@go-to-k/cdkd 0.290.15 → 0.290.16

package/dist/{program-BBgCW2BX.js → program-U03H43s7.js}

@@ -1,8 +1,8 @@
-import { $ as secretBearing, $n as BOOTSTRAP_MARKER_PREFIX, $r as getAwsClients, $t as s3BucketRegionalDomainName, A as extractDeploymentEventError, Ai as markNonRetryable, An as buildForceUnlockCommand, Ar as resolveAutoAssetStorage, At as parameterTypeMayLoseSecretIdentity, B as toCfnInteger, Bn as importableOutputs, Br as MIGRATE_TMP_PREFIX, Bt as configIntegerRefusal, C as buildFinalSnapshotIdentifier, Cn as recordMaskOnlyValue, Cr as AssetManifestLoader, Ct as IntrinsicFunctionResolver, D as refusesFinalSnapshot, Di as isRetryableTransientError, Dn as LockManager, Dr as getDefaultStateBucketName, Dt as getAccountInfo, E as isFinalSnapshotError, Ei as isMarkedNonRetryable, En as scrubResourceRecord, Er as synthesisStatusMessage, Et as coerceParameterTypedValue, F as isStatefulRecreateTargetSync, Fn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Fr as resolveUseCdkBootstrapAssets, Ft as resolveExplicitPhysicalId, G as gray, Gn as AssetPublisher, Gr as PARTITION_TABLE, Gt as requireConfigObject, H as formatResourceLine, Hn as orphansAfterRollback, Hr as uploadCfnTemplate, Ht as readConfigString, I as renderStatefulReason, In as DEFAULT_STATE_PREFIX, Ir as stateBucketExistenceConfirmed, It as assertRegionMatch, J as yellow, Jn as buildAssetRedirectMap, Jr as AssemblyReader, Jt as producerRegionsFromState, K as green, Kn as stringifyValue, Kr as canonicalizeRegion, Kt as requireConfigString, L as WARM_THROUGHPUT_MEMBERS, Ln as exportNamesCarriedFrom, Lr as warnDeprecatedNoPrefixCliFlag, Lt as coerceCfnBoolean, M as planOrphanAdoption, Mi as retryClassificationText, Mn as forceQuitRecoveryClause, Mr as resolveSkipPrefix, Mt as isSettledInstanceState, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as formatLockExpiry, Nr as resolveStateBucketWithDefault, Nt as WAFv2WebACLProvider, O as unsupportedFinalSnapshotError, Oi as isThrottlingError, On as S3StateBackend, Or as getLegacyStateBucketName, Ot as isImpossibleEmptyStoredAttribute, P as isStatefulRecreateTargetForReplace, Pn as shellQuote, Pr as resolveStateBucketWithDefaultAndSource, Pt as normalizeAwsTagsToCfn, Q as isExportAliasCollision, Qn as AssetModeResolver, Qr as AwsClients, Qt as s3BucketDualStackDomainName, R as coerceWarmThroughput$1, Rn as hasReadableExportSet, Rr as CFN_TEMPLATE_BODY_LIMIT, Rt as coerceCfnInteger, S as PRE_DELETE_SNAPSHOT_TYPES, Sn as maskSecretsInText, Sr as stripControlChars, St as isTerminationProtectionPropagationError, T as createPreDeleteFinalSnapshot, Ti as withErrorHandling, Tn as redactSecretsForState, Tr as Synthesizer, Tt as cfnRefValueFromPhysicalId, U as bold, Un as orphansCarriedFrom, Ur as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Ut as replayWarn, V as toFiniteNumber, Vn as isReadableBag, Vr as findLargeInlineResources, Vt as configStringRefusal, W as cyan, Wn as shouldRetainResource, Wr as expectedOwnerParam, Wt as requireConfigArray, X as collectPublishedOutputNames, Xn as loadPublishableAssetManifest, Xt as s3BucketArn, Y as collectDeclaredOutputNames, Yn as createAssetRedirectResolver, Yr as processStackMessages, Yt as withSharedDrainBudget, Z as exportAliasCollisionScrubWarning, Zn as rewriteTemplateAssetReferences, Zr as resolveBucketRegion, Zt as s3BucketDomainName, _ as isSecretBearingReferenceString, _i as ResourceUpdateNotSupportedError, _n as errorCauseChain, _r as partitionSensitiveEnv, _t as slowCcOperationTimeoutMs, a as DeploymentEventsStore, ai as CrossAccountSecretRefusalError, an as findSilentDropProperties, ar as readBootstrapMarkerBody, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bn as markSameGenerationBag, br as runDockerStreaming, bt as deleteSkipReason, c as replayFailedOperations, ci as DynamicReferenceRegionAmbiguousError, cn as DagBuilder, cr as buildDenyExternalAccessPolicy, ct as createMaskedRetryLogger, d as updatePartialReason, di as LocalStartServiceError, dn as STATE_SOURCED_CROSS_GENERATION_RULES, dr as describeDockerCapturedOutput, dt as beginCommandInterruptScope, ei as resetAwsClients, en as s3BucketWebsiteUrl, er as assertAssetBucketRegion, et as secretBearingStateKeyWarning, f as withResourceDeadline, fn as STATE_SOURCED_READBACK_RULES, fr as describeDockerExecFailure, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as ResourceTimeoutError, gn as dynamicReferenceTokens, gr as getDockerCmd, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as ProvisioningError, hn as createSecretMasker, hr as formatDockerLoginError, ht as startInterruptWatch, i as DeploymentEventsReader, in as findActionableSilentDrops, ir as parseBootstrapMarker, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as markRedactedCause, jn as buildLockContentionMessage, jr as resolveCaptureObservedState, jt as refStateLookupFromResource, k as makeCanonicalizePropertiesFn, ki as isTransientServerError, kn as rebuildClientForBucketRegion, kr as resolveApp, kt as isUnboundTemplateParameter, l as replayRollback, li as IntrinsicResolutionRefusalError, ln as TemplateParser, lr as describeAwsFailure, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as PartialFailureError, mn as carriesSecretMask, mr as dockerSpawnEnvWithSensitive, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as DiffCalculator, nr as getBootstrapMarkerKey, nt as getCurrentResourceSecrets, o as planFailedOps, on as describeTypeWithThrottleRetry, or as validateAssetBucketName, ot as ProviderRegistry, p as maskingRetryLogger, pi as NestedStackChildDirectDestroyError, pn as TEMPLATE_SOURCED_RULES, pr as describeDockerFailure, pt as interruptWatchListenerCount, q as red, qn as WorkGraph, qr as derivePartitionAndUrlSuffix, qt as classifyReplaySecretRegion, r as DeployEngine, ri as CdkdError, rn as INTRINSIC_KEYS, rr as isCrossRegionRedirect, rt as IAMRoleProvider, s as planRollback, si as DeployCancelledError, sn as withRetry, sr as validateContainerRepoName, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as setAwsClients, tn as applyRoleArnIfSet, tr as ensureAssetStorage, tt as secretSafeKeyDisplay, u as updatePartialMessage, ui as LocalInvokeBuildError$1, un as STATE_SOURCED_BASELINE_RULES, ur as buildDockerImage, ut as maskerOrIdentity, v as keptWholeReasonText, vi as StackHasActiveImportsError, vn as identityKeyFor, vr as redactDockerArgvValues, vt as UNSPECIFIED_SKIP_REASON, w as ccRoutedFinalSnapshotError, wi as normalizeAwsError, wn as recoverMaskedOutput, wr as getDockerImageBySourceHash, wt as carriesDynamicReference, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xn as maskSecretsInError, xr as escapeRegExp, xt as disableInstanceApiTermination, y as mergeNoChangeOutputs, yi as StackTerminationProtectionError, yn as isSingleDynamicReferenceToken, yr as runDockerForeground, yt as deleteIndeterminateGuards, z as isWarmThroughputDecrease, zn as importableOutputKeys, zr as CFN_TEMPLATE_URL_LIMIT, zt as configBooleanRefusal } from "./deploy-engine-C2qLzc-5.js";
+import { $ as secretBearing, $n as BOOTSTRAP_MARKER_PREFIX, $r as getAwsClients, $t as s3BucketRegionalDomainName, A as extractDeploymentEventError, Ai as markNonRetryable, An as buildForceUnlockCommand, Ar as resolveAutoAssetStorage, At as parameterTypeMayLoseSecretIdentity, B as toCfnInteger, Bn as importableOutputs, Br as MIGRATE_TMP_PREFIX, Bt as configIntegerRefusal, C as buildFinalSnapshotIdentifier, Cn as recordMaskOnlyValue, Cr as AssetManifestLoader, Ct as IntrinsicFunctionResolver, D as refusesFinalSnapshot, Di as isRetryableTransientError, Dn as LockManager, Dr as getDefaultStateBucketName, Dt as getAccountInfo, E as isFinalSnapshotError, Ei as isMarkedNonRetryable, En as scrubResourceRecord, Er as synthesisStatusMessage, Et as coerceParameterTypedValue, F as isStatefulRecreateTargetSync, Fn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Fr as resolveUseCdkBootstrapAssets, Ft as resolveExplicitPhysicalId, G as gray, Gn as AssetPublisher, Gr as PARTITION_TABLE, Gt as requireConfigObject, H as formatResourceLine, Hn as orphansAfterRollback, Hr as uploadCfnTemplate, Ht as readConfigString, I as renderStatefulReason, In as DEFAULT_STATE_PREFIX, Ir as stateBucketExistenceConfirmed, It as assertRegionMatch, J as yellow, Jn as buildAssetRedirectMap, Jr as AssemblyReader, Jt as producerRegionsFromState, K as green, Kn as stringifyValue, Kr as canonicalizeRegion, Kt as requireConfigString, L as WARM_THROUGHPUT_MEMBERS, Ln as exportNamesCarriedFrom, Lr as warnDeprecatedNoPrefixCliFlag, Lt as coerceCfnBoolean, M as planOrphanAdoption, Mi as retryClassificationText, Mn as forceQuitRecoveryClause, Mr as resolveSkipPrefix, Mt as isSettledInstanceState, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as formatLockExpiry, Nr as resolveStateBucketWithDefault, Nt as WAFv2WebACLProvider, O as unsupportedFinalSnapshotError, Oi as isThrottlingError, On as S3StateBackend, Or as getLegacyStateBucketName, Ot as isImpossibleEmptyStoredAttribute, P as isStatefulRecreateTargetForReplace, Pn as shellQuote, Pr as resolveStateBucketWithDefaultAndSource, Pt as normalizeAwsTagsToCfn, Q as isExportAliasCollision, Qn as AssetModeResolver, Qr as AwsClients, Qt as s3BucketDualStackDomainName, R as coerceWarmThroughput$1, Rn as hasReadableExportSet, Rr as CFN_TEMPLATE_BODY_LIMIT, Rt as coerceCfnInteger, S as PRE_DELETE_SNAPSHOT_TYPES, Sn as maskSecretsInText, Sr as stripControlChars, St as isTerminationProtectionPropagationError, T as createPreDeleteFinalSnapshot, Ti as withErrorHandling, Tn as redactSecretsForState, Tr as Synthesizer, Tt as cfnRefValueFromPhysicalId, U as bold, Un as orphansCarriedFrom, Ur as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Ut as replayWarn, V as toFiniteNumber, Vn as isReadableBag, Vr as findLargeInlineResources, Vt as configStringRefusal, W as cyan, Wn as shouldRetainResource, Wr as expectedOwnerParam, Wt as requireConfigArray, X as collectPublishedOutputNames, Xn as loadPublishableAssetManifest, Xt as s3BucketArn, Y as collectDeclaredOutputNames, Yn as createAssetRedirectResolver, Yr as processStackMessages, Yt as withSharedDrainBudget, Z as exportAliasCollisionScrubWarning, Zn as rewriteTemplateAssetReferences, Zr as resolveBucketRegion, Zt as s3BucketDomainName, _ as isSecretBearingReferenceString, _i as ResourceUpdateNotSupportedError, _n as errorCauseChain, _r as partitionSensitiveEnv, _t as slowCcOperationTimeoutMs, a as DeploymentEventsStore, ai as CrossAccountSecretRefusalError, an as findSilentDropProperties, ar as readBootstrapMarkerBody, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bn as markSameGenerationBag, br as runDockerStreaming, bt as deleteSkipReason, c as replayFailedOperations, ci as DynamicReferenceRegionAmbiguousError, cn as DagBuilder, cr as buildDenyExternalAccessPolicy, ct as createMaskedRetryLogger, d as updatePartialReason, di as LocalStartServiceError, dn as STATE_SOURCED_CROSS_GENERATION_RULES, dr as describeDockerCapturedOutput, dt as beginCommandInterruptScope, ei as resetAwsClients, en as s3BucketWebsiteUrl, er as assertAssetBucketRegion, et as secretBearingStateKeyWarning, f as withResourceDeadline, fn as STATE_SOURCED_READBACK_RULES, fr as describeDockerExecFailure, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as ResourceTimeoutError, gn as dynamicReferenceTokens, gr as getDockerCmd, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as ProvisioningError, hn as createSecretMasker, hr as formatDockerLoginError, ht as startInterruptWatch, i as DeploymentEventsReader, in as findActionableSilentDrops, ir as parseBootstrapMarker, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as markRedactedCause, jn as buildLockContentionMessage, jr as resolveCaptureObservedState, jt as refStateLookupFromResource, k as makeCanonicalizePropertiesFn, ki as isTransientServerError, kn as rebuildClientForBucketRegion, kr as resolveApp, kt as isUnboundTemplateParameter, l as replayRollback, li as IntrinsicResolutionRefusalError, ln as TemplateParser, lr as describeAwsFailure, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as PartialFailureError, mn as carriesSecretMask, mr as dockerSpawnEnvWithSensitive, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as DiffCalculator, nr as getBootstrapMarkerKey, nt as getCurrentResourceSecrets, o as planFailedOps, on as describeTypeWithThrottleRetry, or as validateAssetBucketName, ot as ProviderRegistry, p as maskingRetryLogger, pi as NestedStackChildDirectDestroyError, pn as TEMPLATE_SOURCED_RULES, pr as describeDockerFailure, pt as interruptWatchListenerCount, q as red, qn as WorkGraph, qr as derivePartitionAndUrlSuffix, qt as classifyReplaySecretRegion, r as DeployEngine, ri as CdkdError, rn as INTRINSIC_KEYS, rr as isCrossRegionRedirect, rt as IAMRoleProvider, s as planRollback, si as DeployCancelledError, sn as withRetry, sr as validateContainerRepoName, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as setAwsClients, tn as applyRoleArnIfSet, tr as ensureAssetStorage, tt as secretSafeKeyDisplay, u as updatePartialMessage, ui as LocalInvokeBuildError$1, un as STATE_SOURCED_BASELINE_RULES, ur as buildDockerImage, ut as maskerOrIdentity, v as keptWholeReasonText, vi as StackHasActiveImportsError, vn as identityKeyFor, vr as redactDockerArgvValues, vt as UNSPECIFIED_SKIP_REASON, w as ccRoutedFinalSnapshotError, wi as normalizeAwsError, wn as recoverMaskedOutput, wr as getDockerImageBySourceHash, wt as carriesDynamicReference, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xn as maskSecretsInError, xr as escapeRegExp, xt as disableInstanceApiTermination, y as mergeNoChangeOutputs, yi as StackTerminationProtectionError, yn as isSingleDynamicReferenceToken, yr as runDockerForeground, yt as deleteIndeterminateGuards, z as isWarmThroughputDecrease, zn as importableOutputKeys, zr as CFN_TEMPLATE_URL_LIMIT, zt as configBooleanRefusal } from "./deploy-engine-B91NMqm1.js";
 import { C as displaySafe, S as displayIdent, _ as withSkipPrefix, b as STACK_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE } from "./logger-C17H06QA.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BnegtHzZ.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-D5-3SGmd.js";
+import { t as getCdkdVersion } from "./version-1FTpsWNc.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CvkcE8rH.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7079,6 +7079,46 @@ function isTruthyCfnBoolean(value) {
 //#endregion
 //#region src/provisioning/providers/s3-bucket-provider.ts
 /**
+* The "remove this bucket by hand" clause both partial-create cleanup arms end
+* with, rendered through the shared sanitize / shell-quote / SUPPRESS
+* (`renderDisableCommand`, the issue
+* [#2669](https://github.com/go-to-k/cdkd/issues/2669) shape; adopted here by
+* issue [#3136](https://github.com/go-to-k/cdkd/issues/3136)).
+*
+* `bucketName` is TEMPLATE-chosen — `Properties.BucketName`, or the name cdkd
+* generated for the resource — and until now both arms hand-quoted it as
+* `--bucket '<name>'`, so a `'` in the value broke out of the quoting and a
+* control byte forged lines on the operator's terminal. (A WARN, so that is
+* its whole reach — the recorder persists a thrown `error.message`, not this.)
+* When sanitizing CHANGES the name the whole command is
+* SUPPRESSED rather than shown with the sanitized value, because such a command
+* would delete a DIFFERENT bucket — the wrong-target harm the shared renderer
+* exists to prevent, and the reason emitting no command is the honest answer
+* rather than a fallback.
+*
+* ONE clause for both arms so the two cannot come to render the same value
+* differently. The prose `(${bucketName})` each arm carries BESIDE it is still
+* interpolated as-is: this clause takes only the pasteable half, and
+* display-sanitizing the PROSE of provider warnings is tracked as issue
+* [#3269](https://github.com/go-to-k/cdkd/issues/3269) (#3136 covers the
+* COMMAND half across providers, not prose).
+*
+* `maskSecrets` is REQUIRED rather than optional, and both call sites build it
+* from `context?.maskSecrets` (security review of #3136, which found these two
+* arms reaching no masker at all). It does two things: the arms now route
+* their whole warning through it, and it makes `renderDisableCommand` SUPPRESS
+* the command for a secret-bearing bucket name — which a message-level mask
+* could not catch once `shellQuote` has escaped an inner quote.
+*/
+function manualBucketDeletionClause(bucketName, maskSecrets) {
+	const command = renderDisableCommand({
+		before: "aws s3api delete-bucket --bucket",
+		identifier: bucketName,
+		maskSecrets
+	});
+	return command ? `Manual deletion may be required before the next deploy: ${command}` : "Manual deletion may be required before the next deploy, via the console: the bucket name cannot be reproduced safely on a command line, so any command shown here would act on a different bucket.";
+}
+/**
 * A plain (non-array) object. `typeof x === 'object'` alone accepts arrays and
 * `null`; a `Transition: []` or an unresolved intrinsic pushed through as a
 * single transition entry makes S3 answer `MalformedXML` for the WHOLE
@@ -10440,11 +10480,13 @@ var S3BucketProvider = class S3BucketProvider {
 					this.logger.debug(`Cleaned up partially-created S3 bucket ${logicalId} (${bucketName}) after wiring failure`);
 				} catch (cleanupError) {
 					this.logger.debug(`DeleteBucket cleanup failed for S3 bucket ${logicalId} (${bucketName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
-					this.logger.warn(`Failed to clean up partially-created S3 bucket ${logicalId} (${bucketName}) (${cleanupError instanceof Error ? cleanupError.name : typeof cleanupError}). Re-run with --verbose for AWS's own message. Manual deletion may be required before the next deploy: aws s3api delete-bucket --bucket '${bucketName}'`);
+					const maskSecrets = maskerOrIdentity(context?.maskSecrets);
+					this.logger.warn(maskSecrets(`Failed to clean up partially-created S3 bucket ${logicalId} (${bucketName}) (${cleanupError instanceof Error ? cleanupError.name : typeof cleanupError}). Re-run with --verbose for AWS's own message. ` + manualBucketDeletionClause(bucketName, maskSecrets)));
 				}
 				else if (preflight.kind === "indeterminate") {
 					this.logger.debug(`GetBucketLocation failed for S3 bucket ${bucketName} (${logicalId}) during create: ${preflight.reason}`);
-					this.logger.warn(`Not cleaning up S3 bucket ${logicalId} (${bucketName}) after a wiring failure: this deploy could not confirm whether it created the bucket (region probe failed: ${preflight.errorName}), and in us-east-1 a successful CreateBucket does not prove it. Re-run with --verbose for AWS's own message. If cdkd created it, delete it manually before the next deploy: aws s3api delete-bucket --bucket '${bucketName}'`);
+					const maskSecrets = maskerOrIdentity(context?.maskSecrets);
+					this.logger.warn(maskSecrets(`Not cleaning up S3 bucket ${logicalId} (${bucketName}) after a wiring failure: this deploy could not confirm whether it created the bucket (region probe failed: ${preflight.errorName}), and in us-east-1 a successful CreateBucket does not prove it. Re-run with --verbose for AWS's own message. If cdkd created it, the bucket is an orphan. ` + manualBucketDeletionClause(bucketName, maskSecrets)));
 				}
 				throw innerError;
 			}
@@ -17894,10 +17936,28 @@ function mapSSESpecification(raw) {
 * still are not.
 */
 function readCapacityNumber(block, member) {
-	if (typeof block !== "object" || block === null || Array.isArray(block)) return void 0;
+	if (!isPlainCapacityBlock(block)) return void 0;
 	return coerceCfnInteger(block[member]);
 }
 /**
+* Is this a `ProvisionedThroughput` block whose MEMBERS can be read at all?
+*
+* One spelling, shared by {@link readCapacityNumber} — where a `false` answer
+* means "no usable member" — and by
+* {@link DynamoDBTableProvider.coerceIndexCapacityBlock}, where it means
+* "forward this VERBATIM and let AWS name the shape" (issue
+* [#3255](https://github.com/go-to-k/cdkd/issues/3255)). The two conclusions
+* differ; the shape test must not, or the create forwarder could rewrite a
+* block the flip's reader refuses to read (or vice versa).
+*
+* An ARRAY is excluded deliberately: `[]` indexes to `undefined` for both
+* members, so treating it as a block would DROP nothing and report nothing
+* while `CreateTable` rejects the list by name anyway.
+*/
+function isPlainCapacityBlock(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
 * Whether a desired `GlobalSecondaryIndexes[]` entry declares BOTH capacity
 * members usably — the same test the BillingMode flip's per-index block applies
 * before it forwards the index, expressed as a predicate for the pre-flip
@@ -17919,11 +17979,23 @@ function hasUsableDeclaredCapacity(entry) {
 	return readCapacityNumber(declared, "ReadCapacityUnits") !== void 0 && readCapacityNumber(declared, "WriteCapacityUnits") !== void 0;
 }
 /**
-* The two TABLE-level `ProvisionedThroughput` members, in the order both
-* forwarders build them. Named once so {@link hasUsableTableCapacity} and
-* {@link tableCapacityForSend} cannot come to disagree about the membership.
+* The two `ProvisionedThroughput` members, in the order the forwarders build
+* them. Named once so {@link hasUsableTableCapacity}, {@link tableCapacityForSend}
+* and the per-INDEX create forwarder
+* ({@link DynamoDBTableProvider.coerceIndexCapacityBlock}) cannot come to
+* disagree about the membership.
+*
+* Deliberately NOT `TABLE_CAPACITY_MEMBERS` any more (issue
+* [#3255](https://github.com/go-to-k/cdkd/issues/3255)): CloudFormation's
+* `ProvisionedThroughput` block has the same two members at the TABLE level and
+* inside every `GlobalSecondaryIndexes[]` entry, and a second list for the
+* per-index reader would be exactly the drift this constant exists to prevent.
+* What differs between the two levels is what an ABSENT member does — the table
+* level substitutes {@link DEFAULT_TABLE_CAPACITY_UNITS}, the per-index level
+* deliberately has no default ({@link readCapacityNumber}) — and that is a
+* property of each forwarder, not of the membership.
 */
-const TABLE_CAPACITY_MEMBERS = ["ReadCapacityUnits", "WriteCapacityUnits"];
+const PROVISIONED_CAPACITY_MEMBERS = ["ReadCapacityUnits", "WriteCapacityUnits"];
 /**
 * The capacity both TABLE-level forwarders substitute for a member the
 * template does not declare at all — `create()`'s `CreateTable` and the
@@ -17967,7 +18039,7 @@ function hasUsableTableCapacity(value) {
 	if (!value) return false;
 	if (typeof value !== "object" || Array.isArray(value)) return true;
 	const pt = value;
-	for (const member of TABLE_CAPACITY_MEMBERS) {
+	for (const member of PROVISIONED_CAPACITY_MEMBERS) {
 		const raw = pt[member];
 		if (raw === void 0 || raw === null) continue;
 		const n = coerceCfnInteger(raw);
@@ -18374,7 +18446,7 @@ function reverseMapSecondaryIndex(live, desired, bagInformative) {
 *    predicate EVERY per-index write path calls — the `Create` / `Update` GSI
 *    actions in `applyGsiUpdates` AND `create()`'s `CreateTable` forward, which
 *    maps each entry through
-*    {@link DynamoDBTableProvider.coerceIndexWarmThroughputForCreate}. It is
+*    {@link DynamoDBTableProvider.coerceIndexThroughputForCreate}. It is
 *    TIGHTER than truthiness (at least one member resolving to a finite
 *    number), so `WarmThroughput: {}` is neither sent nor emitted on any path.
 *    An earlier version of this bullet carved out the TABLE-create path as an
@@ -18383,9 +18455,15 @@ function reverseMapSecondaryIndex(live, desired, bagInformative) {
 *    template failed on a fresh create and succeeded on a later GSI add. Fixed
 *    in PR review round 6; the carve-out is gone because the divergence is.
 *  - `ProvisionedThroughput` / `OnDemandThroughput` keep TRUTHINESS, which is
-*    what their write path does: those two members ARE still forwarded verbatim
-*    (the create-path mapper rewrites only `WarmThroughput`), and
-*    `applyGsiUpdates` gates on `gsi.ProvisionedThroughput` alone. Widening
+*    still what their write path does: `applyGsiUpdates` gates on
+*    `gsi.ProvisionedThroughput` alone, `OnDemandThroughput` is forwarded
+*    verbatim on every path, and the `ProvisionedThroughput` coercion issue
+*    [#3255](https://github.com/go-to-k/cdkd/issues/3255) added to ALL FOUR
+*    per-index send sites (`create()`'s mapper plus `applyGsiUpdates`'
+*    adopted-repair, `Create` and same-name `Update` actions) never
+*    SUPPRESSES the block — it rewrites members inside a block that is sent
+*    either way, so "would cdkd send this block" is unchanged by it, even
+*    where both members were dropped and an empty block goes out. Widening
 *    `isSendableWarmThroughput` over them would be wrong twice over — it reads
 *    members those blocks do not have (`ReadUnitsPerSecond` vs
 *    `ReadCapacityUnits`), so every declared capacity would read as undeclared.
@@ -18577,7 +18655,7 @@ var DynamoDBTableProvider = class {
 			};
 			if (billingMode === "PROVISIONED") {
 				const pt = properties["ProvisionedThroughput"];
-				const onUnusable = (member, raw) => this.warnUnusableTableCapacity(`AWS::DynamoDB::Table ${logicalId}`, member, raw, maskSecrets);
+				const onUnusable = (member, raw) => this.warnUnusableProvisionedCapacity(`AWS::DynamoDB::Table ${logicalId}`, member, raw, maskSecrets);
 				createParams.ProvisionedThroughput = {
 					ReadCapacityUnits: tableCapacityForSend(pt, "ReadCapacityUnits", onUnusable),
 					WriteCapacityUnits: tableCapacityForSend(pt, "WriteCapacityUnits", onUnusable)
@@ -18593,7 +18671,7 @@ var DynamoDBTableProvider = class {
 			};
 			if (properties["GlobalSecondaryIndexes"]) {
 				const declaredGsis = properties["GlobalSecondaryIndexes"];
-				createParams.GlobalSecondaryIndexes = Array.isArray(declaredGsis) ? declaredGsis.map((entry) => this.coerceIndexWarmThroughputForCreate(logicalId, entry, maskSecrets)) : declaredGsis;
+				createParams.GlobalSecondaryIndexes = Array.isArray(declaredGsis) ? declaredGsis.map((entry) => this.coerceIndexThroughputForCreate(logicalId, entry, maskSecrets)) : declaredGsis;
 			}
 			if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
 			const sse = mapSSESpecification(properties["SSESpecification"]);
@@ -18711,7 +18789,7 @@ var DynamoDBTableProvider = class {
 				if (tableClassChanged) updateInput.TableClass = normalizeTableClass(properties["TableClass"]);
 				if (billingOrThroughputChanged && billingMode !== "PAY_PER_REQUEST" && properties["ProvisionedThroughput"]) {
 					const pt = properties["ProvisionedThroughput"];
-					const onUnusable = (member, raw) => this.warnUnusableTableCapacity(`AWS::DynamoDB::Table ${logicalId}`, member, raw, maskSecrets);
+					const onUnusable = (member, raw) => this.warnUnusableProvisionedCapacity(`AWS::DynamoDB::Table ${logicalId}`, member, raw, maskSecrets);
 					updateInput.ProvisionedThroughput = {
 						ReadCapacityUnits: tableCapacityForSend(pt, "ReadCapacityUnits", onUnusable),
 						WriteCapacityUnits: tableCapacityForSend(pt, "WriteCapacityUnits", onUnusable)
@@ -19403,7 +19481,7 @@ var DynamoDBTableProvider = class {
 				const adopted = { IndexName: name };
 				let adoptedHasMember = false;
 				if (liveCapacityComparable && gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && !liveCapacityAlreadyMatches(live.ProvisionedThroughput, gsi.ProvisionedThroughput) && !this.skipZeroCapacityIndexUpdate(name, physicalId, gsi.ProvisionedThroughput, maskSecrets)) {
-					adopted.ProvisionedThroughput = gsi.ProvisionedThroughput;
+					adopted.ProvisionedThroughput = this.indexCapacityForSend(this.indexScopeAt(name, physicalId, maskSecrets), gsi.ProvisionedThroughput, maskSecrets);
 					adoptedHasMember = true;
 				}
 				const adoptedWarm = this.warmThroughputOpFor(name, physicalId, gsi, void 0, live, maskSecrets);
@@ -19415,13 +19493,13 @@ var DynamoDBTableProvider = class {
 				warn(`GSI ${maskSecrets(name)} was adopted from AWS rather than created, so cdkd could not verify its KeySchema / Projection match the template. Run \`cdkd drift ${physicalId}\` to confirm, and \`cdkd drift --accept\` if AWS is the source of truth.`);
 				continue;
 			}
-			this.warnRefusedWarmThroughput(`GSI ${maskSecrets(name)} on DynamoDB table ${physicalId}`, gsi.WarmThroughput, maskSecrets);
-			const createWarm = this.coerceWarmThroughputForSend(`GSI ${maskSecrets(name)} on DynamoDB table ${physicalId}`, gsi.WarmThroughput, maskSecrets);
+			this.warnRefusedWarmThroughput(this.indexScopeAt(name, physicalId, maskSecrets), gsi.WarmThroughput, maskSecrets);
+			const createWarm = this.coerceWarmThroughputForSend(this.indexScopeAt(name, physicalId, maskSecrets), gsi.WarmThroughput, maskSecrets);
 			ops.push({ Create: {
 				IndexName: name,
 				KeySchema: gsi.KeySchema,
 				Projection: gsi.Projection,
-				...gsi.ProvisionedThroughput ? { ProvisionedThroughput: gsi.ProvisionedThroughput } : {},
+				...gsi.ProvisionedThroughput ? { ProvisionedThroughput: this.indexCapacityForSend(this.indexScopeAt(name, physicalId, maskSecrets), gsi.ProvisionedThroughput, maskSecrets) } : {},
 				...gsi.OnDemandThroughput ? { OnDemandThroughput: gsi.OnDemandThroughput } : {},
 				...createWarm ? { WarmThroughput: createWarm } : {}
 			} });
@@ -19433,7 +19511,7 @@ var DynamoDBTableProvider = class {
 			if (gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && JSON.stringify(before.ProvisionedThroughput) !== JSON.stringify(gsi.ProvisionedThroughput)) {
 				if (liveCapacityComparable && liveCapacityAlreadyMatches(liveIndexByName?.get(name)?.ProvisionedThroughput, gsi.ProvisionedThroughput)) this.logger.debug(`GSI ${name} on DynamoDB table ${physicalId} already carries the requested capacity in AWS; skipping its throughput Update`);
 				else if (!this.skipZeroCapacityIndexUpdate(name, physicalId, gsi.ProvisionedThroughput, maskSecrets)) {
-					update.ProvisionedThroughput = gsi.ProvisionedThroughput;
+					update.ProvisionedThroughput = this.indexCapacityForSend(this.indexScopeAt(name, physicalId, maskSecrets), gsi.ProvisionedThroughput, maskSecrets);
 					updateHasMember = true;
 				}
 			}
@@ -19465,45 +19543,201 @@ var DynamoDBTableProvider = class {
 		return coerced.spec;
 	}
 	/**
-	* One `CreateTable` index entry with its `WarmThroughput` coerced (PR review
-	* round 6).
+	* `GSI <name> on AWS::DynamoDB::Table <logicalId>` — the scope every
+	* create-path per-index warning interpolates.
+	*
+	* The index NAME is a RESOLVED property value, so it is masked before it
+	* becomes part of a message (issue #1997). It is also an UNCHECKED cast off
+	* the template: `IndexName: 2024` (unquoted YAML) reaches here as a NUMBER,
+	* and the real masker is a `String.prototype.replace` call that THROWS on
+	* one — which would take the whole deploy down from a diagnostic path. So
+	* the type test is the guard, not merely `!== undefined`: anything that is
+	* not a string has no name to print and takes the `<unnamed>` arm, exactly
+	* as an absent one does. (Reached by the review of issue
+	* [#3255](https://github.com/go-to-k/cdkd/issues/3255): before it, the scope
+	* was built only for an entry declaring `WarmThroughput`, so the crash was
+	* unreachable for an ordinary PROVISIONED template.)
+	*/
+	indexScope(indexName, logicalId, maskSecrets) {
+		return `GSI ${typeof indexName === "string" ? maskSecrets(indexName) : "<unnamed>"} on AWS::DynamoDB::Table ${logicalId}`;
+	}
+	/**
+	* `GSI <name> on DynamoDB table <physicalId>` — {@link indexScope}'s twin for
+	* the UPDATE path, which names the LIVE table rather than the template's
+	* logical id.
+	*
+	* Same guard, same reason, and the reason is why this exists at all rather
+	* than the five call sites spelling `maskSecrets(name)` inline: `name` is a
+	* key of a map built from `g.IndexName!` off an UNCHECKED template cast, so
+	* `IndexName: 2024` (unquoted YAML) is truthy, becomes the key, and arrives
+	* here as a NUMBER — on which the real masker's `String.prototype.replace`
+	* THROWS. The create path was guarded when {@link indexScope} was added
+	* (the review of issue #3255); the update sites that now build a scope
+	* EAGERLY for the capacity coercion were not, which newly exposed the same
+	* crash on an ordinary PROVISIONED capacity update with a non-empty secret
+	* bag (found by the review of that round).
+	*/
+	indexScopeAt(indexName, physicalId, maskSecrets) {
+		return `GSI ${typeof indexName === "string" ? maskSecrets(indexName) : "<unnamed>"} on DynamoDB table ${physicalId}`;
+	}
+	/**
+	* The per-index `ProvisionedThroughput` an `UpdateTable` action should put on
+	* the wire (the review of issue
+	* [#3255](https://github.com/go-to-k/cdkd/issues/3255)).
+	*
+	* Exists because coercing only `create()`'s forward left the file
+	* INTERNALLY divergent in the direction the issue is about: the same index
+	* entry succeeded on a fresh create and was rejected by AWS when added by a
+	* later update, which is the `WarmThroughput` round-6 story with the
+	* polarity flipped. All three `applyGsiUpdates` send sites — the adopted
+	* index's repair `Update`, the `Create` action and the same-name `Update`
+	* action — now read through {@link coerceIndexCapacityBlock}, the same
+	* reader `create()` uses.
+	*
+	* **The GUARDS around those sites deliberately stay on `toFiniteNumber`**,
+	* and that is the split `dynamodb-warm-throughput.ts`'s header already
+	* records: a FORWARDER reads CloudFormation's grammar, a GUARD reads the
+	* wider one, because over-acceptance is the safe side of an
+	* already-matches / zero-capacity / change-detection test. Nothing moves as
+	* a result — `liveCapacityAlreadyMatches` and `skipZeroCapacityIndexUpdate`
+	* are asked about the DECLARED block exactly as before, and the change
+	* detector still compares the declared block against the recorded one, both
+	* raw. Only what reaches AWS changes.
+	*/
+	indexCapacityForSend(scope, declared, maskSecrets) {
+		if (declared === void 0) return void 0;
+		return this.coerceIndexCapacityBlock(scope, declared, maskSecrets) ?? declared;
+	}
+	/**
+	* One `CreateTable` index entry with BOTH of its throughput blocks coerced —
+	* `WarmThroughput` (PR review round 6) and `ProvisionedThroughput` (issue
+	* [#3255](https://github.com/go-to-k/cdkd/issues/3255)).
 	*
 	* `create()` forwards the declared `GlobalSecondaryIndexes` array to
-	* `CreateTable`, so it is a SEND SITE for the same per-index value the
-	* update path coerces — and it was the one the round-5 sweep missed. Entries
-	* are rebuilt rather than mutated: the input bag belongs to the caller (the
-	* resolved template, which the engine also records into state), and a
-	* provider that edits it in place would change what state reports cdkd sent.
-	*
-	* An entry that is not a plain object, or that declares no `WarmThroughput`,
-	* is returned UNCHANGED — including the identity of the object, so the
-	* common case allocates nothing.
-	*/
-	coerceIndexWarmThroughputForCreate(logicalId, entry, maskSecrets = (text) => text) {
+	* `CreateTable`, so it is a SEND SITE for the same per-index values the
+	* update path coerces. `WarmThroughput` was the one the round-5 sweep
+	* missed; `ProvisionedThroughput` was missed by round 6 AND by issue #3147's
+	* own enumeration, because this forwarder is a CAST rather than a call, so
+	* neither sweep's grep could see it. The BillingMode flip's per-index reader
+	* ({@link readCapacityNumber}) has been on the grammar since #3147, so until
+	* now create and flip disagreed about the same property: a CFn-legal
+	* `ReadCapacityUnits: '7'` reached `CreateTable` as a STRING in a `number`
+	* field, and a `' 7 '` CloudFormation refuses the template for was forwarded
+	* unchanged.
+	*
+	* Entries are rebuilt rather than mutated: the input bag belongs to the
+	* caller (the resolved template, which the engine also records into state),
+	* and a provider that edits it in place would change what state reports cdkd
+	* sent.
+	*
+	* An entry that is not a plain object, and one declaring NEITHER throughput
+	* block, is returned UNCHANGED — identity included. An entry that DOES
+	* declare one is rebuilt whenever that block's coercion changes anything;
+	* the `WarmThroughput` half rebuilds even for an already-numeric value,
+	* which is pre-existing behaviour and costs one spread per declared block.
+	*/
+	coerceIndexThroughputForCreate(logicalId, entry, maskSecrets = (text) => text) {
 		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return entry;
-		const declared = entry["WarmThroughput"];
-		if (declared === void 0) return entry;
-		const scope = `GSI ${entry.IndexName === void 0 ? "<unnamed>" : maskSecrets(entry.IndexName)} on AWS::DynamoDB::Table ${logicalId}`;
-		const coerced = this.coerceWarmThroughputForSend(scope, declared, maskSecrets);
-		if (coerced === void 0) {
-			this.warnRefusedWarmThroughput(scope, declared, maskSecrets);
-			const { WarmThroughput: _dropped, ...rest } = entry;
-			return rest;
+		const bag = entry;
+		const declaredWarm = bag["WarmThroughput"];
+		const declaredCapacity = bag["ProvisionedThroughput"];
+		if (declaredWarm === void 0 && !isPlainCapacityBlock(declaredCapacity)) return entry;
+		const scope = this.indexScope(entry.IndexName, logicalId, maskSecrets);
+		let out = entry;
+		if (declaredWarm !== void 0) {
+			const coerced = this.coerceWarmThroughputForSend(scope, declaredWarm, maskSecrets);
+			if (coerced === void 0) {
+				this.warnRefusedWarmThroughput(scope, declaredWarm, maskSecrets);
+				const { WarmThroughput: _dropped, ...rest } = out;
+				out = rest;
+			} else out = {
+				...out,
+				WarmThroughput: coerced
+			};
 		}
-		return {
-			...entry,
-			WarmThroughput: coerced
+		const capacity = this.coerceIndexCapacityBlock(scope, declaredCapacity, maskSecrets);
+		if (capacity !== void 0) out = {
+			...out,
+			ProvisionedThroughput: capacity
 		};
+		return out;
 	}
 	/**
-	* Announce a TABLE-level `ProvisionedThroughput` member
-	* {@link tableCapacityForSend} DROPPED (issue
-	* [#3147](https://github.com/go-to-k/cdkd/issues/3147)).
-	*
-	* Called from BOTH table-level forwarders — `create()`'s `CreateTable` and
-	* the BillingMode flip's `UpdateTable` — because the member vanishes at each
-	* independently, and a drop that is never announced is the silent-narrowing
-	* class this file's other warn arms exist to end.
+	* One `CreateTable` index entry's `ProvisionedThroughput`, with each DECLARED
+	* member read through CloudFormation's DynamoDB Integer grammar (issue
+	* [#3255](https://github.com/go-to-k/cdkd/issues/3255)). Returns `undefined`
+	* when the block needs no rewriting at all.
+	*
+	* It reads through {@link readCapacityNumber} — the function the BillingMode
+	* flip's per-index forwarder calls — rather than restating the grammar, for
+	* the same reason {@link hasUsableDeclaredCapacity} does: that is what keeps
+	* create and flip answering identically about one template value.
+	*
+	* THREE decisions, each of which had a plausible alternative:
+	*
+	*  - **A rejected spelling drops the MEMBER, not the whole block.** This is
+	*    what {@link tableCapacityForSend} already does one level up for the
+	*    identical grammar, so create's two capacity forwarders answer the same
+	*    way; it keeps a sibling member the template spelled LEGALLY, which
+	*    dropping the block would discard; and it is the more informative
+	*    failure at AWS — `CreateTable` names the missing member at its exact
+	*    index position, where a missing block yields only
+	*    `ProvisionedThroughput must be specified for index: <name>`. Both
+	*    directions FAIL the deploy (DynamoDB requires both members on a
+	*    PROVISIONED index), so this is a choice of error TEXT, never of
+	*    outcome — what matters is that neither silently succeeds at a capacity
+	*    CloudFormation refuses the template for.
+	*
+	*    **That is also why this drop needs NO `effectiveProperties`**, which
+	*    `.claude/rules/provider-property-fidelity.md` otherwise requires of any
+	*    announced narrowing: the rule exists because a SUCCEEDING call plus a
+	*    record describing the declared value is permanent phantom drift. Here
+	*    `CreateTable` FAILS, so `create()` never returns and nothing is
+	*    recorded — the same reasoning `tableCapacityForSend` states for the
+	*    table-level omit one level up.
+	*  - **An ABSENT member stays absent — no `5` default.** The per-index
+	*    reader deliberately has none ({@link readCapacityNumber}'s doc, issue
+	*    #1588): a defaulted per-index capacity would land in cdkd state as if
+	*    the template had declared it, with no later call to correct it. Only
+	*    the TABLE level defaults.
+	*  - **A block that is not a plain object is forwarded VERBATIM**, the
+	*    fail-OPEN direction this file takes everywhere: an unresolved intrinsic
+	*    or a mis-nested template value is AWS's to reject by name, and that is
+	*    also the pre-existing behaviour of this forwarder.
+	*
+	* A member name the grammar does not know is preserved untouched, for the
+	* same fail-open reason — a misspelled `ReadCapacityUnit` reaches AWS and is
+	* named there rather than vanishing here.
+	*/
+	coerceIndexCapacityBlock(scope, declared, maskSecrets = (text) => text) {
+		if (!isPlainCapacityBlock(declared)) return void 0;
+		const block = declared;
+		let rewritten;
+		for (const member of PROVISIONED_CAPACITY_MEMBERS) {
+			if (!(member in block)) continue;
+			const coerced = readCapacityNumber(block, member);
+			if (coerced === block[member]) continue;
+			rewritten ??= { ...block };
+			if (coerced === void 0) {
+				this.warnUnusableProvisionedCapacity(scope, member, block[member], maskSecrets);
+				delete rewritten[member];
+			} else rewritten[member] = coerced;
+		}
+		return rewritten;
+	}
+	/**
+	* Announce a `ProvisionedThroughput` member a forwarder DROPPED (issue
+	* [#3147](https://github.com/go-to-k/cdkd/issues/3147); widened to the
+	* per-index create forwarder by issue
+	* [#3255](https://github.com/go-to-k/cdkd/issues/3255)).
+	*
+	* Called from all THREE forwarders that can drop one — `create()`'s
+	* `CreateTable` table-level block, the BillingMode flip's `UpdateTable`
+	* table-level block, and `create()`'s per-`GlobalSecondaryIndexes[]` block —
+	* because the member vanishes at each independently, and a drop that is
+	* never announced is the silent-narrowing class this file's other warn arms
+	* exist to end. `scope` names the resource or the index, so a table with
+	* several GSIs says WHICH one.
 	*
 	* It says NO capacity was substituted, which is the whole decision: the
 	* sibling `AWS::DynamoDB::GlobalTable` forwarders announce a 5/5 FALLBACK,
@@ -19511,9 +19745,9 @@ var DynamoDBTableProvider = class {
 	* table that does not exist. {@link tableCapacityForSend}'s doc carries why
 	* this type differs.
 	*/
-	warnUnusableTableCapacity(scope, member, raw, maskSecrets = (text) => text) {
+	warnUnusableProvisionedCapacity(scope, member, raw, maskSecrets = (text) => text) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
-		warn(`${scope}: ProvisionedThroughput.${member} ${JSON.stringify(maskLeafValue$1(raw, maskSecrets))} is not an Integer CloudFormation accepts (an optional sign and decimal digits only — no surrounding whitespace, hex, exponent or decimal point), so it was NOT sent and NO capacity was substituted for it. DynamoDB requires both members on a PROVISIONED table and will reject the request naming this one — CloudFormation refuses the same template at properties validation. Check for an unresolved intrinsic, or spell the value as a decimal integer.`);
+		warn(`${scope}: ProvisionedThroughput.${member} ${JSON.stringify(maskLeafValue$1(raw, maskSecrets))} is not an Integer CloudFormation accepts (an optional sign and decimal digits only — no surrounding whitespace, hex, exponent or decimal point), so it was NOT sent and NO capacity was substituted for it. DynamoDB requires both members wherever a PROVISIONED ProvisionedThroughput block is declared — the table itself, and every GlobalSecondaryIndexes[] entry of a PROVISIONED table — and will reject the request naming this one; CloudFormation refuses the same template at properties validation. Check for an unresolved intrinsic, or spell the value as a decimal integer.`);
 	}
 	/**
 	* Announce a `WarmThroughput` the send rule REFUSES (PR review of issue
@@ -25748,7 +25982,13 @@ var SSMParameterProvider = class {
 					await this.ssmClient.send(new DeleteParameterCommand({ Name: name }));
 					debug(`Cleaned up partially-created SSM parameter ${logicalId} (${name}) after wiring failure`);
 				} catch (cleanupError) {
-					warn(`Failed to clean up partially-created SSM parameter ${logicalId} (${name}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws ssm delete-parameter --name '${name}'`);
+					const deleteCommand = renderDisableCommand({
+						before: "aws ssm delete-parameter --name",
+						identifier: name,
+						maskSecrets: mask
+					});
+					const manualStep = deleteCommand ? `Manual deletion may be required before the next deploy: ${deleteCommand}` : "Manual deletion may be required before the next deploy, via the console: the parameter name cannot be reproduced safely on a command line, and a command naming the sanitized form would delete a DIFFERENT parameter.";
+					warn(`Failed to clean up partially-created SSM parameter ${logicalId} (${name}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. ${manualStep}`);
 				}
 				throw innerError;
 			}
@@ -25976,7 +26216,13 @@ var SSMParameterProvider = class {
 		const shape = isArn ? "an ARN" : "a version / label selector";
 		const remedy = input.knownPhysicalId === explicit ? `pass the parameter NAME instead: --resource ${input.logicalId}=<parameterName>` : `set Properties.Name to the parameter NAME rather than ${shape}`;
 		const whyNotDerived = isArn ? " cdkd deliberately does NOT derive the name from the ARN: the leading \"/\" is not recoverable (arn:...:parameter/foo is the ARN of BOTH the simple name \"foo\" and the hierarchical name \"/foo\"), and a parameter shared from another account has no name form at all — so a derived name could silently address a DIFFERENT parameter." : "";
-		throw new ProvisioningError(`Cannot adopt SSM parameter ${input.logicalId} from ${shape} ('${explicit}'): cdkd records a parameter's NAME as its physical id, because SSM's write APIs accept only the name (PutParameter and DeleteParameter both reject an ARN, and a name cannot contain ':'), so the next cdkd deploy and cdkd destroy would fail with a ValidationException. ${remedy}.${whyNotDerived} Read the name AWS holds with: aws ssm get-parameter --name '${explicit}' --query Parameter.Name --output text`, input.resourceType, input.logicalId);
+		const readCommand = renderDisableCommand({
+			before: "aws ssm get-parameter --name",
+			identifier: explicit,
+			after: "--query Parameter.Name --output text"
+		});
+		const howToRead = readCommand ? ` Read the name AWS holds with: ${readCommand}` : " Read the name AWS holds via the console: the value cdkd was given cannot be reproduced safely on a command line, so any command shown here would read a different parameter.";
+		throw new ProvisioningError(`Cannot adopt SSM parameter ${input.logicalId} from ${shape} ('${explicit}'): cdkd records a parameter's NAME as its physical id, because SSM's write APIs accept only the name (PutParameter and DeleteParameter both reject an ARN, and a name cannot contain ':'), so the next cdkd deploy and cdkd destroy would fail with a ValidationException. ${remedy}.${whyNotDerived}${howToRead}`, input.resourceType, input.logicalId);
 	}
 	/**
 	* Adopt an existing SSM parameter into cdkd state.
@@ -66054,7 +66300,7 @@ function indexNestedChildTemplates(template, templatePath) {
 		if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
 		const assetPath = resource.Metadata?.["aws:asset:path"];
 		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-		if (isAbsoluteCrossPlatform(assetPath)) throw new Error(`Nested stack '${logicalId}' has Metadata['aws:asset:path']='${assetPath}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
+		if (isAbsoluteCrossPlatform(assetPath)) throw new Error(`Nested stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
 		result[logicalId] = path.join(dir, assetPath);
 	}
 	return result;
@@ -66354,7 +66600,7 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 * fail at deploy time.
 */
 async function buildDiffTree(args) {
-	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption } = args;
+	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption, ancestorTemplatePaths } = args;
 	const state = await loadStateOrEmpty(stackName, region, stateBackend);
 	const secretBearingAbove = parentHasSecretReference === true || templateHasSecretDynamicReference(template);
 	const { changes, outputChanges, adoptedOrphans, adoptedRecords, blocking } = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, {
@@ -66390,6 +66636,9 @@ async function buildDiffTree(args) {
 		const childTemplatePath = nestedTemplates[logicalId];
 		if (!childTemplatePath) throw new Error(`Nested template file not found for ${NESTED_STACK_RESOURCE_TYPE} '${logicalId}' under stack '${stackName}'. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default), then re-run synth.`);
 		const childStackName = `${stackName}~${logicalId}`;
+		const resolvedChildPath = path.resolve(childTemplatePath);
+		if (ancestorTemplatePaths?.has(resolvedChildPath) === true) throw new Error(`Nested stack '${displaySafe(logicalId)}' under stack '${displaySafe(stackName)}' resolves to nested template '${displaySafe(resolvedChildPath)}', which is already being diffed higher up the same nesting chain. Its Metadata['aws:asset:path'] closes a cycle; CDK emits an acyclic nested template tree, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to diff.`);
+		const childAncestorTemplatePaths = new Set(ancestorTemplatePaths ?? []).add(resolvedChildPath);
 		const childTemplate = readNestedTemplate(childTemplatePath);
 		if (assetRedirect) rewriteTemplateAssetReferences(childTemplate, assetRedirect);
 		const grandchildTemplates = indexNestedChildTemplates(childTemplate, childTemplatePath);
@@ -66408,6 +66657,7 @@ async function buildDiffTree(args) {
 			...assetRedirect && { assetRedirect },
 			...cfnFallback !== void 0 && { cfnFallback },
 			...previewOrphanAdoption && { previewOrphanAdoption },
+			ancestorTemplatePaths: childAncestorTemplatePaths,
 			parentHasSecretReference: secretBearingAbove
 		}));
 	}
@@ -74649,6 +74899,39 @@ function createStateMigrateCommand() {
 //#endregion
 //#region src/cli/commands/state-list-tree.ts
 /**
+* How deep a node may sit below its root, counting the root as 0.
+*
+* A node that would sit deeper is made a root instead (see
+* {@link buildStackTree}). The value is far beyond any nesting an app is
+* written with: CloudFormation stops at five levels of nested stacks, so an
+* app that also has to deploy through CloudFormation cannot exceed that.
+* cdkd deploys nested stacks through its own engine and imposes no limit of
+* its own, so a deliberately deeper app CAN produce a tree this reshapes —
+* which is the point. The view stays whole either way.
+*
+* It exists because every step AFTER the tree is built recurses once per
+* level: this module's own child sort, the box-drawing renderer and
+* {@link stackTreeToJson}, plus the `JSON.stringify` that serializes that
+* shape for `--tree --json`. Capping the tree bounds all four at once, which
+* an iterative rewrite of any of them could not: `JSON.stringify` recurses
+* into whatever nesting it is handed, and the text view indents four
+* characters per level, so a chain deep enough would need more indentation
+* than a string can hold.
+*
+* It bounds the DEPTH, not the bucket, and what it does to the failure at the
+* far end is change its KIND. Before the cap, one deep chain exhausted the
+* CALL STACK, at a record count nothing fixes — V8's budget moves with frame
+* size and with what else is on the stack. After it, every recursion is at
+* most a hundred frames and the remaining ceiling is V8's maximum STRING
+* length: a capped tree still costs a roughly constant number of characters
+* per record (the cap's own pretty-print indent dominates in `--tree --json`),
+* so `JSON.stringify` refuses a large enough bucket deterministically instead
+* of at a moving depth. Both are far past `renderTreeMode`'s unbounded
+* one-read-per-reference fan-out, which gives out first. Read the cap as what
+* stops a SINGLE chain taking the view down, not as a total bound.
+*/
+const MAX_STACK_TREE_DEPTH = 100;
+/**
 * Build a parent → child tree from the flat list of state records.
 *
 * Children are linked to their parent by `(parentStack, parentRegion)`
@@ -74664,6 +74947,17 @@ function createStateMigrateCommand() {
 * from both the text and the JSON view. A node hanging off a loop still sits
 * under its parent, which is now visible (issue #3069).
 *
+* A node that would sit deeper than {@link MAX_STACK_TREE_DEPTH} levels below
+* its root is placed at the root too, so the chain resumes there as its own
+* tree. Every record still appears exactly once, and a tree within the cap is
+* built as before. Without it a long enough chain took the whole view down with
+* a `RangeError` instead of costing only its own rows, since the recursive
+* steps AFTER this function are not covered by the per-stack guard around the
+* state read. Reaching the depths that failed takes thousands of records — in
+* practice a hand-edited bucket, or records planted by someone holding
+* `s3:PutObject` on it — but nothing in cdkd bounds the depth, so the cap does
+* (issue #3155).
+*
 * The roots and every child list are sorted alphabetically by `stackName`,
 * then by `region` (legacy `undefined` last), so output is stable across
 * runs.
@@ -74690,10 +74984,26 @@ function buildStackTree(entries) {
 		if (current !== void 0 && onPath.has(current)) for (const member of path.slice(onPath.get(current))) loopMembers.add(member);
 		for (const node of path) settled.add(node);
 	}
+	const depthOf = /* @__PURE__ */ new Map();
+	for (const member of loopMembers) depthOf.set(member, 0);
+	for (const start of byKey.values()) {
+		if (depthOf.has(start)) continue;
+		const path = [];
+		let current = start;
+		while (current !== void 0 && !depthOf.has(current)) {
+			path.push(current);
+			current = parentOf(current);
+		}
+		let depth = current === void 0 ? -1 : depthOf.get(current);
+		for (let i = path.length - 1; i >= 0; i--) {
+			depth = depth + 1 > 100 ? 0 : depth + 1;
+			depthOf.set(path[i], depth);
+		}
+	}
 	const roots = [];
 	for (const node of byKey.values()) {
 		const parent = parentOf(node);
-		if (parent && !loopMembers.has(node)) {
+		if (parent && depthOf.get(node) > 0) {
 			parent.children.push(node);
 			continue;
 		}
@@ -78727,6 +79037,12 @@ async function stateListCommand(options) {
 *
 * `tree --json` emits the nested {@link import('./state-list-tree.js').StackTreeJson}
 * shape; plain `tree` renders `tree(1)`-style box-drawing.
+*
+* The `JSON.stringify` below recurses once per level of the shape it is handed,
+* and so does the box-drawing renderer. Neither needs a depth guard here:
+* `buildStackTree` caps how deep a node may sit
+* ({@link import('./state-list-tree.js').MAX_STACK_TREE_DEPTH}), which bounds
+* both (issue #3155).
 */
 async function renderTreeMode(refs, stateBackend, asJson) {
 	const entries = await Promise.all(refs.map(async (ref) => {
@@ -94172,4 +94488,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BBgCW2BX.js.map
+//# sourceMappingURL=program-U03H43s7.js.map