@go-to-k/cdkd 0.290.25 → 0.290.27

package/dist/{program-babtsurS.js → program-dYPgGoOv.js}

@@ -1,8 +1,8 @@
-import { $ as secretBearing, $i as normalizeAwsError, $n as redactSecretsForState, $r as synthesisStatusMessage, $t as s3BucketArn, A as extractDeploymentEventError, An as repairMalformedResourcePropertiesForReadOnly, Ar as getBootstrapMarkerKey, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bn as STATE_SOURCED_READBACK_RULES, Br as describeDockerFailure, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as processStackMessages, Cn as refuseMalformedNestedChildOutputs, Cr as createAssetRedirectResolver, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Di as getAwsClients, Dn as refuseMalformedResourcesForDestroy, Dr as BOOTSTRAP_MARKER_PREFIX, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as AwsClients, En as refuseMalformedResourcePropertiesForOrphan, Er as AssetModeResolver, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fi as DeployCancelledError, Fn as withRetry, Fr as validateContainerRepoName, Ft as isSettledInstanceState, G as gray, Gi as ResourceTimeoutError, Gn as errorCauseChain, Gr as redactDockerArgvValues, Gt as readConfigString, H as formatResourceLine, Hi as NestedStackChildDirectDestroyError, Hn as carriesSecretMask, Hr as formatDockerLoginError, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as DynamicReferenceRegionAmbiguousError, In as DagBuilder, Ir as buildDenyExternalAccessPolicy, It as WAFv2WebACLProvider, J as yellow, Ji as StackTerminationProtectionError, Jn as markSameGenerationBag, Jr as escapeRegExp, Jt as requireConfigObject, K as green, Ki as ResourceUpdateNotSupportedError, Kn as identityKeyFor, Kr as runDockerForeground, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Li as IntrinsicResolutionRefusalError, Ln as TemplateParser, Lr as buildDockerImage, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mn as findActionableSilentDrops, Mr as parseBootstrapMarker, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ni as CrossAccountSecretRefusalError, Nn as findSilentDropProperties, Nr as readBootstrapMarkerBody, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as resetAwsClients, On as refuseMalformedState, Or as assertAssetBucketRegion, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pn as describeTypeWithThrottleRetry, Pr as validateAssetBucketName, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as recoverMaskedOutput, Qr as Synthesizer, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as LocalInvokeBuildError$1, Rn as STATE_SOURCED_BASELINE_RULES, Rr as describeDockerCapturedOutput, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as AssemblyReader, Sn as refuseDivergentRecordRegionForDestroy, Sr as buildAssetRedirectMap, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as resolveBucketRegion, Tn as refuseMalformedOutputsForDestroy, Tr as rewriteTemplateAssetReferences, Tt as carriesDynamicReference, U as bold, Ui as PartialFailureError, Un as createSecretMasker, Ur as getDockerCmd, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as MalformedProducerRecordRefusalError, Vn as TEMPLATE_SOURCED_RULES, Vr as dockerSpawnEnvWithSensitive, Vt as coerceCfnInteger, W as cyan, Wi as ProvisioningError, Wn as dynamicReferenceTokens, Wr as partitionSensitiveEnv, Wt as configStringRefusal, X as collectPublishedOutputNames, Xn as maskSecretsInText, Xr as AssetManifestLoader, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yn as maskSecretsInError, Yr as stripControlChars, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zn as recordMaskOnlyValue, Zr as getDockerImageBySourceHash, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as decodeListingKey, _n as malformedRenderedContainersWarning, _r as orphansCarriedFrom, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as markNonRetryable, ai as resolveSkipPrefix, an as applyCallerIdentityCredentials, ar as buildLockContentionMessage, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as canonicalizeRegion, bn as malformedStateRefusalMessage, br as stringifyValue, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as describeAwsFailure, ci as resolveUseCdkBootstrapAssets, cn as INTRINSIC_KEYS, cr as shellQuote, ct as createMaskedRetryLogger, d as updatePartialReason, di as CFN_TEMPLATE_BODY_LIMIT, dn as hasReadableResources, dr as exportNamesCarriedFrom, dt as beginCommandInterruptScope, ea as withErrorHandling, ei as getDefaultStateBucketName, en as s3BucketDomainName, er as scrubResourceRecord, et as secretBearingStateKeyWarning, f as withResourceDeadline, fi as CFN_TEMPLATE_URL_LIMIT, fn as malformedExportNamesWarning, fr as hasReadableExportSet, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, gn as malformedOutputsWarning, gr as orphansAfterRollback, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as uploadCfnTemplate, hn as malformedOutputsRefusalMessage, hr as isReadableBag, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isTransientServerError, ii as resolveCaptureObservedState, in as applyRoleArnIfSet, ir as buildForceUnlockCommand, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as CdkdError, jn as repairMalformedResourcesForReadOnly, jr as isCrossRegionRedirect, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as setAwsClients, kn as repairMalformedOutputsForReadOnly, kr as ensureAssetStorage, kt as getAccountInfo, l as replayRollback, la as safeStringify, li as stateBucketExistenceConfirmed, ln as STATE_RESOURCES_MALFORMED, lr as CUSTOM_RESOURCE_RESPONSE_PREFIX, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as findLargeInlineResources, mn as malformedLocalOutputsWarning, mr as importableOutputs, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as isRetryableTransientError, ni as resolveApp, nn as s3BucketRegionalDomainName, nr as S3StateBackend, nt as getCurrentResourceSecrets, o as planFailedOps, oa as markRedactedCause, oi as resolveStateBucketWithDefault, on as callerEnvCredentials, or as forceQuitRecoveryClause, ot as ProviderRegistry, p as maskingRetryLogger, pi as MIGRATE_TMP_PREFIX, pn as malformedExportSourceWarning, pr as importableOutputKeys, pt as interruptWatchListenerCount, q as red, qi as StackHasActiveImportsError, qn as isSingleDynamicReferenceToken, qr as runDockerStreaming, qt as requireConfigArray, r as DeployEngine, ra as isThrottlingError, ri as resolveAutoAssetStorage, rn as s3BucketWebsiteUrl, rr as rebuildClientForBucketRegion, rt as IAMRoleProvider, s as planRollback, sa as retryClassificationText, si as resolveStateBucketWithDefaultAndSource, sn as DiffCalculator, sr as formatLockExpiry, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as isMarkedNonRetryable, ti as getLegacyStateBucketName, tn as s3BucketDualStackDomainName, tr as LockManager, tt as secretSafeKeyDisplay, u as updatePartialMessage, ui as warnDeprecatedNoPrefixCliFlag, un as hasReadableOutputs, ur as DEFAULT_STATE_PREFIX, ut as maskerOrIdentity, v as keptWholeReasonText, vi as expectedOwnerParam, vn as malformedResourcePropertiesWarning, vr as shouldRetainResource, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wn as refuseMalformedOutputs, wr as loadPublishableAssetManifest, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as derivePartitionAndUrlSuffix, xn as producerRecordKey, xr as WorkGraph, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as PARTITION_TABLE, yn as malformedResourcesWarning, yr as AssetPublisher, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as LocalStartServiceError, zn as STATE_SOURCED_CROSS_GENERATION_RULES, zr as describeDockerExecFailure, zt as assertRegionMatch } from "./deploy-engine-DtFiFMxh.js";
+import { $ as secretBearing, $n as recordMaskOnlyValue, $r as getDockerImageBySourceHash, $t as s3BucketArn, A as extractDeploymentEventError, Ai as resetAwsClients, An as refuseMalformedState, Ar as assertAssetBucketRegion, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as LocalInvokeBuildError$1, Bn as STATE_SOURCED_BASELINE_RULES, Br as describeDockerCapturedOutput, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as derivePartitionAndUrlSuffix, Cn as producerRecordKey, Cr as WorkGraph, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Di as resolveBucketRegion, Dn as refuseMalformedOutputsForDestroy, Dr as rewriteTemplateAssetReferences, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, En as refuseMalformedOutputs, Er as loadPublishableAssetManifest, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fi as CrossAccountSecretRefusalError, Fn as findSilentDropProperties, Fr as readBootstrapMarkerBody, Ft as isSettledInstanceState, G as gray, Gi as PartialFailureError, Gn as createSecretMasker, Gr as getDockerCmd, Gt as readConfigString, H as formatResourceLine, Hn as STATE_SOURCED_READBACK_RULES, Hr as describeDockerFailure, Ht as configBooleanRefusal, I as renderStatefulReason, In as describeTypeWithThrottleRetry, Ir as validateAssetBucketName, It as WAFv2WebACLProvider, J as yellow, Ji as ResourceUpdateNotSupportedError, Jn as identityKeyFor, Jr as runDockerForeground, Jt as requireConfigObject, K as green, Ki as ProvisioningError, Kn as dynamicReferenceTokens, Kr as partitionSensitiveEnv, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Li as DeployCancelledError, Ln as withRetry, Lr as validateContainerRepoName, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mn as repairMalformedResourcePropertiesForReadOnly, Mr as getBootstrapMarkerKey, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ni as CdkdError, Nn as repairMalformedResourcesForReadOnly, Nr as isCrossRegionRedirect, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as AwsClients, On as refuseMalformedResourcePropertiesForOrphan, Or as AssetModeResolver, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pn as findActionableSilentDrops, Pr as parseBootstrapMarker, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as maskSecretsInText, Qr as AssetManifestLoader, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as DynamicReferenceRegionAmbiguousError, Rn as DagBuilder, Rr as buildDenyExternalAccessPolicy, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as canonicalizeRegion, Sn as malformedStateRefusalMessage, Sr as stringifyValue, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as processStackMessages, Tn as refuseMalformedNestedChildOutputs, Tr as createAssetRedirectResolver, Tt as carriesDynamicReference, U as bold, Ui as MalformedProducerRecordRefusalError, Un as TEMPLATE_SOURCED_RULES, Ur as dockerSpawnEnvWithSensitive, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as LocalStartServiceError, Vn as STATE_SOURCED_CROSS_GENERATION_RULES, Vr as describeDockerExecFailure, Vt as coerceCfnInteger, W as cyan, Wi as NestedStackChildDirectDestroyError, Wn as carriesSecretMask, Wr as formatDockerLoginError, Wt as configStringRefusal, X as collectPublishedOutputNames, Xi as StackTerminationProtectionError, Xn as markSameGenerationBag, Xr as escapeRegExp, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as StackHasActiveImportsError, Yn as isSingleDynamicReferenceToken, Yr as runDockerStreaming, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zn as maskSecretsInError, Zr as stripControlChars, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as uploadCfnTemplate, _n as malformedOutputsRefusalMessage, _r as isReadableBag, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isThrottlingError, ai as resolveAutoAssetStorage, an as AWS_CREDENTIAL_ENV_KEYS, ar as rebuildClientForBucketRegion, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as expectedOwnerParam, bn as malformedResourcePropertiesWarning, br as shouldRetainResource, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as markRedactedCause, ci as resolveStateBucketWithDefault, cn as envCredentialsAreAssumedRole, cr as forceQuitRecoveryClause, ct as createMaskedRetryLogger, d as updatePartialReason, da as safeStringify, di as stateBucketExistenceConfirmed, dn as STATE_RESOURCES_MALFORMED, dr as CUSTOM_RESOURCE_RESPONSE_PREFIX, dt as beginCommandInterruptScope, ei as Synthesizer, en as s3BucketDomainName, er as recoverMaskedOutput, et as secretBearingStateKeyWarning, f as withResourceDeadline, fi as warnDeprecatedNoPrefixCliFlag, fn as hasReadableOutputs, fr as DEFAULT_STATE_PREFIX, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as findLargeInlineResources, gn as malformedLocalOutputsWarning, gr as importableOutputs, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as MIGRATE_TMP_PREFIX, hn as malformedExportSourceWarning, hr as importableOutputKeys, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isRetryableTransientError, ii as resolveApp, in as applyRoleArnIfSet, ir as S3StateBackend, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as setAwsClients, jn as repairMalformedOutputsForReadOnly, jr as ensureAssetStorage, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as getAwsClients, kn as refuseMalformedResourcesForDestroy, kr as BOOTSTRAP_MARKER_PREFIX, kt as getAccountInfo, l as replayRollback, la as retryClassificationText, li as resolveStateBucketWithDefaultAndSource, ln as DiffCalculator, lr as formatLockExpiry, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as CFN_TEMPLATE_URL_LIMIT, mn as malformedExportNamesWarning, mr as hasReadableExportSet, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as withErrorHandling, ni as getDefaultStateBucketName, nn as s3BucketRegionalDomainName, nr as scrubResourceRecord, nt as getCurrentResourceSecrets, o as planFailedOps, oa as isTransientServerError, oi as resolveCaptureObservedState, on as applyCallerIdentityCredentials, or as buildForceUnlockCommand, ot as ProviderRegistry, p as maskingRetryLogger, pi as CFN_TEMPLATE_BODY_LIMIT, pn as hasReadableResources, pr as exportNamesCarriedFrom, pt as interruptWatchListenerCount, q as red, qi as ResourceTimeoutError, qn as errorCauseChain, qr as redactDockerArgvValues, qt as requireConfigArray, r as DeployEngine, ra as isMarkedNonRetryable, ri as getLegacyStateBucketName, rn as s3BucketWebsiteUrl, rr as LockManager, rt as IAMRoleProvider, s as planRollback, sa as markNonRetryable, si as resolveSkipPrefix, sn as callerEnvCredentials, sr as buildLockContentionMessage, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as normalizeAwsError, ti as synthesisStatusMessage, tn as s3BucketDualStackDomainName, tr as redactSecretsForState, tt as secretSafeKeyDisplay, u as updatePartialMessage, ua as describeAwsFailure, ui as resolveUseCdkBootstrapAssets, un as INTRINSIC_KEYS, ur as shellQuote, ut as maskerOrIdentity, v as keptWholeReasonText, vi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, vn as malformedOutputsWarning, vr as orphansAfterRollback, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as AssemblyReader, wn as refuseDivergentRecordRegionForDestroy, wr as buildAssetRedirectMap, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as PARTITION_TABLE, xn as malformedResourcesWarning, xr as AssetPublisher, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as decodeListingKey, yn as malformedRenderedContainersWarning, yr as orphansCarriedFrom, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as IntrinsicResolutionRefusalError, zn as TemplateParser, zr as buildDockerImage, zt as assertRegionMatch } from "./deploy-engine-CA70_Rji.js";
 import { C as displaySafe, S as displayIdent, _ as withSkipPrefix, b as STACK_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE } from "./logger-CkHVgzLx.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-CduXA6UL.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DL62n7uG.js";
+import { t as getCdkdVersion } from "./version-CWpPiHCn.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-Dn1f0SJi.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -17849,6 +17849,105 @@ const PROVISIONED_CAPACITY_MEMBERS = ["ReadCapacityUnits", "WriteCapacityUnits"]
 */
 const ON_DEMAND_CEILING_MEMBERS = ["MaxReadRequestUnits", "MaxWriteRequestUnits"];
 /**
+* Narrow ONE `OnDemandThroughput` block to exactly what cdkd puts on the wire,
+* and report the members that were DROPPED (issue
+* [#3287](https://github.com/go-to-k/cdkd/issues/3287)).
+*
+* The ONE spelling of that transform, and that is the whole reason it is a
+* module-level PURE function rather than a method: two callers need the same
+* answer and one of them may not log.
+*
+*  - {@link DynamoDBTableProvider.coerceOnDemandCeilingsForSend} — the WIRE, at
+*    all six send sites, which announces each `dropped` member;
+*  - {@link DynamoDBTableProvider.indexCeilingForSend}'s per-index change
+*    detector, which compares the desired and recorded blocks and must not warn
+*    (the warning is the send's, one line further down, and a detector that
+*    announced would fire on a comparison that emits no op at all).
+*
+* Behaviour is BYTE-identical to what `coerceOnDemandCeilingsForSend` did
+* inline before issue [#3287](https://github.com/go-to-k/cdkd/issues/3287),
+* including the two identity properties its callers
+* depend on: a block that is not a plain object comes back AS ITSELF (AWS names
+* the shape), and a block needing no rewrite comes back by IDENTITY, so
+* {@link DynamoDBTableProvider.coerceIndexThroughputForCreate} can still tell
+* "unchanged" from "rewritten" without a structural compare. A member name the
+* grammar does not know is preserved untouched, the same fail-open direction.
+*
+* `dropped` carries the RAW declared value beside each member name because the
+* warning interpolates it, and only the masking caller may do that.
+*/
+function narrowOnDemandCeilings(declared) {
+	if (!isPlainCapacityBlock(declared)) return {
+		block: declared,
+		dropped: []
+	};
+	const block = declared;
+	let rewritten;
+	const dropped = [];
+	for (const member of ON_DEMAND_CEILING_MEMBERS) {
+		if (!(member in block)) continue;
+		const coerced = coerceCfnInteger(block[member]);
+		if (coerced === block[member] && coerced !== void 0) continue;
+		rewritten ??= { ...block };
+		if (coerced === void 0) {
+			dropped.push({
+				member,
+				raw: block[member]
+			});
+			delete rewritten[member];
+		} else rewritten[member] = coerced;
+	}
+	return {
+		block: rewritten ?? block,
+		dropped
+	};
+}
+/**
+* Does the ceiling AWS currently holds for a GSI already cover every member
+* cdkd is about to send? (issue
+* [#3287](https://github.com/go-to-k/cdkd/issues/3287))
+*
+* The `OnDemandThroughput` twin of {@link liveCapacityAlreadyMatches}, and it
+* exists for the same #1630 reason: cdkd writes state only after `update()`
+* RETURNS, so a ceiling op that already LANDED before a later step threw is
+* unrecorded and the next deploy re-emits it. Consulting what AWS holds is what
+* lets the deploy converge instead.
+*
+* Compared PER MEMBER over the members being SENT, deliberately, and it differs
+* from the capacity sibling in exactly that: omitting a ceiling member KEEPS
+* whatever maximum the table already carries (only an explicit `-1` removes
+* one), so a member cdkd is not sending says nothing about whether the call is
+* redundant. A live member the request does not carry is therefore ignored.
+*
+* Anything unreadable on EITHER side fails OPEN (the op is still emitted): an
+* absent live block — which is also what `DescribeTable` reports for a
+* PROVISIONED table, where the numbers do not exist — an absent live member, a
+* value that is not a number. That is the correct direction: the worst case is
+* the pre-fix behaviour of emitting the op, whereas a false MATCH would
+* silently drop a ceiling change the user asked for.
+*
+* **What AWS does with a repeated identical ceiling is UNMEASURED**, and this
+* guard is written so that it does not matter: it withholds only a call that
+* would change nothing. If DynamoDB rejects the repeat the way it rejects a
+* repeated provisioned capacity ("The provisioned throughput for the index X
+* will not change"), the guard is what keeps the deploy from wedging; if it
+* accepts it, the guard saves a call and a full index-ACTIVE wait. Measuring it
+* would sharpen the doc, not the code.
+*/
+function liveCeilingAlreadyMatches(live, requested) {
+	if (live === void 0) return false;
+	const liveBag = live;
+	let compared = 0;
+	for (const member of ON_DEMAND_CEILING_MEMBERS) {
+		if (!(member in requested)) continue;
+		const want = toFiniteNumber(requested[member]);
+		const have = toFiniteNumber(liveBag[member]);
+		if (want === void 0 || have === void 0 || want !== have) return false;
+		compared += 1;
+	}
+	return compared > 0;
+}
+/**
 * The capacity both TABLE-level forwarders substitute for a member the
 * template does not declare at all — `create()`'s `CreateTable` and the
 * BillingMode flip's `UpdateTable`. It is the pre-issue-#3147 `?? 5`, kept
@@ -18313,15 +18412,27 @@ function reverseMapSecondaryIndex(live, desired, bagInformative) {
 *    [#3255](https://github.com/go-to-k/cdkd/issues/3255), across ALL FOUR
 *    per-index send sites (`create()`'s mapper plus `applyGsiUpdates`'
 *    adopted-repair, `Create` and same-name `Update` actions);
-*    `OnDemandThroughput`'s from issue
-*    [#3265](https://github.com/go-to-k/cdkd/issues/3265), across its own four
-*    (the two TABLE-level forwards plus `create()`'s mapper and
-*    `applyGsiUpdates`' `Create` action) — ever SUPPRESSES the block: each
+*    `OnDemandThroughput`'s from issues
+*    [#3265](https://github.com/go-to-k/cdkd/issues/3265) and
+*    [#3287](https://github.com/go-to-k/cdkd/issues/3287), across its own SIX
+*    (the two TABLE-level forwards, `create()`'s mapper, and all three
+*    `applyGsiUpdates` actions) — ever SUPPRESSES the block: each
 *    rewrites members inside a block that is sent either way, so "would cdkd
 *    send this block" is unchanged by them, even where both members were
 *    dropped and an empty block goes out. That is the reason
 *    {@link DynamoDBTableProvider.coerceOnDemandCeilingsForSend} drops a
-*    MEMBER and never the block. Widening
+*    MEMBER and never the block.
+*
+*    **The two per-index UPDATE arms added by #3287 are the ONE qualification,
+*    and it does not reach this predicate.**
+*    {@link DynamoDBTableProvider.indexCeilingForSend} withholds the MEMBER
+*    from an `UpdateGlobalSecondaryIndexAction` when nothing survived, because
+*    an action carrying only `IndexName` is rejected outright — where the
+*    TABLE-level arm sends the empty block and lets DynamoDB answer. That is a
+*    statement about one OP, not about whether the template declared a block
+*    cdkd forwards: the same bag still reaches `CreateTable` / `UpdateTable`
+*    wherever those arms run, so the predicate's answer is unchanged.
+*    Widening
 *    `isSendableWarmThroughput` over them would be wrong twice over — it reads
 *    members those blocks do not have (`ReadUnitsPerSecond` vs
 *    `ReadCapacityUnits`), so every declared capacity would read as undeclared.
@@ -18632,8 +18743,8 @@ var DynamoDBTableProvider = class {
 					if (tableCapacityUnusable) reasons.push(`the template declares no usable table-level ProvisionedThroughput`);
 					warn(`AWS::DynamoDB::Table ${logicalId}: this deploy removes global secondary index(es) ${removable.map((n) => maskSecrets(n)).join(", ")} and flips BillingMode to PROVISIONED. The removal would normally be applied BEFORE the flip, but ${reasons.join(" and ")}, so AWS rejects the flip either way. Nothing was removed.`);
 				} else if (removable.length > 0) {
-					this.logger.debug(`Deleting GSI(s) ${removable.join(", ")} on DynamoDB table ${physicalId} before the BillingMode flip to PROVISIONED`);
-					await this.runGsiOps(physicalId, removable.map((name) => ({ Delete: { IndexName: name } })), void 0);
+					debug(`Deleting GSI(s) ${removable.join(", ")} on DynamoDB table ${physicalId} before the BillingMode flip to PROVISIONED`);
+					await this.runGsiOps(physicalId, removable.map((name) => ({ Delete: { IndexName: name } })), void 0, maskSecrets);
 					for (const name of removable) preFlipDeletedIndexNames.add(name);
 				}
 			}
@@ -19318,6 +19429,7 @@ var DynamoDBTableProvider = class {
 	*/
 	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip = /* @__PURE__ */ new Set(), liveIndexNames, liveIndexByName, liveCapacityComparable = false, maskSecrets = (text) => text) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
+		const debug = (message) => this.logger.debug(maskSecrets(message));
 		const prev = previousGsis ?? [];
 		const desired = desiredGsis ?? [];
 		const prevByName = new Map(prev.filter((g) => g.IndexName).map((g) => [g.IndexName, g]));
@@ -19326,7 +19438,7 @@ var DynamoDBTableProvider = class {
 		for (const name of prevByName.keys()) {
 			if (desiredByName.has(name)) continue;
 			if (liveIndexNames !== void 0 && !liveIndexNames.has(name)) {
-				this.logger.debug(`GSI ${name} is recorded in cdkd state but not live on DynamoDB table ${physicalId}; skipping its Delete (already removed)`);
+				debug(`${this.indexScopeAt(name, physicalId, maskSecrets)} is recorded in cdkd state but not live; skipping its Delete (already removed)`);
 				continue;
 			}
 			ops.push({ Delete: { IndexName: name } });
@@ -19335,7 +19447,7 @@ var DynamoDBTableProvider = class {
 			const live = liveIndexByName?.get(name);
 			if (!gsi.KeySchema) throw new ProvisioningError(`GlobalSecondaryIndex ${name} on DynamoDB table ${logicalId} is missing KeySchema`, resourceType, logicalId, physicalId);
 			if (live !== void 0 && live.IndexStatus !== "DELETING") {
-				warn(`GSI ${maskSecrets(name)} on DynamoDB table ${physicalId} already exists in AWS but is absent from cdkd's recorded previous state, so its Create is being skipped. This usually means an earlier deploy created the index and then failed before state was written.`);
+				warn(`${this.indexScopeAt(name, physicalId, maskSecrets)} already exists in AWS but is absent from cdkd's recorded previous state, so its Create is being skipped. This usually means an earlier deploy created the index and then failed before state was written.`);
 				const adopted = { IndexName: name };
 				let adoptedHasMember = false;
 				if (liveCapacityComparable && gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && !liveCapacityAlreadyMatches(live.ProvisionedThroughput, gsi.ProvisionedThroughput) && !this.skipZeroCapacityIndexUpdate(name, physicalId, gsi.ProvisionedThroughput, maskSecrets)) {
@@ -19347,8 +19459,13 @@ var DynamoDBTableProvider = class {
 					adopted.WarmThroughput = adoptedWarm;
 					adoptedHasMember = true;
 				}
+				const adoptedCeiling = this.indexCeilingForSend(name, physicalId, gsi, void 0, live, maskSecrets);
+				if (adoptedCeiling) {
+					adopted.OnDemandThroughput = adoptedCeiling;
+					adoptedHasMember = true;
+				}
 				if (adoptedHasMember) ops.push({ Update: adopted });
-				warn(`GSI ${maskSecrets(name)} was adopted from AWS rather than created, so cdkd could not verify its KeySchema / Projection match the template. Run \`cdkd drift ${physicalId}\` to confirm, and \`cdkd drift --accept\` if AWS is the source of truth.`);
+				warn(`${this.indexScopeAt(name, physicalId, maskSecrets)} was adopted from AWS rather than created, so cdkd could not verify its KeySchema / Projection match the template. Run \`cdkd drift ${physicalId}\` to confirm, and \`cdkd drift --accept\` if AWS is the source of truth.`);
 				continue;
 			}
 			this.warnRefusedWarmThroughput(this.indexScopeAt(name, physicalId, maskSecrets), gsi.WarmThroughput, maskSecrets);
@@ -19367,7 +19484,7 @@ var DynamoDBTableProvider = class {
 			const update = { IndexName: name };
 			let updateHasMember = false;
 			if (gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && JSON.stringify(before.ProvisionedThroughput) !== JSON.stringify(gsi.ProvisionedThroughput)) {
-				if (liveCapacityComparable && liveCapacityAlreadyMatches(liveIndexByName?.get(name)?.ProvisionedThroughput, gsi.ProvisionedThroughput)) this.logger.debug(`GSI ${name} on DynamoDB table ${physicalId} already carries the requested capacity in AWS; skipping its throughput Update`);
+				if (liveCapacityComparable && liveCapacityAlreadyMatches(liveIndexByName?.get(name)?.ProvisionedThroughput, gsi.ProvisionedThroughput)) debug(`${this.indexScopeAt(name, physicalId, maskSecrets)} already carries the requested capacity in AWS; skipping its throughput Update`);
 				else if (!this.skipZeroCapacityIndexUpdate(name, physicalId, gsi.ProvisionedThroughput, maskSecrets)) {
 					update.ProvisionedThroughput = this.indexCapacityForSend(this.indexScopeAt(name, physicalId, maskSecrets), gsi.ProvisionedThroughput, maskSecrets);
 					updateHasMember = true;
@@ -19378,9 +19495,14 @@ var DynamoDBTableProvider = class {
 				update.WarmThroughput = warm;
 				updateHasMember = true;
 			}
+			const ceiling = this.indexCeilingForSend(name, physicalId, gsi, before, liveIndexByName?.get(name), maskSecrets);
+			if (ceiling) {
+				update.OnDemandThroughput = ceiling;
+				updateHasMember = true;
+			}
 			if (updateHasMember) ops.push({ Update: update });
 		}
-		await this.runGsiOps(physicalId, ops, desiredAttributeDefinitions);
+		await this.runGsiOps(physicalId, ops, desiredAttributeDefinitions, maskSecrets);
 	}
 	/**
 	* The NUMERIC `WarmThroughput` spec to put on the wire, announcing any member
@@ -19467,6 +19589,136 @@ var DynamoDBTableProvider = class {
 		return this.coerceIndexCapacityBlock(scope, declared, maskSecrets) ?? declared;
 	}
 	/**
+	* The per-index `OnDemandThroughput` an `UpdateGlobalSecondaryIndexAction`
+	* should carry, or `undefined` when no op is warranted (issue
+	* [#3287](https://github.com/go-to-k/cdkd/issues/3287)).
+	*
+	* The whole of that issue: `UpdateGlobalSecondaryIndexAction` declares the
+	* member, the SDK has always accepted it, and NEITHER update arm ever set it
+	* — while the `Create` action arm has carried it since issue #3265. So one
+	* template applied a per-index ceiling when the index was ADDED and silently
+	* discarded a later edit to it, recording the new value as applied so no
+	* later deploy converged. Routed through
+	* {@link coerceOnDemandCeilingsForSend} like the other five sites, so one
+	* template value cannot be answered differently at two of them.
+	*
+	* FIVE decisions, in the order the op is decided, plus one deliberate NON-decision:
+	*
+	*  - **The declaration gate is TRUTHINESS**, matching `indexDeclares`' gate
+	*    for this block and the `Create` arm's `gsi.OnDemandThroughput` test. A
+	*    tighter gate here would make the #1767 drift-side predicate answer
+	*    "declared" for a block this arm skips.
+	*  - **The BILLING MODE is deliberately NOT gated here**, and that is a
+	*    decision with a filed issue rather than an oversight. DynamoDB accepts
+	*    `OnDemandThroughput` only on a PAY_PER_REQUEST table, and the ceiling
+	*    rides the SAME action as the capacity — so on a PROVISIONED one the op
+	*    is rejected and takes an otherwise-valid capacity edit with it. A gate
+	*    WITHHOLDING the member was written for the go-to-k/cdkd#3380 review's M1
+	*    and REVERTED on the next round: a mid-update warn-and-skip lets the
+	*    deploy succeed, so the engine records the un-sent ceiling as applied and
+	*    the deploy that FIXES the billing mode then compares equal and never
+	*    sends it — issue #3287's own defect, reintroduced by its own guard. The
+	*    file's table-level twin states that reasoning at its own refusal. The
+	*    correct shape is a PRE-FLIGHT refusal covering all THREE per-index send
+	*    sites (the `Create` arm has carried the same defect since #3265), which
+	*    is issue [#3392](https://github.com/go-to-k/cdkd/issues/3392). Until
+	*    then AWS validates the constraint, exactly as it does for the
+	*    TABLE-level arm and for the `Create` action.
+	*
+	*    **That IS a behaviour change on this shape, stated rather than glossed**
+	*    (round 3's C4). Before #3287 neither `Update` arm sent the member, so a
+	*    PROVISIONED table declaring a per-index ceiling deployed GREEN with the
+	*    ceiling silently ignored. Now the same-name arm sends it once the
+	*    ceiling CHANGES, AWS rejects the `UpdateTable`, and the co-resident
+	*    capacity / warm edits fail with it; the adopted-index arm has no
+	*    recorded previous side to gate on, so it re-fails every deploy until the
+	*    template is edited. Loud and recording nothing beats silent and lost,
+	*    which is why it ships this way rather than behind the withdrawn skip —
+	*    but it is a change, and #3392 is what makes it a cdkd-worded refusal
+	*    before any call instead of an AWS rejection after one.
+	*  - **The change detector compares the NARROWED blocks WHEN NOTHING WAS
+	*    DROPPED, and the RAW ones otherwise** — the one place it differs from its
+	*    `ProvisionedThroughput` sibling two arms up. `'200'` and `200` are the
+	*    SAME ceiling once coerced, so a purely narrowed detector saves an
+	*    `UpdateGlobalSecondaryIndexAction` — and a full index-ACTIVE wait — on a
+	*    re-spelling. But narrowing ALONE conceals a case the raw compare reports
+	*    (the go-to-k/cdkd#3380 spec review's Drift 2): two DIFFERENT rejected
+	*    spellings (`' 25 '` against a recorded `' 30 '`) narrow to the same
+	*    block, so the arm would return before {@link
+	*    DynamoDBTableProvider.coerceOnDemandCeilingsForSend} ever warns and the
+	*    user would stop being told what to fix — exactly what
+	*    `.claude/rules/provider-diff-record-folds.md` refuses and what keeps the
+	*    TABLE-level detector raw. So the discriminator is
+	*    {@link narrowOnDemandCeilings}'s OWN `dropped` report: any drop on either
+	*    side falls back to the RAW compare, which keeps the announcement alive
+	*    while the narrowed compare still absorbs a lossless re-spelling.
+	*  - **A block with no SURVIVING GRAMMAR MEMBER emits NO op, and WARNS.** The TABLE-level
+	*    arm sends the empty block and lets DynamoDB answer; here the action can
+	*    legitimately carry nothing but `IndexName`, which AWS rejects outright,
+	*    so an empty ceiling would take a capacity edit down with it or fire a
+	*    doomed call on its own. The test is per MEMBER and not
+	*    `Object.keys(...).length === 0` (the go-to-k/cdkd#3380 review's m2):
+	*    {@link narrowOnDemandCeilings} preserves an unknown member name by
+	*    design, so a typo'd `MaxReadRequestUnit` leaves a non-empty object that
+	*    the SDK serializes to `{}` — the same rejected action, reached past a
+	*    key-count gate. The fail-open "let AWS name it" reasoning does NOT reach
+	*    that shape here, because AWS never sees the name to name. The warning is
+	*    this arm's OWN, not {@link warnUnusableOnDemandCeiling}'s (round 2's C3):
+	*    an unknown member is never DROPPED by the narrowing — its name is
+	*    preserved — so the per-member announcement says nothing about it, and
+	*    withholding silently would lose the ceiling where the pre-gate code at
+	*    least failed loudly at AWS.
+	*  - **A block that is not a plain object is forwarded VERBATIM**, the
+	*    fail-open direction every forwarder in this file takes: a STRING, a
+	*    NUMBER or an ARRAY is AWS's to reject by name — and unlike the unknown
+	*    member above, AWS really does see it and rejects it by shape.
+	*  - **The live ceiling is consulted for idempotency**
+	*    ({@link liveCeilingAlreadyMatches}), the #1630 arm the capacity sibling
+	*    already has, and it needs NO billing-mode gate: `DescribeTable` reports
+	*    `OnDemandThroughput` only on a PAY_PER_REQUEST table, so on a
+	*    PROVISIONED one the live block is simply absent and the guard fails
+	*    OPEN — the correct direction, since the worst case is the op AWS then
+	*    rejects by name (issue #3392) rather than a silently dropped change.
+	*    There is no `{0, 0}` analogue of the #1571 capacity trap.
+	*
+	* What it deliberately does NOT do is REMOVE a ceiling. A desired side that
+	* declares none takes the truthiness gate and emits nothing, so the live
+	* maximum SURVIVES — `-1` is AWS's documented removal sentinel and an absent
+	* member keeps the maximum. That is byte-identical to what `update()`'s
+	* TABLE-level arm does with the same edit (its own comment states it), and
+	* implementing the reset on ONE of the two would make the same property
+	* behave differently at the table and at an index of the same table. The
+	* removal direction is filed for BOTH sites together as issue
+	* [#3373](https://github.com/go-to-k/cdkd/issues/3373), which also records
+	* why it is not an extrapolation from the GlobalTable measurement: `-1` is
+	* LIVE-VERIFIED at `UpdateTable.OnDemandThroughput` and UNMEASURED at this
+	* action's, and sending it DESTROYS a live ceiling.
+	*/
+	indexCeilingForSend(name, physicalId, gsi, before, live, maskSecrets) {
+		if (!gsi.OnDemandThroughput) return void 0;
+		if (before !== void 0) {
+			const desired = narrowOnDemandCeilings(gsi.OnDemandThroughput);
+			const previous = narrowOnDemandCeilings(before.OnDemandThroughput);
+			const [desiredSide, previousSide] = desired.dropped.length > 0 || previous.dropped.length > 0 ? [gsi.OnDemandThroughput, before.OnDemandThroughput] : [desired.block, previous.block];
+			if (JSON.stringify(desiredSide) === JSON.stringify(previousSide)) return void 0;
+		}
+		const scope = this.indexScopeAt(name, physicalId, maskSecrets);
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		const debug = (message) => this.logger.debug(maskSecrets(message));
+		const send = this.coerceOnDemandCeilingsForSend(scope, gsi.OnDemandThroughput, maskSecrets);
+		if (!isPlainCapacityBlock(send)) return send;
+		if (!ON_DEMAND_CEILING_MEMBERS.some((member) => member in send)) {
+			if (narrowOnDemandCeilings(gsi.OnDemandThroughput).dropped.length > 0) debug(`${scope}: every declared OnDemandThroughput member was unusable, so no ceiling op was sent`);
+			else warn(`${scope}: declares an OnDemandThroughput with no member DynamoDB accepts (${ON_DEMAND_CEILING_MEMBERS.join(" / ")}), so no ceiling op was sent. Check the member names.`);
+			return;
+		}
+		if (liveCeilingAlreadyMatches(live?.OnDemandThroughput, send)) {
+			debug(`${scope}: already carries the requested OnDemandThroughput in AWS; skipping its ceiling Update`);
+			return;
+		}
+		return send;
+	}
+	/**
 	* One `CreateTable` index entry with ALL THREE of its throughput blocks
 	* coerced — `WarmThroughput` (PR review round 6), `ProvisionedThroughput`
 	* (issue [#3255](https://github.com/go-to-k/cdkd/issues/3255)) and
@@ -19606,7 +19858,7 @@ var DynamoDBTableProvider = class {
 	* through CloudFormation's DynamoDB Integer grammar (issue
 	* [#3265](https://github.com/go-to-k/cdkd/issues/3265)).
 	*
-	* Called from ALL FOUR send sites, which is the whole point — the block was
+	* Called from ALL SIX send sites, which is the whole point — the block was
 	* forwarded VERBATIM at every one of them, so a CFn-legal
 	* `MaxReadRequestUnits: '100'` reached AWS as the STRING `"100"` in a `Long`
 	* field and the request failed, while a `' 100 '` / `'0x64'` / `'1e2'`
@@ -19620,15 +19872,19 @@ var DynamoDBTableProvider = class {
 	*     same blind spot that hid this forwarder from issue #3147's sweep and
 	*     from #3255's round 6, one property over);
 	*  3. `update()`'s TABLE-level `UpdateTable.OnDemandThroughput`;
-	*  4. `applyGsiUpdates`' per-index `Create` action.
-	*
-	* FOUR and not six: `UpdateGlobalSecondaryIndexAction` declares
-	* `OnDemandThroughput` too, and neither the adopted-index repair nor the
-	* same-name `Update` arm ever sets it — so a ceiling EDIT on a live index is
-	* silently discarded today. That is a MISSING SEND rather than a grammar
-	* defect, so it is not routed here; issue
-	* [#3287](https://github.com/go-to-k/cdkd/issues/3287) holds it, and it will
-	* read through this function when it lands.
+	*  4. `applyGsiUpdates`' per-index `Create` action;
+	*  5. `applyGsiUpdates`' same-name `Update` action, and
+	*  6. its adopted-index repair `Update` — both through
+	*     {@link indexCeilingForSend}, added by issue
+	*     [#3287](https://github.com/go-to-k/cdkd/issues/3287).
+	*
+	* Sites 5 and 6 were the MISSING SEND rather than a grammar defect: until
+	* #3287 `UpdateGlobalSecondaryIndexAction.OnDemandThroughput` was declared by
+	* the SDK and set by neither arm, and `updateHasMember` was set only by the
+	* capacity and warm arms — so a template whose only edit was a live index's
+	* ceiling fired no op at all, the engine recorded the new value, and the next
+	* deploy compared EQUAL. The edit was lost permanently, with nothing refused
+	* and nothing dropped to warn about.
 	*
 	* THREE decisions, each with a plausible alternative:
 	*
@@ -19684,9 +19940,16 @@ var DynamoDBTableProvider = class {
 	* fail. Closing it needs `effectiveProperties` AND its
 	* `canonicalizeDesiredProperties` twin (the rule requires the pair; shipping
 	* the first alone re-issues a no-op `UpdateTable` on every later deploy), and
-	* this provider implements neither today. Tracked as issue
-	* [#3286](https://github.com/go-to-k/cdkd/issues/3286); the warning names the
-	* residual so a user is not left to discover it from a `cdkd drift` line. The
+	* this provider implements neither today. That pair was WRITTEN and
+	* WITHDRAWN: `observedProperties` is captured from the RAW template bag in
+	* `deploy-engine.ts`, so a folded record leaves the observed side carrying a
+	* per-index ceiling the record omits, and `drift-calculator.ts` compares
+	* `GlobalSecondaryIndexes` as one positional deep-equal array — the fold
+	* MANUFACTURES the phantom drift it exists to remove. Agreeing the two is a
+	* deploy-engine change across three call sites. Tracked as issue
+	* [#3286](https://github.com/go-to-k/cdkd/issues/3286), which carries the
+	* evidence; the warning names the residual so a user is not left to discover
+	* it from a `cdkd drift` line. The
 	* `AWS::DynamoDB::GlobalTable` sibling answers the SAME way for the same
 	* spelling — `collectTableOnDemandCeilings` coerces through
 	* `coerceCfnInteger` and a rejected ceiling is reported and LEFT UNSENT, with
@@ -19694,20 +19957,9 @@ var DynamoDBTableProvider = class {
 	* capacity answer, not its ceiling one) — so the two types do not diverge.
 	*/
 	coerceOnDemandCeilingsForSend(scope, declared, maskSecrets) {
-		if (!isPlainCapacityBlock(declared)) return declared;
-		const block = declared;
-		let rewritten;
-		for (const member of ON_DEMAND_CEILING_MEMBERS) {
-			if (!(member in block)) continue;
-			const coerced = coerceCfnInteger(block[member]);
-			if (coerced === block[member]) continue;
-			rewritten ??= { ...block };
-			if (coerced === void 0) {
-				this.warnUnusableOnDemandCeiling(scope, member, block[member], maskSecrets);
-				delete rewritten[member];
-			} else rewritten[member] = coerced;
-		}
-		return rewritten ?? block;
+		const { block, dropped } = narrowOnDemandCeilings(declared);
+		for (const { member, raw } of dropped) this.warnUnusableOnDemandCeiling(scope, member, raw, maskSecrets);
+		return block;
 	}
 	/**
 	* Announce an `OnDemandThroughput` member a forwarder DROPPED (issue
@@ -19871,15 +20123,15 @@ var DynamoDBTableProvider = class {
 		if (requested === void 0) return false;
 		if (toFiniteNumber(requested.ReadCapacityUnits) !== 0 || toFiniteNumber(requested.WriteCapacityUnits) !== 0) return false;
 		const warn = (message) => this.logger.warn(maskSecrets(message));
-		warn(`GSI ${maskSecrets(indexName)} on DynamoDB table ${physicalId}: the requested ProvisionedThroughput is {ReadCapacityUnits: 0, WriteCapacityUnits: 0}, which is AWS's on-demand placeholder rather than a capacity DynamoDB accepts (the minimum is 1), so no per-index throughput update was sent. This usually means the value came from a pre-#1767 cdkd state record — a \`cdkd drift --revert\` of such a record, or a rollback replaying it. Re-run \`cdkd deploy\` (or \`cdkd drift --accept\`) to refresh the record.`);
+		warn(`${this.indexScopeAt(indexName, physicalId, maskSecrets)}: the requested ProvisionedThroughput is {ReadCapacityUnits: 0, WriteCapacityUnits: 0}, which is AWS's on-demand placeholder rather than a capacity DynamoDB accepts (the minimum is 1), so no per-index throughput update was sent. This usually means the value came from a pre-#1767 cdkd state record — a \`cdkd drift --revert\` of such a record, or a rollback replaying it. Re-run \`cdkd deploy\` (or \`cdkd drift --accept\`) to refresh the record.`);
 		return true;
 	}
 	/**
 	* The per-index `WarmThroughput` this update should send, or `undefined`
 	* (issue #1768, one nesting level down from the table-level branch).
 	*
-	* `applyGsiUpdates` used to send only `ProvisionedThroughput` /
-	* `OnDemandThroughput` on both of its arms, while `readCurrentState` emits a
+	* `applyGsiUpdates` used to send only `ProvisionedThroughput` on both of its
+	* arms, while `readCurrentState` emits a
 	* declared per-index `WarmThroughput` — so a template declaring one had it
 	* silently dropped on every index add / change, `cdkd drift` reported the
 	* difference forever, and `--revert` emitted no op at all and exited 0
@@ -19903,20 +20155,20 @@ var DynamoDBTableProvider = class {
 	warmThroughputOpFor(indexName, physicalId, desired, previous, live, maskSecrets = (text) => text) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const debug = (message) => this.logger.debug(maskSecrets(message));
-		const safeIndexName = maskSecrets(indexName);
+		const scope = this.indexScopeAt(indexName, physicalId, maskSecrets);
 		const requested = desired.WarmThroughput;
 		if (previous !== void 0 && JSON.stringify(previous.WarmThroughput) === JSON.stringify(requested)) return;
-		const sendable = this.coerceWarmThroughputForSend(`GSI ${safeIndexName} on DynamoDB table ${physicalId}`, requested, maskSecrets);
+		const sendable = this.coerceWarmThroughputForSend(scope, requested, maskSecrets);
 		if (sendable === void 0) {
-			this.warnRefusedWarmThroughput(`GSI ${safeIndexName} on DynamoDB table ${physicalId}`, requested, maskSecrets);
+			this.warnRefusedWarmThroughput(scope, requested, maskSecrets);
 			return;
 		}
 		if (warmThroughputAlreadyMatches(sendable, live?.WarmThroughput)) {
-			debug(`GSI ${safeIndexName} on DynamoDB table ${physicalId} already carries the requested warm throughput in AWS; skipping its WarmThroughput Update`);
+			debug(`${scope} already carries the requested warm throughput in AWS; skipping its WarmThroughput Update`);
 			return;
 		}
 		if (isWarmThroughputDecrease(sendable, live?.WarmThroughput)) {
-			warn(`GSI ${safeIndexName} on DynamoDB table ${physicalId}: the requested WarmThroughput ${JSON.stringify(maskDeep(sendable, maskSecrets))} is lower than the ${JSON.stringify(maskDeep({
+			warn(`${scope}: the requested WarmThroughput ${JSON.stringify(maskDeep(sendable, maskSecrets))} is lower than the ${JSON.stringify(maskDeep({
 				ReadUnitsPerSecond: live?.WarmThroughput?.ReadUnitsPerSecond,
 				WriteUnitsPerSecond: live?.WarmThroughput?.WriteUnitsPerSecond
 			}, maskSecrets))} DynamoDB currently holds for that index. Warm throughput only ever RISES with an index's traffic and cannot be lowered — AWS rejects the UpdateTable with "decreasing WarmThroughput is not supported" — so it was NOT sent and every other change on this table still applied. On a deploy this warning may be the only signal you get: a successful deploy re-captures AWS's current value as the drift baseline. If your template declares this index's WarmThroughput, set it to the value AWS holds (or remove it, which AWS treats as keeping the last-set value); if it does not, the value came from a cdkd state record and 'cdkd deploy' (or 'cdkd drift --accept') refreshes it.`);
@@ -19933,7 +20185,8 @@ var DynamoDBTableProvider = class {
 	* of it — the wait is what makes the next op (there, the BillingMode flip)
 	* legal.
 	*/
-	async runGsiOps(physicalId, ops, desiredAttributeDefinitions) {
+	async runGsiOps(physicalId, ops, desiredAttributeDefinitions, maskSecrets = (text) => text) {
+		const debug = (message) => this.logger.debug(maskSecrets(message));
 		for (const op of ops) {
 			const input = {
 				TableName: physicalId,
@@ -19942,8 +20195,7 @@ var DynamoDBTableProvider = class {
 			if (op.Create && desiredAttributeDefinitions) input.AttributeDefinitions = desiredAttributeDefinitions;
 			await this.dynamoDBClient.send(new UpdateTableCommand(input));
 			await this.waitForTableAndIndexesActive(physicalId);
-			const verb = op.Create ? "created" : op.Delete ? "deleted" : "updated";
-			this.logger.debug(`${verb} GSI ${op.Create?.IndexName ?? op.Delete?.IndexName ?? op.Update?.IndexName} on DynamoDB table ${physicalId}`);
+			debug(`${op.Create ? "created" : op.Delete ? "deleted" : "updated"} ${this.indexScopeAt(op.Create?.IndexName ?? op.Delete?.IndexName ?? op.Update?.IndexName, physicalId, maskSecrets)}`);
 		}
 	}
 	/**
@@ -70106,6 +70358,28 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				state: scrubbed
 			};
 		});
+		const crossStackNeedles = allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets);
+		const redactCrossStackName = (name) => redactSecretsForState(name, crossStackNeedles);
+		const newImports = state.imports?.map((entry) => {
+			const exportName = redactCrossStackName(entry.exportName);
+			if (exportName === entry.exportName) return entry;
+			recordsChanged++;
+			return {
+				...entry,
+				exportName
+			};
+		});
+		const newOutputReads = state.outputReads?.map((entry) => {
+			const sourceStack = redactCrossStackName(entry.sourceStack);
+			const outputName = redactCrossStackName(entry.outputName);
+			if (sourceStack === entry.sourceStack && outputName === entry.outputName) return entry;
+			recordsChanged++;
+			return {
+				...entry,
+				sourceStack,
+				outputName
+			};
+		});
 		const newOutputs = redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource, TEMPLATE_SOURCED_RULES) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets));
 		emitAbandonedScanNotes();
 		if (JSON.stringify(newOutputs) !== JSON.stringify(state.outputs)) recordsChanged++;
@@ -70115,6 +70389,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				...carriedState,
 				resources: newResources,
 				...state.orphans !== void 0 && { orphans: newOrphans },
+				...newImports !== void 0 && { imports: newImports },
+				...newOutputReads !== void 0 && { outputReads: newOutputReads },
 				outputs: newOutputs,
 				lastModified: Date.now()
 			};
@@ -90314,13 +90590,12 @@ function readEnvOverridesFile$3(filePath) {
 * which drives the `--role-arn` cases without booting the API server.
 */
 function forwardAwsEnv$2(env) {
-	for (const key of [
-		"AWS_ACCESS_KEY_ID",
-		"AWS_SECRET_ACCESS_KEY",
-		"AWS_SESSION_TOKEN",
+	const passThrough = [
+		...AWS_CREDENTIAL_ENV_KEYS,
 		"AWS_REGION",
 		"AWS_DEFAULT_REGION"
-	]) {
+	];
+	for (const key of passThrough) {
 		const value = process.env[key];
 		if (value !== void 0) env[key] = value;
 	}
@@ -92795,6 +93070,36 @@ async function buildSigV4HeadersIfRequested(options, resolved, loaded, host, por
 	return headers;
 }
 /**
+* The `--sigv4` refusal, as a pure function of the two facts that decide its
+* wording (issue [#3250](https://github.com/go-to-k/cdkd/issues/3250) item 5).
+*
+* NAMING THE EXCLUSION. On a `--role-arn` run over a caller with no static
+* triple, `AWS_ACCESS_KEY_ID` IS set in this process — cdkd set it, to the
+* role — so "set AWS_ACCESS_KEY_ID" alone reads as a bug report about cdkd
+* rather than as the refusal it is. The message has to say which value it
+* declines and why.
+*
+* THE REMEDY ORDER DIFFERS PER BRANCH, deliberately. The assumed-role branch
+* fires precisely when the caller has no static pair BY DESIGN — SSO, an
+* instance role, a container role — so leading with "mint an access key pair"
+* tells the one user who should not do that to do it first. The role-less
+* branch is the opposite: there the pair genuinely is the simplest answer.
+* `--profile` is dropped from either list when one was already passed and did
+* not produce a usable pair — the same already-followed-advice defect, one arm
+* over.
+*
+* PURE, and separate from its caller, for a reason the caller cannot give: the
+* `--profile` arm of {@link resolveHostCredentialsForSigV4} transacts with AWS,
+* so the unit suite's network fence refuses every route that reaches this throw
+* with `options.profile` set. As a helper, all four combinations are testable
+* with no network at all.
+*/
+function sigv4NoCredentialsRefusal(args) {
+	const exportPair = `set AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY in your shell before running cdkd (the snapshot cdkd puts back is taken before it assumes the role, so exporting them afterwards is too late)`;
+	const profileRemedy = args.profileAlreadyPassed ? "" : `pass --profile <name>, `;
+	return new CdkdError(args.assumedRolePublished ? `--sigv4: no AWS credentials available to sign the request as YOU. AWS_ACCESS_KEY_ID is set in this process, but cdkd set it: it holds the --role-arn assumed role, and this signature is what the emulated agent sees as its INVOKER, so cdkd deliberately will not sign as that role. Your own credentials carried no static triple before the assume — an SSO / IAM Identity Center, EC2 instance or ECS container chain, or a profile you exported rather than passed — so there is nothing to put back. To fix: ${profileRemedy}pass --assume-role <arn>, or ${exportPair}.` : `--sigv4: no AWS credentials available to sign the request. To fix: ${exportPair}, ${profileRemedy}or pass --assume-role <arn>.`, "LOCAL_INVOKE_AGENTCORE_SIGV4_NO_CREDENTIALS");
+}
+/**
 * Resolve credentials for host-side SigV4 signing. Precedence:
 *   1. `--assume-role` → STS temp creds (warn + fall through on STS failure);
 *   2. `--profile` → profile creds (sessionToken when the profile carries one);
@@ -92837,7 +93142,10 @@ async function resolveHostCredentialsForSigV4(options, resolved, loaded, region)
 		secretAccessKey: shellCredentials.secretAccessKey,
 		...shellCredentials.sessionToken && { sessionToken: shellCredentials.sessionToken }
 	};
-	throw new CdkdError("--sigv4: no AWS credentials available to sign the request. Set AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY, pass --profile <name>, or pass --assume-role <arn>.", "LOCAL_INVOKE_AGENTCORE_SIGV4_NO_CREDENTIALS");
+	throw sigv4NoCredentialsRefusal({
+		assumedRolePublished: envCredentialsAreAssumedRole(),
+		profileAlreadyPassed: options.profile !== void 0
+	});
 }
 /**
 * Acquire the agent image. A CODE artifact (managed runtime) is built from
@@ -93278,9 +93586,7 @@ function platformToArchitecture(platform) {
 */
 function forwardAwsEnv$1(env) {
 	const passThrough = [
-		"AWS_ACCESS_KEY_ID",
-		"AWS_SECRET_ACCESS_KEY",
-		"AWS_SESSION_TOKEN",
+		...AWS_CREDENTIAL_ENV_KEYS,
 		"AWS_REGION",
 		"AWS_DEFAULT_REGION"
 	];
@@ -94456,9 +94762,7 @@ async function assumeLambdaExecutionRole(roleArn, region) {
 */
 function forwardAwsEnv(env) {
 	const passThrough = [
-		"AWS_ACCESS_KEY_ID",
-		"AWS_SECRET_ACCESS_KEY",
-		"AWS_SESSION_TOKEN",
+		...AWS_CREDENTIAL_ENV_KEYS,
 		"AWS_REGION",
 		"AWS_DEFAULT_REGION"
 	];
@@ -94706,4 +95010,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-babtsurS.js.map
+//# sourceMappingURL=program-dYPgGoOv.js.map