@go-to-k/cdkd 0.290.27 → 0.290.28

package/dist/{program-dYPgGoOv.js → program-C1iVGcxJ.js}

@@ -1,8 +1,8 @@
-import { $ as secretBearing, $n as recordMaskOnlyValue, $r as getDockerImageBySourceHash, $t as s3BucketArn, A as extractDeploymentEventError, Ai as resetAwsClients, An as refuseMalformedState, Ar as assertAssetBucketRegion, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as LocalInvokeBuildError$1, Bn as STATE_SOURCED_BASELINE_RULES, Br as describeDockerCapturedOutput, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as derivePartitionAndUrlSuffix, Cn as producerRecordKey, Cr as WorkGraph, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Di as resolveBucketRegion, Dn as refuseMalformedOutputsForDestroy, Dr as rewriteTemplateAssetReferences, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, En as refuseMalformedOutputs, Er as loadPublishableAssetManifest, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fi as CrossAccountSecretRefusalError, Fn as findSilentDropProperties, Fr as readBootstrapMarkerBody, Ft as isSettledInstanceState, G as gray, Gi as PartialFailureError, Gn as createSecretMasker, Gr as getDockerCmd, Gt as readConfigString, H as formatResourceLine, Hn as STATE_SOURCED_READBACK_RULES, Hr as describeDockerFailure, Ht as configBooleanRefusal, I as renderStatefulReason, In as describeTypeWithThrottleRetry, Ir as validateAssetBucketName, It as WAFv2WebACLProvider, J as yellow, Ji as ResourceUpdateNotSupportedError, Jn as identityKeyFor, Jr as runDockerForeground, Jt as requireConfigObject, K as green, Ki as ProvisioningError, Kn as dynamicReferenceTokens, Kr as partitionSensitiveEnv, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Li as DeployCancelledError, Ln as withRetry, Lr as validateContainerRepoName, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mn as repairMalformedResourcePropertiesForReadOnly, Mr as getBootstrapMarkerKey, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ni as CdkdError, Nn as repairMalformedResourcesForReadOnly, Nr as isCrossRegionRedirect, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as AwsClients, On as refuseMalformedResourcePropertiesForOrphan, Or as AssetModeResolver, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pn as findActionableSilentDrops, Pr as parseBootstrapMarker, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as maskSecretsInText, Qr as AssetManifestLoader, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as DynamicReferenceRegionAmbiguousError, Rn as DagBuilder, Rr as buildDenyExternalAccessPolicy, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as canonicalizeRegion, Sn as malformedStateRefusalMessage, Sr as stringifyValue, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as processStackMessages, Tn as refuseMalformedNestedChildOutputs, Tr as createAssetRedirectResolver, Tt as carriesDynamicReference, U as bold, Ui as MalformedProducerRecordRefusalError, Un as TEMPLATE_SOURCED_RULES, Ur as dockerSpawnEnvWithSensitive, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as LocalStartServiceError, Vn as STATE_SOURCED_CROSS_GENERATION_RULES, Vr as describeDockerExecFailure, Vt as coerceCfnInteger, W as cyan, Wi as NestedStackChildDirectDestroyError, Wn as carriesSecretMask, Wr as formatDockerLoginError, Wt as configStringRefusal, X as collectPublishedOutputNames, Xi as StackTerminationProtectionError, Xn as markSameGenerationBag, Xr as escapeRegExp, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as StackHasActiveImportsError, Yn as isSingleDynamicReferenceToken, Yr as runDockerStreaming, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zn as maskSecretsInError, Zr as stripControlChars, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as uploadCfnTemplate, _n as malformedOutputsRefusalMessage, _r as isReadableBag, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isThrottlingError, ai as resolveAutoAssetStorage, an as AWS_CREDENTIAL_ENV_KEYS, ar as rebuildClientForBucketRegion, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as expectedOwnerParam, bn as malformedResourcePropertiesWarning, br as shouldRetainResource, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as markRedactedCause, ci as resolveStateBucketWithDefault, cn as envCredentialsAreAssumedRole, cr as forceQuitRecoveryClause, ct as createMaskedRetryLogger, d as updatePartialReason, da as safeStringify, di as stateBucketExistenceConfirmed, dn as STATE_RESOURCES_MALFORMED, dr as CUSTOM_RESOURCE_RESPONSE_PREFIX, dt as beginCommandInterruptScope, ei as Synthesizer, en as s3BucketDomainName, er as recoverMaskedOutput, et as secretBearingStateKeyWarning, f as withResourceDeadline, fi as warnDeprecatedNoPrefixCliFlag, fn as hasReadableOutputs, fr as DEFAULT_STATE_PREFIX, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as findLargeInlineResources, gn as malformedLocalOutputsWarning, gr as importableOutputs, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as MIGRATE_TMP_PREFIX, hn as malformedExportSourceWarning, hr as importableOutputKeys, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isRetryableTransientError, ii as resolveApp, in as applyRoleArnIfSet, ir as S3StateBackend, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as setAwsClients, jn as repairMalformedOutputsForReadOnly, jr as ensureAssetStorage, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as getAwsClients, kn as refuseMalformedResourcesForDestroy, kr as BOOTSTRAP_MARKER_PREFIX, kt as getAccountInfo, l as replayRollback, la as retryClassificationText, li as resolveStateBucketWithDefaultAndSource, ln as DiffCalculator, lr as formatLockExpiry, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as CFN_TEMPLATE_URL_LIMIT, mn as malformedExportNamesWarning, mr as hasReadableExportSet, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as withErrorHandling, ni as getDefaultStateBucketName, nn as s3BucketRegionalDomainName, nr as scrubResourceRecord, nt as getCurrentResourceSecrets, o as planFailedOps, oa as isTransientServerError, oi as resolveCaptureObservedState, on as applyCallerIdentityCredentials, or as buildForceUnlockCommand, ot as ProviderRegistry, p as maskingRetryLogger, pi as CFN_TEMPLATE_BODY_LIMIT, pn as hasReadableResources, pr as exportNamesCarriedFrom, pt as interruptWatchListenerCount, q as red, qi as ResourceTimeoutError, qn as errorCauseChain, qr as redactDockerArgvValues, qt as requireConfigArray, r as DeployEngine, ra as isMarkedNonRetryable, ri as getLegacyStateBucketName, rn as s3BucketWebsiteUrl, rr as LockManager, rt as IAMRoleProvider, s as planRollback, sa as markNonRetryable, si as resolveSkipPrefix, sn as callerEnvCredentials, sr as buildLockContentionMessage, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as normalizeAwsError, ti as synthesisStatusMessage, tn as s3BucketDualStackDomainName, tr as redactSecretsForState, tt as secretSafeKeyDisplay, u as updatePartialMessage, ua as describeAwsFailure, ui as resolveUseCdkBootstrapAssets, un as INTRINSIC_KEYS, ur as shellQuote, ut as maskerOrIdentity, v as keptWholeReasonText, vi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, vn as malformedOutputsWarning, vr as orphansAfterRollback, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as AssemblyReader, wn as refuseDivergentRecordRegionForDestroy, wr as buildAssetRedirectMap, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as PARTITION_TABLE, xn as malformedResourcesWarning, xr as AssetPublisher, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as decodeListingKey, yn as malformedRenderedContainersWarning, yr as orphansCarriedFrom, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as IntrinsicResolutionRefusalError, zn as TemplateParser, zr as buildDockerImage, zt as assertRegionMatch } from "./deploy-engine-CA70_Rji.js";
-import { C as displaySafe, S as displayIdent, _ as withSkipPrefix, b as STACK_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE } from "./logger-CkHVgzLx.js";
+import { $ as secretBearing, $n as recordMaskOnlyValue, $r as AssetManifestLoader, $t as s3BucketArn, A as extractDeploymentEventError, Ai as getAwsClients, An as refuseMalformedState, Ar as BOOTSTRAP_MARKER_PREFIX, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as IntrinsicResolutionRefusalError, Bn as STATE_SOURCED_BASELINE_RULES, Br as buildDockerImage, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as canonicalizeRegion, Cn as producerRecordKey, Cr as stringifyValue, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Dn as refuseMalformedOutputsForDestroy, Dr as loadPublishableAssetManifest, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as processStackMessages, En as refuseMalformedOutputs, Er as createAssetRedirectResolver, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fn as findSilentDropProperties, Fr as parseBootstrapMarker, Ft as isSettledInstanceState, G as gray, Gi as NestedStackChildDirectDestroyError, Gn as createSecretMasker, Gr as formatDockerLoginError, Gt as readConfigString, H as formatResourceLine, Hi as LocalStartServiceError, Hn as STATE_SOURCED_READBACK_RULES, Hr as describeDockerExecFailure, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as CrossAccountSecretRefusalError, In as describeTypeWithThrottleRetry, Ir as readBootstrapMarkerBody, It as WAFv2WebACLProvider, J as yellow, Ji as ResourceTimeoutError, Jn as identityKeyFor, Jr as redactDockerArgvValues, Jt as requireConfigObject, K as green, Ki as PartialFailureError, Kn as dynamicReferenceTokens, Kr as getDockerCmd, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Ln as withRetry, Lr as validateAssetBucketName, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mi as setAwsClients, Mn as repairMalformedResourcePropertiesForReadOnly, Mr as ensureAssetStorage, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as repairMalformedResourcesForReadOnly, Nr as getBootstrapMarkerKey, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as resolveBucketRegion, On as refuseMalformedResourcePropertiesForOrphan, Or as rewriteTemplateAssetReferences, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pi as CdkdError, Pn as findActionableSilentDrops, Pr as isCrossRegionRedirect, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as maskSecretsInText, Qr as stripControlChars, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as DeployCancelledError, Rn as DagBuilder, Rr as validateContainerRepoName, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as PARTITION_TABLE, Sn as malformedStateRefusalMessage, Sr as AssetPublisher, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as AssemblyReader, Tn as refuseMalformedNestedChildOutputs, Tr as buildAssetRedirectMap, Tt as carriesDynamicReference, U as bold, Un as TEMPLATE_SOURCED_RULES, Ur as describeDockerFailure, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as LocalInvokeBuildError$1, Vn as STATE_SOURCED_CROSS_GENERATION_RULES, Vr as describeDockerCapturedOutput, Vt as coerceCfnInteger, W as cyan, Wi as MalformedProducerRecordRefusalError, Wn as carriesSecretMask, Wr as dockerSpawnEnvWithSensitive, Wt as configStringRefusal, X as collectPublishedOutputNames, Xi as StackHasActiveImportsError, Xn as markSameGenerationBag, Xr as runDockerStreaming, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as ResourceUpdateNotSupportedError, Yn as isSingleDynamicReferenceToken, Yr as runDockerForeground, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zi as StackTerminationProtectionError, Zn as maskSecretsInError, Zr as escapeRegExp, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as findLargeInlineResources, _n as malformedOutputsRefusalMessage, _r as importableOutputs, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isRetryableTransientError, ai as resolveApp, an as AWS_CREDENTIAL_ENV_KEYS, ar as rebuildClientForBucketRegion, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as decodeListingKey, bn as malformedResourcePropertiesWarning, br as orphansCarriedFrom, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as markNonRetryable, ci as resolveSkipPrefix, cn as envCredentialsAreAssumedRole, cr as buildLockContentionMessage, ct as createMaskedRetryLogger, d as updatePartialReason, da as describeAwsFailure, di as resolveUseCdkBootstrapAssets, dn as STATE_RESOURCES_MALFORMED, dr as shellQuote, dt as beginCommandInterruptScope, ei as getDockerImageBySourceHash, en as s3BucketDomainName, er as recoverMaskedOutput, et as secretBearingStateKeyWarning, f as withResourceDeadline, fa as safeStringify, fi as stateBucketExistenceConfirmed, fn as hasReadableOutputs, fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as MIGRATE_TMP_PREFIX, gn as malformedLocalOutputsWarning, gr as importableOutputKeys, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as CFN_TEMPLATE_URL_LIMIT, hn as malformedExportSourceWarning, hr as hasReadableExportSet, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isMarkedNonRetryable, ii as getLegacyStateBucketName, in as applyRoleArnIfSet, ir as S3StateBackend, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as resetAwsClients, jn as repairMalformedOutputsForReadOnly, jr as assertAssetBucketRegion, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as AwsClients, kn as refuseMalformedResourcesForDestroy, kr as AssetModeResolver, kt as getAccountInfo, l as replayRollback, la as markRedactedCause, li as resolveStateBucketWithDefault, ln as DiffCalculator, lr as forceQuitRecoveryClause, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as CFN_TEMPLATE_BODY_LIMIT, mn as malformedExportNamesWarning, mr as exportNamesCarriedFrom, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as normalizeAwsError, ni as synthesisStatusMessage, nn as s3BucketRegionalDomainName, nr as scrubResourceRecord, nt as getCurrentResourceSecrets, o as planFailedOps, oa as isThrottlingError, oi as resolveAutoAssetStorage, on as applyCallerIdentityCredentials, or as UNREPRODUCIBLE_LOCK_CLAUSE, ot as ProviderRegistry, p as maskingRetryLogger, pi as warnDeprecatedNoPrefixCliFlag, pn as hasReadableResources, pr as DEFAULT_STATE_PREFIX, pt as interruptWatchListenerCount, q as red, qi as ProvisioningError, qn as errorCauseChain, qr as partitionSensitiveEnv, qt as requireConfigArray, r as DeployEngine, ra as withErrorHandling, ri as getDefaultStateBucketName, rn as s3BucketWebsiteUrl, rr as LockManager, rt as IAMRoleProvider, s as planRollback, sa as isTransientServerError, si as resolveCaptureObservedState, sn as callerEnvCredentials, sr as buildForceUnlockCommand, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as Synthesizer, tn as s3BucketDualStackDomainName, tr as redactSecretsForState, tt as secretSafeKeyDisplay, u as updatePartialMessage, ua as retryClassificationText, ui as resolveStateBucketWithDefaultAndSource, un as INTRINSIC_KEYS, ur as formatLockExpiry, ut as maskerOrIdentity, v as keptWholeReasonText, vi as uploadCfnTemplate, vn as malformedOutputsWarning, vr as isReadableBag, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as derivePartitionAndUrlSuffix, wn as refuseDivergentRecordRegionForDestroy, wr as WorkGraph, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as expectedOwnerParam, xn as malformedResourcesWarning, xr as shouldRetainResource, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, yn as malformedRenderedContainersWarning, yr as orphansAfterRollback, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as DynamicReferenceRegionAmbiguousError, zn as TemplateParser, zr as buildDenyExternalAccessPolicy, zt as assertRegionMatch } from "./deploy-engine-CcFbq2q8.js";
+import { C as displayIdent, S as UNRENDERABLE, T as truncateCodePoints, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displaySafe, x as STACK_REF_MAX_CODE_POINTS } from "./logger-6LP1UiFA.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-CWpPiHCn.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-Dn1f0SJi.js";
+import { t as getCdkdVersion } from "./version-B2-UuEte.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DiZsq-4k.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -17948,6 +17948,158 @@ function liveCeilingAlreadyMatches(live, requested) {
 	return compared > 0;
 }
 /**
+* The sentinel DynamoDB accepts to CLEAR an on-demand request-unit maximum
+* (issue [#3373](https://github.com/go-to-k/cdkd/issues/3373)).
+*
+* LIVE-VERIFIED at BOTH positions this file sends from, which is what makes it
+* implementable at both at once rather than at one and not the other:
+*
+*  - `UpdateTable.OnDemandThroughput` — AWS's own SDK model doc for the block,
+*    and the measurement recorded on issue
+*    [#1434](https://github.com/go-to-k/cdkd/issues/1434) (us-east-1 +
+*    us-west-2, 2026-08-09), which probed the SINGLE-member shape this file
+*    also sends: `{MaxWriteRequestUnits: -1}` against a live `{100, 100}` was
+*    accepted and read back as `{MaxReadRequestUnits: 100}`;
+*  - `UpdateTable.GlobalSecondaryIndexUpdates[].Update.OnDemandThroughput` —
+*    the position issue #3373's body called UNMEASURED. It is not, and the
+*    evidence is in TWO places, named separately because a reviewer checked
+*    and one of them is not where an earlier draft of this said it was:
+*    issue [#1423](https://github.com/go-to-k/cdkd/issues/1423)'s comment
+*    thread carries the `{-1, -1}` transcript (us-east-1, 2026-08-09,
+*    throwaway table) — ACCEPTED, with `DescribeTable` then reporting the
+*    block ABSENT — and PR
+*    [#1433](https://github.com/go-to-k/cdkd/pull/1433)'s body carries the
+*    MIXED `keep 50 / reset -1` probe at the same position, re-run precisely
+*    because only `{-1, -1}` had been verified. `dynamodb-globaltable-provider.ts`
+*    has shipped on both since. #3373's dup-check dismissed those issues
+*    because `AWS::DynamoDB::GlobalTable` spells its per-GSI ceilings
+*    `Write` / `ReadOnDemandThroughputSettings` — true of the TEMPLATE and
+*    irrelevant to the WIRE, where both providers send the same
+*    `UpdateGlobalSecondaryIndexAction.OnDemandThroughput`.
+*
+* The read-back is ABSENCE, never `-1`, at both positions — so nothing on the
+* drift / `readCurrentState` side may expect this value.
+*/
+const ON_DEMAND_LIMIT_RESET$1 = -1;
+/**
+* Which `OnDemandThroughput` members this update must explicitly REMOVE, as a
+* list of member names (issue #3373).
+*
+* An absent member KEEPS whatever maximum the table already carries, so a
+* template edit that drops a ceiling used to deploy GREEN, be recorded as
+* applied, and leave the live maximum in force forever — the #1160
+* absent-field-reset class, one level down inside a nested block.
+*
+* PER MEMBER, never per BLOCK: read and write maxima are independent template
+* values, so a whole-block branch would drop the single-member removal, which
+* is the likelier user edit (the `AWS::DynamoDB::GlobalTable` twin paid for
+* that once already).
+*
+* FOUR conditions, all necessary, each closing a different way this goes
+* wrong:
+*
+*  1. **the PREVIOUS side declared it AND it survived narrowing.**
+*     `previousProperties` is a cdkd STATE record and the record is RAW — it
+*     holds the spelling the TEMPLATE declared, including a member
+*     {@link narrowOnDemandCeilings} REFUSED and cdkd therefore never sent. A
+*     raw presence test would read such a member as "previously applied".
+*  2. **the DESIRED side does not declare it AT ALL, raw.** This is issue
+*     [#1440](https://github.com/go-to-k/cdkd/issues/1440) exactly: a member
+*     the grammar rejected is the template TRYING to SET a ceiling, and taking
+*     the reset branch for it would silently CLEAR the ceiling being set. The
+*     narrowed desired side cannot tell those apart; the raw one can.
+*  3. **AWS actually HOLDS the member right now.** It proves there is a maximum
+*     to remove, and it makes the whole rule fail CLOSED when cdkd holds no
+*     live snapshot — the correct direction for a send that DESTROYS a live
+*     value.
+*  4. **this update leaves the table on PAY_PER_REQUEST** (`ceilingsSendable`).
+*     Condition 3 does NOT subsume this, and believing it did was a BLOCKER on
+*     PR go-to-k/cdkd#3401 (spec review, M0). The live snapshot is the ONE
+*     `DescribeTable` at the top of `update()` and is never refreshed, while
+*     both removal arms run AFTER the BillingMode flip — so on a template that
+*     flips a live on-demand table to PROVISIONED **and** drops the ceiling,
+*     the pre-flight refusals both decline (neither side DECLARES a ceiling),
+*     the flip lands, and the stale snapshot then says the member is live: cdkd
+*     would send `-1` to a now-PROVISIONED table, AWS would reject it, and a
+*     previously-green no-op becomes a HALF-APPLIED deploy — the exact class
+*     the #3392 pre-flight exists to prevent. `dynamodb-globaltable-provider.ts`
+*     carries the same guard at both of its positions
+*     (`onDemandCeilingLive` / `!billingFlipped`), named in PR
+*     go-to-k/cdkd#1433's body as "skipped on a billing flip".
+*
+*     What the skip COSTS was asked and MEASURED, not assumed (the
+*     go-to-k/cdkd#3401 code review raised it; issue
+*     [#1441](https://github.com/go-to-k/cdkd/issues/1441) had already
+*     settled it). The worry is a round trip: deploy A sets a ceiling on a
+*     PAY_PER_REQUEST table, deploy B flips to PROVISIONED and drops it (the
+*     reset suppressed here), deploy C flips back declaring nothing — and
+*     since deploy B's template is now the previous side, condition 1 can
+*     never fire again, so a RETAINED ceiling would be unclearable. #1441's
+*     probe (us-east-1, 2026-08-10, transcript on the issue) ran exactly that
+*     sequence at the TABLE level: `DescribeTable` reports the block ABSENT
+*     after the flip, and it does NOT come back on the flip home. Nothing is
+*     stranded. The PER-INDEX round trip is not separately measured — issue
+*     [#3403](https://github.com/go-to-k/cdkd/issues/3403) — but it fails in
+*     the SAFE direction (a lingering maximum, never a destroyed one).
+*
+* Every member-presence test here is `Object.hasOwn`, not `in` (the
+* go-to-k/cdkd#3401 security review). `in` walks the prototype chain, and these
+* three tests gate a DESTRUCTIVE send off a cdkd STATE record — the own-key
+* convention `drift.ts`'s `hasOwnKey` / `ownValue` already follow for
+* state-derived bags (issue go-to-k/cdkd#2899). Not demonstrably reachable
+* today; the point is that the guard on a destroying path should not depend on
+* that staying true.
+*
+* `declared` present but NOT a plain block (a string, an array, an unresolved
+* intrinsic) yields NO removals: that value is forwarded VERBATIM for AWS to
+* reject by shape, and merging a sentinel into it is not expressible.
+*
+* And a declared block cdkd cannot READ AT ALL yields none either — a plain
+* object with no member surviving {@link narrowOnDemandCeilings}, i.e. only
+* rejected spellings or only names the grammar does not know (`{Ref: 'Unset'}`,
+* a mis-nested value). That is condition 2 one level up: such a block is not a
+* statement that the sibling member was REMOVED, it is a template cdkd could
+* not read, and clearing a live maximum on the strength of it is the same
+* destruction #1440 describes. An ABSENT desired side is the opposite and is
+* the headline case — nothing declared means nothing kept.
+*/
+function onDemandCeilingRemovals(declared, previous, live, ceilingsSendable) {
+	if (!ceilingsSendable) return [];
+	if (live === void 0) return [];
+	if (declared !== void 0 && !isPlainCapacityBlock(declared)) return [];
+	const previousBlock = narrowOnDemandCeilings(previous).block;
+	if (!isPlainCapacityBlock(previousBlock)) return [];
+	const declaredBlock = isPlainCapacityBlock(declared) ? declared : void 0;
+	if (declaredBlock !== void 0) {
+		const declaredSurvivors = narrowOnDemandCeilings(declaredBlock).block;
+		if (!isPlainCapacityBlock(declaredSurvivors) || !ON_DEMAND_CEILING_MEMBERS.some((member) => Object.hasOwn(declaredSurvivors, member))) return [];
+	}
+	const liveBag = live;
+	const removals = [];
+	for (const member of ON_DEMAND_CEILING_MEMBERS) {
+		if (!Object.hasOwn(previousBlock, member)) continue;
+		if (declaredBlock !== void 0 && Object.hasOwn(declaredBlock, member)) continue;
+		if (toFiniteNumber(liveBag[member]) === void 0) continue;
+		removals.push(member);
+	}
+	return removals;
+}
+/**
+* Merge the {@link onDemandCeilingRemovals} sentinels into a block bound for
+* the wire (issue #3373).
+*
+* A COPY, never a mutation of `block`: {@link narrowOnDemandCeilings} returns
+* its input BY IDENTITY when nothing needed rewriting, so mutating here would
+* write `-1` into the caller's own `properties` bag — which the engine then
+* records as state.
+*/
+function withOnDemandCeilingRemovals(block, removals) {
+	if (removals.length === 0) return block;
+	const merged = { ...isPlainCapacityBlock(block) ? block : {} };
+	for (const member of removals) merged[member] = ON_DEMAND_LIMIT_RESET$1;
+	return merged;
+}
+/**
 * The capacity both TABLE-level forwarders substitute for a member the
 * template does not declare at all — `create()`'s `CreateTable` and the
 * BillingMode flip's `UpdateTable`. It is the pre-issue-#3147 `?? 5`, kept
@@ -18712,7 +18864,17 @@ var DynamoDBTableProvider = class {
 			const billingOrThroughputChanged = billingMode !== prevBillingMode || JSON.stringify(properties["ProvisionedThroughput"]) !== JSON.stringify(previousProperties["ProvisionedThroughput"]);
 			if (billingOrThroughputChanged && billingMode === "PROVISIONED" && (prevBillingMode === "PAY_PER_REQUEST" || liveBillingMode === "PAY_PER_REQUEST") && properties["OnDemandThroughput"] !== void 0) {
 				const absentNote = properties["BillingMode"] === void 0 ? " (BillingMode is absent from the template, which CloudFormation resets to PROVISIONED)" : "";
-				throw new ProvisioningError(`AWS::DynamoDB::Table ${logicalId}: the template flips BillingMode to PROVISIONED${absentNote} while still declaring OnDemandThroughput, which AWS accepts only on a PAY_PER_REQUEST table. Nothing was applied. Remove OnDemandThroughput, or keep BillingMode: PAY_PER_REQUEST.`, logicalId, resourceType);
+				throw new ProvisioningError(`AWS::DynamoDB::Table ${logicalId}: the template flips BillingMode to PROVISIONED${absentNote} while still declaring OnDemandThroughput, which AWS accepts only on a PAY_PER_REQUEST table. No BillingMode flip and no index change were applied. Remove OnDemandThroughput, or keep BillingMode: PAY_PER_REQUEST.`, resourceType, logicalId);
+			}
+			const effectiveBillingMode = billingOrThroughputChanged ? billingMode : liveBillingMode;
+			if (effectiveBillingMode === "PROVISIONED") {
+				const ceilingIndexNames = (Array.isArray(properties["GlobalSecondaryIndexes"]) ? properties["GlobalSecondaryIndexes"] : []).filter((entry) => entry !== null && typeof entry === "object" && !Array.isArray(entry)).filter((entry) => Boolean(entry["OnDemandThroughput"])).map((entry) => typeof entry["IndexName"] === "string" ? maskSecrets(entry["IndexName"]) : "<unnamed>");
+				if (ceilingIndexNames.length > 0) {
+					const modeNote = billingOrThroughputChanged ? "" : " (the table is already PROVISIONED in AWS and this update sends no BillingMode change)";
+					const message = `AWS::DynamoDB::Table ${logicalId}: GlobalSecondaryIndexes ${ceilingIndexNames.join(", ")} declare OnDemandThroughput while the table's billing mode is PROVISIONED${modeNote}, which AWS accepts only on a PAY_PER_REQUEST table. Remove the per-index OnDemandThroughput, or set BillingMode: PAY_PER_REQUEST.`;
+					if (context?.replayingState === true || context?.desiredFromAwsReadback === true) warn(`${message} Downgraded to a warning because this update's desired properties did not come from the template, so there is no template-side remedy; the per-index ceiling will be sent and AWS will reject it.`);
+					else throw new ProvisioningError(`${message} No BillingMode flip and no index change were applied.`, resourceType, logicalId, physicalId);
+				}
 			}
 			const liveIndexes = table?.GlobalSecondaryIndexes ?? [];
 			const desiredIndexByName = /* @__PURE__ */ new Map();
@@ -18796,10 +18958,13 @@ var DynamoDBTableProvider = class {
 				this.logger.debug(`Updated BillingMode/ProvisionedThroughput/TableClass on DynamoDB table ${physicalId}`);
 			}
 			if (JSON.stringify(properties["OnDemandThroughput"]) !== JSON.stringify(previousProperties["OnDemandThroughput"])) {
-				if (properties["OnDemandThroughput"]) {
+				const ceilingRemovals = onDemandCeilingRemovals(properties["OnDemandThroughput"], previousProperties["OnDemandThroughput"], table?.OnDemandThroughput, effectiveBillingMode === "PAY_PER_REQUEST");
+				if (properties["OnDemandThroughput"] || ceilingRemovals.length > 0) {
+					const declaredForSend = properties["OnDemandThroughput"] ? this.coerceOnDemandCeilingsForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["OnDemandThroughput"], maskSecrets) : {};
+					if (ceilingRemovals.length > 0) debug(`AWS::DynamoDB::Table ${logicalId}: removing the OnDemandThroughput ${ceilingRemovals.join(" / ")} the template no longer declares (sending ${ON_DEMAND_LIMIT_RESET$1}, DynamoDB's reset sentinel)`);
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
-						OnDemandThroughput: this.coerceOnDemandCeilingsForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["OnDemandThroughput"], maskSecrets)
+						OnDemandThroughput: withOnDemandCeilingRemovals(declaredForSend, ceilingRemovals)
 					}));
 					await this.waitForTableActiveAfterUpdate(physicalId);
 					this.logger.debug(`Updated OnDemandThroughput on DynamoDB table ${physicalId}`);
@@ -18868,7 +19033,7 @@ var DynamoDBTableProvider = class {
 					this.logger.debug(`Disabled DynamoDB Stream on table ${physicalId}`);
 				}
 			}
-			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, maskSecrets);
+			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, effectiveBillingMode === "PAY_PER_REQUEST", maskSecrets);
 			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"], maskSecrets);
 			if (JSON.stringify(properties["TimeToLiveSpecification"]) !== JSON.stringify(previousProperties["TimeToLiveSpecification"])) {
 				this.assertNoActiveTtlAttributeNameChange(logicalId, resourceType, physicalId, properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"]);
@@ -19062,7 +19227,7 @@ var DynamoDBTableProvider = class {
 	* change", so a dropped block must be turned into an explicit
 	* `PointInTimeRecoveryEnabled: false`).
 	*/
-	async applyPointInTimeRecovery(tableName, spec, previousSpec, maskSecrets = (text) => text) {
+	async applyPointInTimeRecovery(tableName, spec, previousSpec, maskSecrets) {
 		let enabled;
 		let recoveryPeriodInDays;
 		if (spec !== void 0 && spec !== null) {
@@ -19237,7 +19402,7 @@ var DynamoDBTableProvider = class {
 	* pre-existing WarmThroughput "no clean remap" stance; precision changes flow
 	* through on the create / first-enable path.
 	*/
-	async applyKinesisStreamingDestination(tableName, spec, previousSpec, maskSecrets = (text) => text) {
+	async applyKinesisStreamingDestination(tableName, spec, previousSpec, maskSecrets) {
 		const newArn = this.extractKinesisStreamArn(spec);
 		const prevArn = this.extractKinesisStreamArn(previousSpec);
 		if (newArn === prevArn) {
@@ -19427,7 +19592,7 @@ var DynamoDBTableProvider = class {
 	*    a remove-then-add pair, so this method throws on such a change rather than
 	*    silently dropping it.
 	*/
-	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip = /* @__PURE__ */ new Set(), liveIndexNames, liveIndexByName, liveCapacityComparable = false, maskSecrets = (text) => text) {
+	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip, liveIndexNames, liveIndexByName, liveCapacityComparable, onDemandCeilingsSendable, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const debug = (message) => this.logger.debug(maskSecrets(message));
 		const prev = previousGsis ?? [];
@@ -19459,7 +19624,7 @@ var DynamoDBTableProvider = class {
 					adopted.WarmThroughput = adoptedWarm;
 					adoptedHasMember = true;
 				}
-				const adoptedCeiling = this.indexCeilingForSend(name, physicalId, gsi, void 0, live, maskSecrets);
+				const adoptedCeiling = this.indexCeilingForSend(name, physicalId, gsi, void 0, live, onDemandCeilingsSendable, maskSecrets);
 				if (adoptedCeiling) {
 					adopted.OnDemandThroughput = adoptedCeiling;
 					adoptedHasMember = true;
@@ -19495,7 +19660,7 @@ var DynamoDBTableProvider = class {
 				update.WarmThroughput = warm;
 				updateHasMember = true;
 			}
-			const ceiling = this.indexCeilingForSend(name, physicalId, gsi, before, liveIndexByName?.get(name), maskSecrets);
+			const ceiling = this.indexCeilingForSend(name, physicalId, gsi, before, liveIndexByName?.get(name), onDemandCeilingsSendable, maskSecrets);
 			if (ceiling) {
 				update.OnDemandThroughput = ceiling;
 				updateHasMember = true;
@@ -19515,7 +19680,7 @@ var DynamoDBTableProvider = class {
 	* two messages are disjoint by construction: this one fires only when
 	* something DID resolve.
 	*/
-	coerceWarmThroughputForSend(scope, value, maskSecrets = (text) => text) {
+	coerceWarmThroughputForSend(scope, value, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const coerced = coerceWarmThroughput(value);
 		if (coerced === void 0) return void 0;
@@ -19618,24 +19783,23 @@ var DynamoDBTableProvider = class {
 	*    deploy succeed, so the engine records the un-sent ceiling as applied and
 	*    the deploy that FIXES the billing mode then compares equal and never
 	*    sends it — issue #3287's own defect, reintroduced by its own guard. The
-	*    file's table-level twin states that reasoning at its own refusal. The
-	*    correct shape is a PRE-FLIGHT refusal covering all THREE per-index send
-	*    sites (the `Create` arm has carried the same defect since #3265), which
-	*    is issue [#3392](https://github.com/go-to-k/cdkd/issues/3392). Until
-	*    then AWS validates the constraint, exactly as it does for the
-	*    TABLE-level arm and for the `Create` action.
-	*
-	*    **That IS a behaviour change on this shape, stated rather than glossed**
-	*    (round 3's C4). Before #3287 neither `Update` arm sent the member, so a
-	*    PROVISIONED table declaring a per-index ceiling deployed GREEN with the
-	*    ceiling silently ignored. Now the same-name arm sends it once the
-	*    ceiling CHANGES, AWS rejects the `UpdateTable`, and the co-resident
-	*    capacity / warm edits fail with it; the adopted-index arm has no
-	*    recorded previous side to gate on, so it re-fails every deploy until the
-	*    template is edited. Loud and recording nothing beats silent and lost,
-	*    which is why it ships this way rather than behind the withdrawn skip —
-	*    but it is a change, and #3392 is what makes it a cdkd-worded refusal
-	*    before any call instead of an AWS rejection after one.
+	*    file's table-level twin states that reasoning at its own refusal.
+	*
+	*    **The refusal it pointed at has SHIPPED** (issue
+	*    [#3392](https://github.com/go-to-k/cdkd/issues/3392)): `update()` walks
+	*    `GlobalSecondaryIndexes[]` before any call and throws when the EFFECTIVE
+	*    billing mode is PROVISIONED, which covers all THREE per-index send sites
+	*    at once (this arm, the same-name `Update` arm's caller, and the `Create`
+	*    action, which has carried the same defect since #3265) because none of
+	*    them is reached. So this arm's job is unchanged and stays deliberately
+	*    mode-blind: a gate here would be a SECOND spelling of one rule, and the
+	*    mid-update spelling is the one that was measured wrong.
+	*
+	*    On the REPLAY path the pre-flight downgrades to a warning and this arm
+	*    still runs, so the remaining behaviour is what #3287's round 3 recorded:
+	*    the member goes out, AWS rejects the `UpdateTable`, and the co-resident
+	*    capacity / warm edits fail with it. Loud and recording nothing beats
+	*    silent and lost.
 	*  - **The change detector compares the NARROWED blocks WHEN NOTHING WAS
 	*    DROPPED, and the RAW ones otherwise** — the one place it differs from its
 	*    `ProvisionedThroughput` sibling two arms up. `'200'` and `200` are the
@@ -19681,21 +19845,39 @@ var DynamoDBTableProvider = class {
 	*    rejects by name (issue #3392) rather than a silently dropped change.
 	*    There is no `{0, 0}` analogue of the #1571 capacity trap.
 	*
-	* What it deliberately does NOT do is REMOVE a ceiling. A desired side that
-	* declares none takes the truthiness gate and emits nothing, so the live
-	* maximum SURVIVES — `-1` is AWS's documented removal sentinel and an absent
-	* member keeps the maximum. That is byte-identical to what `update()`'s
-	* TABLE-level arm does with the same edit (its own comment states it), and
-	* implementing the reset on ONE of the two would make the same property
-	* behave differently at the table and at an index of the same table. The
-	* removal direction is filed for BOTH sites together as issue
-	* [#3373](https://github.com/go-to-k/cdkd/issues/3373), which also records
-	* why it is not an extrapolation from the GlobalTable measurement: `-1` is
-	* LIVE-VERIFIED at `UpdateTable.OnDemandThroughput` and UNMEASURED at this
-	* action's, and sending it DESTROYS a live ceiling.
-	*/
-	indexCeilingForSend(name, physicalId, gsi, before, live, maskSecrets) {
-		if (!gsi.OnDemandThroughput) return void 0;
+	* It DOES remove a ceiling, since issue
+	* [#3373](https://github.com/go-to-k/cdkd/issues/3373) — and the removal is
+	* the one thing here that runs AHEAD of the truthiness gate, because the
+	* whole point is a desired side that declares nothing. An absent member KEEPS
+	* whatever maximum the index already carries, so before #3373 a template edit
+	* dropping a ceiling deployed GREEN, was recorded as applied, and left the
+	* live maximum in force forever.
+	*
+	* {@link onDemandCeilingRemovals} owns every condition and
+	* {@link ON_DEMAND_LIMIT_RESET} carries the measurement for THIS action's
+	* position (issue #1423's probe transcript, not an extrapolation from the
+	* table-level field's docs). Two properties of that rule matter most here:
+	* the previous side is read through {@link narrowOnDemandCeilings} so a
+	* member cdkd REFUSED cannot read as "previously applied"; the reset fires
+	* only for a member AWS is OBSERVED to hold, which makes it fail CLOSED with
+	* no live snapshot; and it is suppressed outright when this update FLIPS the
+	* table to PROVISIONED (`onDemandCeilingsSendable`). Do not read the
+	* observed-live condition as covering the flip — it does not, and believing
+	* it did was a merge blocker: the live snapshot is taken before the flip and
+	* never refreshed.
+	*
+	* The TABLE-level arm in `update()` takes the same rule in the same change,
+	* because implementing it at ONE of the two positions would make the same
+	* property behave differently at the table and at an index of the same table.
+	*/
+	indexCeilingForSend(name, physicalId, gsi, before, live, onDemandCeilingsSendable, maskSecrets) {
+		const removals = onDemandCeilingRemovals(gsi.OnDemandThroughput, before?.OnDemandThroughput, live?.OnDemandThroughput, onDemandCeilingsSendable);
+		if (!gsi.OnDemandThroughput) {
+			if (removals.length === 0) return void 0;
+			const removalScope = this.indexScopeAt(name, physicalId, maskSecrets);
+			this.logger.debug(maskSecrets(`${removalScope}: removing the OnDemandThroughput ${removals.join(" / ")} the template no longer declares (sending ${ON_DEMAND_LIMIT_RESET$1}, DynamoDB's reset sentinel)`));
+			return withOnDemandCeilingRemovals({}, removals);
+		}
 		if (before !== void 0) {
 			const desired = narrowOnDemandCeilings(gsi.OnDemandThroughput);
 			const previous = narrowOnDemandCeilings(before.OnDemandThroughput);
@@ -19705,8 +19887,10 @@ var DynamoDBTableProvider = class {
 		const scope = this.indexScopeAt(name, physicalId, maskSecrets);
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const debug = (message) => this.logger.debug(maskSecrets(message));
-		const send = this.coerceOnDemandCeilingsForSend(scope, gsi.OnDemandThroughput, maskSecrets);
-		if (!isPlainCapacityBlock(send)) return send;
+		const coerced = this.coerceOnDemandCeilingsForSend(scope, gsi.OnDemandThroughput, maskSecrets);
+		if (!isPlainCapacityBlock(coerced)) return coerced;
+		if (removals.length > 0) debug(`${scope}: removing the OnDemandThroughput ${removals.join(" / ")} the template no longer declares (sending ${ON_DEMAND_LIMIT_RESET$1}, DynamoDB's reset sentinel)`);
+		const send = withOnDemandCeilingRemovals(coerced, removals);
 		if (!ON_DEMAND_CEILING_MEMBERS.some((member) => member in send)) {
 			if (narrowOnDemandCeilings(gsi.OnDemandThroughput).dropped.length > 0) debug(`${scope}: every declared OnDemandThroughput member was unusable, so no ceiling op was sent`);
 			else warn(`${scope}: declares an OnDemandThroughput with no member DynamoDB accepts (${ON_DEMAND_CEILING_MEMBERS.join(" / ")}), so no ceiling op was sent. Check the member names.`);
@@ -19751,7 +19935,7 @@ var DynamoDBTableProvider = class {
 	* value, which is pre-existing behaviour and costs one spread per declared
 	* block.
 	*/
-	coerceIndexThroughputForCreate(logicalId, entry, maskSecrets = (text) => text) {
+	coerceIndexThroughputForCreate(logicalId, entry, maskSecrets) {
 		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return entry;
 		const bag = entry;
 		const declaredWarm = bag["WarmThroughput"];
@@ -19837,7 +20021,7 @@ var DynamoDBTableProvider = class {
 	* same fail-open reason — a misspelled `ReadCapacityUnit` reaches AWS and is
 	* named there rather than vanishing here.
 	*/
-	coerceIndexCapacityBlock(scope, declared, maskSecrets = (text) => text) {
+	coerceIndexCapacityBlock(scope, declared, maskSecrets) {
 		if (!isPlainCapacityBlock(declared)) return void 0;
 		const block = declared;
 		let rewritten;
@@ -20045,7 +20229,7 @@ var DynamoDBTableProvider = class {
 	* table that does not exist. {@link tableCapacityForSend}'s doc carries why
 	* this type differs.
 	*/
-	warnUnusableProvisionedCapacity(scope, member, raw, maskSecrets = (text) => text) {
+	warnUnusableProvisionedCapacity(scope, member, raw, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		warn(`${scope}: ProvisionedThroughput.${member} ${JSON.stringify(maskLeafValue$1(raw, maskSecrets))} is not an Integer CloudFormation accepts (an optional sign and decimal digits only — no surrounding whitespace, hex, exponent or decimal point), so it was NOT sent and NO capacity was substituted for it. DynamoDB requires both members wherever a PROVISIONED ProvisionedThroughput block is declared — the table itself, and every GlobalSecondaryIndexes[] entry of a PROVISIONED table — and will reject the request naming this one; CloudFormation refuses the same template at properties validation. Check for an unresolved intrinsic, or spell the value as a decimal integer.`);
 	}
@@ -20061,7 +20245,7 @@ var DynamoDBTableProvider = class {
 	* Silent for an ABSENT or FALSY value — see {@link isRefusedWarmThroughput}
 	* for why those two are not this warning's business.
 	*/
-	warnRefusedWarmThroughput(scope, value, maskSecrets = (text) => text) {
+	warnRefusedWarmThroughput(scope, value, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		if (!isRefusedWarmThroughput(value)) return;
 		warn(`${scope}: the declared WarmThroughput ${JSON.stringify(maskLeafValue$1(value, maskSecrets))} carries no usable ReadUnitsPerSecond or WriteUnitsPerSecond, so it was NOT sent — DynamoDB accepts only those two members and rejects a request without either. Check for a misspelled member name or an unresolved intrinsic. Nothing else on this resource was affected.`);
@@ -20119,7 +20303,7 @@ var DynamoDBTableProvider = class {
 	*    `DescribeTable` reports for every index anyway, so there is no divergence
 	*    to hide.
 	*/
-	skipZeroCapacityIndexUpdate(indexName, physicalId, requested, maskSecrets = (text) => text) {
+	skipZeroCapacityIndexUpdate(indexName, physicalId, requested, maskSecrets) {
 		if (requested === void 0) return false;
 		if (toFiniteNumber(requested.ReadCapacityUnits) !== 0 || toFiniteNumber(requested.WriteCapacityUnits) !== 0) return false;
 		const warn = (message) => this.logger.warn(maskSecrets(message));
@@ -20152,7 +20336,7 @@ var DynamoDBTableProvider = class {
 	*    lower than current WarmThroughput, decreasing WarmThroughput is not
 	*    supported`.
 	*/
-	warmThroughputOpFor(indexName, physicalId, desired, previous, live, maskSecrets = (text) => text) {
+	warmThroughputOpFor(indexName, physicalId, desired, previous, live, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const debug = (message) => this.logger.debug(maskSecrets(message));
 		const scope = this.indexScopeAt(indexName, physicalId, maskSecrets);
@@ -20185,7 +20369,7 @@ var DynamoDBTableProvider = class {
 	* of it — the wait is what makes the next op (there, the BillingMode flip)
 	* legal.
 	*/
-	async runGsiOps(physicalId, ops, desiredAttributeDefinitions, maskSecrets = (text) => text) {
+	async runGsiOps(physicalId, ops, desiredAttributeDefinitions, maskSecrets) {
 		const debug = (message) => this.logger.debug(maskSecrets(message));
 		for (const op of ops) {
 			const input = {
@@ -20244,7 +20428,7 @@ var DynamoDBTableProvider = class {
 	* resource clean. The message therefore says the warning may be the only
 	* signal, and names both numbers so the template edit needs no second look.
 	*/
-	skipWarmThroughputDecrease(logicalId, physicalId, desired, live, maskSecrets = (text) => text) {
+	skipWarmThroughputDecrease(logicalId, physicalId, desired, live, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		if (!isWarmThroughputDecrease(desired, live)) return false;
 		warn(`AWS::DynamoDB::Table ${logicalId}: the requested WarmThroughput ${JSON.stringify(maskDeep(desired, maskSecrets))} is lower than the ${JSON.stringify(maskDeep({
@@ -80176,11 +80360,12 @@ async function stateOrphanCommand(stackArgs, options) {
 			if (!options.force) {
 				for (const target of targets) if (await setup.lockManager.isLocked(stackName, target.region)) {
 					const where = target.region ? displaySafe(target.region, { asciiOnly: true }) || "<unrenderable>" : "legacy";
-					throw new Error(`Stack '${displaySafe(stackName, { asciiOnly: true })}' (${where}) is locked. Run: ${buildForceUnlockCommand(stackName, target.region, {
+					const recoveryCommand = buildForceUnlockCommand(stackName, target.region, {
 						profile: options.profile,
 						stateBucket: setup.bucket,
 						statePrefix: options.statePrefix
-					}) || "a command cdkd cannot show safely: the recorded name or region would not survive a command line intact, so inspect the lock object directly"} first, or pass --force to remove anyway.`);
+					});
+					throw new Error(`Stack '${displaySafe(stackName, { asciiOnly: true })}' (${where}) is locked. ` + (recoveryCommand ? `Run: ${recoveryCommand} first, or pass --force to remove anyway.` : `${UNREPRODUCIBLE_LOCK_CLAUSE} Or pass --force to remove anyway.`));
 				}
 			}
 			if (!options.yes && !options.force) {
@@ -88249,11 +88434,11 @@ async function pullEcrImage(imageUri, options) {
 		const cached = ASSUMED_ROLE_CACHE.get(cacheKey);
 		if (cached && isCredentialFresh(cached)) {
 			assumed = cached;
-			logger.debug(`Reusing cached AssumeRole credentials for ${options.ecrRoleArn}`);
+			logger.debug(`Reusing cached AssumeRole credentials for ${displayIdent(options.ecrRoleArn, { maxCodePoints: 612 })}`);
 		} else {
 			assumed = await assumeRoleForEcr(options.ecrRoleArn, callerRegion, logger);
 			ASSUMED_ROLE_CACHE.set(cacheKey, assumed);
-			logger.info(`Assumed role ${options.ecrRoleArn} for ECR pull (account=${parsed.accountId}, region=${parsed.region})`);
+			logger.info(`Assumed role ${displayIdent(options.ecrRoleArn, { maxCodePoints: 612 })} for ECR pull (account=${parsed.accountId}, region=${parsed.region})`);
 		}
 	} else if (crossAccount) logger.info(`Cross-account ECR pull: image account ${parsed.accountId} != caller ${callerAccount}. Using the caller's credentials; pass --ecr-role-arn <arn> if AWS rejects with AccessDenied.`);
 	if (crossRegion) logger.info(`Cross-region ECR pull: image region ${parsed.region} != caller ${callerRegion ?? "(unset)"}. Authenticating against the image region directly.`);
@@ -88284,7 +88469,7 @@ async function pullEcrImage(imageUri, options) {
 * mirrors the convention used by `src/utils/role-arn.ts`.
 */
 async function assumeRoleForEcr(roleArn, callerRegion, logger) {
-	logger.debug(`Assuming role ${roleArn} for ECR pull...`);
+	logger.debug(`Assuming role ${displayIdent(roleArn, { maxCodePoints: 612 })} for ECR pull...`);
 	const sts = new STSClient({
 		...awsClientDefaults(),
 		...callerRegion && { region: callerRegion }
@@ -88295,7 +88480,7 @@ async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 			RoleSessionName: `cdkd-local-ecr-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds || !creds.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new LocalInvokeBuildError$1(`AssumeRole(${roleArn}) returned no usable credentials. Verify the role's trust policy allows your identity to assume it.`);
+		if (!creds || !creds.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new LocalInvokeBuildError$1(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials. Verify the role's trust policy allows your identity to assume it.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -88305,7 +88490,7 @@ async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 	} catch (err) {
 		if (err instanceof LocalInvokeBuildError$1) throw err;
 		const reason = err instanceof Error ? err.message : String(err);
-		throw new LocalInvokeBuildError$1(`Failed to assume role ${roleArn} for ECR pull: ${reason}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
+		throw new LocalInvokeBuildError$1(`Failed to assume role ${displayIdent(roleArn, { maxCodePoints: 612 })} for ECR pull: ${displaySafe(reason)}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
 	} finally {
 		sts.destroy();
 	}
@@ -88623,7 +88808,7 @@ const CONTAINER_AWS_CREDENTIALS_PATH = "/cdkd-aws/credentials";
 */
 async function writeProfileCredentialsFile(profileName, creds) {
 	if (profileName === "") throw new Error("writeProfileCredentialsFile: profile name must not be empty.");
-	if (/[\r\n[\]]/.test(profileName)) throw new Error(`writeProfileCredentialsFile: profile name '${profileName}' contains a forbidden character (any of CR, LF, '[', ']' would corrupt the INI file or the docker -e env var).`);
+	if (/[\r\n[\]]/.test(profileName)) throw new Error(`writeProfileCredentialsFile: profile name ${displayIdent(profileName)} contains a forbidden character (any of CR, LF, '[', ']' would corrupt the INI file or the docker -e env var).`);
 	const dir = await mkdtemp(path.join(tmpdir(), "cdkd-profile-creds-"));
 	const hostPath = path.join(dir, "credentials");
 	const lines = [
@@ -88632,7 +88817,15 @@ async function writeProfileCredentialsFile(profileName, creds) {
 		`aws_secret_access_key = ${creds.secretAccessKey}`
 	];
 	if (creds.sessionToken) lines.push(`aws_session_token = ${creds.sessionToken}`);
-	await writeFile(hostPath, lines.join("\n") + "\n", { mode: 384 });
+	try {
+		await writeFile(hostPath, lines.join("\n") + "\n", { mode: 384 });
+	} catch (err) {
+		await rm(dir, {
+			recursive: true,
+			force: true
+		}).catch(() => {});
+		throw err;
+	}
 	return {
 		hostPath,
 		containerPath: CONTAINER_AWS_CREDENTIALS_PATH,
@@ -90645,7 +90838,11 @@ async function resolveProfileCredentials(profile) {
 	try {
 		const credsProvider = sts.config.credentials;
 		const creds = typeof credsProvider === "function" ? await credsProvider() : credsProvider;
-		if (!creds || !creds.accessKeyId || !creds.secretAccessKey) throw new Error(`--profile '${profile}': credential provider chain resolved without usable credentials. Check \`aws sso login --profile ` + profile + "` for SSO profiles, or `~/.aws/credentials` / `~/.aws/config` for regular profiles.");
+		if (!creds || !creds.accessKeyId || !creds.secretAccessKey) {
+			const shownProfile = displayIdent(profile);
+			const ssoHint = isPasteableIdent(profile) ? "run `aws sso login --profile " + profile + "`" : "run `aws sso login` for that profile -- cdkd is not writing the command out, because it cannot vouch that the name as rendered is the one your shell would act on";
+			throw new Error(`--profile ${shownProfile}: credential provider chain resolved without usable credentials. For SSO profiles, ${ssoHint}. For regular profiles, check \`~/.aws/credentials\` / \`~/.aws/config\`.`);
+		}
 		return {
 			accessKeyId: creds.accessKeyId,
 			secretAccessKey: creds.secretAccessKey,
@@ -90672,7 +90869,7 @@ async function assumeLambdaExecutionRole$1(roleArn, region) {
 			RoleSessionName: `cdkd-local-start-api-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${roleArn}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -91234,7 +91431,7 @@ async function resolveEcsSecrets(entries, options = {}) {
 	try {
 		return await Promise.all(entries.map(async (entry) => {
 			const value = await resolveOne(entry, secretsClient, ssmClient);
-			logger.debug(`Resolved secret ${entry.containerName}.${entry.name} (${entry.valueFrom})`);
+			logger.debug(`Resolved secret ${displayIdent(entry.containerName)}.${displayIdent(entry.name)} (${displayIdent(entry.valueFrom, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })})`);
 			return {
 				...entry,
 				value
@@ -91251,7 +91448,7 @@ async function resolveOne(entry, secretsClient, ssmClient) {
 	switch (shape.kind) {
 		case "secrets-manager": return resolveSecretsManager(entry, shape, secretsClient);
 		case "ssm": return resolveSsm(entry, shape, ssmClient);
-		case "unknown": throw new EcsSecretsResolutionError(`Container '${entry.containerName}' secret '${entry.name}' references an unsupported ValueFrom shape '${arn}'. Expected Secrets Manager ARN (optionally with :<json-key>::) or SSM Parameter ARN.`);
+		case "unknown": throw new EcsSecretsResolutionError(`Container '${displayIdent(entry.containerName)}' secret '${displayIdent(entry.name)}' references an unsupported ValueFrom shape ${displayIdent(arn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}. Expected Secrets Manager ARN (optionally with :<json-key>::) or SSM Parameter ARN.`);
 	}
 }
 /**
@@ -91284,20 +91481,20 @@ async function resolveSecretsManager(entry, shape, client) {
 	try {
 		secretString = (await client.send(new GetSecretValueCommand({ SecretId: shape.baseArn }))).SecretString;
 	} catch (err) {
-		throw new EcsSecretsResolutionError(`Failed to resolve Secrets Manager secret for container '${entry.containerName}' / env '${entry.name}' (${shape.baseArn}): ${err instanceof Error ? err.message : String(err)}`);
+		throw new EcsSecretsResolutionError(`Failed to resolve Secrets Manager secret for container '${displayIdent(entry.containerName)}' / env '${displayIdent(entry.name)}' (${displayIdent(shape.baseArn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}): ${displaySafe(err instanceof Error ? err.message : String(err))}`);
 	}
-	if (secretString === void 0) throw new EcsSecretsResolutionError(`Secrets Manager returned no SecretString for container '${entry.containerName}' / env '${entry.name}' (${shape.baseArn}). Binary secrets are not supported.`);
+	if (secretString === void 0) throw new EcsSecretsResolutionError(`Secrets Manager returned no SecretString for container '${displayIdent(entry.containerName)}' / env '${displayIdent(entry.name)}' (${displayIdent(shape.baseArn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}). Binary secrets are not supported.`);
 	if (shape.jsonKey === void 0) return secretString;
 	let parsed;
 	try {
 		parsed = JSON.parse(secretString);
 	} catch (err) {
 		const kind = err instanceof Error ? err.name : "unknown";
-		throw new EcsSecretsResolutionError(`Container '${entry.containerName}' secret '${entry.name}' specified json-key '${shape.jsonKey}' but the secret value is not valid JSON (${kind}). The parser detail is withheld because it would echo the secret plaintext.`);
+		throw new EcsSecretsResolutionError(`Container '${displayIdent(entry.containerName)}' secret '${displayIdent(entry.name)}' specified json-key '${displaySafe(shape.jsonKey)}' but the secret value is not valid JSON (${displayIdent(kind)}). The parser detail is withheld because it would echo the secret plaintext.`);
 	}
-	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new EcsSecretsResolutionError(`Container '${entry.containerName}' secret '${entry.name}' specified json-key '${shape.jsonKey}' but the secret root is not a JSON object.`);
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new EcsSecretsResolutionError(`Container '${displayIdent(entry.containerName)}' secret '${displayIdent(entry.name)}' specified json-key '${displaySafe(shape.jsonKey)}' but the secret root is not a JSON object.`);
 	const value = parsed[shape.jsonKey];
-	if (value === void 0) throw new EcsSecretsResolutionError(`Container '${entry.containerName}' secret '${entry.name}' specified json-key '${shape.jsonKey}' but no such key exists in the secret JSON.`);
+	if (value === void 0) throw new EcsSecretsResolutionError(`Container '${displayIdent(entry.containerName)}' secret '${displayIdent(entry.name)}' specified json-key '${displaySafe(shape.jsonKey)}' but no such key exists in the secret JSON.`);
 	return typeof value === "string" ? value : JSON.stringify(value);
 }
 async function resolveSsm(entry, shape, client) {
@@ -91306,11 +91503,11 @@ async function resolveSsm(entry, shape, client) {
 			Name: shape.name,
 			WithDecryption: true
 		}))).Parameter?.Value;
-		if (value === void 0) throw new EcsSecretsResolutionError(`SSM parameter '${shape.name}' returned no Value for container '${entry.containerName}' / env '${entry.name}'.`);
+		if (value === void 0) throw new EcsSecretsResolutionError(`SSM parameter '${displayIdent(shape.name, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}' returned no Value for container '${displayIdent(entry.containerName)}' / env '${displayIdent(entry.name)}'.`);
 		return value;
 	} catch (err) {
 		if (err instanceof EcsSecretsResolutionError) throw err;
-		throw new EcsSecretsResolutionError(`Failed to resolve SSM parameter for container '${entry.containerName}' / env '${entry.name}' (${shape.name}): ${err instanceof Error ? err.message : String(err)}`);
+		throw new EcsSecretsResolutionError(`Failed to resolve SSM parameter for container '${displayIdent(entry.containerName)}' / env '${displayIdent(entry.name)}' (${displayIdent(shape.name, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}): ${displaySafe(err instanceof Error ? err.message : String(err))}`);
 	}
 }
 
@@ -91914,8 +92111,9 @@ async function localRunTaskCommand(target, options) {
 	const state = createEcsRunState();
 	let sigintHandler;
 	let sigintCount = 0;
+	let detachedSuccessfully = false;
 	let stateProvider;
-	let profileCredsFile;
+	let channels;
 	let cleanupPromise;
 	const cleanup = async () => {
 		if (!cleanupPromise) cleanupPromise = (async () => {
@@ -91924,10 +92122,10 @@ async function localRunTaskCommand(target, options) {
 			} catch (err) {
 				getLogger().debug(`cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
 			}
-			if (profileCredsFile) try {
-				await profileCredsFile.dispose();
+			if (channels?.profileCredsFile) try {
+				await channels.profileCredsFile.dispose();
 			} catch (err) {
-				getLogger().debug(`Failed to remove profile credentials tmpdir ${profileCredsFile.hostPath}: ${err instanceof Error ? err.message : String(err)}`);
+				getLogger().debug(`Failed to remove profile credentials tmpdir ${channels.profileCredsFile.hostPath}: ${err instanceof Error ? err.message : String(err)}`);
 			}
 		})();
 		await cleanupPromise;
@@ -91993,33 +92191,20 @@ async function localRunTaskCommand(target, options) {
 			resolvedRoleArn = options.assumeTaskRole;
 			assumedCredentials = await assumeTaskRole(resolvedRoleArn, options.region);
 		}
-		const sidecarCredentials = await resolveSidecarCredentials(options, assumedCredentials);
-		if (options.profile && sidecarCredentials && !assumedCredentials) profileCredsFile = await writeProfileCredentialsFile(options.profile, sidecarCredentials);
+		channels = await resolveTaskCredentialChannels(options, assumedCredentials);
 		const envOverrides = readEnvOverridesFile$2(options.envVars);
-		const runOpts = {
-			cluster: options.cluster,
-			containerHost: options.containerHost,
-			skipPull: options.pull === false,
-			keepRunning: options.keepRunning,
-			detach: options.detach
-		};
-		if (envOverrides) runOpts.envOverrides = envOverrides;
-		if (sidecarCredentials) runOpts.taskCredentials = sidecarCredentials;
-		if (resolvedRoleArn) runOpts.taskRoleArn = resolvedRoleArn;
-		if (options.platform) runOpts.platformOverride = options.platform;
-		if (options.region) runOpts.region = options.region;
-		if (options.ecrRoleArn) runOpts.ecrRoleArn = options.ecrRoleArn;
-		if (profileCredsFile) runOpts.profileCredentialsFile = {
-			hostPath: profileCredsFile.hostPath,
-			containerPath: profileCredsFile.containerPath,
-			profileName: profileCredsFile.profileName
-		};
+		const runOpts = buildRunEcsTaskOptions(options, channels, {
+			...envOverrides !== void 0 && { envOverrides },
+			...resolvedRoleArn !== void 0 && { resolvedRoleArn }
+		});
 		const hostGatewayExtraHosts = await resolveHostGatewayExtraHosts();
 		if (hostGatewayExtraHosts.length > 0) runOpts.hostGatewayExtraHosts = hostGatewayExtraHosts;
 		const result = await runEcsTask(task, runOpts, state);
 		if (options.detach) {
 			logger.info("Task containers started in detached mode; cdkd is exiting.");
 			logger.info(`Use 'docker ps -a --filter network=${result.state.network?.networkName ?? "<network>"}' to inspect; tear down with 'docker rm -f' and 'docker network rm'.`);
+			if (channels.profileCredsFile) logger.info(`The AWS credentials file mounted into the containers is NOT removed in detached mode: delete ${displayIdent(channels.profileCredsFile.hostPath)} once you tear them down.`);
+			detachedSuccessfully = true;
 			sigintCount = 99;
 			return;
 		}
@@ -92028,7 +92213,7 @@ async function localRunTaskCommand(target, options) {
 	} finally {
 		if (sigintHandler) process.off("SIGINT", sigintHandler);
 		if (stateProvider) stateProvider.dispose();
-		if (!options.detach) await cleanup();
+		if (!detachedSuccessfully) await cleanup();
 	}
 }
 /**
@@ -92047,7 +92232,7 @@ async function resolvePlaceholderAccount(arn, region) {
 	});
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
-		if (!account) throw new Error(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN '${arn}'. Pass the ARN explicitly: --assume-task-role <arn>`);
+		if (!account) throw new Error(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN ${displayIdent(arn, { maxCodePoints: 612 })}. Pass the ARN explicitly: --assume-task-role <arn>`);
 		return arn.split(TASK_ROLE_ACCOUNT_PLACEHOLDER).join(account);
 	} finally {
 		sts.destroy();
@@ -92069,7 +92254,7 @@ async function assumeTaskRole(roleArn, region) {
 			RoleSessionName: `cdkd-local-run-task-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${roleArn}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -92256,6 +92441,106 @@ async function resolveSidecarCredentials(options, assumedCredentials) {
 	if (assumedCredentials) return assumedCredentials;
 	if (options.profile) return resolveProfileCredentials(options.profile);
 }
+/**
+* Resolve BOTH credential channels a locally-run ECS task receives, and decide
+* whether the second one exists at all.
+*
+* 1. `sidecarCredentials` — what the AWS-published
+*    `amazon-ecs-local-container-endpoints` sidecar serves at
+*    `169.254.170.2/role/<role>`; {@link resolveSidecarCredentials} owns the
+*    precedence (issue #658).
+* 2. `profileCredsFile` — the ECS analogue of PR #670 (Lambda-container
+*    fix-back finding #1). When `--profile <p>` is set AND `--assume-task-role`
+*    did NOT produce credentials for this task, a host-side AWS shared
+*    credentials file is written under `[<options.profile>]` and bind-mounted
+*    read-only into every user container, so handler code calling
+*    `fromIni({ profile: '<options.profile>' })` resolves to the same creds the
+*    sidecar serves. Without it the SDK looks for `[<options.profile>]` in
+*    `~/.aws/credentials` INSIDE the container and fails.
+*
+*    Gating on `!assumedCredentials` preserves the documented precedence
+*    (assume-task-role > profile-file > sidecar): when `--assume-task-role`
+*    won, the sidecar's `/role/<arn>` endpoint already serves the assumed creds
+*    and the file's env vars must NOT override them.
+*
+* ONE helper rather than two, and that is the substance of issue
+* go-to-k/cdkd#3378 rather than a tidying choice. Both of these lived inline in
+* `localRunTaskCommand`'s body, which meant the gate's annotation below was
+* fenced only for EXISTING (`local-surface-env-identity.test.ts` checks that an
+* annotation is there and carries a reason — it cannot check that the reason is
+* TRUE). And the reason is not a property of the `if` at all: it is a property
+* of the COMPOSITION, that `sidecarCredentials` on the `!assumedCredentials`
+* path can only have come from {@link resolveSidecarCredentials}'s `--profile`
+* arm. Extracting the three-line gate ALONE would have re-tested the same three
+* booleans and proved nothing; a test over this helper writes a real file and
+* can read the bytes back. `resolveSidecarCredentials`'s own doc already set
+* the precedent for the seam over a command-level harness — that harness would
+* have to mock the whole Synth + Docker + AWS pipeline, and a mock is exactly
+* what cannot answer "which identity's bytes landed in the file".
+*
+* cdkd-local-env-identity: the `!assumedCredentials` gate means
+* `resolveSidecarCredentials` reached its `--profile` arm, so this is
+* `resolveProfileCredentials` through
+* `awsClientDefaults({ ignoreAssumedRole: true })` — the caller's own chain,
+* never the `--role-arn` role — and never an `--assume-task-role` STS result,
+* which wins earlier and is served by the metadata sidecar instead.
+*/
+async function resolveTaskCredentialChannels(options, assumedCredentials) {
+	const sidecarCredentials = await resolveSidecarCredentials(options, assumedCredentials);
+	if (options.profile && sidecarCredentials && !assumedCredentials) return {
+		sidecarCredentials,
+		profileCredsFile: await writeProfileCredentialsFile(options.profile, sidecarCredentials)
+	};
+	return {
+		sidecarCredentials,
+		profileCredsFile: void 0
+	};
+}
+/**
+* Build the `RunEcsTaskOptions` bag from the options and the resolved credential
+* channels.
+*
+* Extracted for the WIRING, which is the half
+* {@link resolveTaskCredentialChannels} could not cover (go-to-k/cdkd#3390 round
+* 2, on go-to-k/cdkd#3394). That helper decides WHETHER a credentials file
+* exists and whose bytes are in it; this one decides whether the answer reaches
+* the runner at all. Between them sat a single assignment, and mutating it to
+* `undefined` left 114 tests green across five files: no file is bind-mounted,
+* so every handler calling `fromIni({ profile })` inside the task container
+* fails -- the exact defect PR go-to-k/cdkd#670 shipped this path to fix. "A
+* probed callee says nothing about its WIRING" is the rule, and this is the
+* seam that lets a unit test say something about it.
+*
+* PURE, and it takes the whole `channels` object rather than a pre-destructured
+* file so the test subject is the same value the resolver returns -- a helper
+* taking `profileCredsFile` alone would move the untested assignment rather
+* than remove it.
+*
+* The file is COPIED field by field rather than passed through: `dispose` stays
+* with the command, which owns the lifetime, and `RunEcsTaskOptions` deliberately
+* declares only the three fields the runner mounts with.
+*/
+function buildRunEcsTaskOptions(options, channels, extra = {}) {
+	const runOpts = {
+		cluster: options.cluster,
+		containerHost: options.containerHost,
+		skipPull: options.pull === false,
+		keepRunning: options.keepRunning,
+		detach: options.detach
+	};
+	if (extra.envOverrides) runOpts.envOverrides = extra.envOverrides;
+	if (channels.sidecarCredentials) runOpts.taskCredentials = channels.sidecarCredentials;
+	if (extra.resolvedRoleArn) runOpts.taskRoleArn = extra.resolvedRoleArn;
+	if (options.platform) runOpts.platformOverride = options.platform;
+	if (options.region) runOpts.region = options.region;
+	if (options.ecrRoleArn) runOpts.ecrRoleArn = options.ecrRoleArn;
+	if (channels.profileCredsFile) runOpts.profileCredentialsFile = {
+		hostPath: channels.profileCredsFile.hostPath,
+		containerPath: channels.profileCredsFile.containerPath,
+		profileName: channels.profileCredsFile.profileName
+	};
+	return runOpts;
+}
 function createLocalRunTaskCommand() {
 	const cmd = new Command("run-task").description("Run an AWS::ECS::TaskDefinition locally — pulls/builds images, sets up a per-task docker network with the AWS-published metadata-endpoints sidecar, and starts every container in dependsOn order. Target accepts a CDK display path (MyStack/MyService/TaskDef) or stack-qualified logical ID (MyStack:MyServiceTaskDefXYZ1234). Single-stack apps may omit the stack prefix.").argument("<target>", "CDK display path or stack-qualified logical ID of the AWS::ECS::TaskDefinition to run").addOption(new Option("--cluster <name>", "Cluster name surfaced to ECS_CONTAINER_METADATA_URI_V4 and used as the docker network prefix").default("cdkd-local")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"ContainerName\":{\"KEY\":\"VALUE\"}, \"Parameters\":{}})")).addOption(new Option("--container-host <ip>", "Host IP to bind published container ports to. Must be a numeric IP (Docker rejects hostnames here)").default("127.0.0.1")).addOption(new Option("--assume-task-role [arn]", "Assume the task definition's TaskRoleArn (or the supplied ARN) and forward STS-issued temp credentials via the metadata sidecar so containers run with the deployed function role. Bare flag uses the template's TaskRoleArn; pass an explicit ARN to override.")).addOption(new Option("--no-pull", "Skip docker pull for every container image and the metadata sidecar")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries (#455). Issues sts:AssumeRole via the default credential chain and uses the temporary credentials for ecr:GetAuthorizationToken + docker pull. Required when the caller does not have direct cross-account access to the target repository. A same-account pull in ANY region does not need this flag: the ECR client is built for the image URI's own region, so crossing a region costs nothing extra (issue #2536).")).addOption(new Option("--platform <platform>", "Force docker --platform (linux/amd64 or linux/arm64). Default: inferred from task RuntimePlatform.CpuArchitecture")).addOption(new Option("--keep-running", "Don't docker rm -f the user containers on task exit (network + sidecar are still torn down). Use when you want to docker exec into a stopped container for post-mortems.").default(false)).addOption(new Option("--detach", "Start the containers in the background and exit (skip log streaming + auto teardown). Useful in CI smoke tests; caller manages container lifecycle.").default(false)).addOption(new Option("--from-state", "Read cdkd S3 state for the target stack and substitute Fn::Sub / Fn::GetAtt references to same-stack AWS::ECR::Repository resources with the deployed URI. Off by default — only the AWS pseudo-parameter tier (${AWS::AccountId} / ${AWS::Region}) is resolved without this flag.").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in container env vars / secrets / image URIs with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the cdkd stack name; pass an explicit value when the CFn stack name differs. Mutually exclusive with --from-state. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-state when the same stack name has state in multiple regions, and with --from-cfn-stack as the CFn client region (cdkd does not have a separate --cfn-stack-region flag).").argParser(parseStackRegion)).action(withErrorHandling(localRunTaskCommand));
 	[
@@ -93126,7 +93411,13 @@ async function resolveHostCredentialsForSigV4(options, resolved, loaded, region)
 	if (assumeRoleArn) try {
 		return await assumeAgentCoreExecutionRole(assumeRoleArn, region);
 	} catch (err) {
-		logger.warn(`--assume-role: STS AssumeRole(${assumeRoleArn}) failed for --sigv4 signing: ${err instanceof Error ? err.message : String(err)}. Falling back to ${options.profile ? `--profile ${options.profile}` : "shell credentials"}.`);
+		logger.warn(assumeRoleFallbackWarning({
+			assumeRoleArn,
+			purpose: "--sigv4 signing",
+			error: err,
+			profile: options.profile,
+			fallbackWithoutProfile: "shell credentials"
+		}));
 	}
 	if (options.profile) {
 		const creds = await resolveProfileCredentials(options.profile);
@@ -93241,7 +93532,13 @@ async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options
 	if (assumeRoleArn) try {
 		credentials = await assumeAgentCoreExecutionRole(assumeRoleArn, region);
 	} catch (err) {
-		logger.warn(`--assume-role: STS AssumeRole(${assumeRoleArn}) failed for the fromS3 bundle download: ${err instanceof Error ? err.message : String(err)}. Falling back to ${options.profile ? `--profile ${options.profile}` : "the default credentials"}.`);
+		logger.warn(assumeRoleFallbackWarning({
+			assumeRoleArn,
+			purpose: "the fromS3 bundle download",
+			error: err,
+			profile: options.profile,
+			fallbackWithoutProfile: "the default credentials"
+		}));
 	}
 	const bundle = await downloadAndExtractS3Bundle(location, {
 		...region !== void 0 && { region },
@@ -93439,7 +93736,7 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 			if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
 			assumeSucceeded = true;
 		} catch (err) {
-			logger.warn(`--assume-role: STS AssumeRole(${args.assumeRoleArn}) failed: ${err instanceof Error ? err.message : String(err)}. Falling back to the developer's shell credentials.`);
+			logger.warn(`--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 612 })}) failed: ${displaySafe(err instanceof Error ? err.message : String(err))}. Falling back to the developer's shell credentials.`);
 		}
 	}
 	if (!assumeSucceeded) {
@@ -93452,6 +93749,53 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 	}
 }
 /**
+* The `--assume-role: STS AssumeRole(...) failed` warning, for the two sites
+* that emit the FALLBACK form of it — the `--sigv4` signing path and the fromS3 bundle download.
+*
+* ONE builder rather than two near-identical template literals, and that is
+* go-to-k/cdkd#3390's test review rather than tidiness. The two were twins, and
+* a twin is where a sanitizing rule goes half-applied: dropping `displayIdent`
+* from the fromS3 copy alone reddened only the source-shape fence, because the
+* `--sigv4` copy was the one with a behavioural case. As one PURE function both
+* sites inherit whatever this is tested to do, and there is one subject to test
+* rather than a second one somebody has to remember exists.
+*
+* TWO untrusted values, and both take `displayIdent` (issue
+* [#3377](https://github.com/go-to-k/cdkd/issues/3377) for the first, this PR's
+* security review for the second):
+*
+* - `profile` is user-supplied argv, and `ConsoleLogger.formatMessage`
+*   sanitizes only a call's EXTRA ARGS, never the message itself — so the
+*   message text is the last place it can be made safe. A MESSAGE, not a
+*   command to paste, so `displayIdent` and not `isPasteableIdent`;
+*   `resolveProfileCredentials` in `local-start-api.ts` is the site that needs
+*   both spellings and shows the difference.
+* - `assumeRoleArn` is the WIDER boundary of the two, which is why it is here
+*   at all: nothing validates it before `assumeAgentCoreExecutionRole` (whose
+*   own throw lands in the very `catch` that calls this), and
+*   `resolveAssumeRoleArn` can source it from a DEPLOYED STATE RECORD rather
+*   than from argv. Every character of a legitimate ARN is in `PLAIN_IDENT`, so
+*   it renders bare exactly as before. cdk-local's twin of this line flattens
+*   the same value for the same reason; cdkd had nothing.
+*
+* `error` takes `displaySafe` — the DENYLIST, since an SDK error message is
+* free-form text rather than an identifier, which is the line
+* `display-safe.ts`'s header draws. The first cut stringified it and sanitized
+* NOTHING, and go-to-k/cdkd#3390's round-2 security review showed that was the
+* hole the other two guards leave open: STS answers an unparseable RoleArn with
+* a `ValidationError` that ECHOES THE SUBMITTED VALUE VERBATIM, so the
+* attacker-controlled ARN comes back through the error string and lands on the
+* same line the `displayIdent` two expressions to its left was added to
+* protect. A C1 byte, `U+0085`, `U+2028` and the bidi overrides all survive an
+* XML 1.0 response body. `formatError` sanitizes a `cause` for exactly this
+* reason and cannot help here, because this is a logger MESSAGE and
+* `ConsoleLogger.formatMessage` sanitizes only a call's EXTRA ARGS.
+*/
+function assumeRoleFallbackWarning(args) {
+	const fallback = args.profile ? `--profile ${displayIdent(args.profile)}` : args.fallbackWithoutProfile;
+	return `--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 612 })}) failed for ${args.purpose}: ${displaySafe(args.error instanceof Error ? args.error.message : String(args.error))}. Falling back to ${fallback}.`;
+}
+/**
 * Resolve the role ARN to assume, honoring the three `--assume-role` forms.
 * Bare `--assume-role` uses the runtime's literal `RoleArn`; when that is an
 * intrinsic (the common L2 case — `Fn::GetAtt` to an auto-created role) it
@@ -93465,7 +93809,7 @@ function resolveAssumeRoleArn(options, resolved, loaded) {
 		if (loaded) {
 			const fromState = resolveExecutionRoleArnFromState(loaded, resolved.logicalId, "RoleArn");
 			if (fromState) {
-				getLogger().debug(`--assume-role: resolved RoleArn from state: ${fromState}`);
+				getLogger().debug(`--assume-role: resolved RoleArn from state: ${displayIdent(fromState)}`);
 				return fromState;
 			}
 		}
@@ -93610,7 +93954,7 @@ async function assumeAgentCoreExecutionRole(roleArn, region) {
 			RoleSessionName: `${getEmbedConfig().resourceNamePrefix}-invoke-agentcore-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new CdkdError(`AssumeRole(${roleArn}) returned no usable credentials.`, "LOCAL_INVOKE_AGENTCORE_ASSUMEROLE_NO_CREDS");
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new CdkdError(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`, "LOCAL_INVOKE_AGENTCORE_ASSUMEROLE_NO_CREDS");
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -94223,7 +94567,7 @@ async function localInvokeCommand(target, options) {
 				const arn = resolveExecutionRoleArnFromState(stateForRoleHint, lambda.logicalId);
 				if (arn) {
 					resolvedAssumeRoleArn = arn;
-					logger.info(`--assume-role: auto-resolved execution role from cdkd state: ${arn}`);
+					logger.info(`--assume-role: auto-resolved execution role from cdkd state: ${displayIdent(arn, { maxCodePoints: 612 })}`);
 				} else logger.warn(`--assume-role: could not resolve the execution role ARN from cdkd state for '${lambda.logicalId}'. Pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.`);
 			}
 		} else maybeSuggestAssumeRole(options, stateForRoleHint, lambda.logicalId);
@@ -94691,7 +95035,7 @@ async function applyLambdaCredentialEnv(dockerEnv, args) {
 			assumeSucceeded = true;
 		} catch (err) {
 			const reason = err instanceof Error ? err.message : String(err);
-			logger.warn(`--assume-role: STS AssumeRole(${args.assumeRoleArn}) failed: ${reason}. Falling back to the developer's shell credentials.`);
+			logger.warn(`--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 612 })}) failed: ${displaySafe(reason)}. Falling back to the developer's shell credentials.`);
 		}
 	}
 	if (!assumeSucceeded) {
@@ -94729,7 +95073,7 @@ async function assumeLambdaExecutionRole(roleArn, region) {
 			RoleSessionName: `cdkd-local-invoke-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${roleArn}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -94850,7 +95194,7 @@ function materializeInlineCode(handler, source, fileExtension) {
 function suggestAssumeRoleFromState(state, logicalId) {
 	const logger = getLogger();
 	const roleArn = resolveExecutionRoleArnFromState(state, logicalId);
-	if (roleArn) logger.info(`Hint: the deployed function uses execution role ${roleArn}. Re-run with --assume-role to invoke under the deployed function's narrow permissions.`);
+	if (roleArn) logger.info(`Hint: the deployed function uses execution role ${displayIdent(roleArn, { maxCodePoints: 612 })}. Re-run with --assume-role to invoke under the deployed function's narrow permissions.`);
 }
 /**
 * Emit the "re-run with `--assume-role`" hint, if it applies.
@@ -95010,4 +95354,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-dYPgGoOv.js.map
+//# sourceMappingURL=program-C1iVGcxJ.js.map