@go-to-k/cdkd 0.290.26 → 0.290.28

package/dist/{program-BgDlhE-S.js → program-C1iVGcxJ.js}

@@ -1,8 +1,8 @@
-import { $ as secretBearing, $n as recordMaskOnlyValue, $r as getDockerImageBySourceHash, $t as s3BucketArn, A as extractDeploymentEventError, Ai as resetAwsClients, An as refuseMalformedState, Ar as assertAssetBucketRegion, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as LocalInvokeBuildError$1, Bn as STATE_SOURCED_BASELINE_RULES, Br as describeDockerCapturedOutput, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as derivePartitionAndUrlSuffix, Cn as producerRecordKey, Cr as WorkGraph, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Di as resolveBucketRegion, Dn as refuseMalformedOutputsForDestroy, Dr as rewriteTemplateAssetReferences, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, En as refuseMalformedOutputs, Er as loadPublishableAssetManifest, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fi as CrossAccountSecretRefusalError, Fn as findSilentDropProperties, Fr as readBootstrapMarkerBody, Ft as isSettledInstanceState, G as gray, Gi as PartialFailureError, Gn as createSecretMasker, Gr as getDockerCmd, Gt as readConfigString, H as formatResourceLine, Hn as STATE_SOURCED_READBACK_RULES, Hr as describeDockerFailure, Ht as configBooleanRefusal, I as renderStatefulReason, In as describeTypeWithThrottleRetry, Ir as validateAssetBucketName, It as WAFv2WebACLProvider, J as yellow, Ji as ResourceUpdateNotSupportedError, Jn as identityKeyFor, Jr as runDockerForeground, Jt as requireConfigObject, K as green, Ki as ProvisioningError, Kn as dynamicReferenceTokens, Kr as partitionSensitiveEnv, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Li as DeployCancelledError, Ln as withRetry, Lr as validateContainerRepoName, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mn as repairMalformedResourcePropertiesForReadOnly, Mr as getBootstrapMarkerKey, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ni as CdkdError, Nn as repairMalformedResourcesForReadOnly, Nr as isCrossRegionRedirect, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as AwsClients, On as refuseMalformedResourcePropertiesForOrphan, Or as AssetModeResolver, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pn as findActionableSilentDrops, Pr as parseBootstrapMarker, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as maskSecretsInText, Qr as AssetManifestLoader, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as DynamicReferenceRegionAmbiguousError, Rn as DagBuilder, Rr as buildDenyExternalAccessPolicy, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as canonicalizeRegion, Sn as malformedStateRefusalMessage, Sr as stringifyValue, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as processStackMessages, Tn as refuseMalformedNestedChildOutputs, Tr as createAssetRedirectResolver, Tt as carriesDynamicReference, U as bold, Ui as MalformedProducerRecordRefusalError, Un as TEMPLATE_SOURCED_RULES, Ur as dockerSpawnEnvWithSensitive, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as LocalStartServiceError, Vn as STATE_SOURCED_CROSS_GENERATION_RULES, Vr as describeDockerExecFailure, Vt as coerceCfnInteger, W as cyan, Wi as NestedStackChildDirectDestroyError, Wn as carriesSecretMask, Wr as formatDockerLoginError, Wt as configStringRefusal, X as collectPublishedOutputNames, Xi as StackTerminationProtectionError, Xn as markSameGenerationBag, Xr as escapeRegExp, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as StackHasActiveImportsError, Yn as isSingleDynamicReferenceToken, Yr as runDockerStreaming, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zn as maskSecretsInError, Zr as stripControlChars, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as uploadCfnTemplate, _n as malformedOutputsRefusalMessage, _r as isReadableBag, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isThrottlingError, ai as resolveAutoAssetStorage, an as AWS_CREDENTIAL_ENV_KEYS, ar as rebuildClientForBucketRegion, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as expectedOwnerParam, bn as malformedResourcePropertiesWarning, br as shouldRetainResource, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as markRedactedCause, ci as resolveStateBucketWithDefault, cn as envCredentialsAreAssumedRole, cr as forceQuitRecoveryClause, ct as createMaskedRetryLogger, d as updatePartialReason, da as safeStringify, di as stateBucketExistenceConfirmed, dn as STATE_RESOURCES_MALFORMED, dr as CUSTOM_RESOURCE_RESPONSE_PREFIX, dt as beginCommandInterruptScope, ei as Synthesizer, en as s3BucketDomainName, er as recoverMaskedOutput, et as secretBearingStateKeyWarning, f as withResourceDeadline, fi as warnDeprecatedNoPrefixCliFlag, fn as hasReadableOutputs, fr as DEFAULT_STATE_PREFIX, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as findLargeInlineResources, gn as malformedLocalOutputsWarning, gr as importableOutputs, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as MIGRATE_TMP_PREFIX, hn as malformedExportSourceWarning, hr as importableOutputKeys, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isRetryableTransientError, ii as resolveApp, in as applyRoleArnIfSet, ir as S3StateBackend, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as setAwsClients, jn as repairMalformedOutputsForReadOnly, jr as ensureAssetStorage, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as getAwsClients, kn as refuseMalformedResourcesForDestroy, kr as BOOTSTRAP_MARKER_PREFIX, kt as getAccountInfo, l as replayRollback, la as retryClassificationText, li as resolveStateBucketWithDefaultAndSource, ln as DiffCalculator, lr as formatLockExpiry, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as CFN_TEMPLATE_URL_LIMIT, mn as malformedExportNamesWarning, mr as hasReadableExportSet, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as withErrorHandling, ni as getDefaultStateBucketName, nn as s3BucketRegionalDomainName, nr as scrubResourceRecord, nt as getCurrentResourceSecrets, o as planFailedOps, oa as isTransientServerError, oi as resolveCaptureObservedState, on as applyCallerIdentityCredentials, or as buildForceUnlockCommand, ot as ProviderRegistry, p as maskingRetryLogger, pi as CFN_TEMPLATE_BODY_LIMIT, pn as hasReadableResources, pr as exportNamesCarriedFrom, pt as interruptWatchListenerCount, q as red, qi as ResourceTimeoutError, qn as errorCauseChain, qr as redactDockerArgvValues, qt as requireConfigArray, r as DeployEngine, ra as isMarkedNonRetryable, ri as getLegacyStateBucketName, rn as s3BucketWebsiteUrl, rr as LockManager, rt as IAMRoleProvider, s as planRollback, sa as markNonRetryable, si as resolveSkipPrefix, sn as callerEnvCredentials, sr as buildLockContentionMessage, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as normalizeAwsError, ti as synthesisStatusMessage, tn as s3BucketDualStackDomainName, tr as redactSecretsForState, tt as secretSafeKeyDisplay, u as updatePartialMessage, ua as describeAwsFailure, ui as resolveUseCdkBootstrapAssets, un as INTRINSIC_KEYS, ur as shellQuote, ut as maskerOrIdentity, v as keptWholeReasonText, vi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, vn as malformedOutputsWarning, vr as orphansAfterRollback, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as AssemblyReader, wn as refuseDivergentRecordRegionForDestroy, wr as buildAssetRedirectMap, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as PARTITION_TABLE, xn as malformedResourcesWarning, xr as AssetPublisher, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as decodeListingKey, yn as malformedRenderedContainersWarning, yr as orphansCarriedFrom, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as IntrinsicResolutionRefusalError, zn as TemplateParser, zr as buildDockerImage, zt as assertRegionMatch } from "./deploy-engine-CbIc5Y73.js";
-import { C as displaySafe, S as displayIdent, _ as withSkipPrefix, b as STACK_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE } from "./logger-CkHVgzLx.js";
+import { $ as secretBearing, $n as recordMaskOnlyValue, $r as AssetManifestLoader, $t as s3BucketArn, A as extractDeploymentEventError, Ai as getAwsClients, An as refuseMalformedState, Ar as BOOTSTRAP_MARKER_PREFIX, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as IntrinsicResolutionRefusalError, Bn as STATE_SOURCED_BASELINE_RULES, Br as buildDockerImage, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as canonicalizeRegion, Cn as producerRecordKey, Cr as stringifyValue, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Dn as refuseMalformedOutputsForDestroy, Dr as loadPublishableAssetManifest, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as processStackMessages, En as refuseMalformedOutputs, Er as createAssetRedirectResolver, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fn as findSilentDropProperties, Fr as parseBootstrapMarker, Ft as isSettledInstanceState, G as gray, Gi as NestedStackChildDirectDestroyError, Gn as createSecretMasker, Gr as formatDockerLoginError, Gt as readConfigString, H as formatResourceLine, Hi as LocalStartServiceError, Hn as STATE_SOURCED_READBACK_RULES, Hr as describeDockerExecFailure, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as CrossAccountSecretRefusalError, In as describeTypeWithThrottleRetry, Ir as readBootstrapMarkerBody, It as WAFv2WebACLProvider, J as yellow, Ji as ResourceTimeoutError, Jn as identityKeyFor, Jr as redactDockerArgvValues, Jt as requireConfigObject, K as green, Ki as PartialFailureError, Kn as dynamicReferenceTokens, Kr as getDockerCmd, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Ln as withRetry, Lr as validateAssetBucketName, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mi as setAwsClients, Mn as repairMalformedResourcePropertiesForReadOnly, Mr as ensureAssetStorage, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as repairMalformedResourcesForReadOnly, Nr as getBootstrapMarkerKey, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as resolveBucketRegion, On as refuseMalformedResourcePropertiesForOrphan, Or as rewriteTemplateAssetReferences, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pi as CdkdError, Pn as findActionableSilentDrops, Pr as isCrossRegionRedirect, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as maskSecretsInText, Qr as stripControlChars, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as DeployCancelledError, Rn as DagBuilder, Rr as validateContainerRepoName, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as PARTITION_TABLE, Sn as malformedStateRefusalMessage, Sr as AssetPublisher, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as AssemblyReader, Tn as refuseMalformedNestedChildOutputs, Tr as buildAssetRedirectMap, Tt as carriesDynamicReference, U as bold, Un as TEMPLATE_SOURCED_RULES, Ur as describeDockerFailure, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as LocalInvokeBuildError$1, Vn as STATE_SOURCED_CROSS_GENERATION_RULES, Vr as describeDockerCapturedOutput, Vt as coerceCfnInteger, W as cyan, Wi as MalformedProducerRecordRefusalError, Wn as carriesSecretMask, Wr as dockerSpawnEnvWithSensitive, Wt as configStringRefusal, X as collectPublishedOutputNames, Xi as StackHasActiveImportsError, Xn as markSameGenerationBag, Xr as runDockerStreaming, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as ResourceUpdateNotSupportedError, Yn as isSingleDynamicReferenceToken, Yr as runDockerForeground, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zi as StackTerminationProtectionError, Zn as maskSecretsInError, Zr as escapeRegExp, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as findLargeInlineResources, _n as malformedOutputsRefusalMessage, _r as importableOutputs, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isRetryableTransientError, ai as resolveApp, an as AWS_CREDENTIAL_ENV_KEYS, ar as rebuildClientForBucketRegion, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as decodeListingKey, bn as malformedResourcePropertiesWarning, br as orphansCarriedFrom, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as markNonRetryable, ci as resolveSkipPrefix, cn as envCredentialsAreAssumedRole, cr as buildLockContentionMessage, ct as createMaskedRetryLogger, d as updatePartialReason, da as describeAwsFailure, di as resolveUseCdkBootstrapAssets, dn as STATE_RESOURCES_MALFORMED, dr as shellQuote, dt as beginCommandInterruptScope, ei as getDockerImageBySourceHash, en as s3BucketDomainName, er as recoverMaskedOutput, et as secretBearingStateKeyWarning, f as withResourceDeadline, fa as safeStringify, fi as stateBucketExistenceConfirmed, fn as hasReadableOutputs, fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as MIGRATE_TMP_PREFIX, gn as malformedLocalOutputsWarning, gr as importableOutputKeys, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as CFN_TEMPLATE_URL_LIMIT, hn as malformedExportSourceWarning, hr as hasReadableExportSet, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isMarkedNonRetryable, ii as getLegacyStateBucketName, in as applyRoleArnIfSet, ir as S3StateBackend, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as resetAwsClients, jn as repairMalformedOutputsForReadOnly, jr as assertAssetBucketRegion, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as AwsClients, kn as refuseMalformedResourcesForDestroy, kr as AssetModeResolver, kt as getAccountInfo, l as replayRollback, la as markRedactedCause, li as resolveStateBucketWithDefault, ln as DiffCalculator, lr as forceQuitRecoveryClause, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as CFN_TEMPLATE_BODY_LIMIT, mn as malformedExportNamesWarning, mr as exportNamesCarriedFrom, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as normalizeAwsError, ni as synthesisStatusMessage, nn as s3BucketRegionalDomainName, nr as scrubResourceRecord, nt as getCurrentResourceSecrets, o as planFailedOps, oa as isThrottlingError, oi as resolveAutoAssetStorage, on as applyCallerIdentityCredentials, or as UNREPRODUCIBLE_LOCK_CLAUSE, ot as ProviderRegistry, p as maskingRetryLogger, pi as warnDeprecatedNoPrefixCliFlag, pn as hasReadableResources, pr as DEFAULT_STATE_PREFIX, pt as interruptWatchListenerCount, q as red, qi as ProvisioningError, qn as errorCauseChain, qr as partitionSensitiveEnv, qt as requireConfigArray, r as DeployEngine, ra as withErrorHandling, ri as getDefaultStateBucketName, rn as s3BucketWebsiteUrl, rr as LockManager, rt as IAMRoleProvider, s as planRollback, sa as isTransientServerError, si as resolveCaptureObservedState, sn as callerEnvCredentials, sr as buildForceUnlockCommand, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as Synthesizer, tn as s3BucketDualStackDomainName, tr as redactSecretsForState, tt as secretSafeKeyDisplay, u as updatePartialMessage, ua as retryClassificationText, ui as resolveStateBucketWithDefaultAndSource, un as INTRINSIC_KEYS, ur as formatLockExpiry, ut as maskerOrIdentity, v as keptWholeReasonText, vi as uploadCfnTemplate, vn as malformedOutputsWarning, vr as isReadableBag, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as derivePartitionAndUrlSuffix, wn as refuseDivergentRecordRegionForDestroy, wr as WorkGraph, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as expectedOwnerParam, xn as malformedResourcesWarning, xr as shouldRetainResource, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, yn as malformedRenderedContainersWarning, yr as orphansAfterRollback, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as DynamicReferenceRegionAmbiguousError, zn as TemplateParser, zr as buildDenyExternalAccessPolicy, zt as assertRegionMatch } from "./deploy-engine-CcFbq2q8.js";
+import { C as displayIdent, S as UNRENDERABLE, T as truncateCodePoints, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displaySafe, x as STACK_REF_MAX_CODE_POINTS } from "./logger-6LP1UiFA.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-yD49aCCv.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-7KM2pV3Q.js";
+import { t as getCdkdVersion } from "./version-B2-UuEte.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DiZsq-4k.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -17849,6 +17849,257 @@ const PROVISIONED_CAPACITY_MEMBERS = ["ReadCapacityUnits", "WriteCapacityUnits"]
 */
 const ON_DEMAND_CEILING_MEMBERS = ["MaxReadRequestUnits", "MaxWriteRequestUnits"];
 /**
+* Narrow ONE `OnDemandThroughput` block to exactly what cdkd puts on the wire,
+* and report the members that were DROPPED (issue
+* [#3287](https://github.com/go-to-k/cdkd/issues/3287)).
+*
+* The ONE spelling of that transform, and that is the whole reason it is a
+* module-level PURE function rather than a method: two callers need the same
+* answer and one of them may not log.
+*
+*  - {@link DynamoDBTableProvider.coerceOnDemandCeilingsForSend} — the WIRE, at
+*    all six send sites, which announces each `dropped` member;
+*  - {@link DynamoDBTableProvider.indexCeilingForSend}'s per-index change
+*    detector, which compares the desired and recorded blocks and must not warn
+*    (the warning is the send's, one line further down, and a detector that
+*    announced would fire on a comparison that emits no op at all).
+*
+* Behaviour is BYTE-identical to what `coerceOnDemandCeilingsForSend` did
+* inline before issue [#3287](https://github.com/go-to-k/cdkd/issues/3287),
+* including the two identity properties its callers
+* depend on: a block that is not a plain object comes back AS ITSELF (AWS names
+* the shape), and a block needing no rewrite comes back by IDENTITY, so
+* {@link DynamoDBTableProvider.coerceIndexThroughputForCreate} can still tell
+* "unchanged" from "rewritten" without a structural compare. A member name the
+* grammar does not know is preserved untouched, the same fail-open direction.
+*
+* `dropped` carries the RAW declared value beside each member name because the
+* warning interpolates it, and only the masking caller may do that.
+*/
+function narrowOnDemandCeilings(declared) {
+	if (!isPlainCapacityBlock(declared)) return {
+		block: declared,
+		dropped: []
+	};
+	const block = declared;
+	let rewritten;
+	const dropped = [];
+	for (const member of ON_DEMAND_CEILING_MEMBERS) {
+		if (!(member in block)) continue;
+		const coerced = coerceCfnInteger(block[member]);
+		if (coerced === block[member] && coerced !== void 0) continue;
+		rewritten ??= { ...block };
+		if (coerced === void 0) {
+			dropped.push({
+				member,
+				raw: block[member]
+			});
+			delete rewritten[member];
+		} else rewritten[member] = coerced;
+	}
+	return {
+		block: rewritten ?? block,
+		dropped
+	};
+}
+/**
+* Does the ceiling AWS currently holds for a GSI already cover every member
+* cdkd is about to send? (issue
+* [#3287](https://github.com/go-to-k/cdkd/issues/3287))
+*
+* The `OnDemandThroughput` twin of {@link liveCapacityAlreadyMatches}, and it
+* exists for the same #1630 reason: cdkd writes state only after `update()`
+* RETURNS, so a ceiling op that already LANDED before a later step threw is
+* unrecorded and the next deploy re-emits it. Consulting what AWS holds is what
+* lets the deploy converge instead.
+*
+* Compared PER MEMBER over the members being SENT, deliberately, and it differs
+* from the capacity sibling in exactly that: omitting a ceiling member KEEPS
+* whatever maximum the table already carries (only an explicit `-1` removes
+* one), so a member cdkd is not sending says nothing about whether the call is
+* redundant. A live member the request does not carry is therefore ignored.
+*
+* Anything unreadable on EITHER side fails OPEN (the op is still emitted): an
+* absent live block — which is also what `DescribeTable` reports for a
+* PROVISIONED table, where the numbers do not exist — an absent live member, a
+* value that is not a number. That is the correct direction: the worst case is
+* the pre-fix behaviour of emitting the op, whereas a false MATCH would
+* silently drop a ceiling change the user asked for.
+*
+* **What AWS does with a repeated identical ceiling is UNMEASURED**, and this
+* guard is written so that it does not matter: it withholds only a call that
+* would change nothing. If DynamoDB rejects the repeat the way it rejects a
+* repeated provisioned capacity ("The provisioned throughput for the index X
+* will not change"), the guard is what keeps the deploy from wedging; if it
+* accepts it, the guard saves a call and a full index-ACTIVE wait. Measuring it
+* would sharpen the doc, not the code.
+*/
+function liveCeilingAlreadyMatches(live, requested) {
+	if (live === void 0) return false;
+	const liveBag = live;
+	let compared = 0;
+	for (const member of ON_DEMAND_CEILING_MEMBERS) {
+		if (!(member in requested)) continue;
+		const want = toFiniteNumber(requested[member]);
+		const have = toFiniteNumber(liveBag[member]);
+		if (want === void 0 || have === void 0 || want !== have) return false;
+		compared += 1;
+	}
+	return compared > 0;
+}
+/**
+* The sentinel DynamoDB accepts to CLEAR an on-demand request-unit maximum
+* (issue [#3373](https://github.com/go-to-k/cdkd/issues/3373)).
+*
+* LIVE-VERIFIED at BOTH positions this file sends from, which is what makes it
+* implementable at both at once rather than at one and not the other:
+*
+*  - `UpdateTable.OnDemandThroughput` — AWS's own SDK model doc for the block,
+*    and the measurement recorded on issue
+*    [#1434](https://github.com/go-to-k/cdkd/issues/1434) (us-east-1 +
+*    us-west-2, 2026-08-09), which probed the SINGLE-member shape this file
+*    also sends: `{MaxWriteRequestUnits: -1}` against a live `{100, 100}` was
+*    accepted and read back as `{MaxReadRequestUnits: 100}`;
+*  - `UpdateTable.GlobalSecondaryIndexUpdates[].Update.OnDemandThroughput` —
+*    the position issue #3373's body called UNMEASURED. It is not, and the
+*    evidence is in TWO places, named separately because a reviewer checked
+*    and one of them is not where an earlier draft of this said it was:
+*    issue [#1423](https://github.com/go-to-k/cdkd/issues/1423)'s comment
+*    thread carries the `{-1, -1}` transcript (us-east-1, 2026-08-09,
+*    throwaway table) — ACCEPTED, with `DescribeTable` then reporting the
+*    block ABSENT — and PR
+*    [#1433](https://github.com/go-to-k/cdkd/pull/1433)'s body carries the
+*    MIXED `keep 50 / reset -1` probe at the same position, re-run precisely
+*    because only `{-1, -1}` had been verified. `dynamodb-globaltable-provider.ts`
+*    has shipped on both since. #3373's dup-check dismissed those issues
+*    because `AWS::DynamoDB::GlobalTable` spells its per-GSI ceilings
+*    `Write` / `ReadOnDemandThroughputSettings` — true of the TEMPLATE and
+*    irrelevant to the WIRE, where both providers send the same
+*    `UpdateGlobalSecondaryIndexAction.OnDemandThroughput`.
+*
+* The read-back is ABSENCE, never `-1`, at both positions — so nothing on the
+* drift / `readCurrentState` side may expect this value.
+*/
+const ON_DEMAND_LIMIT_RESET$1 = -1;
+/**
+* Which `OnDemandThroughput` members this update must explicitly REMOVE, as a
+* list of member names (issue #3373).
+*
+* An absent member KEEPS whatever maximum the table already carries, so a
+* template edit that drops a ceiling used to deploy GREEN, be recorded as
+* applied, and leave the live maximum in force forever — the #1160
+* absent-field-reset class, one level down inside a nested block.
+*
+* PER MEMBER, never per BLOCK: read and write maxima are independent template
+* values, so a whole-block branch would drop the single-member removal, which
+* is the likelier user edit (the `AWS::DynamoDB::GlobalTable` twin paid for
+* that once already).
+*
+* FOUR conditions, all necessary, each closing a different way this goes
+* wrong:
+*
+*  1. **the PREVIOUS side declared it AND it survived narrowing.**
+*     `previousProperties` is a cdkd STATE record and the record is RAW — it
+*     holds the spelling the TEMPLATE declared, including a member
+*     {@link narrowOnDemandCeilings} REFUSED and cdkd therefore never sent. A
+*     raw presence test would read such a member as "previously applied".
+*  2. **the DESIRED side does not declare it AT ALL, raw.** This is issue
+*     [#1440](https://github.com/go-to-k/cdkd/issues/1440) exactly: a member
+*     the grammar rejected is the template TRYING to SET a ceiling, and taking
+*     the reset branch for it would silently CLEAR the ceiling being set. The
+*     narrowed desired side cannot tell those apart; the raw one can.
+*  3. **AWS actually HOLDS the member right now.** It proves there is a maximum
+*     to remove, and it makes the whole rule fail CLOSED when cdkd holds no
+*     live snapshot — the correct direction for a send that DESTROYS a live
+*     value.
+*  4. **this update leaves the table on PAY_PER_REQUEST** (`ceilingsSendable`).
+*     Condition 3 does NOT subsume this, and believing it did was a BLOCKER on
+*     PR go-to-k/cdkd#3401 (spec review, M0). The live snapshot is the ONE
+*     `DescribeTable` at the top of `update()` and is never refreshed, while
+*     both removal arms run AFTER the BillingMode flip — so on a template that
+*     flips a live on-demand table to PROVISIONED **and** drops the ceiling,
+*     the pre-flight refusals both decline (neither side DECLARES a ceiling),
+*     the flip lands, and the stale snapshot then says the member is live: cdkd
+*     would send `-1` to a now-PROVISIONED table, AWS would reject it, and a
+*     previously-green no-op becomes a HALF-APPLIED deploy — the exact class
+*     the #3392 pre-flight exists to prevent. `dynamodb-globaltable-provider.ts`
+*     carries the same guard at both of its positions
+*     (`onDemandCeilingLive` / `!billingFlipped`), named in PR
+*     go-to-k/cdkd#1433's body as "skipped on a billing flip".
+*
+*     What the skip COSTS was asked and MEASURED, not assumed (the
+*     go-to-k/cdkd#3401 code review raised it; issue
+*     [#1441](https://github.com/go-to-k/cdkd/issues/1441) had already
+*     settled it). The worry is a round trip: deploy A sets a ceiling on a
+*     PAY_PER_REQUEST table, deploy B flips to PROVISIONED and drops it (the
+*     reset suppressed here), deploy C flips back declaring nothing — and
+*     since deploy B's template is now the previous side, condition 1 can
+*     never fire again, so a RETAINED ceiling would be unclearable. #1441's
+*     probe (us-east-1, 2026-08-10, transcript on the issue) ran exactly that
+*     sequence at the TABLE level: `DescribeTable` reports the block ABSENT
+*     after the flip, and it does NOT come back on the flip home. Nothing is
+*     stranded. The PER-INDEX round trip is not separately measured — issue
+*     [#3403](https://github.com/go-to-k/cdkd/issues/3403) — but it fails in
+*     the SAFE direction (a lingering maximum, never a destroyed one).
+*
+* Every member-presence test here is `Object.hasOwn`, not `in` (the
+* go-to-k/cdkd#3401 security review). `in` walks the prototype chain, and these
+* three tests gate a DESTRUCTIVE send off a cdkd STATE record — the own-key
+* convention `drift.ts`'s `hasOwnKey` / `ownValue` already follow for
+* state-derived bags (issue go-to-k/cdkd#2899). Not demonstrably reachable
+* today; the point is that the guard on a destroying path should not depend on
+* that staying true.
+*
+* `declared` present but NOT a plain block (a string, an array, an unresolved
+* intrinsic) yields NO removals: that value is forwarded VERBATIM for AWS to
+* reject by shape, and merging a sentinel into it is not expressible.
+*
+* And a declared block cdkd cannot READ AT ALL yields none either — a plain
+* object with no member surviving {@link narrowOnDemandCeilings}, i.e. only
+* rejected spellings or only names the grammar does not know (`{Ref: 'Unset'}`,
+* a mis-nested value). That is condition 2 one level up: such a block is not a
+* statement that the sibling member was REMOVED, it is a template cdkd could
+* not read, and clearing a live maximum on the strength of it is the same
+* destruction #1440 describes. An ABSENT desired side is the opposite and is
+* the headline case — nothing declared means nothing kept.
+*/
+function onDemandCeilingRemovals(declared, previous, live, ceilingsSendable) {
+	if (!ceilingsSendable) return [];
+	if (live === void 0) return [];
+	if (declared !== void 0 && !isPlainCapacityBlock(declared)) return [];
+	const previousBlock = narrowOnDemandCeilings(previous).block;
+	if (!isPlainCapacityBlock(previousBlock)) return [];
+	const declaredBlock = isPlainCapacityBlock(declared) ? declared : void 0;
+	if (declaredBlock !== void 0) {
+		const declaredSurvivors = narrowOnDemandCeilings(declaredBlock).block;
+		if (!isPlainCapacityBlock(declaredSurvivors) || !ON_DEMAND_CEILING_MEMBERS.some((member) => Object.hasOwn(declaredSurvivors, member))) return [];
+	}
+	const liveBag = live;
+	const removals = [];
+	for (const member of ON_DEMAND_CEILING_MEMBERS) {
+		if (!Object.hasOwn(previousBlock, member)) continue;
+		if (declaredBlock !== void 0 && Object.hasOwn(declaredBlock, member)) continue;
+		if (toFiniteNumber(liveBag[member]) === void 0) continue;
+		removals.push(member);
+	}
+	return removals;
+}
+/**
+* Merge the {@link onDemandCeilingRemovals} sentinels into a block bound for
+* the wire (issue #3373).
+*
+* A COPY, never a mutation of `block`: {@link narrowOnDemandCeilings} returns
+* its input BY IDENTITY when nothing needed rewriting, so mutating here would
+* write `-1` into the caller's own `properties` bag — which the engine then
+* records as state.
+*/
+function withOnDemandCeilingRemovals(block, removals) {
+	if (removals.length === 0) return block;
+	const merged = { ...isPlainCapacityBlock(block) ? block : {} };
+	for (const member of removals) merged[member] = ON_DEMAND_LIMIT_RESET$1;
+	return merged;
+}
+/**
 * The capacity both TABLE-level forwarders substitute for a member the
 * template does not declare at all — `create()`'s `CreateTable` and the
 * BillingMode flip's `UpdateTable`. It is the pre-issue-#3147 `?? 5`, kept
@@ -18313,15 +18564,27 @@ function reverseMapSecondaryIndex(live, desired, bagInformative) {
 *    [#3255](https://github.com/go-to-k/cdkd/issues/3255), across ALL FOUR
 *    per-index send sites (`create()`'s mapper plus `applyGsiUpdates`'
 *    adopted-repair, `Create` and same-name `Update` actions);
-*    `OnDemandThroughput`'s from issue
-*    [#3265](https://github.com/go-to-k/cdkd/issues/3265), across its own four
-*    (the two TABLE-level forwards plus `create()`'s mapper and
-*    `applyGsiUpdates`' `Create` action) — ever SUPPRESSES the block: each
+*    `OnDemandThroughput`'s from issues
+*    [#3265](https://github.com/go-to-k/cdkd/issues/3265) and
+*    [#3287](https://github.com/go-to-k/cdkd/issues/3287), across its own SIX
+*    (the two TABLE-level forwards, `create()`'s mapper, and all three
+*    `applyGsiUpdates` actions) — ever SUPPRESSES the block: each
 *    rewrites members inside a block that is sent either way, so "would cdkd
 *    send this block" is unchanged by them, even where both members were
 *    dropped and an empty block goes out. That is the reason
 *    {@link DynamoDBTableProvider.coerceOnDemandCeilingsForSend} drops a
-*    MEMBER and never the block. Widening
+*    MEMBER and never the block.
+*
+*    **The two per-index UPDATE arms added by #3287 are the ONE qualification,
+*    and it does not reach this predicate.**
+*    {@link DynamoDBTableProvider.indexCeilingForSend} withholds the MEMBER
+*    from an `UpdateGlobalSecondaryIndexAction` when nothing survived, because
+*    an action carrying only `IndexName` is rejected outright — where the
+*    TABLE-level arm sends the empty block and lets DynamoDB answer. That is a
+*    statement about one OP, not about whether the template declared a block
+*    cdkd forwards: the same bag still reaches `CreateTable` / `UpdateTable`
+*    wherever those arms run, so the predicate's answer is unchanged.
+*    Widening
 *    `isSendableWarmThroughput` over them would be wrong twice over — it reads
 *    members those blocks do not have (`ReadUnitsPerSecond` vs
 *    `ReadCapacityUnits`), so every declared capacity would read as undeclared.
@@ -18601,7 +18864,17 @@ var DynamoDBTableProvider = class {
 			const billingOrThroughputChanged = billingMode !== prevBillingMode || JSON.stringify(properties["ProvisionedThroughput"]) !== JSON.stringify(previousProperties["ProvisionedThroughput"]);
 			if (billingOrThroughputChanged && billingMode === "PROVISIONED" && (prevBillingMode === "PAY_PER_REQUEST" || liveBillingMode === "PAY_PER_REQUEST") && properties["OnDemandThroughput"] !== void 0) {
 				const absentNote = properties["BillingMode"] === void 0 ? " (BillingMode is absent from the template, which CloudFormation resets to PROVISIONED)" : "";
-				throw new ProvisioningError(`AWS::DynamoDB::Table ${logicalId}: the template flips BillingMode to PROVISIONED${absentNote} while still declaring OnDemandThroughput, which AWS accepts only on a PAY_PER_REQUEST table. Nothing was applied. Remove OnDemandThroughput, or keep BillingMode: PAY_PER_REQUEST.`, logicalId, resourceType);
+				throw new ProvisioningError(`AWS::DynamoDB::Table ${logicalId}: the template flips BillingMode to PROVISIONED${absentNote} while still declaring OnDemandThroughput, which AWS accepts only on a PAY_PER_REQUEST table. No BillingMode flip and no index change were applied. Remove OnDemandThroughput, or keep BillingMode: PAY_PER_REQUEST.`, resourceType, logicalId);
+			}
+			const effectiveBillingMode = billingOrThroughputChanged ? billingMode : liveBillingMode;
+			if (effectiveBillingMode === "PROVISIONED") {
+				const ceilingIndexNames = (Array.isArray(properties["GlobalSecondaryIndexes"]) ? properties["GlobalSecondaryIndexes"] : []).filter((entry) => entry !== null && typeof entry === "object" && !Array.isArray(entry)).filter((entry) => Boolean(entry["OnDemandThroughput"])).map((entry) => typeof entry["IndexName"] === "string" ? maskSecrets(entry["IndexName"]) : "<unnamed>");
+				if (ceilingIndexNames.length > 0) {
+					const modeNote = billingOrThroughputChanged ? "" : " (the table is already PROVISIONED in AWS and this update sends no BillingMode change)";
+					const message = `AWS::DynamoDB::Table ${logicalId}: GlobalSecondaryIndexes ${ceilingIndexNames.join(", ")} declare OnDemandThroughput while the table's billing mode is PROVISIONED${modeNote}, which AWS accepts only on a PAY_PER_REQUEST table. Remove the per-index OnDemandThroughput, or set BillingMode: PAY_PER_REQUEST.`;
+					if (context?.replayingState === true || context?.desiredFromAwsReadback === true) warn(`${message} Downgraded to a warning because this update's desired properties did not come from the template, so there is no template-side remedy; the per-index ceiling will be sent and AWS will reject it.`);
+					else throw new ProvisioningError(`${message} No BillingMode flip and no index change were applied.`, resourceType, logicalId, physicalId);
+				}
 			}
 			const liveIndexes = table?.GlobalSecondaryIndexes ?? [];
 			const desiredIndexByName = /* @__PURE__ */ new Map();
@@ -18632,8 +18905,8 @@ var DynamoDBTableProvider = class {
 					if (tableCapacityUnusable) reasons.push(`the template declares no usable table-level ProvisionedThroughput`);
 					warn(`AWS::DynamoDB::Table ${logicalId}: this deploy removes global secondary index(es) ${removable.map((n) => maskSecrets(n)).join(", ")} and flips BillingMode to PROVISIONED. The removal would normally be applied BEFORE the flip, but ${reasons.join(" and ")}, so AWS rejects the flip either way. Nothing was removed.`);
 				} else if (removable.length > 0) {
-					this.logger.debug(`Deleting GSI(s) ${removable.join(", ")} on DynamoDB table ${physicalId} before the BillingMode flip to PROVISIONED`);
-					await this.runGsiOps(physicalId, removable.map((name) => ({ Delete: { IndexName: name } })), void 0);
+					debug(`Deleting GSI(s) ${removable.join(", ")} on DynamoDB table ${physicalId} before the BillingMode flip to PROVISIONED`);
+					await this.runGsiOps(physicalId, removable.map((name) => ({ Delete: { IndexName: name } })), void 0, maskSecrets);
 					for (const name of removable) preFlipDeletedIndexNames.add(name);
 				}
 			}
@@ -18685,10 +18958,13 @@ var DynamoDBTableProvider = class {
 				this.logger.debug(`Updated BillingMode/ProvisionedThroughput/TableClass on DynamoDB table ${physicalId}`);
 			}
 			if (JSON.stringify(properties["OnDemandThroughput"]) !== JSON.stringify(previousProperties["OnDemandThroughput"])) {
-				if (properties["OnDemandThroughput"]) {
+				const ceilingRemovals = onDemandCeilingRemovals(properties["OnDemandThroughput"], previousProperties["OnDemandThroughput"], table?.OnDemandThroughput, effectiveBillingMode === "PAY_PER_REQUEST");
+				if (properties["OnDemandThroughput"] || ceilingRemovals.length > 0) {
+					const declaredForSend = properties["OnDemandThroughput"] ? this.coerceOnDemandCeilingsForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["OnDemandThroughput"], maskSecrets) : {};
+					if (ceilingRemovals.length > 0) debug(`AWS::DynamoDB::Table ${logicalId}: removing the OnDemandThroughput ${ceilingRemovals.join(" / ")} the template no longer declares (sending ${ON_DEMAND_LIMIT_RESET$1}, DynamoDB's reset sentinel)`);
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
-						OnDemandThroughput: this.coerceOnDemandCeilingsForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["OnDemandThroughput"], maskSecrets)
+						OnDemandThroughput: withOnDemandCeilingRemovals(declaredForSend, ceilingRemovals)
 					}));
 					await this.waitForTableActiveAfterUpdate(physicalId);
 					this.logger.debug(`Updated OnDemandThroughput on DynamoDB table ${physicalId}`);
@@ -18757,7 +19033,7 @@ var DynamoDBTableProvider = class {
 					this.logger.debug(`Disabled DynamoDB Stream on table ${physicalId}`);
 				}
 			}
-			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, maskSecrets);
+			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, effectiveBillingMode === "PAY_PER_REQUEST", maskSecrets);
 			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"], maskSecrets);
 			if (JSON.stringify(properties["TimeToLiveSpecification"]) !== JSON.stringify(previousProperties["TimeToLiveSpecification"])) {
 				this.assertNoActiveTtlAttributeNameChange(logicalId, resourceType, physicalId, properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"]);
@@ -18951,7 +19227,7 @@ var DynamoDBTableProvider = class {
 	* change", so a dropped block must be turned into an explicit
 	* `PointInTimeRecoveryEnabled: false`).
 	*/
-	async applyPointInTimeRecovery(tableName, spec, previousSpec, maskSecrets = (text) => text) {
+	async applyPointInTimeRecovery(tableName, spec, previousSpec, maskSecrets) {
 		let enabled;
 		let recoveryPeriodInDays;
 		if (spec !== void 0 && spec !== null) {
@@ -19126,7 +19402,7 @@ var DynamoDBTableProvider = class {
 	* pre-existing WarmThroughput "no clean remap" stance; precision changes flow
 	* through on the create / first-enable path.
 	*/
-	async applyKinesisStreamingDestination(tableName, spec, previousSpec, maskSecrets = (text) => text) {
+	async applyKinesisStreamingDestination(tableName, spec, previousSpec, maskSecrets) {
 		const newArn = this.extractKinesisStreamArn(spec);
 		const prevArn = this.extractKinesisStreamArn(previousSpec);
 		if (newArn === prevArn) {
@@ -19316,8 +19592,9 @@ var DynamoDBTableProvider = class {
 	*    a remove-then-add pair, so this method throws on such a change rather than
 	*    silently dropping it.
 	*/
-	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip = /* @__PURE__ */ new Set(), liveIndexNames, liveIndexByName, liveCapacityComparable = false, maskSecrets = (text) => text) {
+	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip, liveIndexNames, liveIndexByName, liveCapacityComparable, onDemandCeilingsSendable, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
+		const debug = (message) => this.logger.debug(maskSecrets(message));
 		const prev = previousGsis ?? [];
 		const desired = desiredGsis ?? [];
 		const prevByName = new Map(prev.filter((g) => g.IndexName).map((g) => [g.IndexName, g]));
@@ -19326,7 +19603,7 @@ var DynamoDBTableProvider = class {
 		for (const name of prevByName.keys()) {
 			if (desiredByName.has(name)) continue;
 			if (liveIndexNames !== void 0 && !liveIndexNames.has(name)) {
-				this.logger.debug(`GSI ${name} is recorded in cdkd state but not live on DynamoDB table ${physicalId}; skipping its Delete (already removed)`);
+				debug(`${this.indexScopeAt(name, physicalId, maskSecrets)} is recorded in cdkd state but not live; skipping its Delete (already removed)`);
 				continue;
 			}
 			ops.push({ Delete: { IndexName: name } });
@@ -19335,7 +19612,7 @@ var DynamoDBTableProvider = class {
 			const live = liveIndexByName?.get(name);
 			if (!gsi.KeySchema) throw new ProvisioningError(`GlobalSecondaryIndex ${name} on DynamoDB table ${logicalId} is missing KeySchema`, resourceType, logicalId, physicalId);
 			if (live !== void 0 && live.IndexStatus !== "DELETING") {
-				warn(`GSI ${maskSecrets(name)} on DynamoDB table ${physicalId} already exists in AWS but is absent from cdkd's recorded previous state, so its Create is being skipped. This usually means an earlier deploy created the index and then failed before state was written.`);
+				warn(`${this.indexScopeAt(name, physicalId, maskSecrets)} already exists in AWS but is absent from cdkd's recorded previous state, so its Create is being skipped. This usually means an earlier deploy created the index and then failed before state was written.`);
 				const adopted = { IndexName: name };
 				let adoptedHasMember = false;
 				if (liveCapacityComparable && gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && !liveCapacityAlreadyMatches(live.ProvisionedThroughput, gsi.ProvisionedThroughput) && !this.skipZeroCapacityIndexUpdate(name, physicalId, gsi.ProvisionedThroughput, maskSecrets)) {
@@ -19347,8 +19624,13 @@ var DynamoDBTableProvider = class {
 					adopted.WarmThroughput = adoptedWarm;
 					adoptedHasMember = true;
 				}
+				const adoptedCeiling = this.indexCeilingForSend(name, physicalId, gsi, void 0, live, onDemandCeilingsSendable, maskSecrets);
+				if (adoptedCeiling) {
+					adopted.OnDemandThroughput = adoptedCeiling;
+					adoptedHasMember = true;
+				}
 				if (adoptedHasMember) ops.push({ Update: adopted });
-				warn(`GSI ${maskSecrets(name)} was adopted from AWS rather than created, so cdkd could not verify its KeySchema / Projection match the template. Run \`cdkd drift ${physicalId}\` to confirm, and \`cdkd drift --accept\` if AWS is the source of truth.`);
+				warn(`${this.indexScopeAt(name, physicalId, maskSecrets)} was adopted from AWS rather than created, so cdkd could not verify its KeySchema / Projection match the template. Run \`cdkd drift ${physicalId}\` to confirm, and \`cdkd drift --accept\` if AWS is the source of truth.`);
 				continue;
 			}
 			this.warnRefusedWarmThroughput(this.indexScopeAt(name, physicalId, maskSecrets), gsi.WarmThroughput, maskSecrets);
@@ -19367,7 +19649,7 @@ var DynamoDBTableProvider = class {
 			const update = { IndexName: name };
 			let updateHasMember = false;
 			if (gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && JSON.stringify(before.ProvisionedThroughput) !== JSON.stringify(gsi.ProvisionedThroughput)) {
-				if (liveCapacityComparable && liveCapacityAlreadyMatches(liveIndexByName?.get(name)?.ProvisionedThroughput, gsi.ProvisionedThroughput)) this.logger.debug(`GSI ${name} on DynamoDB table ${physicalId} already carries the requested capacity in AWS; skipping its throughput Update`);
+				if (liveCapacityComparable && liveCapacityAlreadyMatches(liveIndexByName?.get(name)?.ProvisionedThroughput, gsi.ProvisionedThroughput)) debug(`${this.indexScopeAt(name, physicalId, maskSecrets)} already carries the requested capacity in AWS; skipping its throughput Update`);
 				else if (!this.skipZeroCapacityIndexUpdate(name, physicalId, gsi.ProvisionedThroughput, maskSecrets)) {
 					update.ProvisionedThroughput = this.indexCapacityForSend(this.indexScopeAt(name, physicalId, maskSecrets), gsi.ProvisionedThroughput, maskSecrets);
 					updateHasMember = true;
@@ -19378,9 +19660,14 @@ var DynamoDBTableProvider = class {
 				update.WarmThroughput = warm;
 				updateHasMember = true;
 			}
+			const ceiling = this.indexCeilingForSend(name, physicalId, gsi, before, liveIndexByName?.get(name), onDemandCeilingsSendable, maskSecrets);
+			if (ceiling) {
+				update.OnDemandThroughput = ceiling;
+				updateHasMember = true;
+			}
 			if (updateHasMember) ops.push({ Update: update });
 		}
-		await this.runGsiOps(physicalId, ops, desiredAttributeDefinitions);
+		await this.runGsiOps(physicalId, ops, desiredAttributeDefinitions, maskSecrets);
 	}
 	/**
 	* The NUMERIC `WarmThroughput` spec to put on the wire, announcing any member
@@ -19393,7 +19680,7 @@ var DynamoDBTableProvider = class {
 	* two messages are disjoint by construction: this one fires only when
 	* something DID resolve.
 	*/
-	coerceWarmThroughputForSend(scope, value, maskSecrets = (text) => text) {
+	coerceWarmThroughputForSend(scope, value, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const coerced = coerceWarmThroughput(value);
 		if (coerced === void 0) return void 0;
@@ -19467,6 +19754,155 @@ var DynamoDBTableProvider = class {
 		return this.coerceIndexCapacityBlock(scope, declared, maskSecrets) ?? declared;
 	}
 	/**
+	* The per-index `OnDemandThroughput` an `UpdateGlobalSecondaryIndexAction`
+	* should carry, or `undefined` when no op is warranted (issue
+	* [#3287](https://github.com/go-to-k/cdkd/issues/3287)).
+	*
+	* The whole of that issue: `UpdateGlobalSecondaryIndexAction` declares the
+	* member, the SDK has always accepted it, and NEITHER update arm ever set it
+	* — while the `Create` action arm has carried it since issue #3265. So one
+	* template applied a per-index ceiling when the index was ADDED and silently
+	* discarded a later edit to it, recording the new value as applied so no
+	* later deploy converged. Routed through
+	* {@link coerceOnDemandCeilingsForSend} like the other five sites, so one
+	* template value cannot be answered differently at two of them.
+	*
+	* FIVE decisions, in the order the op is decided, plus one deliberate NON-decision:
+	*
+	*  - **The declaration gate is TRUTHINESS**, matching `indexDeclares`' gate
+	*    for this block and the `Create` arm's `gsi.OnDemandThroughput` test. A
+	*    tighter gate here would make the #1767 drift-side predicate answer
+	*    "declared" for a block this arm skips.
+	*  - **The BILLING MODE is deliberately NOT gated here**, and that is a
+	*    decision with a filed issue rather than an oversight. DynamoDB accepts
+	*    `OnDemandThroughput` only on a PAY_PER_REQUEST table, and the ceiling
+	*    rides the SAME action as the capacity — so on a PROVISIONED one the op
+	*    is rejected and takes an otherwise-valid capacity edit with it. A gate
+	*    WITHHOLDING the member was written for the go-to-k/cdkd#3380 review's M1
+	*    and REVERTED on the next round: a mid-update warn-and-skip lets the
+	*    deploy succeed, so the engine records the un-sent ceiling as applied and
+	*    the deploy that FIXES the billing mode then compares equal and never
+	*    sends it — issue #3287's own defect, reintroduced by its own guard. The
+	*    file's table-level twin states that reasoning at its own refusal.
+	*
+	*    **The refusal it pointed at has SHIPPED** (issue
+	*    [#3392](https://github.com/go-to-k/cdkd/issues/3392)): `update()` walks
+	*    `GlobalSecondaryIndexes[]` before any call and throws when the EFFECTIVE
+	*    billing mode is PROVISIONED, which covers all THREE per-index send sites
+	*    at once (this arm, the same-name `Update` arm's caller, and the `Create`
+	*    action, which has carried the same defect since #3265) because none of
+	*    them is reached. So this arm's job is unchanged and stays deliberately
+	*    mode-blind: a gate here would be a SECOND spelling of one rule, and the
+	*    mid-update spelling is the one that was measured wrong.
+	*
+	*    On the REPLAY path the pre-flight downgrades to a warning and this arm
+	*    still runs, so the remaining behaviour is what #3287's round 3 recorded:
+	*    the member goes out, AWS rejects the `UpdateTable`, and the co-resident
+	*    capacity / warm edits fail with it. Loud and recording nothing beats
+	*    silent and lost.
+	*  - **The change detector compares the NARROWED blocks WHEN NOTHING WAS
+	*    DROPPED, and the RAW ones otherwise** — the one place it differs from its
+	*    `ProvisionedThroughput` sibling two arms up. `'200'` and `200` are the
+	*    SAME ceiling once coerced, so a purely narrowed detector saves an
+	*    `UpdateGlobalSecondaryIndexAction` — and a full index-ACTIVE wait — on a
+	*    re-spelling. But narrowing ALONE conceals a case the raw compare reports
+	*    (the go-to-k/cdkd#3380 spec review's Drift 2): two DIFFERENT rejected
+	*    spellings (`' 25 '` against a recorded `' 30 '`) narrow to the same
+	*    block, so the arm would return before {@link
+	*    DynamoDBTableProvider.coerceOnDemandCeilingsForSend} ever warns and the
+	*    user would stop being told what to fix — exactly what
+	*    `.claude/rules/provider-diff-record-folds.md` refuses and what keeps the
+	*    TABLE-level detector raw. So the discriminator is
+	*    {@link narrowOnDemandCeilings}'s OWN `dropped` report: any drop on either
+	*    side falls back to the RAW compare, which keeps the announcement alive
+	*    while the narrowed compare still absorbs a lossless re-spelling.
+	*  - **A block with no SURVIVING GRAMMAR MEMBER emits NO op, and WARNS.** The TABLE-level
+	*    arm sends the empty block and lets DynamoDB answer; here the action can
+	*    legitimately carry nothing but `IndexName`, which AWS rejects outright,
+	*    so an empty ceiling would take a capacity edit down with it or fire a
+	*    doomed call on its own. The test is per MEMBER and not
+	*    `Object.keys(...).length === 0` (the go-to-k/cdkd#3380 review's m2):
+	*    {@link narrowOnDemandCeilings} preserves an unknown member name by
+	*    design, so a typo'd `MaxReadRequestUnit` leaves a non-empty object that
+	*    the SDK serializes to `{}` — the same rejected action, reached past a
+	*    key-count gate. The fail-open "let AWS name it" reasoning does NOT reach
+	*    that shape here, because AWS never sees the name to name. The warning is
+	*    this arm's OWN, not {@link warnUnusableOnDemandCeiling}'s (round 2's C3):
+	*    an unknown member is never DROPPED by the narrowing — its name is
+	*    preserved — so the per-member announcement says nothing about it, and
+	*    withholding silently would lose the ceiling where the pre-gate code at
+	*    least failed loudly at AWS.
+	*  - **A block that is not a plain object is forwarded VERBATIM**, the
+	*    fail-open direction every forwarder in this file takes: a STRING, a
+	*    NUMBER or an ARRAY is AWS's to reject by name — and unlike the unknown
+	*    member above, AWS really does see it and rejects it by shape.
+	*  - **The live ceiling is consulted for idempotency**
+	*    ({@link liveCeilingAlreadyMatches}), the #1630 arm the capacity sibling
+	*    already has, and it needs NO billing-mode gate: `DescribeTable` reports
+	*    `OnDemandThroughput` only on a PAY_PER_REQUEST table, so on a
+	*    PROVISIONED one the live block is simply absent and the guard fails
+	*    OPEN — the correct direction, since the worst case is the op AWS then
+	*    rejects by name (issue #3392) rather than a silently dropped change.
+	*    There is no `{0, 0}` analogue of the #1571 capacity trap.
+	*
+	* It DOES remove a ceiling, since issue
+	* [#3373](https://github.com/go-to-k/cdkd/issues/3373) — and the removal is
+	* the one thing here that runs AHEAD of the truthiness gate, because the
+	* whole point is a desired side that declares nothing. An absent member KEEPS
+	* whatever maximum the index already carries, so before #3373 a template edit
+	* dropping a ceiling deployed GREEN, was recorded as applied, and left the
+	* live maximum in force forever.
+	*
+	* {@link onDemandCeilingRemovals} owns every condition and
+	* {@link ON_DEMAND_LIMIT_RESET} carries the measurement for THIS action's
+	* position (issue #1423's probe transcript, not an extrapolation from the
+	* table-level field's docs). Two properties of that rule matter most here:
+	* the previous side is read through {@link narrowOnDemandCeilings} so a
+	* member cdkd REFUSED cannot read as "previously applied"; the reset fires
+	* only for a member AWS is OBSERVED to hold, which makes it fail CLOSED with
+	* no live snapshot; and it is suppressed outright when this update FLIPS the
+	* table to PROVISIONED (`onDemandCeilingsSendable`). Do not read the
+	* observed-live condition as covering the flip — it does not, and believing
+	* it did was a merge blocker: the live snapshot is taken before the flip and
+	* never refreshed.
+	*
+	* The TABLE-level arm in `update()` takes the same rule in the same change,
+	* because implementing it at ONE of the two positions would make the same
+	* property behave differently at the table and at an index of the same table.
+	*/
+	indexCeilingForSend(name, physicalId, gsi, before, live, onDemandCeilingsSendable, maskSecrets) {
+		const removals = onDemandCeilingRemovals(gsi.OnDemandThroughput, before?.OnDemandThroughput, live?.OnDemandThroughput, onDemandCeilingsSendable);
+		if (!gsi.OnDemandThroughput) {
+			if (removals.length === 0) return void 0;
+			const removalScope = this.indexScopeAt(name, physicalId, maskSecrets);
+			this.logger.debug(maskSecrets(`${removalScope}: removing the OnDemandThroughput ${removals.join(" / ")} the template no longer declares (sending ${ON_DEMAND_LIMIT_RESET$1}, DynamoDB's reset sentinel)`));
+			return withOnDemandCeilingRemovals({}, removals);
+		}
+		if (before !== void 0) {
+			const desired = narrowOnDemandCeilings(gsi.OnDemandThroughput);
+			const previous = narrowOnDemandCeilings(before.OnDemandThroughput);
+			const [desiredSide, previousSide] = desired.dropped.length > 0 || previous.dropped.length > 0 ? [gsi.OnDemandThroughput, before.OnDemandThroughput] : [desired.block, previous.block];
+			if (JSON.stringify(desiredSide) === JSON.stringify(previousSide)) return void 0;
+		}
+		const scope = this.indexScopeAt(name, physicalId, maskSecrets);
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		const debug = (message) => this.logger.debug(maskSecrets(message));
+		const coerced = this.coerceOnDemandCeilingsForSend(scope, gsi.OnDemandThroughput, maskSecrets);
+		if (!isPlainCapacityBlock(coerced)) return coerced;
+		if (removals.length > 0) debug(`${scope}: removing the OnDemandThroughput ${removals.join(" / ")} the template no longer declares (sending ${ON_DEMAND_LIMIT_RESET$1}, DynamoDB's reset sentinel)`);
+		const send = withOnDemandCeilingRemovals(coerced, removals);
+		if (!ON_DEMAND_CEILING_MEMBERS.some((member) => member in send)) {
+			if (narrowOnDemandCeilings(gsi.OnDemandThroughput).dropped.length > 0) debug(`${scope}: every declared OnDemandThroughput member was unusable, so no ceiling op was sent`);
+			else warn(`${scope}: declares an OnDemandThroughput with no member DynamoDB accepts (${ON_DEMAND_CEILING_MEMBERS.join(" / ")}), so no ceiling op was sent. Check the member names.`);
+			return;
+		}
+		if (liveCeilingAlreadyMatches(live?.OnDemandThroughput, send)) {
+			debug(`${scope}: already carries the requested OnDemandThroughput in AWS; skipping its ceiling Update`);
+			return;
+		}
+		return send;
+	}
+	/**
 	* One `CreateTable` index entry with ALL THREE of its throughput blocks
 	* coerced — `WarmThroughput` (PR review round 6), `ProvisionedThroughput`
 	* (issue [#3255](https://github.com/go-to-k/cdkd/issues/3255)) and
@@ -19499,7 +19935,7 @@ var DynamoDBTableProvider = class {
 	* value, which is pre-existing behaviour and costs one spread per declared
 	* block.
 	*/
-	coerceIndexThroughputForCreate(logicalId, entry, maskSecrets = (text) => text) {
+	coerceIndexThroughputForCreate(logicalId, entry, maskSecrets) {
 		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return entry;
 		const bag = entry;
 		const declaredWarm = bag["WarmThroughput"];
@@ -19585,7 +20021,7 @@ var DynamoDBTableProvider = class {
 	* same fail-open reason — a misspelled `ReadCapacityUnit` reaches AWS and is
 	* named there rather than vanishing here.
 	*/
-	coerceIndexCapacityBlock(scope, declared, maskSecrets = (text) => text) {
+	coerceIndexCapacityBlock(scope, declared, maskSecrets) {
 		if (!isPlainCapacityBlock(declared)) return void 0;
 		const block = declared;
 		let rewritten;
@@ -19606,7 +20042,7 @@ var DynamoDBTableProvider = class {
 	* through CloudFormation's DynamoDB Integer grammar (issue
 	* [#3265](https://github.com/go-to-k/cdkd/issues/3265)).
 	*
-	* Called from ALL FOUR send sites, which is the whole point — the block was
+	* Called from ALL SIX send sites, which is the whole point — the block was
 	* forwarded VERBATIM at every one of them, so a CFn-legal
 	* `MaxReadRequestUnits: '100'` reached AWS as the STRING `"100"` in a `Long`
 	* field and the request failed, while a `' 100 '` / `'0x64'` / `'1e2'`
@@ -19620,15 +20056,19 @@ var DynamoDBTableProvider = class {
 	*     same blind spot that hid this forwarder from issue #3147's sweep and
 	*     from #3255's round 6, one property over);
 	*  3. `update()`'s TABLE-level `UpdateTable.OnDemandThroughput`;
-	*  4. `applyGsiUpdates`' per-index `Create` action.
-	*
-	* FOUR and not six: `UpdateGlobalSecondaryIndexAction` declares
-	* `OnDemandThroughput` too, and neither the adopted-index repair nor the
-	* same-name `Update` arm ever sets it — so a ceiling EDIT on a live index is
-	* silently discarded today. That is a MISSING SEND rather than a grammar
-	* defect, so it is not routed here; issue
-	* [#3287](https://github.com/go-to-k/cdkd/issues/3287) holds it, and it will
-	* read through this function when it lands.
+	*  4. `applyGsiUpdates`' per-index `Create` action;
+	*  5. `applyGsiUpdates`' same-name `Update` action, and
+	*  6. its adopted-index repair `Update` — both through
+	*     {@link indexCeilingForSend}, added by issue
+	*     [#3287](https://github.com/go-to-k/cdkd/issues/3287).
+	*
+	* Sites 5 and 6 were the MISSING SEND rather than a grammar defect: until
+	* #3287 `UpdateGlobalSecondaryIndexAction.OnDemandThroughput` was declared by
+	* the SDK and set by neither arm, and `updateHasMember` was set only by the
+	* capacity and warm arms — so a template whose only edit was a live index's
+	* ceiling fired no op at all, the engine recorded the new value, and the next
+	* deploy compared EQUAL. The edit was lost permanently, with nothing refused
+	* and nothing dropped to warn about.
 	*
 	* THREE decisions, each with a plausible alternative:
 	*
@@ -19684,9 +20124,16 @@ var DynamoDBTableProvider = class {
 	* fail. Closing it needs `effectiveProperties` AND its
 	* `canonicalizeDesiredProperties` twin (the rule requires the pair; shipping
 	* the first alone re-issues a no-op `UpdateTable` on every later deploy), and
-	* this provider implements neither today. Tracked as issue
-	* [#3286](https://github.com/go-to-k/cdkd/issues/3286); the warning names the
-	* residual so a user is not left to discover it from a `cdkd drift` line. The
+	* this provider implements neither today. That pair was WRITTEN and
+	* WITHDRAWN: `observedProperties` is captured from the RAW template bag in
+	* `deploy-engine.ts`, so a folded record leaves the observed side carrying a
+	* per-index ceiling the record omits, and `drift-calculator.ts` compares
+	* `GlobalSecondaryIndexes` as one positional deep-equal array — the fold
+	* MANUFACTURES the phantom drift it exists to remove. Agreeing the two is a
+	* deploy-engine change across three call sites. Tracked as issue
+	* [#3286](https://github.com/go-to-k/cdkd/issues/3286), which carries the
+	* evidence; the warning names the residual so a user is not left to discover
+	* it from a `cdkd drift` line. The
 	* `AWS::DynamoDB::GlobalTable` sibling answers the SAME way for the same
 	* spelling — `collectTableOnDemandCeilings` coerces through
 	* `coerceCfnInteger` and a rejected ceiling is reported and LEFT UNSENT, with
@@ -19694,20 +20141,9 @@ var DynamoDBTableProvider = class {
 	* capacity answer, not its ceiling one) — so the two types do not diverge.
 	*/
 	coerceOnDemandCeilingsForSend(scope, declared, maskSecrets) {
-		if (!isPlainCapacityBlock(declared)) return declared;
-		const block = declared;
-		let rewritten;
-		for (const member of ON_DEMAND_CEILING_MEMBERS) {
-			if (!(member in block)) continue;
-			const coerced = coerceCfnInteger(block[member]);
-			if (coerced === block[member]) continue;
-			rewritten ??= { ...block };
-			if (coerced === void 0) {
-				this.warnUnusableOnDemandCeiling(scope, member, block[member], maskSecrets);
-				delete rewritten[member];
-			} else rewritten[member] = coerced;
-		}
-		return rewritten ?? block;
+		const { block, dropped } = narrowOnDemandCeilings(declared);
+		for (const { member, raw } of dropped) this.warnUnusableOnDemandCeiling(scope, member, raw, maskSecrets);
+		return block;
 	}
 	/**
 	* Announce an `OnDemandThroughput` member a forwarder DROPPED (issue
@@ -19793,7 +20229,7 @@ var DynamoDBTableProvider = class {
 	* table that does not exist. {@link tableCapacityForSend}'s doc carries why
 	* this type differs.
 	*/
-	warnUnusableProvisionedCapacity(scope, member, raw, maskSecrets = (text) => text) {
+	warnUnusableProvisionedCapacity(scope, member, raw, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		warn(`${scope}: ProvisionedThroughput.${member} ${JSON.stringify(maskLeafValue$1(raw, maskSecrets))} is not an Integer CloudFormation accepts (an optional sign and decimal digits only — no surrounding whitespace, hex, exponent or decimal point), so it was NOT sent and NO capacity was substituted for it. DynamoDB requires both members wherever a PROVISIONED ProvisionedThroughput block is declared — the table itself, and every GlobalSecondaryIndexes[] entry of a PROVISIONED table — and will reject the request naming this one; CloudFormation refuses the same template at properties validation. Check for an unresolved intrinsic, or spell the value as a decimal integer.`);
 	}
@@ -19809,7 +20245,7 @@ var DynamoDBTableProvider = class {
 	* Silent for an ABSENT or FALSY value — see {@link isRefusedWarmThroughput}
 	* for why those two are not this warning's business.
 	*/
-	warnRefusedWarmThroughput(scope, value, maskSecrets = (text) => text) {
+	warnRefusedWarmThroughput(scope, value, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		if (!isRefusedWarmThroughput(value)) return;
 		warn(`${scope}: the declared WarmThroughput ${JSON.stringify(maskLeafValue$1(value, maskSecrets))} carries no usable ReadUnitsPerSecond or WriteUnitsPerSecond, so it was NOT sent — DynamoDB accepts only those two members and rejects a request without either. Check for a misspelled member name or an unresolved intrinsic. Nothing else on this resource was affected.`);
@@ -19867,19 +20303,19 @@ var DynamoDBTableProvider = class {
 	*    `DescribeTable` reports for every index anyway, so there is no divergence
 	*    to hide.
 	*/
-	skipZeroCapacityIndexUpdate(indexName, physicalId, requested, maskSecrets = (text) => text) {
+	skipZeroCapacityIndexUpdate(indexName, physicalId, requested, maskSecrets) {
 		if (requested === void 0) return false;
 		if (toFiniteNumber(requested.ReadCapacityUnits) !== 0 || toFiniteNumber(requested.WriteCapacityUnits) !== 0) return false;
 		const warn = (message) => this.logger.warn(maskSecrets(message));
-		warn(`GSI ${maskSecrets(indexName)} on DynamoDB table ${physicalId}: the requested ProvisionedThroughput is {ReadCapacityUnits: 0, WriteCapacityUnits: 0}, which is AWS's on-demand placeholder rather than a capacity DynamoDB accepts (the minimum is 1), so no per-index throughput update was sent. This usually means the value came from a pre-#1767 cdkd state record — a \`cdkd drift --revert\` of such a record, or a rollback replaying it. Re-run \`cdkd deploy\` (or \`cdkd drift --accept\`) to refresh the record.`);
+		warn(`${this.indexScopeAt(indexName, physicalId, maskSecrets)}: the requested ProvisionedThroughput is {ReadCapacityUnits: 0, WriteCapacityUnits: 0}, which is AWS's on-demand placeholder rather than a capacity DynamoDB accepts (the minimum is 1), so no per-index throughput update was sent. This usually means the value came from a pre-#1767 cdkd state record — a \`cdkd drift --revert\` of such a record, or a rollback replaying it. Re-run \`cdkd deploy\` (or \`cdkd drift --accept\`) to refresh the record.`);
 		return true;
 	}
 	/**
 	* The per-index `WarmThroughput` this update should send, or `undefined`
 	* (issue #1768, one nesting level down from the table-level branch).
 	*
-	* `applyGsiUpdates` used to send only `ProvisionedThroughput` /
-	* `OnDemandThroughput` on both of its arms, while `readCurrentState` emits a
+	* `applyGsiUpdates` used to send only `ProvisionedThroughput` on both of its
+	* arms, while `readCurrentState` emits a
 	* declared per-index `WarmThroughput` — so a template declaring one had it
 	* silently dropped on every index add / change, `cdkd drift` reported the
 	* difference forever, and `--revert` emitted no op at all and exited 0
@@ -19900,23 +20336,23 @@ var DynamoDBTableProvider = class {
 	*    lower than current WarmThroughput, decreasing WarmThroughput is not
 	*    supported`.
 	*/
-	warmThroughputOpFor(indexName, physicalId, desired, previous, live, maskSecrets = (text) => text) {
+	warmThroughputOpFor(indexName, physicalId, desired, previous, live, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const debug = (message) => this.logger.debug(maskSecrets(message));
-		const safeIndexName = maskSecrets(indexName);
+		const scope = this.indexScopeAt(indexName, physicalId, maskSecrets);
 		const requested = desired.WarmThroughput;
 		if (previous !== void 0 && JSON.stringify(previous.WarmThroughput) === JSON.stringify(requested)) return;
-		const sendable = this.coerceWarmThroughputForSend(`GSI ${safeIndexName} on DynamoDB table ${physicalId}`, requested, maskSecrets);
+		const sendable = this.coerceWarmThroughputForSend(scope, requested, maskSecrets);
 		if (sendable === void 0) {
-			this.warnRefusedWarmThroughput(`GSI ${safeIndexName} on DynamoDB table ${physicalId}`, requested, maskSecrets);
+			this.warnRefusedWarmThroughput(scope, requested, maskSecrets);
 			return;
 		}
 		if (warmThroughputAlreadyMatches(sendable, live?.WarmThroughput)) {
-			debug(`GSI ${safeIndexName} on DynamoDB table ${physicalId} already carries the requested warm throughput in AWS; skipping its WarmThroughput Update`);
+			debug(`${scope} already carries the requested warm throughput in AWS; skipping its WarmThroughput Update`);
 			return;
 		}
 		if (isWarmThroughputDecrease(sendable, live?.WarmThroughput)) {
-			warn(`GSI ${safeIndexName} on DynamoDB table ${physicalId}: the requested WarmThroughput ${JSON.stringify(maskDeep(sendable, maskSecrets))} is lower than the ${JSON.stringify(maskDeep({
+			warn(`${scope}: the requested WarmThroughput ${JSON.stringify(maskDeep(sendable, maskSecrets))} is lower than the ${JSON.stringify(maskDeep({
 				ReadUnitsPerSecond: live?.WarmThroughput?.ReadUnitsPerSecond,
 				WriteUnitsPerSecond: live?.WarmThroughput?.WriteUnitsPerSecond
 			}, maskSecrets))} DynamoDB currently holds for that index. Warm throughput only ever RISES with an index's traffic and cannot be lowered — AWS rejects the UpdateTable with "decreasing WarmThroughput is not supported" — so it was NOT sent and every other change on this table still applied. On a deploy this warning may be the only signal you get: a successful deploy re-captures AWS's current value as the drift baseline. If your template declares this index's WarmThroughput, set it to the value AWS holds (or remove it, which AWS treats as keeping the last-set value); if it does not, the value came from a cdkd state record and 'cdkd deploy' (or 'cdkd drift --accept') refreshes it.`);
@@ -19933,7 +20369,8 @@ var DynamoDBTableProvider = class {
 	* of it — the wait is what makes the next op (there, the BillingMode flip)
 	* legal.
 	*/
-	async runGsiOps(physicalId, ops, desiredAttributeDefinitions) {
+	async runGsiOps(physicalId, ops, desiredAttributeDefinitions, maskSecrets) {
+		const debug = (message) => this.logger.debug(maskSecrets(message));
 		for (const op of ops) {
 			const input = {
 				TableName: physicalId,
@@ -19942,8 +20379,7 @@ var DynamoDBTableProvider = class {
 			if (op.Create && desiredAttributeDefinitions) input.AttributeDefinitions = desiredAttributeDefinitions;
 			await this.dynamoDBClient.send(new UpdateTableCommand(input));
 			await this.waitForTableAndIndexesActive(physicalId);
-			const verb = op.Create ? "created" : op.Delete ? "deleted" : "updated";
-			this.logger.debug(`${verb} GSI ${op.Create?.IndexName ?? op.Delete?.IndexName ?? op.Update?.IndexName} on DynamoDB table ${physicalId}`);
+			debug(`${op.Create ? "created" : op.Delete ? "deleted" : "updated"} ${this.indexScopeAt(op.Create?.IndexName ?? op.Delete?.IndexName ?? op.Update?.IndexName, physicalId, maskSecrets)}`);
 		}
 	}
 	/**
@@ -19992,7 +20428,7 @@ var DynamoDBTableProvider = class {
 	* resource clean. The message therefore says the warning may be the only
 	* signal, and names both numbers so the template edit needs no second look.
 	*/
-	skipWarmThroughputDecrease(logicalId, physicalId, desired, live, maskSecrets = (text) => text) {
+	skipWarmThroughputDecrease(logicalId, physicalId, desired, live, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		if (!isWarmThroughputDecrease(desired, live)) return false;
 		warn(`AWS::DynamoDB::Table ${logicalId}: the requested WarmThroughput ${JSON.stringify(maskDeep(desired, maskSecrets))} is lower than the ${JSON.stringify(maskDeep({
@@ -79924,11 +80360,12 @@ async function stateOrphanCommand(stackArgs, options) {
 			if (!options.force) {
 				for (const target of targets) if (await setup.lockManager.isLocked(stackName, target.region)) {
 					const where = target.region ? displaySafe(target.region, { asciiOnly: true }) || "<unrenderable>" : "legacy";
-					throw new Error(`Stack '${displaySafe(stackName, { asciiOnly: true })}' (${where}) is locked. Run: ${buildForceUnlockCommand(stackName, target.region, {
+					const recoveryCommand = buildForceUnlockCommand(stackName, target.region, {
 						profile: options.profile,
 						stateBucket: setup.bucket,
 						statePrefix: options.statePrefix
-					}) || "a command cdkd cannot show safely: the recorded name or region would not survive a command line intact, so inspect the lock object directly"} first, or pass --force to remove anyway.`);
+					});
+					throw new Error(`Stack '${displaySafe(stackName, { asciiOnly: true })}' (${where}) is locked. ` + (recoveryCommand ? `Run: ${recoveryCommand} first, or pass --force to remove anyway.` : `${UNREPRODUCIBLE_LOCK_CLAUSE} Or pass --force to remove anyway.`));
 				}
 			}
 			if (!options.yes && !options.force) {
@@ -87997,11 +88434,11 @@ async function pullEcrImage(imageUri, options) {
 		const cached = ASSUMED_ROLE_CACHE.get(cacheKey);
 		if (cached && isCredentialFresh(cached)) {
 			assumed = cached;
-			logger.debug(`Reusing cached AssumeRole credentials for ${options.ecrRoleArn}`);
+			logger.debug(`Reusing cached AssumeRole credentials for ${displayIdent(options.ecrRoleArn, { maxCodePoints: 612 })}`);
 		} else {
 			assumed = await assumeRoleForEcr(options.ecrRoleArn, callerRegion, logger);
 			ASSUMED_ROLE_CACHE.set(cacheKey, assumed);
-			logger.info(`Assumed role ${options.ecrRoleArn} for ECR pull (account=${parsed.accountId}, region=${parsed.region})`);
+			logger.info(`Assumed role ${displayIdent(options.ecrRoleArn, { maxCodePoints: 612 })} for ECR pull (account=${parsed.accountId}, region=${parsed.region})`);
 		}
 	} else if (crossAccount) logger.info(`Cross-account ECR pull: image account ${parsed.accountId} != caller ${callerAccount}. Using the caller's credentials; pass --ecr-role-arn <arn> if AWS rejects with AccessDenied.`);
 	if (crossRegion) logger.info(`Cross-region ECR pull: image region ${parsed.region} != caller ${callerRegion ?? "(unset)"}. Authenticating against the image region directly.`);
@@ -88032,7 +88469,7 @@ async function pullEcrImage(imageUri, options) {
 * mirrors the convention used by `src/utils/role-arn.ts`.
 */
 async function assumeRoleForEcr(roleArn, callerRegion, logger) {
-	logger.debug(`Assuming role ${roleArn} for ECR pull...`);
+	logger.debug(`Assuming role ${displayIdent(roleArn, { maxCodePoints: 612 })} for ECR pull...`);
 	const sts = new STSClient({
 		...awsClientDefaults(),
 		...callerRegion && { region: callerRegion }
@@ -88043,7 +88480,7 @@ async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 			RoleSessionName: `cdkd-local-ecr-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds || !creds.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new LocalInvokeBuildError$1(`AssumeRole(${roleArn}) returned no usable credentials. Verify the role's trust policy allows your identity to assume it.`);
+		if (!creds || !creds.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new LocalInvokeBuildError$1(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials. Verify the role's trust policy allows your identity to assume it.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -88053,7 +88490,7 @@ async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 	} catch (err) {
 		if (err instanceof LocalInvokeBuildError$1) throw err;
 		const reason = err instanceof Error ? err.message : String(err);
-		throw new LocalInvokeBuildError$1(`Failed to assume role ${roleArn} for ECR pull: ${reason}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
+		throw new LocalInvokeBuildError$1(`Failed to assume role ${displayIdent(roleArn, { maxCodePoints: 612 })} for ECR pull: ${displaySafe(reason)}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
 	} finally {
 		sts.destroy();
 	}
@@ -88371,7 +88808,7 @@ const CONTAINER_AWS_CREDENTIALS_PATH = "/cdkd-aws/credentials";
 */
 async function writeProfileCredentialsFile(profileName, creds) {
 	if (profileName === "") throw new Error("writeProfileCredentialsFile: profile name must not be empty.");
-	if (/[\r\n[\]]/.test(profileName)) throw new Error(`writeProfileCredentialsFile: profile name '${profileName}' contains a forbidden character (any of CR, LF, '[', ']' would corrupt the INI file or the docker -e env var).`);
+	if (/[\r\n[\]]/.test(profileName)) throw new Error(`writeProfileCredentialsFile: profile name ${displayIdent(profileName)} contains a forbidden character (any of CR, LF, '[', ']' would corrupt the INI file or the docker -e env var).`);
 	const dir = await mkdtemp(path.join(tmpdir(), "cdkd-profile-creds-"));
 	const hostPath = path.join(dir, "credentials");
 	const lines = [
@@ -88380,7 +88817,15 @@ async function writeProfileCredentialsFile(profileName, creds) {
 		`aws_secret_access_key = ${creds.secretAccessKey}`
 	];
 	if (creds.sessionToken) lines.push(`aws_session_token = ${creds.sessionToken}`);
-	await writeFile(hostPath, lines.join("\n") + "\n", { mode: 384 });
+	try {
+		await writeFile(hostPath, lines.join("\n") + "\n", { mode: 384 });
+	} catch (err) {
+		await rm(dir, {
+			recursive: true,
+			force: true
+		}).catch(() => {});
+		throw err;
+	}
 	return {
 		hostPath,
 		containerPath: CONTAINER_AWS_CREDENTIALS_PATH,
@@ -90393,7 +90838,11 @@ async function resolveProfileCredentials(profile) {
 	try {
 		const credsProvider = sts.config.credentials;
 		const creds = typeof credsProvider === "function" ? await credsProvider() : credsProvider;
-		if (!creds || !creds.accessKeyId || !creds.secretAccessKey) throw new Error(`--profile '${profile}': credential provider chain resolved without usable credentials. Check \`aws sso login --profile ` + profile + "` for SSO profiles, or `~/.aws/credentials` / `~/.aws/config` for regular profiles.");
+		if (!creds || !creds.accessKeyId || !creds.secretAccessKey) {
+			const shownProfile = displayIdent(profile);
+			const ssoHint = isPasteableIdent(profile) ? "run `aws sso login --profile " + profile + "`" : "run `aws sso login` for that profile -- cdkd is not writing the command out, because it cannot vouch that the name as rendered is the one your shell would act on";
+			throw new Error(`--profile ${shownProfile}: credential provider chain resolved without usable credentials. For SSO profiles, ${ssoHint}. For regular profiles, check \`~/.aws/credentials\` / \`~/.aws/config\`.`);
+		}
 		return {
 			accessKeyId: creds.accessKeyId,
 			secretAccessKey: creds.secretAccessKey,
@@ -90420,7 +90869,7 @@ async function assumeLambdaExecutionRole$1(roleArn, region) {
 			RoleSessionName: `cdkd-local-start-api-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${roleArn}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -90982,7 +91431,7 @@ async function resolveEcsSecrets(entries, options = {}) {
 	try {
 		return await Promise.all(entries.map(async (entry) => {
 			const value = await resolveOne(entry, secretsClient, ssmClient);
-			logger.debug(`Resolved secret ${entry.containerName}.${entry.name} (${entry.valueFrom})`);
+			logger.debug(`Resolved secret ${displayIdent(entry.containerName)}.${displayIdent(entry.name)} (${displayIdent(entry.valueFrom, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })})`);
 			return {
 				...entry,
 				value
@@ -90999,7 +91448,7 @@ async function resolveOne(entry, secretsClient, ssmClient) {
 	switch (shape.kind) {
 		case "secrets-manager": return resolveSecretsManager(entry, shape, secretsClient);
 		case "ssm": return resolveSsm(entry, shape, ssmClient);
-		case "unknown": throw new EcsSecretsResolutionError(`Container '${entry.containerName}' secret '${entry.name}' references an unsupported ValueFrom shape '${arn}'. Expected Secrets Manager ARN (optionally with :<json-key>::) or SSM Parameter ARN.`);
+		case "unknown": throw new EcsSecretsResolutionError(`Container '${displayIdent(entry.containerName)}' secret '${displayIdent(entry.name)}' references an unsupported ValueFrom shape ${displayIdent(arn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}. Expected Secrets Manager ARN (optionally with :<json-key>::) or SSM Parameter ARN.`);
 	}
 }
 /**
@@ -91032,20 +91481,20 @@ async function resolveSecretsManager(entry, shape, client) {
 	try {
 		secretString = (await client.send(new GetSecretValueCommand({ SecretId: shape.baseArn }))).SecretString;
 	} catch (err) {
-		throw new EcsSecretsResolutionError(`Failed to resolve Secrets Manager secret for container '${entry.containerName}' / env '${entry.name}' (${shape.baseArn}): ${err instanceof Error ? err.message : String(err)}`);
+		throw new EcsSecretsResolutionError(`Failed to resolve Secrets Manager secret for container '${displayIdent(entry.containerName)}' / env '${displayIdent(entry.name)}' (${displayIdent(shape.baseArn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}): ${displaySafe(err instanceof Error ? err.message : String(err))}`);
 	}
-	if (secretString === void 0) throw new EcsSecretsResolutionError(`Secrets Manager returned no SecretString for container '${entry.containerName}' / env '${entry.name}' (${shape.baseArn}). Binary secrets are not supported.`);
+	if (secretString === void 0) throw new EcsSecretsResolutionError(`Secrets Manager returned no SecretString for container '${displayIdent(entry.containerName)}' / env '${displayIdent(entry.name)}' (${displayIdent(shape.baseArn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}). Binary secrets are not supported.`);
 	if (shape.jsonKey === void 0) return secretString;
 	let parsed;
 	try {
 		parsed = JSON.parse(secretString);
 	} catch (err) {
 		const kind = err instanceof Error ? err.name : "unknown";
-		throw new EcsSecretsResolutionError(`Container '${entry.containerName}' secret '${entry.name}' specified json-key '${shape.jsonKey}' but the secret value is not valid JSON (${kind}). The parser detail is withheld because it would echo the secret plaintext.`);
+		throw new EcsSecretsResolutionError(`Container '${displayIdent(entry.containerName)}' secret '${displayIdent(entry.name)}' specified json-key '${displaySafe(shape.jsonKey)}' but the secret value is not valid JSON (${displayIdent(kind)}). The parser detail is withheld because it would echo the secret plaintext.`);
 	}
-	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new EcsSecretsResolutionError(`Container '${entry.containerName}' secret '${entry.name}' specified json-key '${shape.jsonKey}' but the secret root is not a JSON object.`);
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new EcsSecretsResolutionError(`Container '${displayIdent(entry.containerName)}' secret '${displayIdent(entry.name)}' specified json-key '${displaySafe(shape.jsonKey)}' but the secret root is not a JSON object.`);
 	const value = parsed[shape.jsonKey];
-	if (value === void 0) throw new EcsSecretsResolutionError(`Container '${entry.containerName}' secret '${entry.name}' specified json-key '${shape.jsonKey}' but no such key exists in the secret JSON.`);
+	if (value === void 0) throw new EcsSecretsResolutionError(`Container '${displayIdent(entry.containerName)}' secret '${displayIdent(entry.name)}' specified json-key '${displaySafe(shape.jsonKey)}' but no such key exists in the secret JSON.`);
 	return typeof value === "string" ? value : JSON.stringify(value);
 }
 async function resolveSsm(entry, shape, client) {
@@ -91054,11 +91503,11 @@ async function resolveSsm(entry, shape, client) {
 			Name: shape.name,
 			WithDecryption: true
 		}))).Parameter?.Value;
-		if (value === void 0) throw new EcsSecretsResolutionError(`SSM parameter '${shape.name}' returned no Value for container '${entry.containerName}' / env '${entry.name}'.`);
+		if (value === void 0) throw new EcsSecretsResolutionError(`SSM parameter '${displayIdent(shape.name, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}' returned no Value for container '${displayIdent(entry.containerName)}' / env '${displayIdent(entry.name)}'.`);
 		return value;
 	} catch (err) {
 		if (err instanceof EcsSecretsResolutionError) throw err;
-		throw new EcsSecretsResolutionError(`Failed to resolve SSM parameter for container '${entry.containerName}' / env '${entry.name}' (${shape.name}): ${err instanceof Error ? err.message : String(err)}`);
+		throw new EcsSecretsResolutionError(`Failed to resolve SSM parameter for container '${displayIdent(entry.containerName)}' / env '${displayIdent(entry.name)}' (${displayIdent(shape.name, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}): ${displaySafe(err instanceof Error ? err.message : String(err))}`);
 	}
 }
 
@@ -91662,8 +92111,9 @@ async function localRunTaskCommand(target, options) {
 	const state = createEcsRunState();
 	let sigintHandler;
 	let sigintCount = 0;
+	let detachedSuccessfully = false;
 	let stateProvider;
-	let profileCredsFile;
+	let channels;
 	let cleanupPromise;
 	const cleanup = async () => {
 		if (!cleanupPromise) cleanupPromise = (async () => {
@@ -91672,10 +92122,10 @@ async function localRunTaskCommand(target, options) {
 			} catch (err) {
 				getLogger().debug(`cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
 			}
-			if (profileCredsFile) try {
-				await profileCredsFile.dispose();
+			if (channels?.profileCredsFile) try {
+				await channels.profileCredsFile.dispose();
 			} catch (err) {
-				getLogger().debug(`Failed to remove profile credentials tmpdir ${profileCredsFile.hostPath}: ${err instanceof Error ? err.message : String(err)}`);
+				getLogger().debug(`Failed to remove profile credentials tmpdir ${channels.profileCredsFile.hostPath}: ${err instanceof Error ? err.message : String(err)}`);
 			}
 		})();
 		await cleanupPromise;
@@ -91741,33 +92191,20 @@ async function localRunTaskCommand(target, options) {
 			resolvedRoleArn = options.assumeTaskRole;
 			assumedCredentials = await assumeTaskRole(resolvedRoleArn, options.region);
 		}
-		const sidecarCredentials = await resolveSidecarCredentials(options, assumedCredentials);
-		if (options.profile && sidecarCredentials && !assumedCredentials) profileCredsFile = await writeProfileCredentialsFile(options.profile, sidecarCredentials);
+		channels = await resolveTaskCredentialChannels(options, assumedCredentials);
 		const envOverrides = readEnvOverridesFile$2(options.envVars);
-		const runOpts = {
-			cluster: options.cluster,
-			containerHost: options.containerHost,
-			skipPull: options.pull === false,
-			keepRunning: options.keepRunning,
-			detach: options.detach
-		};
-		if (envOverrides) runOpts.envOverrides = envOverrides;
-		if (sidecarCredentials) runOpts.taskCredentials = sidecarCredentials;
-		if (resolvedRoleArn) runOpts.taskRoleArn = resolvedRoleArn;
-		if (options.platform) runOpts.platformOverride = options.platform;
-		if (options.region) runOpts.region = options.region;
-		if (options.ecrRoleArn) runOpts.ecrRoleArn = options.ecrRoleArn;
-		if (profileCredsFile) runOpts.profileCredentialsFile = {
-			hostPath: profileCredsFile.hostPath,
-			containerPath: profileCredsFile.containerPath,
-			profileName: profileCredsFile.profileName
-		};
+		const runOpts = buildRunEcsTaskOptions(options, channels, {
+			...envOverrides !== void 0 && { envOverrides },
+			...resolvedRoleArn !== void 0 && { resolvedRoleArn }
+		});
 		const hostGatewayExtraHosts = await resolveHostGatewayExtraHosts();
 		if (hostGatewayExtraHosts.length > 0) runOpts.hostGatewayExtraHosts = hostGatewayExtraHosts;
 		const result = await runEcsTask(task, runOpts, state);
 		if (options.detach) {
 			logger.info("Task containers started in detached mode; cdkd is exiting.");
 			logger.info(`Use 'docker ps -a --filter network=${result.state.network?.networkName ?? "<network>"}' to inspect; tear down with 'docker rm -f' and 'docker network rm'.`);
+			if (channels.profileCredsFile) logger.info(`The AWS credentials file mounted into the containers is NOT removed in detached mode: delete ${displayIdent(channels.profileCredsFile.hostPath)} once you tear them down.`);
+			detachedSuccessfully = true;
 			sigintCount = 99;
 			return;
 		}
@@ -91776,7 +92213,7 @@ async function localRunTaskCommand(target, options) {
 	} finally {
 		if (sigintHandler) process.off("SIGINT", sigintHandler);
 		if (stateProvider) stateProvider.dispose();
-		if (!options.detach) await cleanup();
+		if (!detachedSuccessfully) await cleanup();
 	}
 }
 /**
@@ -91795,7 +92232,7 @@ async function resolvePlaceholderAccount(arn, region) {
 	});
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
-		if (!account) throw new Error(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN '${arn}'. Pass the ARN explicitly: --assume-task-role <arn>`);
+		if (!account) throw new Error(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN ${displayIdent(arn, { maxCodePoints: 612 })}. Pass the ARN explicitly: --assume-task-role <arn>`);
 		return arn.split(TASK_ROLE_ACCOUNT_PLACEHOLDER).join(account);
 	} finally {
 		sts.destroy();
@@ -91817,7 +92254,7 @@ async function assumeTaskRole(roleArn, region) {
 			RoleSessionName: `cdkd-local-run-task-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${roleArn}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -92004,6 +92441,106 @@ async function resolveSidecarCredentials(options, assumedCredentials) {
 	if (assumedCredentials) return assumedCredentials;
 	if (options.profile) return resolveProfileCredentials(options.profile);
 }
+/**
+* Resolve BOTH credential channels a locally-run ECS task receives, and decide
+* whether the second one exists at all.
+*
+* 1. `sidecarCredentials` — what the AWS-published
+*    `amazon-ecs-local-container-endpoints` sidecar serves at
+*    `169.254.170.2/role/<role>`; {@link resolveSidecarCredentials} owns the
+*    precedence (issue #658).
+* 2. `profileCredsFile` — the ECS analogue of PR #670 (Lambda-container
+*    fix-back finding #1). When `--profile <p>` is set AND `--assume-task-role`
+*    did NOT produce credentials for this task, a host-side AWS shared
+*    credentials file is written under `[<options.profile>]` and bind-mounted
+*    read-only into every user container, so handler code calling
+*    `fromIni({ profile: '<options.profile>' })` resolves to the same creds the
+*    sidecar serves. Without it the SDK looks for `[<options.profile>]` in
+*    `~/.aws/credentials` INSIDE the container and fails.
+*
+*    Gating on `!assumedCredentials` preserves the documented precedence
+*    (assume-task-role > profile-file > sidecar): when `--assume-task-role`
+*    won, the sidecar's `/role/<arn>` endpoint already serves the assumed creds
+*    and the file's env vars must NOT override them.
+*
+* ONE helper rather than two, and that is the substance of issue
+* go-to-k/cdkd#3378 rather than a tidying choice. Both of these lived inline in
+* `localRunTaskCommand`'s body, which meant the gate's annotation below was
+* fenced only for EXISTING (`local-surface-env-identity.test.ts` checks that an
+* annotation is there and carries a reason — it cannot check that the reason is
+* TRUE). And the reason is not a property of the `if` at all: it is a property
+* of the COMPOSITION, that `sidecarCredentials` on the `!assumedCredentials`
+* path can only have come from {@link resolveSidecarCredentials}'s `--profile`
+* arm. Extracting the three-line gate ALONE would have re-tested the same three
+* booleans and proved nothing; a test over this helper writes a real file and
+* can read the bytes back. `resolveSidecarCredentials`'s own doc already set
+* the precedent for the seam over a command-level harness — that harness would
+* have to mock the whole Synth + Docker + AWS pipeline, and a mock is exactly
+* what cannot answer "which identity's bytes landed in the file".
+*
+* cdkd-local-env-identity: the `!assumedCredentials` gate means
+* `resolveSidecarCredentials` reached its `--profile` arm, so this is
+* `resolveProfileCredentials` through
+* `awsClientDefaults({ ignoreAssumedRole: true })` — the caller's own chain,
+* never the `--role-arn` role — and never an `--assume-task-role` STS result,
+* which wins earlier and is served by the metadata sidecar instead.
+*/
+async function resolveTaskCredentialChannels(options, assumedCredentials) {
+	const sidecarCredentials = await resolveSidecarCredentials(options, assumedCredentials);
+	if (options.profile && sidecarCredentials && !assumedCredentials) return {
+		sidecarCredentials,
+		profileCredsFile: await writeProfileCredentialsFile(options.profile, sidecarCredentials)
+	};
+	return {
+		sidecarCredentials,
+		profileCredsFile: void 0
+	};
+}
+/**
+* Build the `RunEcsTaskOptions` bag from the options and the resolved credential
+* channels.
+*
+* Extracted for the WIRING, which is the half
+* {@link resolveTaskCredentialChannels} could not cover (go-to-k/cdkd#3390 round
+* 2, on go-to-k/cdkd#3394). That helper decides WHETHER a credentials file
+* exists and whose bytes are in it; this one decides whether the answer reaches
+* the runner at all. Between them sat a single assignment, and mutating it to
+* `undefined` left 114 tests green across five files: no file is bind-mounted,
+* so every handler calling `fromIni({ profile })` inside the task container
+* fails -- the exact defect PR go-to-k/cdkd#670 shipped this path to fix. "A
+* probed callee says nothing about its WIRING" is the rule, and this is the
+* seam that lets a unit test say something about it.
+*
+* PURE, and it takes the whole `channels` object rather than a pre-destructured
+* file so the test subject is the same value the resolver returns -- a helper
+* taking `profileCredsFile` alone would move the untested assignment rather
+* than remove it.
+*
+* The file is COPIED field by field rather than passed through: `dispose` stays
+* with the command, which owns the lifetime, and `RunEcsTaskOptions` deliberately
+* declares only the three fields the runner mounts with.
+*/
+function buildRunEcsTaskOptions(options, channels, extra = {}) {
+	const runOpts = {
+		cluster: options.cluster,
+		containerHost: options.containerHost,
+		skipPull: options.pull === false,
+		keepRunning: options.keepRunning,
+		detach: options.detach
+	};
+	if (extra.envOverrides) runOpts.envOverrides = extra.envOverrides;
+	if (channels.sidecarCredentials) runOpts.taskCredentials = channels.sidecarCredentials;
+	if (extra.resolvedRoleArn) runOpts.taskRoleArn = extra.resolvedRoleArn;
+	if (options.platform) runOpts.platformOverride = options.platform;
+	if (options.region) runOpts.region = options.region;
+	if (options.ecrRoleArn) runOpts.ecrRoleArn = options.ecrRoleArn;
+	if (channels.profileCredsFile) runOpts.profileCredentialsFile = {
+		hostPath: channels.profileCredsFile.hostPath,
+		containerPath: channels.profileCredsFile.containerPath,
+		profileName: channels.profileCredsFile.profileName
+	};
+	return runOpts;
+}
 function createLocalRunTaskCommand() {
 	const cmd = new Command("run-task").description("Run an AWS::ECS::TaskDefinition locally — pulls/builds images, sets up a per-task docker network with the AWS-published metadata-endpoints sidecar, and starts every container in dependsOn order. Target accepts a CDK display path (MyStack/MyService/TaskDef) or stack-qualified logical ID (MyStack:MyServiceTaskDefXYZ1234). Single-stack apps may omit the stack prefix.").argument("<target>", "CDK display path or stack-qualified logical ID of the AWS::ECS::TaskDefinition to run").addOption(new Option("--cluster <name>", "Cluster name surfaced to ECS_CONTAINER_METADATA_URI_V4 and used as the docker network prefix").default("cdkd-local")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"ContainerName\":{\"KEY\":\"VALUE\"}, \"Parameters\":{}})")).addOption(new Option("--container-host <ip>", "Host IP to bind published container ports to. Must be a numeric IP (Docker rejects hostnames here)").default("127.0.0.1")).addOption(new Option("--assume-task-role [arn]", "Assume the task definition's TaskRoleArn (or the supplied ARN) and forward STS-issued temp credentials via the metadata sidecar so containers run with the deployed function role. Bare flag uses the template's TaskRoleArn; pass an explicit ARN to override.")).addOption(new Option("--no-pull", "Skip docker pull for every container image and the metadata sidecar")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries (#455). Issues sts:AssumeRole via the default credential chain and uses the temporary credentials for ecr:GetAuthorizationToken + docker pull. Required when the caller does not have direct cross-account access to the target repository. A same-account pull in ANY region does not need this flag: the ECR client is built for the image URI's own region, so crossing a region costs nothing extra (issue #2536).")).addOption(new Option("--platform <platform>", "Force docker --platform (linux/amd64 or linux/arm64). Default: inferred from task RuntimePlatform.CpuArchitecture")).addOption(new Option("--keep-running", "Don't docker rm -f the user containers on task exit (network + sidecar are still torn down). Use when you want to docker exec into a stopped container for post-mortems.").default(false)).addOption(new Option("--detach", "Start the containers in the background and exit (skip log streaming + auto teardown). Useful in CI smoke tests; caller manages container lifecycle.").default(false)).addOption(new Option("--from-state", "Read cdkd S3 state for the target stack and substitute Fn::Sub / Fn::GetAtt references to same-stack AWS::ECR::Repository resources with the deployed URI. Off by default — only the AWS pseudo-parameter tier (${AWS::AccountId} / ${AWS::Region}) is resolved without this flag.").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in container env vars / secrets / image URIs with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the cdkd stack name; pass an explicit value when the CFn stack name differs. Mutually exclusive with --from-state. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-state when the same stack name has state in multiple regions, and with --from-cfn-stack as the CFn client region (cdkd does not have a separate --cfn-stack-region flag).").argParser(parseStackRegion)).action(withErrorHandling(localRunTaskCommand));
 	[
@@ -92874,7 +93411,13 @@ async function resolveHostCredentialsForSigV4(options, resolved, loaded, region)
 	if (assumeRoleArn) try {
 		return await assumeAgentCoreExecutionRole(assumeRoleArn, region);
 	} catch (err) {
-		logger.warn(`--assume-role: STS AssumeRole(${assumeRoleArn}) failed for --sigv4 signing: ${err instanceof Error ? err.message : String(err)}. Falling back to ${options.profile ? `--profile ${options.profile}` : "shell credentials"}.`);
+		logger.warn(assumeRoleFallbackWarning({
+			assumeRoleArn,
+			purpose: "--sigv4 signing",
+			error: err,
+			profile: options.profile,
+			fallbackWithoutProfile: "shell credentials"
+		}));
 	}
 	if (options.profile) {
 		const creds = await resolveProfileCredentials(options.profile);
@@ -92989,7 +93532,13 @@ async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options
 	if (assumeRoleArn) try {
 		credentials = await assumeAgentCoreExecutionRole(assumeRoleArn, region);
 	} catch (err) {
-		logger.warn(`--assume-role: STS AssumeRole(${assumeRoleArn}) failed for the fromS3 bundle download: ${err instanceof Error ? err.message : String(err)}. Falling back to ${options.profile ? `--profile ${options.profile}` : "the default credentials"}.`);
+		logger.warn(assumeRoleFallbackWarning({
+			assumeRoleArn,
+			purpose: "the fromS3 bundle download",
+			error: err,
+			profile: options.profile,
+			fallbackWithoutProfile: "the default credentials"
+		}));
 	}
 	const bundle = await downloadAndExtractS3Bundle(location, {
 		...region !== void 0 && { region },
@@ -93187,7 +93736,7 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 			if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
 			assumeSucceeded = true;
 		} catch (err) {
-			logger.warn(`--assume-role: STS AssumeRole(${args.assumeRoleArn}) failed: ${err instanceof Error ? err.message : String(err)}. Falling back to the developer's shell credentials.`);
+			logger.warn(`--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 612 })}) failed: ${displaySafe(err instanceof Error ? err.message : String(err))}. Falling back to the developer's shell credentials.`);
 		}
 	}
 	if (!assumeSucceeded) {
@@ -93200,6 +93749,53 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 	}
 }
 /**
+* The `--assume-role: STS AssumeRole(...) failed` warning, for the two sites
+* that emit the FALLBACK form of it — the `--sigv4` signing path and the fromS3 bundle download.
+*
+* ONE builder rather than two near-identical template literals, and that is
+* go-to-k/cdkd#3390's test review rather than tidiness. The two were twins, and
+* a twin is where a sanitizing rule goes half-applied: dropping `displayIdent`
+* from the fromS3 copy alone reddened only the source-shape fence, because the
+* `--sigv4` copy was the one with a behavioural case. As one PURE function both
+* sites inherit whatever this is tested to do, and there is one subject to test
+* rather than a second one somebody has to remember exists.
+*
+* TWO untrusted values, and both take `displayIdent` (issue
+* [#3377](https://github.com/go-to-k/cdkd/issues/3377) for the first, this PR's
+* security review for the second):
+*
+* - `profile` is user-supplied argv, and `ConsoleLogger.formatMessage`
+*   sanitizes only a call's EXTRA ARGS, never the message itself — so the
+*   message text is the last place it can be made safe. A MESSAGE, not a
+*   command to paste, so `displayIdent` and not `isPasteableIdent`;
+*   `resolveProfileCredentials` in `local-start-api.ts` is the site that needs
+*   both spellings and shows the difference.
+* - `assumeRoleArn` is the WIDER boundary of the two, which is why it is here
+*   at all: nothing validates it before `assumeAgentCoreExecutionRole` (whose
+*   own throw lands in the very `catch` that calls this), and
+*   `resolveAssumeRoleArn` can source it from a DEPLOYED STATE RECORD rather
+*   than from argv. Every character of a legitimate ARN is in `PLAIN_IDENT`, so
+*   it renders bare exactly as before. cdk-local's twin of this line flattens
+*   the same value for the same reason; cdkd had nothing.
+*
+* `error` takes `displaySafe` — the DENYLIST, since an SDK error message is
+* free-form text rather than an identifier, which is the line
+* `display-safe.ts`'s header draws. The first cut stringified it and sanitized
+* NOTHING, and go-to-k/cdkd#3390's round-2 security review showed that was the
+* hole the other two guards leave open: STS answers an unparseable RoleArn with
+* a `ValidationError` that ECHOES THE SUBMITTED VALUE VERBATIM, so the
+* attacker-controlled ARN comes back through the error string and lands on the
+* same line the `displayIdent` two expressions to its left was added to
+* protect. A C1 byte, `U+0085`, `U+2028` and the bidi overrides all survive an
+* XML 1.0 response body. `formatError` sanitizes a `cause` for exactly this
+* reason and cannot help here, because this is a logger MESSAGE and
+* `ConsoleLogger.formatMessage` sanitizes only a call's EXTRA ARGS.
+*/
+function assumeRoleFallbackWarning(args) {
+	const fallback = args.profile ? `--profile ${displayIdent(args.profile)}` : args.fallbackWithoutProfile;
+	return `--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 612 })}) failed for ${args.purpose}: ${displaySafe(args.error instanceof Error ? args.error.message : String(args.error))}. Falling back to ${fallback}.`;
+}
+/**
 * Resolve the role ARN to assume, honoring the three `--assume-role` forms.
 * Bare `--assume-role` uses the runtime's literal `RoleArn`; when that is an
 * intrinsic (the common L2 case — `Fn::GetAtt` to an auto-created role) it
@@ -93213,7 +93809,7 @@ function resolveAssumeRoleArn(options, resolved, loaded) {
 		if (loaded) {
 			const fromState = resolveExecutionRoleArnFromState(loaded, resolved.logicalId, "RoleArn");
 			if (fromState) {
-				getLogger().debug(`--assume-role: resolved RoleArn from state: ${fromState}`);
+				getLogger().debug(`--assume-role: resolved RoleArn from state: ${displayIdent(fromState)}`);
 				return fromState;
 			}
 		}
@@ -93358,7 +93954,7 @@ async function assumeAgentCoreExecutionRole(roleArn, region) {
 			RoleSessionName: `${getEmbedConfig().resourceNamePrefix}-invoke-agentcore-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new CdkdError(`AssumeRole(${roleArn}) returned no usable credentials.`, "LOCAL_INVOKE_AGENTCORE_ASSUMEROLE_NO_CREDS");
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new CdkdError(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`, "LOCAL_INVOKE_AGENTCORE_ASSUMEROLE_NO_CREDS");
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -93971,7 +94567,7 @@ async function localInvokeCommand(target, options) {
 				const arn = resolveExecutionRoleArnFromState(stateForRoleHint, lambda.logicalId);
 				if (arn) {
 					resolvedAssumeRoleArn = arn;
-					logger.info(`--assume-role: auto-resolved execution role from cdkd state: ${arn}`);
+					logger.info(`--assume-role: auto-resolved execution role from cdkd state: ${displayIdent(arn, { maxCodePoints: 612 })}`);
 				} else logger.warn(`--assume-role: could not resolve the execution role ARN from cdkd state for '${lambda.logicalId}'. Pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.`);
 			}
 		} else maybeSuggestAssumeRole(options, stateForRoleHint, lambda.logicalId);
@@ -94439,7 +95035,7 @@ async function applyLambdaCredentialEnv(dockerEnv, args) {
 			assumeSucceeded = true;
 		} catch (err) {
 			const reason = err instanceof Error ? err.message : String(err);
-			logger.warn(`--assume-role: STS AssumeRole(${args.assumeRoleArn}) failed: ${reason}. Falling back to the developer's shell credentials.`);
+			logger.warn(`--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 612 })}) failed: ${displaySafe(reason)}. Falling back to the developer's shell credentials.`);
 		}
 	}
 	if (!assumeSucceeded) {
@@ -94477,7 +95073,7 @@ async function assumeLambdaExecutionRole(roleArn, region) {
 			RoleSessionName: `cdkd-local-invoke-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${roleArn}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -94598,7 +95194,7 @@ function materializeInlineCode(handler, source, fileExtension) {
 function suggestAssumeRoleFromState(state, logicalId) {
 	const logger = getLogger();
 	const roleArn = resolveExecutionRoleArnFromState(state, logicalId);
-	if (roleArn) logger.info(`Hint: the deployed function uses execution role ${roleArn}. Re-run with --assume-role to invoke under the deployed function's narrow permissions.`);
+	if (roleArn) logger.info(`Hint: the deployed function uses execution role ${displayIdent(roleArn, { maxCodePoints: 612 })}. Re-run with --assume-role to invoke under the deployed function's narrow permissions.`);
 }
 /**
 * Emit the "re-run with `--assume-role`" hint, if it applies.
@@ -94758,4 +95354,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BgDlhE-S.js.map
+//# sourceMappingURL=program-C1iVGcxJ.js.map