@go-to-k/cdkd 0.283.26 → 0.283.28

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as resolveAutoAssetStorage, A as cyan, An as LocalMigrateError, At as loadPublishableAssetManifest, B as findSilentDropProperties, Bn as StackTerminationProtectionError, Bt as buildDenyExternalAccessPolicy, C as makeCanonicalizePropertiesFn, Cn as setAwsClients, Ct as rebuildClientForBucketRegion, D as renderStatefulReason, Dt as WorkGraph, E as isStatefulRecreateTargetSync, Et as stringifyValue, F as IAMRoleProvider, Fn as PartialFailureError, Ft as ensureAssetStorage, G as IntrinsicFunctionResolver, Gn as normalizeAwsError, Gt as runDockerStreaming, H as slowCcOperationTimeoutMs, Ht as formatDockerLoginError, I as collectInlinePolicyNamesManagedBySiblings, In as ProvisioningError, It as getBootstrapMarkerKey, J as refStateLookupFromResource, Jn as isRetryableTransientError, Jt as Synthesizer, K as cfnRefValueFromPhysicalId, Kn as withErrorHandling, Kt as AssetManifestLoader, L as clearOnUpdateRemoval, Ln as ResourceTimeoutError, Lt as parseBootstrapMarker, M as green, Mt as escapeRegExp, N as red, Nn as MissingCdkCliError, Nt as AssetModeResolver, O as formatResourceLine, On as DeployCancelledError, Ot as buildAssetRedirectMap, P as yellow, Pn as NestedStackChildDirectDestroyError, Pt as BOOTSTRAP_MARKER_PREFIX, Q as assertRegionMatch, Qt as resolveApp, R as ProviderRegistry, Rn as ResourceUpdateNotSupportedError, Rt as validateAssetBucketName, S as unsupportedFinalSnapshotError, Sn as resetAwsClients, St as S3StateBackend, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as CdkdError, Tt as AssetPublisher, U as disableInstanceApiTermination, Ut as getDockerCmd, V as CloudControlProvider, Vt as buildDockerImage, W as isTerminationProtectionPropagationError, Wt as runDockerForeground, X as normalizeAwsTagsToCfn, Xn as markNonRetryable, Xt as getDefaultStateBucketName, Y as WAFv2WebACLProvider, Yn as isThrottlingError, Yt as synthesisStatusMessage, Z as resolveExplicitPhysicalId, Zt as getLegacyStateBucketName, _ as buildFinalSnapshotIdentifier, _n as processStackMessages, _t as describeTypeWithThrottleRetry, a as DeploymentEventsStore, an as stateBucketExistenceConfirmed, at as requireConfigObject, b as isFinalSnapshotError, bn as AwsClients, bt as TemplateParser, c as replayFailedOperations, cn as CFN_TEMPLATE_URL_LIMIT, ct as redactSecretsForState, d as deleteSkipReason, dn as uploadCfnTemplate, dt as s3BucketDomainName, en as resolveCaptureObservedState, et as configBooleanRefusal, f as withResourceDeadline, fn as expectedOwnerParam, ft as s3BucketDualStackDomainName, g as PRE_DELETE_SNAPSHOT_TYPES, gn as AssemblyReader, gt as DiffCalculator, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as derivePartitionAndUrlSuffix, ht as applyRoleArnIfSet, i as DeploymentEventsReader, in as resolveUseCdkBootstrapAssets, it as requireConfigArray, j as gray, jn as LocalStartServiceError, jt as rewriteTemplateAssetReferences, k as bold, kn as LocalInvokeBuildError$1, kt as createAssetRedirectResolver, l as replayRollback, ln as MIGRATE_TMP_PREFIX, lt as scrubResourceRecord, m as computeImplicitDeleteEdges, mn as canonicalizeRegion, mt as s3BucketWebsiteUrl, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveStateBucketWithDefault, nt as readConfigString, o as planFailedOps, on as warnDeprecatedNoPrefixCliFlag, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as PARTITION_TABLE, pt as s3BucketRegionalDomainName, q as getAccountInfo, qn as isMarkedNonRetryable, qt as getDockerImageBySourceHash, r as DeployEngine, rn as resolveStateBucketWithDefaultAndSource, rt as replayWarn, s as planRollback, sn as CFN_TEMPLATE_BODY_LIMIT, st as TEMPLATE_SOURCED_READBACK_RULES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveSkipPrefix, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as findLargeInlineResources, ut as s3BucketArn, v as ccRoutedFinalSnapshotError, vt as withRetry, w as extractDeploymentEventError, wt as shouldRetainResource, x as refusesFinalSnapshot, xn as getAwsClients, xt as LockManager, y as createPreDeleteFinalSnapshot, yn as resolveBucketRegion, yt as DagBuilder, z as findActionableSilentDrops, zn as StackHasActiveImportsError, zt as validateContainerRepoName } from "./deploy-engine-B6z9CCAL.js";
+import { $ as coerceCfnBoolean, $t as resolveApp, A as cyan, An as LocalInvokeBuildError$1, At as createAssetRedirectResolver, B as findSilentDropProperties, Bn as StackHasActiveImportsError, Bt as validateContainerRepoName, C as makeCanonicalizePropertiesFn, Cn as resetAwsClients, Ct as S3StateBackend, D as renderStatefulReason, Dt as stringifyValue, E as isStatefulRecreateTargetSync, En as CdkdError, Et as AssetPublisher, F as IAMRoleProvider, Fn as NestedStackChildDirectDestroyError, Ft as BOOTSTRAP_MARKER_PREFIX, G as IntrinsicFunctionResolver, Gt as runDockerForeground, H as slowCcOperationTimeoutMs, Ht as buildDockerImage, I as collectInlinePolicyNamesManagedBySiblings, In as PartialFailureError, It as ensureAssetStorage, J as refStateLookupFromResource, Jn as isMarkedNonRetryable, Jt as getDockerImageBySourceHash, K as cfnRefValueFromPhysicalId, Kn as normalizeAwsError, Kt as runDockerStreaming, L as clearOnUpdateRemoval, Ln as ProvisioningError, Lt as getBootstrapMarkerKey, M as green, Mn as LocalStartServiceError, Mt as rewriteTemplateAssetReferences, N as red, Nt as escapeRegExp, O as formatResourceLine, Ot as WorkGraph, P as yellow, Pn as MissingCdkCliError, Pt as AssetModeResolver, Q as assertRegionMatch, Qt as getLegacyStateBucketName, R as ProviderRegistry, Rn as ResourceTimeoutError, Rt as parseBootstrapMarker, S as unsupportedFinalSnapshotError, Sn as getAwsClients, St as LockManager, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tt as shouldRetainResource, U as disableInstanceApiTermination, Ut as formatDockerLoginError, V as CloudControlProvider, Vn as StackTerminationProtectionError, Vt as buildDenyExternalAccessPolicy, W as isTerminationProtectionPropagationError, Wt as getDockerCmd, X as normalizeAwsTagsToCfn, Xn as isThrottlingError, Xt as synthesisStatusMessage, Y as WAFv2WebACLProvider, Yn as isRetryableTransientError, Yt as Synthesizer, Z as resolveExplicitPhysicalId, Zn as markNonRetryable, Zt as getDefaultStateBucketName, _ as buildFinalSnapshotIdentifier, _n as AssemblyReader, _t as INTRINSIC_KEYS, a as DeploymentEventsStore, an as resolveUseCdkBootstrapAssets, at as requireConfigObject, b as isFinalSnapshotError, bn as resolveBucketRegion, bt as DagBuilder, c as replayFailedOperations, cn as CFN_TEMPLATE_BODY_LIMIT, ct as redactSecretsForState, d as deleteSkipReason, dn as findLargeInlineResources, dt as s3BucketDomainName, en as resolveAutoAssetStorage, et as configBooleanRefusal, f as withResourceDeadline, fn as uploadCfnTemplate, ft as s3BucketDualStackDomainName, g as PRE_DELETE_SNAPSHOT_TYPES, gn as derivePartitionAndUrlSuffix, gt as DiffCalculator, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as canonicalizeRegion, ht as applyRoleArnIfSet, i as DeploymentEventsReader, in as resolveStateBucketWithDefaultAndSource, it as requireConfigArray, j as gray, jn as LocalMigrateError, jt as loadPublishableAssetManifest, k as bold, kn as DeployCancelledError, kt as buildAssetRedirectMap, l as replayRollback, ln as CFN_TEMPLATE_URL_LIMIT, lt as scrubResourceRecord, m as computeImplicitDeleteEdges, mn as PARTITION_TABLE, mt as s3BucketWebsiteUrl, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveSkipPrefix, nt as readConfigString, o as planFailedOps, on as stateBucketExistenceConfirmed, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as expectedOwnerParam, pt as s3BucketRegionalDomainName, q as getAccountInfo, qn as withErrorHandling, qt as AssetManifestLoader, r as DeployEngine, rn as resolveStateBucketWithDefault, rt as replayWarn, s as planRollback, sn as warnDeprecatedNoPrefixCliFlag, st as TEMPLATE_SOURCED_READBACK_RULES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveCaptureObservedState, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as MIGRATE_TMP_PREFIX, ut as s3BucketArn, v as ccRoutedFinalSnapshotError, vn as processStackMessages, vt as describeTypeWithThrottleRetry, w as extractDeploymentEventError, wn as setAwsClients, wt as rebuildClientForBucketRegion, x as refusesFinalSnapshot, xn as AwsClients, xt as TemplateParser, y as createPreDeleteFinalSnapshot, yt as withRetry, z as findActionableSilentDrops, zn as ResourceUpdateNotSupportedError, zt as validateAssetBucketName } from "./deploy-engine-5rA6lMn8.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CshsD-Pi.js";
+import { t as ASGProvider } from "./asg-provider-DzaowTd_.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -13989,6 +13989,209 @@ function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-warm-throughput.ts
+/**
+* The two DynamoDB `WarmThroughput` rules that `AWS::DynamoDB::Table` and
+* `AWS::DynamoDB::GlobalTable` both need, in ONE spelling.
+*
+* `WarmThroughput` is the same CloudFormation block on both types, and both
+* providers have to answer the same two questions about it before an
+* `UpdateTable` / `CreateTable` goes out:
+*
+*  1. **Is this block SENDABLE, and as what numbers?** CloudFormation is
+*     stringly typed, so `{ReadUnitsPerSecond: '12000'}` — or anything that
+*     came back from an `Fn::Sub` — arrives as a STRING and must not be
+*     forwarded verbatim into a numeric `Long` field.
+*  2. **Would sending it LOWER what AWS already reports?** Warm throughput
+*     only ever rises with a table's traffic and AWS REJECTS a call that
+*     lowers it (`decreasing WarmThroughput is not supported`, measured live
+*     us-east-1 2026-08-13 for issue #1768).
+*
+* **Provenance, stated precisely because it is easy to over-claim.** Exactly
+* ONE of these rules ever shipped: `AWS::DynamoDB::Table` got them in PR #1808
+* (issues #1760 / #1768), and the `AWS::DynamoDB::GlobalTable` side never
+* existed outside the change that created this file (issue #1857). So this is
+* the Table rule LIFTED — not two shipped rules reconciled, and no deployed
+* behaviour changed for either type when it moved here.
+*
+* What WAS compared is the lifted rule against the GlobalTable spelling
+* drafted alongside it, over the shapes both had to answer (a quoted numeric
+* string, a partially usable block, a mixed decrease/increase, an absent live
+* value, a zero, a negative, a non-numeric string, a whitespace string, an
+* explicit `undefined` / `null`, a boolean, an empty block, a scalar, an
+* array). {@link isWarmThroughputDecrease} agreed on every one; the coercion
+* agreed on all but a whitespace-only string, where a bare `Number('   ')` is
+* `0` rather than `NaN`. This module keeps the REFUSING answer for that shape,
+* since `'   '` is not a capacity anyone declared and a warm throughput of 0
+* is not a request AWS can honour. That is a DRAFT reconciled against a
+* shipped rule, which is worth less than two shipped rules agreeing — the
+* reason to read the probe list as a design note rather than as field
+* evidence.
+*
+* Living here rather than in either provider is the point. A decrease guard is
+* three clauses that all FAIL OPEN for different reasons, and two files
+* spelling it independently is two chances for a later "fix" to change one of
+* them — at which point the sibling type silently keeps the old answer, and
+* nothing in the tree says which is intended. Same class as
+* `emr-configuration.ts`, and the same reason.
+*
+* Deliberately NOT here: everything only ONE provider has. The `Table` side's
+* `isSendableWarmThroughput` / `isRefusedWarmThroughput` /
+* `declaresWarmThroughput` / `warmThroughputAlreadyMatches` are its drift-side
+* and already-matches gates, which `GlobalTable` has no counterpart to (issue
+* #1742 strips the per-index `WarmThroughput` from BOTH of its drift
+* comparison sides unconditionally, so drift never asks the question there);
+* the `GlobalTable` side's `warmThroughputDiagnostic` builds a
+* `ThroughputDiagnostic` that only that provider's collector understands.
+* Moving a helper with one caller here would buy nothing and cost a hop.
+*
+* Issues: #1760 / #1768 (Table, PR #1808), #1857 (GlobalTable).
+*/
+/**
+* The two `WarmThroughput` members, in the ONE order every message, every
+* comparison and every emitted block uses. A shared order is what makes two
+* blocks carrying the same numbers compare equal by `deepEqual` and serialize
+* to the same wire bytes regardless of the order the template wrote them in.
+*/
+const WARM_THROUGHPUT_MEMBERS = ["ReadUnitsPerSecond", "WriteUnitsPerSecond"];
+/**
+* A CloudFormation-borne numeric property, or `undefined` when the value is
+* not a usable number.
+*
+* Plain `Number()` coercion is NOT good enough and the tree learned it three
+* separate times: `Number(null)`, `Number('')`, `Number([])`, `Number(false)`
+* and `Number('   ')` are all **0**, not `NaN` — so a live `0` would compare
+* EQUAL to a desired `null` / `''` / `[]` / `false`, and a whitespace-only
+* string would be forwarded as a request for zero units.
+*
+* A YAML-borne numeric STRING is still accepted, because that is a real
+* template shape and `'12000'` genuinely means 12000.
+*
+* EXPORTED, and not because warm throughput needs it exported. This exact rule
+* was hand-written three times — here, as `dynamodb-table-provider.ts`'s
+* `capacityNumber` (byte-identical), and as `dynamodb-globaltable-provider.ts`'s
+* `toFiniteNumber` (a different spelling of the same total function) — which is
+* precisely the divergence this module exists to stop: the next "fix" to one of
+* them would have left the other two answering differently, with nothing in the
+* tree saying which was intended. It reads `ReadCapacityUnits` /
+* `MaxReadRequestUnits` / `MinCapacity` as readily as it reads
+* `ReadUnitsPerSecond`; there is only ever one right answer for "is this
+* stringly-typed CFn value a number I can send?".
+*/
+function toFiniteNumber(value) {
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value === "string" && value.trim() !== "") {
+		const n = Number(value);
+		return Number.isFinite(n) ? n : void 0;
+	}
+}
+/**
+* Coerce a CFn `WarmThroughput` block to the numeric shape the SDK's `Long`
+* fields accept, PER MEMBER.
+*
+* PER MEMBER, not whole-block, and that distinction is the point: a block
+* whose write half is an unresolved intrinsic still has a perfectly good read
+* half, and dropping both would silently discard a value the template really
+* did ask for. The dropped member is NAMED (`droppedMembers`) so the caller's
+* warning can say which half went missing instead of reporting the whole
+* property.
+*
+* A block with NO usable member yields `spec: undefined` — refused rather than
+* forwarded, because forwarding a malformed block surfaces as an opaque AWS
+* validation error naming neither cdkd nor the property. `droppedMembers` is
+* still populated in that case, so a REFUSAL message can name what it refused;
+* a block that is not an object at all (an unresolved `Fn::If`, a scalar, an
+* array) has no member to name and reports none, which is what lets a caller
+* word "one half went missing" differently from "the block is unusable".
+*
+* Pure: takes the raw bag, returns numbers, logs nothing. Each caller owns its
+* own message, so the wording stays consistent across that provider's send
+* sites without forcing one wording across both providers.
+*/
+function coerceWarmThroughput$1(raw) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return { droppedMembers: [] };
+	const bag = raw;
+	const spec = {};
+	const droppedMembers = [];
+	for (const member of WARM_THROUGHPUT_MEMBERS) {
+		if (bag[member] === void 0) continue;
+		const coerced = toFiniteNumber(bag[member]);
+		if (coerced === void 0) {
+			droppedMembers.push(member);
+			continue;
+		}
+		spec[member] = coerced;
+	}
+	if (Object.keys(spec).length === 0) return { droppedMembers };
+	return {
+		spec,
+		droppedMembers
+	};
+}
+/**
+* Whether the COERCED desired `WarmThroughput` would LOWER what AWS already
+* reports.
+*
+* Measured live (us-east-1, 2026-08-13, issue #1768) against a table AWS
+* reports `{ReadUnitsPerSecond: 12000, WriteUnitsPerSecond: 4000}` for:
+*
+* ```
+* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000, WriteUnitsPerSecond: 2000}
+*   ValidationException: One or more parameter values were invalid: Requested
+*   ReadUnitsPerSecond for WarmThroughput for table is lower than current
+*   WarmThroughput, decreasing WarmThroughput is not supported
+* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000}      -> same rejection
+* UpdateTable WarmThroughput={WriteUnitsPerSecond: 2000}     -> same rejection, naming WriteUnitsPerSecond
+* UpdateTable WarmThroughput={12000, 4000}  (re-assert)      -> ACCEPTED
+* ```
+*
+* So the value is one AWS raises with the table's traffic and never lowers,
+* and a decrease is REJECTED rather than accepted-and-ignored — which is what
+* had to be measured before choosing, because the two produce different
+* correct answers. The caller SKIPS the call on a true here.
+*
+* Evaluated on the COERCED spec, never on the raw bag: analysing the raw bag
+* makes the verdict describe a request that is not the one being sent (a
+* dropped member is not part of the call and must not be part of the
+* comparison).
+*
+* Semantics, all three chosen to FAIL OPEN — i.e. to let the call through and
+* leave AWS as the authority — because a false positive here silently drops a
+* legitimate INCREASE, which is a real capacity change the user asked for,
+* while a false negative merely reproduces the pre-fix behaviour of an
+* AWS-side rejection that names the property:
+*  - DECLARED members only. An absent member is not a request to lower
+*    anything, so it takes no part in the verdict.
+*  - MIXED is not a decrease. One member below live and the other above means
+*    the call carries a genuine increase; AWS decides.
+*  - An absent or unusable LIVE counterpart is not a decrease. Without a
+*    number to compare against there is no evidence of one. Only the LIVE side
+*    can reach that arm: the desired side is a COERCED spec, so a malformed
+*    template value has already been dropped by {@link coerceWarmThroughput}.
+*
+* A decrease therefore requires every declared member to be at-or-below live
+* AND at least one to be strictly below.
+*
+* The skip this drives is right for EVERY `update()` caller — the deploy
+* engine, `cdkd drift --revert`, and the rollback executor's two revert arms —
+* because none of them can make AWS lower the value, so none loses anything a
+* doomed call would have achieved.
+*/
+function isWarmThroughputDecrease(desired, live) {
+	if (desired === void 0 || live === void 0) return false;
+	let sawDecrease = false;
+	for (const member of WARM_THROUGHPUT_MEMBERS) {
+		if (desired[member] === void 0) continue;
+		const wanted = toFiniteNumber(desired[member]);
+		const current = toFiniteNumber(live[member]);
+		if (wanted === void 0 || current === void 0) return false;
+		if (wanted > current) return false;
+		if (wanted < current) sawDecrease = true;
+	}
+	return sawDecrease;
+}
+
 //#endregion
 //#region src/provisioning/providers/dynamodb-table-provider.ts
 /**
@@ -14091,28 +14294,6 @@ function hasUsableTableCapacity(value) {
 	return true;
 }
 /**
-* A capacity member, or `undefined` when the value is not a usable number.
-*
-* `Number()` coercion is NOT good enough here and the first draft of this
-* helper shipped that bug: `Number(null)`, `Number('')`, `Number([])` and
-* `Number(false)` are all **0**, not `NaN` — so a live `0` would have compared
-* EQUAL to a desired `null` / `''` / `[]` / `false` and suppressed the call.
-* The blast radius on DynamoDB is small (a PROVISIONED index's capacity is
-* always >= 1), but the rule this encodes is copied to other providers, so it
-* is spelled correctly rather than relying on the type that happens to be
-* unreachable today.
-*
-* A YAML-borne numeric STRING is still accepted, because that is a real
-* template shape and `'5'` genuinely means 5.
-*/
-function capacityNumber(value) {
-	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
-	if (typeof value === "string" && value.trim() !== "") {
-		const n = Number(value);
-		return Number.isFinite(n) ? n : void 0;
-	}
-}
-/**
 * Does the capacity AWS currently holds for a GSI already equal the pair the
 * template requests? (issue #1630)
 *
@@ -14131,10 +14312,10 @@ function capacityNumber(value) {
 */
 function liveCapacityAlreadyMatches(live, requested) {
 	if (live === void 0) return false;
-	const liveRead = capacityNumber(live.ReadCapacityUnits);
-	const liveWrite = capacityNumber(live.WriteCapacityUnits);
-	const wantRead = capacityNumber(requested.ReadCapacityUnits);
-	const wantWrite = capacityNumber(requested.WriteCapacityUnits);
+	const liveRead = toFiniteNumber(live.ReadCapacityUnits);
+	const liveWrite = toFiniteNumber(live.WriteCapacityUnits);
+	const wantRead = toFiniteNumber(requested.ReadCapacityUnits);
+	const wantWrite = toFiniteNumber(requested.WriteCapacityUnits);
 	if (liveRead === void 0 || liveWrite === void 0) return false;
 	if (wantRead === void 0 || wantWrite === void 0) return false;
 	return liveRead === wantRead && liveWrite === wantWrite;
@@ -14182,8 +14363,10 @@ const BILLING_FLIP_ACTIVE_WAIT_ATTEMPTS = 600;
 * Still not `!== undefined`, and still ONE spelling for the write sites and the
 * drift side both: a value this refuses is a value cdkd does not send, so the
 * readback must not emit AWS's computed value as though the template had asked
-* for it. A YAML-borne numeric STRING is accepted, via {@link capacityNumber},
-* because `'12000'` genuinely means 12000.
+* for it. A YAML-borne numeric STRING is accepted, by the shared coercion's own
+* number reader ({@link toFiniteNumber}, in `../dynamodb-warm-throughput.ts` —
+* the one this file's capacity paths read too), because `'12000'` genuinely
+* means 12000.
 */
 function isSendableWarmThroughput(value) {
 	return coerceWarmThroughput(value) !== void 0;
@@ -14204,8 +14387,9 @@ function isSendableWarmThroughput(value) {
 * over), and it makes the quoted form WORK instead of merely warning.
 *
 * Per MEMBER, so a bad one cannot take a good one with it, and never `NaN`:
-* {@link capacityNumber} accepts a number or a numeric string and rejects
-* everything else, so a member that does not resolve is OMITTED from the spec
+* the shared coercion's number reader is {@link toFiniteNumber} — a number or
+* a numeric string, everything else rejected — so a member that
+* does not resolve is OMITTED from the spec
 * and reported in `dropped` for the caller to announce. AWS accepts a
 * one-member `WarmThroughput` (measured us-east-1, 2026-08-13: an
 * `UpdateTable` carrying only `ReadUnitsPerSecond` is a valid request shape —
@@ -14244,27 +14428,22 @@ function isSendableWarmThroughput(value) {
 * the comparator's `deepEqual` is strict about that. It is the generic
 * stringly-typed-CFn class (every numeric property has it), not something this
 * coercion can reach from the write side.
+*
+* The RULE moved to `../dynamodb-warm-throughput.ts` when
+* `AWS::DynamoDB::GlobalTable` needed the same one (issue #1857); this is the
+* local adapter onto the shape this file's four call sites already read, so
+* the behaviour, the signature and the tests are unchanged. The shared
+* coercion always reports `droppedMembers`, including on a total refusal —
+* that arm is unreachable from here, since a `usable === 0` outcome maps to
+* `undefined` and the names go with it, which is exactly what this file did
+* before.
 */
 function coerceWarmThroughput(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
-	const bag = value;
-	const spec = {};
-	const dropped = [];
-	let usable = 0;
-	for (const member of ["ReadUnitsPerSecond", "WriteUnitsPerSecond"]) {
-		if (bag[member] === void 0) continue;
-		const n = capacityNumber(bag[member]);
-		if (n === void 0) {
-			dropped.push(member);
-			continue;
-		}
-		spec[member] = n;
-		usable++;
-	}
-	if (usable === 0) return void 0;
+	const { spec, droppedMembers } = coerceWarmThroughput$1(value);
+	if (spec === void 0) return void 0;
 	return {
 		spec,
-		dropped
+		dropped: [...droppedMembers]
 	};
 }
 /**
@@ -14337,60 +14516,6 @@ function declaresWarmThroughput(properties) {
 	return properties !== void 0 && isSendableWarmThroughput(properties["WarmThroughput"]);
 }
 /**
-* Is the WarmThroughput this update would SEND a DECREASE of what AWS already
-* holds (issue #1768)?
-*
-* Measured live (us-east-1, 2026-08-13) against a table AWS reports
-* `{ReadUnitsPerSecond: 12000, WriteUnitsPerSecond: 4000}` for:
-*
-* ```
-* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000, WriteUnitsPerSecond: 2000}
-*   ValidationException: One or more parameter values were invalid: Requested
-*   ReadUnitsPerSecond for WarmThroughput for table is lower than current
-*   WarmThroughput, decreasing WarmThroughput is not supported
-* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000}      -> same rejection
-* UpdateTable WarmThroughput={WriteUnitsPerSecond: 2000}     -> same rejection, naming WriteUnitsPerSecond
-* UpdateTable WarmThroughput={12000, 4000}  (re-assert)      -> ACCEPTED
-* ```
-*
-* So the value is one AWS raises with the table's traffic and never lowers,
-* and a decrease is REJECTED rather than accepted-and-ignored — which is what
-* the issue said to measure before choosing, because the two produce different
-* correct answers. The caller SKIPS the call on a true here.
-*
-* Rules, each one chosen so the skip is right for EVERY `update()` caller
-* (the deploy engine, `cdkd drift --revert`, and the rollback executor's two
-* revert arms — none of which can make AWS lower the value, so none of them
-* loses anything a doomed call would have achieved):
-*
-* - Only the members the desired side DECLARES are examined; an omitted member
-*   is not sent and cannot be a decrease.
-* - EVERY declared member must be at-or-below its live counterpart AND at
-*   least one strictly below. A MIXED request (one member up, one down) still
-*   goes out: AWS rejects it by name, which is the pre-fix behavior and better
-*   than silently dropping the increase the user asked for.
-* - Anything not resolvable to a finite number fails OPEN (the call is still
-*   issued): the worst case is the pre-fix behavior, whereas a false positive
-*   would silently drop a real increase. Only the LIVE side can actually reach
-*   that arm now (PR review round 8): the desired side is a COERCED spec, so a
-*   malformed template value or an unresolved intrinsic has already been
-*   dropped by {@link coerceWarmThroughput} and cannot arrive here. The check
-*   is kept for the live side, which is whatever `DescribeTable` returned.
-*/
-function isWarmThroughputDecrease(desired, live) {
-	if (live === void 0) return false;
-	let sawDecrease = false;
-	for (const member of ["ReadUnitsPerSecond", "WriteUnitsPerSecond"]) {
-		if (desired[member] === void 0) continue;
-		const wanted = capacityNumber(desired[member]);
-		const current = capacityNumber(live[member]);
-		if (wanted === void 0 || current === void 0) return false;
-		if (wanted > current) return false;
-		if (wanted < current) sawDecrease = true;
-	}
-	return sawDecrease;
-}
-/**
 * Does the warm throughput AWS currently holds already equal what this update
 * would request (issue #1768 PR review)?
 *
@@ -14419,10 +14544,10 @@ function isWarmThroughputDecrease(desired, live) {
 function warmThroughputAlreadyMatches(desired, live) {
 	if (live === void 0) return false;
 	let compared = 0;
-	for (const member of ["ReadUnitsPerSecond", "WriteUnitsPerSecond"]) {
+	for (const member of WARM_THROUGHPUT_MEMBERS) {
 		if (desired[member] === void 0) continue;
-		const wanted = capacityNumber(desired[member]);
-		const current = capacityNumber(live[member]);
+		const wanted = toFiniteNumber(desired[member]);
+		const current = toFiniteNumber(live[member]);
 		if (wanted === void 0 || current === void 0) return false;
 		if (wanted !== current) return false;
 		compared++;
@@ -15529,7 +15654,7 @@ var DynamoDBTableProvider = class {
 	*/
 	skipZeroCapacityIndexUpdate(indexName, physicalId, requested) {
 		if (requested === void 0) return false;
-		if (capacityNumber(requested.ReadCapacityUnits) !== 0 || capacityNumber(requested.WriteCapacityUnits) !== 0) return false;
+		if (toFiniteNumber(requested.ReadCapacityUnits) !== 0 || toFiniteNumber(requested.WriteCapacityUnits) !== 0) return false;
 		this.logger.warn(`GSI ${indexName} on DynamoDB table ${physicalId}: the requested ProvisionedThroughput is {ReadCapacityUnits: 0, WriteCapacityUnits: 0}, which is AWS's on-demand placeholder rather than a capacity DynamoDB accepts (the minimum is 1), so no per-index throughput update was sent. This usually means the value came from a pre-#1767 cdkd state record — a \`cdkd drift --revert\` of such a record, or a rollback replaying it. Re-run \`cdkd deploy\` (or \`cdkd drift --accept\`) to refresh the record.`);
 		return true;
 	}
@@ -16425,6 +16550,35 @@ var DynamoDBGlobalTableProvider = class {
 		}
 	}
 	/**
+	* The `WarmThroughput` block to put on ONE `GlobalSecondaryIndexUpdate`, or
+	* `undefined` when it must not be sent (issue #1857).
+	*
+	* ONE helper for all three `UpdateTable` send sites — the billing-flip
+	* ride-along, the `added` loop's `Create`, and the `modified` loop's
+	* `Update` — because three copies of a decrease guard is three chances to
+	* word one differently, and the whole point of {@link isWarmThroughputDecrease}
+	* is that the answer does not depend on which site asked.
+	*
+	* The `desired` argument is already COERCED (`toSdkGlobalSecondaryIndexes`
+	* did it), so an unusable block never reaches here at all: it was refused
+	* and reported during translation, and arrives as `undefined`. What is left
+	* for this helper is the one question translation cannot answer, because it
+	* needs live AWS state: would this call LOWER what AWS reports?
+	*
+	* The refusal is a WARN and a dropped member, not a throw. A decrease is a
+	* template that has fallen behind a value AWS grew on its own; failing the
+	* deploy over it would block every unrelated change to the same table, and
+	* there is no template edit that "fixes" it other than raising a number the
+	* user never chose.
+	*/
+	warmThroughputForSend(indexName, desired, liveWarmByIndexName, logicalId, physicalId) {
+		if (!desired) return void 0;
+		const live = liveWarmByIndexName.get(indexName);
+		if (!isWarmThroughputDecrease(desired, live)) return desired;
+		const format = (spec) => WARM_THROUGHPUT_MEMBERS.filter((m) => spec?.[m] !== void 0).map((m) => `${m}=${spec?.[m]}`).join(", ");
+		this.logger.warn(`DynamoDB GlobalTable ${logicalId}: GSI '${indexName}' on ${physicalId}: WarmThroughput was NOT sent — the template asks for ${format(desired)} while AWS reports ${format(live)}, and DynamoDB rejects a decrease ("decreasing WarmThroughput is not supported"). Warm throughput only rises with a table's traffic, so a template below the live value can never be applied; raise it to at least the live value, or remove it. Every other change to this index is applied normally.`);
+	}
+	/**
 	* Add a single replica region. Issues one `UpdateTableCommand` with
 	* `ReplicaUpdates: [{ Create: { RegionName, ... } }]` and polls
 	* `DescribeTable` until the replica's `ReplicaStatus` flips to ACTIVE.
@@ -16510,6 +16664,16 @@ var DynamoDBGlobalTableProvider = class {
 				return (props["Replicas"] ?? []).find((r) => r["Region"] === currentRegion)?.["Tags"];
 			};
 			if (tableArn) await this.applyTagDiff(tableArn, extractLocalTags(previousProperties), extractLocalTags(properties));
+			const liveWarmByIndexName = /* @__PURE__ */ new Map();
+			for (const liveGsi of describeResp.Table?.GlobalSecondaryIndexes ?? []) {
+				const name = liveGsi.IndexName;
+				const warm = liveGsi.WarmThroughput;
+				if (typeof name !== "string" || !warm) continue;
+				const spec = {};
+				if (warm.ReadUnitsPerSecond !== void 0) spec.ReadUnitsPerSecond = warm.ReadUnitsPerSecond;
+				if (warm.WriteUnitsPerSecond !== void 0) spec.WriteUnitsPerSecond = warm.WriteUnitsPerSecond;
+				if (Object.keys(spec).length > 0) liveWarmByIndexName.set(name, spec);
+			}
 			const recordedOldBilling = previousProperties["BillingMode"];
 			const recordedOldBillingAbsent = recordedOldBilling === void 0;
 			const recordedOldBillingUsable = typeof recordedOldBilling === "string" && recordedOldBilling.trim() !== "";
@@ -16659,11 +16823,11 @@ var DynamoDBGlobalTableProvider = class {
 						const gsi = byIndexName.get(indexName);
 						if (!gsi?.ProvisionedThroughput) continue;
 						const previousWarm = previousByIndexName.get(indexName)?.WarmThroughput;
-						const warmChanged = gsi.WarmThroughput !== void 0 && !deepEqual$1(gsi.WarmThroughput, previousWarm);
+						const warmToSend = gsi.WarmThroughput !== void 0 && !deepEqual$1(gsi.WarmThroughput, previousWarm) ? this.warmThroughputForSend(indexName, gsi.WarmThroughput, liveWarmByIndexName, logicalId, physicalId) : void 0;
 						indexUpdates.push({ Update: {
 							IndexName: indexName,
 							ProvisionedThroughput: gsi.ProvisionedThroughput,
-							...warmChanged && { WarmThroughput: gsi.WarmThroughput }
+							...warmToSend && { WarmThroughput: warmToSend }
 						} });
 						if (survivingIndexNames.has(indexName)) gsiHandledByBillingFlip.add(indexName);
 					}
@@ -16798,13 +16962,14 @@ var DynamoDBGlobalTableProvider = class {
 			}
 			for (const gsi of gsiDiff.added) {
 				if (!gsi.IndexName || !gsi.KeySchema || !gsi.Projection) continue;
+				const addedWarmToSend = this.warmThroughputForSend(gsi.IndexName, gsi.WarmThroughput, liveWarmByIndexName, logicalId, physicalId);
 				const gsiUpdate = { Create: {
 					IndexName: gsi.IndexName,
 					KeySchema: gsi.KeySchema,
 					Projection: gsi.Projection,
 					...gsi.ProvisionedThroughput && { ProvisionedThroughput: gsi.ProvisionedThroughput },
 					...gsi.OnDemandThroughput && { OnDemandThroughput: gsi.OnDemandThroughput },
-					...gsi.WarmThroughput && { WarmThroughput: gsi.WarmThroughput }
+					...addedWarmToSend && { WarmThroughput: addedWarmToSend }
 				} };
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
@@ -16831,9 +16996,14 @@ var DynamoDBGlobalTableProvider = class {
 				if (Object.keys(onDemand).length > 0) update.OnDemandThroughput = onDemand;
 				if (!billingFlipped && gsi.ProvisionedThroughput) update.ProvisionedThroughput = gsi.ProvisionedThroughput;
 				const previousSdk = previousSdkByName.get(gsi.IndexName);
-				if (gsi.WarmThroughput !== void 0 && !deepEqual$1(gsi.WarmThroughput, previousSdk?.WarmThroughput)) update.WarmThroughput = gsi.WarmThroughput;
+				let warmDecreaseRefused = false;
+				if (gsi.WarmThroughput !== void 0 && !deepEqual$1(gsi.WarmThroughput, previousSdk?.WarmThroughput)) {
+					const warmToSend = this.warmThroughputForSend(gsi.IndexName, gsi.WarmThroughput, liveWarmByIndexName, logicalId, physicalId);
+					if (warmToSend) update.WarmThroughput = warmToSend;
+					else warmDecreaseRefused = true;
+				}
 				if (!update.ProvisionedThroughput && !update.OnDemandThroughput && !update.WarmThroughput) {
-					if (!billingFlipped && unresolvedMembers.length === 0) this.logger.warn(`GSI '${gsi.IndexName}' on ${physicalId} changed in a way DynamoDB's UpdateTable cannot express (KeySchema / Projection are immutable on an existing index). Recreate the index under a new name to apply the change.`);
+					if (!billingFlipped && unresolvedMembers.length === 0 && !warmDecreaseRefused) this.logger.warn(`GSI '${gsi.IndexName}' on ${physicalId} changed in a way DynamoDB's UpdateTable cannot express (KeySchema / Projection are immutable on an existing index). Recreate the index under a new name to apply the change.`);
 					continue;
 				}
 				const gsiUpdate = { Update: update };
@@ -17310,9 +17480,27 @@ var DynamoDBGlobalTableProvider = class {
 		try {
 			if (hasTransitionalIndex(preDeleteIndexes)) {
 				this.logger.debug(`Waiting for indexes on ${physicalId} to settle before DeleteTable (issue #1521)`);
-				await this.waitForIndexesActive(physicalId, logicalId);
+				await this.waitForIndexesActive(physicalId, logicalId, { proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE });
 			}
-			await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: physicalId }));
+			let deleteAttempts = 0;
+			await withRetry(async () => {
+				if (deleteAttempts++ > 0) {
+					if (deleteAttempts === 2) {
+						const remainingAttempts = 1 + DELETE_INDEX_BUSY_MAX_RETRIES - deleteAttempts;
+						this.logger.warn(`DynamoDB GlobalTable ${logicalId}: AWS refused DeleteTable on ${physicalId} because a global secondary index is still being created, updated or deleted — application auto-scaling can start an index capacity change at any moment, including during this destroy. Waiting for the index to settle and retrying (up to ${remainingAttempts} more attempts, each preceded by up to ${DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS} DescribeTable polls ~1s apart — a little over a minute of settling per attempt). Nothing is wrong with the table; a large index backfill can outlast this budget, in which case the destroy fails with AWS's own message and re-running it succeeds once the index is ACTIVE.`);
+					}
+					await this.waitForIndexesActive(physicalId, logicalId, {
+						maxAttempts: DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS,
+						proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE
+					});
+				}
+				await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: physicalId }));
+			}, logicalId, {
+				maxRetries: DELETE_INDEX_BUSY_MAX_RETRIES,
+				isRetryable: (message) => isIndexBusyDeleteError(message),
+				logger: this.logger,
+				sleep: (ms) => deleteTableRetryDelays.sleep ? deleteTableRetryDelays.sleep(ms) : new Promise((resolve) => setTimeout(resolve, ms))
+			});
 			await this.waitForTableGone(physicalId, logicalId);
 			this.logger.debug(`Successfully deleted DynamoDB GlobalTable ${logicalId}`);
 		} catch (error) {
@@ -17928,22 +18116,49 @@ var DynamoDBGlobalTableProvider = class {
 	* throwing. A missed registration self-heals on the next deploy (the
 	* reconcile re-asserts anything not already present), whereas throwing
 	* here would fail a deploy whose actual resources are all correct. Index
-	* backfill on a large table can take a long time, hence the 15-minute cap.
-	* The caller that follows it with a mutating call keeps AWS's own error as
-	* the backstop for the case where even that cap is not enough.
-	*/
-	async waitForIndexesActive(tableName, logicalId) {
-		const maxAttempts = 900;
+	* backfill on a large table can take a long time, hence the 15-minute
+	* DEFAULT cap. The caller that follows it with a mutating call keeps AWS's
+	* own error as the backstop for the case where even that cap is not enough.
+	*
+	* `opts.maxAttempts` exists because the cap is only right for a wait that
+	* runs ONCE: the #1830 delete retry re-runs this per attempt, so the caller's
+	* wall clock is the product and the default would blow past the per-resource
+	* deadline `destroy-runner.ts` enforces.
+	*
+	* `opts.proceedNote` covers the OTHER thing that is caller-specific: what it
+	* costs when the wait ends WITHOUT confirming. Both arms that end that way —
+	* the timeout, and a `DescribeTable` that failed for a reason other than
+	* throttling or a gone table — stop waiting and let the caller proceed, so
+	* one note serves both. The consequences genuinely differ: on the delete
+	* path AWS refuses the `DeleteTable` and that refusal is the backstop, while
+	* the auto-scaling caller has NO backstop — `reconcileAutoScalingTargets`
+	* simply skips an index that is not ready and nothing downstream refuses.
+	* The default sentence is the auto-scaling one; every delete-path caller
+	* passes {@link DELETE_INDEX_WAIT_PROCEED_NOTE}.
+	*/
+	async waitForIndexesActive(tableName, logicalId, opts) {
+		const maxAttempts = opts?.maxAttempts ?? 900;
+		const proceedNote = opts?.proceedNote ?? "auto-scaling registration for a still-building index may have been skipped. The next deploy re-asserts it.";
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
 			try {
 				if (!hasTransitionalIndex((await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.GlobalSecondaryIndexes ?? [])) return;
 			} catch (err) {
-				this.logger.debug(`DescribeTable while waiting for indexes on ${tableName}: ${err instanceof Error ? err.message : String(err)}`);
+				const message = err instanceof Error ? err.message : String(err);
+				if (isThrottlingError(err)) {
+					this.logger.debug(`DescribeTable throttled while waiting for indexes on ${tableName} (attempt ${attempt}/${maxAttempts}); still waiting: ${message}`);
+					await new Promise((resolve) => setTimeout(resolve, 1e3));
+					continue;
+				}
+				if (err instanceof ResourceNotFoundException$1) {
+					this.logger.debug(`Table ${tableName} (${logicalId}) no longer exists while waiting for indexes`);
+					return;
+				}
+				this.logger.warn(`DescribeTable failed while waiting for indexes on ${tableName} (${logicalId}), so cdkd stopped waiting; ${proceedNote} DescribeTable error: ${message}`);
 				return;
 			}
 			await new Promise((resolve) => setTimeout(resolve, 1e3));
 		}
-		this.logger.warn(`Indexes on ${tableName} (${logicalId}) did not all reach ACTIVE within ${maxAttempts}s; auto-scaling registration for a still-building index may have been skipped. The next deploy re-asserts it.`);
+		this.logger.warn(`Indexes on ${tableName} (${logicalId}) did not all reach ACTIVE within ${maxAttempts} DescribeTable polls (~1s apart, so a little over ${maxAttempts}s of wall clock); ${proceedNote}`);
 	}
 	/**
 	* Wait until a specific replica's `ReplicaStatus` flips to ACTIVE.
@@ -18082,6 +18297,14 @@ function autoScalingResourceId(tableName, indexName) {
 */
 const autoScalingRetryDelays = {};
 /**
+* Test seam for the index-busy `DeleteTable` retry's backoff (issue #1830),
+* mirroring {@link autoScalingRetryDelays}. Production leaves `sleep`
+* undefined so `withRetry`'s real schedule applies; a test injects a no-op so
+* the ~47s budget does not have to be waited out. Kept SEPARATE from the
+* auto-scaling seam so a test can slow one path without silencing the other.
+*/
+const deleteTableRetryDelays = {};
+/**
 * Resource ids per `DescribeScalableTargets` request. Kept at the API's
 * documented per-page ceiling rather than a larger guess — the request is
 * paginated anyway, and over-asking risks a `ValidationException` that would
@@ -18235,12 +18458,113 @@ const INDEX_TRANSITIONAL_STATUSES = /* @__PURE__ */ new Set([
 function hasTransitionalIndex(indexes) {
 	return (indexes ?? []).some((gsi) => INDEX_TRANSITIONAL_STATUSES.has(gsi.IndexStatus ?? ""));
 }
-/** Coerce a CFn numeric (CFn is stringly-typed) to a finite number. */
-function toFiniteNumber(value) {
-	if (value === void 0 || value === null || value === "") return void 0;
-	if (typeof value !== "number" && typeof value !== "string") return void 0;
-	const n = Number(value);
-	return Number.isFinite(n) ? n : void 0;
+/**
+* AWS's refusal when `DeleteTable` lands while one of the table's GSIs is
+* mid-transition (issue #1830). Observed verbatim on a real destroy:
+*
+*   Attempt to change a resource which is still in use: Cannot delete table
+*   while indexes are being created, updated, or deleted.
+*
+* Matched on the leading clause rather than on the whole sentence: the
+* trailing status list is AWS wording that can gain a state without changing
+* what the message MEANS, and the leading clause is already specific enough
+* that nothing else in the DynamoDB surface produces it. Case-insensitive
+* because the text arrives inside a wrapper prefix whose casing is not ours.
+*
+* Deliberately NOT keyed on the exception NAME: AWS reports this as a plain
+* `ResourceInUseException`, which is the same name it uses for genuinely
+* terminal conflicts (deleting a table that is `CREATING`, creating one that
+* already exists). Retrying on the name would turn those into a 47s stall
+* before the same failure.
+*/
+const INDEX_BUSY_DELETE_MESSAGE = /cannot delete table while indexes are being/i;
+function isIndexBusyDeleteError(message) {
+	return INDEX_BUSY_DELETE_MESSAGE.test(message);
+}
+/**
+* Retry budget for the index-busy `DeleteTable` refusal (issue #1830).
+*
+* Left at `withRetry`'s own default of 8 rather than raised. Named rather than
+* inlined because passing it at all is what opts this call out of
+* `withRetry`'s dense IAM-propagation schedule, which would be wrong for a
+* condition measured in seconds-to-minutes rather than sub-second.
+*
+* The count MULTIPLIES the per-attempt re-arm poll below, so the two have to
+* be read together — see {@link DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS} for the
+* arithmetic and for why the poll is not the 15-minute one.
+*/
+const DELETE_INDEX_BUSY_MAX_RETRIES = 8;
+/**
+* Seconds the index-busy `DeleteTable` retry spends re-arming BEFORE each
+* retry (issue #1830) — one `DescribeTable` per second, and it returns on the
+* first one that reports every index settled.
+*
+* Bounded well under
+* {@link DynamoDBGlobalTableProvider['waitForIndexesActive']}'s 15-minute
+* default because THAT default is sized for a wait that runs once, while this
+* one runs per retry: the caller's wall clock is
+* `DELETE_INDEX_BUSY_MAX_RETRIES x this + withRetry's ~47s of backoff`, and
+* `destroy-runner.ts` caps a single `delete()` at the per-resource deadline
+* (30 min by default; this provider declares no `getMinResourceTimeoutMs` to
+* lift it). At 900s the product was ~2h, so a genuinely stuck index produced a
+* 30-minute wait ending in a generic `ResourceTimeoutError` that never
+* mentions indexes. At 60s the worst case is ~8.8 min and the user gets AWS's
+* own actionable sentence instead.
+*
+* The FIRST attempt is unaffected — it does not re-arm at all, and the #1521
+* pre-delete gate ahead of the loop keeps its full 15-minute poll.
+*/
+const DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS = 60;
+/**
+* What proceeding costs when a DELETE-path index-settle wait ends WITHOUT
+* confirming — passed as
+* {@link DynamoDBGlobalTableProvider['waitForIndexesActive']}'s `proceedNote`
+* by BOTH delete-path callers (the #1521 pre-delete gate and the #1830 retry
+* re-arm).
+*
+* The default note that helper falls back to is the auto-scaling caller's, and
+* it is not merely unhelpful here but wrong: nothing on the delete path
+* re-asserts anything on a later deploy. Conversely the delete path really
+* does have a backstop — `DeleteTable` follows immediately and AWS refuses it
+* again if the index is still transitioning — which the auto-scaling caller
+* does not: `reconcileAutoScalingTargets` skips an index that is not ready and
+* nothing downstream notices. One sentence per caller, so neither claims the
+* other's safety net.
+*/
+const DELETE_INDEX_WAIT_PROCEED_NOTE = `the DeleteTable goes ahead anyway and AWS's own refusal stays the backstop.`;
+/**
+* Build the {@link ThroughputDiagnostic} for a `WarmThroughput` block that did
+* not survive coercion intact, or `undefined` when it did.
+*
+* Two distinct outcomes, worded differently because the remedy differs:
+*  - PARTIAL — one member dropped, the other still sent. The call goes ahead;
+*    the user needs to know which half silently did not.
+*  - REFUSED — nothing sendable. No call is made for the property at all,
+*    which is the point (issue #1857 defect 3): forwarding the malformed block
+*    would surface as an AWS validation error that names neither cdkd nor the
+*    property.
+*/
+function warmThroughputDiagnostic(raw, coercion, indexName) {
+	if (raw === void 0 || raw === null) return void 0;
+	const scope = {
+		kind: "unresolved-member",
+		member: "WarmThroughput"
+	};
+	const dropped = coercion.droppedMembers.join(" / ");
+	if (coercion.spec) {
+		if (coercion.droppedMembers.length === 0) return void 0;
+		const kept = WARM_THROUGHPUT_MEMBERS.filter((m) => coercion.spec?.[m] !== void 0).join(" / ");
+		return {
+			...scope,
+			...indexName !== void 0 && { indexName },
+			message: `WarmThroughput.${dropped} did not resolve to a number and was DROPPED; ${kept} is still sent. AWS types these as numbers, so a quoted "12000" is fine but an unresolved intrinsic or an object is not. The dropped member keeps its current AWS value until the template supplies a usable one.`
+		};
+	}
+	return {
+		...scope,
+		...indexName !== void 0 && { indexName },
+		message: `WarmThroughput is declared but no member resolved to a number${dropped ? ` (${dropped})` : ""}, so the whole block is REFUSED and not sent. Forwarding it would fail as an opaque AWS validation error naming neither cdkd nor the property. Set WarmThroughput.ReadUnitsPerSecond / WriteUnitsPerSecond to numbers, or remove the block. Nothing else about the index is affected.`
+	};
 }
 /**
 * Merge an explicitly-supplied, already-SDK-shaped throughput block over a
@@ -18535,7 +18859,10 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 			KeySchema: gsi["KeySchema"],
 			Projection: gsi["Projection"]
 		};
-		if (gsi["WarmThroughput"] !== void 0) sdk.WarmThroughput = gsi["WarmThroughput"];
+		const warmCoercion = coerceWarmThroughput$1(gsi["WarmThroughput"]);
+		if (warmCoercion.spec) sdk.WarmThroughput = warmCoercion.spec;
+		const warmDiagnostic = warmThroughputDiagnostic(gsi["WarmThroughput"], warmCoercion, typeof indexName === "string" ? indexName : void 0);
+		if (warmDiagnostic) diagnostics?.push(warmDiagnostic);
 		const explicitProvisioned = asRecord$1(gsi["ProvisionedThroughput"]);
 		const explicitOnDemand = asRecord$1(gsi["OnDemandThroughput"]);
 		if (explicitProvisioned && billingMode !== "PROVISIONED") diagnostics?.push({
@@ -56744,6 +57071,307 @@ function createDeployCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/analyzer/outputs-diff.ts
+/**
+* A `${...}` placeholder `Fn::Sub` did NOT substitute.
+*
+* `resolveSub` catches a genuine `Ref` / `Fn::GetAtt` miss, WARNS, and keeps the
+* literal `${Foo}` in the output string — it neither throws nor leaves an
+* intrinsic object behind. So a half-substituted `Fn::Sub` reaches this module
+* looking like an ordinary resolved string, and comparing it against state
+* reports a phantom change whose printed value is `"arn:...${NewBucket}"`.
+*
+* Only consulted for a value whose TEMPLATE source actually contained an
+* `Fn::Sub` (see {@link templateUsesSub}). Applying it to every string
+* over-matches badly: an IAM policy body with `${aws:username}`, a UserData
+* snippet with a shell `${VAR}`, or any literal a user wrote would set
+* `resolutionFailed` and suppress the WHOLE Outputs section for that stack, on
+* every run, forever.
+*
+* Within `Fn::Sub`-sourced values one false positive remains and is accepted:
+* `${!Literal}` is `Fn::Sub`'s ESCAPE and resolves to the literal text
+* `${Literal}`, which post-resolution is indistinguishable from a placeholder
+* that failed to substitute. That case merely SUPPRESSES the section (the
+* pre-#1921 behavior) whereas the alternative is a phantom reported every run.
+*/
+const UNSUBSTITUTED_SUB_PLACEHOLDER = /\$\{[^}]*\}/;
+/**
+* True when `value` is, or anywhere CONTAINS, something the diff could not
+* fully resolve against current state.
+*
+* The deploy engine's twin check is `Object.values(bag).some(v => v ===
+* undefined)` — its resolver THROWS on failure and the catch stores `undefined`.
+* The diff's resolver is best-effort and fails in three further ways that all
+* have to count as "unresolved" here, because anything that slips through is
+* compared against state and reported as a change the apply will never make:
+*
+* 1. `undefined` — the SAME signal the deploy side keys on. `resolve` returns it
+*    WITHOUT throwing for a constructible-but-unknown attribute
+*    (`AWS::DynamoDB::Table.StreamArn`, `AWS::IAM::Policy.PolicyId`,
+*    `AWS::EC2::SecurityGroup.VpcId`, ...). `JSON.stringify` drops an
+*    `undefined`-valued key, so state can never hold one and such an output
+*    would otherwise report a PERMANENT phantom `ADD` printing `new: undefined`.
+* 2. A symbol — `Ref: AWS::NoValue` resolves to a sentinel symbol, which
+*    `resolveValue` strips only INSIDE arrays / objects; a top-level
+*    `Fn::If` selecting `AWS::NoValue` returns it bare. Not persistable, so
+*    again a permanent phantom.
+* 3. A surviving intrinsic OBJECT, or — only when the template source used
+*    `Fn::Sub` — an unsubstituted placeholder STRING (see
+*    {@link UNSUBSTITUTED_SUB_PLACEHOLDER}).
+*
+* DEEP rather than shallow: an unresolved leaf can sit anywhere inside an array
+* or object an outer intrinsic already built.
+*/
+function isUnresolvedValue(value, sourceUsedSub) {
+	if (value === void 0) return true;
+	if (typeof value === "symbol") return true;
+	if (typeof value === "string") return sourceUsedSub && UNSUBSTITUTED_SUB_PLACEHOLDER.test(value);
+	if (value === null || typeof value !== "object") return false;
+	if (Array.isArray(value)) return value.some((v) => isUnresolvedValue(v, sourceUsedSub));
+	const keys = Object.keys(value);
+	if (keys.length === 1 && INTRINSIC_KEYS.has(keys[0])) return true;
+	return Object.values(value).some((v) => isUnresolvedValue(v, sourceUsedSub));
+}
+/**
+* True when this output's RAW template value contains an `Fn::Sub` anywhere —
+* including nested inside an `Fn::Join` / `Fn::If`, since those resolve their
+* arguments and a laundered placeholder from an inner `Fn::Sub` surfaces in the
+* outer result.
+*/
+function templateUsesSub(templateValue) {
+	if (templateValue === null || typeof templateValue !== "object") return false;
+	if (Array.isArray(templateValue)) return templateValue.some(templateUsesSub);
+	const record = templateValue;
+	if (Object.prototype.hasOwnProperty.call(record, "Fn::Sub")) return true;
+	return Object.values(record).some(templateUsesSub);
+}
+/**
+* True when `value` is a string carrying a SECRET-BEARING CloudFormation
+* dynamic reference — `{{resolve:secretsmanager:` or `{{resolve:ssm-secure:`,
+* the two spellings that are secret regardless of what they point at.
+*
+* The diff resolves with `skipDynamicReferences`, so a secret-bearing output
+* arrives here as its unresolved `{{resolve:...}}` expression — which is also
+* what post-GHSA state stores. A state record written by an OLDER binary can
+* still hold the resolved PLAINTEXT instead (that mismatch is exactly what
+* `cdkd scrub` exists to repair), and printing it is this module's problem
+* because it is the first code path that DISPLAYS a stored output value.
+*/
+function isSecretDynamicReference(value) {
+	if (typeof value !== "string") return false;
+	return value.includes("{{resolve:secretsmanager:") || value.includes("{{resolve:ssm-secure:");
+}
+/** Structural equality, mirroring the deploy engine's `outputMapsEqual` leaf rule. */
+function valuesEqual(a, b) {
+	if (a === b) return true;
+	if (a == null || b == null) return a === b;
+	if (typeof a !== typeof b) return false;
+	if (typeof a !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => valuesEqual(v, b[i]));
+	}
+	const ao = a;
+	const bo = b;
+	const ak = Object.keys(ao);
+	if (ak.length !== Object.keys(bo).length) return false;
+	for (const k of ak) {
+		if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
+		if (!valuesEqual(ao[k], bo[k])) return false;
+	}
+	return true;
+}
+/**
+* Resolve a template's `Outputs` section into the exact bag shape the deploy
+* engine persists to `StackState.outputs` (issue #1921).
+*
+* This is the preview twin of `DeployEngine.resolveOutputs`, and the three
+* semantics below are load-bearing for parity — a preview that builds a
+* DIFFERENT bag than the apply persists reports a phantom change on every run,
+* which is this issue's own bug class inverted. `tests/unit/analyzer/
+* outputs-diff.test.ts` fences each one against drift on the deploy side.
+*
+* 1. An output whose `Condition` evaluates false is SKIPPED, not resolved —
+*    CloudFormation simply does not create it (mirrors the resource side's
+*    `filterResourcesByCondition`; an unknown condition name is kept).
+* 2. An `Export.Name` is stored as a SECOND key holding the same value, so
+*    `Fn::ImportValue` can find it by export name. Both keys land in state, so
+*    both must land here.
+* 3. Resolution is best-effort and never throws — a diff must never harden into
+*    an error where the deploy would have succeeded.
+*
+* The parity claim is scoped to the deploy engine's NO-CHANGE branch, which is
+* the one this preview stands in for. Its changed-resources branch resolves
+* outputs with no `resolutionFailed` gate at all — correctly, because by then
+* every resource exists and resolution is expected to succeed, whereas a diff
+* runs BEFORE any of them are created.
+*
+* Deliberately does NOT redact secrets the way the deploy side does: this
+* resolver runs with `skipDynamicReferences`, so a `{{resolve:...}}` reference
+* is never resolved to plaintext in the first place and the bag already holds
+* the expression that state stores post-redaction.
+*/
+async function resolveTemplateOutputs(template, resolveFn, conditions) {
+	const logger = getLogger().child("OutputsDiff");
+	const outputs = {};
+	const exportNames = /* @__PURE__ */ new Set();
+	const failedKeys = /* @__PURE__ */ new Set();
+	const secretSourceKeys = /* @__PURE__ */ new Set();
+	let resolutionFailed = false;
+	if (!template.Outputs) return {
+		outputs,
+		exportNames,
+		failedKeys,
+		secretSourceKeys,
+		resolutionFailed
+	};
+	/**
+	* Record a key the resolver DROPPED — plus the literal `Export.Name` alias the
+	* deploy would have written alongside it. Both are absent from the bag, so
+	* both would otherwise read as phantom REMOVEs and make the suppression
+	* warning fire on the ordinary pending-resource case.
+	*/
+	const recordFailure = (outputKey, output) => {
+		failedKeys.add(outputKey);
+		if (typeof output.Export?.Name === "string") failedKeys.add(output.Export.Name);
+	};
+	for (const [outputKey, output] of Object.entries(template.Outputs)) {
+		if (!isSecretDynamicReference(output.Value)) continue;
+		secretSourceKeys.add(outputKey);
+		if (typeof output.Export?.Name === "string") secretSourceKeys.add(output.Export.Name);
+	}
+	for (const [outputKey, output] of Object.entries(template.Outputs)) {
+		if (output.Condition !== void 0 && conditions?.[output.Condition] === false) {
+			logger.debug(`Skipping output ${outputKey} — condition ${output.Condition} is false`);
+			continue;
+		}
+		const sourceUsedSub = templateUsesSub(output.Value);
+		let value;
+		try {
+			value = await resolveFn(structuredClone(output.Value));
+		} catch (error) {
+			logger.debug(`Diff could not resolve output ${outputKey}: ${String(error)}`);
+			resolutionFailed = true;
+			recordFailure(outputKey, output);
+			continue;
+		}
+		if (isUnresolvedValue(value, sourceUsedSub)) {
+			logger.debug(`Diff left output ${outputKey} unresolved (references a pending resource)`);
+			resolutionFailed = true;
+			recordFailure(outputKey, output);
+			continue;
+		}
+		outputs[outputKey] = value;
+		if (output.Export?.Name) {
+			let exportName = output.Export.Name;
+			const exportSourceUsedSub = templateUsesSub(output.Export.Name);
+			if (typeof exportName !== "string") try {
+				exportName = await resolveFn(structuredClone(exportName));
+			} catch (error) {
+				logger.debug(`Diff could not resolve Export.Name of ${outputKey}: ${String(error)}`);
+				resolutionFailed = true;
+				continue;
+			}
+			if (typeof exportName === "string" && !isUnresolvedValue(exportName, exportSourceUsedSub)) {
+				outputs[exportName] = value;
+				exportNames.add(exportName);
+			} else resolutionFailed = true;
+		}
+	}
+	return {
+		outputs,
+		exportNames,
+		failedKeys,
+		secretSourceKeys,
+		resolutionFailed
+	};
+}
+/**
+* Compare the persisted Outputs bag against the one the next deploy would
+* write, key by key (issue #1921).
+*
+* Compares BAG KEYS rather than template output names on purpose. The bag is
+* what actually lands in `StackState.outputs` AND what
+* `ExportIndexStore.updateForStack` publishes, so a key-level comparison is
+* exactly the `outputMapsEqual` predicate the deploy engine gates its persist
+* on — no interpretive layer in between that could drift from apply semantics.
+* The practical payoff is that the motivating #875 case shows the user the
+* literal export name their downstream `Fn::ImportValue` needs.
+*
+* ## Withholding legacy secret plaintext
+*
+* This is the first code path that DISPLAYS a stored output value, and
+* `cdkd diff` is routinely run in CI — so a value that turns out to be secret
+* plaintext would land in build logs. `StackState.outputs` is only guaranteed
+* redacted for records written after the GHSA fix; an older binary persisted
+* the RESOLVED plaintext, which is the condition `cdkd scrub` repairs.
+*
+* Two independent signals identify such a record, and BOTH are needed:
+*
+* - the desired side is still a secret-bearing expression per
+*   {@link isSecretDynamicReference} (this resolver runs with
+*   `skipDynamicReferences`) while the stored side is not; and
+* - `secretSourceKeys` — the template itself declares the key's value as such a
+*   reference. This one reaches cases the first cannot: a
+*   condition-skipped secret output, or one deleted from the template, has NO
+*   desired side at all and would otherwise print in full as a REMOVE row.
+*
+* A hit on either makes the WHOLE record suspect, not just that key: the
+* record was written by a pre-GHSA binary, so every value in it is unredacted.
+* Withholding is therefore record-level. The change is still REPORTED — only
+* the value is withheld — so `--fail` and the exports story are unaffected.
+*/
+function computeOutputsDiff(current, desired, exportNames, secretSourceKeys = /* @__PURE__ */ new Set()) {
+	const changes = [];
+	const currentBag = current ?? {};
+	const legacyRecord = Object.entries(currentBag).some(([name, oldValue]) => {
+		if (isSecretDynamicReference(oldValue)) return false;
+		return isSecretDynamicReference(desired[name]) || secretSourceKeys.has(name);
+	});
+	const push = (change) => {
+		if (legacyRecord && change.changeType !== "ADD") {
+			const { oldValue: _dropped, ...rest } = change;
+			changes.push({
+				...rest,
+				oldValueRedacted: true
+			});
+			return;
+		}
+		changes.push(change);
+	};
+	for (const [name, newValue] of Object.entries(desired)) {
+		const isExport = exportNames.has(name);
+		if (!Object.prototype.hasOwnProperty.call(currentBag, name)) {
+			changes.push({
+				name,
+				changeType: "ADD",
+				newValue,
+				isExport
+			});
+			continue;
+		}
+		const oldValue = currentBag[name];
+		if (!valuesEqual(oldValue, newValue)) push({
+			name,
+			changeType: "MODIFY",
+			oldValue,
+			newValue,
+			isExport
+		});
+	}
+	for (const [name, oldValue] of Object.entries(currentBag)) {
+		if (Object.prototype.hasOwnProperty.call(desired, name)) continue;
+		push({
+			name,
+			changeType: "REMOVE",
+			oldValue,
+			isExport: false
+		});
+	}
+	return changes;
+}
+
 //#endregion
 //#region src/cli/cfn-stack-states.ts
 /**
@@ -57705,6 +58333,11 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 * resolver so changes buried inside intrinsics (e.g. `Fn::Join` literal
 * args) are detected against resolved values in state.
 *
+* Also computes the `Outputs` delta (issue #1921) — an Outputs-only change has
+* a byte-identical `Resources` section, so without it such a stack previews as
+* "No changes detected" while the apply persists new outputs and republishes
+* the exports index.
+*
 * Pure with respect to AWS state mutation — only reads state (the resolver
 * may read producer state for `Fn::ImportValue` / `Fn::GetStackOutput`).
 */
@@ -57749,7 +58382,16 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		...conditions && { conditions },
 		skipDynamicReferences: true
 	});
-	return diffCalculator.calculateDiff(currentState, effectiveTemplate, resolveFn, canonicalizeProperties);
+	const changes = await diffCalculator.calculateDiff(currentState, effectiveTemplate, resolveFn, canonicalizeProperties);
+	const resolved = await resolveTemplateOutputs(effectiveTemplate, resolveFn, conditions);
+	let outputChanges = [];
+	if (resolved.resolutionFailed) {
+		if (computeOutputsDiff(currentState.outputs, resolved.outputs, resolved.exportNames, resolved.secretSourceKeys).filter((change) => !resolved.failedKeys.has(change.name)).length > 0) logger.warn(`Outputs of stack ${stackName} may have changed, but one or more could not be resolved against current state — omitting the Outputs section from this diff. It is usually an output referencing a resource this deploy has yet to create.`);
+	} else outputChanges = computeOutputsDiff(currentState.outputs, resolved.outputs, resolved.exportNames, resolved.secretSourceKeys);
+	return {
+		changes,
+		outputChanges
+	};
 }
 /**
 * Resolve a nested-stack child's input `Parameters` (declared on the parent's
@@ -57812,12 +58454,14 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 async function buildDiffTree(args) {
 	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parameters, canonicalizeProperties, assetRedirect, cfnFallback } = args;
 	const state = await loadStateOrEmpty(stackName, region, stateBackend);
+	const { changes, outputChanges } = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, parameters, canonicalizeProperties, cfnFallback);
 	const node = {
 		stackName,
 		displayName,
 		region,
-		changes: await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, parameters, canonicalizeProperties, cfnFallback),
+		changes,
 		ccApiRoutes: collectCcApiRoutes(template, state),
+		outputChanges,
 		children: []
 	};
 	if (!recursive) return node;
@@ -57862,12 +58506,14 @@ async function buildDiffTree(args) {
 */
 async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculator) {
 	const state = await loadStateOrEmpty(stackName, region, stateBackend);
+	const { changes, outputChanges } = await computeStackDiff(state, EMPTY_TEMPLATE, region, stackName, stateBackend, diffCalculator);
 	const node = {
 		stackName,
 		displayName: stackName,
 		region,
-		changes: await computeStackDiff(state, EMPTY_TEMPLATE, region, stackName, stateBackend, diffCalculator),
+		changes,
 		ccApiRoutes: /* @__PURE__ */ new Map(),
+		outputChanges,
 		children: []
 	};
 	for (const [logicalId, resource] of Object.entries(state.resources)) {
@@ -57925,7 +58571,7 @@ function collectCcApiRoutes(template, state) {
 /** True when this node has at least one real (non-`NO_CHANGE`) change. */
 function nodeHasChanges(node) {
 	for (const change of node.changes.values()) if (change.changeType !== "NO_CHANGE") return true;
-	return false;
+	return node.outputChanges.length > 0;
 }
 /** True when this node OR any descendant has a real change (tree-wide drift detector for `--fail`). */
 function treeHasChanges(node) {
@@ -57956,26 +58602,17 @@ function diffTreeToJson(node) {
 		stack: node.stackName,
 		region: node.region,
 		changes,
+		outputChanges: node.outputChanges.map((change) => ({
+			name: change.name,
+			changeType: change.changeType,
+			...change.changeType !== "ADD" && !change.oldValueRedacted ? { oldValue: change.oldValue } : {},
+			...change.oldValueRedacted ? { oldValueRedacted: true } : {},
+			...change.changeType !== "REMOVE" ? { newValue: change.newValue } : {},
+			export: change.isExport
+		})),
 		children: node.children.map(diffTreeToJson)
 	};
 }
-const INTRINSIC_KEYS = /* @__PURE__ */ new Set([
-	"Ref",
-	"Fn::Sub",
-	"Fn::GetAtt",
-	"Fn::Join",
-	"Fn::Select",
-	"Fn::Split",
-	"Fn::If",
-	"Fn::ImportValue",
-	"Fn::FindInMap",
-	"Fn::Base64",
-	"Fn::GetAZs",
-	"Fn::Equals",
-	"Fn::And",
-	"Fn::Or",
-	"Fn::Not"
-]);
 function isIntrinsic(value) {
 	if (value === null || value === void 0 || typeof value !== "object" || Array.isArray(value)) return false;
 	const keys = Object.keys(value);
@@ -58111,6 +58748,84 @@ function renderChangeLines(changes, logFn, ccApiRoutes) {
 		delete: deleteCount
 	};
 }
+/** Stand-in printed instead of a withheld legacy-plaintext output value. */
+const REDACTED_LEGACY_PLAINTEXT = "<redacted: legacy plaintext in state — run `cdkd scrub`>";
+/**
+* Strip characters that let a template-controlled string manipulate the
+* TERMINAL rather than merely appear in it: C0 (incl. ESC, so no ANSI sequence
+* survives), DEL, C1 (the 8-bit CSI forms some terminals still honor), and the
+* bidi / format overrides that visually reorder a rendered line.
+*
+* Applied only on the human-render path. The `--json` payload is deliberately
+* left byte-faithful: it is a machine interface, an export NAME is data a
+* consumer may match on, and silently mutating it there would trade a real
+* correctness regression for a display concern belonging to whatever renders
+* the JSON. `JSON.stringify` already escapes everything below 0x20.
+*/
+function stripControlChars(value) {
+	return value.replace(/[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
+}
+/**
+* The same guard for an already-JSON-SERIALIZED value: C1 and the bidi marks
+* only, deliberately NOT C0.
+*
+* `JSON.stringify` escapes every character below 0x20 that occurs INSIDE a
+* string, so the only C0 left on this path is the pretty-printer's own
+* structural newlines — stripping those collapses a multi-line value onto a
+* single line. What `JSON.stringify` passes through unchanged is the C1 range
+* and the bidi overrides, and those are what this removes.
+*/
+function stripDisplayOnlyChars(value) {
+	return value.replace(/[\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
+}
+/**
+* Render one node's Outputs delta (issue #1921) via `logFn`, returning the
+* per-kind counts. Emits nothing when there is no delta, so an unchanged
+* Outputs section adds no noise to a resource-only diff.
+*
+* Rows are keyed by the PERSISTED bag key, which is what `StackState.outputs`
+* holds and what the exports index publishes. An output carrying an
+* `Export.Name` therefore shows TWO rows — its logical name and its export
+* name — because the deploy writes both keys. That is the useful half for the
+* motivating case: the `[export]`-tagged row IS the string a downstream
+* `Fn::ImportValue` resolves, so the user can match it against the consumer
+* that was failing with "export not found".
+*/
+function renderOutputChangeLines(outputChanges, logFn) {
+	const counts = {
+		add: 0,
+		change: 0,
+		remove: 0
+	};
+	if (outputChanges.length === 0) return counts;
+	logFn("\n  Outputs:");
+	const indent = "            ";
+	const render = (value) => stripDisplayOnlyChars((JSON.stringify(value, null, 2) ?? "undefined").replace(/\n/g, `\n${indent}`));
+	const renderOld = (change) => change.oldValueRedacted ? REDACTED_LEGACY_PLAINTEXT : render(change.oldValue);
+	for (const change of outputChanges) {
+		const exported = change.isExport ? " [export]" : "";
+		const name = stripControlChars(change.name);
+		switch (change.changeType) {
+			case "ADD":
+				counts.add++;
+				logFn(`    [+] ${name}${exported}`);
+				logFn(`          new: ${render(change.newValue)}`);
+				break;
+			case "MODIFY":
+				counts.change++;
+				logFn(`    [~] ${name}${exported}`);
+				logFn(`          old: ${renderOld(change)}`);
+				logFn(`          new: ${render(change.newValue)}`);
+				break;
+			case "REMOVE":
+				counts.remove++;
+				logFn(`    [-] ${name}${exported}`);
+				logFn(`          old: ${renderOld(change)}`);
+				break;
+		}
+	}
+	return counts;
+}
 /**
 * Render a diff tree (root + nested children, DFS) via `logFn`. Only nodes
 * that actually have changes get a block — unchanged nested children are
@@ -58123,7 +58838,9 @@ function renderDiffTree(node, isRoot, logFn) {
 	if (nodeHasChanges(node)) {
 		logFn(isRoot ? `\nStack ${node.stackName}:` : `\nNested stack: ${node.displayName}`);
 		const { create, update, delete: del } = renderChangeLines(node.changes, logFn, node.ccApiRoutes);
+		const outputs = renderOutputChangeLines(node.outputChanges, logFn);
 		logFn(`\n${create} to create, ${update} to update, ${del} to delete`);
+		if (outputs.add + outputs.change + outputs.remove > 0) logFn(`${outputs.add} output(s) to add, ${outputs.change} to change, ${outputs.remove} to remove`);
 	}
 	for (const child of node.children) renderDiffTree(child, false, logFn);
 }
@@ -79390,7 +80107,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.26");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.28");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;