@go-to-k/cdkd 0.283.8 → 0.283.10

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as resolveAutoAssetStorage, A as cyan, An as LocalMigrateError, At as createAssetRedirectResolver, B as findSilentDropProperties, Bn as StackTerminationProtectionError, Bt as buildDenyExternalAccessPolicy, C as makeCanonicalizePropertiesFn, Cn as setAwsClients, Ct as S3StateBackend, D as renderStatefulReason, Dt as stringifyValue, E as isStatefulRecreateTargetSync, Et as AssetPublisher, F as IAMRoleProvider, Fn as PartialFailureError, Ft as ensureAssetStorage, G as IntrinsicFunctionResolver, Gn as normalizeAwsError, Gt as runDockerStreaming, H as slowCcOperationTimeoutMs, Ht as formatDockerLoginError, I as collectInlinePolicyNamesManagedBySiblings, In as ProvisioningError, It as getBootstrapMarkerKey, J as refStateLookupFromResource, Jt as Synthesizer, K as cfnRefValueFromPhysicalId, Kn as withErrorHandling, Kt as AssetManifestLoader, L as clearOnUpdateRemoval, Ln as ResourceTimeoutError, Lt as parseBootstrapMarker, M as green, Mt as rewriteTemplateAssetReferences, N as red, Nn as MissingCdkCliError, Nt as AssetModeResolver, O as formatResourceLine, On as DeployCancelledError, Ot as WorkGraph, P as yellow, Pn as NestedStackChildDirectDestroyError, Pt as BOOTSTRAP_MARKER_PREFIX, Q as assertRegionMatch, Qt as resolveApp, R as ProviderRegistry, Rn as ResourceUpdateNotSupportedError, Rt as validateAssetBucketName, S as unsupportedFinalSnapshotError, Sn as resetAwsClients, St as LockManager, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as CdkdError, Tt as shouldRetainResource, U as disableInstanceApiTermination, Ut as getDockerCmd, V as CloudControlProvider, Vt as buildDockerImage, W as isTerminationProtectionPropagationError, Wt as runDockerForeground, X as normalizeAwsTagsToCfn, Xt as getDefaultStateBucketName, Y as WAFv2WebACLProvider, Yt as synthesisStatusMessage, Z as resolveExplicitPhysicalId, Zt as getLegacyStateBucketName, _ as buildFinalSnapshotIdentifier, _n as processStackMessages, _t as isRetryableTransientError, a as DeploymentEventsStore, an as stateBucketExistenceConfirmed, at as requireConfigObject, b as isFinalSnapshotError, bn as AwsClients, bt as DagBuilder, c as replayFailedOperations, cn as CFN_TEMPLATE_URL_LIMIT, ct as s3BucketDomainName, d as deleteSkipReason, dn as uploadCfnTemplate, dt as s3BucketWebsiteUrl, en as resolveCaptureObservedState, et as configBooleanRefusal, f as withResourceDeadline, fn as expectedOwnerParam, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as AssemblyReader, gt as isMarkedNonRetryable, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as derivePartitionAndUrlSuffix, ht as withRetry, i as DeploymentEventsReader, in as resolveUseCdkBootstrapAssets, it as requireConfigArray, j as gray, jn as LocalStartServiceError, jt as loadPublishableAssetManifest, k as bold, kn as LocalInvokeBuildError$1, kt as buildAssetRedirectMap, l as replayRollback, ln as MIGRATE_TMP_PREFIX, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mn as canonicalizeRegion, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveStateBucketWithDefault, nt as readConfigString, o as planFailedOps, on as warnDeprecatedNoPrefixCliFlag, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as PARTITION_TABLE, pt as DiffCalculator, q as getAccountInfo, qt as getDockerImageBySourceHash, r as DeployEngine, rn as resolveStateBucketWithDefaultAndSource, rt as replayWarn, s as planRollback, sn as CFN_TEMPLATE_BODY_LIMIT, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveSkipPrefix, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as findLargeInlineResources, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vt as isThrottlingError, w as extractDeploymentEventError, wt as rebuildClientForBucketRegion, x as refusesFinalSnapshot, xn as getAwsClients, xt as TemplateParser, y as createPreDeleteFinalSnapshot, yn as resolveBucketRegion, yt as markNonRetryable, z as findActionableSilentDrops, zn as StackHasActiveImportsError, zt as validateContainerRepoName } from "./deploy-engine-D95wmKN8.js";
+import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefaultAndSource, A as cyan, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as findSilentDropProperties, Bt as runDockerForeground, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalMigrateError, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as IntrinsicFunctionResolver, Gn as isThrottlingError, Gt as synthesisStatusMessage, H as slowCcOperationTimeoutMs, Hn as withErrorHandling, Ht as AssetManifestLoader, I as collectInlinePolicyNamesManagedBySiblings, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as refStateLookupFromResource, Jt as resolveApp, K as cfnRefValueFromPhysicalId, Kn as markNonRetryable, Kt as getDefaultStateBucketName, L as clearOnUpdateRemoval, Lt as buildDockerImage, M as green, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as red, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as formatResourceLine, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as assertRegionMatch, Qt as resolveStateBucketWithDefault, R as ProviderRegistry, Rt as formatDockerLoginError, S as unsupportedFinalSnapshotError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as isMarkedNonRetryable, Ut as getDockerImageBySourceHash, V as CloudControlProvider, Vn as normalizeAwsError, Vt as runDockerStreaming, W as isTerminationProtectionPropagationError, Wn as isRetryableTransientError, Wt as Synthesizer, X as normalizeAwsTagsToCfn, Xt as resolveCaptureObservedState, Y as WAFv2WebACLProvider, Yt as resolveAutoAssetStorage, Z as resolveExplicitPhysicalId, Zt as resolveSkipPrefix, _ as buildFinalSnapshotIdentifier, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as requireConfigObject, b as isFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketDomainName, d as deleteSkipReason, dn as derivePartitionAndUrlSuffix, dt as s3BucketWebsiteUrl, en as resolveUseCdkBootstrapAssets, et as configBooleanRefusal, f as withResourceDeadline, fn as AssemblyReader, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as AwsClients, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as resolveBucketRegion, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigArray, j as gray, jn as PartialFailureError, jt as ensureAssetStorage, k as bold, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as readConfigString, o as planFailedOps, on as findLargeInlineResources, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as processStackMessages, pt as DiffCalculator, q as getAccountInfo, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as replayWarn, s as planRollback, sn as uploadCfnTemplate, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as canonicalizeRegion, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as extractDeploymentEventError, wn as DeployCancelledError, wt as WorkGraph, x as refusesFinalSnapshot, xn as CdkdError, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as getDockerCmd } from "./deploy-engine-Bvr31OQ0.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-Tu4sDbhu.js";
+import { t as ASGProvider } from "./asg-provider-CrBdHIgB.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -14107,10 +14107,149 @@ const BILLING_FLIP_ACTIVE_WAIT_ATTEMPTS = 600;
 * though the template had asked, and `--revert` can never clear it because the
 * write gate skips the falsy value. Keep this the ONLY spelling of the rule.
 *
-* Deliberately TRUTHINESS, because that is what the wire has always done.
+* It USED to be bare truthiness, "because that is what the wire has always
+* done". PR review of issue #1768 showed that is not a rule, it is the absence
+* of one: `WarmThroughput: {}` and `WarmThroughput: 'nonsense'` are both truthy,
+* so they went out as `UpdateTable{WarmThroughput: {}}` /
+* `{WarmThroughput: 'nonsense'}` — a call that can only be rejected, and one
+* cdkd would repeat on every deploy. Harmless-looking at the table level (one
+* doomed call, loudly); newly REACHABLE per index once issue #1768's per-index
+* send path landed, where the same value is emitted once per index. So the rule
+* is now: at least ONE of the two user-settable members must resolve to a
+* finite number.
+*
+* Still not `!== undefined`, and still ONE spelling for the write sites and the
+* drift side both: a value this refuses is a value cdkd does not send, so the
+* readback must not emit AWS's computed value as though the template had asked
+* for it. A YAML-borne numeric STRING is accepted, via {@link capacityNumber},
+* because `'12000'` genuinely means 12000.
 */
 function isSendableWarmThroughput(value) {
-	return Boolean(value);
+	return coerceWarmThroughput(value) !== void 0;
+}
+/**
+* Turn a template-declared `WarmThroughput` into the NUMERIC spec cdkd puts on
+* the wire, or `undefined` when nothing in it is usable (PR review round 5).
+*
+* The send sites used to forward the declared value VERBATIM while
+* {@link isSendableWarmThroughput} accepted a numeric STRING, so the predicate
+* blessed the one shape it exists to stop: `{ReadUnitsPerSecond: '12000'}` went
+* out as `"WarmThroughput":{"ReadUnitsPerSecond":"12000"}` — a string in a Long
+* field, which DynamoDB rejects — and the drift side then answered "declared"
+* for it, so the readback emitted AWS's numeric value and the table drifted on
+* every run. Coercing rather than dropping string support is the better answer
+* for a stringly-typed CFn template (`'12000'` genuinely means 12000, and
+* `create()`'s table-level `ProvisionedThroughput` already coerces one line
+* over), and it makes the quoted form WORK instead of merely warning.
+*
+* Per MEMBER, so a bad one cannot take a good one with it, and never `NaN`:
+* {@link capacityNumber} accepts a number or a numeric string and rejects
+* everything else, so a member that does not resolve is OMITTED from the spec
+* and reported in `dropped` for the caller to announce. AWS accepts a
+* one-member `WarmThroughput` (measured us-east-1, 2026-08-13: an
+* `UpdateTable` carrying only `ReadUnitsPerSecond` is a valid request shape —
+* it was refused for being a DECREASE, not for its shape), so a partial send
+* is a real request rather than a malformed one.
+*
+* {@link isSendableWarmThroughput} is defined AS this function's success, so
+* the drift-side gate and the write-side coercion cannot answer differently —
+* structurally, not by hand. That identity is exact at the BLOCK level and
+* ONLY there (PR review round 6, where the earlier wording was measured and
+* found broader than the truth): both sides ask "is any member usable", so a
+* block cdkd sends is a block drift compares, and a block cdkd refuses is one
+* drift ignores.
+*
+* PER MEMBER it does NOT hold, and the residual is real:
+* `{ReadUnitsPerSecond: 12000, WriteUnitsPerSecond: {Ref: 'Unset'}}` sends only
+* `ReadUnitsPerSecond`, while `readCurrentState` emits AWS's computed value for
+* BOTH members and `getDriftUnknownPaths` leaves the path compared — so AWS's
+* `WriteUnitsPerSecond`, which cdkd never sent, is compared against the
+* template forever. It fails OPEN — the difference is REPORTED by `cdkd drift`,
+* never hidden — and {@link DynamoDBTableProvider.coerceWarmThroughputForSend}
+* names the dropped member when the value is APPLIED.
+*
+* How loud, precisely (measured, PR review round 7 — an earlier version of this
+* sentence said "on every deploy" and was falsified by the code two hundred
+* lines down): every warn in this provider sits behind a CHANGE gate, so the
+* drop is announced on the deploy that INTRODUCES it and is silent on every
+* repeat deploy of the same value, while the drift report persists. Loud once,
+* then a standing drift entry — not a per-deploy nag, and not silent either.
+* Closing the residual means emitting per-member, which is a `readCurrentState`
+* shape change with its own drift-baseline migration — deliberately not folded
+* into this issue.
+*
+* NOT a drift fix either way: state records what the TEMPLATE said, so a
+* `properties` baseline still holds `'12000'` against a numeric readback and
+* the comparator's `deepEqual` is strict about that. It is the generic
+* stringly-typed-CFn class (every numeric property has it), not something this
+* coercion can reach from the write side.
+*/
+function coerceWarmThroughput(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const bag = value;
+	const spec = {};
+	const dropped = [];
+	let usable = 0;
+	for (const member of ["ReadUnitsPerSecond", "WriteUnitsPerSecond"]) {
+		if (bag[member] === void 0) continue;
+		const n = capacityNumber(bag[member]);
+		if (n === void 0) {
+			dropped.push(member);
+			continue;
+		}
+		spec[member] = n;
+		usable++;
+	}
+	if (usable === 0) return void 0;
+	return {
+		spec,
+		dropped
+	};
+}
+/**
+* Is this a `WarmThroughput` the user WROTE that the tightened send rule then
+* refuses (PR review of issue #1768)?
+*
+* The set of values whose OUTCOME this issue changed, and the exact set the
+* write sites must warn about. Tightening {@link isSendableWarmThroughput}
+* closed a doomed-call class, and silently: a template declaring
+* `{ ReadUnitsPerSecnd: 20000 }` (a member typo), `'nonsense'`, `{}`, or an
+* unresolved intrinsic used to reach AWS and be REJECTED BY NAME, and now
+* vanishes with no warning, no debug line, and a green deploy — the "loud
+* failure for a quiet lie" trade the adopted-index arm in `applyGsiUpdates`
+* refuses, and out of step with every other skip in this file
+* ({@link DynamoDBTableProvider.skipZeroCapacityIndexUpdate},
+* {@link DynamoDBTableProvider.skipWarmThroughputDecrease}), which all warn.
+*
+* ABSENT is silent, because that is the ordinary case — the overwhelming
+* majority of templates declare no warm throughput at all and must not be
+* nagged. FALSY-but-present (`null`, `''`, `false`, `0`) is silent too: those
+* were skipped silently BEFORE this issue as well (`Boolean(value)` was the
+* whole rule), so they are not a behavior this PR changed and warning about
+* them would be a new noise source, not a restored signal.
+*/
+function isRefusedWarmThroughput(value) {
+	if (value === void 0) return false;
+	if (!value) return false;
+	return !isSendableWarmThroughput(value);
+}
+/**
+* Does the DESIRED bag carry enough for the drift side to answer "what did the
+* template declare"?
+*
+* An ABSENT or EMPTY bag answers NO: `drift.ts` passes `properties ?? {}`, and
+* other callers pass nothing at all, so `{}` means "nothing recorded" rather
+* than "this key is absent" (the contract on {@link ResourceProvider.getDriftUnknownPaths}).
+* Every gate below falls back to the pre-gate behavior on a NO, since dropping
+* a key on the strength of a bag that was never populated is unrecoverable
+* phantom drift in the other direction.
+*
+* Named once and shared by the table-level `WarmThroughput` gate (issue #1760)
+* and the per-index gates (issue #1767) so the two cannot answer the
+* "uninformative bag" question differently.
+*/
+function desiredBagIsInformative(properties) {
+	return properties !== void 0 && Object.keys(properties).length > 0;
 }
 /**
 * Does this desired-property bag DECLARE a table-level `WarmThroughput`?
@@ -14133,8 +14272,267 @@ function isSendableWarmThroughput(value) {
 * phantom drift, while the residual is a loud, per-resource revert failure.
 */
 function declaresWarmThroughput(properties) {
-	if (properties === void 0 || Object.keys(properties).length === 0) return true;
-	return isSendableWarmThroughput(properties["WarmThroughput"]);
+	if (!desiredBagIsInformative(properties)) return true;
+	return properties !== void 0 && isSendableWarmThroughput(properties["WarmThroughput"]);
+}
+/**
+* Is the WarmThroughput this update would SEND a DECREASE of what AWS already
+* holds (issue #1768)?
+*
+* Measured live (us-east-1, 2026-08-13) against a table AWS reports
+* `{ReadUnitsPerSecond: 12000, WriteUnitsPerSecond: 4000}` for:
+*
+* ```
+* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000, WriteUnitsPerSecond: 2000}
+*   ValidationException: One or more parameter values were invalid: Requested
+*   ReadUnitsPerSecond for WarmThroughput for table is lower than current
+*   WarmThroughput, decreasing WarmThroughput is not supported
+* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000}      -> same rejection
+* UpdateTable WarmThroughput={WriteUnitsPerSecond: 2000}     -> same rejection, naming WriteUnitsPerSecond
+* UpdateTable WarmThroughput={12000, 4000}  (re-assert)      -> ACCEPTED
+* ```
+*
+* So the value is one AWS raises with the table's traffic and never lowers,
+* and a decrease is REJECTED rather than accepted-and-ignored — which is what
+* the issue said to measure before choosing, because the two produce different
+* correct answers. The caller SKIPS the call on a true here.
+*
+* Rules, each one chosen so the skip is right for EVERY `update()` caller
+* (the deploy engine, `cdkd drift --revert`, and the rollback executor's two
+* revert arms — none of which can make AWS lower the value, so none of them
+* loses anything a doomed call would have achieved):
+*
+* - Only the members the desired side DECLARES are examined; an omitted member
+*   is not sent and cannot be a decrease.
+* - EVERY declared member must be at-or-below its live counterpart AND at
+*   least one strictly below. A MIXED request (one member up, one down) still
+*   goes out: AWS rejects it by name, which is the pre-fix behavior and better
+*   than silently dropping the increase the user asked for.
+* - Anything not resolvable to a finite number fails OPEN (the call is still
+*   issued): the worst case is the pre-fix behavior, whereas a false positive
+*   would silently drop a real increase. Only the LIVE side can actually reach
+*   that arm now (PR review round 8): the desired side is a COERCED spec, so a
+*   malformed template value or an unresolved intrinsic has already been
+*   dropped by {@link coerceWarmThroughput} and cannot arrive here. The check
+*   is kept for the live side, which is whatever `DescribeTable` returned.
+*/
+function isWarmThroughputDecrease(desired, live) {
+	if (live === void 0) return false;
+	let sawDecrease = false;
+	for (const member of ["ReadUnitsPerSecond", "WriteUnitsPerSecond"]) {
+		if (desired[member] === void 0) continue;
+		const wanted = capacityNumber(desired[member]);
+		const current = capacityNumber(live[member]);
+		if (wanted === void 0 || current === void 0) return false;
+		if (wanted > current) return false;
+		if (wanted < current) sawDecrease = true;
+	}
+	return sawDecrease;
+}
+/**
+* Does the warm throughput AWS currently holds already equal what this update
+* would request (issue #1768 PR review)?
+*
+* The warm-throughput twin of {@link liveCapacityAlreadyMatches}, and compared
+* the same way and for the same reason: the live side is a
+* `...WarmThroughputDescription` carrying an AWS-managed `Status` alongside the
+* two units, so a structural compare against the two-member desired object
+* could never match and the suppression would be dead code that only LOOKED
+* safe.
+*
+* Only the members the desired side DECLARES are compared — an omitted member
+* is not part of the request, so it cannot make the request differ. Anything
+* unresolvable fails OPEN (the call is still issued): the worst case is a
+* redundant `UpdateTable`, whereas a false MATCH silently drops a
+* warm-throughput raise the user asked for. As in
+* {@link isWarmThroughputDecrease}, only the LIVE side can reach that arm now
+* that the desired side is a coerced spec.
+*
+* Deliberately NOT applied to the TABLE-level branch, which still sends an
+* equal re-assert: that is measured-accepted by AWS (us-east-1, 2026-08-13 —
+* re-asserting `{12000, 4000}` returns a normal `TableDescription`), it is ONE
+* call rather than one per index, and its own change gate already requires the
+* value to differ from the recorded previous. The per-index path is where the
+* redundancy multiplies and where the carried #1767 residual reaches it.
+*/
+function warmThroughputAlreadyMatches(desired, live) {
+	if (live === void 0) return false;
+	let compared = 0;
+	for (const member of ["ReadUnitsPerSecond", "WriteUnitsPerSecond"]) {
+		if (desired[member] === void 0) continue;
+		const wanted = capacityNumber(desired[member]);
+		const current = capacityNumber(live[member]);
+		if (wanted === void 0 || current === void 0) return false;
+		if (wanted !== current) return false;
+		compared++;
+	}
+	return compared > 0;
+}
+/**
+* Reverse-map one live secondary-index description to its CloudFormation
+* shape (issue #1767).
+*
+* `DescribeTable` describes an index with a superset of the CFn members —
+* measured live, us-east-1 2026-08-13, on a `PAY_PER_REQUEST` table with one
+* GSI and no capacity settings:
+*
+* ```json
+* { "IndexName": "gsi1",
+*   "KeySchema": [{ "AttributeName": "gsipk", "KeyType": "HASH" }],
+*   "Projection": { "ProjectionType": "ALL" },
+*   "IndexStatus": "CREATING", "Backfilling": true,
+*   "ProvisionedThroughput": { "NumberOfDecreasesToday": 0, "ReadCapacityUnits": 0, "WriteCapacityUnits": 0 },
+*   "IndexSizeBytes": 0, "ItemCount": 0,
+*   "IndexArn": "arn:aws:dynamodb:...:table/.../index/gsi1",
+*   "WarmThroughput": { "ReadUnitsPerSecond": 12000, "WriteUnitsPerSecond": 4000, "Status": "UPDATING" } }
+* ```
+*
+* NONE of `IndexStatus` / `Backfilling` / `IndexSizeBytes` / `ItemCount` /
+* `IndexArn` is a CFn property, the `ProvisionedThroughput` block is AWS's
+* `{0, 0}` on-demand placeholder (the #1571 trap), and the per-index
+* `WarmThroughput` is the AWS-computed value the table-level gate already
+* refuses to surface (issue #1760). Forwarding the description verbatim put
+* all of them into the drift comparison, and — unlike a top-level key the
+* baseline lacks — they are members of an ARRAY the baseline DOES carry, which
+* `deepEqual` compares positionally, so every one of them participated.
+*
+* The mapper is therefore an ALLOW-LIST rather than a deny-list: a member AWS
+* adds later is dropped by construction instead of silently joining the
+* comparison.
+*
+* `desired` is the DESIRED bag's entry for the SAME `IndexName` (matched by
+* name, never by position — the list is an unordered set, see
+* {@link DynamoDBTableProvider.getDriftUnorderedPaths}). The three throughput
+* blocks are emitted only when that entry declares them, the #1760 shape one
+* nesting level down; `bagInformative` false means the caller supplied no bag
+* to decide with and every block is emitted, cleaned of its AWS-managed
+* members.
+*
+* Known residual, unchanged by this fix: CFn's per-index
+* `ContributorInsightsSpecification` has no `DescribeTable` counterpart (it
+* needs a per-index `DescribeContributorInsights` call), so a template
+* declaring one still cannot converge against a `properties` baseline. It is
+* ALSO dropped on the write side, since `create()` forwards the CFn blob to
+* `CreateTable` and the SDK serializer discards the unknown member — still
+* true after round 6 taught that path to coerce `WarmThroughput`, because the
+* entry is rebuilt with a SPREAD and every other member, known or not, rides
+* along unchanged. Filed as issue
+* [#1782](https://github.com/go-to-k/cdkd/issues/1782).
+*/
+function reverseMapSecondaryIndex(live, desired, bagInformative) {
+	const out = {};
+	if (live.IndexName !== void 0) out["IndexName"] = live.IndexName;
+	if (live.KeySchema !== void 0) out["KeySchema"] = live.KeySchema.map((element) => ({ ...element }));
+	if (live.Projection !== void 0) {
+		const projection = {};
+		if (live.Projection.ProjectionType !== void 0) projection["ProjectionType"] = live.Projection.ProjectionType;
+		if (live.Projection.NonKeyAttributes !== void 0) projection["NonKeyAttributes"] = [...live.Projection.NonKeyAttributes];
+		if (Object.keys(projection).length > 0) out["Projection"] = projection;
+	}
+	if ("ProvisionedThroughput" in live && indexDeclares(desired, "ProvisionedThroughput", bagInformative) && live.ProvisionedThroughput) {
+		const provisioned = live.ProvisionedThroughput;
+		const pt = {};
+		if (provisioned.ReadCapacityUnits !== void 0) pt["ReadCapacityUnits"] = provisioned.ReadCapacityUnits;
+		if (provisioned.WriteCapacityUnits !== void 0) pt["WriteCapacityUnits"] = provisioned.WriteCapacityUnits;
+		if (Object.keys(pt).length > 0) out["ProvisionedThroughput"] = pt;
+	}
+	if ("OnDemandThroughput" in live && indexDeclares(desired, "OnDemandThroughput", bagInformative) && live.OnDemandThroughput) {
+		const onDemand = live.OnDemandThroughput;
+		const odt = {};
+		if (onDemand.MaxReadRequestUnits !== void 0) odt["MaxReadRequestUnits"] = onDemand.MaxReadRequestUnits;
+		if (onDemand.MaxWriteRequestUnits !== void 0) odt["MaxWriteRequestUnits"] = onDemand.MaxWriteRequestUnits;
+		if (Object.keys(odt).length > 0) out["OnDemandThroughput"] = odt;
+	}
+	if ("WarmThroughput" in live && indexDeclares(desired, "WarmThroughput", bagInformative) && live.WarmThroughput) {
+		const warm = live.WarmThroughput;
+		const wt = {};
+		if (warm.ReadUnitsPerSecond !== void 0) wt["ReadUnitsPerSecond"] = warm.ReadUnitsPerSecond;
+		if (warm.WriteUnitsPerSecond !== void 0) wt["WriteUnitsPerSecond"] = warm.WriteUnitsPerSecond;
+		if (Object.keys(wt).length > 0) out["WarmThroughput"] = wt;
+	}
+	return out;
+}
+/**
+* Does the DESIRED entry for one index declare this block (issue #1767)?
+*
+* The question is always "would cdkd SEND this block", because that is what
+* makes AWS's readback value explainable by the template — so each block is
+* answered by the write rule that actually governs it, never by a second
+* spelling of one:
+*
+*  - `WarmThroughput` routes through {@link isSendableWarmThroughput}, the
+*    predicate EVERY per-index write path calls — the `Create` / `Update` GSI
+*    actions in `applyGsiUpdates` AND `create()`'s `CreateTable` forward, which
+*    maps each entry through
+*    {@link DynamoDBTableProvider.coerceIndexWarmThroughputForCreate}. It is
+*    TIGHTER than truthiness (at least one member resolving to a finite
+*    number), so `WarmThroughput: {}` is neither sent nor emitted on any path.
+*    An earlier version of this bullet carved out the TABLE-create path as an
+*    exception, and that exception was a DEFECT rather than a design: it also
+*    put a quoted `'12000'` on the wire as a string in a Long field, so one
+*    template failed on a fresh create and succeeded on a later GSI add. Fixed
+*    in PR review round 6; the carve-out is gone because the divergence is.
+*  - `ProvisionedThroughput` / `OnDemandThroughput` keep TRUTHINESS, which is
+*    what their write path does: those two members ARE still forwarded verbatim
+*    (the create-path mapper rewrites only `WarmThroughput`), and
+*    `applyGsiUpdates` gates on `gsi.ProvisionedThroughput` alone. Widening
+*    `isSendableWarmThroughput` over them would be wrong twice over — it reads
+*    members those blocks do not have (`ReadUnitsPerSecond` vs
+*    `ReadCapacityUnits`), so every declared capacity would read as undeclared.
+*
+* An UNINFORMATIVE bag answers TRUE for every block, keeping the pre-#1767
+* behavior for a caller that supplied nothing to decide with. A bag that IS
+* informative but names no entry for this index answers FALSE: the index
+* exists in AWS and not in the template, so nothing cdkd sent can explain any
+* of its throughput blocks.
+*/
+function indexDeclares(desired, key, bagInformative) {
+	if (!bagInformative) return true;
+	const value = desired?.[key];
+	return key === "WarmThroughput" ? isSendableWarmThroughput(value) : Boolean(value);
+}
+/**
+* Is this value an index list that DECLARES at least one index (issue #1767)?
+*
+* The ONE spelling of that question, shared by {@link desiredIndexEntriesByName}
+* (which decides what each live index is matched against) and by
+* {@link DynamoDBTableProvider.getDriftUnknownPaths} (which decides whether the
+* list is compared at all). Spelled independently they disagreed: a plain
+* truthiness test reads `[]` and an unresolved `{Fn::If: [...]}` as DECLARED —
+* so the list stayed in the comparison while the mapper, which needs an ARRAY
+* to match names against, treated the same value as declaring nothing and
+* stripped every throughput block from the readback. That is a one-sided
+* difference manufactured by the pair, which is the failure this file's
+* `isSendableWarmThroughput` header exists to prevent.
+*
+* Consequence worth stating: a template declaring `GlobalSecondaryIndexes: []`
+* now has that path IGNORED by the comparator, so an index created out of band
+* on such a table is not reported. That is the same answer the readback gives
+* (nothing the template declared can explain that index), and consistency
+* between the two is worth more than detection on a shape where the two used to
+* contradict each other.
+*/
+function declaresIndexList(value) {
+	return Array.isArray(value) && value.length > 0;
+}
+/**
+* Index the DESIRED bag's secondary-index list by `IndexName` (issue #1767).
+*
+* Returns an empty map for anything {@link declaresIndexList} rejects — an
+* empty array, an unresolved intrinsic, a mis-nested template value — which
+* routes every live index through {@link indexDeclares}'s "declares nothing"
+* arm. Sharing that predicate with `getDriftUnknownPaths` is what keeps the
+* emission and the comparison from answering differently for the same bag.
+*/
+function desiredIndexEntriesByName(value) {
+	const byName = /* @__PURE__ */ new Map();
+	if (!declaresIndexList(value)) return byName;
+	for (const entry of value) {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+		const name = entry["IndexName"];
+		if (typeof name === "string") byName.set(name, entry);
+	}
+	return byName;
 }
 var DynamoDBTableProvider = class {
 	dynamoDBClient;
@@ -14192,12 +14590,17 @@ var DynamoDBTableProvider = class {
 				};
 			}
 			if (properties["OnDemandThroughput"]) createParams.OnDemandThroughput = properties["OnDemandThroughput"];
-			if (isSendableWarmThroughput(properties["WarmThroughput"])) createParams.WarmThroughput = properties["WarmThroughput"];
+			const createWarmThroughput = this.coerceWarmThroughputForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"]);
+			if (createWarmThroughput) createParams.WarmThroughput = createWarmThroughput;
+			else this.warnRefusedWarmThroughput(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"]);
 			if (properties["StreamSpecification"]) createParams.StreamSpecification = {
 				StreamEnabled: true,
 				StreamViewType: properties["StreamSpecification"]["StreamViewType"]
 			};
-			if (properties["GlobalSecondaryIndexes"]) createParams.GlobalSecondaryIndexes = properties["GlobalSecondaryIndexes"];
+			if (properties["GlobalSecondaryIndexes"]) {
+				const declaredGsis = properties["GlobalSecondaryIndexes"];
+				createParams.GlobalSecondaryIndexes = Array.isArray(declaredGsis) ? declaredGsis.map((entry) => this.coerceIndexWarmThroughputForCreate(logicalId, entry)) : declaredGsis;
+			}
 			if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
 			const sse = mapSSESpecification(properties["SSESpecification"]);
 			if (sse && Object.keys(sse).length > 0) createParams.SSESpecification = sse;
@@ -14355,10 +14758,12 @@ var DynamoDBTableProvider = class {
 				}
 			}
 			if (JSON.stringify(properties["WarmThroughput"]) !== JSON.stringify(previousProperties["WarmThroughput"])) {
-				if (isSendableWarmThroughput(properties["WarmThroughput"])) {
+				this.warnRefusedWarmThroughput(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"]);
+				const warmThroughputToSend = this.coerceWarmThroughputForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"]);
+				if (warmThroughputToSend !== void 0 && !this.skipWarmThroughputDecrease(logicalId, physicalId, warmThroughputToSend, table?.WarmThroughput)) {
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
-						WarmThroughput: properties["WarmThroughput"]
+						WarmThroughput: warmThroughputToSend
 					}));
 					await this.waitForTableActiveAfterUpdate(physicalId);
 					this.logger.debug(`Updated WarmThroughput on DynamoDB table ${physicalId}`);
@@ -14822,6 +15227,32 @@ var DynamoDBTableProvider = class {
 	* between GSI mutations because a freshly-created index keeps backfilling
 	* after the table itself returns to ACTIVE, and AWS rejects the next GSI op
 	* until the prior index settles.
+	*
+	* `WarmThroughput.Status` is deliberately NOT part of the predicate, and that
+	* is MEASURED rather than assumed (PR review of issue #1768 raised it as a
+	* suspected race, since the per-index warm-throughput send path this provider
+	* gained has no other reason to wait). Live, us-east-1 2026-08-13, on a
+	* PAY_PER_REQUEST table with two ACTIVE GSIs: raising `gsi1`'s warm
+	* throughput 12000/4000 -> 14000/5000 left
+	*
+	* ```
+	* TableStatus: ACTIVE | gsi1: IndexStatus ACTIVE, WarmThroughput.Status UPDATING
+	*                     | gsi2: IndexStatus ACTIVE, WarmThroughput.Status ACTIVE
+	* ```
+	*
+	* for 90+ seconds — so this predicate IS satisfied while a warm update is
+	* still settling, exactly as the review described. What does not follow is
+	* the failure: with `gsi1` in that state, all three next-op shapes were
+	* ACCEPTED, no `ResourceInUseException` —
+	*
+	*  - a warm-throughput `Update` on the OTHER index (`gsi2`);
+	*  - a warm-throughput `Update` on the SAME index (`gsi1`);
+	*  - a GSI `Create` (`gsi3`), the op AWS gates most strictly.
+	*
+	* So warm throughput settles OUT OF BAND of the index lifecycle, and adding
+	* it to this predicate would only make every GSI op wait on a status that
+	* blocks nothing — minutes of wait budget spent per op, with a real risk of
+	* exhausting it on a table whose warm status lingers.
 	*/
 	async waitForTableAndIndexesActive(tableName, maxAttempts = 1800) {
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
@@ -14872,32 +15303,223 @@ var DynamoDBTableProvider = class {
 			if (!gsi.KeySchema) throw new ProvisioningError(`GlobalSecondaryIndex ${name} on DynamoDB table ${logicalId} is missing KeySchema`, resourceType, logicalId, physicalId);
 			if (live !== void 0 && live.IndexStatus !== "DELETING") {
 				this.logger.warn(`GSI ${name} on DynamoDB table ${physicalId} already exists in AWS but is absent from cdkd's recorded previous state, so its Create is being skipped. This usually means an earlier deploy created the index and then failed before state was written.`);
-				if (liveCapacityComparable && gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && !liveCapacityAlreadyMatches(live.ProvisionedThroughput, gsi.ProvisionedThroughput)) ops.push({ Update: {
-					IndexName: name,
-					ProvisionedThroughput: gsi.ProvisionedThroughput
-				} });
+				const adopted = { IndexName: name };
+				let adoptedHasMember = false;
+				if (liveCapacityComparable && gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && !liveCapacityAlreadyMatches(live.ProvisionedThroughput, gsi.ProvisionedThroughput) && !this.skipZeroCapacityIndexUpdate(name, physicalId, gsi.ProvisionedThroughput)) {
+					adopted.ProvisionedThroughput = gsi.ProvisionedThroughput;
+					adoptedHasMember = true;
+				}
+				const adoptedWarm = this.warmThroughputOpFor(name, physicalId, gsi, void 0, live);
+				if (adoptedWarm) {
+					adopted.WarmThroughput = adoptedWarm;
+					adoptedHasMember = true;
+				}
+				if (adoptedHasMember) ops.push({ Update: adopted });
 				this.logger.warn(`GSI ${name} was adopted from AWS rather than created, so cdkd could not verify its KeySchema / Projection match the template. Run \`cdkd drift ${physicalId}\` to confirm, and \`cdkd drift --accept\` if AWS is the source of truth.`);
 				continue;
 			}
+			this.warnRefusedWarmThroughput(`GSI ${name} on DynamoDB table ${physicalId}`, gsi.WarmThroughput);
+			const createWarm = this.coerceWarmThroughputForSend(`GSI ${name} on DynamoDB table ${physicalId}`, gsi.WarmThroughput);
 			ops.push({ Create: {
 				IndexName: name,
 				KeySchema: gsi.KeySchema,
 				Projection: gsi.Projection,
 				...gsi.ProvisionedThroughput ? { ProvisionedThroughput: gsi.ProvisionedThroughput } : {},
-				...gsi.OnDemandThroughput ? { OnDemandThroughput: gsi.OnDemandThroughput } : {}
+				...gsi.OnDemandThroughput ? { OnDemandThroughput: gsi.OnDemandThroughput } : {},
+				...createWarm ? { WarmThroughput: createWarm } : {}
 			} });
 		} else {
 			const before = prevByName.get(name);
 			if (JSON.stringify(before.KeySchema) !== JSON.stringify(gsi.KeySchema) || JSON.stringify(before.Projection) !== JSON.stringify(gsi.Projection)) throw new ProvisioningError(`GlobalSecondaryIndex ${name} on DynamoDB table ${logicalId} changed its KeySchema or Projection, which DynamoDB cannot modify in place. Rename the index (so it is dropped and re-created) or replace the table.`, resourceType, logicalId, physicalId);
-			if (gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && JSON.stringify(before.ProvisionedThroughput) !== JSON.stringify(gsi.ProvisionedThroughput)) if (liveCapacityComparable && liveCapacityAlreadyMatches(liveIndexByName?.get(name)?.ProvisionedThroughput, gsi.ProvisionedThroughput)) this.logger.debug(`GSI ${name} on DynamoDB table ${physicalId} already carries the requested capacity in AWS; skipping its throughput Update`);
-			else ops.push({ Update: {
-				IndexName: name,
-				ProvisionedThroughput: gsi.ProvisionedThroughput
-			} });
+			const update = { IndexName: name };
+			let updateHasMember = false;
+			if (gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && JSON.stringify(before.ProvisionedThroughput) !== JSON.stringify(gsi.ProvisionedThroughput)) {
+				if (liveCapacityComparable && liveCapacityAlreadyMatches(liveIndexByName?.get(name)?.ProvisionedThroughput, gsi.ProvisionedThroughput)) this.logger.debug(`GSI ${name} on DynamoDB table ${physicalId} already carries the requested capacity in AWS; skipping its throughput Update`);
+				else if (!this.skipZeroCapacityIndexUpdate(name, physicalId, gsi.ProvisionedThroughput)) {
+					update.ProvisionedThroughput = gsi.ProvisionedThroughput;
+					updateHasMember = true;
+				}
+			}
+			const warm = this.warmThroughputOpFor(name, physicalId, gsi, before, liveIndexByName?.get(name));
+			if (warm) {
+				update.WarmThroughput = warm;
+				updateHasMember = true;
+			}
+			if (updateHasMember) ops.push({ Update: update });
 		}
 		await this.runGsiOps(physicalId, ops, desiredAttributeDefinitions);
 	}
 	/**
+	* The NUMERIC `WarmThroughput` spec to put on the wire, announcing any member
+	* that had to be dropped (PR review round 5).
+	*
+	* The single send-side entry point for all four write sites, so a template's
+	* quoted `'12000'` reaches AWS as `12000` rather than as a string in a Long
+	* field. Returns `undefined` for a value {@link isSendableWarmThroughput}
+	* refuses — the caller's existing refusal warning covers that case, and the
+	* two messages are disjoint by construction: this one fires only when
+	* something DID resolve.
+	*/
+	coerceWarmThroughputForSend(scope, value) {
+		const coerced = coerceWarmThroughput(value);
+		if (coerced === void 0) return void 0;
+		if (coerced.dropped.length > 0) this.logger.warn(`${scope}: WarmThroughput member(s) ${coerced.dropped.join(", ")} in ${JSON.stringify(value)} are not a number DynamoDB accepts, so they were dropped from the request, which leaves ${JSON.stringify(coerced.spec)}. Check for an unresolved intrinsic or a non-numeric value.`);
+		return coerced.spec;
+	}
+	/**
+	* One `CreateTable` index entry with its `WarmThroughput` coerced (PR review
+	* round 6).
+	*
+	* `create()` forwards the declared `GlobalSecondaryIndexes` array to
+	* `CreateTable`, so it is a SEND SITE for the same per-index value the
+	* update path coerces — and it was the one the round-5 sweep missed. Entries
+	* are rebuilt rather than mutated: the input bag belongs to the caller (the
+	* resolved template, which the engine also records into state), and a
+	* provider that edits it in place would change what state reports cdkd sent.
+	*
+	* An entry that is not a plain object, or that declares no `WarmThroughput`,
+	* is returned UNCHANGED — including the identity of the object, so the
+	* common case allocates nothing.
+	*/
+	coerceIndexWarmThroughputForCreate(logicalId, entry) {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return entry;
+		const declared = entry["WarmThroughput"];
+		if (declared === void 0) return entry;
+		const scope = `GSI ${entry.IndexName ?? "<unnamed>"} on AWS::DynamoDB::Table ${logicalId}`;
+		const coerced = this.coerceWarmThroughputForSend(scope, declared);
+		if (coerced === void 0) {
+			this.warnRefusedWarmThroughput(scope, declared);
+			const { WarmThroughput: _dropped, ...rest } = entry;
+			return rest;
+		}
+		return {
+			...entry,
+			WarmThroughput: coerced
+		};
+	}
+	/**
+	* Announce a `WarmThroughput` the send rule REFUSES (PR review of issue
+	* #1768) — the missing half of tightening {@link isSendableWarmThroughput}.
+	*
+	* Called at all FOUR write sites (`create()`, the table-level `update()`
+	* branch, the GSI `Create` action, and {@link warmThroughputOpFor}) because
+	* the value vanishes at each of them independently. `scope` names the
+	* resource or the index so a table with several GSIs says WHICH one.
+	*
+	* Silent for an ABSENT or FALSY value — see {@link isRefusedWarmThroughput}
+	* for why those two are not this warning's business.
+	*/
+	warnRefusedWarmThroughput(scope, value) {
+		if (!isRefusedWarmThroughput(value)) return;
+		this.logger.warn(`${scope}: the declared WarmThroughput ${JSON.stringify(value)} carries no usable ReadUnitsPerSecond or WriteUnitsPerSecond, so it was NOT sent — DynamoDB accepts only those two members and rejects a request without either. Check for a misspelled member name or an unresolved intrinsic. Nothing else on this resource was affected.`);
+	}
+	/**
+	* Should this per-index capacity `Update` be SKIPPED because the value is
+	* AWS's on-demand `{0, 0}` placeholder rather than a capacity anyone asked
+	* for (issue #1767 review)?
+	*
+	* Newly reachable BECAUSE of the #1767 readback change, on the transition
+	* residual `getDriftUnknownPaths` deliberately carries. A pre-#1767
+	* `observedProperties` baseline holds the whole `DescribeTable` index
+	* description, including the `{NumberOfDecreasesToday: 0, ReadCapacityUnits:
+	* 0, WriteCapacityUnits: 0}` block AWS reports for every index of a
+	* PAY_PER_REQUEST table (the #1571 trap). `cdkd drift --revert` hands that
+	* blob to `update()` as the DESIRED side against the trimmed readback as the
+	* previous side, so the values differ, `liveCapacityComparable` is false on
+	* PAY_PER_REQUEST (which disables the #1630 idempotency skip), and the op
+	* that goes out asks AWS for capacity 0 — which AWS rejects, since the
+	* minimum is 1. Before #1767 both sides carried the same blob, compared
+	* equal, and no revert was ever offered.
+	*
+	* Deliberately NOT gated on the live billing mode. A `{0, 0}` request is
+	* refused by AWS in EITHER mode, so gating would leave the same doomed call
+	* reachable for a PROVISIONED table whose stale baseline carries the
+	* placeholder. Scoped tightly to BOTH members resolving to 0: any other
+	* capacity — including a half-declared or malformed one — still goes out and
+	* is answered by AWS, the fail-OPEN direction this file uses everywhere.
+	*
+	* CALLER-BLIND, decided rather than overlooked (PR review). A TEMPLATE-borne
+	* `{0, 0}` warn-skips here while `create()` fails loudly on the same value,
+	* which reads like the "loud failure for a quiet lie" trade the adopted-index
+	* arm below forbids. It stands for three reasons:
+	*
+	*  - The discriminator that EXISTS does not separate the callers that matter.
+	*    `ResourceProvider.update` DOES take an optional `UpdateContext` — an
+	*    earlier draft of this comment claimed the signature carries no context
+	*    at all, which is simply false (`s3-bucket-provider.ts` consumes it
+	*    today) — but its one field, `desiredFromAwsReadback`, is set ONLY by
+	*    `cdkd drift --revert` (`src/cli/commands/drift.ts`). The rollback
+	*    executor's revert arms deliberately pass NO context: their desired bag
+	*    is `previousState.properties`, a TEMPLATE recorded earlier, so they are
+	*    indistinguishable from an ordinary template deploy — and THAT is the
+	*    pair this decision turns on. Knowing the value came from a readback
+	*    would not license throwing on the other two.
+	*  - With the caller unknowable, the repo's rule for the UPDATE path is
+	*    WARN-never-throw (issues #1545 / #1552): the desired bag here can BE a
+	*    historical cdkd state record, and a refusal would make the table
+	*    un-updatable and un-rollbackable with no template-side remedy.
+	*  - The lie is bounded and self-surfacing. AWS never accepted `{0, 0}` at
+	*    create either, so no live table can be holding it; and where the value
+	*    would actually matter — a PROVISIONED table, whose indexes hold a real
+	*    capacity — recording `{0, 0}` diverges from the readback and `cdkd drift`
+	*    REPORTS it. On a PAY_PER_REQUEST table the recorded `{0, 0}` matches what
+	*    `DescribeTable` reports for every index anyway, so there is no divergence
+	*    to hide.
+	*/
+	skipZeroCapacityIndexUpdate(indexName, physicalId, requested) {
+		if (requested === void 0) return false;
+		if (capacityNumber(requested.ReadCapacityUnits) !== 0 || capacityNumber(requested.WriteCapacityUnits) !== 0) return false;
+		this.logger.warn(`GSI ${indexName} on DynamoDB table ${physicalId}: the requested ProvisionedThroughput is {ReadCapacityUnits: 0, WriteCapacityUnits: 0}, which is AWS's on-demand placeholder rather than a capacity DynamoDB accepts (the minimum is 1), so no per-index throughput update was sent. This usually means the value came from a pre-#1767 cdkd state record — a \`cdkd drift --revert\` of such a record, or a rollback replaying it. Re-run \`cdkd deploy\` (or \`cdkd drift --accept\`) to refresh the record.`);
+		return true;
+	}
+	/**
+	* The per-index `WarmThroughput` this update should send, or `undefined`
+	* (issue #1768, one nesting level down from the table-level branch).
+	*
+	* `applyGsiUpdates` used to send only `ProvisionedThroughput` /
+	* `OnDemandThroughput` on both of its arms, while `readCurrentState` emits a
+	* declared per-index `WarmThroughput` — so a template declaring one had it
+	* silently dropped on every index add / change, `cdkd drift` reported the
+	* difference forever, and `--revert` emitted no op at all and exited 0
+	* claiming success. That silent-success shape is worse than the loud
+	* table-level dead end #1768 fixed.
+	*
+	* The rules mirror the table-level branch exactly:
+	*  - only a value the write side would SEND at all
+	*    ({@link isSendableWarmThroughput});
+	*  - only when it CHANGED against the recorded previous entry (an absent
+	*    previous — the adopted-index arm — is treated as changed, since nothing
+	*    was recorded to compare with);
+	*  - never a DECREASE. Measured live (us-east-1, 2026-08-13) on a GSI AWS
+	*    reports `{12000, 4000}` for: a `WarmThroughput`-only `Update` action
+	*    with `{12000, 4000}` is ACCEPTED (so the action shape needs no
+	*    `ProvisionedThroughput` companion), while `{6000, 2000}` is rejected
+	*    with `Requested ReadUnitsPerSecond for WarmThroughput for index gsi1 is
+	*    lower than current WarmThroughput, decreasing WarmThroughput is not
+	*    supported`.
+	*/
+	warmThroughputOpFor(indexName, physicalId, desired, previous, live) {
+		const requested = desired.WarmThroughput;
+		if (previous !== void 0 && JSON.stringify(previous.WarmThroughput) === JSON.stringify(requested)) return;
+		const sendable = this.coerceWarmThroughputForSend(`GSI ${indexName} on DynamoDB table ${physicalId}`, requested);
+		if (sendable === void 0) {
+			this.warnRefusedWarmThroughput(`GSI ${indexName} on DynamoDB table ${physicalId}`, requested);
+			return;
+		}
+		if (warmThroughputAlreadyMatches(sendable, live?.WarmThroughput)) {
+			this.logger.debug(`GSI ${indexName} on DynamoDB table ${physicalId} already carries the requested warm throughput in AWS; skipping its WarmThroughput Update`);
+			return;
+		}
+		if (isWarmThroughputDecrease(sendable, live?.WarmThroughput)) {
+			this.logger.warn(`GSI ${indexName} on DynamoDB table ${physicalId}: the requested WarmThroughput ${JSON.stringify(sendable)} is lower than the ${JSON.stringify({
+				ReadUnitsPerSecond: live?.WarmThroughput?.ReadUnitsPerSecond,
+				WriteUnitsPerSecond: live?.WarmThroughput?.WriteUnitsPerSecond
+			})} DynamoDB currently holds for that index. Warm throughput only ever RISES with an index's traffic and cannot be lowered — AWS rejects the UpdateTable with "decreasing WarmThroughput is not supported" — so it was NOT sent and every other change on this table still applied. On a deploy this warning may be the only signal you get: a successful deploy re-captures AWS's current value as the drift baseline. If your template declares this index's WarmThroughput, set it to the value AWS holds (or remove it, which AWS treats as keeping the last-set value); if it does not, the value came from a cdkd state record and 'cdkd deploy' (or 'cdkd drift --accept') refreshes it.`);
+			return;
+		}
+		return sendable;
+	}
+	/**
 	* Issue a list of `GlobalSecondaryIndexUpdates` ops, one per `UpdateTable`,
 	* waiting for the table AND every index to return to ACTIVE between each.
 	*
@@ -14947,6 +15569,33 @@ var DynamoDBTableProvider = class {
 		}
 	}
 	/**
+	* Should this update SKIP its `WarmThroughput` call because the value would
+	* DECREASE what AWS already holds (issue #1768)?
+	*
+	* Thin logging wrapper over the pure {@link isWarmThroughputDecrease}, kept
+	* on the class so the warning is emitted at exactly the one site that skips.
+	*
+	* The warning is what makes the skip honest, and its WORDING is checked
+	* against the code rather than assumed (PR review): the first version
+	* promised `cdkd drift` would "keep reporting the difference", which is TRUE
+	* on the `drift --revert` path — nothing is recorded, so the observed
+	* baseline still holds the declared value — and FALSE on the DEPLOY path.
+	* A successful deploy re-captures `observedProperties` through this same
+	* `readCurrentState` (`deploy-engine.ts`'s `kickOffObservedCapture`), which
+	* for a DECLARING template emits AWS's CURRENT value, so the very deploy
+	* that warned equalises the comparison and the next `cdkd drift` reports the
+	* resource clean. The message therefore says the warning may be the only
+	* signal, and names both numbers so the template edit needs no second look.
+	*/
+	skipWarmThroughputDecrease(logicalId, physicalId, desired, live) {
+		if (!isWarmThroughputDecrease(desired, live)) return false;
+		this.logger.warn(`AWS::DynamoDB::Table ${logicalId}: the requested WarmThroughput ${JSON.stringify(desired)} is lower than the ${JSON.stringify({
+			ReadUnitsPerSecond: live?.ReadUnitsPerSecond,
+			WriteUnitsPerSecond: live?.WriteUnitsPerSecond
+		})} DynamoDB currently holds for table ${physicalId}. Warm throughput only ever RISES with a table's traffic and cannot be lowered — AWS rejects the UpdateTable with "decreasing WarmThroughput is not supported" — so it was NOT sent and every other change on this resource still applied. On a deploy this warning may be the only signal you get: a successful deploy re-captures AWS's current value as the drift baseline, so the next 'cdkd drift' reports this table clean (a 'cdkd drift --revert' records nothing and keeps reporting it). To make cdkd and AWS agree, set WarmThroughput to the value AWS holds (or remove the property, which AWS treats as keeping the last-set value).`);
+		return true;
+	}
+	/**
 	* `AttributeDefinitions` is a SET, keyed by `AttributeName`: CFn accepts the
 	* members in any order and `DescribeTable` returns them in an order matching
 	* neither the request nor the template. Measured live (us-east-1,
@@ -14966,6 +15615,29 @@ var DynamoDBTableProvider = class {
 	* `KeySchema` is deliberately NOT declared, at the table level or the index
 	* level: it is order-SIGNIFICANT (HASH before RANGE), so sorting it would
 	* HIDE a real key change rather than remove a phantom one.
+	*
+	* `GlobalSecondaryIndexes` / `LocalSecondaryIndexes` are NOT declared either,
+	* and that is a MECHANISM limit rather than a judgement about the lists —
+	* both really are sets keyed by `IndexName` (issue #1767 proposes declaring
+	* them). Every entry here is a SUBTREE declaration, and unlike
+	* `getDriftUnknownPaths` this walk DESCENDS INTO ARRAY ELEMENTS giving each
+	* the parent's path (`drift-normalize.ts`), so a `'GlobalSecondaryIndexes'`
+	* entry also reaches `GlobalSecondaryIndexes.KeySchema` and would sort the
+	* per-index key schema — reversing the sentence above at the index level
+	* only. Issue #1767 calls the sort and the member reverse-map separable;
+	* this change ships the reverse-map, and the ordering half needed a
+	* leaf-only form of the declaration first (issue
+	* [#1783](https://github.com/go-to-k/cdkd/issues/1783)). **That form now
+	* EXISTS** — `LEAF_ONLY_PATH_SUFFIX` (`[]`) landed in
+	* [#1799](https://github.com/go-to-k/cdkd/pull/1799), so
+	* `'GlobalSecondaryIndexes[]'` would claim the list alone without reaching
+	* the per-index `KeySchema`. It is deliberately NOT declared here yet:
+	* adopting it is its own change with its own real-AWS verification, tracked
+	* as issue [#1812](https://github.com/go-to-k/cdkd/issues/1812). Consequence
+	* until then, stated so it is not mistaken for solved: an index list AWS
+	* returns in a different ORDER than the template declared is still phantom
+	* drift against a `properties` baseline. It is not reachable on the ordinary
+	* `observedProperties` path, where both sides come from this same readback.
 	*/
 	getDriftUnorderedPaths(resourceType) {
 		if (resourceType !== "AWS::DynamoDB::Table") return [];
@@ -15009,11 +15681,72 @@ var DynamoDBTableProvider = class {
 	* `TlsConfig` (issue #1602): an absent / empty bag falls back to the
 	* type-level answer of COMPARING, since hiding a real drift is the worse
 	* failure.
+	*
+	* `GlobalSecondaryIndexes` / `LocalSecondaryIndexes` join it under the SAME
+	* rule for the SAME reason (issue #1767), one nesting level up: the readback
+	* now emits the reverse-mapped CFn shape, so every `observedProperties`
+	* baseline an earlier binary wrote — which carries `IndexStatus` /
+	* `ItemCount` / `IndexArn` / the on-demand `{0, 0}` placeholder / the
+	* computed per-index `WarmThroughput` — no longer equals it. Ignoring the
+	* path on both sides when the template declares NO index list covers the
+	* transition and the steady state for that population, exactly as the
+	* `WarmThroughput` arm does: an index list the template never declared is
+	* AWS-authored (created out of band, or by a sibling), which is the #1498
+	* class.
+	*
+	* Known residual, deliberately NOT covered, because covering it costs more
+	* than it buys: a table whose template DOES declare indexes keeps comparing,
+	* so its already-written observed baseline reports a one-sided
+	* `GlobalSecondaryIndexes` difference until the next deploy re-captures it
+	* (or `cdkd drift --accept` does). `cdkd drift --revert` is the third thing a
+	* user may reach for on that report, and for the shapes measured here it
+	* applies NOTHING to AWS — which is a property of three separate skips, not
+	* "by construction", and the distinction is load-bearing because this PR
+	* briefly broke it. The index names match, so no Create / Delete is derived;
+	* the stale blob's `{0, 0}` capacity is refused by
+	* {@link skipZeroCapacityIndexUpdate}; and its per-index `WarmThroughput` —
+	* which the same PR taught `applyGsiUpdates` to SEND (issue #1768), turning
+	* an earlier "by construction" wording false the moment it landed — is
+	* refused by {@link warmThroughputAlreadyMatches}, since a stale blob carries
+	* exactly what AWS holds. Remove any of the three and the residual stops
+	* being harmless: the revert starts issuing one redundant `UpdateTable` plus
+	* a full index-ACTIVE wait per GSI, or a doomed one.
+	*
+	* "Applies nothing" is NOT the same as "reaches those skips" (PR review round
+	* 5). `applyGsiUpdates` compares `KeySchema` / `Projection` between the
+	* recorded previous and the desired entry BEFORE any of them and THROWS on a
+	* difference, because DynamoDB cannot modify either in place. On this path
+	* that compare is a trimmed readback against a stale full description, and
+	* both members survive the #1767 reverse-map unchanged — `KeySchema`
+	* verbatim, `Projection` rebuilt member-for-member — so for every shape
+	* exercised here it matches and the throw does not fire. It is named because
+	* it is the outcome an enumeration of skips would otherwise hide: a stale
+	* blob whose `Projection` AWS has since re-normalized would fail the revert
+	* loudly rather than no-op it. Suppressing the residual instead would mean ignoring the
+	* whole array for the population that HAS indexes — i.e. never detecting an
+	* out-of-band index add / remove / capacity change again, permanently, to
+	* remove a one-time report. No PATH can express the middle ground:
+	* `isIgnoredPath` is never asked about a path that crosses an array
+	* (`diffAt` compares arrays wholesale via `deepEqual`), so a per-MEMBER
+	* ignore path does not exist — the same wall issue #1742 records for the
+	* `AWS::DynamoDB::GlobalTable` twin. **A non-path seam now EXISTS**:
+	* `ResourceProvider.canonicalizeDriftProperties`, applied to BOTH comparison
+	* sides, landed in [#1799](https://github.com/go-to-k/cdkd/pull/1799) (which
+	* closed issue [#1784](https://github.com/go-to-k/cdkd/issues/1784)) and can
+	* strip the AWS-managed member from each bag — converging an already-written
+	* record with a post-fix readback, with no ignore-path and no lost
+	* detection. It is deliberately NOT adopted here yet: doing so is its own
+	* change with its own real-AWS verification, tracked as issue
+	* [#1812](https://github.com/go-to-k/cdkd/issues/1812).
 	*/
 	getDriftUnknownPaths(resourceType, properties) {
 		if (resourceType !== "AWS::DynamoDB::Table") return [];
-		if (declaresWarmThroughput(properties)) return [];
-		return ["WarmThroughput"];
+		const paths = [];
+		if (!declaresWarmThroughput(properties)) paths.push("WarmThroughput");
+		if (desiredBagIsInformative(properties)) {
+			for (const key of ["GlobalSecondaryIndexes", "LocalSecondaryIndexes"]) if (properties !== void 0 && !declaresIndexList(properties[key])) paths.push(key);
+		}
+		return paths;
 	}
 	/**
 	* Read the AWS-current DynamoDB table configuration in CFn-property shape.
@@ -15027,18 +15760,18 @@ var DynamoDBTableProvider = class {
 	*  - StreamSpecification's CFn shape includes only `StreamViewType`; the
 	*    API response carries `StreamEnabled` too. We surface both since the
 	*    drift comparator only descends into keys present in state.
-	*  - GSI / LSI in the API response include `IndexStatus`, `ItemCount`,
-	*    `IndexArn` and sizing fields cdkd never sets, and they are forwarded
-	*    VERBATIM. This used to claim "the comparator filters them" — it does
-	*    NOT, and issue #1767 quotes that sentence as the bug: the filter is
-	*    `calculateResourceDrift`'s state-keys-only walk, which only reaches an
-	*    absent TOP-LEVEL key. These are members of an array under a key the
-	*    baseline DOES carry, and arrays compare positionally, so every
-	*    AWS-managed member participates — `ItemCount` MOVES as data lands, so
-	*    an in-use table with an index drifts against its own
-	*    `observedProperties` on the ordinary path. Fixing it needs a full
-	*    reverse-mapper plus the same migration companion this issue's
-	*    `WarmThroughput` gate needed, hence a separate issue.
+	*  - GSI / LSI in the API response include `IndexStatus`, `Backfilling`,
+	*    `ItemCount`, `IndexArn` and sizing fields cdkd never sets. They used to
+	*    be forwarded VERBATIM under a comment claiming "the comparator filters
+	*    them" — it does NOT, and issue #1767 quotes that sentence as the bug:
+	*    the filter is `calculateResourceDrift`'s state-keys-only walk, which
+	*    only reaches an absent TOP-LEVEL key. These are members of an array
+	*    under a key the baseline DOES carry, and arrays compare positionally,
+	*    so every AWS-managed member participated — and `ItemCount` MOVES as
+	*    data lands, so an in-use table with any index drifted against its own
+	*    `observedProperties` on the ORDINARY path, on a schedule set by its own
+	*    write traffic. Each entry is now reverse-mapped to its CFn shape by
+	*    {@link reverseMapSecondaryIndex}.
 	*
 	* Returns `undefined` when the table is gone (`ResourceNotFoundException`).
 	*
@@ -15050,8 +15783,10 @@ var DynamoDBTableProvider = class {
 	* template carries them).
 	*
 	* `properties` is the DESIRED bag (the state-recorded template intent every
-	* caller passes) and is consulted for exactly one field, `WarmThroughput` —
-	* see {@link getDriftUnknownPaths} for the measurement and the reasoning.
+	* caller passes). It is consulted for the table-level `WarmThroughput` — see
+	* {@link getDriftUnknownPaths} for the measurement and the reasoning — and,
+	* since issue #1767, for the per-index throughput blocks of each secondary
+	* index, matched by `IndexName`.
 	*/
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
 		try {
@@ -15082,8 +15817,15 @@ var DynamoDBTableProvider = class {
 				StreamEnabled: true,
 				StreamViewType: table.StreamSpecification.StreamViewType
 			};
-			if (table.GlobalSecondaryIndexes && table.GlobalSecondaryIndexes.length > 0) result["GlobalSecondaryIndexes"] = table.GlobalSecondaryIndexes;
-			if (table.LocalSecondaryIndexes && table.LocalSecondaryIndexes.length > 0) result["LocalSecondaryIndexes"] = table.LocalSecondaryIndexes;
+			const bagInformative = desiredBagIsInformative(properties);
+			if (table.GlobalSecondaryIndexes && table.GlobalSecondaryIndexes.length > 0) {
+				const desiredByName = desiredIndexEntriesByName(properties?.["GlobalSecondaryIndexes"]);
+				result["GlobalSecondaryIndexes"] = table.GlobalSecondaryIndexes.map((live) => reverseMapSecondaryIndex(live, live.IndexName === void 0 ? void 0 : desiredByName.get(live.IndexName), bagInformative));
+			}
+			if (table.LocalSecondaryIndexes && table.LocalSecondaryIndexes.length > 0) {
+				const desiredByName = desiredIndexEntriesByName(properties?.["LocalSecondaryIndexes"]);
+				result["LocalSecondaryIndexes"] = table.LocalSecondaryIndexes.map((live) => reverseMapSecondaryIndex(live, live.IndexName === void 0 ? void 0 : desiredByName.get(live.IndexName), bagInformative));
+			}
 			if (table.SSEDescription?.Status === "ENABLED") {
 				const sse = { SSEEnabled: true };
 				if (table.SSEDescription.KMSMasterKeyArn !== void 0) sse["KMSMasterKeyId"] = table.SSEDescription.KMSMasterKeyArn;
@@ -15182,6 +15924,23 @@ var DynamoDBTableProvider = class {
 //#endregion
 //#region src/provisioning/providers/dynamodb-globaltable-provider.ts
 /**
+* The CLOSED path table {@link DynamoDBGlobalTableProvider.canonicalizeDriftProperties}
+* strips from BOTH drift comparison sides (issue #1742).
+*
+* One entry today: the AWS-computed `GlobalSecondaryIndexes[].WarmThroughput`.
+* A table rather than an inline check so a second per-array-element member
+* lands as a row instead of a second walk — and so the scope is READABLE as a
+* list of paths, which is what "closed table" means here. Deliberately does
+* NOT include `LocalSecondaryIndexes` (this provider's readback assigns the
+* raw SDK descriptions there, a wider divergence than one member) or
+* `Replicas[].GlobalSecondaryIndexes` (whose entries carry only the read-half
+* throughput blocks — no `WarmThroughput` is emitted or accepted there).
+*/
+const DRIFT_STRIPPED_INDEX_MEMBERS = [{
+	listKey: "GlobalSecondaryIndexes",
+	member: "WarmThroughput"
+}];
+/**
 * AWS DynamoDB GlobalTable Provider
 *
 * Implements resource provisioning for AWS::DynamoDB::GlobalTable using the
@@ -16635,7 +17394,12 @@ var DynamoDBGlobalTableProvider = class {
 					const entry = { IndexName: gsi.IndexName };
 					if (gsi.KeySchema) entry["KeySchema"] = gsi.KeySchema;
 					if (gsi.Projection) entry["Projection"] = gsi.Projection;
-					if (gsi.WarmThroughput) entry["WarmThroughput"] = gsi.WarmThroughput;
+					if (gsi.WarmThroughput) {
+						const warm = {};
+						if (gsi.WarmThroughput.ReadUnitsPerSecond !== void 0) warm["ReadUnitsPerSecond"] = gsi.WarmThroughput.ReadUnitsPerSecond;
+						if (gsi.WarmThroughput.WriteUnitsPerSecond !== void 0) warm["WriteUnitsPerSecond"] = gsi.WarmThroughput.WriteUnitsPerSecond;
+						if (Object.keys(warm).length > 0) entry["WarmThroughput"] = warm;
+					}
 					const replicaEntry = { IndexName: gsi.IndexName };
 					if (billingMode === "PROVISIONED") {
 						const writeAutoScaling = await this.readAutoScalingSettings(tableNameForSubs, "dynamodb:index:WriteCapacityUnits", void 0, gsi.IndexName);
@@ -16888,6 +17652,115 @@ var DynamoDBGlobalTableProvider = class {
 		return ["AttributeDefinitions"];
 	}
 	/**
+	* Strip the AWS-computed per-index `WarmThroughput` from BOTH drift
+	* comparison sides (issue #1742 defect 2, on the #1784 seam).
+	*
+	* `DescribeTable` reports a `WarmThroughput` for EVERY index whether or not
+	* the template asked for one — a default `{ReadUnitsPerSecond: 12000,
+	* WriteUnitsPerSecond: 4000, Status: 'ACTIVE'}`, measured us-east-1
+	* 2026-08-13 on the `rollback-replay-effective-props` fixture — so on a
+	* `properties`-only baseline (what a reverse-replacement rollback leaves
+	* behind, since `rollback-executor.ts` strips `observedProperties`) the
+	* member is a permanent one-sided difference: `cdkd drift` reports the table
+	* forever and `--revert` re-issues calls for it.
+	*
+	* Why this mechanism and not the two cheaper ones:
+	*
+	* - `getDriftUnknownPaths` (the #1760 answer for the sibling type's
+	*   TOP-LEVEL member) cannot express it. `calculateResourceDrift` compares
+	*   arrays wholesale, so `isIgnoredPath` is never asked about a path that
+	*   crosses one; the only expressible suppression is the WHOLE
+	*   `GlobalSecondaryIndexes` subtree, i.e. never detecting an index add /
+	*   remove / capacity change again — the #1420 stopgap already refused.
+	* - Gating the READBACK emission on the desired side (this issue's own
+	*   second candidate answer) removes the phantom for the `properties`
+	*   baseline and CREATES one for the far larger `observedProperties`
+	*   population: every bag already in S3 was written by a binary that emitted
+	*   the computed member, so the first `cdkd drift` after upgrading compares
+	*   a baseline that HAS it against a readback that does not, and reports the
+	*   whole array on an untouched table. It does not self-heal — the observed
+	*   capture only runs on CREATE / UPDATE. That attempt was implemented,
+	*   reviewed and REVERTED; do not re-propose it.
+	*
+	* Stripping from BOTH sides is what converges the two populations at once: a
+	* stale observed record and a fresh readback both lose the member, and a
+	* `properties` baseline that never had it now faces an AWS side without it.
+	*
+	* ACCEPTED COST, stated because it is a real loss: a template that DECLARES
+	* a per-index `WarmThroughput` no longer has changes to it REPORTED by
+	* `cdkd drift`. The value is still SENT (`toSdkGlobalSecondaryIndexes`
+	* forwards it on create and on a new index), so this is a detection gap, not
+	* a delivery one, and it is bounded by what cdkd could do about a difference
+	* anyway: warm throughput only ever GROWS on the AWS side and cannot be
+	* lowered, so `--revert` would issue a decrease AWS rejects — the residual
+	* issue #1768 records for the sibling type's declared arm. A per-index
+	* declared-gate is not expressible here in any case: this hook sees ONE bag
+	* with no `side` argument and no reference to the desired side, which is the
+	* symmetry the #1784 contract requires and the reason one-sided
+	* normalization is refused.
+	*
+	* Scope is a CLOSED table rather than a walk for any key named
+	* `WarmThroughput`: `Replicas[].GlobalSecondaryIndexes[]` entries carry only
+	* the read-half throughput blocks (no `WarmThroughput` is emitted or
+	* accepted there), and a blanket strip would remove a member from a path
+	* nobody measured. The table is a FLAT list of `{listKey, member}` pairs —
+	* the type is hardcoded one line below, not a key of it — and nothing
+	* mechanically fences it against `readCurrentState`: a future per-replica
+	* `WarmThroughput` emission would desync silently, so a member added to the
+	* readback needs a row added here in the same change.
+	*
+	* The `resourceType` guard is kept but is UNREACHABLE, and the earlier
+	* claim that it followed the #1784 CC-API-fallback caveat was WRONG — that
+	* caveat is about the BAG SHAPE when a type has no `readCurrentState`, and
+	* never produces a foreign `resourceType`. `drift.ts` resolves the provider
+	* by `(resourceType, provisionedBy)` and then passes that SAME type back in,
+	* and this provider is registered for exactly one type, so the `!==` arm
+	* cannot fire. It stays as a cheap shape guard for a future second
+	* registration, not because anything routes a foreign type here.
+	*
+	* UNCOVERED POPULATION, stated because the fix does NOT reach it: a
+	* cc-api-routed GlobalTable gets neither half. Top-level `WarmThroughput` is
+	* a `silentDrop` property for this type, so a template declaring it
+	* auto-routes the whole resource through Cloud Control (the #614 routing)
+	* and the route is STICKY — `drift.ts` then resolves `provider` to
+	* `CloudControlProvider`, this hook is never invoked, and the AWS side comes
+	* from CC's `GetResource`. So the `properties`-only-baseline phantom drift
+	* this closes survives there. Pre-existing, not introduced here.
+	*
+	* Note the trigger is the TOP-LEVEL `WarmThroughput`, NOT the per-index
+	* member this strips: a template declaring only the per-index member keeps
+	* `GlobalSecondaryIndexes` (a handled property), stays SDK-routed, and IS
+	* covered. Do not read this bound as "warm-throughput templates are
+	* uncovered" — an earlier draft of this comment said so and was wrong.
+	*
+	* Pure, non-mutating, and identity-returning when nothing applies: the input
+	* bag is the caller's state record / readback, an unaffected table pays
+	* nothing, and only the index entries that actually carry the member are
+	* rebuilt.
+	*/
+	canonicalizeDriftProperties(resourceType, properties) {
+		if (resourceType !== "AWS::DynamoDB::GlobalTable") return properties;
+		let result = properties;
+		for (const { listKey, member } of DRIFT_STRIPPED_INDEX_MEMBERS) {
+			const list = result[listKey];
+			if (!Array.isArray(list)) continue;
+			let stripped = false;
+			const canonical = list.map((element) => {
+				const entry = asRecord$1(element);
+				if (!entry || !(member in entry)) return element;
+				stripped = true;
+				const copy = { ...entry };
+				delete copy[member];
+				return copy;
+			});
+			if (stripped) result = {
+				...result,
+				[listKey]: canonical
+			};
+		}
+		return result;
+	}
+	/**
 	* Adopt an existing DynamoDB GlobalTable into cdkd state.
 	*
 	* Lookup order:
@@ -77189,7 +78062,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.8");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.10");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;