@go-to-k/cdkd 0.283.9 → 0.283.11

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefaultAndSource, A as cyan, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as findSilentDropProperties, Bt as runDockerForeground, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalMigrateError, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as IntrinsicFunctionResolver, Gn as isThrottlingError, Gt as synthesisStatusMessage, H as slowCcOperationTimeoutMs, Hn as withErrorHandling, Ht as AssetManifestLoader, I as collectInlinePolicyNamesManagedBySiblings, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as refStateLookupFromResource, Jt as resolveApp, K as cfnRefValueFromPhysicalId, Kn as markNonRetryable, Kt as getDefaultStateBucketName, L as clearOnUpdateRemoval, Lt as buildDockerImage, M as green, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as red, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as formatResourceLine, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as assertRegionMatch, Qt as resolveStateBucketWithDefault, R as ProviderRegistry, Rt as formatDockerLoginError, S as unsupportedFinalSnapshotError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as isMarkedNonRetryable, Ut as getDockerImageBySourceHash, V as CloudControlProvider, Vn as normalizeAwsError, Vt as runDockerStreaming, W as isTerminationProtectionPropagationError, Wn as isRetryableTransientError, Wt as Synthesizer, X as normalizeAwsTagsToCfn, Xt as resolveCaptureObservedState, Y as WAFv2WebACLProvider, Yt as resolveAutoAssetStorage, Z as resolveExplicitPhysicalId, Zt as resolveSkipPrefix, _ as buildFinalSnapshotIdentifier, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as requireConfigObject, b as isFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketDomainName, d as deleteSkipReason, dn as derivePartitionAndUrlSuffix, dt as s3BucketWebsiteUrl, en as resolveUseCdkBootstrapAssets, et as configBooleanRefusal, f as withResourceDeadline, fn as AssemblyReader, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as AwsClients, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as resolveBucketRegion, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigArray, j as gray, jn as PartialFailureError, jt as ensureAssetStorage, k as bold, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as readConfigString, o as planFailedOps, on as findLargeInlineResources, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as processStackMessages, pt as DiffCalculator, q as getAccountInfo, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as replayWarn, s as planRollback, sn as uploadCfnTemplate, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as canonicalizeRegion, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as extractDeploymentEventError, wn as DeployCancelledError, wt as WorkGraph, x as refusesFinalSnapshot, xn as CdkdError, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as getDockerCmd } from "./deploy-engine-CWt7h7Nc.js";
+import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefault, A as cyan, An as MissingCdkCliError, At as AssetModeResolver, B as findSilentDropProperties, Bt as getDockerCmd, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalMigrateError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalInvokeBuildError$1, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as ResourceUpdateNotSupportedError, Ft as validateAssetBucketName, G as IntrinsicFunctionResolver, Gn as isRetryableTransientError, Gt as Synthesizer, H as slowCcOperationTimeoutMs, Hn as normalizeAwsError, Ht as runDockerStreaming, I as collectInlinePolicyNamesManagedBySiblings, In as StackHasActiveImportsError, It as validateContainerRepoName, J as refStateLookupFromResource, Jt as getLegacyStateBucketName, K as cfnRefValueFromPhysicalId, Kn as isThrottlingError, Kt as synthesisStatusMessage, L as clearOnUpdateRemoval, Ln as StackTerminationProtectionError, Lt as buildDenyExternalAccessPolicy, M as green, Mn as PartialFailureError, Mt as ensureAssetStorage, N as red, Nn as ProvisioningError, Nt as getBootstrapMarkerKey, O as formatResourceLine, On as LocalStartServiceError, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceTimeoutError, Pt as parseBootstrapMarker, Q as assertRegionMatch, Qt as resolveSkipPrefix, R as ProviderRegistry, Rt as buildDockerImage, S as unsupportedFinalSnapshotError, Sn as CdkdError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as DeployCancelledError, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as withErrorHandling, Ut as AssetManifestLoader, V as CloudControlProvider, Vt as runDockerForeground, W as isTerminationProtectionPropagationError, Wn as isMarkedNonRetryable, Wt as getDockerImageBySourceHash, X as normalizeAwsTagsToCfn, Xt as resolveAutoAssetStorage, Y as WAFv2WebACLProvider, Yt as resolveApp, Z as resolveExplicitPhysicalId, Zt as resolveCaptureObservedState, _ as buildFinalSnapshotIdentifier, _n as AwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as CFN_TEMPLATE_URL_LIMIT, at as requireConfigObject, b as isFinalSnapshotError, bn as setAwsClients, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as uploadCfnTemplate, ct as s3BucketDomainName, d as deleteSkipReason, dn as canonicalizeRegion, dt as s3BucketWebsiteUrl, en as resolveStateBucketWithDefaultAndSource, et as configBooleanRefusal, f as withResourceDeadline, fn as derivePartitionAndUrlSuffix, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as resolveBucketRegion, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_BODY_LIMIT, it as requireConfigArray, j as gray, jn as NestedStackChildDirectDestroyError, jt as BOOTSTRAP_MARKER_PREFIX, k as bold, kt as escapeRegExp, l as replayRollback, ln as expectedOwnerParam, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mn as processStackMessages, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as stateBucketExistenceConfirmed, nt as readConfigString, o as planFailedOps, on as MIGRATE_TMP_PREFIX, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as AssemblyReader, pt as DiffCalculator, q as getAccountInfo, qn as markNonRetryable, qt as getDefaultStateBucketName, r as DeployEngine, rn as warnDeprecatedNoPrefixCliFlag, rt as replayWarn, s as planRollback, sn as findLargeInlineResources, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveUseCdkBootstrapAssets, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as PARTITION_TABLE, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as getAwsClients, vt as LockManager, w as extractDeploymentEventError, wt as WorkGraph, x as refusesFinalSnapshot, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as resetAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as formatDockerLoginError } from "./deploy-engine-DculbwzR.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-D5ZBSgh2.js";
+import { t as ASGProvider } from "./asg-provider-C7weaxqp.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -14107,10 +14107,149 @@ const BILLING_FLIP_ACTIVE_WAIT_ATTEMPTS = 600;
 * though the template had asked, and `--revert` can never clear it because the
 * write gate skips the falsy value. Keep this the ONLY spelling of the rule.
 *
-* Deliberately TRUTHINESS, because that is what the wire has always done.
+* It USED to be bare truthiness, "because that is what the wire has always
+* done". PR review of issue #1768 showed that is not a rule, it is the absence
+* of one: `WarmThroughput: {}` and `WarmThroughput: 'nonsense'` are both truthy,
+* so they went out as `UpdateTable{WarmThroughput: {}}` /
+* `{WarmThroughput: 'nonsense'}` — a call that can only be rejected, and one
+* cdkd would repeat on every deploy. Harmless-looking at the table level (one
+* doomed call, loudly); newly REACHABLE per index once issue #1768's per-index
+* send path landed, where the same value is emitted once per index. So the rule
+* is now: at least ONE of the two user-settable members must resolve to a
+* finite number.
+*
+* Still not `!== undefined`, and still ONE spelling for the write sites and the
+* drift side both: a value this refuses is a value cdkd does not send, so the
+* readback must not emit AWS's computed value as though the template had asked
+* for it. A YAML-borne numeric STRING is accepted, via {@link capacityNumber},
+* because `'12000'` genuinely means 12000.
 */
 function isSendableWarmThroughput(value) {
-	return Boolean(value);
+	return coerceWarmThroughput(value) !== void 0;
+}
+/**
+* Turn a template-declared `WarmThroughput` into the NUMERIC spec cdkd puts on
+* the wire, or `undefined` when nothing in it is usable (PR review round 5).
+*
+* The send sites used to forward the declared value VERBATIM while
+* {@link isSendableWarmThroughput} accepted a numeric STRING, so the predicate
+* blessed the one shape it exists to stop: `{ReadUnitsPerSecond: '12000'}` went
+* out as `"WarmThroughput":{"ReadUnitsPerSecond":"12000"}` — a string in a Long
+* field, which DynamoDB rejects — and the drift side then answered "declared"
+* for it, so the readback emitted AWS's numeric value and the table drifted on
+* every run. Coercing rather than dropping string support is the better answer
+* for a stringly-typed CFn template (`'12000'` genuinely means 12000, and
+* `create()`'s table-level `ProvisionedThroughput` already coerces one line
+* over), and it makes the quoted form WORK instead of merely warning.
+*
+* Per MEMBER, so a bad one cannot take a good one with it, and never `NaN`:
+* {@link capacityNumber} accepts a number or a numeric string and rejects
+* everything else, so a member that does not resolve is OMITTED from the spec
+* and reported in `dropped` for the caller to announce. AWS accepts a
+* one-member `WarmThroughput` (measured us-east-1, 2026-08-13: an
+* `UpdateTable` carrying only `ReadUnitsPerSecond` is a valid request shape —
+* it was refused for being a DECREASE, not for its shape), so a partial send
+* is a real request rather than a malformed one.
+*
+* {@link isSendableWarmThroughput} is defined AS this function's success, so
+* the drift-side gate and the write-side coercion cannot answer differently —
+* structurally, not by hand. That identity is exact at the BLOCK level and
+* ONLY there (PR review round 6, where the earlier wording was measured and
+* found broader than the truth): both sides ask "is any member usable", so a
+* block cdkd sends is a block drift compares, and a block cdkd refuses is one
+* drift ignores.
+*
+* PER MEMBER it does NOT hold, and the residual is real:
+* `{ReadUnitsPerSecond: 12000, WriteUnitsPerSecond: {Ref: 'Unset'}}` sends only
+* `ReadUnitsPerSecond`, while `readCurrentState` emits AWS's computed value for
+* BOTH members and `getDriftUnknownPaths` leaves the path compared — so AWS's
+* `WriteUnitsPerSecond`, which cdkd never sent, is compared against the
+* template forever. It fails OPEN — the difference is REPORTED by `cdkd drift`,
+* never hidden — and {@link DynamoDBTableProvider.coerceWarmThroughputForSend}
+* names the dropped member when the value is APPLIED.
+*
+* How loud, precisely (measured, PR review round 7 — an earlier version of this
+* sentence said "on every deploy" and was falsified by the code two hundred
+* lines down): every warn in this provider sits behind a CHANGE gate, so the
+* drop is announced on the deploy that INTRODUCES it and is silent on every
+* repeat deploy of the same value, while the drift report persists. Loud once,
+* then a standing drift entry — not a per-deploy nag, and not silent either.
+* Closing the residual means emitting per-member, which is a `readCurrentState`
+* shape change with its own drift-baseline migration — deliberately not folded
+* into this issue.
+*
+* NOT a drift fix either way: state records what the TEMPLATE said, so a
+* `properties` baseline still holds `'12000'` against a numeric readback and
+* the comparator's `deepEqual` is strict about that. It is the generic
+* stringly-typed-CFn class (every numeric property has it), not something this
+* coercion can reach from the write side.
+*/
+function coerceWarmThroughput(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const bag = value;
+	const spec = {};
+	const dropped = [];
+	let usable = 0;
+	for (const member of ["ReadUnitsPerSecond", "WriteUnitsPerSecond"]) {
+		if (bag[member] === void 0) continue;
+		const n = capacityNumber(bag[member]);
+		if (n === void 0) {
+			dropped.push(member);
+			continue;
+		}
+		spec[member] = n;
+		usable++;
+	}
+	if (usable === 0) return void 0;
+	return {
+		spec,
+		dropped
+	};
+}
+/**
+* Is this a `WarmThroughput` the user WROTE that the tightened send rule then
+* refuses (PR review of issue #1768)?
+*
+* The set of values whose OUTCOME this issue changed, and the exact set the
+* write sites must warn about. Tightening {@link isSendableWarmThroughput}
+* closed a doomed-call class, and silently: a template declaring
+* `{ ReadUnitsPerSecnd: 20000 }` (a member typo), `'nonsense'`, `{}`, or an
+* unresolved intrinsic used to reach AWS and be REJECTED BY NAME, and now
+* vanishes with no warning, no debug line, and a green deploy — the "loud
+* failure for a quiet lie" trade the adopted-index arm in `applyGsiUpdates`
+* refuses, and out of step with every other skip in this file
+* ({@link DynamoDBTableProvider.skipZeroCapacityIndexUpdate},
+* {@link DynamoDBTableProvider.skipWarmThroughputDecrease}), which all warn.
+*
+* ABSENT is silent, because that is the ordinary case — the overwhelming
+* majority of templates declare no warm throughput at all and must not be
+* nagged. FALSY-but-present (`null`, `''`, `false`, `0`) is silent too: those
+* were skipped silently BEFORE this issue as well (`Boolean(value)` was the
+* whole rule), so they are not a behavior this PR changed and warning about
+* them would be a new noise source, not a restored signal.
+*/
+function isRefusedWarmThroughput(value) {
+	if (value === void 0) return false;
+	if (!value) return false;
+	return !isSendableWarmThroughput(value);
+}
+/**
+* Does the DESIRED bag carry enough for the drift side to answer "what did the
+* template declare"?
+*
+* An ABSENT or EMPTY bag answers NO: `drift.ts` passes `properties ?? {}`, and
+* other callers pass nothing at all, so `{}` means "nothing recorded" rather
+* than "this key is absent" (the contract on {@link ResourceProvider.getDriftUnknownPaths}).
+* Every gate below falls back to the pre-gate behavior on a NO, since dropping
+* a key on the strength of a bag that was never populated is unrecoverable
+* phantom drift in the other direction.
+*
+* Named once and shared by the table-level `WarmThroughput` gate (issue #1760)
+* and the per-index gates (issue #1767) so the two cannot answer the
+* "uninformative bag" question differently.
+*/
+function desiredBagIsInformative(properties) {
+	return properties !== void 0 && Object.keys(properties).length > 0;
 }
 /**
 * Does this desired-property bag DECLARE a table-level `WarmThroughput`?
@@ -14133,8 +14272,267 @@ function isSendableWarmThroughput(value) {
 * phantom drift, while the residual is a loud, per-resource revert failure.
 */
 function declaresWarmThroughput(properties) {
-	if (properties === void 0 || Object.keys(properties).length === 0) return true;
-	return isSendableWarmThroughput(properties["WarmThroughput"]);
+	if (!desiredBagIsInformative(properties)) return true;
+	return properties !== void 0 && isSendableWarmThroughput(properties["WarmThroughput"]);
+}
+/**
+* Is the WarmThroughput this update would SEND a DECREASE of what AWS already
+* holds (issue #1768)?
+*
+* Measured live (us-east-1, 2026-08-13) against a table AWS reports
+* `{ReadUnitsPerSecond: 12000, WriteUnitsPerSecond: 4000}` for:
+*
+* ```
+* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000, WriteUnitsPerSecond: 2000}
+*   ValidationException: One or more parameter values were invalid: Requested
+*   ReadUnitsPerSecond for WarmThroughput for table is lower than current
+*   WarmThroughput, decreasing WarmThroughput is not supported
+* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000}      -> same rejection
+* UpdateTable WarmThroughput={WriteUnitsPerSecond: 2000}     -> same rejection, naming WriteUnitsPerSecond
+* UpdateTable WarmThroughput={12000, 4000}  (re-assert)      -> ACCEPTED
+* ```
+*
+* So the value is one AWS raises with the table's traffic and never lowers,
+* and a decrease is REJECTED rather than accepted-and-ignored — which is what
+* the issue said to measure before choosing, because the two produce different
+* correct answers. The caller SKIPS the call on a true here.
+*
+* Rules, each one chosen so the skip is right for EVERY `update()` caller
+* (the deploy engine, `cdkd drift --revert`, and the rollback executor's two
+* revert arms — none of which can make AWS lower the value, so none of them
+* loses anything a doomed call would have achieved):
+*
+* - Only the members the desired side DECLARES are examined; an omitted member
+*   is not sent and cannot be a decrease.
+* - EVERY declared member must be at-or-below its live counterpart AND at
+*   least one strictly below. A MIXED request (one member up, one down) still
+*   goes out: AWS rejects it by name, which is the pre-fix behavior and better
+*   than silently dropping the increase the user asked for.
+* - Anything not resolvable to a finite number fails OPEN (the call is still
+*   issued): the worst case is the pre-fix behavior, whereas a false positive
+*   would silently drop a real increase. Only the LIVE side can actually reach
+*   that arm now (PR review round 8): the desired side is a COERCED spec, so a
+*   malformed template value or an unresolved intrinsic has already been
+*   dropped by {@link coerceWarmThroughput} and cannot arrive here. The check
+*   is kept for the live side, which is whatever `DescribeTable` returned.
+*/
+function isWarmThroughputDecrease(desired, live) {
+	if (live === void 0) return false;
+	let sawDecrease = false;
+	for (const member of ["ReadUnitsPerSecond", "WriteUnitsPerSecond"]) {
+		if (desired[member] === void 0) continue;
+		const wanted = capacityNumber(desired[member]);
+		const current = capacityNumber(live[member]);
+		if (wanted === void 0 || current === void 0) return false;
+		if (wanted > current) return false;
+		if (wanted < current) sawDecrease = true;
+	}
+	return sawDecrease;
+}
+/**
+* Does the warm throughput AWS currently holds already equal what this update
+* would request (issue #1768 PR review)?
+*
+* The warm-throughput twin of {@link liveCapacityAlreadyMatches}, and compared
+* the same way and for the same reason: the live side is a
+* `...WarmThroughputDescription` carrying an AWS-managed `Status` alongside the
+* two units, so a structural compare against the two-member desired object
+* could never match and the suppression would be dead code that only LOOKED
+* safe.
+*
+* Only the members the desired side DECLARES are compared — an omitted member
+* is not part of the request, so it cannot make the request differ. Anything
+* unresolvable fails OPEN (the call is still issued): the worst case is a
+* redundant `UpdateTable`, whereas a false MATCH silently drops a
+* warm-throughput raise the user asked for. As in
+* {@link isWarmThroughputDecrease}, only the LIVE side can reach that arm now
+* that the desired side is a coerced spec.
+*
+* Deliberately NOT applied to the TABLE-level branch, which still sends an
+* equal re-assert: that is measured-accepted by AWS (us-east-1, 2026-08-13 —
+* re-asserting `{12000, 4000}` returns a normal `TableDescription`), it is ONE
+* call rather than one per index, and its own change gate already requires the
+* value to differ from the recorded previous. The per-index path is where the
+* redundancy multiplies and where the carried #1767 residual reaches it.
+*/
+function warmThroughputAlreadyMatches(desired, live) {
+	if (live === void 0) return false;
+	let compared = 0;
+	for (const member of ["ReadUnitsPerSecond", "WriteUnitsPerSecond"]) {
+		if (desired[member] === void 0) continue;
+		const wanted = capacityNumber(desired[member]);
+		const current = capacityNumber(live[member]);
+		if (wanted === void 0 || current === void 0) return false;
+		if (wanted !== current) return false;
+		compared++;
+	}
+	return compared > 0;
+}
+/**
+* Reverse-map one live secondary-index description to its CloudFormation
+* shape (issue #1767).
+*
+* `DescribeTable` describes an index with a superset of the CFn members —
+* measured live, us-east-1 2026-08-13, on a `PAY_PER_REQUEST` table with one
+* GSI and no capacity settings:
+*
+* ```json
+* { "IndexName": "gsi1",
+*   "KeySchema": [{ "AttributeName": "gsipk", "KeyType": "HASH" }],
+*   "Projection": { "ProjectionType": "ALL" },
+*   "IndexStatus": "CREATING", "Backfilling": true,
+*   "ProvisionedThroughput": { "NumberOfDecreasesToday": 0, "ReadCapacityUnits": 0, "WriteCapacityUnits": 0 },
+*   "IndexSizeBytes": 0, "ItemCount": 0,
+*   "IndexArn": "arn:aws:dynamodb:...:table/.../index/gsi1",
+*   "WarmThroughput": { "ReadUnitsPerSecond": 12000, "WriteUnitsPerSecond": 4000, "Status": "UPDATING" } }
+* ```
+*
+* NONE of `IndexStatus` / `Backfilling` / `IndexSizeBytes` / `ItemCount` /
+* `IndexArn` is a CFn property, the `ProvisionedThroughput` block is AWS's
+* `{0, 0}` on-demand placeholder (the #1571 trap), and the per-index
+* `WarmThroughput` is the AWS-computed value the table-level gate already
+* refuses to surface (issue #1760). Forwarding the description verbatim put
+* all of them into the drift comparison, and — unlike a top-level key the
+* baseline lacks — they are members of an ARRAY the baseline DOES carry, which
+* `deepEqual` compares positionally, so every one of them participated.
+*
+* The mapper is therefore an ALLOW-LIST rather than a deny-list: a member AWS
+* adds later is dropped by construction instead of silently joining the
+* comparison.
+*
+* `desired` is the DESIRED bag's entry for the SAME `IndexName` (matched by
+* name, never by position — the list is an unordered set, see
+* {@link DynamoDBTableProvider.getDriftUnorderedPaths}). The three throughput
+* blocks are emitted only when that entry declares them, the #1760 shape one
+* nesting level down; `bagInformative` false means the caller supplied no bag
+* to decide with and every block is emitted, cleaned of its AWS-managed
+* members.
+*
+* Known residual, unchanged by this fix: CFn's per-index
+* `ContributorInsightsSpecification` has no `DescribeTable` counterpart (it
+* needs a per-index `DescribeContributorInsights` call), so a template
+* declaring one still cannot converge against a `properties` baseline. It is
+* ALSO dropped on the write side, since `create()` forwards the CFn blob to
+* `CreateTable` and the SDK serializer discards the unknown member — still
+* true after round 6 taught that path to coerce `WarmThroughput`, because the
+* entry is rebuilt with a SPREAD and every other member, known or not, rides
+* along unchanged. Filed as issue
+* [#1782](https://github.com/go-to-k/cdkd/issues/1782).
+*/
+function reverseMapSecondaryIndex(live, desired, bagInformative) {
+	const out = {};
+	if (live.IndexName !== void 0) out["IndexName"] = live.IndexName;
+	if (live.KeySchema !== void 0) out["KeySchema"] = live.KeySchema.map((element) => ({ ...element }));
+	if (live.Projection !== void 0) {
+		const projection = {};
+		if (live.Projection.ProjectionType !== void 0) projection["ProjectionType"] = live.Projection.ProjectionType;
+		if (live.Projection.NonKeyAttributes !== void 0) projection["NonKeyAttributes"] = [...live.Projection.NonKeyAttributes];
+		if (Object.keys(projection).length > 0) out["Projection"] = projection;
+	}
+	if ("ProvisionedThroughput" in live && indexDeclares(desired, "ProvisionedThroughput", bagInformative) && live.ProvisionedThroughput) {
+		const provisioned = live.ProvisionedThroughput;
+		const pt = {};
+		if (provisioned.ReadCapacityUnits !== void 0) pt["ReadCapacityUnits"] = provisioned.ReadCapacityUnits;
+		if (provisioned.WriteCapacityUnits !== void 0) pt["WriteCapacityUnits"] = provisioned.WriteCapacityUnits;
+		if (Object.keys(pt).length > 0) out["ProvisionedThroughput"] = pt;
+	}
+	if ("OnDemandThroughput" in live && indexDeclares(desired, "OnDemandThroughput", bagInformative) && live.OnDemandThroughput) {
+		const onDemand = live.OnDemandThroughput;
+		const odt = {};
+		if (onDemand.MaxReadRequestUnits !== void 0) odt["MaxReadRequestUnits"] = onDemand.MaxReadRequestUnits;
+		if (onDemand.MaxWriteRequestUnits !== void 0) odt["MaxWriteRequestUnits"] = onDemand.MaxWriteRequestUnits;
+		if (Object.keys(odt).length > 0) out["OnDemandThroughput"] = odt;
+	}
+	if ("WarmThroughput" in live && indexDeclares(desired, "WarmThroughput", bagInformative) && live.WarmThroughput) {
+		const warm = live.WarmThroughput;
+		const wt = {};
+		if (warm.ReadUnitsPerSecond !== void 0) wt["ReadUnitsPerSecond"] = warm.ReadUnitsPerSecond;
+		if (warm.WriteUnitsPerSecond !== void 0) wt["WriteUnitsPerSecond"] = warm.WriteUnitsPerSecond;
+		if (Object.keys(wt).length > 0) out["WarmThroughput"] = wt;
+	}
+	return out;
+}
+/**
+* Does the DESIRED entry for one index declare this block (issue #1767)?
+*
+* The question is always "would cdkd SEND this block", because that is what
+* makes AWS's readback value explainable by the template — so each block is
+* answered by the write rule that actually governs it, never by a second
+* spelling of one:
+*
+*  - `WarmThroughput` routes through {@link isSendableWarmThroughput}, the
+*    predicate EVERY per-index write path calls — the `Create` / `Update` GSI
+*    actions in `applyGsiUpdates` AND `create()`'s `CreateTable` forward, which
+*    maps each entry through
+*    {@link DynamoDBTableProvider.coerceIndexWarmThroughputForCreate}. It is
+*    TIGHTER than truthiness (at least one member resolving to a finite
+*    number), so `WarmThroughput: {}` is neither sent nor emitted on any path.
+*    An earlier version of this bullet carved out the TABLE-create path as an
+*    exception, and that exception was a DEFECT rather than a design: it also
+*    put a quoted `'12000'` on the wire as a string in a Long field, so one
+*    template failed on a fresh create and succeeded on a later GSI add. Fixed
+*    in PR review round 6; the carve-out is gone because the divergence is.
+*  - `ProvisionedThroughput` / `OnDemandThroughput` keep TRUTHINESS, which is
+*    what their write path does: those two members ARE still forwarded verbatim
+*    (the create-path mapper rewrites only `WarmThroughput`), and
+*    `applyGsiUpdates` gates on `gsi.ProvisionedThroughput` alone. Widening
+*    `isSendableWarmThroughput` over them would be wrong twice over — it reads
+*    members those blocks do not have (`ReadUnitsPerSecond` vs
+*    `ReadCapacityUnits`), so every declared capacity would read as undeclared.
+*
+* An UNINFORMATIVE bag answers TRUE for every block, keeping the pre-#1767
+* behavior for a caller that supplied nothing to decide with. A bag that IS
+* informative but names no entry for this index answers FALSE: the index
+* exists in AWS and not in the template, so nothing cdkd sent can explain any
+* of its throughput blocks.
+*/
+function indexDeclares(desired, key, bagInformative) {
+	if (!bagInformative) return true;
+	const value = desired?.[key];
+	return key === "WarmThroughput" ? isSendableWarmThroughput(value) : Boolean(value);
+}
+/**
+* Is this value an index list that DECLARES at least one index (issue #1767)?
+*
+* The ONE spelling of that question, shared by {@link desiredIndexEntriesByName}
+* (which decides what each live index is matched against) and by
+* {@link DynamoDBTableProvider.getDriftUnknownPaths} (which decides whether the
+* list is compared at all). Spelled independently they disagreed: a plain
+* truthiness test reads `[]` and an unresolved `{Fn::If: [...]}` as DECLARED —
+* so the list stayed in the comparison while the mapper, which needs an ARRAY
+* to match names against, treated the same value as declaring nothing and
+* stripped every throughput block from the readback. That is a one-sided
+* difference manufactured by the pair, which is the failure this file's
+* `isSendableWarmThroughput` header exists to prevent.
+*
+* Consequence worth stating: a template declaring `GlobalSecondaryIndexes: []`
+* now has that path IGNORED by the comparator, so an index created out of band
+* on such a table is not reported. That is the same answer the readback gives
+* (nothing the template declared can explain that index), and consistency
+* between the two is worth more than detection on a shape where the two used to
+* contradict each other.
+*/
+function declaresIndexList(value) {
+	return Array.isArray(value) && value.length > 0;
+}
+/**
+* Index the DESIRED bag's secondary-index list by `IndexName` (issue #1767).
+*
+* Returns an empty map for anything {@link declaresIndexList} rejects — an
+* empty array, an unresolved intrinsic, a mis-nested template value — which
+* routes every live index through {@link indexDeclares}'s "declares nothing"
+* arm. Sharing that predicate with `getDriftUnknownPaths` is what keeps the
+* emission and the comparison from answering differently for the same bag.
+*/
+function desiredIndexEntriesByName(value) {
+	const byName = /* @__PURE__ */ new Map();
+	if (!declaresIndexList(value)) return byName;
+	for (const entry of value) {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+		const name = entry["IndexName"];
+		if (typeof name === "string") byName.set(name, entry);
+	}
+	return byName;
 }
 var DynamoDBTableProvider = class {
 	dynamoDBClient;
@@ -14192,12 +14590,17 @@ var DynamoDBTableProvider = class {
 				};
 			}
 			if (properties["OnDemandThroughput"]) createParams.OnDemandThroughput = properties["OnDemandThroughput"];
-			if (isSendableWarmThroughput(properties["WarmThroughput"])) createParams.WarmThroughput = properties["WarmThroughput"];
+			const createWarmThroughput = this.coerceWarmThroughputForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"]);
+			if (createWarmThroughput) createParams.WarmThroughput = createWarmThroughput;
+			else this.warnRefusedWarmThroughput(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"]);
 			if (properties["StreamSpecification"]) createParams.StreamSpecification = {
 				StreamEnabled: true,
 				StreamViewType: properties["StreamSpecification"]["StreamViewType"]
 			};
-			if (properties["GlobalSecondaryIndexes"]) createParams.GlobalSecondaryIndexes = properties["GlobalSecondaryIndexes"];
+			if (properties["GlobalSecondaryIndexes"]) {
+				const declaredGsis = properties["GlobalSecondaryIndexes"];
+				createParams.GlobalSecondaryIndexes = Array.isArray(declaredGsis) ? declaredGsis.map((entry) => this.coerceIndexWarmThroughputForCreate(logicalId, entry)) : declaredGsis;
+			}
 			if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
 			const sse = mapSSESpecification(properties["SSESpecification"]);
 			if (sse && Object.keys(sse).length > 0) createParams.SSESpecification = sse;
@@ -14355,10 +14758,12 @@ var DynamoDBTableProvider = class {
 				}
 			}
 			if (JSON.stringify(properties["WarmThroughput"]) !== JSON.stringify(previousProperties["WarmThroughput"])) {
-				if (isSendableWarmThroughput(properties["WarmThroughput"])) {
+				this.warnRefusedWarmThroughput(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"]);
+				const warmThroughputToSend = this.coerceWarmThroughputForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"]);
+				if (warmThroughputToSend !== void 0 && !this.skipWarmThroughputDecrease(logicalId, physicalId, warmThroughputToSend, table?.WarmThroughput)) {
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
-						WarmThroughput: properties["WarmThroughput"]
+						WarmThroughput: warmThroughputToSend
 					}));
 					await this.waitForTableActiveAfterUpdate(physicalId);
 					this.logger.debug(`Updated WarmThroughput on DynamoDB table ${physicalId}`);
@@ -14822,6 +15227,32 @@ var DynamoDBTableProvider = class {
 	* between GSI mutations because a freshly-created index keeps backfilling
 	* after the table itself returns to ACTIVE, and AWS rejects the next GSI op
 	* until the prior index settles.
+	*
+	* `WarmThroughput.Status` is deliberately NOT part of the predicate, and that
+	* is MEASURED rather than assumed (PR review of issue #1768 raised it as a
+	* suspected race, since the per-index warm-throughput send path this provider
+	* gained has no other reason to wait). Live, us-east-1 2026-08-13, on a
+	* PAY_PER_REQUEST table with two ACTIVE GSIs: raising `gsi1`'s warm
+	* throughput 12000/4000 -> 14000/5000 left
+	*
+	* ```
+	* TableStatus: ACTIVE | gsi1: IndexStatus ACTIVE, WarmThroughput.Status UPDATING
+	*                     | gsi2: IndexStatus ACTIVE, WarmThroughput.Status ACTIVE
+	* ```
+	*
+	* for 90+ seconds — so this predicate IS satisfied while a warm update is
+	* still settling, exactly as the review described. What does not follow is
+	* the failure: with `gsi1` in that state, all three next-op shapes were
+	* ACCEPTED, no `ResourceInUseException` —
+	*
+	*  - a warm-throughput `Update` on the OTHER index (`gsi2`);
+	*  - a warm-throughput `Update` on the SAME index (`gsi1`);
+	*  - a GSI `Create` (`gsi3`), the op AWS gates most strictly.
+	*
+	* So warm throughput settles OUT OF BAND of the index lifecycle, and adding
+	* it to this predicate would only make every GSI op wait on a status that
+	* blocks nothing — minutes of wait budget spent per op, with a real risk of
+	* exhausting it on a table whose warm status lingers.
 	*/
 	async waitForTableAndIndexesActive(tableName, maxAttempts = 1800) {
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
@@ -14872,32 +15303,223 @@ var DynamoDBTableProvider = class {
 			if (!gsi.KeySchema) throw new ProvisioningError(`GlobalSecondaryIndex ${name} on DynamoDB table ${logicalId} is missing KeySchema`, resourceType, logicalId, physicalId);
 			if (live !== void 0 && live.IndexStatus !== "DELETING") {
 				this.logger.warn(`GSI ${name} on DynamoDB table ${physicalId} already exists in AWS but is absent from cdkd's recorded previous state, so its Create is being skipped. This usually means an earlier deploy created the index and then failed before state was written.`);
-				if (liveCapacityComparable && gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && !liveCapacityAlreadyMatches(live.ProvisionedThroughput, gsi.ProvisionedThroughput)) ops.push({ Update: {
-					IndexName: name,
-					ProvisionedThroughput: gsi.ProvisionedThroughput
-				} });
+				const adopted = { IndexName: name };
+				let adoptedHasMember = false;
+				if (liveCapacityComparable && gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && !liveCapacityAlreadyMatches(live.ProvisionedThroughput, gsi.ProvisionedThroughput) && !this.skipZeroCapacityIndexUpdate(name, physicalId, gsi.ProvisionedThroughput)) {
+					adopted.ProvisionedThroughput = gsi.ProvisionedThroughput;
+					adoptedHasMember = true;
+				}
+				const adoptedWarm = this.warmThroughputOpFor(name, physicalId, gsi, void 0, live);
+				if (adoptedWarm) {
+					adopted.WarmThroughput = adoptedWarm;
+					adoptedHasMember = true;
+				}
+				if (adoptedHasMember) ops.push({ Update: adopted });
 				this.logger.warn(`GSI ${name} was adopted from AWS rather than created, so cdkd could not verify its KeySchema / Projection match the template. Run \`cdkd drift ${physicalId}\` to confirm, and \`cdkd drift --accept\` if AWS is the source of truth.`);
 				continue;
 			}
+			this.warnRefusedWarmThroughput(`GSI ${name} on DynamoDB table ${physicalId}`, gsi.WarmThroughput);
+			const createWarm = this.coerceWarmThroughputForSend(`GSI ${name} on DynamoDB table ${physicalId}`, gsi.WarmThroughput);
 			ops.push({ Create: {
 				IndexName: name,
 				KeySchema: gsi.KeySchema,
 				Projection: gsi.Projection,
 				...gsi.ProvisionedThroughput ? { ProvisionedThroughput: gsi.ProvisionedThroughput } : {},
-				...gsi.OnDemandThroughput ? { OnDemandThroughput: gsi.OnDemandThroughput } : {}
+				...gsi.OnDemandThroughput ? { OnDemandThroughput: gsi.OnDemandThroughput } : {},
+				...createWarm ? { WarmThroughput: createWarm } : {}
 			} });
 		} else {
 			const before = prevByName.get(name);
 			if (JSON.stringify(before.KeySchema) !== JSON.stringify(gsi.KeySchema) || JSON.stringify(before.Projection) !== JSON.stringify(gsi.Projection)) throw new ProvisioningError(`GlobalSecondaryIndex ${name} on DynamoDB table ${logicalId} changed its KeySchema or Projection, which DynamoDB cannot modify in place. Rename the index (so it is dropped and re-created) or replace the table.`, resourceType, logicalId, physicalId);
-			if (gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && JSON.stringify(before.ProvisionedThroughput) !== JSON.stringify(gsi.ProvisionedThroughput)) if (liveCapacityComparable && liveCapacityAlreadyMatches(liveIndexByName?.get(name)?.ProvisionedThroughput, gsi.ProvisionedThroughput)) this.logger.debug(`GSI ${name} on DynamoDB table ${physicalId} already carries the requested capacity in AWS; skipping its throughput Update`);
-			else ops.push({ Update: {
-				IndexName: name,
-				ProvisionedThroughput: gsi.ProvisionedThroughput
-			} });
+			const update = { IndexName: name };
+			let updateHasMember = false;
+			if (gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && JSON.stringify(before.ProvisionedThroughput) !== JSON.stringify(gsi.ProvisionedThroughput)) {
+				if (liveCapacityComparable && liveCapacityAlreadyMatches(liveIndexByName?.get(name)?.ProvisionedThroughput, gsi.ProvisionedThroughput)) this.logger.debug(`GSI ${name} on DynamoDB table ${physicalId} already carries the requested capacity in AWS; skipping its throughput Update`);
+				else if (!this.skipZeroCapacityIndexUpdate(name, physicalId, gsi.ProvisionedThroughput)) {
+					update.ProvisionedThroughput = gsi.ProvisionedThroughput;
+					updateHasMember = true;
+				}
+			}
+			const warm = this.warmThroughputOpFor(name, physicalId, gsi, before, liveIndexByName?.get(name));
+			if (warm) {
+				update.WarmThroughput = warm;
+				updateHasMember = true;
+			}
+			if (updateHasMember) ops.push({ Update: update });
 		}
 		await this.runGsiOps(physicalId, ops, desiredAttributeDefinitions);
 	}
 	/**
+	* The NUMERIC `WarmThroughput` spec to put on the wire, announcing any member
+	* that had to be dropped (PR review round 5).
+	*
+	* The single send-side entry point for all four write sites, so a template's
+	* quoted `'12000'` reaches AWS as `12000` rather than as a string in a Long
+	* field. Returns `undefined` for a value {@link isSendableWarmThroughput}
+	* refuses — the caller's existing refusal warning covers that case, and the
+	* two messages are disjoint by construction: this one fires only when
+	* something DID resolve.
+	*/
+	coerceWarmThroughputForSend(scope, value) {
+		const coerced = coerceWarmThroughput(value);
+		if (coerced === void 0) return void 0;
+		if (coerced.dropped.length > 0) this.logger.warn(`${scope}: WarmThroughput member(s) ${coerced.dropped.join(", ")} in ${JSON.stringify(value)} are not a number DynamoDB accepts, so they were dropped from the request, which leaves ${JSON.stringify(coerced.spec)}. Check for an unresolved intrinsic or a non-numeric value.`);
+		return coerced.spec;
+	}
+	/**
+	* One `CreateTable` index entry with its `WarmThroughput` coerced (PR review
+	* round 6).
+	*
+	* `create()` forwards the declared `GlobalSecondaryIndexes` array to
+	* `CreateTable`, so it is a SEND SITE for the same per-index value the
+	* update path coerces — and it was the one the round-5 sweep missed. Entries
+	* are rebuilt rather than mutated: the input bag belongs to the caller (the
+	* resolved template, which the engine also records into state), and a
+	* provider that edits it in place would change what state reports cdkd sent.
+	*
+	* An entry that is not a plain object, or that declares no `WarmThroughput`,
+	* is returned UNCHANGED — including the identity of the object, so the
+	* common case allocates nothing.
+	*/
+	coerceIndexWarmThroughputForCreate(logicalId, entry) {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return entry;
+		const declared = entry["WarmThroughput"];
+		if (declared === void 0) return entry;
+		const scope = `GSI ${entry.IndexName ?? "<unnamed>"} on AWS::DynamoDB::Table ${logicalId}`;
+		const coerced = this.coerceWarmThroughputForSend(scope, declared);
+		if (coerced === void 0) {
+			this.warnRefusedWarmThroughput(scope, declared);
+			const { WarmThroughput: _dropped, ...rest } = entry;
+			return rest;
+		}
+		return {
+			...entry,
+			WarmThroughput: coerced
+		};
+	}
+	/**
+	* Announce a `WarmThroughput` the send rule REFUSES (PR review of issue
+	* #1768) — the missing half of tightening {@link isSendableWarmThroughput}.
+	*
+	* Called at all FOUR write sites (`create()`, the table-level `update()`
+	* branch, the GSI `Create` action, and {@link warmThroughputOpFor}) because
+	* the value vanishes at each of them independently. `scope` names the
+	* resource or the index so a table with several GSIs says WHICH one.
+	*
+	* Silent for an ABSENT or FALSY value — see {@link isRefusedWarmThroughput}
+	* for why those two are not this warning's business.
+	*/
+	warnRefusedWarmThroughput(scope, value) {
+		if (!isRefusedWarmThroughput(value)) return;
+		this.logger.warn(`${scope}: the declared WarmThroughput ${JSON.stringify(value)} carries no usable ReadUnitsPerSecond or WriteUnitsPerSecond, so it was NOT sent — DynamoDB accepts only those two members and rejects a request without either. Check for a misspelled member name or an unresolved intrinsic. Nothing else on this resource was affected.`);
+	}
+	/**
+	* Should this per-index capacity `Update` be SKIPPED because the value is
+	* AWS's on-demand `{0, 0}` placeholder rather than a capacity anyone asked
+	* for (issue #1767 review)?
+	*
+	* Newly reachable BECAUSE of the #1767 readback change, on the transition
+	* residual `getDriftUnknownPaths` deliberately carries. A pre-#1767
+	* `observedProperties` baseline holds the whole `DescribeTable` index
+	* description, including the `{NumberOfDecreasesToday: 0, ReadCapacityUnits:
+	* 0, WriteCapacityUnits: 0}` block AWS reports for every index of a
+	* PAY_PER_REQUEST table (the #1571 trap). `cdkd drift --revert` hands that
+	* blob to `update()` as the DESIRED side against the trimmed readback as the
+	* previous side, so the values differ, `liveCapacityComparable` is false on
+	* PAY_PER_REQUEST (which disables the #1630 idempotency skip), and the op
+	* that goes out asks AWS for capacity 0 — which AWS rejects, since the
+	* minimum is 1. Before #1767 both sides carried the same blob, compared
+	* equal, and no revert was ever offered.
+	*
+	* Deliberately NOT gated on the live billing mode. A `{0, 0}` request is
+	* refused by AWS in EITHER mode, so gating would leave the same doomed call
+	* reachable for a PROVISIONED table whose stale baseline carries the
+	* placeholder. Scoped tightly to BOTH members resolving to 0: any other
+	* capacity — including a half-declared or malformed one — still goes out and
+	* is answered by AWS, the fail-OPEN direction this file uses everywhere.
+	*
+	* CALLER-BLIND, decided rather than overlooked (PR review). A TEMPLATE-borne
+	* `{0, 0}` warn-skips here while `create()` fails loudly on the same value,
+	* which reads like the "loud failure for a quiet lie" trade the adopted-index
+	* arm below forbids. It stands for three reasons:
+	*
+	*  - The discriminator that EXISTS does not separate the callers that matter.
+	*    `ResourceProvider.update` DOES take an optional `UpdateContext` — an
+	*    earlier draft of this comment claimed the signature carries no context
+	*    at all, which is simply false (`s3-bucket-provider.ts` consumes it
+	*    today) — but its one field, `desiredFromAwsReadback`, is set ONLY by
+	*    `cdkd drift --revert` (`src/cli/commands/drift.ts`). The rollback
+	*    executor's revert arms deliberately pass NO context: their desired bag
+	*    is `previousState.properties`, a TEMPLATE recorded earlier, so they are
+	*    indistinguishable from an ordinary template deploy — and THAT is the
+	*    pair this decision turns on. Knowing the value came from a readback
+	*    would not license throwing on the other two.
+	*  - With the caller unknowable, the repo's rule for the UPDATE path is
+	*    WARN-never-throw (issues #1545 / #1552): the desired bag here can BE a
+	*    historical cdkd state record, and a refusal would make the table
+	*    un-updatable and un-rollbackable with no template-side remedy.
+	*  - The lie is bounded and self-surfacing. AWS never accepted `{0, 0}` at
+	*    create either, so no live table can be holding it; and where the value
+	*    would actually matter — a PROVISIONED table, whose indexes hold a real
+	*    capacity — recording `{0, 0}` diverges from the readback and `cdkd drift`
+	*    REPORTS it. On a PAY_PER_REQUEST table the recorded `{0, 0}` matches what
+	*    `DescribeTable` reports for every index anyway, so there is no divergence
+	*    to hide.
+	*/
+	skipZeroCapacityIndexUpdate(indexName, physicalId, requested) {
+		if (requested === void 0) return false;
+		if (capacityNumber(requested.ReadCapacityUnits) !== 0 || capacityNumber(requested.WriteCapacityUnits) !== 0) return false;
+		this.logger.warn(`GSI ${indexName} on DynamoDB table ${physicalId}: the requested ProvisionedThroughput is {ReadCapacityUnits: 0, WriteCapacityUnits: 0}, which is AWS's on-demand placeholder rather than a capacity DynamoDB accepts (the minimum is 1), so no per-index throughput update was sent. This usually means the value came from a pre-#1767 cdkd state record — a \`cdkd drift --revert\` of such a record, or a rollback replaying it. Re-run \`cdkd deploy\` (or \`cdkd drift --accept\`) to refresh the record.`);
+		return true;
+	}
+	/**
+	* The per-index `WarmThroughput` this update should send, or `undefined`
+	* (issue #1768, one nesting level down from the table-level branch).
+	*
+	* `applyGsiUpdates` used to send only `ProvisionedThroughput` /
+	* `OnDemandThroughput` on both of its arms, while `readCurrentState` emits a
+	* declared per-index `WarmThroughput` — so a template declaring one had it
+	* silently dropped on every index add / change, `cdkd drift` reported the
+	* difference forever, and `--revert` emitted no op at all and exited 0
+	* claiming success. That silent-success shape is worse than the loud
+	* table-level dead end #1768 fixed.
+	*
+	* The rules mirror the table-level branch exactly:
+	*  - only a value the write side would SEND at all
+	*    ({@link isSendableWarmThroughput});
+	*  - only when it CHANGED against the recorded previous entry (an absent
+	*    previous — the adopted-index arm — is treated as changed, since nothing
+	*    was recorded to compare with);
+	*  - never a DECREASE. Measured live (us-east-1, 2026-08-13) on a GSI AWS
+	*    reports `{12000, 4000}` for: a `WarmThroughput`-only `Update` action
+	*    with `{12000, 4000}` is ACCEPTED (so the action shape needs no
+	*    `ProvisionedThroughput` companion), while `{6000, 2000}` is rejected
+	*    with `Requested ReadUnitsPerSecond for WarmThroughput for index gsi1 is
+	*    lower than current WarmThroughput, decreasing WarmThroughput is not
+	*    supported`.
+	*/
+	warmThroughputOpFor(indexName, physicalId, desired, previous, live) {
+		const requested = desired.WarmThroughput;
+		if (previous !== void 0 && JSON.stringify(previous.WarmThroughput) === JSON.stringify(requested)) return;
+		const sendable = this.coerceWarmThroughputForSend(`GSI ${indexName} on DynamoDB table ${physicalId}`, requested);
+		if (sendable === void 0) {
+			this.warnRefusedWarmThroughput(`GSI ${indexName} on DynamoDB table ${physicalId}`, requested);
+			return;
+		}
+		if (warmThroughputAlreadyMatches(sendable, live?.WarmThroughput)) {
+			this.logger.debug(`GSI ${indexName} on DynamoDB table ${physicalId} already carries the requested warm throughput in AWS; skipping its WarmThroughput Update`);
+			return;
+		}
+		if (isWarmThroughputDecrease(sendable, live?.WarmThroughput)) {
+			this.logger.warn(`GSI ${indexName} on DynamoDB table ${physicalId}: the requested WarmThroughput ${JSON.stringify(sendable)} is lower than the ${JSON.stringify({
+				ReadUnitsPerSecond: live?.WarmThroughput?.ReadUnitsPerSecond,
+				WriteUnitsPerSecond: live?.WarmThroughput?.WriteUnitsPerSecond
+			})} DynamoDB currently holds for that index. Warm throughput only ever RISES with an index's traffic and cannot be lowered — AWS rejects the UpdateTable with "decreasing WarmThroughput is not supported" — so it was NOT sent and every other change on this table still applied. On a deploy this warning may be the only signal you get: a successful deploy re-captures AWS's current value as the drift baseline. If your template declares this index's WarmThroughput, set it to the value AWS holds (or remove it, which AWS treats as keeping the last-set value); if it does not, the value came from a cdkd state record and 'cdkd deploy' (or 'cdkd drift --accept') refreshes it.`);
+			return;
+		}
+		return sendable;
+	}
+	/**
 	* Issue a list of `GlobalSecondaryIndexUpdates` ops, one per `UpdateTable`,
 	* waiting for the table AND every index to return to ACTIVE between each.
 	*
@@ -14947,6 +15569,33 @@ var DynamoDBTableProvider = class {
 		}
 	}
 	/**
+	* Should this update SKIP its `WarmThroughput` call because the value would
+	* DECREASE what AWS already holds (issue #1768)?
+	*
+	* Thin logging wrapper over the pure {@link isWarmThroughputDecrease}, kept
+	* on the class so the warning is emitted at exactly the one site that skips.
+	*
+	* The warning is what makes the skip honest, and its WORDING is checked
+	* against the code rather than assumed (PR review): the first version
+	* promised `cdkd drift` would "keep reporting the difference", which is TRUE
+	* on the `drift --revert` path — nothing is recorded, so the observed
+	* baseline still holds the declared value — and FALSE on the DEPLOY path.
+	* A successful deploy re-captures `observedProperties` through this same
+	* `readCurrentState` (`deploy-engine.ts`'s `kickOffObservedCapture`), which
+	* for a DECLARING template emits AWS's CURRENT value, so the very deploy
+	* that warned equalises the comparison and the next `cdkd drift` reports the
+	* resource clean. The message therefore says the warning may be the only
+	* signal, and names both numbers so the template edit needs no second look.
+	*/
+	skipWarmThroughputDecrease(logicalId, physicalId, desired, live) {
+		if (!isWarmThroughputDecrease(desired, live)) return false;
+		this.logger.warn(`AWS::DynamoDB::Table ${logicalId}: the requested WarmThroughput ${JSON.stringify(desired)} is lower than the ${JSON.stringify({
+			ReadUnitsPerSecond: live?.ReadUnitsPerSecond,
+			WriteUnitsPerSecond: live?.WriteUnitsPerSecond
+		})} DynamoDB currently holds for table ${physicalId}. Warm throughput only ever RISES with a table's traffic and cannot be lowered — AWS rejects the UpdateTable with "decreasing WarmThroughput is not supported" — so it was NOT sent and every other change on this resource still applied. On a deploy this warning may be the only signal you get: a successful deploy re-captures AWS's current value as the drift baseline, so the next 'cdkd drift' reports this table clean (a 'cdkd drift --revert' records nothing and keeps reporting it). To make cdkd and AWS agree, set WarmThroughput to the value AWS holds (or remove the property, which AWS treats as keeping the last-set value).`);
+		return true;
+	}
+	/**
 	* `AttributeDefinitions` is a SET, keyed by `AttributeName`: CFn accepts the
 	* members in any order and `DescribeTable` returns them in an order matching
 	* neither the request nor the template. Measured live (us-east-1,
@@ -14966,6 +15615,29 @@ var DynamoDBTableProvider = class {
 	* `KeySchema` is deliberately NOT declared, at the table level or the index
 	* level: it is order-SIGNIFICANT (HASH before RANGE), so sorting it would
 	* HIDE a real key change rather than remove a phantom one.
+	*
+	* `GlobalSecondaryIndexes` / `LocalSecondaryIndexes` are NOT declared either,
+	* and that is a MECHANISM limit rather than a judgement about the lists —
+	* both really are sets keyed by `IndexName` (issue #1767 proposes declaring
+	* them). Every entry here is a SUBTREE declaration, and unlike
+	* `getDriftUnknownPaths` this walk DESCENDS INTO ARRAY ELEMENTS giving each
+	* the parent's path (`drift-normalize.ts`), so a `'GlobalSecondaryIndexes'`
+	* entry also reaches `GlobalSecondaryIndexes.KeySchema` and would sort the
+	* per-index key schema — reversing the sentence above at the index level
+	* only. Issue #1767 calls the sort and the member reverse-map separable;
+	* this change ships the reverse-map, and the ordering half needed a
+	* leaf-only form of the declaration first (issue
+	* [#1783](https://github.com/go-to-k/cdkd/issues/1783)). **That form now
+	* EXISTS** — `LEAF_ONLY_PATH_SUFFIX` (`[]`) landed in
+	* [#1799](https://github.com/go-to-k/cdkd/pull/1799), so
+	* `'GlobalSecondaryIndexes[]'` would claim the list alone without reaching
+	* the per-index `KeySchema`. It is deliberately NOT declared here yet:
+	* adopting it is its own change with its own real-AWS verification, tracked
+	* as issue [#1812](https://github.com/go-to-k/cdkd/issues/1812). Consequence
+	* until then, stated so it is not mistaken for solved: an index list AWS
+	* returns in a different ORDER than the template declared is still phantom
+	* drift against a `properties` baseline. It is not reachable on the ordinary
+	* `observedProperties` path, where both sides come from this same readback.
 	*/
 	getDriftUnorderedPaths(resourceType) {
 		if (resourceType !== "AWS::DynamoDB::Table") return [];
@@ -15009,11 +15681,72 @@ var DynamoDBTableProvider = class {
 	* `TlsConfig` (issue #1602): an absent / empty bag falls back to the
 	* type-level answer of COMPARING, since hiding a real drift is the worse
 	* failure.
+	*
+	* `GlobalSecondaryIndexes` / `LocalSecondaryIndexes` join it under the SAME
+	* rule for the SAME reason (issue #1767), one nesting level up: the readback
+	* now emits the reverse-mapped CFn shape, so every `observedProperties`
+	* baseline an earlier binary wrote — which carries `IndexStatus` /
+	* `ItemCount` / `IndexArn` / the on-demand `{0, 0}` placeholder / the
+	* computed per-index `WarmThroughput` — no longer equals it. Ignoring the
+	* path on both sides when the template declares NO index list covers the
+	* transition and the steady state for that population, exactly as the
+	* `WarmThroughput` arm does: an index list the template never declared is
+	* AWS-authored (created out of band, or by a sibling), which is the #1498
+	* class.
+	*
+	* Known residual, deliberately NOT covered, because covering it costs more
+	* than it buys: a table whose template DOES declare indexes keeps comparing,
+	* so its already-written observed baseline reports a one-sided
+	* `GlobalSecondaryIndexes` difference until the next deploy re-captures it
+	* (or `cdkd drift --accept` does). `cdkd drift --revert` is the third thing a
+	* user may reach for on that report, and for the shapes measured here it
+	* applies NOTHING to AWS — which is a property of three separate skips, not
+	* "by construction", and the distinction is load-bearing because this PR
+	* briefly broke it. The index names match, so no Create / Delete is derived;
+	* the stale blob's `{0, 0}` capacity is refused by
+	* {@link skipZeroCapacityIndexUpdate}; and its per-index `WarmThroughput` —
+	* which the same PR taught `applyGsiUpdates` to SEND (issue #1768), turning
+	* an earlier "by construction" wording false the moment it landed — is
+	* refused by {@link warmThroughputAlreadyMatches}, since a stale blob carries
+	* exactly what AWS holds. Remove any of the three and the residual stops
+	* being harmless: the revert starts issuing one redundant `UpdateTable` plus
+	* a full index-ACTIVE wait per GSI, or a doomed one.
+	*
+	* "Applies nothing" is NOT the same as "reaches those skips" (PR review round
+	* 5). `applyGsiUpdates` compares `KeySchema` / `Projection` between the
+	* recorded previous and the desired entry BEFORE any of them and THROWS on a
+	* difference, because DynamoDB cannot modify either in place. On this path
+	* that compare is a trimmed readback against a stale full description, and
+	* both members survive the #1767 reverse-map unchanged — `KeySchema`
+	* verbatim, `Projection` rebuilt member-for-member — so for every shape
+	* exercised here it matches and the throw does not fire. It is named because
+	* it is the outcome an enumeration of skips would otherwise hide: a stale
+	* blob whose `Projection` AWS has since re-normalized would fail the revert
+	* loudly rather than no-op it. Suppressing the residual instead would mean ignoring the
+	* whole array for the population that HAS indexes — i.e. never detecting an
+	* out-of-band index add / remove / capacity change again, permanently, to
+	* remove a one-time report. No PATH can express the middle ground:
+	* `isIgnoredPath` is never asked about a path that crosses an array
+	* (`diffAt` compares arrays wholesale via `deepEqual`), so a per-MEMBER
+	* ignore path does not exist — the same wall issue #1742 records for the
+	* `AWS::DynamoDB::GlobalTable` twin. **A non-path seam now EXISTS**:
+	* `ResourceProvider.canonicalizeDriftProperties`, applied to BOTH comparison
+	* sides, landed in [#1799](https://github.com/go-to-k/cdkd/pull/1799) (which
+	* closed issue [#1784](https://github.com/go-to-k/cdkd/issues/1784)) and can
+	* strip the AWS-managed member from each bag — converging an already-written
+	* record with a post-fix readback, with no ignore-path and no lost
+	* detection. It is deliberately NOT adopted here yet: doing so is its own
+	* change with its own real-AWS verification, tracked as issue
+	* [#1812](https://github.com/go-to-k/cdkd/issues/1812).
 	*/
 	getDriftUnknownPaths(resourceType, properties) {
 		if (resourceType !== "AWS::DynamoDB::Table") return [];
-		if (declaresWarmThroughput(properties)) return [];
-		return ["WarmThroughput"];
+		const paths = [];
+		if (!declaresWarmThroughput(properties)) paths.push("WarmThroughput");
+		if (desiredBagIsInformative(properties)) {
+			for (const key of ["GlobalSecondaryIndexes", "LocalSecondaryIndexes"]) if (properties !== void 0 && !declaresIndexList(properties[key])) paths.push(key);
+		}
+		return paths;
 	}
 	/**
 	* Read the AWS-current DynamoDB table configuration in CFn-property shape.
@@ -15027,18 +15760,18 @@ var DynamoDBTableProvider = class {
 	*  - StreamSpecification's CFn shape includes only `StreamViewType`; the
 	*    API response carries `StreamEnabled` too. We surface both since the
 	*    drift comparator only descends into keys present in state.
-	*  - GSI / LSI in the API response include `IndexStatus`, `ItemCount`,
-	*    `IndexArn` and sizing fields cdkd never sets, and they are forwarded
-	*    VERBATIM. This used to claim "the comparator filters them" — it does
-	*    NOT, and issue #1767 quotes that sentence as the bug: the filter is
-	*    `calculateResourceDrift`'s state-keys-only walk, which only reaches an
-	*    absent TOP-LEVEL key. These are members of an array under a key the
-	*    baseline DOES carry, and arrays compare positionally, so every
-	*    AWS-managed member participates — `ItemCount` MOVES as data lands, so
-	*    an in-use table with an index drifts against its own
-	*    `observedProperties` on the ordinary path. Fixing it needs a full
-	*    reverse-mapper plus the same migration companion this issue's
-	*    `WarmThroughput` gate needed, hence a separate issue.
+	*  - GSI / LSI in the API response include `IndexStatus`, `Backfilling`,
+	*    `ItemCount`, `IndexArn` and sizing fields cdkd never sets. They used to
+	*    be forwarded VERBATIM under a comment claiming "the comparator filters
+	*    them" — it does NOT, and issue #1767 quotes that sentence as the bug:
+	*    the filter is `calculateResourceDrift`'s state-keys-only walk, which
+	*    only reaches an absent TOP-LEVEL key. These are members of an array
+	*    under a key the baseline DOES carry, and arrays compare positionally,
+	*    so every AWS-managed member participated — and `ItemCount` MOVES as
+	*    data lands, so an in-use table with any index drifted against its own
+	*    `observedProperties` on the ORDINARY path, on a schedule set by its own
+	*    write traffic. Each entry is now reverse-mapped to its CFn shape by
+	*    {@link reverseMapSecondaryIndex}.
 	*
 	* Returns `undefined` when the table is gone (`ResourceNotFoundException`).
 	*
@@ -15050,8 +15783,10 @@ var DynamoDBTableProvider = class {
 	* template carries them).
 	*
 	* `properties` is the DESIRED bag (the state-recorded template intent every
-	* caller passes) and is consulted for exactly one field, `WarmThroughput` —
-	* see {@link getDriftUnknownPaths} for the measurement and the reasoning.
+	* caller passes). It is consulted for the table-level `WarmThroughput` — see
+	* {@link getDriftUnknownPaths} for the measurement and the reasoning — and,
+	* since issue #1767, for the per-index throughput blocks of each secondary
+	* index, matched by `IndexName`.
 	*/
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
 		try {
@@ -15082,8 +15817,15 @@ var DynamoDBTableProvider = class {
 				StreamEnabled: true,
 				StreamViewType: table.StreamSpecification.StreamViewType
 			};
-			if (table.GlobalSecondaryIndexes && table.GlobalSecondaryIndexes.length > 0) result["GlobalSecondaryIndexes"] = table.GlobalSecondaryIndexes;
-			if (table.LocalSecondaryIndexes && table.LocalSecondaryIndexes.length > 0) result["LocalSecondaryIndexes"] = table.LocalSecondaryIndexes;
+			const bagInformative = desiredBagIsInformative(properties);
+			if (table.GlobalSecondaryIndexes && table.GlobalSecondaryIndexes.length > 0) {
+				const desiredByName = desiredIndexEntriesByName(properties?.["GlobalSecondaryIndexes"]);
+				result["GlobalSecondaryIndexes"] = table.GlobalSecondaryIndexes.map((live) => reverseMapSecondaryIndex(live, live.IndexName === void 0 ? void 0 : desiredByName.get(live.IndexName), bagInformative));
+			}
+			if (table.LocalSecondaryIndexes && table.LocalSecondaryIndexes.length > 0) {
+				const desiredByName = desiredIndexEntriesByName(properties?.["LocalSecondaryIndexes"]);
+				result["LocalSecondaryIndexes"] = table.LocalSecondaryIndexes.map((live) => reverseMapSecondaryIndex(live, live.IndexName === void 0 ? void 0 : desiredByName.get(live.IndexName), bagInformative));
+			}
 			if (table.SSEDescription?.Status === "ENABLED") {
 				const sse = { SSEEnabled: true };
 				if (table.SSEDescription.KMSMasterKeyArn !== void 0) sse["KMSMasterKeyId"] = table.SSEDescription.KMSMasterKeyArn;
@@ -65044,6 +65786,363 @@ function createEventsPruneCommand() {
 	})).option("--older-than <duration>", "Delete runs older than this duration (e.g. 24h, 90m)").option("--all", "Delete every recorded run and the index (full purge)", false).action(withErrorHandling((stack, _options, command) => eventsPruneCommand(stack, command.optsWithGlobals())));
 }
 
+//#endregion
+//#region src/utils/ecr-uri.ts
+/**
+* The ECR registry-host FORM TABLE — the ONE place the host forms AWS serves are
+* spelled (issue #1793).
+*
+* The forms used to be spelled TWICE, here and in `src/cli/commands/gc.ts`,
+* and the two already disagreed: gc carried the `-fips` and `on.aws` forms
+* while this module matched only the plain one, so a genuine FIPS or dual-stack
+* registry was not recognized here AT ALL and `cdkd local invoke` /
+* `run-task` classified it as a public image (anonymous pull, no
+* `docker login`).
+*
+* **What is shared is this TABLE, not the whole matcher** — read that precisely,
+* because the unification is deliberately PARTIAL. gc builds its pattern from
+* the table through {@link ecrRegistryHostPattern}; this module's own
+* {@link ECR_URI_HOST_REGEX} re-spells the alternation from the table's LABELS
+* column and cannot use that builder at all (its doc says why). So the shared
+* fact is which label runs AWS serves and which of them carry a FIXED suffix —
+* which is exactly what had drifted — while each matcher keeps its own
+* acceptance rule, deliberately: gc matches the suffix against the union over
+* every partition and {@link parseEcrRegistryHost} pairs it WITH the region (see
+* `gc.ts`'s `AWS_URL_SUFFIXES` doc for why the two strictnesses must not merge).
+*
+* A THIRD, looser spelling of "this is an ECR registry host" still lives outside
+* this table — `isCdkAssetImageUri`'s `host.includes('.dkr.ecr.')` in
+* `src/local/ecs-task-resolver.ts`, which recognizes only the plain form and is
+* case-SENSITIVE. It is tracked as issue #1846 rather than folded in here: it
+* must keep tolerating an UNRESOLVED host
+* (`${AWS::AccountId}.dkr.ecr.${AWS::Region}.${AWS::URLSuffix}`), so it cannot
+* simply become a call to either matcher.
+*
+* Every row is read off the AWS-published `ecr` endpoint list
+* (https://docs.aws.amazon.com/general/latest/gr/ecr.html) plus the docker
+* push / pull examples in the ECR user guide's "Making requests to Amazon ECR
+* registries", rather than inferred:
+*
+* - `<acct>.dkr.ecr.<region>.<urlSuffix>` — the IPv4-only registry endpoint,
+*   every partition.
+* - `<acct>.dkr.ecr-fips.<region>.<urlSuffix>` — the FIPS IPv4 endpoint, served
+*   in `us-east-1` / `us-east-2` / `us-west-1` / `us-west-2` /
+*   `us-gov-east-1` / `us-gov-west-1` — i.e. only in partitions whose suffix is
+*   `amazonaws.com`, which is why pairing it with the region's own partition
+*   suffix is exactly right rather than merely convenient.
+* - `<acct>.dkr-ecr.<region>.on.aws` — the dual-stack (IPv4 + IPv6) endpoint.
+* - `<acct>.dkr-ecr-fips.<region>.on.aws` — the dual-stack FIPS endpoint, in the
+*   same six regions as the IPv4 FIPS form. This one was missing from BOTH
+*   copies of the grammar; unifying them is what surfaced it.
+*
+* The two dual-stack forms carry a FIXED suffix, so their check is that literal
+* rather than the region's partition suffix — the TIGHTEST available check for
+* them, not a relaxation: `on.aws` is an AWS-owned domain, so unlike a captured
+* suffix it cannot be substituted by a host someone else owns. They are
+* accepted for ANY region rather than only the partitions AWS documents them
+* in, deliberately: under-accepting is precisely the issue #1764 failure (a
+* cdkd table lagging AWS made a GENUINE registry classify as public), and the
+* suffix being AWS-owned means the widening cannot point a `docker login`
+* anywhere but AWS.
+*/
+const ECR_REGISTRY_HOST_FORMS = [
+	{ labels: "dkr.ecr" },
+	{ labels: "dkr.ecr-fips" },
+	{
+		labels: "dkr-ecr",
+		fixedUrlSuffix: "on.aws"
+	},
+	{
+		labels: "dkr-ecr-fips",
+		fixedUrlSuffix: "on.aws"
+	}
+];
+/**
+* {@link ECR_REGISTRY_HOST_FORMS} ordered LONGEST LABELS FIRST, so
+* `dkr.ecr-fips` is tried before its own `dkr.ecr` prefix instead of relying on
+* backtracking.
+*/
+const ECR_HOST_FORMS_LONGEST_FIRST = [...ECR_REGISTRY_HOST_FORMS].sort((a, b) => b.labels.length - a.labels.length);
+/**
+* {@link ECR_REGISTRY_HOST_FORMS} keyed by its (already lower-case) labels, for
+* resolving which suffix rule the matched form wants.
+*/
+const ECR_HOST_FORM_BY_LABELS = new Map(ECR_REGISTRY_HOST_FORMS.map((form) => [form.labels, form]));
+/**
+* The host half of an ECR image URI as a regex SOURCE string, built from
+* {@link ECR_REGISTRY_HOST_FORMS} (issue #1793).
+*
+* ONE consumer: `cdkd gc`, which passes loose non-capturing sub-patterns and
+* matches the suffix against the union over every partition.
+*
+* **This module does NOT call it**, and that is structural rather than an
+* oversight — {@link ECR_URI_HOST_REGEX} re-spells the alternation from the
+* table's LABELS column instead. The strict matcher needs the suffix CAPTURED,
+* at a FIXED group index, to pair it with the region; this builder inlines a
+* `fixedUrlSuffix` as an UNCAPTURED literal, so the capturing-group count would
+* differ per alternative and the group index of the suffix would depend on which
+* form matched. Making the fixed suffix capturing to even the count is not the
+* fix either: it would hand gc a group it does not want, ahead of the tag /
+* digest groups it reads BY POSITION. So the sharable unit is the table, not the
+* pattern — and the cross-matcher test in `tests/unit/cli/gc.test.ts` is driven
+* off the table, so a row added there must work on BOTH sides or the suite reds.
+*
+* Every group this function ADDS is non-capturing, and that is load-bearing
+* rather than stylistic, for the same by-position reason: `gc.ts` reads its ECR
+* tag / digest by GROUP INDEX, and a capturing group here would silently shift
+* them. The caller's own three sub-patterns are interpolated verbatim, so
+* whether THOSE capture is the caller's business.
+*/
+function ecrRegistryHostPattern(segments) {
+	const forms = ECR_HOST_FORMS_LONGEST_FIRST.map((form) => {
+		const suffix = form.fixedUrlSuffix === void 0 ? segments.partitionUrlSuffix : escapeRegExp(form.fixedUrlSuffix);
+		return `${escapeRegExp(form.labels)}\\.${segments.region}\\.${suffix}`;
+	});
+	return `${segments.accountId}\\.(?:${forms.join("|")})`;
+}
+/**
+* Matching the HOST half of an ECR image URI:
+* `<acct>.<labels>.<region>.<urlSuffix>/`.
+*
+* The suffix is CAPTURED rather than spelled out (issue #1758): the previous
+* pattern hardcoded `amazonaws.com` with an optional `.cn` tail, so a `us-iso*`
+* registry (`c2s.ic.gov` / `sc2s.sgov.gov`) never matched and the caller
+* silently classified a real ECR image as a user-managed one — skipping the
+* `docker login` it needs.
+*
+* The LABELS are captured too, because which suffix is expected depends on
+* WHICH form matched (issue #1793) — the dual-stack forms carry a fixed
+* `on.aws` rather than the region's partition suffix.
+*
+* Built from {@link ECR_REGISTRY_HOST_FORMS}'s LABELS column rather than through
+* {@link ecrRegistryHostPattern}: the builder cannot serve this matcher's fixed
+* capture-group layout (see its doc). The table is what the two matchers share.
+*
+* The `i` flag makes the labels case-INSENSITIVE (issue #1792). DNS is
+* case-insensitive, so `<acct>.DKR.ECR.<region>.<suffix>` names the same host,
+* but the labels were spelled as case-sensitive literals — and unlike the
+* issue #1786 defect one layer over, the host then did not match the SHAPE at
+* all, so `parseEcrRegistryHost` returned `undefined` AND
+* {@link looksLikeEcrHostWithForeignSuffix} returned `false`, i.e. not even the
+* issue #1764 diagnostic fired.
+*
+* Widening the shape is the right fix rather than a refusal because DOCKER
+* accepts an upper-cased registry host, so cdkd is not made to `docker login`
+* for a URI docker will then reject. `distribution/reference`'s grammar spells
+* `domain-component` as `([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])`
+* while the repository PATH is `alpha-numeric := [a-z0-9]+`, and
+* `ParseNormalizedNamed` raises `repository name must be lowercase` for the
+* REMOTE NAME only — `splitDockerDomain` performs no case folding on the
+* domain. This change never touches the repository path.
+*
+* What docker does NOT fold is its CREDENTIAL STORE, which is keyed on the
+* hostname verbatim (measured in issue #1801: a pull of an upper-cased host
+* sent no credentials at all, while the lower-cased spelling authenticated).
+* That is why the fix here is only the SHAPE match: the login / pull spelling
+* is reconciled one layer up by `ecr-puller.ts`'s `canonicalizeImageUriHost`,
+* which every docker-facing consumer already routes through. Issue #1817
+* tracks moving that fold in here.
+*
+* **Every verdict issues #1792 / #1793 changed, in full** — `p` is
+* {@link parseEcrRegistryHost}, `d` is
+* {@link looksLikeEcrHostWithForeignSuffix} (the issue #1764 diagnostic), `S`
+* is the region's own partition suffix and `F` a foreign one. The table is
+* spelled out because the DIAGNOSTIC-ONLY rows are the easy ones to omit: `p`
+* is unchanged there, so a summary that tracks only the parse verdict reads as
+* "no change" while a warning that never used to fire now does.
+*
+* ```text
+*   host                              before        after         what changed
+*   <a>.dkr.ecr.<r>.S                 p=ok  d=f     p=ok  d=f     nothing
+*   <a>.dkr.ecr.<r>.F                 p=und d=TRUE  p=und d=TRUE  nothing
+*   <a>.dkr.ecr.<r>.on.aws            p=und d=TRUE  p=und d=TRUE  nothing (*)
+*   <a>.DKR.ECR.<r>.S                 p=und d=f     p=ok  d=f     #1792 PARSE
+*   <a>.DKR.ECR.<r>.F                 p=und d=f     p=und d=TRUE  #1792 diag only
+*   <a>.dkr.ecr-fips.<r>.S            p=und d=f     p=ok  d=f     #1793 PARSE
+*   <a>.dkr.ecr-fips.<r>.F            p=und d=f     p=und d=TRUE  #1793 diag only
+*   <a>.dkr-ecr.<r>.on.aws            p=und d=f     p=ok  d=f     #1793 PARSE
+*   <a>.dkr-ecr-fips.<r>.on.aws       p=und d=f     p=ok  d=f     #1793 PARSE
+*   <a>.dkr-ecr.<r>.S                 p=und d=f     p=und d=TRUE  #1793 diag only
+*   <a>.dkr-ecr-fips.<r>.S            p=und d=f     p=und d=TRUE  #1793 diag only
+*   <a>.dkr.ecr-fips.<r>.on.aws       p=und d=f     p=und d=TRUE  #1793 diag only
+* ```
+*
+* (*) `dkr.ecr` + `on.aws` is the one mispairing that ALREADY reported `true`
+* before the change: the pre-#1793 pattern matched the plain labels against a
+* wildcard `([^/]+)` suffix, so `on.aws` was simply a suffix that is not
+* `amazonaws.com`. Every other row that flips `d` was previously refused at the
+* SHAPE, which is why both verdicts were quiet.
+*
+* The five `d`-only flips are an improvement in kind — a host AWS does not serve
+* now says so instead of passing silently as a public image — but the caller's
+* MESSAGE was written for the #1764 partition-gap case and now over-claims for a
+* form/suffix mispairing (`amazonaws.com` IS `us-east-1`'s partition suffix).
+* `src/local/ecs-task-resolver.ts` owns that wording; recorded on issue #1846.
+*/
+const ECR_URI_HOST_REGEX = new RegExp(`^(\\d{12})\\.(${ECR_HOST_FORMS_LONGEST_FIRST.map((form) => escapeRegExp(form.labels)).join("|")})\\.([^.]+)\\.([^/]+)/`, "i");
+/**
+* A region segment cdkd is willing to treat as a region id.
+*
+* Case is not the only way the `startsWith` partition classification can be
+* side-stepped: any leading junk defeats it the same way, and the captured
+* segment does not stay inert — it becomes an `ECRClient({region})` and is
+* interpolated into the fallback `docker login` endpoint. Measured before this
+* guard: `…dkr.ecr. us-iso-east-1.amazonaws.com/…` (leading space) and a
+* combining-mark form both parsed, yielding regions `" us-iso-east-1"` and
+* `"us-i̇so-east-1"`. Neither leaks credentials — an ACCEPTED suffix is always
+* an AWS-owned domain — but a region id is ASCII alphanumeric plus `-`, so
+* anything else is a malformed host and refusing it keeps the classification
+* honest.
+*
+* TESTED AGAINST THE RAW SEGMENT, BEFORE `toLowerCase()`, and that order is the
+* whole point: `String.prototype.toLowerCase` performs full Unicode case
+* folding, so the Kelvin sign U+212A folds to a plain ASCII `k`. Checking the
+* FOLDED segment therefore accepts `us-eKst-1` and yields the region
+* `us-ekst-1` — a region the host does not name — which is precisely the
+* class of substitution this guard exists to refuse. Matching `[A-Za-z0-9-]`
+* on the raw capture keeps case-insensitivity (the point of issue #1786) while
+* admitting only characters that fold to themselves.
+*
+* ONE DELIBERATE SIDE EFFECT, called out because it is a withdrawal rather than
+* an addition: a malformed-region host is now classified as an ordinary public
+* image with NO cdkd-side signal at all — neither the ECR verdict nor the #1764
+* foreign-suffix diagnostic. Both arms change, not just the foreign one:
+* `<acct>.dkr.ecr.us_east_1.example.com/…` used to log the partition-gap
+* warning and now logs nothing, and `<acct>.dkr.ecr.us_east_1.amazonaws.com/…`
+* used to be ACCEPTED as ECR and is now refused. That is the correct verdict
+* rather than a regression — the diagnostic's whole subject is "this suffix does
+* not belong to its region's PARTITION", and a segment that is not a region id
+* has no partition to belong to, so reporting it would send the reader hunting
+* for a table entry that could never exist — but it does mean a typo'd region
+* gets no cdkd-side hint, only docker's own pull failure. Both arms are pinned
+* by tests so a future widening of the guard cannot flip them silently.
+*/
+const CANONICAL_REGION_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
+/**
+* A URL suffix cdkd is willing to compare against the partition table.
+*
+* The SAME raw-capture rule as the region, and for the same reason one layer
+* over: the suffix is folded before the comparison, so a code point folding
+* into ASCII can impersonate a partition's suffix. This became reachable the
+* moment issue #1764 landed `aws-isoe`'s `cloud.adc-e.uk` — that suffix
+* contains a `k`, so `…dkr.ecr.eu-isoe-west-1.cloud.adc-e.uK/…` (Kelvin
+* sign) folded onto it and was ACCEPTED. Not a credential leak, since UTS-46
+* maps U+212A to `k` too and the host resolves to the real AWS domain, but it
+* falsifies the invariant the region guard's comment above states, so both
+* captures are held to the same rule rather than only the one that was
+* measured first.
+*
+* Dots are admitted because a suffix is a dotted DNS name; every other
+* character is refused, so the accepted set stays exactly the partition
+* table's own literals.
+*/
+const CANONICAL_URL_SUFFIX = /^[A-Za-z0-9][A-Za-z0-9.-]*$/;
+/**
+* The ONE case-normalization boundary of this module (issue #1786).
+*
+* DNS is case-INSENSITIVE, so `US-ISO-EAST-1.amazonaws.com` and
+* `us-iso-east-1.amazonaws.com` name the same host — but both halves of the
+* #1758 suffix check were case-SENSITIVE, in OPPOSITE directions:
+*
+* - an upper-cased REGION fails every `startsWith` prefix test in
+*   `derivePartitionAndUrlSuffix`, so it falls through to the commercial
+*   partition whose suffix is `amazonaws.com` — which is exactly what an ISO
+*   look-alike host carries, so the strict check ACCEPTED it (the bypass);
+* - an upper-cased region or SUFFIX on a GENUINE host stopped matching its own
+*   partition's suffix, so a real ECR registry was REJECTED and the caller
+*   silently classified it as a user-managed image — the #1758 regression, one
+*   layer up.
+*
+* The normalization lives HERE rather than inside `derivePartitionAndUrlSuffix`
+* because this is the boundary where an untrusted, DNS-shaped string enters
+* cdkd, and keeping it in ONE function means both exported entry points below —
+* and the suffix COMPARISON itself — cannot drift apart.
+*
+* This does NOT duplicate `canonicalizeRegion`, which issue #1795 added inside
+* `derivePartitionAndUrlSuffix` so the mapping folds its own input. The two
+* answer different questions and both are needed: that one makes the partition
+* LOOKUP case-insensitive for every caller, while these guards decide whether
+* the captured segments are a region id and a URL suffix AT ALL. Folding alone
+* cannot do that — folding is precisely what turns `us-eKst-1` into the
+* plausible `us-ekst-1` (see the guards' own comments), so a fold-only helper
+* makes the substitution easier to reach, not harder. Double-folding is a
+* no-op, which is why the redundant `toLowerCase()` calls below are left in
+* rather than removed: they keep this function the single answer for the
+* comparison even if the helper's behaviour changes again.
+*
+* The derived suffix is lower-cased too. Every entry in the partition table is
+* a lower-case literal today, so that is a no-op; it is there so this function
+* stays the single answer even if that table ever gains a mixed-case entry.
+*/
+function matchEcrRegistryHost(imageUri) {
+	const m = ECR_URI_HOST_REGEX.exec(imageUri);
+	if (!m) return void 0;
+	if (!CANONICAL_REGION_SEGMENT.test(m[3])) return void 0;
+	if (!CANONICAL_URL_SUFFIX.test(m[4])) return void 0;
+	const form = ECR_HOST_FORM_BY_LABELS.get(m[2].toLowerCase());
+	if (!form) return void 0;
+	const region = m[3].toLowerCase();
+	return {
+		accountId: m[1],
+		region,
+		suffix: m[4].toLowerCase(),
+		expectedSuffix: (form.fixedUrlSuffix ?? derivePartitionAndUrlSuffix(region).urlSuffix).toLowerCase()
+	};
+}
+/**
+* The account + region of an ECR image URI, or `undefined` when the URI is not
+* an ECR registry host — either because it does not have one of the shapes
+* {@link ECR_REGISTRY_HOST_FORMS} lists, or because its suffix is not the one
+* the matched form carries for the region it names.
+*
+* Lives in `src/utils/` rather than beside its first caller because it has TWO
+* consumers in different layers — `src/local/ecr-puller.ts` (which needs the
+* `:tag` tail too) and `src/local/ecs-task-resolver.ts` (which classifies an
+* image that may carry a digest or no tag at all). Before issue #1758 they each
+* carried their own copy of the hardcoded commercial pattern, and fixing only
+* the pull path left `cdkd local run-task` broken outside the commercial
+* partition; ONE definition is what stops them drifting apart again.
+*
+* The module is deliberately free of AWS SDK imports, which is what lets
+* `ecs-task-resolver.ts` consume it without breaking the invariant that module
+* documents about itself (it resolves secrets through a separate module for
+* exactly that reason).
+*
+* The returned `region` is LOWER-CASED (issue #1786) — it is consumed as an SDK
+* client region by `ecr-puller.ts` and as the `region` of a `kind: 'ecr'` image
+* by `ecs-task-resolver.ts`, and the canonical spelling of an AWS region id is
+* lower case.
+*/
+function parseEcrRegistryHost(imageUri) {
+	const m = matchEcrRegistryHost(imageUri);
+	if (!m) return void 0;
+	if (m.suffix !== m.expectedSuffix) return void 0;
+	return {
+		accountId: m.accountId,
+		region: m.region
+	};
+}
+/**
+* True when the URI has one of the ECR HOST SHAPES but carries a suffix that
+* form does not serve for the region it names — i.e. exactly the case
+* {@link parseEcrRegistryHost} rejects for a reason the caller may want to
+* report.
+*
+* Since issue #1793 that covers a form / suffix MISPAIRING too, not only a
+* foreign suffix: `<acct>.dkr-ecr.<region>.amazonaws.com` and
+* `<acct>.dkr.ecr.<region>.on.aws` each spell one form's labels with the
+* other's suffix, and AWS serves neither.
+*
+* The two rejections are worth telling apart at a call site that degrades
+* silently: a genuinely public image and a registry in a partition
+* `derivePartitionAndUrlSuffix` does not know yet (issue #1764) both come back
+* `undefined`, and only the second is a cdkd gap rather than a user choice.
+*/
+function looksLikeEcrHostWithForeignSuffix(imageUri) {
+	const m = matchEcrRegistryHost(imageUri);
+	return m !== void 0 && m.suffix !== m.expectedSuffix;
+}
+
 //#endregion
 //#region src/cli/commands/gc.ts
 /**
@@ -65103,10 +66202,6 @@ function parseOlderThan(value) {
 	const multiplier = match[2] === "d" ? 1440 * 60 * 1e3 : 3600 * 1e3;
 	return Math.round(num * multiplier);
 }
-/** Escape a literal string for embedding in a RegExp. */
-function escapeRegExp(value) {
-	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
 /**
 * Characters that terminate an S3 key extracted from a URL-shaped string.
 * Whitespace / quotes never appear in cdkd's content-addressed asset keys
@@ -65144,30 +66239,50 @@ const GC_EXTRA_URL_SUFFIXES = [];
 */
 const URL_SUFFIX_ALTERNATION = `(?:${[...[.../* @__PURE__ */ new Set([...PARTITION_TABLE.map((row) => row.urlSuffix), ...GC_EXTRA_URL_SUFFIXES])]].sort((a, b) => b.length - a.length).map(escapeRegExp).join("|")})`;
 /**
-* The HOST half of an ECR registry, as an alternation over the forms AWS
-* serves: `<acct>.dkr.ecr.<region>.<urlSuffix>`, its FIPS sibling
-* `<acct>.dkr.ecr-fips.<region>.<urlSuffix>`, and the short-form alias
-* `<acct>.dkr-ecr.<region>.on.aws`.
-*
-* Kept DELIBERATELY separate from the S3 matchers' shared
-* {@link URL_SUFFIX_ALTERNATION} rather than folded into it: `on.aws` is an
-* ECR-only endpoint, so adding it to the shared suffix set would also make
-* `https://<assetBucket>.s3.<region>.on.aws/<key>` a recognized S3 reference.
-* Widening either matcher only ever over-PROTECTS, but the two services' host
-* grammars genuinely differ and conflating them is how the next widening goes
-* wrong.
+* The HOST half of an ECR registry, built from the ONE authoritative FORM TABLE
+* in `src/utils/ecr-uri.ts` (issue #1793) instead of spelled a second time here.
+*
+* That module owns which segment spellings AWS serves — the plain
+* `<acct>.dkr.ecr.<region>.<urlSuffix>`, its FIPS sibling
+* `<acct>.dkr.ecr-fips.<region>.<urlSuffix>`, and the two dual-stack forms
+* `<acct>.dkr-ecr[-fips].<region>.on.aws` — while each matcher keeps its own
+* suffix-ACCEPTANCE rule on top: gc passes the union over every partition
+* ({@link URL_SUFFIX_ALTERNATION}), whereas `parseEcrRegistryHost` pairs the
+* captured suffix WITH the region. See the {@link AWS_URL_SUFFIXES} doc for why
+* the two strictnesses are deliberate and must not be merged.
+*
+* gc is the ONLY consumer of {@link ecrRegistryHostPattern}: the strict matcher
+* there needs the suffix captured at a fixed group index and so re-spells the
+* alternation off the same table's labels column. What the two share is the
+* TABLE, not the pattern — enough to stop the FORMS drifting, which is what had
+* gone wrong, and the cross-matcher test in `tests/unit/cli/gc.test.ts` is driven
+* off the table so a row added there must work on both sides.
+*
+* Sharing the table immediately brought a form gc was MISSING:
+* `<acct>.dkr-ecr-fips.<region>.on.aws`, the dual-stack FIPS endpoint. A form
+* missing here reads a live image as unreferenced and DELETES it, so this is the
+* irreversible direction — which is the whole argument for one definition.
+*
+* `on.aws` still does not reach the S3 matchers, and now cannot: it is an
+* ECR-only endpoint, so folding it into the shared suffix set would also make
+* `https://<assetBucket>.s3.<region>.on.aws/<key>` a recognized S3 reference —
+* and in the form table a fixed suffix travels WITH its own form rather than
+* sitting in a shared set, so that separation is mechanical instead of
+* remembered.
 *
 * Account and region are matched loosely on purpose (see the extractor doc):
 * collecting a reference from another account's or region's URI can only KEEP
-* more, never delete more — which is also why the two extra forms are worth
-* carrying even though cdkd's own publisher writes the plain one. Issue #1793
-* tracks deriving these host forms from ONE place shared with
-* `src/utils/ecr-uri.ts` instead of two hand-kept copies — that module matches
-* only the plain `dkr.ecr` form today, so the two already disagree.
+* more, never delete more — which is also why the extra forms are worth
+* carrying even though cdkd's own publisher writes the plain one.
 *
-* Every group is non-capturing, for the {@link URL_SUFFIX_ALTERNATION} reason.
+* Every group is non-capturing, for the {@link URL_SUFFIX_ALTERNATION} reason;
+* {@link ecrRegistryHostPattern} guarantees it for the groups IT adds.
 */
-const ECR_REGISTRY_HOST = `\\d{12}\\.(?:dkr\\.ecr(?:-fips)?\\.[a-z0-9-]+\\.${URL_SUFFIX_ALTERNATION}|dkr-ecr\\.[a-z0-9-]+\\.on\\.aws)`;
+const ECR_REGISTRY_HOST = ecrRegistryHostPattern({
+	accountId: "\\d{12}",
+	region: "[a-z0-9-]+",
+	partitionUrlSuffix: URL_SUFFIX_ALTERNATION
+});
 /**
 * cdkd's publishers write content-addressed keys (`<sha256>.<ext>`). A
 * second, name-independent pass collects every such token from every
@@ -65225,7 +66340,7 @@ function buildReferenceExtractors(marker) {
 	const s3UriRe = new RegExp(`s3://${bucket}/(${KEY_TERMINATORS}+)`, "g");
 	const virtualHostedRe = new RegExp(`https://${bucket}\\.s3[^/\\s]*\\.${URL_SUFFIX_ALTERNATION}/(${KEY_TERMINATORS}+)`, "g");
 	const pathStyleRe = new RegExp(`https://s3[^/\\s]*\\.${URL_SUFFIX_ALTERNATION}/${bucket}/(${KEY_TERMINATORS}+)`, "g");
-	const ecrRe = new RegExp(`${ECR_REGISTRY_HOST}/${repo}(?::([A-Za-z0-9_][A-Za-z0-9._-]{0,127}))?(?:@(sha256:[0-9a-f]{64}))?`, "g");
+	const ecrRe = new RegExp(`${ECR_REGISTRY_HOST}/${repo}(?::([A-Za-z0-9_][A-Za-z0-9._-]{0,127}))?(?:@(sha256:[0-9a-f]{64}))?`, "gi");
 	const extractOnce = (value, refs) => {
 		for (const re of [
 			s3UriRe,
@@ -65234,7 +66349,7 @@ function buildReferenceExtractors(marker) {
 		]) for (const match of value.matchAll(re)) if (match[1]) refs.s3Keys.add(match[1]);
 		for (const match of value.matchAll(ecrRe)) {
 			if (match[1]) refs.imageTags.add(match[1]);
-			if (match[2]) refs.imageDigests.add(match[2]);
+			if (match[2]) refs.imageDigests.add(match[2].toLowerCase());
 		}
 		for (const match of value.matchAll(CONTENT_HASH_KEY_RE)) refs.s3Keys.add(match[0]);
 	};
@@ -68441,183 +69556,6 @@ function notFoundError$1(target, stack, resources) {
 	return new LocalInvokeResolutionError(msg.trimEnd());
 }
 
-//#endregion
-//#region src/utils/ecr-uri.ts
-/**
-* Matching the HOST half of an ECR image URI:
-* `<acct>.dkr.ecr.<region>.<urlSuffix>/`.
-*
-* The suffix is CAPTURED rather than spelled out (issue #1758): the previous
-* pattern hardcoded `amazonaws.com` with an optional `.cn` tail, so a `us-iso*`
-* registry (`c2s.ic.gov` / `sc2s.sgov.gov`) never matched and the caller
-* silently classified a real ECR image as a user-managed one — skipping the
-* `docker login` it needs.
-*
-* KNOWN BOUND (issue #1792): the `dkr.ecr` LABELS are still matched
-* case-sensitively, so `<acct>.DKR.ECR.<region>.<suffix>/` does not match at
-* all. Audited deliberately while fixing issue #1786 rather than missed — that
-* issue's normalization covers the captured region + suffix, i.e. the strict
-* CHECK, whereas widening the shape MATCHER makes cdkd `docker login` to a
-* host shape it previously skipped, which is a behavior expansion wanting its
-* own decision. The failure direction here is the safe one: NO credentials are
-* sent on any of the four call sites. Traced — `local run-task` and
-* `local invoke-agentcore` fall through to an anonymous `docker pull` that
-* fails, while `local invoke` and `local start-api` REFUSE before any pull.
-*/
-const ECR_URI_HOST_REGEX = /^(\d{12})\.dkr\.ecr\.([^.]+)\.([^/]+)\//;
-/**
-* A region segment cdkd is willing to treat as a region id.
-*
-* Case is not the only way the `startsWith` partition classification can be
-* side-stepped: any leading junk defeats it the same way, and the captured
-* segment does not stay inert — it becomes an `ECRClient({region})` and is
-* interpolated into the fallback `docker login` endpoint. Measured before this
-* guard: `…dkr.ecr. us-iso-east-1.amazonaws.com/…` (leading space) and a
-* combining-mark form both parsed, yielding regions `" us-iso-east-1"` and
-* `"us-i̇so-east-1"`. Neither leaks credentials — an ACCEPTED suffix is always
-* an AWS-owned domain — but a region id is ASCII alphanumeric plus `-`, so
-* anything else is a malformed host and refusing it keeps the classification
-* honest.
-*
-* TESTED AGAINST THE RAW SEGMENT, BEFORE `toLowerCase()`, and that order is the
-* whole point: `String.prototype.toLowerCase` performs full Unicode case
-* folding, so the Kelvin sign U+212A folds to a plain ASCII `k`. Checking the
-* FOLDED segment therefore accepts `us-eKst-1` and yields the region
-* `us-ekst-1` — a region the host does not name — which is precisely the
-* class of substitution this guard exists to refuse. Matching `[A-Za-z0-9-]`
-* on the raw capture keeps case-insensitivity (the point of issue #1786) while
-* admitting only characters that fold to themselves.
-*
-* ONE DELIBERATE SIDE EFFECT, called out because it is a withdrawal rather than
-* an addition: a malformed-region host is now classified as an ordinary public
-* image with NO cdkd-side signal at all — neither the ECR verdict nor the #1764
-* foreign-suffix diagnostic. Both arms change, not just the foreign one:
-* `<acct>.dkr.ecr.us_east_1.example.com/…` used to log the partition-gap
-* warning and now logs nothing, and `<acct>.dkr.ecr.us_east_1.amazonaws.com/…`
-* used to be ACCEPTED as ECR and is now refused. That is the correct verdict
-* rather than a regression — the diagnostic's whole subject is "this suffix does
-* not belong to its region's PARTITION", and a segment that is not a region id
-* has no partition to belong to, so reporting it would send the reader hunting
-* for a table entry that could never exist — but it does mean a typo'd region
-* gets no cdkd-side hint, only docker's own pull failure. Both arms are pinned
-* by tests so a future widening of the guard cannot flip them silently.
-*/
-const CANONICAL_REGION_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
-/**
-* A URL suffix cdkd is willing to compare against the partition table.
-*
-* The SAME raw-capture rule as the region, and for the same reason one layer
-* over: the suffix is folded before the comparison, so a code point folding
-* into ASCII can impersonate a partition's suffix. This became reachable the
-* moment issue #1764 landed `aws-isoe`'s `cloud.adc-e.uk` — that suffix
-* contains a `k`, so `…dkr.ecr.eu-isoe-west-1.cloud.adc-e.uK/…` (Kelvin
-* sign) folded onto it and was ACCEPTED. Not a credential leak, since UTS-46
-* maps U+212A to `k` too and the host resolves to the real AWS domain, but it
-* falsifies the invariant the region guard's comment above states, so both
-* captures are held to the same rule rather than only the one that was
-* measured first.
-*
-* Dots are admitted because a suffix is a dotted DNS name; every other
-* character is refused, so the accepted set stays exactly the partition
-* table's own literals.
-*/
-const CANONICAL_URL_SUFFIX = /^[A-Za-z0-9][A-Za-z0-9.-]*$/;
-/**
-* The ONE case-normalization boundary of this module (issue #1786).
-*
-* DNS is case-INSENSITIVE, so `US-ISO-EAST-1.amazonaws.com` and
-* `us-iso-east-1.amazonaws.com` name the same host — but both halves of the
-* #1758 suffix check were case-SENSITIVE, in OPPOSITE directions:
-*
-* - an upper-cased REGION fails every `startsWith` prefix test in
-*   `derivePartitionAndUrlSuffix`, so it falls through to the commercial
-*   partition whose suffix is `amazonaws.com` — which is exactly what an ISO
-*   look-alike host carries, so the strict check ACCEPTED it (the bypass);
-* - an upper-cased region or SUFFIX on a GENUINE host stopped matching its own
-*   partition's suffix, so a real ECR registry was REJECTED and the caller
-*   silently classified it as a user-managed image — the #1758 regression, one
-*   layer up.
-*
-* The normalization lives HERE rather than inside `derivePartitionAndUrlSuffix`
-* because this is the boundary where an untrusted, DNS-shaped string enters
-* cdkd, and keeping it in ONE function means both exported entry points below —
-* and the suffix COMPARISON itself — cannot drift apart.
-*
-* This does NOT duplicate `canonicalizeRegion`, which issue #1795 added inside
-* `derivePartitionAndUrlSuffix` so the mapping folds its own input. The two
-* answer different questions and both are needed: that one makes the partition
-* LOOKUP case-insensitive for every caller, while these guards decide whether
-* the captured segments are a region id and a URL suffix AT ALL. Folding alone
-* cannot do that — folding is precisely what turns `us-eKst-1` into the
-* plausible `us-ekst-1` (see the guards' own comments), so a fold-only helper
-* makes the substitution easier to reach, not harder. Double-folding is a
-* no-op, which is why the redundant `toLowerCase()` calls below are left in
-* rather than removed: they keep this function the single answer for the
-* comparison even if the helper's behaviour changes again.
-*
-* The derived suffix is lower-cased too. Every entry in the partition table is
-* a lower-case literal today, so that is a no-op; it is there so this function
-* stays the single answer even if that table ever gains a mixed-case entry.
-*/
-function matchEcrRegistryHost(imageUri) {
-	const m = ECR_URI_HOST_REGEX.exec(imageUri);
-	if (!m) return void 0;
-	if (!CANONICAL_REGION_SEGMENT.test(m[2])) return void 0;
-	if (!CANONICAL_URL_SUFFIX.test(m[3])) return void 0;
-	const region = m[2].toLowerCase();
-	return {
-		accountId: m[1],
-		region,
-		suffix: m[3].toLowerCase(),
-		expectedSuffix: derivePartitionAndUrlSuffix(region).urlSuffix.toLowerCase()
-	};
-}
-/**
-* The account + region of an ECR image URI, or `undefined` when the URI is not
-* an ECR registry host for the region it names.
-*
-* Lives in `src/utils/` rather than beside its first caller because it has TWO
-* consumers in different layers — `src/local/ecr-puller.ts` (which needs the
-* `:tag` tail too) and `src/local/ecs-task-resolver.ts` (which classifies an
-* image that may carry a digest or no tag at all). Before issue #1758 they each
-* carried their own copy of the hardcoded commercial pattern, and fixing only
-* the pull path left `cdkd local run-task` broken outside the commercial
-* partition; ONE definition is what stops them drifting apart again.
-*
-* The module is deliberately free of AWS SDK imports, which is what lets
-* `ecs-task-resolver.ts` consume it without breaking the invariant that module
-* documents about itself (it resolves secrets through a separate module for
-* exactly that reason).
-*
-* The returned `region` is LOWER-CASED (issue #1786) — it is consumed as an SDK
-* client region by `ecr-puller.ts` and as the `region` of a `kind: 'ecr'` image
-* by `ecs-task-resolver.ts`, and the canonical spelling of an AWS region id is
-* lower case.
-*/
-function parseEcrRegistryHost(imageUri) {
-	const m = matchEcrRegistryHost(imageUri);
-	if (!m) return void 0;
-	if (m.suffix !== m.expectedSuffix) return void 0;
-	return {
-		accountId: m.accountId,
-		region: m.region
-	};
-}
-/**
-* True when the URI has the ECR HOST SHAPE but its suffix does not belong to
-* the region it names — i.e. exactly the case {@link parseEcrRegistryHost}
-* rejects for a reason the caller may want to report.
-*
-* The two rejections are worth telling apart at a call site that degrades
-* silently: a genuinely public image and a registry in a partition
-* `derivePartitionAndUrlSuffix` does not know yet (issue #1764) both come back
-* `undefined`, and only the second is a cdkd gap rather than a user choice.
-*/
-function looksLikeEcrHostWithForeignSuffix(imageUri) {
-	const m = matchEcrRegistryHost(imageUri);
-	return m !== void 0 && m.suffix !== m.expectedSuffix;
-}
-
 //#endregion
 //#region src/local/ecs-task-resolver.ts
 function detectEcsImageResolutionNeeds(stack) {
@@ -77320,7 +78258,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.9");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.11");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;