@go-to-k/cdkd 0.290.14 → 0.290.16

package/dist/{program-DD0X9qLM.js → program-U03H43s7.js}

@@ -1,8 +1,8 @@
-import { $ as secretBearing, $n as BOOTSTRAP_MARKER_PREFIX, $r as getAwsClients, $t as s3BucketRegionalDomainName, A as extractDeploymentEventError, Ai as markNonRetryable, An as buildForceUnlockCommand, Ar as resolveAutoAssetStorage, At as parameterTypeMayLoseSecretIdentity, B as toCfnInteger, Bn as importableOutputs, Br as MIGRATE_TMP_PREFIX, Bt as configIntegerRefusal, C as buildFinalSnapshotIdentifier, Cn as recordMaskOnlyValue, Cr as AssetManifestLoader, Ct as IntrinsicFunctionResolver, D as refusesFinalSnapshot, Di as isRetryableTransientError, Dn as LockManager, Dr as getDefaultStateBucketName, Dt as getAccountInfo, E as isFinalSnapshotError, Ei as isMarkedNonRetryable, En as scrubResourceRecord, Er as synthesisStatusMessage, Et as coerceParameterTypedValue, F as isStatefulRecreateTargetSync, Fn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Fr as resolveUseCdkBootstrapAssets, Ft as resolveExplicitPhysicalId, G as gray, Gn as AssetPublisher, Gr as PARTITION_TABLE, Gt as requireConfigObject, H as formatResourceLine, Hn as orphansAfterRollback, Hr as uploadCfnTemplate, Ht as readConfigString, I as renderStatefulReason, In as DEFAULT_STATE_PREFIX, Ir as stateBucketExistenceConfirmed, It as assertRegionMatch, J as yellow, Jn as buildAssetRedirectMap, Jr as AssemblyReader, Jt as producerRegionsFromState, K as green, Kn as stringifyValue, Kr as canonicalizeRegion, Kt as requireConfigString, L as WARM_THROUGHPUT_MEMBERS, Ln as exportNamesCarriedFrom, Lr as warnDeprecatedNoPrefixCliFlag, Lt as coerceCfnBoolean, M as planOrphanAdoption, Mi as retryClassificationText, Mn as forceQuitRecoveryClause, Mr as resolveSkipPrefix, Mt as isSettledInstanceState, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as formatLockExpiry, Nr as resolveStateBucketWithDefault, Nt as WAFv2WebACLProvider, O as unsupportedFinalSnapshotError, Oi as isThrottlingError, On as S3StateBackend, Or as getLegacyStateBucketName, Ot as isImpossibleEmptyStoredAttribute, P as isStatefulRecreateTargetForReplace, Pn as shellQuote, Pr as resolveStateBucketWithDefaultAndSource, Pt as normalizeAwsTagsToCfn, Q as isExportAliasCollision, Qn as AssetModeResolver, Qr as AwsClients, Qt as s3BucketDualStackDomainName, R as coerceWarmThroughput$1, Rn as hasReadableExportSet, Rr as CFN_TEMPLATE_BODY_LIMIT, Rt as coerceCfnInteger, S as PRE_DELETE_SNAPSHOT_TYPES, Sn as maskSecretsInText, Sr as stripControlChars, St as isTerminationProtectionPropagationError, T as createPreDeleteFinalSnapshot, Ti as withErrorHandling, Tn as redactSecretsForState, Tr as Synthesizer, Tt as cfnRefValueFromPhysicalId, U as bold, Un as orphansCarriedFrom, Ur as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Ut as replayWarn, V as toFiniteNumber, Vn as isReadableBag, Vr as findLargeInlineResources, Vt as configStringRefusal, W as cyan, Wn as shouldRetainResource, Wr as expectedOwnerParam, Wt as requireConfigArray, X as collectPublishedOutputNames, Xn as loadPublishableAssetManifest, Xt as s3BucketArn, Y as collectDeclaredOutputNames, Yn as createAssetRedirectResolver, Yr as processStackMessages, Yt as withSharedDrainBudget, Z as exportAliasCollisionScrubWarning, Zn as rewriteTemplateAssetReferences, Zr as resolveBucketRegion, Zt as s3BucketDomainName, _ as isSecretBearingReferenceString, _i as ResourceUpdateNotSupportedError, _n as errorCauseChain, _r as partitionSensitiveEnv, _t as slowCcOperationTimeoutMs, a as DeploymentEventsStore, ai as CrossAccountSecretRefusalError, an as findSilentDropProperties, ar as readBootstrapMarkerBody, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bn as markSameGenerationBag, br as runDockerStreaming, bt as deleteSkipReason, c as replayFailedOperations, ci as DynamicReferenceRegionAmbiguousError, cn as DagBuilder, cr as buildDenyExternalAccessPolicy, ct as createMaskedRetryLogger, d as updatePartialReason, di as LocalStartServiceError, dn as STATE_SOURCED_CROSS_GENERATION_RULES, dr as describeDockerCapturedOutput, dt as beginCommandInterruptScope, ei as resetAwsClients, en as s3BucketWebsiteUrl, er as assertAssetBucketRegion, et as secretBearingStateKeyWarning, f as withResourceDeadline, fn as STATE_SOURCED_READBACK_RULES, fr as describeDockerExecFailure, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as ResourceTimeoutError, gn as dynamicReferenceTokens, gr as getDockerCmd, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as ProvisioningError, hn as createSecretMasker, hr as formatDockerLoginError, ht as startInterruptWatch, i as DeploymentEventsReader, in as findActionableSilentDrops, ir as parseBootstrapMarker, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as markRedactedCause, jn as buildLockContentionMessage, jr as resolveCaptureObservedState, jt as refStateLookupFromResource, k as makeCanonicalizePropertiesFn, ki as isTransientServerError, kn as rebuildClientForBucketRegion, kr as resolveApp, kt as isUnboundTemplateParameter, l as replayRollback, li as IntrinsicResolutionRefusalError, ln as TemplateParser, lr as describeAwsFailure, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as PartialFailureError, mn as carriesSecretMask, mr as dockerSpawnEnvWithSensitive, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as DiffCalculator, nr as getBootstrapMarkerKey, nt as getCurrentResourceSecrets, o as planFailedOps, on as describeTypeWithThrottleRetry, or as validateAssetBucketName, ot as ProviderRegistry, p as maskingRetryLogger, pi as NestedStackChildDirectDestroyError, pn as TEMPLATE_SOURCED_RULES, pr as describeDockerFailure, pt as interruptWatchListenerCount, q as red, qn as WorkGraph, qr as derivePartitionAndUrlSuffix, qt as classifyReplaySecretRegion, r as DeployEngine, ri as CdkdError, rn as INTRINSIC_KEYS, rr as isCrossRegionRedirect, rt as IAMRoleProvider, s as planRollback, si as DeployCancelledError, sn as withRetry, sr as validateContainerRepoName, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as setAwsClients, tn as applyRoleArnIfSet, tr as ensureAssetStorage, tt as secretSafeKeyDisplay, u as updatePartialMessage, ui as LocalInvokeBuildError$1, un as STATE_SOURCED_BASELINE_RULES, ur as buildDockerImage, ut as maskerOrIdentity, v as keptWholeReasonText, vi as StackHasActiveImportsError, vn as identityKeyFor, vr as redactDockerArgvValues, vt as UNSPECIFIED_SKIP_REASON, w as ccRoutedFinalSnapshotError, wi as normalizeAwsError, wn as recoverMaskedOutput, wr as getDockerImageBySourceHash, wt as carriesDynamicReference, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xn as maskSecretsInError, xr as escapeRegExp, xt as disableInstanceApiTermination, y as mergeNoChangeOutputs, yi as StackTerminationProtectionError, yn as isSingleDynamicReferenceToken, yr as runDockerForeground, yt as deleteIndeterminateGuards, z as isWarmThroughputDecrease, zn as importableOutputKeys, zr as CFN_TEMPLATE_URL_LIMIT, zt as configBooleanRefusal } from "./deploy-engine-v7h1H_Ac.js";
+import { $ as secretBearing, $n as BOOTSTRAP_MARKER_PREFIX, $r as getAwsClients, $t as s3BucketRegionalDomainName, A as extractDeploymentEventError, Ai as markNonRetryable, An as buildForceUnlockCommand, Ar as resolveAutoAssetStorage, At as parameterTypeMayLoseSecretIdentity, B as toCfnInteger, Bn as importableOutputs, Br as MIGRATE_TMP_PREFIX, Bt as configIntegerRefusal, C as buildFinalSnapshotIdentifier, Cn as recordMaskOnlyValue, Cr as AssetManifestLoader, Ct as IntrinsicFunctionResolver, D as refusesFinalSnapshot, Di as isRetryableTransientError, Dn as LockManager, Dr as getDefaultStateBucketName, Dt as getAccountInfo, E as isFinalSnapshotError, Ei as isMarkedNonRetryable, En as scrubResourceRecord, Er as synthesisStatusMessage, Et as coerceParameterTypedValue, F as isStatefulRecreateTargetSync, Fn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Fr as resolveUseCdkBootstrapAssets, Ft as resolveExplicitPhysicalId, G as gray, Gn as AssetPublisher, Gr as PARTITION_TABLE, Gt as requireConfigObject, H as formatResourceLine, Hn as orphansAfterRollback, Hr as uploadCfnTemplate, Ht as readConfigString, I as renderStatefulReason, In as DEFAULT_STATE_PREFIX, Ir as stateBucketExistenceConfirmed, It as assertRegionMatch, J as yellow, Jn as buildAssetRedirectMap, Jr as AssemblyReader, Jt as producerRegionsFromState, K as green, Kn as stringifyValue, Kr as canonicalizeRegion, Kt as requireConfigString, L as WARM_THROUGHPUT_MEMBERS, Ln as exportNamesCarriedFrom, Lr as warnDeprecatedNoPrefixCliFlag, Lt as coerceCfnBoolean, M as planOrphanAdoption, Mi as retryClassificationText, Mn as forceQuitRecoveryClause, Mr as resolveSkipPrefix, Mt as isSettledInstanceState, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as formatLockExpiry, Nr as resolveStateBucketWithDefault, Nt as WAFv2WebACLProvider, O as unsupportedFinalSnapshotError, Oi as isThrottlingError, On as S3StateBackend, Or as getLegacyStateBucketName, Ot as isImpossibleEmptyStoredAttribute, P as isStatefulRecreateTargetForReplace, Pn as shellQuote, Pr as resolveStateBucketWithDefaultAndSource, Pt as normalizeAwsTagsToCfn, Q as isExportAliasCollision, Qn as AssetModeResolver, Qr as AwsClients, Qt as s3BucketDualStackDomainName, R as coerceWarmThroughput$1, Rn as hasReadableExportSet, Rr as CFN_TEMPLATE_BODY_LIMIT, Rt as coerceCfnInteger, S as PRE_DELETE_SNAPSHOT_TYPES, Sn as maskSecretsInText, Sr as stripControlChars, St as isTerminationProtectionPropagationError, T as createPreDeleteFinalSnapshot, Ti as withErrorHandling, Tn as redactSecretsForState, Tr as Synthesizer, Tt as cfnRefValueFromPhysicalId, U as bold, Un as orphansCarriedFrom, Ur as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Ut as replayWarn, V as toFiniteNumber, Vn as isReadableBag, Vr as findLargeInlineResources, Vt as configStringRefusal, W as cyan, Wn as shouldRetainResource, Wr as expectedOwnerParam, Wt as requireConfigArray, X as collectPublishedOutputNames, Xn as loadPublishableAssetManifest, Xt as s3BucketArn, Y as collectDeclaredOutputNames, Yn as createAssetRedirectResolver, Yr as processStackMessages, Yt as withSharedDrainBudget, Z as exportAliasCollisionScrubWarning, Zn as rewriteTemplateAssetReferences, Zr as resolveBucketRegion, Zt as s3BucketDomainName, _ as isSecretBearingReferenceString, _i as ResourceUpdateNotSupportedError, _n as errorCauseChain, _r as partitionSensitiveEnv, _t as slowCcOperationTimeoutMs, a as DeploymentEventsStore, ai as CrossAccountSecretRefusalError, an as findSilentDropProperties, ar as readBootstrapMarkerBody, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bn as markSameGenerationBag, br as runDockerStreaming, bt as deleteSkipReason, c as replayFailedOperations, ci as DynamicReferenceRegionAmbiguousError, cn as DagBuilder, cr as buildDenyExternalAccessPolicy, ct as createMaskedRetryLogger, d as updatePartialReason, di as LocalStartServiceError, dn as STATE_SOURCED_CROSS_GENERATION_RULES, dr as describeDockerCapturedOutput, dt as beginCommandInterruptScope, ei as resetAwsClients, en as s3BucketWebsiteUrl, er as assertAssetBucketRegion, et as secretBearingStateKeyWarning, f as withResourceDeadline, fn as STATE_SOURCED_READBACK_RULES, fr as describeDockerExecFailure, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as ResourceTimeoutError, gn as dynamicReferenceTokens, gr as getDockerCmd, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as ProvisioningError, hn as createSecretMasker, hr as formatDockerLoginError, ht as startInterruptWatch, i as DeploymentEventsReader, in as findActionableSilentDrops, ir as parseBootstrapMarker, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as markRedactedCause, jn as buildLockContentionMessage, jr as resolveCaptureObservedState, jt as refStateLookupFromResource, k as makeCanonicalizePropertiesFn, ki as isTransientServerError, kn as rebuildClientForBucketRegion, kr as resolveApp, kt as isUnboundTemplateParameter, l as replayRollback, li as IntrinsicResolutionRefusalError, ln as TemplateParser, lr as describeAwsFailure, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as PartialFailureError, mn as carriesSecretMask, mr as dockerSpawnEnvWithSensitive, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as DiffCalculator, nr as getBootstrapMarkerKey, nt as getCurrentResourceSecrets, o as planFailedOps, on as describeTypeWithThrottleRetry, or as validateAssetBucketName, ot as ProviderRegistry, p as maskingRetryLogger, pi as NestedStackChildDirectDestroyError, pn as TEMPLATE_SOURCED_RULES, pr as describeDockerFailure, pt as interruptWatchListenerCount, q as red, qn as WorkGraph, qr as derivePartitionAndUrlSuffix, qt as classifyReplaySecretRegion, r as DeployEngine, ri as CdkdError, rn as INTRINSIC_KEYS, rr as isCrossRegionRedirect, rt as IAMRoleProvider, s as planRollback, si as DeployCancelledError, sn as withRetry, sr as validateContainerRepoName, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as setAwsClients, tn as applyRoleArnIfSet, tr as ensureAssetStorage, tt as secretSafeKeyDisplay, u as updatePartialMessage, ui as LocalInvokeBuildError$1, un as STATE_SOURCED_BASELINE_RULES, ur as buildDockerImage, ut as maskerOrIdentity, v as keptWholeReasonText, vi as StackHasActiveImportsError, vn as identityKeyFor, vr as redactDockerArgvValues, vt as UNSPECIFIED_SKIP_REASON, w as ccRoutedFinalSnapshotError, wi as normalizeAwsError, wn as recoverMaskedOutput, wr as getDockerImageBySourceHash, wt as carriesDynamicReference, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xn as maskSecretsInError, xr as escapeRegExp, xt as disableInstanceApiTermination, y as mergeNoChangeOutputs, yi as StackTerminationProtectionError, yn as isSingleDynamicReferenceToken, yr as runDockerForeground, yt as deleteIndeterminateGuards, z as isWarmThroughputDecrease, zn as importableOutputKeys, zr as CFN_TEMPLATE_URL_LIMIT, zt as configBooleanRefusal } from "./deploy-engine-B91NMqm1.js";
 import { C as displaySafe, S as displayIdent, _ as withSkipPrefix, b as STACK_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE } from "./logger-C17H06QA.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CqnAWzcc.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BAYjqZuM.js";
+import { t as getCdkdVersion } from "./version-1FTpsWNc.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CvkcE8rH.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7079,6 +7079,46 @@ function isTruthyCfnBoolean(value) {
 //#endregion
 //#region src/provisioning/providers/s3-bucket-provider.ts
 /**
+* The "remove this bucket by hand" clause both partial-create cleanup arms end
+* with, rendered through the shared sanitize / shell-quote / SUPPRESS
+* (`renderDisableCommand`, the issue
+* [#2669](https://github.com/go-to-k/cdkd/issues/2669) shape; adopted here by
+* issue [#3136](https://github.com/go-to-k/cdkd/issues/3136)).
+*
+* `bucketName` is TEMPLATE-chosen — `Properties.BucketName`, or the name cdkd
+* generated for the resource — and until now both arms hand-quoted it as
+* `--bucket '<name>'`, so a `'` in the value broke out of the quoting and a
+* control byte forged lines on the operator's terminal. (A WARN, so that is
+* its whole reach — the recorder persists a thrown `error.message`, not this.)
+* When sanitizing CHANGES the name the whole command is
+* SUPPRESSED rather than shown with the sanitized value, because such a command
+* would delete a DIFFERENT bucket — the wrong-target harm the shared renderer
+* exists to prevent, and the reason emitting no command is the honest answer
+* rather than a fallback.
+*
+* ONE clause for both arms so the two cannot come to render the same value
+* differently. The prose `(${bucketName})` each arm carries BESIDE it is still
+* interpolated as-is: this clause takes only the pasteable half, and
+* display-sanitizing the PROSE of provider warnings is tracked as issue
+* [#3269](https://github.com/go-to-k/cdkd/issues/3269) (#3136 covers the
+* COMMAND half across providers, not prose).
+*
+* `maskSecrets` is REQUIRED rather than optional, and both call sites build it
+* from `context?.maskSecrets` (security review of #3136, which found these two
+* arms reaching no masker at all). It does two things: the arms now route
+* their whole warning through it, and it makes `renderDisableCommand` SUPPRESS
+* the command for a secret-bearing bucket name — which a message-level mask
+* could not catch once `shellQuote` has escaped an inner quote.
+*/
+function manualBucketDeletionClause(bucketName, maskSecrets) {
+	const command = renderDisableCommand({
+		before: "aws s3api delete-bucket --bucket",
+		identifier: bucketName,
+		maskSecrets
+	});
+	return command ? `Manual deletion may be required before the next deploy: ${command}` : "Manual deletion may be required before the next deploy, via the console: the bucket name cannot be reproduced safely on a command line, so any command shown here would act on a different bucket.";
+}
+/**
 * A plain (non-array) object. `typeof x === 'object'` alone accepts arrays and
 * `null`; a `Transition: []` or an unresolved intrinsic pushed through as a
 * single transition entry makes S3 answer `MalformedXML` for the WHOLE
@@ -10440,11 +10480,13 @@ var S3BucketProvider = class S3BucketProvider {
 					this.logger.debug(`Cleaned up partially-created S3 bucket ${logicalId} (${bucketName}) after wiring failure`);
 				} catch (cleanupError) {
 					this.logger.debug(`DeleteBucket cleanup failed for S3 bucket ${logicalId} (${bucketName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
-					this.logger.warn(`Failed to clean up partially-created S3 bucket ${logicalId} (${bucketName}) (${cleanupError instanceof Error ? cleanupError.name : typeof cleanupError}). Re-run with --verbose for AWS's own message. Manual deletion may be required before the next deploy: aws s3api delete-bucket --bucket '${bucketName}'`);
+					const maskSecrets = maskerOrIdentity(context?.maskSecrets);
+					this.logger.warn(maskSecrets(`Failed to clean up partially-created S3 bucket ${logicalId} (${bucketName}) (${cleanupError instanceof Error ? cleanupError.name : typeof cleanupError}). Re-run with --verbose for AWS's own message. ` + manualBucketDeletionClause(bucketName, maskSecrets)));
 				}
 				else if (preflight.kind === "indeterminate") {
 					this.logger.debug(`GetBucketLocation failed for S3 bucket ${bucketName} (${logicalId}) during create: ${preflight.reason}`);
-					this.logger.warn(`Not cleaning up S3 bucket ${logicalId} (${bucketName}) after a wiring failure: this deploy could not confirm whether it created the bucket (region probe failed: ${preflight.errorName}), and in us-east-1 a successful CreateBucket does not prove it. Re-run with --verbose for AWS's own message. If cdkd created it, delete it manually before the next deploy: aws s3api delete-bucket --bucket '${bucketName}'`);
+					const maskSecrets = maskerOrIdentity(context?.maskSecrets);
+					this.logger.warn(maskSecrets(`Not cleaning up S3 bucket ${logicalId} (${bucketName}) after a wiring failure: this deploy could not confirm whether it created the bucket (region probe failed: ${preflight.errorName}), and in us-east-1 a successful CreateBucket does not prove it. Re-run with --verbose for AWS's own message. If cdkd created it, the bucket is an orphan. ` + manualBucketDeletionClause(bucketName, maskSecrets)));
 				}
 				throw innerError;
 			}
@@ -17881,16 +17923,39 @@ function mapSSESpecification(raw) {
 * the index to the same warn-and-omit path an absent block takes, letting AWS
 * name it — the CFn-handler outcome.
 *
-* CFn is stringly typed, so a numeric string is accepted and coerced; `NaN` /
-* `Infinity` / objects / unresolved intrinsics are not.
+* CFn is stringly typed, so a numeric string is accepted and coerced — through
+* {@link coerceCfnInteger}, CloudFormation's MEASURED DynamoDB Integer grammar
+* (issue [#3147](https://github.com/go-to-k/cdkd/issues/3147); the table is on
+* `toCfnInteger` in `../dynamodb-warm-throughput.ts`): an optional sign and
+* decimal digits, with NO trim, so `" 7 "` / `"7 "` / `""` / `"0x9"` / `"1e1"`
+* / `"6.5"` are every one `undefined` here because CloudFormation refuses the
+* template that spells them. The pre-#3147 reader was `Number()`, which
+* forwarded `7` / `9` / `10` for the first four and deployed an index at a
+* capacity CloudFormation would not have accepted. `NaN` / `Infinity` / a
+* non-integer number / objects / unresolved intrinsics were never usable and
+* still are not.
 */
 function readCapacityNumber(block, member) {
-	if (typeof block !== "object" || block === null || Array.isArray(block)) return void 0;
-	const raw = block[member];
-	if (raw === void 0 || raw === null || raw === "") return void 0;
-	if (typeof raw !== "number" && typeof raw !== "string") return void 0;
-	const value = Number(raw);
-	return Number.isFinite(value) ? value : void 0;
+	if (!isPlainCapacityBlock(block)) return void 0;
+	return coerceCfnInteger(block[member]);
+}
+/**
+* Is this a `ProvisionedThroughput` block whose MEMBERS can be read at all?
+*
+* One spelling, shared by {@link readCapacityNumber} — where a `false` answer
+* means "no usable member" — and by
+* {@link DynamoDBTableProvider.coerceIndexCapacityBlock}, where it means
+* "forward this VERBATIM and let AWS name the shape" (issue
+* [#3255](https://github.com/go-to-k/cdkd/issues/3255)). The two conclusions
+* differ; the shape test must not, or the create forwarder could rewrite a
+* block the flip's reader refuses to read (or vice versa).
+*
+* An ARRAY is excluded deliberately: `[]` indexes to `undefined` for both
+* members, so treating it as a block would DROP nothing and report nothing
+* while `CreateTable` rejects the list by name anyway.
+*/
+function isPlainCapacityBlock(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
 * Whether a desired `GlobalSecondaryIndexes[]` entry declares BOTH capacity
@@ -17901,19 +17966,51 @@ function readCapacityNumber(block, member) {
 * BOTH members are required, exactly as in the flip block: an entry declaring
 * only one is treated like an absent one there, so accepting it here would let
 * the pre-flip delete run ahead of a flip AWS still rejects.
+*
+* A MIRROR, so it calls {@link readCapacityNumber} — the function the flip's
+* per-index forwarder calls — rather than restating the rule. That is what kept
+* it correct across issue [#3147](https://github.com/go-to-k/cdkd/issues/3147):
+* the reader moved to CloudFormation's Integer grammar and this predicate moved
+* with it, so a padded `" 7 "` is "no usable declared capacity" here exactly
+* because the forwarder drops it there.
 */
 function hasUsableDeclaredCapacity(entry) {
 	const declared = entry?.["ProvisionedThroughput"];
 	return readCapacityNumber(declared, "ReadCapacityUnits") !== void 0 && readCapacityNumber(declared, "WriteCapacityUnits") !== void 0;
 }
 /**
+* The two `ProvisionedThroughput` members, in the order the forwarders build
+* them. Named once so {@link hasUsableTableCapacity}, {@link tableCapacityForSend}
+* and the per-INDEX create forwarder
+* ({@link DynamoDBTableProvider.coerceIndexCapacityBlock}) cannot come to
+* disagree about the membership.
+*
+* Deliberately NOT `TABLE_CAPACITY_MEMBERS` any more (issue
+* [#3255](https://github.com/go-to-k/cdkd/issues/3255)): CloudFormation's
+* `ProvisionedThroughput` block has the same two members at the TABLE level and
+* inside every `GlobalSecondaryIndexes[]` entry, and a second list for the
+* per-index reader would be exactly the drift this constant exists to prevent.
+* What differs between the two levels is what an ABSENT member does — the table
+* level substitutes {@link DEFAULT_TABLE_CAPACITY_UNITS}, the per-index level
+* deliberately has no default ({@link readCapacityNumber}) — and that is a
+* property of each forwarder, not of the membership.
+*/
+const PROVISIONED_CAPACITY_MEMBERS = ["ReadCapacityUnits", "WriteCapacityUnits"];
+/**
+* The capacity both TABLE-level forwarders substitute for a member the
+* template does not declare at all — `create()`'s `CreateTable` and the
+* BillingMode flip's `UpdateTable`. It is the pre-issue-#3147 `?? 5`, kept
+* BYTE-identical in behaviour for the absent case; what changed is only what a
+* DECLARED-but-unusable member does.
+*/
+const DEFAULT_TABLE_CAPACITY_UNITS = 5;
+/**
 * Whether the desired TABLE-level `ProvisionedThroughput` is one the flip can
 * actually send (issue #1617 PR review).
 *
 * Deliberately NOT {@link hasUsableDeclaredCapacity}: the flip defaults each
-* member to 5 when absent (`Number(pt['ReadCapacityUnits'] ?? 5)`), so a
-* half-declared TABLE capacity is sendable while a half-declared per-INDEX one
-* is not.
+* ABSENT member to 5 ({@link tableCapacityForSend}), so a half-declared TABLE
+* capacity is sendable while a half-declared per-INDEX one is not.
 *
 * It mirrors the flip's GATE as well as its arithmetic, which the first version
 * did not and a second review round caught — both halves of that miss are real:
@@ -17921,23 +18018,78 @@ function hasUsableDeclaredCapacity(entry) {
 * - the gate is plain TRUTHINESS (`properties['ProvisionedThroughput']`), so a
 *   non-object truthy value sends `{5, 5}` and SUCCEEDS. Requiring a plain
 *   object refused it and skipped a removal that would have been fine.
-* - a DECLARED member that coerces to `0` (`''`, `false`, `[]`) is finite, so
-*   an arithmetic-only check accepted it — while AWS rejects a capacity below
-*   1, which is precisely the deterministic rejection this predicate exists to
-*   keep a delete from running ahead of.
+* - a DECLARED member that coerces to `0` (`0`, `'0'`) is a capacity AWS
+*   rejects (below 1), which is precisely the deterministic rejection this
+*   predicate exists to keep a delete from running ahead of.
+*
+* It reads through {@link tableCapacityForSend}'s OWN reader since issue
+* [#3147](https://github.com/go-to-k/cdkd/issues/3147) — `coerceCfnInteger`,
+* plus the `< 1` rule AWS adds on top of the grammar — so the two cannot
+* answer differently. On the pre-#3147 `Number()` reader they DID, in both
+* directions: a padded `" 7 "` counted as usable here while the forwarder now
+* drops it, and a DECLARED `null` counted as UNUSABLE here while the
+* forwarder's `?? 5` sent 5 and AWS accepted the flip — so this predicate
+* refused a pre-flip removal on a flip that would have succeeded, warning that
+* "AWS rejects the flip either way" when it does not. `null` therefore takes
+* the ABSENT arm here, exactly as it does at the forwarder; `''` / `false` /
+* `[]`, which `Number()` read as **0**, are now dropped-and-named by the
+* forwarder, so they make the flip fail and stay UNUSABLE here.
 */
 function hasUsableTableCapacity(value) {
 	if (!value) return false;
 	if (typeof value !== "object" || Array.isArray(value)) return true;
 	const pt = value;
-	for (const member of ["ReadCapacityUnits", "WriteCapacityUnits"]) {
-		if (pt[member] === void 0) continue;
-		const n = Number(pt[member]);
-		if (!Number.isFinite(n) || n < 1) return false;
+	for (const member of PROVISIONED_CAPACITY_MEMBERS) {
+		const raw = pt[member];
+		if (raw === void 0 || raw === null) continue;
+		const n = coerceCfnInteger(raw);
+		if (n === void 0 || n < 1) return false;
 	}
 	return true;
 }
 /**
+* Read one TABLE-level `ProvisionedThroughput` member for the wire (issue
+* [#3147](https://github.com/go-to-k/cdkd/issues/3147)).
+*
+* THREE answers, where the pre-#3147 `Number(pt[member] ?? 5)` had two:
+*
+*  - ABSENT (`undefined` / `null`, matching `??`) -> the
+*    {@link DEFAULT_TABLE_CAPACITY_UNITS} default, silently, exactly as before.
+*  - a value {@link coerceCfnInteger} accepts -> that integer.
+*  - anything else -> `undefined`, i.e. the member is OMITTED from the request,
+*    and `onUnusable` announces it.
+*
+* The third answer is the decision this function exists for, and it is NOT the
+* announced-default one its `AWS::DynamoDB::GlobalTable` sibling takes. Two
+* reasons, both local to this type:
+*
+*  - **This file's own precedent for the table-level capacity is "let AWS
+*    reject it, by name".** A flip to PROVISIONED carrying NO
+*    `ProvisionedThroughput` at all is deliberately left to fail at AWS as CFn
+*    parity (see the comment at that gate), and the per-index arm below refuses
+*    to invent a capacity in even stronger terms. Substituting 5 for a
+*    DECLARED `" 7 "` would be the one place this type guesses.
+*  - **A substituted capacity is invisible afterwards.** State records the
+*    DESIRED bag, so a table created at 5 against a recorded `" 7 "` compares
+*    EQUAL on every later `cdkd diff`: the divergence never surfaces and the
+*    warning scrolls past once. Omitting the member fails the deploy with
+*    DynamoDB naming the member, which is also what CloudFormation does with
+*    this template (it refuses it at properties validation).
+*
+* `onUnusable` is called at most once per member and never for the absent case,
+* so an ordinary template is silent.
+*/
+function tableCapacityForSend(pt, member, onUnusable) {
+	const raw = pt?.[member];
+	if (raw === void 0 || raw === null) return DEFAULT_TABLE_CAPACITY_UNITS;
+	const coerced = coerceCfnInteger(raw);
+	if (coerced === void 0) {
+		onUnusable(member, raw);
+		return;
+	}
+	return coerced;
+}
+/**
 * Does the capacity AWS currently holds for a GSI already equal the pair the
 * template requests? (issue #1630)
 *
@@ -18294,7 +18446,7 @@ function reverseMapSecondaryIndex(live, desired, bagInformative) {
 *    predicate EVERY per-index write path calls — the `Create` / `Update` GSI
 *    actions in `applyGsiUpdates` AND `create()`'s `CreateTable` forward, which
 *    maps each entry through
-*    {@link DynamoDBTableProvider.coerceIndexWarmThroughputForCreate}. It is
+*    {@link DynamoDBTableProvider.coerceIndexThroughputForCreate}. It is
 *    TIGHTER than truthiness (at least one member resolving to a finite
 *    number), so `WarmThroughput: {}` is neither sent nor emitted on any path.
 *    An earlier version of this bullet carved out the TABLE-create path as an
@@ -18303,9 +18455,15 @@ function reverseMapSecondaryIndex(live, desired, bagInformative) {
 *    template failed on a fresh create and succeeded on a later GSI add. Fixed
 *    in PR review round 6; the carve-out is gone because the divergence is.
 *  - `ProvisionedThroughput` / `OnDemandThroughput` keep TRUTHINESS, which is
-*    what their write path does: those two members ARE still forwarded verbatim
-*    (the create-path mapper rewrites only `WarmThroughput`), and
-*    `applyGsiUpdates` gates on `gsi.ProvisionedThroughput` alone. Widening
+*    still what their write path does: `applyGsiUpdates` gates on
+*    `gsi.ProvisionedThroughput` alone, `OnDemandThroughput` is forwarded
+*    verbatim on every path, and the `ProvisionedThroughput` coercion issue
+*    [#3255](https://github.com/go-to-k/cdkd/issues/3255) added to ALL FOUR
+*    per-index send sites (`create()`'s mapper plus `applyGsiUpdates`'
+*    adopted-repair, `Create` and same-name `Update` actions) never
+*    SUPPRESSES the block — it rewrites members inside a block that is sent
+*    either way, so "would cdkd send this block" is unchanged by it, even
+*    where both members were dropped and an empty block goes out. Widening
 *    `isSendableWarmThroughput` over them would be wrong twice over — it reads
 *    members those blocks do not have (`ReadUnitsPerSecond` vs
 *    `ReadCapacityUnits`), so every declared capacity would read as undeclared.
@@ -18497,9 +18655,10 @@ var DynamoDBTableProvider = class {
 			};
 			if (billingMode === "PROVISIONED") {
 				const pt = properties["ProvisionedThroughput"];
+				const onUnusable = (member, raw) => this.warnUnusableProvisionedCapacity(`AWS::DynamoDB::Table ${logicalId}`, member, raw, maskSecrets);
 				createParams.ProvisionedThroughput = {
-					ReadCapacityUnits: Number(pt?.["ReadCapacityUnits"] ?? 5),
-					WriteCapacityUnits: Number(pt?.["WriteCapacityUnits"] ?? 5)
+					ReadCapacityUnits: tableCapacityForSend(pt, "ReadCapacityUnits", onUnusable),
+					WriteCapacityUnits: tableCapacityForSend(pt, "WriteCapacityUnits", onUnusable)
 				};
 			}
 			if (properties["OnDemandThroughput"]) createParams.OnDemandThroughput = properties["OnDemandThroughput"];
@@ -18512,7 +18671,7 @@ var DynamoDBTableProvider = class {
 			};
 			if (properties["GlobalSecondaryIndexes"]) {
 				const declaredGsis = properties["GlobalSecondaryIndexes"];
-				createParams.GlobalSecondaryIndexes = Array.isArray(declaredGsis) ? declaredGsis.map((entry) => this.coerceIndexWarmThroughputForCreate(logicalId, entry, maskSecrets)) : declaredGsis;
+				createParams.GlobalSecondaryIndexes = Array.isArray(declaredGsis) ? declaredGsis.map((entry) => this.coerceIndexThroughputForCreate(logicalId, entry, maskSecrets)) : declaredGsis;
 			}
 			if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
 			const sse = mapSSESpecification(properties["SSESpecification"]);
@@ -18526,7 +18685,7 @@ var DynamoDBTableProvider = class {
 			tableCreated = true;
 			this.logger.debug(`CreateTable initiated for ${tableName}, waiting for ACTIVE status`);
 			const tableInfo = await this.waitForTableActive(tableName);
-			await this.applyPointInTimeRecovery(tableName, properties["PointInTimeRecoverySpecification"]);
+			await this.applyPointInTimeRecovery(tableName, properties["PointInTimeRecoverySpecification"], void 0, maskSecrets);
 			await this.applyTimeToLive(tableName, properties["TimeToLiveSpecification"]);
 			await this.applyKinesisStreamingDestination(tableName, properties["KinesisStreamSpecification"], void 0, maskSecrets);
 			await this.applyContributorInsights(tableName, properties["ContributorInsightsSpecification"]);
@@ -18630,9 +18789,10 @@ var DynamoDBTableProvider = class {
 				if (tableClassChanged) updateInput.TableClass = normalizeTableClass(properties["TableClass"]);
 				if (billingOrThroughputChanged && billingMode !== "PAY_PER_REQUEST" && properties["ProvisionedThroughput"]) {
 					const pt = properties["ProvisionedThroughput"];
+					const onUnusable = (member, raw) => this.warnUnusableProvisionedCapacity(`AWS::DynamoDB::Table ${logicalId}`, member, raw, maskSecrets);
 					updateInput.ProvisionedThroughput = {
-						ReadCapacityUnits: Number(pt["ReadCapacityUnits"] ?? 5),
-						WriteCapacityUnits: Number(pt["WriteCapacityUnits"] ?? 5)
+						ReadCapacityUnits: tableCapacityForSend(pt, "ReadCapacityUnits", onUnusable),
+						WriteCapacityUnits: tableCapacityForSend(pt, "WriteCapacityUnits", onUnusable)
 					};
 				}
 				const flipLiveIndexes = liveIndexes.filter((live) => typeof live.IndexName !== "string" || !preFlipDeletedIndexNames.has(live.IndexName));
@@ -18740,7 +18900,7 @@ var DynamoDBTableProvider = class {
 				}
 			}
 			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, maskSecrets);
-			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"]);
+			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"], maskSecrets);
 			if (JSON.stringify(properties["TimeToLiveSpecification"]) !== JSON.stringify(previousProperties["TimeToLiveSpecification"])) {
 				this.assertNoActiveTtlAttributeNameChange(logicalId, resourceType, physicalId, properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"]);
 				await this.applyTimeToLive(physicalId, properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"]);
@@ -18933,13 +19093,20 @@ var DynamoDBTableProvider = class {
 	* change", so a dropped block must be turned into an explicit
 	* `PointInTimeRecoveryEnabled: false`).
 	*/
-	async applyPointInTimeRecovery(tableName, spec, previousSpec) {
+	async applyPointInTimeRecovery(tableName, spec, previousSpec, maskSecrets = (text) => text) {
 		let enabled;
 		let recoveryPeriodInDays;
 		if (spec !== void 0 && spec !== null) {
 			const s = spec;
 			enabled = Boolean(s["PointInTimeRecoveryEnabled"]);
-			if (enabled && s["RecoveryPeriodInDays"] !== void 0) recoveryPeriodInDays = Number(s["RecoveryPeriodInDays"]);
+			if (enabled && s["RecoveryPeriodInDays"] !== void 0) {
+				const rawRecoveryPeriod = s["RecoveryPeriodInDays"];
+				recoveryPeriodInDays = coerceCfnInteger(rawRecoveryPeriod);
+				if (recoveryPeriodInDays === void 0) {
+					const warn = (message) => this.logger.warn(maskSecrets(message));
+					warn(`DynamoDB table ${tableName}: PointInTimeRecoverySpecification.RecoveryPeriodInDays ${JSON.stringify(maskLeafValue$1(rawRecoveryPeriod, maskSecrets))} is not an Integer CloudFormation accepts (an optional sign and decimal digits only — no surrounding whitespace, hex, exponent or decimal point), so it was DROPPED from the UpdateContinuousBackups request: point-in-time recovery is enabled with DynamoDB's default recovery period instead of the declared one. Check for an unresolved intrinsic, or spell the value as a decimal integer.`);
+				}
+			}
 		} else if (previousSpec !== void 0 && previousSpec !== null) enabled = false;
 		if (enabled === void 0) return;
 		const pitrSpec = { PointInTimeRecoveryEnabled: enabled };
@@ -19314,7 +19481,7 @@ var DynamoDBTableProvider = class {
 				const adopted = { IndexName: name };
 				let adoptedHasMember = false;
 				if (liveCapacityComparable && gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && !liveCapacityAlreadyMatches(live.ProvisionedThroughput, gsi.ProvisionedThroughput) && !this.skipZeroCapacityIndexUpdate(name, physicalId, gsi.ProvisionedThroughput, maskSecrets)) {
-					adopted.ProvisionedThroughput = gsi.ProvisionedThroughput;
+					adopted.ProvisionedThroughput = this.indexCapacityForSend(this.indexScopeAt(name, physicalId, maskSecrets), gsi.ProvisionedThroughput, maskSecrets);
 					adoptedHasMember = true;
 				}
 				const adoptedWarm = this.warmThroughputOpFor(name, physicalId, gsi, void 0, live, maskSecrets);
@@ -19326,13 +19493,13 @@ var DynamoDBTableProvider = class {
 				warn(`GSI ${maskSecrets(name)} was adopted from AWS rather than created, so cdkd could not verify its KeySchema / Projection match the template. Run \`cdkd drift ${physicalId}\` to confirm, and \`cdkd drift --accept\` if AWS is the source of truth.`);
 				continue;
 			}
-			this.warnRefusedWarmThroughput(`GSI ${maskSecrets(name)} on DynamoDB table ${physicalId}`, gsi.WarmThroughput, maskSecrets);
-			const createWarm = this.coerceWarmThroughputForSend(`GSI ${maskSecrets(name)} on DynamoDB table ${physicalId}`, gsi.WarmThroughput, maskSecrets);
+			this.warnRefusedWarmThroughput(this.indexScopeAt(name, physicalId, maskSecrets), gsi.WarmThroughput, maskSecrets);
+			const createWarm = this.coerceWarmThroughputForSend(this.indexScopeAt(name, physicalId, maskSecrets), gsi.WarmThroughput, maskSecrets);
 			ops.push({ Create: {
 				IndexName: name,
 				KeySchema: gsi.KeySchema,
 				Projection: gsi.Projection,
-				...gsi.ProvisionedThroughput ? { ProvisionedThroughput: gsi.ProvisionedThroughput } : {},
+				...gsi.ProvisionedThroughput ? { ProvisionedThroughput: this.indexCapacityForSend(this.indexScopeAt(name, physicalId, maskSecrets), gsi.ProvisionedThroughput, maskSecrets) } : {},
 				...gsi.OnDemandThroughput ? { OnDemandThroughput: gsi.OnDemandThroughput } : {},
 				...createWarm ? { WarmThroughput: createWarm } : {}
 			} });
@@ -19344,7 +19511,7 @@ var DynamoDBTableProvider = class {
 			if (gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && JSON.stringify(before.ProvisionedThroughput) !== JSON.stringify(gsi.ProvisionedThroughput)) {
 				if (liveCapacityComparable && liveCapacityAlreadyMatches(liveIndexByName?.get(name)?.ProvisionedThroughput, gsi.ProvisionedThroughput)) this.logger.debug(`GSI ${name} on DynamoDB table ${physicalId} already carries the requested capacity in AWS; skipping its throughput Update`);
 				else if (!this.skipZeroCapacityIndexUpdate(name, physicalId, gsi.ProvisionedThroughput, maskSecrets)) {
-					update.ProvisionedThroughput = gsi.ProvisionedThroughput;
+					update.ProvisionedThroughput = this.indexCapacityForSend(this.indexScopeAt(name, physicalId, maskSecrets), gsi.ProvisionedThroughput, maskSecrets);
 					updateHasMember = true;
 				}
 			}
@@ -19376,35 +19543,211 @@ var DynamoDBTableProvider = class {
 		return coerced.spec;
 	}
 	/**
-	* One `CreateTable` index entry with its `WarmThroughput` coerced (PR review
-	* round 6).
+	* `GSI <name> on AWS::DynamoDB::Table <logicalId>` — the scope every
+	* create-path per-index warning interpolates.
+	*
+	* The index NAME is a RESOLVED property value, so it is masked before it
+	* becomes part of a message (issue #1997). It is also an UNCHECKED cast off
+	* the template: `IndexName: 2024` (unquoted YAML) reaches here as a NUMBER,
+	* and the real masker is a `String.prototype.replace` call that THROWS on
+	* one — which would take the whole deploy down from a diagnostic path. So
+	* the type test is the guard, not merely `!== undefined`: anything that is
+	* not a string has no name to print and takes the `<unnamed>` arm, exactly
+	* as an absent one does. (Reached by the review of issue
+	* [#3255](https://github.com/go-to-k/cdkd/issues/3255): before it, the scope
+	* was built only for an entry declaring `WarmThroughput`, so the crash was
+	* unreachable for an ordinary PROVISIONED template.)
+	*/
+	indexScope(indexName, logicalId, maskSecrets) {
+		return `GSI ${typeof indexName === "string" ? maskSecrets(indexName) : "<unnamed>"} on AWS::DynamoDB::Table ${logicalId}`;
+	}
+	/**
+	* `GSI <name> on DynamoDB table <physicalId>` — {@link indexScope}'s twin for
+	* the UPDATE path, which names the LIVE table rather than the template's
+	* logical id.
+	*
+	* Same guard, same reason, and the reason is why this exists at all rather
+	* than the five call sites spelling `maskSecrets(name)` inline: `name` is a
+	* key of a map built from `g.IndexName!` off an UNCHECKED template cast, so
+	* `IndexName: 2024` (unquoted YAML) is truthy, becomes the key, and arrives
+	* here as a NUMBER — on which the real masker's `String.prototype.replace`
+	* THROWS. The create path was guarded when {@link indexScope} was added
+	* (the review of issue #3255); the update sites that now build a scope
+	* EAGERLY for the capacity coercion were not, which newly exposed the same
+	* crash on an ordinary PROVISIONED capacity update with a non-empty secret
+	* bag (found by the review of that round).
+	*/
+	indexScopeAt(indexName, physicalId, maskSecrets) {
+		return `GSI ${typeof indexName === "string" ? maskSecrets(indexName) : "<unnamed>"} on DynamoDB table ${physicalId}`;
+	}
+	/**
+	* The per-index `ProvisionedThroughput` an `UpdateTable` action should put on
+	* the wire (the review of issue
+	* [#3255](https://github.com/go-to-k/cdkd/issues/3255)).
+	*
+	* Exists because coercing only `create()`'s forward left the file
+	* INTERNALLY divergent in the direction the issue is about: the same index
+	* entry succeeded on a fresh create and was rejected by AWS when added by a
+	* later update, which is the `WarmThroughput` round-6 story with the
+	* polarity flipped. All three `applyGsiUpdates` send sites — the adopted
+	* index's repair `Update`, the `Create` action and the same-name `Update`
+	* action — now read through {@link coerceIndexCapacityBlock}, the same
+	* reader `create()` uses.
+	*
+	* **The GUARDS around those sites deliberately stay on `toFiniteNumber`**,
+	* and that is the split `dynamodb-warm-throughput.ts`'s header already
+	* records: a FORWARDER reads CloudFormation's grammar, a GUARD reads the
+	* wider one, because over-acceptance is the safe side of an
+	* already-matches / zero-capacity / change-detection test. Nothing moves as
+	* a result — `liveCapacityAlreadyMatches` and `skipZeroCapacityIndexUpdate`
+	* are asked about the DECLARED block exactly as before, and the change
+	* detector still compares the declared block against the recorded one, both
+	* raw. Only what reaches AWS changes.
+	*/
+	indexCapacityForSend(scope, declared, maskSecrets) {
+		if (declared === void 0) return void 0;
+		return this.coerceIndexCapacityBlock(scope, declared, maskSecrets) ?? declared;
+	}
+	/**
+	* One `CreateTable` index entry with BOTH of its throughput blocks coerced —
+	* `WarmThroughput` (PR review round 6) and `ProvisionedThroughput` (issue
+	* [#3255](https://github.com/go-to-k/cdkd/issues/3255)).
 	*
 	* `create()` forwards the declared `GlobalSecondaryIndexes` array to
-	* `CreateTable`, so it is a SEND SITE for the same per-index value the
-	* update path coerces — and it was the one the round-5 sweep missed. Entries
-	* are rebuilt rather than mutated: the input bag belongs to the caller (the
-	* resolved template, which the engine also records into state), and a
-	* provider that edits it in place would change what state reports cdkd sent.
-	*
-	* An entry that is not a plain object, or that declares no `WarmThroughput`,
-	* is returned UNCHANGED — including the identity of the object, so the
-	* common case allocates nothing.
-	*/
-	coerceIndexWarmThroughputForCreate(logicalId, entry, maskSecrets = (text) => text) {
+	* `CreateTable`, so it is a SEND SITE for the same per-index values the
+	* update path coerces. `WarmThroughput` was the one the round-5 sweep
+	* missed; `ProvisionedThroughput` was missed by round 6 AND by issue #3147's
+	* own enumeration, because this forwarder is a CAST rather than a call, so
+	* neither sweep's grep could see it. The BillingMode flip's per-index reader
+	* ({@link readCapacityNumber}) has been on the grammar since #3147, so until
+	* now create and flip disagreed about the same property: a CFn-legal
+	* `ReadCapacityUnits: '7'` reached `CreateTable` as a STRING in a `number`
+	* field, and a `' 7 '` CloudFormation refuses the template for was forwarded
+	* unchanged.
+	*
+	* Entries are rebuilt rather than mutated: the input bag belongs to the
+	* caller (the resolved template, which the engine also records into state),
+	* and a provider that edits it in place would change what state reports cdkd
+	* sent.
+	*
+	* An entry that is not a plain object, and one declaring NEITHER throughput
+	* block, is returned UNCHANGED — identity included. An entry that DOES
+	* declare one is rebuilt whenever that block's coercion changes anything;
+	* the `WarmThroughput` half rebuilds even for an already-numeric value,
+	* which is pre-existing behaviour and costs one spread per declared block.
+	*/
+	coerceIndexThroughputForCreate(logicalId, entry, maskSecrets = (text) => text) {
 		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return entry;
-		const declared = entry["WarmThroughput"];
-		if (declared === void 0) return entry;
-		const scope = `GSI ${entry.IndexName === void 0 ? "<unnamed>" : maskSecrets(entry.IndexName)} on AWS::DynamoDB::Table ${logicalId}`;
-		const coerced = this.coerceWarmThroughputForSend(scope, declared, maskSecrets);
-		if (coerced === void 0) {
-			this.warnRefusedWarmThroughput(scope, declared, maskSecrets);
-			const { WarmThroughput: _dropped, ...rest } = entry;
-			return rest;
+		const bag = entry;
+		const declaredWarm = bag["WarmThroughput"];
+		const declaredCapacity = bag["ProvisionedThroughput"];
+		if (declaredWarm === void 0 && !isPlainCapacityBlock(declaredCapacity)) return entry;
+		const scope = this.indexScope(entry.IndexName, logicalId, maskSecrets);
+		let out = entry;
+		if (declaredWarm !== void 0) {
+			const coerced = this.coerceWarmThroughputForSend(scope, declaredWarm, maskSecrets);
+			if (coerced === void 0) {
+				this.warnRefusedWarmThroughput(scope, declaredWarm, maskSecrets);
+				const { WarmThroughput: _dropped, ...rest } = out;
+				out = rest;
+			} else out = {
+				...out,
+				WarmThroughput: coerced
+			};
 		}
-		return {
-			...entry,
-			WarmThroughput: coerced
+		const capacity = this.coerceIndexCapacityBlock(scope, declaredCapacity, maskSecrets);
+		if (capacity !== void 0) out = {
+			...out,
+			ProvisionedThroughput: capacity
 		};
+		return out;
+	}
+	/**
+	* One `CreateTable` index entry's `ProvisionedThroughput`, with each DECLARED
+	* member read through CloudFormation's DynamoDB Integer grammar (issue
+	* [#3255](https://github.com/go-to-k/cdkd/issues/3255)). Returns `undefined`
+	* when the block needs no rewriting at all.
+	*
+	* It reads through {@link readCapacityNumber} — the function the BillingMode
+	* flip's per-index forwarder calls — rather than restating the grammar, for
+	* the same reason {@link hasUsableDeclaredCapacity} does: that is what keeps
+	* create and flip answering identically about one template value.
+	*
+	* THREE decisions, each of which had a plausible alternative:
+	*
+	*  - **A rejected spelling drops the MEMBER, not the whole block.** This is
+	*    what {@link tableCapacityForSend} already does one level up for the
+	*    identical grammar, so create's two capacity forwarders answer the same
+	*    way; it keeps a sibling member the template spelled LEGALLY, which
+	*    dropping the block would discard; and it is the more informative
+	*    failure at AWS — `CreateTable` names the missing member at its exact
+	*    index position, where a missing block yields only
+	*    `ProvisionedThroughput must be specified for index: <name>`. Both
+	*    directions FAIL the deploy (DynamoDB requires both members on a
+	*    PROVISIONED index), so this is a choice of error TEXT, never of
+	*    outcome — what matters is that neither silently succeeds at a capacity
+	*    CloudFormation refuses the template for.
+	*
+	*    **That is also why this drop needs NO `effectiveProperties`**, which
+	*    `.claude/rules/provider-property-fidelity.md` otherwise requires of any
+	*    announced narrowing: the rule exists because a SUCCEEDING call plus a
+	*    record describing the declared value is permanent phantom drift. Here
+	*    `CreateTable` FAILS, so `create()` never returns and nothing is
+	*    recorded — the same reasoning `tableCapacityForSend` states for the
+	*    table-level omit one level up.
+	*  - **An ABSENT member stays absent — no `5` default.** The per-index
+	*    reader deliberately has none ({@link readCapacityNumber}'s doc, issue
+	*    #1588): a defaulted per-index capacity would land in cdkd state as if
+	*    the template had declared it, with no later call to correct it. Only
+	*    the TABLE level defaults.
+	*  - **A block that is not a plain object is forwarded VERBATIM**, the
+	*    fail-OPEN direction this file takes everywhere: an unresolved intrinsic
+	*    or a mis-nested template value is AWS's to reject by name, and that is
+	*    also the pre-existing behaviour of this forwarder.
+	*
+	* A member name the grammar does not know is preserved untouched, for the
+	* same fail-open reason — a misspelled `ReadCapacityUnit` reaches AWS and is
+	* named there rather than vanishing here.
+	*/
+	coerceIndexCapacityBlock(scope, declared, maskSecrets = (text) => text) {
+		if (!isPlainCapacityBlock(declared)) return void 0;
+		const block = declared;
+		let rewritten;
+		for (const member of PROVISIONED_CAPACITY_MEMBERS) {
+			if (!(member in block)) continue;
+			const coerced = readCapacityNumber(block, member);
+			if (coerced === block[member]) continue;
+			rewritten ??= { ...block };
+			if (coerced === void 0) {
+				this.warnUnusableProvisionedCapacity(scope, member, block[member], maskSecrets);
+				delete rewritten[member];
+			} else rewritten[member] = coerced;
+		}
+		return rewritten;
+	}
+	/**
+	* Announce a `ProvisionedThroughput` member a forwarder DROPPED (issue
+	* [#3147](https://github.com/go-to-k/cdkd/issues/3147); widened to the
+	* per-index create forwarder by issue
+	* [#3255](https://github.com/go-to-k/cdkd/issues/3255)).
+	*
+	* Called from all THREE forwarders that can drop one — `create()`'s
+	* `CreateTable` table-level block, the BillingMode flip's `UpdateTable`
+	* table-level block, and `create()`'s per-`GlobalSecondaryIndexes[]` block —
+	* because the member vanishes at each independently, and a drop that is
+	* never announced is the silent-narrowing class this file's other warn arms
+	* exist to end. `scope` names the resource or the index, so a table with
+	* several GSIs says WHICH one.
+	*
+	* It says NO capacity was substituted, which is the whole decision: the
+	* sibling `AWS::DynamoDB::GlobalTable` forwarders announce a 5/5 FALLBACK,
+	* and saying the wrong one of those two would send a user looking for a
+	* table that does not exist. {@link tableCapacityForSend}'s doc carries why
+	* this type differs.
+	*/
+	warnUnusableProvisionedCapacity(scope, member, raw, maskSecrets = (text) => text) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		warn(`${scope}: ProvisionedThroughput.${member} ${JSON.stringify(maskLeafValue$1(raw, maskSecrets))} is not an Integer CloudFormation accepts (an optional sign and decimal digits only — no surrounding whitespace, hex, exponent or decimal point), so it was NOT sent and NO capacity was substituted for it. DynamoDB requires both members wherever a PROVISIONED ProvisionedThroughput block is declared — the table itself, and every GlobalSecondaryIndexes[] entry of a PROVISIONED table — and will reject the request naming this one; CloudFormation refuses the same template at properties validation. Check for an unresolved intrinsic, or spell the value as a decimal integer.`);
 	}
 	/**
 	* Announce a `WarmThroughput` the send rule REFUSES (PR review of issue
@@ -23953,10 +24296,19 @@ var LogsLogGroupProvider = class {
 		const rawPreviousRetention = previousProperties["RetentionInDays"];
 		const renderedRetention = JSON.stringify(rawRetention);
 		const sameRawRetention = Object.is(rawRetention, rawPreviousRetention) || renderedRetention !== void 0 && renderedRetention !== "null" && renderedRetention === JSON.stringify(rawPreviousRetention);
-		const retentionInDays = toCfnInteger(rawRetention);
+		let retentionInDays = toCfnInteger(rawRetention);
 		const oldRetentionInDays = toCfnInteger(rawPreviousRetention);
 		const desiredFromAwsReadback = context?.desiredFromAwsReadback === true;
-		if (!sameRawRetention && !isAbsentRetention(rawRetention, desiredFromAwsReadback)) assertUsableRetention(rawRetention, retentionInDays, logicalId, resourceType);
+		if (!sameRawRetention && !isAbsentRetention(rawRetention, desiredFromAwsReadback)) try {
+			assertUsableRetention(rawRetention, retentionInDays, logicalId, resourceType);
+		} catch (refusal) {
+			if (context?.replayingState !== true || !(refusal instanceof ProvisioningError)) throw refusal;
+			const legacyReading = toFiniteNumber(rawRetention);
+			if (legacyReading !== void 0 && Number.isInteger(legacyReading) && legacyReading > 0) {
+				retentionInDays = legacyReading;
+				this.logger.warn(`${refusal.message}. This update replays a cdkd state record (rollback) written by a cdkd that read the value as ${legacyReading} and applied it, so the retention is RESTORED as ${legacyReading} days rather than refused. Fix the template spelling and re-deploy.`);
+			} else this.logger.warn(`${refusal.message}. This update replays a cdkd state record (rollback), so the value is read as the "no retention" the record meant rather than refused: the log group's retention policy is REMOVED, which is what the cdkd that wrote the record left in place. Re-apply it by hand (aws logs put-retention-policy) or fix the template and re-deploy.`);
+		}
 		const newKmsKeyId = properties["KmsKeyId"];
 		if (newKmsKeyId !== previousProperties["KmsKeyId"]) {
 			if (newKmsKeyId) await this.logsClient.send(new AssociateKmsKeyCommand({
@@ -25630,7 +25982,13 @@ var SSMParameterProvider = class {
 					await this.ssmClient.send(new DeleteParameterCommand({ Name: name }));
 					debug(`Cleaned up partially-created SSM parameter ${logicalId} (${name}) after wiring failure`);
 				} catch (cleanupError) {
-					warn(`Failed to clean up partially-created SSM parameter ${logicalId} (${name}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws ssm delete-parameter --name '${name}'`);
+					const deleteCommand = renderDisableCommand({
+						before: "aws ssm delete-parameter --name",
+						identifier: name,
+						maskSecrets: mask
+					});
+					const manualStep = deleteCommand ? `Manual deletion may be required before the next deploy: ${deleteCommand}` : "Manual deletion may be required before the next deploy, via the console: the parameter name cannot be reproduced safely on a command line, and a command naming the sanitized form would delete a DIFFERENT parameter.";
+					warn(`Failed to clean up partially-created SSM parameter ${logicalId} (${name}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. ${manualStep}`);
 				}
 				throw innerError;
 			}
@@ -25858,7 +26216,13 @@ var SSMParameterProvider = class {
 		const shape = isArn ? "an ARN" : "a version / label selector";
 		const remedy = input.knownPhysicalId === explicit ? `pass the parameter NAME instead: --resource ${input.logicalId}=<parameterName>` : `set Properties.Name to the parameter NAME rather than ${shape}`;
 		const whyNotDerived = isArn ? " cdkd deliberately does NOT derive the name from the ARN: the leading \"/\" is not recoverable (arn:...:parameter/foo is the ARN of BOTH the simple name \"foo\" and the hierarchical name \"/foo\"), and a parameter shared from another account has no name form at all — so a derived name could silently address a DIFFERENT parameter." : "";
-		throw new ProvisioningError(`Cannot adopt SSM parameter ${input.logicalId} from ${shape} ('${explicit}'): cdkd records a parameter's NAME as its physical id, because SSM's write APIs accept only the name (PutParameter and DeleteParameter both reject an ARN, and a name cannot contain ':'), so the next cdkd deploy and cdkd destroy would fail with a ValidationException. ${remedy}.${whyNotDerived} Read the name AWS holds with: aws ssm get-parameter --name '${explicit}' --query Parameter.Name --output text`, input.resourceType, input.logicalId);
+		const readCommand = renderDisableCommand({
+			before: "aws ssm get-parameter --name",
+			identifier: explicit,
+			after: "--query Parameter.Name --output text"
+		});
+		const howToRead = readCommand ? ` Read the name AWS holds with: ${readCommand}` : " Read the name AWS holds via the console: the value cdkd was given cannot be reproduced safely on a command line, so any command shown here would read a different parameter.";
+		throw new ProvisioningError(`Cannot adopt SSM parameter ${input.logicalId} from ${shape} ('${explicit}'): cdkd records a parameter's NAME as its physical id, because SSM's write APIs accept only the name (PutParameter and DeleteParameter both reject an ARN, and a name cannot contain ':'), so the next cdkd deploy and cdkd destroy would fail with a ValidationException. ${remedy}.${whyNotDerived}${howToRead}`, input.resourceType, input.logicalId);
 	}
 	/**
 	* Adopt an existing SSM parameter into cdkd state.
@@ -65936,7 +66300,7 @@ function indexNestedChildTemplates(template, templatePath) {
 		if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
 		const assetPath = resource.Metadata?.["aws:asset:path"];
 		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-		if (isAbsoluteCrossPlatform(assetPath)) throw new Error(`Nested stack '${logicalId}' has Metadata['aws:asset:path']='${assetPath}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
+		if (isAbsoluteCrossPlatform(assetPath)) throw new Error(`Nested stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
 		result[logicalId] = path.join(dir, assetPath);
 	}
 	return result;
@@ -66236,7 +66600,7 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 * fail at deploy time.
 */
 async function buildDiffTree(args) {
-	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption } = args;
+	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption, ancestorTemplatePaths } = args;
 	const state = await loadStateOrEmpty(stackName, region, stateBackend);
 	const secretBearingAbove = parentHasSecretReference === true || templateHasSecretDynamicReference(template);
 	const { changes, outputChanges, adoptedOrphans, adoptedRecords, blocking } = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, {
@@ -66272,6 +66636,9 @@ async function buildDiffTree(args) {
 		const childTemplatePath = nestedTemplates[logicalId];
 		if (!childTemplatePath) throw new Error(`Nested template file not found for ${NESTED_STACK_RESOURCE_TYPE} '${logicalId}' under stack '${stackName}'. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default), then re-run synth.`);
 		const childStackName = `${stackName}~${logicalId}`;
+		const resolvedChildPath = path.resolve(childTemplatePath);
+		if (ancestorTemplatePaths?.has(resolvedChildPath) === true) throw new Error(`Nested stack '${displaySafe(logicalId)}' under stack '${displaySafe(stackName)}' resolves to nested template '${displaySafe(resolvedChildPath)}', which is already being diffed higher up the same nesting chain. Its Metadata['aws:asset:path'] closes a cycle; CDK emits an acyclic nested template tree, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to diff.`);
+		const childAncestorTemplatePaths = new Set(ancestorTemplatePaths ?? []).add(resolvedChildPath);
 		const childTemplate = readNestedTemplate(childTemplatePath);
 		if (assetRedirect) rewriteTemplateAssetReferences(childTemplate, assetRedirect);
 		const grandchildTemplates = indexNestedChildTemplates(childTemplate, childTemplatePath);
@@ -66290,6 +66657,7 @@ async function buildDiffTree(args) {
 			...assetRedirect && { assetRedirect },
 			...cfnFallback !== void 0 && { cfnFallback },
 			...previewOrphanAdoption && { previewOrphanAdoption },
+			ancestorTemplatePaths: childAncestorTemplatePaths,
 			parentHasSecretReference: secretBearingAbove
 		}));
 	}
@@ -74531,6 +74899,39 @@ function createStateMigrateCommand() {
 //#endregion
 //#region src/cli/commands/state-list-tree.ts
 /**
+* How deep a node may sit below its root, counting the root as 0.
+*
+* A node that would sit deeper is made a root instead (see
+* {@link buildStackTree}). The value is far beyond any nesting an app is
+* written with: CloudFormation stops at five levels of nested stacks, so an
+* app that also has to deploy through CloudFormation cannot exceed that.
+* cdkd deploys nested stacks through its own engine and imposes no limit of
+* its own, so a deliberately deeper app CAN produce a tree this reshapes —
+* which is the point. The view stays whole either way.
+*
+* It exists because every step AFTER the tree is built recurses once per
+* level: this module's own child sort, the box-drawing renderer and
+* {@link stackTreeToJson}, plus the `JSON.stringify` that serializes that
+* shape for `--tree --json`. Capping the tree bounds all four at once, which
+* an iterative rewrite of any of them could not: `JSON.stringify` recurses
+* into whatever nesting it is handed, and the text view indents four
+* characters per level, so a chain deep enough would need more indentation
+* than a string can hold.
+*
+* It bounds the DEPTH, not the bucket, and what it does to the failure at the
+* far end is change its KIND. Before the cap, one deep chain exhausted the
+* CALL STACK, at a record count nothing fixes — V8's budget moves with frame
+* size and with what else is on the stack. After it, every recursion is at
+* most a hundred frames and the remaining ceiling is V8's maximum STRING
+* length: a capped tree still costs a roughly constant number of characters
+* per record (the cap's own pretty-print indent dominates in `--tree --json`),
+* so `JSON.stringify` refuses a large enough bucket deterministically instead
+* of at a moving depth. Both are far past `renderTreeMode`'s unbounded
+* one-read-per-reference fan-out, which gives out first. Read the cap as what
+* stops a SINGLE chain taking the view down, not as a total bound.
+*/
+const MAX_STACK_TREE_DEPTH = 100;
+/**
 * Build a parent → child tree from the flat list of state records.
 *
 * Children are linked to their parent by `(parentStack, parentRegion)`
@@ -74546,6 +74947,17 @@ function createStateMigrateCommand() {
 * from both the text and the JSON view. A node hanging off a loop still sits
 * under its parent, which is now visible (issue #3069).
 *
+* A node that would sit deeper than {@link MAX_STACK_TREE_DEPTH} levels below
+* its root is placed at the root too, so the chain resumes there as its own
+* tree. Every record still appears exactly once, and a tree within the cap is
+* built as before. Without it a long enough chain took the whole view down with
+* a `RangeError` instead of costing only its own rows, since the recursive
+* steps AFTER this function are not covered by the per-stack guard around the
+* state read. Reaching the depths that failed takes thousands of records — in
+* practice a hand-edited bucket, or records planted by someone holding
+* `s3:PutObject` on it — but nothing in cdkd bounds the depth, so the cap does
+* (issue #3155).
+*
 * The roots and every child list are sorted alphabetically by `stackName`,
 * then by `region` (legacy `undefined` last), so output is stable across
 * runs.
@@ -74572,10 +74984,26 @@ function buildStackTree(entries) {
 		if (current !== void 0 && onPath.has(current)) for (const member of path.slice(onPath.get(current))) loopMembers.add(member);
 		for (const node of path) settled.add(node);
 	}
+	const depthOf = /* @__PURE__ */ new Map();
+	for (const member of loopMembers) depthOf.set(member, 0);
+	for (const start of byKey.values()) {
+		if (depthOf.has(start)) continue;
+		const path = [];
+		let current = start;
+		while (current !== void 0 && !depthOf.has(current)) {
+			path.push(current);
+			current = parentOf(current);
+		}
+		let depth = current === void 0 ? -1 : depthOf.get(current);
+		for (let i = path.length - 1; i >= 0; i--) {
+			depth = depth + 1 > 100 ? 0 : depth + 1;
+			depthOf.set(path[i], depth);
+		}
+	}
 	const roots = [];
 	for (const node of byKey.values()) {
 		const parent = parentOf(node);
-		if (parent && !loopMembers.has(node)) {
+		if (parent && depthOf.get(node) > 0) {
 			parent.children.push(node);
 			continue;
 		}
@@ -78609,6 +79037,12 @@ async function stateListCommand(options) {
 *
 * `tree --json` emits the nested {@link import('./state-list-tree.js').StackTreeJson}
 * shape; plain `tree` renders `tree(1)`-style box-drawing.
+*
+* The `JSON.stringify` below recurses once per level of the shape it is handed,
+* and so does the box-drawing renderer. Neither needs a depth guard here:
+* `buildStackTree` caps how deep a node may sit
+* ({@link import('./state-list-tree.js').MAX_STACK_TREE_DEPTH}), which bounds
+* both (issue #3155).
 */
 async function renderTreeMode(refs, stateBackend, asJson) {
 	const entries = await Promise.all(refs.map(async (ref) => {
@@ -94054,4 +94488,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-DD0X9qLM.js.map
+//# sourceMappingURL=program-U03H43s7.js.map