@go-to-k/cdkd 0.283.27 → 0.283.28

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as resolveApp, A as cyan, An as LocalInvokeBuildError$1, At as createAssetRedirectResolver, B as findSilentDropProperties, Bn as StackHasActiveImportsError, Bt as validateContainerRepoName, C as makeCanonicalizePropertiesFn, Cn as resetAwsClients, Ct as S3StateBackend, D as renderStatefulReason, Dt as stringifyValue, E as isStatefulRecreateTargetSync, En as CdkdError, Et as AssetPublisher, F as IAMRoleProvider, Fn as NestedStackChildDirectDestroyError, Ft as BOOTSTRAP_MARKER_PREFIX, G as IntrinsicFunctionResolver, Gt as runDockerForeground, H as slowCcOperationTimeoutMs, Ht as buildDockerImage, I as collectInlinePolicyNamesManagedBySiblings, In as PartialFailureError, It as ensureAssetStorage, J as refStateLookupFromResource, Jn as isMarkedNonRetryable, Jt as getDockerImageBySourceHash, K as cfnRefValueFromPhysicalId, Kn as normalizeAwsError, Kt as runDockerStreaming, L as clearOnUpdateRemoval, Ln as ProvisioningError, Lt as getBootstrapMarkerKey, M as green, Mn as LocalStartServiceError, Mt as rewriteTemplateAssetReferences, N as red, Nt as escapeRegExp, O as formatResourceLine, Ot as WorkGraph, P as yellow, Pn as MissingCdkCliError, Pt as AssetModeResolver, Q as assertRegionMatch, Qt as getLegacyStateBucketName, R as ProviderRegistry, Rn as ResourceTimeoutError, Rt as parseBootstrapMarker, S as unsupportedFinalSnapshotError, Sn as getAwsClients, St as LockManager, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tt as shouldRetainResource, U as disableInstanceApiTermination, Ut as formatDockerLoginError, V as CloudControlProvider, Vn as StackTerminationProtectionError, Vt as buildDenyExternalAccessPolicy, W as isTerminationProtectionPropagationError, Wt as getDockerCmd, X as normalizeAwsTagsToCfn, Xn as isThrottlingError, Xt as synthesisStatusMessage, Y as WAFv2WebACLProvider, Yn as isRetryableTransientError, Yt as Synthesizer, Z as resolveExplicitPhysicalId, Zn as markNonRetryable, Zt as getDefaultStateBucketName, _ as buildFinalSnapshotIdentifier, _n as AssemblyReader, _t as INTRINSIC_KEYS, a as DeploymentEventsStore, an as resolveUseCdkBootstrapAssets, at as requireConfigObject, b as isFinalSnapshotError, bn as resolveBucketRegion, bt as DagBuilder, c as replayFailedOperations, cn as CFN_TEMPLATE_BODY_LIMIT, ct as redactSecretsForState, d as deleteSkipReason, dn as findLargeInlineResources, dt as s3BucketDomainName, en as resolveAutoAssetStorage, et as configBooleanRefusal, f as withResourceDeadline, fn as uploadCfnTemplate, ft as s3BucketDualStackDomainName, g as PRE_DELETE_SNAPSHOT_TYPES, gn as derivePartitionAndUrlSuffix, gt as DiffCalculator, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as canonicalizeRegion, ht as applyRoleArnIfSet, i as DeploymentEventsReader, in as resolveStateBucketWithDefaultAndSource, it as requireConfigArray, j as gray, jn as LocalMigrateError, jt as loadPublishableAssetManifest, k as bold, kn as DeployCancelledError, kt as buildAssetRedirectMap, l as replayRollback, ln as CFN_TEMPLATE_URL_LIMIT, lt as scrubResourceRecord, m as computeImplicitDeleteEdges, mn as PARTITION_TABLE, mt as s3BucketWebsiteUrl, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveSkipPrefix, nt as readConfigString, o as planFailedOps, on as stateBucketExistenceConfirmed, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as expectedOwnerParam, pt as s3BucketRegionalDomainName, q as getAccountInfo, qn as withErrorHandling, qt as AssetManifestLoader, r as DeployEngine, rn as resolveStateBucketWithDefault, rt as replayWarn, s as planRollback, sn as warnDeprecatedNoPrefixCliFlag, st as TEMPLATE_SOURCED_READBACK_RULES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveCaptureObservedState, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as MIGRATE_TMP_PREFIX, ut as s3BucketArn, v as ccRoutedFinalSnapshotError, vn as processStackMessages, vt as describeTypeWithThrottleRetry, w as extractDeploymentEventError, wn as setAwsClients, wt as rebuildClientForBucketRegion, x as refusesFinalSnapshot, xn as AwsClients, xt as TemplateParser, y as createPreDeleteFinalSnapshot, yt as withRetry, z as findActionableSilentDrops, zn as ResourceUpdateNotSupportedError, zt as validateAssetBucketName } from "./deploy-engine-CsvKYG0d.js";
+import { $ as coerceCfnBoolean, $t as resolveApp, A as cyan, An as LocalInvokeBuildError$1, At as createAssetRedirectResolver, B as findSilentDropProperties, Bn as StackHasActiveImportsError, Bt as validateContainerRepoName, C as makeCanonicalizePropertiesFn, Cn as resetAwsClients, Ct as S3StateBackend, D as renderStatefulReason, Dt as stringifyValue, E as isStatefulRecreateTargetSync, En as CdkdError, Et as AssetPublisher, F as IAMRoleProvider, Fn as NestedStackChildDirectDestroyError, Ft as BOOTSTRAP_MARKER_PREFIX, G as IntrinsicFunctionResolver, Gt as runDockerForeground, H as slowCcOperationTimeoutMs, Ht as buildDockerImage, I as collectInlinePolicyNamesManagedBySiblings, In as PartialFailureError, It as ensureAssetStorage, J as refStateLookupFromResource, Jn as isMarkedNonRetryable, Jt as getDockerImageBySourceHash, K as cfnRefValueFromPhysicalId, Kn as normalizeAwsError, Kt as runDockerStreaming, L as clearOnUpdateRemoval, Ln as ProvisioningError, Lt as getBootstrapMarkerKey, M as green, Mn as LocalStartServiceError, Mt as rewriteTemplateAssetReferences, N as red, Nt as escapeRegExp, O as formatResourceLine, Ot as WorkGraph, P as yellow, Pn as MissingCdkCliError, Pt as AssetModeResolver, Q as assertRegionMatch, Qt as getLegacyStateBucketName, R as ProviderRegistry, Rn as ResourceTimeoutError, Rt as parseBootstrapMarker, S as unsupportedFinalSnapshotError, Sn as getAwsClients, St as LockManager, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tt as shouldRetainResource, U as disableInstanceApiTermination, Ut as formatDockerLoginError, V as CloudControlProvider, Vn as StackTerminationProtectionError, Vt as buildDenyExternalAccessPolicy, W as isTerminationProtectionPropagationError, Wt as getDockerCmd, X as normalizeAwsTagsToCfn, Xn as isThrottlingError, Xt as synthesisStatusMessage, Y as WAFv2WebACLProvider, Yn as isRetryableTransientError, Yt as Synthesizer, Z as resolveExplicitPhysicalId, Zn as markNonRetryable, Zt as getDefaultStateBucketName, _ as buildFinalSnapshotIdentifier, _n as AssemblyReader, _t as INTRINSIC_KEYS, a as DeploymentEventsStore, an as resolveUseCdkBootstrapAssets, at as requireConfigObject, b as isFinalSnapshotError, bn as resolveBucketRegion, bt as DagBuilder, c as replayFailedOperations, cn as CFN_TEMPLATE_BODY_LIMIT, ct as redactSecretsForState, d as deleteSkipReason, dn as findLargeInlineResources, dt as s3BucketDomainName, en as resolveAutoAssetStorage, et as configBooleanRefusal, f as withResourceDeadline, fn as uploadCfnTemplate, ft as s3BucketDualStackDomainName, g as PRE_DELETE_SNAPSHOT_TYPES, gn as derivePartitionAndUrlSuffix, gt as DiffCalculator, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as canonicalizeRegion, ht as applyRoleArnIfSet, i as DeploymentEventsReader, in as resolveStateBucketWithDefaultAndSource, it as requireConfigArray, j as gray, jn as LocalMigrateError, jt as loadPublishableAssetManifest, k as bold, kn as DeployCancelledError, kt as buildAssetRedirectMap, l as replayRollback, ln as CFN_TEMPLATE_URL_LIMIT, lt as scrubResourceRecord, m as computeImplicitDeleteEdges, mn as PARTITION_TABLE, mt as s3BucketWebsiteUrl, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveSkipPrefix, nt as readConfigString, o as planFailedOps, on as stateBucketExistenceConfirmed, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as expectedOwnerParam, pt as s3BucketRegionalDomainName, q as getAccountInfo, qn as withErrorHandling, qt as AssetManifestLoader, r as DeployEngine, rn as resolveStateBucketWithDefault, rt as replayWarn, s as planRollback, sn as warnDeprecatedNoPrefixCliFlag, st as TEMPLATE_SOURCED_READBACK_RULES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveCaptureObservedState, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as MIGRATE_TMP_PREFIX, ut as s3BucketArn, v as ccRoutedFinalSnapshotError, vn as processStackMessages, vt as describeTypeWithThrottleRetry, w as extractDeploymentEventError, wn as setAwsClients, wt as rebuildClientForBucketRegion, x as refusesFinalSnapshot, xn as AwsClients, xt as TemplateParser, y as createPreDeleteFinalSnapshot, yt as withRetry, z as findActionableSilentDrops, zn as ResourceUpdateNotSupportedError, zt as validateAssetBucketName } from "./deploy-engine-5rA6lMn8.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-uNJDVURJ.js";
+import { t as ASGProvider } from "./asg-provider-DzaowTd_.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -13989,6 +13989,209 @@ function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-warm-throughput.ts
+/**
+* The two DynamoDB `WarmThroughput` rules that `AWS::DynamoDB::Table` and
+* `AWS::DynamoDB::GlobalTable` both need, in ONE spelling.
+*
+* `WarmThroughput` is the same CloudFormation block on both types, and both
+* providers have to answer the same two questions about it before an
+* `UpdateTable` / `CreateTable` goes out:
+*
+*  1. **Is this block SENDABLE, and as what numbers?** CloudFormation is
+*     stringly typed, so `{ReadUnitsPerSecond: '12000'}` — or anything that
+*     came back from an `Fn::Sub` — arrives as a STRING and must not be
+*     forwarded verbatim into a numeric `Long` field.
+*  2. **Would sending it LOWER what AWS already reports?** Warm throughput
+*     only ever rises with a table's traffic and AWS REJECTS a call that
+*     lowers it (`decreasing WarmThroughput is not supported`, measured live
+*     us-east-1 2026-08-13 for issue #1768).
+*
+* **Provenance, stated precisely because it is easy to over-claim.** Exactly
+* ONE of these rules ever shipped: `AWS::DynamoDB::Table` got them in PR #1808
+* (issues #1760 / #1768), and the `AWS::DynamoDB::GlobalTable` side never
+* existed outside the change that created this file (issue #1857). So this is
+* the Table rule LIFTED — not two shipped rules reconciled, and no deployed
+* behaviour changed for either type when it moved here.
+*
+* What WAS compared is the lifted rule against the GlobalTable spelling
+* drafted alongside it, over the shapes both had to answer (a quoted numeric
+* string, a partially usable block, a mixed decrease/increase, an absent live
+* value, a zero, a negative, a non-numeric string, a whitespace string, an
+* explicit `undefined` / `null`, a boolean, an empty block, a scalar, an
+* array). {@link isWarmThroughputDecrease} agreed on every one; the coercion
+* agreed on all but a whitespace-only string, where a bare `Number('   ')` is
+* `0` rather than `NaN`. This module keeps the REFUSING answer for that shape,
+* since `'   '` is not a capacity anyone declared and a warm throughput of 0
+* is not a request AWS can honour. That is a DRAFT reconciled against a
+* shipped rule, which is worth less than two shipped rules agreeing — the
+* reason to read the probe list as a design note rather than as field
+* evidence.
+*
+* Living here rather than in either provider is the point. A decrease guard is
+* three clauses that all FAIL OPEN for different reasons, and two files
+* spelling it independently is two chances for a later "fix" to change one of
+* them — at which point the sibling type silently keeps the old answer, and
+* nothing in the tree says which is intended. Same class as
+* `emr-configuration.ts`, and the same reason.
+*
+* Deliberately NOT here: everything only ONE provider has. The `Table` side's
+* `isSendableWarmThroughput` / `isRefusedWarmThroughput` /
+* `declaresWarmThroughput` / `warmThroughputAlreadyMatches` are its drift-side
+* and already-matches gates, which `GlobalTable` has no counterpart to (issue
+* #1742 strips the per-index `WarmThroughput` from BOTH of its drift
+* comparison sides unconditionally, so drift never asks the question there);
+* the `GlobalTable` side's `warmThroughputDiagnostic` builds a
+* `ThroughputDiagnostic` that only that provider's collector understands.
+* Moving a helper with one caller here would buy nothing and cost a hop.
+*
+* Issues: #1760 / #1768 (Table, PR #1808), #1857 (GlobalTable).
+*/
+/**
+* The two `WarmThroughput` members, in the ONE order every message, every
+* comparison and every emitted block uses. A shared order is what makes two
+* blocks carrying the same numbers compare equal by `deepEqual` and serialize
+* to the same wire bytes regardless of the order the template wrote them in.
+*/
+const WARM_THROUGHPUT_MEMBERS = ["ReadUnitsPerSecond", "WriteUnitsPerSecond"];
+/**
+* A CloudFormation-borne numeric property, or `undefined` when the value is
+* not a usable number.
+*
+* Plain `Number()` coercion is NOT good enough and the tree learned it three
+* separate times: `Number(null)`, `Number('')`, `Number([])`, `Number(false)`
+* and `Number('   ')` are all **0**, not `NaN` — so a live `0` would compare
+* EQUAL to a desired `null` / `''` / `[]` / `false`, and a whitespace-only
+* string would be forwarded as a request for zero units.
+*
+* A YAML-borne numeric STRING is still accepted, because that is a real
+* template shape and `'12000'` genuinely means 12000.
+*
+* EXPORTED, and not because warm throughput needs it exported. This exact rule
+* was hand-written three times — here, as `dynamodb-table-provider.ts`'s
+* `capacityNumber` (byte-identical), and as `dynamodb-globaltable-provider.ts`'s
+* `toFiniteNumber` (a different spelling of the same total function) — which is
+* precisely the divergence this module exists to stop: the next "fix" to one of
+* them would have left the other two answering differently, with nothing in the
+* tree saying which was intended. It reads `ReadCapacityUnits` /
+* `MaxReadRequestUnits` / `MinCapacity` as readily as it reads
+* `ReadUnitsPerSecond`; there is only ever one right answer for "is this
+* stringly-typed CFn value a number I can send?".
+*/
+function toFiniteNumber(value) {
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value === "string" && value.trim() !== "") {
+		const n = Number(value);
+		return Number.isFinite(n) ? n : void 0;
+	}
+}
+/**
+* Coerce a CFn `WarmThroughput` block to the numeric shape the SDK's `Long`
+* fields accept, PER MEMBER.
+*
+* PER MEMBER, not whole-block, and that distinction is the point: a block
+* whose write half is an unresolved intrinsic still has a perfectly good read
+* half, and dropping both would silently discard a value the template really
+* did ask for. The dropped member is NAMED (`droppedMembers`) so the caller's
+* warning can say which half went missing instead of reporting the whole
+* property.
+*
+* A block with NO usable member yields `spec: undefined` — refused rather than
+* forwarded, because forwarding a malformed block surfaces as an opaque AWS
+* validation error naming neither cdkd nor the property. `droppedMembers` is
+* still populated in that case, so a REFUSAL message can name what it refused;
+* a block that is not an object at all (an unresolved `Fn::If`, a scalar, an
+* array) has no member to name and reports none, which is what lets a caller
+* word "one half went missing" differently from "the block is unusable".
+*
+* Pure: takes the raw bag, returns numbers, logs nothing. Each caller owns its
+* own message, so the wording stays consistent across that provider's send
+* sites without forcing one wording across both providers.
+*/
+function coerceWarmThroughput$1(raw) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return { droppedMembers: [] };
+	const bag = raw;
+	const spec = {};
+	const droppedMembers = [];
+	for (const member of WARM_THROUGHPUT_MEMBERS) {
+		if (bag[member] === void 0) continue;
+		const coerced = toFiniteNumber(bag[member]);
+		if (coerced === void 0) {
+			droppedMembers.push(member);
+			continue;
+		}
+		spec[member] = coerced;
+	}
+	if (Object.keys(spec).length === 0) return { droppedMembers };
+	return {
+		spec,
+		droppedMembers
+	};
+}
+/**
+* Whether the COERCED desired `WarmThroughput` would LOWER what AWS already
+* reports.
+*
+* Measured live (us-east-1, 2026-08-13, issue #1768) against a table AWS
+* reports `{ReadUnitsPerSecond: 12000, WriteUnitsPerSecond: 4000}` for:
+*
+* ```
+* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000, WriteUnitsPerSecond: 2000}
+*   ValidationException: One or more parameter values were invalid: Requested
+*   ReadUnitsPerSecond for WarmThroughput for table is lower than current
+*   WarmThroughput, decreasing WarmThroughput is not supported
+* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000}      -> same rejection
+* UpdateTable WarmThroughput={WriteUnitsPerSecond: 2000}     -> same rejection, naming WriteUnitsPerSecond
+* UpdateTable WarmThroughput={12000, 4000}  (re-assert)      -> ACCEPTED
+* ```
+*
+* So the value is one AWS raises with the table's traffic and never lowers,
+* and a decrease is REJECTED rather than accepted-and-ignored — which is what
+* had to be measured before choosing, because the two produce different
+* correct answers. The caller SKIPS the call on a true here.
+*
+* Evaluated on the COERCED spec, never on the raw bag: analysing the raw bag
+* makes the verdict describe a request that is not the one being sent (a
+* dropped member is not part of the call and must not be part of the
+* comparison).
+*
+* Semantics, all three chosen to FAIL OPEN — i.e. to let the call through and
+* leave AWS as the authority — because a false positive here silently drops a
+* legitimate INCREASE, which is a real capacity change the user asked for,
+* while a false negative merely reproduces the pre-fix behaviour of an
+* AWS-side rejection that names the property:
+*  - DECLARED members only. An absent member is not a request to lower
+*    anything, so it takes no part in the verdict.
+*  - MIXED is not a decrease. One member below live and the other above means
+*    the call carries a genuine increase; AWS decides.
+*  - An absent or unusable LIVE counterpart is not a decrease. Without a
+*    number to compare against there is no evidence of one. Only the LIVE side
+*    can reach that arm: the desired side is a COERCED spec, so a malformed
+*    template value has already been dropped by {@link coerceWarmThroughput}.
+*
+* A decrease therefore requires every declared member to be at-or-below live
+* AND at least one to be strictly below.
+*
+* The skip this drives is right for EVERY `update()` caller — the deploy
+* engine, `cdkd drift --revert`, and the rollback executor's two revert arms —
+* because none of them can make AWS lower the value, so none loses anything a
+* doomed call would have achieved.
+*/
+function isWarmThroughputDecrease(desired, live) {
+	if (desired === void 0 || live === void 0) return false;
+	let sawDecrease = false;
+	for (const member of WARM_THROUGHPUT_MEMBERS) {
+		if (desired[member] === void 0) continue;
+		const wanted = toFiniteNumber(desired[member]);
+		const current = toFiniteNumber(live[member]);
+		if (wanted === void 0 || current === void 0) return false;
+		if (wanted > current) return false;
+		if (wanted < current) sawDecrease = true;
+	}
+	return sawDecrease;
+}
+
 //#endregion
 //#region src/provisioning/providers/dynamodb-table-provider.ts
 /**
@@ -14091,28 +14294,6 @@ function hasUsableTableCapacity(value) {
 	return true;
 }
 /**
-* A capacity member, or `undefined` when the value is not a usable number.
-*
-* `Number()` coercion is NOT good enough here and the first draft of this
-* helper shipped that bug: `Number(null)`, `Number('')`, `Number([])` and
-* `Number(false)` are all **0**, not `NaN` — so a live `0` would have compared
-* EQUAL to a desired `null` / `''` / `[]` / `false` and suppressed the call.
-* The blast radius on DynamoDB is small (a PROVISIONED index's capacity is
-* always >= 1), but the rule this encodes is copied to other providers, so it
-* is spelled correctly rather than relying on the type that happens to be
-* unreachable today.
-*
-* A YAML-borne numeric STRING is still accepted, because that is a real
-* template shape and `'5'` genuinely means 5.
-*/
-function capacityNumber(value) {
-	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
-	if (typeof value === "string" && value.trim() !== "") {
-		const n = Number(value);
-		return Number.isFinite(n) ? n : void 0;
-	}
-}
-/**
 * Does the capacity AWS currently holds for a GSI already equal the pair the
 * template requests? (issue #1630)
 *
@@ -14131,10 +14312,10 @@ function capacityNumber(value) {
 */
 function liveCapacityAlreadyMatches(live, requested) {
 	if (live === void 0) return false;
-	const liveRead = capacityNumber(live.ReadCapacityUnits);
-	const liveWrite = capacityNumber(live.WriteCapacityUnits);
-	const wantRead = capacityNumber(requested.ReadCapacityUnits);
-	const wantWrite = capacityNumber(requested.WriteCapacityUnits);
+	const liveRead = toFiniteNumber(live.ReadCapacityUnits);
+	const liveWrite = toFiniteNumber(live.WriteCapacityUnits);
+	const wantRead = toFiniteNumber(requested.ReadCapacityUnits);
+	const wantWrite = toFiniteNumber(requested.WriteCapacityUnits);
 	if (liveRead === void 0 || liveWrite === void 0) return false;
 	if (wantRead === void 0 || wantWrite === void 0) return false;
 	return liveRead === wantRead && liveWrite === wantWrite;
@@ -14182,8 +14363,10 @@ const BILLING_FLIP_ACTIVE_WAIT_ATTEMPTS = 600;
 * Still not `!== undefined`, and still ONE spelling for the write sites and the
 * drift side both: a value this refuses is a value cdkd does not send, so the
 * readback must not emit AWS's computed value as though the template had asked
-* for it. A YAML-borne numeric STRING is accepted, via {@link capacityNumber},
-* because `'12000'` genuinely means 12000.
+* for it. A YAML-borne numeric STRING is accepted, by the shared coercion's own
+* number reader ({@link toFiniteNumber}, in `../dynamodb-warm-throughput.ts` —
+* the one this file's capacity paths read too), because `'12000'` genuinely
+* means 12000.
 */
 function isSendableWarmThroughput(value) {
 	return coerceWarmThroughput(value) !== void 0;
@@ -14204,8 +14387,9 @@ function isSendableWarmThroughput(value) {
 * over), and it makes the quoted form WORK instead of merely warning.
 *
 * Per MEMBER, so a bad one cannot take a good one with it, and never `NaN`:
-* {@link capacityNumber} accepts a number or a numeric string and rejects
-* everything else, so a member that does not resolve is OMITTED from the spec
+* the shared coercion's number reader is {@link toFiniteNumber} — a number or
+* a numeric string, everything else rejected — so a member that
+* does not resolve is OMITTED from the spec
 * and reported in `dropped` for the caller to announce. AWS accepts a
 * one-member `WarmThroughput` (measured us-east-1, 2026-08-13: an
 * `UpdateTable` carrying only `ReadUnitsPerSecond` is a valid request shape —
@@ -14244,27 +14428,22 @@ function isSendableWarmThroughput(value) {
 * the comparator's `deepEqual` is strict about that. It is the generic
 * stringly-typed-CFn class (every numeric property has it), not something this
 * coercion can reach from the write side.
+*
+* The RULE moved to `../dynamodb-warm-throughput.ts` when
+* `AWS::DynamoDB::GlobalTable` needed the same one (issue #1857); this is the
+* local adapter onto the shape this file's four call sites already read, so
+* the behaviour, the signature and the tests are unchanged. The shared
+* coercion always reports `droppedMembers`, including on a total refusal —
+* that arm is unreachable from here, since a `usable === 0` outcome maps to
+* `undefined` and the names go with it, which is exactly what this file did
+* before.
 */
 function coerceWarmThroughput(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
-	const bag = value;
-	const spec = {};
-	const dropped = [];
-	let usable = 0;
-	for (const member of ["ReadUnitsPerSecond", "WriteUnitsPerSecond"]) {
-		if (bag[member] === void 0) continue;
-		const n = capacityNumber(bag[member]);
-		if (n === void 0) {
-			dropped.push(member);
-			continue;
-		}
-		spec[member] = n;
-		usable++;
-	}
-	if (usable === 0) return void 0;
+	const { spec, droppedMembers } = coerceWarmThroughput$1(value);
+	if (spec === void 0) return void 0;
 	return {
 		spec,
-		dropped
+		dropped: [...droppedMembers]
 	};
 }
 /**
@@ -14337,60 +14516,6 @@ function declaresWarmThroughput(properties) {
 	return properties !== void 0 && isSendableWarmThroughput(properties["WarmThroughput"]);
 }
 /**
-* Is the WarmThroughput this update would SEND a DECREASE of what AWS already
-* holds (issue #1768)?
-*
-* Measured live (us-east-1, 2026-08-13) against a table AWS reports
-* `{ReadUnitsPerSecond: 12000, WriteUnitsPerSecond: 4000}` for:
-*
-* ```
-* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000, WriteUnitsPerSecond: 2000}
-*   ValidationException: One or more parameter values were invalid: Requested
-*   ReadUnitsPerSecond for WarmThroughput for table is lower than current
-*   WarmThroughput, decreasing WarmThroughput is not supported
-* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000}      -> same rejection
-* UpdateTable WarmThroughput={WriteUnitsPerSecond: 2000}     -> same rejection, naming WriteUnitsPerSecond
-* UpdateTable WarmThroughput={12000, 4000}  (re-assert)      -> ACCEPTED
-* ```
-*
-* So the value is one AWS raises with the table's traffic and never lowers,
-* and a decrease is REJECTED rather than accepted-and-ignored — which is what
-* the issue said to measure before choosing, because the two produce different
-* correct answers. The caller SKIPS the call on a true here.
-*
-* Rules, each one chosen so the skip is right for EVERY `update()` caller
-* (the deploy engine, `cdkd drift --revert`, and the rollback executor's two
-* revert arms — none of which can make AWS lower the value, so none of them
-* loses anything a doomed call would have achieved):
-*
-* - Only the members the desired side DECLARES are examined; an omitted member
-*   is not sent and cannot be a decrease.
-* - EVERY declared member must be at-or-below its live counterpart AND at
-*   least one strictly below. A MIXED request (one member up, one down) still
-*   goes out: AWS rejects it by name, which is the pre-fix behavior and better
-*   than silently dropping the increase the user asked for.
-* - Anything not resolvable to a finite number fails OPEN (the call is still
-*   issued): the worst case is the pre-fix behavior, whereas a false positive
-*   would silently drop a real increase. Only the LIVE side can actually reach
-*   that arm now (PR review round 8): the desired side is a COERCED spec, so a
-*   malformed template value or an unresolved intrinsic has already been
-*   dropped by {@link coerceWarmThroughput} and cannot arrive here. The check
-*   is kept for the live side, which is whatever `DescribeTable` returned.
-*/
-function isWarmThroughputDecrease(desired, live) {
-	if (live === void 0) return false;
-	let sawDecrease = false;
-	for (const member of ["ReadUnitsPerSecond", "WriteUnitsPerSecond"]) {
-		if (desired[member] === void 0) continue;
-		const wanted = capacityNumber(desired[member]);
-		const current = capacityNumber(live[member]);
-		if (wanted === void 0 || current === void 0) return false;
-		if (wanted > current) return false;
-		if (wanted < current) sawDecrease = true;
-	}
-	return sawDecrease;
-}
-/**
 * Does the warm throughput AWS currently holds already equal what this update
 * would request (issue #1768 PR review)?
 *
@@ -14419,10 +14544,10 @@ function isWarmThroughputDecrease(desired, live) {
 function warmThroughputAlreadyMatches(desired, live) {
 	if (live === void 0) return false;
 	let compared = 0;
-	for (const member of ["ReadUnitsPerSecond", "WriteUnitsPerSecond"]) {
+	for (const member of WARM_THROUGHPUT_MEMBERS) {
 		if (desired[member] === void 0) continue;
-		const wanted = capacityNumber(desired[member]);
-		const current = capacityNumber(live[member]);
+		const wanted = toFiniteNumber(desired[member]);
+		const current = toFiniteNumber(live[member]);
 		if (wanted === void 0 || current === void 0) return false;
 		if (wanted !== current) return false;
 		compared++;
@@ -15529,7 +15654,7 @@ var DynamoDBTableProvider = class {
 	*/
 	skipZeroCapacityIndexUpdate(indexName, physicalId, requested) {
 		if (requested === void 0) return false;
-		if (capacityNumber(requested.ReadCapacityUnits) !== 0 || capacityNumber(requested.WriteCapacityUnits) !== 0) return false;
+		if (toFiniteNumber(requested.ReadCapacityUnits) !== 0 || toFiniteNumber(requested.WriteCapacityUnits) !== 0) return false;
 		this.logger.warn(`GSI ${indexName} on DynamoDB table ${physicalId}: the requested ProvisionedThroughput is {ReadCapacityUnits: 0, WriteCapacityUnits: 0}, which is AWS's on-demand placeholder rather than a capacity DynamoDB accepts (the minimum is 1), so no per-index throughput update was sent. This usually means the value came from a pre-#1767 cdkd state record — a \`cdkd drift --revert\` of such a record, or a rollback replaying it. Re-run \`cdkd deploy\` (or \`cdkd drift --accept\`) to refresh the record.`);
 		return true;
 	}
@@ -16425,6 +16550,35 @@ var DynamoDBGlobalTableProvider = class {
 		}
 	}
 	/**
+	* The `WarmThroughput` block to put on ONE `GlobalSecondaryIndexUpdate`, or
+	* `undefined` when it must not be sent (issue #1857).
+	*
+	* ONE helper for all three `UpdateTable` send sites — the billing-flip
+	* ride-along, the `added` loop's `Create`, and the `modified` loop's
+	* `Update` — because three copies of a decrease guard is three chances to
+	* word one differently, and the whole point of {@link isWarmThroughputDecrease}
+	* is that the answer does not depend on which site asked.
+	*
+	* The `desired` argument is already COERCED (`toSdkGlobalSecondaryIndexes`
+	* did it), so an unusable block never reaches here at all: it was refused
+	* and reported during translation, and arrives as `undefined`. What is left
+	* for this helper is the one question translation cannot answer, because it
+	* needs live AWS state: would this call LOWER what AWS reports?
+	*
+	* The refusal is a WARN and a dropped member, not a throw. A decrease is a
+	* template that has fallen behind a value AWS grew on its own; failing the
+	* deploy over it would block every unrelated change to the same table, and
+	* there is no template edit that "fixes" it other than raising a number the
+	* user never chose.
+	*/
+	warmThroughputForSend(indexName, desired, liveWarmByIndexName, logicalId, physicalId) {
+		if (!desired) return void 0;
+		const live = liveWarmByIndexName.get(indexName);
+		if (!isWarmThroughputDecrease(desired, live)) return desired;
+		const format = (spec) => WARM_THROUGHPUT_MEMBERS.filter((m) => spec?.[m] !== void 0).map((m) => `${m}=${spec?.[m]}`).join(", ");
+		this.logger.warn(`DynamoDB GlobalTable ${logicalId}: GSI '${indexName}' on ${physicalId}: WarmThroughput was NOT sent — the template asks for ${format(desired)} while AWS reports ${format(live)}, and DynamoDB rejects a decrease ("decreasing WarmThroughput is not supported"). Warm throughput only rises with a table's traffic, so a template below the live value can never be applied; raise it to at least the live value, or remove it. Every other change to this index is applied normally.`);
+	}
+	/**
 	* Add a single replica region. Issues one `UpdateTableCommand` with
 	* `ReplicaUpdates: [{ Create: { RegionName, ... } }]` and polls
 	* `DescribeTable` until the replica's `ReplicaStatus` flips to ACTIVE.
@@ -16510,6 +16664,16 @@ var DynamoDBGlobalTableProvider = class {
 				return (props["Replicas"] ?? []).find((r) => r["Region"] === currentRegion)?.["Tags"];
 			};
 			if (tableArn) await this.applyTagDiff(tableArn, extractLocalTags(previousProperties), extractLocalTags(properties));
+			const liveWarmByIndexName = /* @__PURE__ */ new Map();
+			for (const liveGsi of describeResp.Table?.GlobalSecondaryIndexes ?? []) {
+				const name = liveGsi.IndexName;
+				const warm = liveGsi.WarmThroughput;
+				if (typeof name !== "string" || !warm) continue;
+				const spec = {};
+				if (warm.ReadUnitsPerSecond !== void 0) spec.ReadUnitsPerSecond = warm.ReadUnitsPerSecond;
+				if (warm.WriteUnitsPerSecond !== void 0) spec.WriteUnitsPerSecond = warm.WriteUnitsPerSecond;
+				if (Object.keys(spec).length > 0) liveWarmByIndexName.set(name, spec);
+			}
 			const recordedOldBilling = previousProperties["BillingMode"];
 			const recordedOldBillingAbsent = recordedOldBilling === void 0;
 			const recordedOldBillingUsable = typeof recordedOldBilling === "string" && recordedOldBilling.trim() !== "";
@@ -16659,11 +16823,11 @@ var DynamoDBGlobalTableProvider = class {
 						const gsi = byIndexName.get(indexName);
 						if (!gsi?.ProvisionedThroughput) continue;
 						const previousWarm = previousByIndexName.get(indexName)?.WarmThroughput;
-						const warmChanged = gsi.WarmThroughput !== void 0 && !deepEqual$1(gsi.WarmThroughput, previousWarm);
+						const warmToSend = gsi.WarmThroughput !== void 0 && !deepEqual$1(gsi.WarmThroughput, previousWarm) ? this.warmThroughputForSend(indexName, gsi.WarmThroughput, liveWarmByIndexName, logicalId, physicalId) : void 0;
 						indexUpdates.push({ Update: {
 							IndexName: indexName,
 							ProvisionedThroughput: gsi.ProvisionedThroughput,
-							...warmChanged && { WarmThroughput: gsi.WarmThroughput }
+							...warmToSend && { WarmThroughput: warmToSend }
 						} });
 						if (survivingIndexNames.has(indexName)) gsiHandledByBillingFlip.add(indexName);
 					}
@@ -16798,13 +16962,14 @@ var DynamoDBGlobalTableProvider = class {
 			}
 			for (const gsi of gsiDiff.added) {
 				if (!gsi.IndexName || !gsi.KeySchema || !gsi.Projection) continue;
+				const addedWarmToSend = this.warmThroughputForSend(gsi.IndexName, gsi.WarmThroughput, liveWarmByIndexName, logicalId, physicalId);
 				const gsiUpdate = { Create: {
 					IndexName: gsi.IndexName,
 					KeySchema: gsi.KeySchema,
 					Projection: gsi.Projection,
 					...gsi.ProvisionedThroughput && { ProvisionedThroughput: gsi.ProvisionedThroughput },
 					...gsi.OnDemandThroughput && { OnDemandThroughput: gsi.OnDemandThroughput },
-					...gsi.WarmThroughput && { WarmThroughput: gsi.WarmThroughput }
+					...addedWarmToSend && { WarmThroughput: addedWarmToSend }
 				} };
 				await this.dynamoDBClient.send(new UpdateTableCommand({
 					TableName: physicalId,
@@ -16831,9 +16996,14 @@ var DynamoDBGlobalTableProvider = class {
 				if (Object.keys(onDemand).length > 0) update.OnDemandThroughput = onDemand;
 				if (!billingFlipped && gsi.ProvisionedThroughput) update.ProvisionedThroughput = gsi.ProvisionedThroughput;
 				const previousSdk = previousSdkByName.get(gsi.IndexName);
-				if (gsi.WarmThroughput !== void 0 && !deepEqual$1(gsi.WarmThroughput, previousSdk?.WarmThroughput)) update.WarmThroughput = gsi.WarmThroughput;
+				let warmDecreaseRefused = false;
+				if (gsi.WarmThroughput !== void 0 && !deepEqual$1(gsi.WarmThroughput, previousSdk?.WarmThroughput)) {
+					const warmToSend = this.warmThroughputForSend(gsi.IndexName, gsi.WarmThroughput, liveWarmByIndexName, logicalId, physicalId);
+					if (warmToSend) update.WarmThroughput = warmToSend;
+					else warmDecreaseRefused = true;
+				}
 				if (!update.ProvisionedThroughput && !update.OnDemandThroughput && !update.WarmThroughput) {
-					if (!billingFlipped && unresolvedMembers.length === 0) this.logger.warn(`GSI '${gsi.IndexName}' on ${physicalId} changed in a way DynamoDB's UpdateTable cannot express (KeySchema / Projection are immutable on an existing index). Recreate the index under a new name to apply the change.`);
+					if (!billingFlipped && unresolvedMembers.length === 0 && !warmDecreaseRefused) this.logger.warn(`GSI '${gsi.IndexName}' on ${physicalId} changed in a way DynamoDB's UpdateTable cannot express (KeySchema / Projection are immutable on an existing index). Recreate the index under a new name to apply the change.`);
 					continue;
 				}
 				const gsiUpdate = { Update: update };
@@ -17310,9 +17480,27 @@ var DynamoDBGlobalTableProvider = class {
 		try {
 			if (hasTransitionalIndex(preDeleteIndexes)) {
 				this.logger.debug(`Waiting for indexes on ${physicalId} to settle before DeleteTable (issue #1521)`);
-				await this.waitForIndexesActive(physicalId, logicalId);
+				await this.waitForIndexesActive(physicalId, logicalId, { proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE });
 			}
-			await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: physicalId }));
+			let deleteAttempts = 0;
+			await withRetry(async () => {
+				if (deleteAttempts++ > 0) {
+					if (deleteAttempts === 2) {
+						const remainingAttempts = 1 + DELETE_INDEX_BUSY_MAX_RETRIES - deleteAttempts;
+						this.logger.warn(`DynamoDB GlobalTable ${logicalId}: AWS refused DeleteTable on ${physicalId} because a global secondary index is still being created, updated or deleted — application auto-scaling can start an index capacity change at any moment, including during this destroy. Waiting for the index to settle and retrying (up to ${remainingAttempts} more attempts, each preceded by up to ${DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS} DescribeTable polls ~1s apart — a little over a minute of settling per attempt). Nothing is wrong with the table; a large index backfill can outlast this budget, in which case the destroy fails with AWS's own message and re-running it succeeds once the index is ACTIVE.`);
+					}
+					await this.waitForIndexesActive(physicalId, logicalId, {
+						maxAttempts: DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS,
+						proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE
+					});
+				}
+				await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: physicalId }));
+			}, logicalId, {
+				maxRetries: DELETE_INDEX_BUSY_MAX_RETRIES,
+				isRetryable: (message) => isIndexBusyDeleteError(message),
+				logger: this.logger,
+				sleep: (ms) => deleteTableRetryDelays.sleep ? deleteTableRetryDelays.sleep(ms) : new Promise((resolve) => setTimeout(resolve, ms))
+			});
 			await this.waitForTableGone(physicalId, logicalId);
 			this.logger.debug(`Successfully deleted DynamoDB GlobalTable ${logicalId}`);
 		} catch (error) {
@@ -17928,22 +18116,49 @@ var DynamoDBGlobalTableProvider = class {
 	* throwing. A missed registration self-heals on the next deploy (the
 	* reconcile re-asserts anything not already present), whereas throwing
 	* here would fail a deploy whose actual resources are all correct. Index
-	* backfill on a large table can take a long time, hence the 15-minute cap.
-	* The caller that follows it with a mutating call keeps AWS's own error as
-	* the backstop for the case where even that cap is not enough.
-	*/
-	async waitForIndexesActive(tableName, logicalId) {
-		const maxAttempts = 900;
+	* backfill on a large table can take a long time, hence the 15-minute
+	* DEFAULT cap. The caller that follows it with a mutating call keeps AWS's
+	* own error as the backstop for the case where even that cap is not enough.
+	*
+	* `opts.maxAttempts` exists because the cap is only right for a wait that
+	* runs ONCE: the #1830 delete retry re-runs this per attempt, so the caller's
+	* wall clock is the product and the default would blow past the per-resource
+	* deadline `destroy-runner.ts` enforces.
+	*
+	* `opts.proceedNote` covers the OTHER thing that is caller-specific: what it
+	* costs when the wait ends WITHOUT confirming. Both arms that end that way —
+	* the timeout, and a `DescribeTable` that failed for a reason other than
+	* throttling or a gone table — stop waiting and let the caller proceed, so
+	* one note serves both. The consequences genuinely differ: on the delete
+	* path AWS refuses the `DeleteTable` and that refusal is the backstop, while
+	* the auto-scaling caller has NO backstop — `reconcileAutoScalingTargets`
+	* simply skips an index that is not ready and nothing downstream refuses.
+	* The default sentence is the auto-scaling one; every delete-path caller
+	* passes {@link DELETE_INDEX_WAIT_PROCEED_NOTE}.
+	*/
+	async waitForIndexesActive(tableName, logicalId, opts) {
+		const maxAttempts = opts?.maxAttempts ?? 900;
+		const proceedNote = opts?.proceedNote ?? "auto-scaling registration for a still-building index may have been skipped. The next deploy re-asserts it.";
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
 			try {
 				if (!hasTransitionalIndex((await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.GlobalSecondaryIndexes ?? [])) return;
 			} catch (err) {
-				this.logger.debug(`DescribeTable while waiting for indexes on ${tableName}: ${err instanceof Error ? err.message : String(err)}`);
+				const message = err instanceof Error ? err.message : String(err);
+				if (isThrottlingError(err)) {
+					this.logger.debug(`DescribeTable throttled while waiting for indexes on ${tableName} (attempt ${attempt}/${maxAttempts}); still waiting: ${message}`);
+					await new Promise((resolve) => setTimeout(resolve, 1e3));
+					continue;
+				}
+				if (err instanceof ResourceNotFoundException$1) {
+					this.logger.debug(`Table ${tableName} (${logicalId}) no longer exists while waiting for indexes`);
+					return;
+				}
+				this.logger.warn(`DescribeTable failed while waiting for indexes on ${tableName} (${logicalId}), so cdkd stopped waiting; ${proceedNote} DescribeTable error: ${message}`);
 				return;
 			}
 			await new Promise((resolve) => setTimeout(resolve, 1e3));
 		}
-		this.logger.warn(`Indexes on ${tableName} (${logicalId}) did not all reach ACTIVE within ${maxAttempts}s; auto-scaling registration for a still-building index may have been skipped. The next deploy re-asserts it.`);
+		this.logger.warn(`Indexes on ${tableName} (${logicalId}) did not all reach ACTIVE within ${maxAttempts} DescribeTable polls (~1s apart, so a little over ${maxAttempts}s of wall clock); ${proceedNote}`);
 	}
 	/**
 	* Wait until a specific replica's `ReplicaStatus` flips to ACTIVE.
@@ -18082,6 +18297,14 @@ function autoScalingResourceId(tableName, indexName) {
 */
 const autoScalingRetryDelays = {};
 /**
+* Test seam for the index-busy `DeleteTable` retry's backoff (issue #1830),
+* mirroring {@link autoScalingRetryDelays}. Production leaves `sleep`
+* undefined so `withRetry`'s real schedule applies; a test injects a no-op so
+* the ~47s budget does not have to be waited out. Kept SEPARATE from the
+* auto-scaling seam so a test can slow one path without silencing the other.
+*/
+const deleteTableRetryDelays = {};
+/**
 * Resource ids per `DescribeScalableTargets` request. Kept at the API's
 * documented per-page ceiling rather than a larger guess — the request is
 * paginated anyway, and over-asking risks a `ValidationException` that would
@@ -18235,12 +18458,113 @@ const INDEX_TRANSITIONAL_STATUSES = /* @__PURE__ */ new Set([
 function hasTransitionalIndex(indexes) {
 	return (indexes ?? []).some((gsi) => INDEX_TRANSITIONAL_STATUSES.has(gsi.IndexStatus ?? ""));
 }
-/** Coerce a CFn numeric (CFn is stringly-typed) to a finite number. */
-function toFiniteNumber(value) {
-	if (value === void 0 || value === null || value === "") return void 0;
-	if (typeof value !== "number" && typeof value !== "string") return void 0;
-	const n = Number(value);
-	return Number.isFinite(n) ? n : void 0;
+/**
+* AWS's refusal when `DeleteTable` lands while one of the table's GSIs is
+* mid-transition (issue #1830). Observed verbatim on a real destroy:
+*
+*   Attempt to change a resource which is still in use: Cannot delete table
+*   while indexes are being created, updated, or deleted.
+*
+* Matched on the leading clause rather than on the whole sentence: the
+* trailing status list is AWS wording that can gain a state without changing
+* what the message MEANS, and the leading clause is already specific enough
+* that nothing else in the DynamoDB surface produces it. Case-insensitive
+* because the text arrives inside a wrapper prefix whose casing is not ours.
+*
+* Deliberately NOT keyed on the exception NAME: AWS reports this as a plain
+* `ResourceInUseException`, which is the same name it uses for genuinely
+* terminal conflicts (deleting a table that is `CREATING`, creating one that
+* already exists). Retrying on the name would turn those into a 47s stall
+* before the same failure.
+*/
+const INDEX_BUSY_DELETE_MESSAGE = /cannot delete table while indexes are being/i;
+function isIndexBusyDeleteError(message) {
+	return INDEX_BUSY_DELETE_MESSAGE.test(message);
+}
+/**
+* Retry budget for the index-busy `DeleteTable` refusal (issue #1830).
+*
+* Left at `withRetry`'s own default of 8 rather than raised. Named rather than
+* inlined because passing it at all is what opts this call out of
+* `withRetry`'s dense IAM-propagation schedule, which would be wrong for a
+* condition measured in seconds-to-minutes rather than sub-second.
+*
+* The count MULTIPLIES the per-attempt re-arm poll below, so the two have to
+* be read together — see {@link DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS} for the
+* arithmetic and for why the poll is not the 15-minute one.
+*/
+const DELETE_INDEX_BUSY_MAX_RETRIES = 8;
+/**
+* Seconds the index-busy `DeleteTable` retry spends re-arming BEFORE each
+* retry (issue #1830) — one `DescribeTable` per second, and it returns on the
+* first one that reports every index settled.
+*
+* Bounded well under
+* {@link DynamoDBGlobalTableProvider['waitForIndexesActive']}'s 15-minute
+* default because THAT default is sized for a wait that runs once, while this
+* one runs per retry: the caller's wall clock is
+* `DELETE_INDEX_BUSY_MAX_RETRIES x this + withRetry's ~47s of backoff`, and
+* `destroy-runner.ts` caps a single `delete()` at the per-resource deadline
+* (30 min by default; this provider declares no `getMinResourceTimeoutMs` to
+* lift it). At 900s the product was ~2h, so a genuinely stuck index produced a
+* 30-minute wait ending in a generic `ResourceTimeoutError` that never
+* mentions indexes. At 60s the worst case is ~8.8 min and the user gets AWS's
+* own actionable sentence instead.
+*
+* The FIRST attempt is unaffected — it does not re-arm at all, and the #1521
+* pre-delete gate ahead of the loop keeps its full 15-minute poll.
+*/
+const DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS = 60;
+/**
+* What proceeding costs when a DELETE-path index-settle wait ends WITHOUT
+* confirming — passed as
+* {@link DynamoDBGlobalTableProvider['waitForIndexesActive']}'s `proceedNote`
+* by BOTH delete-path callers (the #1521 pre-delete gate and the #1830 retry
+* re-arm).
+*
+* The default note that helper falls back to is the auto-scaling caller's, and
+* it is not merely unhelpful here but wrong: nothing on the delete path
+* re-asserts anything on a later deploy. Conversely the delete path really
+* does have a backstop — `DeleteTable` follows immediately and AWS refuses it
+* again if the index is still transitioning — which the auto-scaling caller
+* does not: `reconcileAutoScalingTargets` skips an index that is not ready and
+* nothing downstream notices. One sentence per caller, so neither claims the
+* other's safety net.
+*/
+const DELETE_INDEX_WAIT_PROCEED_NOTE = `the DeleteTable goes ahead anyway and AWS's own refusal stays the backstop.`;
+/**
+* Build the {@link ThroughputDiagnostic} for a `WarmThroughput` block that did
+* not survive coercion intact, or `undefined` when it did.
+*
+* Two distinct outcomes, worded differently because the remedy differs:
+*  - PARTIAL — one member dropped, the other still sent. The call goes ahead;
+*    the user needs to know which half silently did not.
+*  - REFUSED — nothing sendable. No call is made for the property at all,
+*    which is the point (issue #1857 defect 3): forwarding the malformed block
+*    would surface as an AWS validation error that names neither cdkd nor the
+*    property.
+*/
+function warmThroughputDiagnostic(raw, coercion, indexName) {
+	if (raw === void 0 || raw === null) return void 0;
+	const scope = {
+		kind: "unresolved-member",
+		member: "WarmThroughput"
+	};
+	const dropped = coercion.droppedMembers.join(" / ");
+	if (coercion.spec) {
+		if (coercion.droppedMembers.length === 0) return void 0;
+		const kept = WARM_THROUGHPUT_MEMBERS.filter((m) => coercion.spec?.[m] !== void 0).join(" / ");
+		return {
+			...scope,
+			...indexName !== void 0 && { indexName },
+			message: `WarmThroughput.${dropped} did not resolve to a number and was DROPPED; ${kept} is still sent. AWS types these as numbers, so a quoted "12000" is fine but an unresolved intrinsic or an object is not. The dropped member keeps its current AWS value until the template supplies a usable one.`
+		};
+	}
+	return {
+		...scope,
+		...indexName !== void 0 && { indexName },
+		message: `WarmThroughput is declared but no member resolved to a number${dropped ? ` (${dropped})` : ""}, so the whole block is REFUSED and not sent. Forwarding it would fail as an opaque AWS validation error naming neither cdkd nor the property. Set WarmThroughput.ReadUnitsPerSecond / WriteUnitsPerSecond to numbers, or remove the block. Nothing else about the index is affected.`
+	};
 }
 /**
 * Merge an explicitly-supplied, already-SDK-shaped throughput block over a
@@ -18535,7 +18859,10 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 			KeySchema: gsi["KeySchema"],
 			Projection: gsi["Projection"]
 		};
-		if (gsi["WarmThroughput"] !== void 0) sdk.WarmThroughput = gsi["WarmThroughput"];
+		const warmCoercion = coerceWarmThroughput$1(gsi["WarmThroughput"]);
+		if (warmCoercion.spec) sdk.WarmThroughput = warmCoercion.spec;
+		const warmDiagnostic = warmThroughputDiagnostic(gsi["WarmThroughput"], warmCoercion, typeof indexName === "string" ? indexName : void 0);
+		if (warmDiagnostic) diagnostics?.push(warmDiagnostic);
 		const explicitProvisioned = asRecord$1(gsi["ProvisionedThroughput"]);
 		const explicitOnDemand = asRecord$1(gsi["OnDemandThroughput"]);
 		if (explicitProvisioned && billingMode !== "PROVISIONED") diagnostics?.push({
@@ -79780,7 +80107,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.27");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.28");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;