@go-to-k/cdkd 0.290.27 → 0.290.29

package/dist/{program-dYPgGoOv.js → program-PCCyP9-O.js}

@@ -1,8 +1,8 @@
-import { $ as secretBearing, $n as recordMaskOnlyValue, $r as getDockerImageBySourceHash, $t as s3BucketArn, A as extractDeploymentEventError, Ai as resetAwsClients, An as refuseMalformedState, Ar as assertAssetBucketRegion, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as LocalInvokeBuildError$1, Bn as STATE_SOURCED_BASELINE_RULES, Br as describeDockerCapturedOutput, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as derivePartitionAndUrlSuffix, Cn as producerRecordKey, Cr as WorkGraph, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Di as resolveBucketRegion, Dn as refuseMalformedOutputsForDestroy, Dr as rewriteTemplateAssetReferences, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, En as refuseMalformedOutputs, Er as loadPublishableAssetManifest, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fi as CrossAccountSecretRefusalError, Fn as findSilentDropProperties, Fr as readBootstrapMarkerBody, Ft as isSettledInstanceState, G as gray, Gi as PartialFailureError, Gn as createSecretMasker, Gr as getDockerCmd, Gt as readConfigString, H as formatResourceLine, Hn as STATE_SOURCED_READBACK_RULES, Hr as describeDockerFailure, Ht as configBooleanRefusal, I as renderStatefulReason, In as describeTypeWithThrottleRetry, Ir as validateAssetBucketName, It as WAFv2WebACLProvider, J as yellow, Ji as ResourceUpdateNotSupportedError, Jn as identityKeyFor, Jr as runDockerForeground, Jt as requireConfigObject, K as green, Ki as ProvisioningError, Kn as dynamicReferenceTokens, Kr as partitionSensitiveEnv, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Li as DeployCancelledError, Ln as withRetry, Lr as validateContainerRepoName, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mn as repairMalformedResourcePropertiesForReadOnly, Mr as getBootstrapMarkerKey, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ni as CdkdError, Nn as repairMalformedResourcesForReadOnly, Nr as isCrossRegionRedirect, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as AwsClients, On as refuseMalformedResourcePropertiesForOrphan, Or as AssetModeResolver, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pn as findActionableSilentDrops, Pr as parseBootstrapMarker, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as maskSecretsInText, Qr as AssetManifestLoader, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as DynamicReferenceRegionAmbiguousError, Rn as DagBuilder, Rr as buildDenyExternalAccessPolicy, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as canonicalizeRegion, Sn as malformedStateRefusalMessage, Sr as stringifyValue, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as processStackMessages, Tn as refuseMalformedNestedChildOutputs, Tr as createAssetRedirectResolver, Tt as carriesDynamicReference, U as bold, Ui as MalformedProducerRecordRefusalError, Un as TEMPLATE_SOURCED_RULES, Ur as dockerSpawnEnvWithSensitive, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as LocalStartServiceError, Vn as STATE_SOURCED_CROSS_GENERATION_RULES, Vr as describeDockerExecFailure, Vt as coerceCfnInteger, W as cyan, Wi as NestedStackChildDirectDestroyError, Wn as carriesSecretMask, Wr as formatDockerLoginError, Wt as configStringRefusal, X as collectPublishedOutputNames, Xi as StackTerminationProtectionError, Xn as markSameGenerationBag, Xr as escapeRegExp, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as StackHasActiveImportsError, Yn as isSingleDynamicReferenceToken, Yr as runDockerStreaming, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zn as maskSecretsInError, Zr as stripControlChars, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as uploadCfnTemplate, _n as malformedOutputsRefusalMessage, _r as isReadableBag, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isThrottlingError, ai as resolveAutoAssetStorage, an as AWS_CREDENTIAL_ENV_KEYS, ar as rebuildClientForBucketRegion, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as expectedOwnerParam, bn as malformedResourcePropertiesWarning, br as shouldRetainResource, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as markRedactedCause, ci as resolveStateBucketWithDefault, cn as envCredentialsAreAssumedRole, cr as forceQuitRecoveryClause, ct as createMaskedRetryLogger, d as updatePartialReason, da as safeStringify, di as stateBucketExistenceConfirmed, dn as STATE_RESOURCES_MALFORMED, dr as CUSTOM_RESOURCE_RESPONSE_PREFIX, dt as beginCommandInterruptScope, ei as Synthesizer, en as s3BucketDomainName, er as recoverMaskedOutput, et as secretBearingStateKeyWarning, f as withResourceDeadline, fi as warnDeprecatedNoPrefixCliFlag, fn as hasReadableOutputs, fr as DEFAULT_STATE_PREFIX, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as findLargeInlineResources, gn as malformedLocalOutputsWarning, gr as importableOutputs, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as MIGRATE_TMP_PREFIX, hn as malformedExportSourceWarning, hr as importableOutputKeys, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isRetryableTransientError, ii as resolveApp, in as applyRoleArnIfSet, ir as S3StateBackend, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as setAwsClients, jn as repairMalformedOutputsForReadOnly, jr as ensureAssetStorage, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as getAwsClients, kn as refuseMalformedResourcesForDestroy, kr as BOOTSTRAP_MARKER_PREFIX, kt as getAccountInfo, l as replayRollback, la as retryClassificationText, li as resolveStateBucketWithDefaultAndSource, ln as DiffCalculator, lr as formatLockExpiry, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as CFN_TEMPLATE_URL_LIMIT, mn as malformedExportNamesWarning, mr as hasReadableExportSet, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as withErrorHandling, ni as getDefaultStateBucketName, nn as s3BucketRegionalDomainName, nr as scrubResourceRecord, nt as getCurrentResourceSecrets, o as planFailedOps, oa as isTransientServerError, oi as resolveCaptureObservedState, on as applyCallerIdentityCredentials, or as buildForceUnlockCommand, ot as ProviderRegistry, p as maskingRetryLogger, pi as CFN_TEMPLATE_BODY_LIMIT, pn as hasReadableResources, pr as exportNamesCarriedFrom, pt as interruptWatchListenerCount, q as red, qi as ResourceTimeoutError, qn as errorCauseChain, qr as redactDockerArgvValues, qt as requireConfigArray, r as DeployEngine, ra as isMarkedNonRetryable, ri as getLegacyStateBucketName, rn as s3BucketWebsiteUrl, rr as LockManager, rt as IAMRoleProvider, s as planRollback, sa as markNonRetryable, si as resolveSkipPrefix, sn as callerEnvCredentials, sr as buildLockContentionMessage, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as normalizeAwsError, ti as synthesisStatusMessage, tn as s3BucketDualStackDomainName, tr as redactSecretsForState, tt as secretSafeKeyDisplay, u as updatePartialMessage, ua as describeAwsFailure, ui as resolveUseCdkBootstrapAssets, un as INTRINSIC_KEYS, ur as shellQuote, ut as maskerOrIdentity, v as keptWholeReasonText, vi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, vn as malformedOutputsWarning, vr as orphansAfterRollback, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as AssemblyReader, wn as refuseDivergentRecordRegionForDestroy, wr as buildAssetRedirectMap, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as PARTITION_TABLE, xn as malformedResourcesWarning, xr as AssetPublisher, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as decodeListingKey, yn as malformedRenderedContainersWarning, yr as orphansCarriedFrom, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as IntrinsicResolutionRefusalError, zn as TemplateParser, zr as buildDockerImage, zt as assertRegionMatch } from "./deploy-engine-CA70_Rji.js";
-import { C as displaySafe, S as displayIdent, _ as withSkipPrefix, b as STACK_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE } from "./logger-CkHVgzLx.js";
+import { $ as secretBearing, $n as recordMaskOnlyValue, $r as AssetManifestLoader, $t as s3BucketArn, A as extractDeploymentEventError, Ai as getAwsClients, An as refuseMalformedState, Ar as BOOTSTRAP_MARKER_PREFIX, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as IntrinsicResolutionRefusalError, Bn as STATE_SOURCED_BASELINE_RULES, Br as buildDockerImage, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as canonicalizeRegion, Cn as producerRecordKey, Cr as stringifyValue, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Dn as refuseMalformedOutputsForDestroy, Dr as loadPublishableAssetManifest, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as processStackMessages, En as refuseMalformedOutputs, Er as createAssetRedirectResolver, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fn as findSilentDropProperties, Fr as parseBootstrapMarker, Ft as isSettledInstanceState, G as gray, Gi as NestedStackChildDirectDestroyError, Gn as createSecretMasker, Gr as formatDockerLoginError, Gt as readConfigString, H as formatResourceLine, Hi as LocalStartServiceError, Hn as STATE_SOURCED_READBACK_RULES, Hr as describeDockerExecFailure, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as CrossAccountSecretRefusalError, In as describeTypeWithThrottleRetry, Ir as readBootstrapMarkerBody, It as WAFv2WebACLProvider, J as yellow, Ji as ResourceTimeoutError, Jn as identityKeyFor, Jr as redactDockerArgvValues, Jt as requireConfigObject, K as green, Ki as PartialFailureError, Kn as dynamicReferenceTokens, Kr as getDockerCmd, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Ln as withRetry, Lr as validateAssetBucketName, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mi as setAwsClients, Mn as repairMalformedResourcePropertiesForReadOnly, Mr as ensureAssetStorage, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as repairMalformedResourcesForReadOnly, Nr as getBootstrapMarkerKey, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as resolveBucketRegion, On as refuseMalformedResourcePropertiesForOrphan, Or as rewriteTemplateAssetReferences, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pi as CdkdError, Pn as findActionableSilentDrops, Pr as isCrossRegionRedirect, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as maskSecretsInText, Qr as stripControlChars, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as DeployCancelledError, Rn as DagBuilder, Rr as validateContainerRepoName, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as PARTITION_TABLE, Sn as malformedStateRefusalMessage, Sr as AssetPublisher, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as AssemblyReader, Tn as refuseMalformedNestedChildOutputs, Tr as buildAssetRedirectMap, Tt as carriesDynamicReference, U as bold, Un as TEMPLATE_SOURCED_RULES, Ur as describeDockerFailure, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as LocalInvokeBuildError$1, Vn as STATE_SOURCED_CROSS_GENERATION_RULES, Vr as describeDockerCapturedOutput, Vt as coerceCfnInteger, W as cyan, Wi as MalformedProducerRecordRefusalError, Wn as carriesSecretMask, Wr as dockerSpawnEnvWithSensitive, Wt as configStringRefusal, X as collectPublishedOutputNames, Xi as StackHasActiveImportsError, Xn as markSameGenerationBag, Xr as runDockerStreaming, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as ResourceUpdateNotSupportedError, Yn as isSingleDynamicReferenceToken, Yr as runDockerForeground, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zi as StackTerminationProtectionError, Zn as maskSecretsInError, Zr as escapeRegExp, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as findLargeInlineResources, _n as malformedOutputsRefusalMessage, _r as importableOutputs, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isRetryableTransientError, ai as resolveApp, an as AWS_CREDENTIAL_ENV_KEYS, ar as rebuildClientForBucketRegion, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as decodeListingKey, bn as malformedResourcePropertiesWarning, br as orphansCarriedFrom, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as markNonRetryable, ci as resolveSkipPrefix, cn as envCredentialsAreAssumedRole, cr as buildLockContentionMessage, ct as createMaskedRetryLogger, d as updatePartialReason, da as describeAwsFailure, di as resolveUseCdkBootstrapAssets, dn as STATE_RESOURCES_MALFORMED, dr as shellQuote, dt as beginCommandInterruptScope, ei as getDockerImageBySourceHash, en as s3BucketDomainName, er as recoverMaskedOutput, et as secretBearingStateKeyWarning, f as withResourceDeadline, fa as safeStringify, fi as stateBucketExistenceConfirmed, fn as hasReadableOutputs, fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as MIGRATE_TMP_PREFIX, gn as malformedLocalOutputsWarning, gr as importableOutputKeys, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as CFN_TEMPLATE_URL_LIMIT, hn as malformedExportSourceWarning, hr as hasReadableExportSet, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isMarkedNonRetryable, ii as getLegacyStateBucketName, in as applyRoleArnIfSet, ir as S3StateBackend, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as resetAwsClients, jn as repairMalformedOutputsForReadOnly, jr as assertAssetBucketRegion, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as AwsClients, kn as refuseMalformedResourcesForDestroy, kr as AssetModeResolver, kt as getAccountInfo, l as replayRollback, la as markRedactedCause, li as resolveStateBucketWithDefault, ln as DiffCalculator, lr as forceQuitRecoveryClause, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as CFN_TEMPLATE_BODY_LIMIT, mn as malformedExportNamesWarning, mr as exportNamesCarriedFrom, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as normalizeAwsError, ni as synthesisStatusMessage, nn as s3BucketRegionalDomainName, nr as scrubResourceRecord, nt as getCurrentResourceSecrets, o as planFailedOps, oa as isThrottlingError, oi as resolveAutoAssetStorage, on as applyCallerIdentityCredentials, or as UNREPRODUCIBLE_LOCK_CLAUSE, ot as ProviderRegistry, p as maskingRetryLogger, pi as warnDeprecatedNoPrefixCliFlag, pn as hasReadableResources, pr as DEFAULT_STATE_PREFIX, pt as interruptWatchListenerCount, q as red, qi as ProvisioningError, qn as errorCauseChain, qr as partitionSensitiveEnv, qt as requireConfigArray, r as DeployEngine, ra as withErrorHandling, ri as getDefaultStateBucketName, rn as s3BucketWebsiteUrl, rr as LockManager, rt as IAMRoleProvider, s as planRollback, sa as isTransientServerError, si as resolveCaptureObservedState, sn as callerEnvCredentials, sr as buildForceUnlockCommand, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as Synthesizer, tn as s3BucketDualStackDomainName, tr as redactSecretsForState, tt as secretSafeKeyDisplay, u as updatePartialMessage, ua as retryClassificationText, ui as resolveStateBucketWithDefaultAndSource, un as INTRINSIC_KEYS, ur as formatLockExpiry, ut as maskerOrIdentity, v as keptWholeReasonText, vi as uploadCfnTemplate, vn as malformedOutputsWarning, vr as isReadableBag, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as derivePartitionAndUrlSuffix, wn as refuseDivergentRecordRegionForDestroy, wr as WorkGraph, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as expectedOwnerParam, xn as malformedResourcesWarning, xr as shouldRetainResource, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, yn as malformedRenderedContainersWarning, yr as orphansAfterRollback, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as DynamicReferenceRegionAmbiguousError, zn as TemplateParser, zr as buildDenyExternalAccessPolicy, zt as assertRegionMatch } from "./deploy-engine-Bcwb9_mO.js";
+import { C as displayIdent, S as UNRENDERABLE, T as truncateCodePoints, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displaySafe, x as STACK_REF_MAX_CODE_POINTS } from "./logger-6LP1UiFA.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-CWpPiHCn.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-Dn1f0SJi.js";
+import { t as getCdkdVersion } from "./version-snXN__f1.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-Dwnb3CES.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -17948,6 +17948,158 @@ function liveCeilingAlreadyMatches(live, requested) {
 	return compared > 0;
 }
 /**
+* The sentinel DynamoDB accepts to CLEAR an on-demand request-unit maximum
+* (issue [#3373](https://github.com/go-to-k/cdkd/issues/3373)).
+*
+* LIVE-VERIFIED at BOTH positions this file sends from, which is what makes it
+* implementable at both at once rather than at one and not the other:
+*
+*  - `UpdateTable.OnDemandThroughput` — AWS's own SDK model doc for the block,
+*    and the measurement recorded on issue
+*    [#1434](https://github.com/go-to-k/cdkd/issues/1434) (us-east-1 +
+*    us-west-2, 2026-08-09), which probed the SINGLE-member shape this file
+*    also sends: `{MaxWriteRequestUnits: -1}` against a live `{100, 100}` was
+*    accepted and read back as `{MaxReadRequestUnits: 100}`;
+*  - `UpdateTable.GlobalSecondaryIndexUpdates[].Update.OnDemandThroughput` —
+*    the position issue #3373's body called UNMEASURED. It is not, and the
+*    evidence is in TWO places, named separately because a reviewer checked
+*    and one of them is not where an earlier draft of this said it was:
+*    issue [#1423](https://github.com/go-to-k/cdkd/issues/1423)'s comment
+*    thread carries the `{-1, -1}` transcript (us-east-1, 2026-08-09,
+*    throwaway table) — ACCEPTED, with `DescribeTable` then reporting the
+*    block ABSENT — and PR
+*    [#1433](https://github.com/go-to-k/cdkd/pull/1433)'s body carries the
+*    MIXED `keep 50 / reset -1` probe at the same position, re-run precisely
+*    because only `{-1, -1}` had been verified. `dynamodb-globaltable-provider.ts`
+*    has shipped on both since. #3373's dup-check dismissed those issues
+*    because `AWS::DynamoDB::GlobalTable` spells its per-GSI ceilings
+*    `Write` / `ReadOnDemandThroughputSettings` — true of the TEMPLATE and
+*    irrelevant to the WIRE, where both providers send the same
+*    `UpdateGlobalSecondaryIndexAction.OnDemandThroughput`.
+*
+* The read-back is ABSENCE, never `-1`, at both positions — so nothing on the
+* drift / `readCurrentState` side may expect this value.
+*/
+const ON_DEMAND_LIMIT_RESET$1 = -1;
+/**
+* Which `OnDemandThroughput` members this update must explicitly REMOVE, as a
+* list of member names (issue #3373).
+*
+* An absent member KEEPS whatever maximum the table already carries, so a
+* template edit that drops a ceiling used to deploy GREEN, be recorded as
+* applied, and leave the live maximum in force forever — the #1160
+* absent-field-reset class, one level down inside a nested block.
+*
+* PER MEMBER, never per BLOCK: read and write maxima are independent template
+* values, so a whole-block branch would drop the single-member removal, which
+* is the likelier user edit (the `AWS::DynamoDB::GlobalTable` twin paid for
+* that once already).
+*
+* FOUR conditions, all necessary, each closing a different way this goes
+* wrong:
+*
+*  1. **the PREVIOUS side declared it AND it survived narrowing.**
+*     `previousProperties` is a cdkd STATE record and the record is RAW — it
+*     holds the spelling the TEMPLATE declared, including a member
+*     {@link narrowOnDemandCeilings} REFUSED and cdkd therefore never sent. A
+*     raw presence test would read such a member as "previously applied".
+*  2. **the DESIRED side does not declare it AT ALL, raw.** This is issue
+*     [#1440](https://github.com/go-to-k/cdkd/issues/1440) exactly: a member
+*     the grammar rejected is the template TRYING to SET a ceiling, and taking
+*     the reset branch for it would silently CLEAR the ceiling being set. The
+*     narrowed desired side cannot tell those apart; the raw one can.
+*  3. **AWS actually HOLDS the member right now.** It proves there is a maximum
+*     to remove, and it makes the whole rule fail CLOSED when cdkd holds no
+*     live snapshot — the correct direction for a send that DESTROYS a live
+*     value.
+*  4. **this update leaves the table on PAY_PER_REQUEST** (`ceilingsSendable`).
+*     Condition 3 does NOT subsume this, and believing it did was a BLOCKER on
+*     PR go-to-k/cdkd#3401 (spec review, M0). The live snapshot is the ONE
+*     `DescribeTable` at the top of `update()` and is never refreshed, while
+*     both removal arms run AFTER the BillingMode flip — so on a template that
+*     flips a live on-demand table to PROVISIONED **and** drops the ceiling,
+*     the pre-flight refusals both decline (neither side DECLARES a ceiling),
+*     the flip lands, and the stale snapshot then says the member is live: cdkd
+*     would send `-1` to a now-PROVISIONED table, AWS would reject it, and a
+*     previously-green no-op becomes a HALF-APPLIED deploy — the exact class
+*     the #3392 pre-flight exists to prevent. `dynamodb-globaltable-provider.ts`
+*     carries the same guard at both of its positions
+*     (`onDemandCeilingLive` / `!billingFlipped`), named in PR
+*     go-to-k/cdkd#1433's body as "skipped on a billing flip".
+*
+*     What the skip COSTS was asked and MEASURED, not assumed (the
+*     go-to-k/cdkd#3401 code review raised it; issue
+*     [#1441](https://github.com/go-to-k/cdkd/issues/1441) had already
+*     settled it). The worry is a round trip: deploy A sets a ceiling on a
+*     PAY_PER_REQUEST table, deploy B flips to PROVISIONED and drops it (the
+*     reset suppressed here), deploy C flips back declaring nothing — and
+*     since deploy B's template is now the previous side, condition 1 can
+*     never fire again, so a RETAINED ceiling would be unclearable. #1441's
+*     probe (us-east-1, 2026-08-10, transcript on the issue) ran exactly that
+*     sequence at the TABLE level: `DescribeTable` reports the block ABSENT
+*     after the flip, and it does NOT come back on the flip home. Nothing is
+*     stranded. The PER-INDEX round trip is not separately measured — issue
+*     [#3403](https://github.com/go-to-k/cdkd/issues/3403) — but it fails in
+*     the SAFE direction (a lingering maximum, never a destroyed one).
+*
+* Every member-presence test here is `Object.hasOwn`, not `in` (the
+* go-to-k/cdkd#3401 security review). `in` walks the prototype chain, and these
+* three tests gate a DESTRUCTIVE send off a cdkd STATE record — the own-key
+* convention `drift.ts`'s `hasOwnKey` / `ownValue` already follow for
+* state-derived bags (issue go-to-k/cdkd#2899). Not demonstrably reachable
+* today; the point is that the guard on a destroying path should not depend on
+* that staying true.
+*
+* `declared` present but NOT a plain block (a string, an array, an unresolved
+* intrinsic) yields NO removals: that value is forwarded VERBATIM for AWS to
+* reject by shape, and merging a sentinel into it is not expressible.
+*
+* And a declared block cdkd cannot READ AT ALL yields none either — a plain
+* object with no member surviving {@link narrowOnDemandCeilings}, i.e. only
+* rejected spellings or only names the grammar does not know (`{Ref: 'Unset'}`,
+* a mis-nested value). That is condition 2 one level up: such a block is not a
+* statement that the sibling member was REMOVED, it is a template cdkd could
+* not read, and clearing a live maximum on the strength of it is the same
+* destruction #1440 describes. An ABSENT desired side is the opposite and is
+* the headline case — nothing declared means nothing kept.
+*/
+function onDemandCeilingRemovals(declared, previous, live, ceilingsSendable) {
+	if (!ceilingsSendable) return [];
+	if (live === void 0) return [];
+	if (declared !== void 0 && !isPlainCapacityBlock(declared)) return [];
+	const previousBlock = narrowOnDemandCeilings(previous).block;
+	if (!isPlainCapacityBlock(previousBlock)) return [];
+	const declaredBlock = isPlainCapacityBlock(declared) ? declared : void 0;
+	if (declaredBlock !== void 0) {
+		const declaredSurvivors = narrowOnDemandCeilings(declaredBlock).block;
+		if (!isPlainCapacityBlock(declaredSurvivors) || !ON_DEMAND_CEILING_MEMBERS.some((member) => Object.hasOwn(declaredSurvivors, member))) return [];
+	}
+	const liveBag = live;
+	const removals = [];
+	for (const member of ON_DEMAND_CEILING_MEMBERS) {
+		if (!Object.hasOwn(previousBlock, member)) continue;
+		if (declaredBlock !== void 0 && Object.hasOwn(declaredBlock, member)) continue;
+		if (toFiniteNumber(liveBag[member]) === void 0) continue;
+		removals.push(member);
+	}
+	return removals;
+}
+/**
+* Merge the {@link onDemandCeilingRemovals} sentinels into a block bound for
+* the wire (issue #3373).
+*
+* A COPY, never a mutation of `block`: {@link narrowOnDemandCeilings} returns
+* its input BY IDENTITY when nothing needed rewriting, so mutating here would
+* write `-1` into the caller's own `properties` bag — which the engine then
+* records as state.
+*/
+function withOnDemandCeilingRemovals(block, removals) {
+	if (removals.length === 0) return block;
+	const merged = { ...isPlainCapacityBlock(block) ? block : {} };
+	for (const member of removals) merged[member] = ON_DEMAND_LIMIT_RESET$1;
+	return merged;
+}
+/**
 * The capacity both TABLE-level forwarders substitute for a member the
 * template does not declare at all — `create()`'s `CreateTable` and the
 * BillingMode flip's `UpdateTable`. It is the pre-issue-#3147 `?? 5`, kept
@@ -18712,7 +18864,17 @@ var DynamoDBTableProvider = class {
 			const billingOrThroughputChanged = billingMode !== prevBillingMode || JSON.stringify(properties["ProvisionedThroughput"]) !== JSON.stringify(previousProperties["ProvisionedThroughput"]);
 			if (billingOrThroughputChanged && billingMode === "PROVISIONED" && (prevBillingMode === "PAY_PER_REQUEST" || liveBillingMode === "PAY_PER_REQUEST") && properties["OnDemandThroughput"] !== void 0) {
 				const absentNote = properties["BillingMode"] === void 0 ? " (BillingMode is absent from the template, which CloudFormation resets to PROVISIONED)" : "";
-				throw new ProvisioningError(`AWS::DynamoDB::Table ${logicalId}: the template flips BillingMode to PROVISIONED${absentNote} while still declaring OnDemandThroughput, which AWS accepts only on a PAY_PER_REQUEST table. Nothing was applied. Remove OnDemandThroughput, or keep BillingMode: PAY_PER_REQUEST.`, logicalId, resourceType);
+				throw new ProvisioningError(`AWS::DynamoDB::Table ${logicalId}: the template flips BillingMode to PROVISIONED${absentNote} while still declaring OnDemandThroughput, which AWS accepts only on a PAY_PER_REQUEST table. No BillingMode flip and no index change were applied. Remove OnDemandThroughput, or keep BillingMode: PAY_PER_REQUEST.`, resourceType, logicalId);
+			}
+			const effectiveBillingMode = billingOrThroughputChanged ? billingMode : liveBillingMode;
+			if (effectiveBillingMode === "PROVISIONED") {
+				const ceilingIndexNames = (Array.isArray(properties["GlobalSecondaryIndexes"]) ? properties["GlobalSecondaryIndexes"] : []).filter((entry) => entry !== null && typeof entry === "object" && !Array.isArray(entry)).filter((entry) => Boolean(entry["OnDemandThroughput"])).map((entry) => typeof entry["IndexName"] === "string" ? maskSecrets(entry["IndexName"]) : "<unnamed>");
+				if (ceilingIndexNames.length > 0) {
+					const modeNote = billingOrThroughputChanged ? "" : " (the table is already PROVISIONED in AWS and this update sends no BillingMode change)";
+					const message = `AWS::DynamoDB::Table ${logicalId}: GlobalSecondaryIndexes ${ceilingIndexNames.join(", ")} declare OnDemandThroughput while the table's billing mode is PROVISIONED${modeNote}, which AWS accepts only on a PAY_PER_REQUEST table. Remove the per-index OnDemandThroughput, or set BillingMode: PAY_PER_REQUEST.`;
+					if (context?.replayingState === true || context?.desiredFromAwsReadback === true) warn(`${message} Downgraded to a warning because this update's desired properties did not come from the template, so there is no template-side remedy; the per-index ceiling will be sent and AWS will reject it.`);
+					else throw new ProvisioningError(`${message} No BillingMode flip and no index change were applied.`, resourceType, logicalId, physicalId);
+				}
 			}
 			const liveIndexes = table?.GlobalSecondaryIndexes ?? [];
 			const desiredIndexByName = /* @__PURE__ */ new Map();
@@ -18796,10 +18958,13 @@ var DynamoDBTableProvider = class {
 				this.logger.debug(`Updated BillingMode/ProvisionedThroughput/TableClass on DynamoDB table ${physicalId}`);
 			}
 			if (JSON.stringify(properties["OnDemandThroughput"]) !== JSON.stringify(previousProperties["OnDemandThroughput"])) {
-				if (properties["OnDemandThroughput"]) {
+				const ceilingRemovals = onDemandCeilingRemovals(properties["OnDemandThroughput"], previousProperties["OnDemandThroughput"], table?.OnDemandThroughput, effectiveBillingMode === "PAY_PER_REQUEST");
+				if (properties["OnDemandThroughput"] || ceilingRemovals.length > 0) {
+					const declaredForSend = properties["OnDemandThroughput"] ? this.coerceOnDemandCeilingsForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["OnDemandThroughput"], maskSecrets) : {};
+					if (ceilingRemovals.length > 0) debug(`AWS::DynamoDB::Table ${logicalId}: removing the OnDemandThroughput ${ceilingRemovals.join(" / ")} the template no longer declares (sending ${ON_DEMAND_LIMIT_RESET$1}, DynamoDB's reset sentinel)`);
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
-						OnDemandThroughput: this.coerceOnDemandCeilingsForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["OnDemandThroughput"], maskSecrets)
+						OnDemandThroughput: withOnDemandCeilingRemovals(declaredForSend, ceilingRemovals)
 					}));
 					await this.waitForTableActiveAfterUpdate(physicalId);
 					this.logger.debug(`Updated OnDemandThroughput on DynamoDB table ${physicalId}`);
@@ -18868,7 +19033,7 @@ var DynamoDBTableProvider = class {
 					this.logger.debug(`Disabled DynamoDB Stream on table ${physicalId}`);
 				}
 			}
-			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, maskSecrets);
+			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, effectiveBillingMode === "PAY_PER_REQUEST", maskSecrets);
 			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"], maskSecrets);
 			if (JSON.stringify(properties["TimeToLiveSpecification"]) !== JSON.stringify(previousProperties["TimeToLiveSpecification"])) {
 				this.assertNoActiveTtlAttributeNameChange(logicalId, resourceType, physicalId, properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"]);
@@ -19062,7 +19227,7 @@ var DynamoDBTableProvider = class {
 	* change", so a dropped block must be turned into an explicit
 	* `PointInTimeRecoveryEnabled: false`).
 	*/
-	async applyPointInTimeRecovery(tableName, spec, previousSpec, maskSecrets = (text) => text) {
+	async applyPointInTimeRecovery(tableName, spec, previousSpec, maskSecrets) {
 		let enabled;
 		let recoveryPeriodInDays;
 		if (spec !== void 0 && spec !== null) {
@@ -19237,7 +19402,7 @@ var DynamoDBTableProvider = class {
 	* pre-existing WarmThroughput "no clean remap" stance; precision changes flow
 	* through on the create / first-enable path.
 	*/
-	async applyKinesisStreamingDestination(tableName, spec, previousSpec, maskSecrets = (text) => text) {
+	async applyKinesisStreamingDestination(tableName, spec, previousSpec, maskSecrets) {
 		const newArn = this.extractKinesisStreamArn(spec);
 		const prevArn = this.extractKinesisStreamArn(previousSpec);
 		if (newArn === prevArn) {
@@ -19427,7 +19592,7 @@ var DynamoDBTableProvider = class {
 	*    a remove-then-add pair, so this method throws on such a change rather than
 	*    silently dropping it.
 	*/
-	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip = /* @__PURE__ */ new Set(), liveIndexNames, liveIndexByName, liveCapacityComparable = false, maskSecrets = (text) => text) {
+	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip, liveIndexNames, liveIndexByName, liveCapacityComparable, onDemandCeilingsSendable, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const debug = (message) => this.logger.debug(maskSecrets(message));
 		const prev = previousGsis ?? [];
@@ -19459,7 +19624,7 @@ var DynamoDBTableProvider = class {
 					adopted.WarmThroughput = adoptedWarm;
 					adoptedHasMember = true;
 				}
-				const adoptedCeiling = this.indexCeilingForSend(name, physicalId, gsi, void 0, live, maskSecrets);
+				const adoptedCeiling = this.indexCeilingForSend(name, physicalId, gsi, void 0, live, onDemandCeilingsSendable, maskSecrets);
 				if (adoptedCeiling) {
 					adopted.OnDemandThroughput = adoptedCeiling;
 					adoptedHasMember = true;
@@ -19495,7 +19660,7 @@ var DynamoDBTableProvider = class {
 				update.WarmThroughput = warm;
 				updateHasMember = true;
 			}
-			const ceiling = this.indexCeilingForSend(name, physicalId, gsi, before, liveIndexByName?.get(name), maskSecrets);
+			const ceiling = this.indexCeilingForSend(name, physicalId, gsi, before, liveIndexByName?.get(name), onDemandCeilingsSendable, maskSecrets);
 			if (ceiling) {
 				update.OnDemandThroughput = ceiling;
 				updateHasMember = true;
@@ -19515,7 +19680,7 @@ var DynamoDBTableProvider = class {
 	* two messages are disjoint by construction: this one fires only when
 	* something DID resolve.
 	*/
-	coerceWarmThroughputForSend(scope, value, maskSecrets = (text) => text) {
+	coerceWarmThroughputForSend(scope, value, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const coerced = coerceWarmThroughput(value);
 		if (coerced === void 0) return void 0;
@@ -19618,24 +19783,23 @@ var DynamoDBTableProvider = class {
 	*    deploy succeed, so the engine records the un-sent ceiling as applied and
 	*    the deploy that FIXES the billing mode then compares equal and never
 	*    sends it — issue #3287's own defect, reintroduced by its own guard. The
-	*    file's table-level twin states that reasoning at its own refusal. The
-	*    correct shape is a PRE-FLIGHT refusal covering all THREE per-index send
-	*    sites (the `Create` arm has carried the same defect since #3265), which
-	*    is issue [#3392](https://github.com/go-to-k/cdkd/issues/3392). Until
-	*    then AWS validates the constraint, exactly as it does for the
-	*    TABLE-level arm and for the `Create` action.
-	*
-	*    **That IS a behaviour change on this shape, stated rather than glossed**
-	*    (round 3's C4). Before #3287 neither `Update` arm sent the member, so a
-	*    PROVISIONED table declaring a per-index ceiling deployed GREEN with the
-	*    ceiling silently ignored. Now the same-name arm sends it once the
-	*    ceiling CHANGES, AWS rejects the `UpdateTable`, and the co-resident
-	*    capacity / warm edits fail with it; the adopted-index arm has no
-	*    recorded previous side to gate on, so it re-fails every deploy until the
-	*    template is edited. Loud and recording nothing beats silent and lost,
-	*    which is why it ships this way rather than behind the withdrawn skip —
-	*    but it is a change, and #3392 is what makes it a cdkd-worded refusal
-	*    before any call instead of an AWS rejection after one.
+	*    file's table-level twin states that reasoning at its own refusal.
+	*
+	*    **The refusal it pointed at has SHIPPED** (issue
+	*    [#3392](https://github.com/go-to-k/cdkd/issues/3392)): `update()` walks
+	*    `GlobalSecondaryIndexes[]` before any call and throws when the EFFECTIVE
+	*    billing mode is PROVISIONED, which covers all THREE per-index send sites
+	*    at once (this arm, the same-name `Update` arm's caller, and the `Create`
+	*    action, which has carried the same defect since #3265) because none of
+	*    them is reached. So this arm's job is unchanged and stays deliberately
+	*    mode-blind: a gate here would be a SECOND spelling of one rule, and the
+	*    mid-update spelling is the one that was measured wrong.
+	*
+	*    On the REPLAY path the pre-flight downgrades to a warning and this arm
+	*    still runs, so the remaining behaviour is what #3287's round 3 recorded:
+	*    the member goes out, AWS rejects the `UpdateTable`, and the co-resident
+	*    capacity / warm edits fail with it. Loud and recording nothing beats
+	*    silent and lost.
 	*  - **The change detector compares the NARROWED blocks WHEN NOTHING WAS
 	*    DROPPED, and the RAW ones otherwise** — the one place it differs from its
 	*    `ProvisionedThroughput` sibling two arms up. `'200'` and `200` are the
@@ -19681,21 +19845,39 @@ var DynamoDBTableProvider = class {
 	*    rejects by name (issue #3392) rather than a silently dropped change.
 	*    There is no `{0, 0}` analogue of the #1571 capacity trap.
 	*
-	* What it deliberately does NOT do is REMOVE a ceiling. A desired side that
-	* declares none takes the truthiness gate and emits nothing, so the live
-	* maximum SURVIVES — `-1` is AWS's documented removal sentinel and an absent
-	* member keeps the maximum. That is byte-identical to what `update()`'s
-	* TABLE-level arm does with the same edit (its own comment states it), and
-	* implementing the reset on ONE of the two would make the same property
-	* behave differently at the table and at an index of the same table. The
-	* removal direction is filed for BOTH sites together as issue
-	* [#3373](https://github.com/go-to-k/cdkd/issues/3373), which also records
-	* why it is not an extrapolation from the GlobalTable measurement: `-1` is
-	* LIVE-VERIFIED at `UpdateTable.OnDemandThroughput` and UNMEASURED at this
-	* action's, and sending it DESTROYS a live ceiling.
-	*/
-	indexCeilingForSend(name, physicalId, gsi, before, live, maskSecrets) {
-		if (!gsi.OnDemandThroughput) return void 0;
+	* It DOES remove a ceiling, since issue
+	* [#3373](https://github.com/go-to-k/cdkd/issues/3373) — and the removal is
+	* the one thing here that runs AHEAD of the truthiness gate, because the
+	* whole point is a desired side that declares nothing. An absent member KEEPS
+	* whatever maximum the index already carries, so before #3373 a template edit
+	* dropping a ceiling deployed GREEN, was recorded as applied, and left the
+	* live maximum in force forever.
+	*
+	* {@link onDemandCeilingRemovals} owns every condition and
+	* {@link ON_DEMAND_LIMIT_RESET} carries the measurement for THIS action's
+	* position (issue #1423's probe transcript, not an extrapolation from the
+	* table-level field's docs). Two properties of that rule matter most here:
+	* the previous side is read through {@link narrowOnDemandCeilings} so a
+	* member cdkd REFUSED cannot read as "previously applied"; the reset fires
+	* only for a member AWS is OBSERVED to hold, which makes it fail CLOSED with
+	* no live snapshot; and it is suppressed outright when this update FLIPS the
+	* table to PROVISIONED (`onDemandCeilingsSendable`). Do not read the
+	* observed-live condition as covering the flip — it does not, and believing
+	* it did was a merge blocker: the live snapshot is taken before the flip and
+	* never refreshed.
+	*
+	* The TABLE-level arm in `update()` takes the same rule in the same change,
+	* because implementing it at ONE of the two positions would make the same
+	* property behave differently at the table and at an index of the same table.
+	*/
+	indexCeilingForSend(name, physicalId, gsi, before, live, onDemandCeilingsSendable, maskSecrets) {
+		const removals = onDemandCeilingRemovals(gsi.OnDemandThroughput, before?.OnDemandThroughput, live?.OnDemandThroughput, onDemandCeilingsSendable);
+		if (!gsi.OnDemandThroughput) {
+			if (removals.length === 0) return void 0;
+			const removalScope = this.indexScopeAt(name, physicalId, maskSecrets);
+			this.logger.debug(maskSecrets(`${removalScope}: removing the OnDemandThroughput ${removals.join(" / ")} the template no longer declares (sending ${ON_DEMAND_LIMIT_RESET$1}, DynamoDB's reset sentinel)`));
+			return withOnDemandCeilingRemovals({}, removals);
+		}
 		if (before !== void 0) {
 			const desired = narrowOnDemandCeilings(gsi.OnDemandThroughput);
 			const previous = narrowOnDemandCeilings(before.OnDemandThroughput);
@@ -19705,8 +19887,10 @@ var DynamoDBTableProvider = class {
 		const scope = this.indexScopeAt(name, physicalId, maskSecrets);
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const debug = (message) => this.logger.debug(maskSecrets(message));
-		const send = this.coerceOnDemandCeilingsForSend(scope, gsi.OnDemandThroughput, maskSecrets);
-		if (!isPlainCapacityBlock(send)) return send;
+		const coerced = this.coerceOnDemandCeilingsForSend(scope, gsi.OnDemandThroughput, maskSecrets);
+		if (!isPlainCapacityBlock(coerced)) return coerced;
+		if (removals.length > 0) debug(`${scope}: removing the OnDemandThroughput ${removals.join(" / ")} the template no longer declares (sending ${ON_DEMAND_LIMIT_RESET$1}, DynamoDB's reset sentinel)`);
+		const send = withOnDemandCeilingRemovals(coerced, removals);
 		if (!ON_DEMAND_CEILING_MEMBERS.some((member) => member in send)) {
 			if (narrowOnDemandCeilings(gsi.OnDemandThroughput).dropped.length > 0) debug(`${scope}: every declared OnDemandThroughput member was unusable, so no ceiling op was sent`);
 			else warn(`${scope}: declares an OnDemandThroughput with no member DynamoDB accepts (${ON_DEMAND_CEILING_MEMBERS.join(" / ")}), so no ceiling op was sent. Check the member names.`);
@@ -19751,7 +19935,7 @@ var DynamoDBTableProvider = class {
 	* value, which is pre-existing behaviour and costs one spread per declared
 	* block.
 	*/
-	coerceIndexThroughputForCreate(logicalId, entry, maskSecrets = (text) => text) {
+	coerceIndexThroughputForCreate(logicalId, entry, maskSecrets) {
 		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return entry;
 		const bag = entry;
 		const declaredWarm = bag["WarmThroughput"];
@@ -19837,7 +20021,7 @@ var DynamoDBTableProvider = class {
 	* same fail-open reason — a misspelled `ReadCapacityUnit` reaches AWS and is
 	* named there rather than vanishing here.
 	*/
-	coerceIndexCapacityBlock(scope, declared, maskSecrets = (text) => text) {
+	coerceIndexCapacityBlock(scope, declared, maskSecrets) {
 		if (!isPlainCapacityBlock(declared)) return void 0;
 		const block = declared;
 		let rewritten;
@@ -20045,7 +20229,7 @@ var DynamoDBTableProvider = class {
 	* table that does not exist. {@link tableCapacityForSend}'s doc carries why
 	* this type differs.
 	*/
-	warnUnusableProvisionedCapacity(scope, member, raw, maskSecrets = (text) => text) {
+	warnUnusableProvisionedCapacity(scope, member, raw, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		warn(`${scope}: ProvisionedThroughput.${member} ${JSON.stringify(maskLeafValue$1(raw, maskSecrets))} is not an Integer CloudFormation accepts (an optional sign and decimal digits only — no surrounding whitespace, hex, exponent or decimal point), so it was NOT sent and NO capacity was substituted for it. DynamoDB requires both members wherever a PROVISIONED ProvisionedThroughput block is declared — the table itself, and every GlobalSecondaryIndexes[] entry of a PROVISIONED table — and will reject the request naming this one; CloudFormation refuses the same template at properties validation. Check for an unresolved intrinsic, or spell the value as a decimal integer.`);
 	}
@@ -20061,7 +20245,7 @@ var DynamoDBTableProvider = class {
 	* Silent for an ABSENT or FALSY value — see {@link isRefusedWarmThroughput}
 	* for why those two are not this warning's business.
 	*/
-	warnRefusedWarmThroughput(scope, value, maskSecrets = (text) => text) {
+	warnRefusedWarmThroughput(scope, value, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		if (!isRefusedWarmThroughput(value)) return;
 		warn(`${scope}: the declared WarmThroughput ${JSON.stringify(maskLeafValue$1(value, maskSecrets))} carries no usable ReadUnitsPerSecond or WriteUnitsPerSecond, so it was NOT sent — DynamoDB accepts only those two members and rejects a request without either. Check for a misspelled member name or an unresolved intrinsic. Nothing else on this resource was affected.`);
@@ -20119,7 +20303,7 @@ var DynamoDBTableProvider = class {
 	*    `DescribeTable` reports for every index anyway, so there is no divergence
 	*    to hide.
 	*/
-	skipZeroCapacityIndexUpdate(indexName, physicalId, requested, maskSecrets = (text) => text) {
+	skipZeroCapacityIndexUpdate(indexName, physicalId, requested, maskSecrets) {
 		if (requested === void 0) return false;
 		if (toFiniteNumber(requested.ReadCapacityUnits) !== 0 || toFiniteNumber(requested.WriteCapacityUnits) !== 0) return false;
 		const warn = (message) => this.logger.warn(maskSecrets(message));
@@ -20152,7 +20336,7 @@ var DynamoDBTableProvider = class {
 	*    lower than current WarmThroughput, decreasing WarmThroughput is not
 	*    supported`.
 	*/
-	warmThroughputOpFor(indexName, physicalId, desired, previous, live, maskSecrets = (text) => text) {
+	warmThroughputOpFor(indexName, physicalId, desired, previous, live, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const debug = (message) => this.logger.debug(maskSecrets(message));
 		const scope = this.indexScopeAt(indexName, physicalId, maskSecrets);
@@ -20185,7 +20369,7 @@ var DynamoDBTableProvider = class {
 	* of it — the wait is what makes the next op (there, the BillingMode flip)
 	* legal.
 	*/
-	async runGsiOps(physicalId, ops, desiredAttributeDefinitions, maskSecrets = (text) => text) {
+	async runGsiOps(physicalId, ops, desiredAttributeDefinitions, maskSecrets) {
 		const debug = (message) => this.logger.debug(maskSecrets(message));
 		for (const op of ops) {
 			const input = {
@@ -20244,7 +20428,7 @@ var DynamoDBTableProvider = class {
 	* resource clean. The message therefore says the warning may be the only
 	* signal, and names both numbers so the template edit needs no second look.
 	*/
-	skipWarmThroughputDecrease(logicalId, physicalId, desired, live, maskSecrets = (text) => text) {
+	skipWarmThroughputDecrease(logicalId, physicalId, desired, live, maskSecrets) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		if (!isWarmThroughputDecrease(desired, live)) return false;
 		warn(`AWS::DynamoDB::Table ${logicalId}: the requested WarmThroughput ${JSON.stringify(maskDeep(desired, maskSecrets))} is lower than the ${JSON.stringify(maskDeep({
@@ -49460,10 +49644,14 @@ var AppSyncProvider = class {
 		}
 		const explicit = resolveExplicitPhysicalId(input, null);
 		if (explicit) try {
-			await this.getClient().send(new GetGraphqlApiCommand({ apiId: explicit }));
+			const response = await this.getClient().send(new GetGraphqlApiCommand({ apiId: explicit }));
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: definedAttributes({
+					ApiId: explicit,
+					Arn: response.graphqlApi?.arn,
+					GraphQLUrl: response.graphqlApi?.uris?.["GRAPHQL"]
+				})
 			};
 		} catch (err) {
 			if (err instanceof NotFoundException$4) return null;
@@ -75683,6 +75871,43 @@ const COMPOSITE_ID_SPLITTERS = {
 			},
 			propertiesOverlay: { FunctionName: functionName }
 		};
+	},
+	"AWS::AppSync::ApiKey": (physicalId, properties) => {
+		const trimmed = physicalId.trim();
+		if (!trimmed) throw new Error("empty physical id for AWS::AppSync::ApiKey (expected 'apiId|apiKeyId', the key ARN, or a bare apiKeyId)");
+		const arnMatch = /^arn:[^:]+:appsync:[^:]*:[^:]*:apis\/([^/|]+)\/apikey\/([^/|]+)$/.exec(trimmed);
+		if (arnMatch) {
+			const [, apiId, apiKeyId] = arnMatch;
+			return {
+				resourceIdentifier: {
+					ApiId: apiId,
+					ApiKeyId: apiKeyId
+				},
+				propertiesOverlay: { ApiId: apiId }
+			};
+		}
+		if (trimmed.startsWith("arn:")) throw new Error(`'${physicalId}' looks like an ARN but is not an AppSync API key ARN (expected arn:<partition>:appsync:<region>:<account>:apis/<apiId>/apikey/<apiKeyId>)`);
+		const parts = trimmed.split("|");
+		if (parts.length > 2) throw new Error(`expected 'apiId|apiKeyId', the key ARN, or a bare apiKeyId, got ${parts.length} parts: '${physicalId}'`);
+		if (parts.length === 2) {
+			const [apiId, apiKeyId] = parts;
+			if (!apiId.trim() || !apiKeyId.trim()) throw new Error(`empty part in 'apiId|apiKeyId': '${physicalId}'`);
+			return {
+				resourceIdentifier: {
+					ApiId: apiId,
+					ApiKeyId: apiKeyId
+				},
+				propertiesOverlay: { ApiId: apiId }
+			};
+		}
+		const apiId = readStringProperty(properties, "ApiId", "AWS::AppSync::ApiKey");
+		return {
+			resourceIdentifier: {
+				ApiId: apiId,
+				ApiKeyId: trimmed
+			},
+			propertiesOverlay: { ApiId: apiId }
+		};
 	}
 };
 /**
@@ -76000,6 +76225,24 @@ function createIdentifierBackfillDeps(ec2Client) {
 * | `AWS::AppSync::Resolver` | `ResolverArn` | `attributes.ResolverArn` |
 * | `AWS::S3Tables::Table` | `TableARN` | `attributes.TableARN` |
 * | `AWS::EC2::SecurityGroupIngress` | `Id` | `attributes.Id` (issue #1761) |
+* | `AWS::AppSync::GraphQLApi` | `Arn` (2026-09-18) | `attributes.Arn` (issue #3414) |
+*
+* The GraphQLApi row is the one whose identifier AWS RE-DECLARED under cdkd:
+* the 2026-09-17 public bundle flipped it from `ApiId` to `Arn` (issue #3327
+* recorded the two published sources disagreeing at the time), and by
+* 2026-09-18 `describe-type` in us-east-1 answers `["/properties/Arn"]` with a
+* full handler set. cdkd's physicalId is the bare `apiId`, which is NOT the ARN
+* and cannot be turned into one without account + partition, so the entry
+* reads the `Arn` attribute `AppSyncProvider.create` records. Because the
+* flip is recent and the two sources disagreed, the entry ALSO declares
+* `physicalIdIsIdentifierFor: ['ApiId']`: a schema that reports the OLD
+* single field is not a schema change that needs a code edit — for a record
+* cdkd deployed, the physicalId already IS that value — so `resolveCompositeId`
+* takes the plain single-key path for it instead of refusing by name. The
+* bypass excludes an ARN-shaped physicalId (a `--migrate-from-cloudformation`
+* record stores CloudFormation's `PhysicalResourceId`, the ARN), which under
+* a pre-flip registry keeps the loud cross-check refusal rather than shipping
+* an ARN as `ApiId`.
 *
 * The SG-ingress row is measured the same way as the rest, and separately
 * against a real CloudFormation stack because the three strings that name one
@@ -76013,11 +76256,21 @@ function createIdentifierBackfillDeps(ec2Client) {
 * `sgr-02345615af6d2db0d`, with `Ref` and `Fn::GetAtt .Id` both returning that
 * same value.
 *
-* All four declare a `read` handler, so CFn genuinely does accept them for
-* IMPORT — unlike `AWS::Glue::Table`, the type issue #1659's title names, which
-* CFn rejects outright (see {@link typeIsImportUnsupported}).
+* All five declare a `read` handler. For four of them CFn genuinely does accept
+* the IMPORT — unlike `AWS::Glue::Table`, the type issue #1659's title names,
+* which CFn rejects outright (see {@link typeIsImportUnsupported}). The fifth,
+* `AWS::AppSync::GraphQLApi`, is measured REFUSED despite its read handler
+* (see {@link CFN_IMPORT_REFUSED_DESPITE_REGISTRY}), so its row below is
+* reachable only under `--skip-import-support-preflight`.
 */
 const COMPOSITE_PHYSICAL_ID_IDENTIFIERS = {
+	"AWS::AppSync::GraphQLApi": recordedArnIdentifier({
+		resourceType: "AWS::AppSync::GraphQLApi",
+		field: "Arn",
+		physicalIdShape: "<apiId>",
+		arnServiceSegment: "appsync",
+		physicalIdIsIdentifierFor: ["ApiId"]
+	}),
 	"AWS::AppSync::DataSource": recordedArnIdentifier({
 		resourceType: "AWS::AppSync::DataSource",
 		field: "DataSourceArn",
@@ -76433,7 +76686,7 @@ function maskedIdentifierAttributeReason(field, logicalId) {
 * and the remedy is the one that doc already gives.
 */
 function recordedArnIdentifier(options) {
-	const { resourceType, field, physicalIdShape, arnServiceSegment } = options;
+	const { resourceType, field, physicalIdShape, arnServiceSegment, physicalIdIsIdentifierFor } = options;
 	/**
 	* Is this value usable AS the type's CFn identifier?
 	*
@@ -76450,12 +76703,14 @@ function recordedArnIdentifier(options) {
 	};
 	return {
 		field,
+		...physicalIdIsIdentifierFor && { physicalIdIsIdentifierFor },
 		resolve: ({ logicalId, physicalId, attributes }) => {
 			const recorded = attributes[field];
 			if (typeof recorded === "string" && isUsableIdentifier(recorded)) return recorded.trim();
 			if (isUsableIdentifier(physicalId)) return physicalId.trim();
 			const recordedNote = typeof recorded === "string" && recorded.trim() ? `attributes.${field} is recorded as '${recorded.trim()}', which is not a ${arnServiceSegment} ARN` : `attributes.${field} is missing or empty`;
-			throw new Error(`cdkd's physical id for ${resourceType} is the composite '${physicalIdShape}', but CloudFormation IMPORT identifies the resource by its ${field}, which cdkd state does not record usably for '${logicalId}' (${recordedNote}). Re-deploy the stack once so cdkd records ${field}, then re-run cdkd export.`);
+			const shapeWord = physicalIdShape.includes("|") ? "the composite" : "the bare";
+			throw new Error(`cdkd's physical id for ${resourceType} is ${shapeWord} '${physicalIdShape}', but CloudFormation IMPORT identifies the resource by its ${field}, which cdkd state does not record usably for '${logicalId}' (${recordedNote}). Re-deploy the stack once so cdkd records ${field}, then re-run cdkd export.`);
 		}
 	};
 }
@@ -77333,6 +77588,15 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 		}
 		let resolved;
 		try {
+			const measuredRefusal = cfnRefusesImportDespiteRegistry(resourceType);
+			if (!options.skipImportSupportPreflight && measuredRefusal !== void 0) {
+				blocked.push({
+					logicalId,
+					resourceType,
+					reason: `AWS CloudFormation does not support ${resourceType} in IMPORT changesets, ${measuredRefusal}. Its registry schema passes cdkd's read-handler pre-flight, so without this list CreateChangeSet would reject the whole export with "ResourceTypes [${resourceType}] are not supported for Import" after the stack was locked. Remove the resource from the stack before exporting (it stays in AWS and can be re-declared in CloudFormation afterwards), or destroy it first and let CloudFormation create it fresh. If AWS has since added IMPORT support for this type, re-run with --skip-import-support-preflight and please open a cdkd issue.`
+				});
+				continue;
+			}
 			const schemaInfo = await cachedTypeSchemaInfo(resourceType, cfnClient, identifierCache);
 			if (!options.skipImportSupportPreflight && typeIsImportUnsupported(schemaInfo)) {
 				blocked.push({
@@ -77438,7 +77702,8 @@ function groupBlockedReasons(blocked) {
 * IMPORT pre-flight and this resolution.
 */
 async function resolveResourceIdentifier(resourceType, logicalId, physicalId, properties, attributes, entry, backfillDeps) {
-	const compositeIdentifier = Object.hasOwn(COMPOSITE_PHYSICAL_ID_IDENTIFIERS, resourceType) ? COMPOSITE_PHYSICAL_ID_IDENTIFIERS[resourceType] : void 0;
+	const registered = Object.hasOwn(COMPOSITE_PHYSICAL_ID_IDENTIFIERS, resourceType) ? COMPOSITE_PHYSICAL_ID_IDENTIFIERS[resourceType] : void 0;
+	const compositeIdentifier = registered && entry.fields.length === 1 && registered.physicalIdIsIdentifierFor?.includes(entry.fields[0]) && !physicalId.trim().startsWith("arn:") ? void 0 : registered;
 	if (compositeIdentifier) {
 		if (entry.fields.length !== 1 || entry.fields[0] !== compositeIdentifier.field) throw new Error(`${resourceType} is registered in COMPOSITE_PHYSICAL_ID_IDENTIFIERS as identified by '${compositeIdentifier.field}', but CloudFormation now reports primaryIdentifier [${entry.fields.join(", ")}]. The registry schema changed under cdkd — update the entry in src/cli/commands/export.ts (or move the type to COMPOSITE_ID_SPLITTERS if its identifier is now composite too)`);
 		const value = await resolveIdentifierValue(compositeIdentifier, {
@@ -77492,6 +77757,14 @@ async function cachedTypeSchemaInfo(resourceType, cfnClient, cache) {
 * legacy types) and a `handlers` block whose keys are only create / update /
 * delete (`AWS::EC2::NetworkAclEntry`).
 *
+* That list is a MEASUREMENT, not a contract, and AWS moves types off it:
+* `AWS::AppSync::ApiKey` was re-published `FULLY_MUTABLE` with a full handler
+* set by 2026-09-18 (issue #3414), so it now passes this pre-flight and is
+* resolved by its `COMPOSITE_ID_SPLITTERS` entry instead. The refusal reads
+* the LIVE response, so such a move needs no edit here — only the resolution
+* that the refusal used to shadow. `AWS::AppSync::GraphQLSchema` is still on
+* the list as of that date (no `handlers` block, `NON_PROVISIONABLE`).
+*
 * **Why the verdict needs TWO agreeing fields.** Reading "the `handlers` key is
 * missing" as a refusal on its own makes any partial or unusual response block
 * an export that works today — the one regression this pre-flight could cause,
@@ -77511,6 +77784,35 @@ function typeIsImportUnsupported(entry) {
 	return entry.importSupport === "unsupported";
 }
 /**
+* Types CloudFormation REFUSES in an IMPORT changeset although their registry
+* schema passes {@link typeIsImportUnsupported} — a `read` handler declared,
+* `ProvisioningType: FULLY_MUTABLE` — so the registry heuristic lets them
+* through and `CreateChangeSet` answers `ResourceTypes [<T>] are not
+* supported for Import` after the lock, the prompt and the template
+* preprocessing have already happened. The heuristic is NECESSARY (a type
+* with no read handler is never importable) but the 2026-09-18 measurement
+* showed it is not SUFFICIENT: AWS's supported-for-import list is a separate
+* fact the registry does not carry.
+*
+* Each entry is a dated measurement, and the map is the `blocked` message's
+* evidence. `--skip-import-support-preflight` bypasses this set together with
+* the heuristic, for the same reason it exists there: AWS may add support
+* without cdkd noticing, and the changeset is then the authority.
+*
+* | Type | measured |
+* |---|---|
+* | `AWS::AppSync::GraphQLApi` | us-east-1, 2026-09-18, the `export` integ fixture: registry `[read, create, update, delete, list]` / `FULLY_MUTABLE` / identifier `Arn`; `CreateChangeSet --change-set-type IMPORT` carrying the API (resolved to its ARN) rejected with `ResourceTypes [AWS::AppSync::GraphQLApi] are not supported for Import`. `AWS::AppSync::ApiKey` is NOT here: a standalone IMPORT changeset carrying one key with `{ApiId, ApiKeyId}` reached `CREATE_COMPLETE` the same day. (issue #3414) |
+*/
+const CFN_IMPORT_REFUSED_DESPITE_REGISTRY = /* @__PURE__ */ new Map([["AWS::AppSync::GraphQLApi", "measured in us-east-1 on 2026-09-18: the registry schema declares a read handler and FULLY_MUTABLE, yet CreateChangeSet --change-set-type IMPORT rejected the type"]]);
+/**
+* The dated measurement behind a {@link CFN_IMPORT_REFUSED_DESPITE_REGISTRY}
+* entry, or `undefined` when CloudFormation has not been measured refusing the
+* type. Exported for unit tests.
+*/
+function cfnRefusesImportDespiteRegistry(resourceType) {
+	return CFN_IMPORT_REFUSED_DESPITE_REGISTRY.get(resourceType);
+}
+/**
 * Fetch the primary identifier field names for a resource type, with a
 * hardcoded single-key fallback when DescribeType is unavailable.
 */
@@ -79043,7 +79345,7 @@ async function confirmPrompt$3(prompt) {
 	return confirmOrRefuse(prompt, { refusal: "The cdkd export confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm, or run the command from a real terminal." });
 }
 function createExportCommand() {
-	const cmd = new Command("export").description("Hand a cdkd-managed stack over to CloudFormation via CFn IMPORT (changeset). AWS resources are unchanged; cdkd state for the stack is deleted on success. Mirror of `cdkd import` (AWS → cdkd) in the reverse direction (cdkd → CFn). Accepts JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Aborts if any resource is not CFn-importable.").argument("[stack]", "Stack name to export (auto-detected for single-stack apps)").option("--cfn-stack-name <name>", "Name of the destination CloudFormation stack for the root stack. Defaults to the cdkd stack name (or the cdkd2cfnStackName mapping when the name contains '~'). For per-nested-child overrides, use --cfn-child-stack-name.").option("--cfn-child-stack-name <pair...>", "Per-nested-child CFn stack-name override. Repeatable. Format: '<cdkdName>=<cfnName>' (e.g. --cfn-child-stack-name 'MyApp~Database=my-app-db'). The cdkd stack name for a nested child is '<parent>~<childLogicalId>' (v6 state-key form). Without an override the CFn name is derived by replacing '~' with '-'. Only consulted when the exported stack tree contains nested children; ignored for flat stacks.").option("--template <path>", "Path to a pre-rendered CloudFormation template (JSON or YAML — format auto-detected). Skips synth.").option("--stack-region <region>", "Region of the cdkd state record to operate on. Required when the same stack name has state in multiple regions.", parseStackRegion).option("--dry-run", "Print the import plan without creating a changeset.", false).option("--accept-transient-context", "Allow CLI -c key=value overrides at export time even though they are not persisted to cdk.json / cdk.context.json (default: refuse). When set, the user is responsible for passing the same -c flags to every future cdk deploy.", false).option("--include-non-importable", "Run a 2-phase migration when the stack contains non-importable resources (Custom::*). Phase 1 imports the importable resources; phase 2 CFn-CREATEs the non-importable ones, which re-invokes each Custom Resource's onCreate handler. Make sure onCreate is idempotent before enabling.", false).option("--parameter <key=value...>", "CFn template Parameter override, repeatable. Required when the synthesized template has Parameters without Default values; otherwise overrides the template's default value. Format: --parameter Key=Value.").option("--strict-cross-stack", "Refuse to export when sibling cdkd stacks in the same CDK app reference the exporting stack via Fn::GetStackOutput. Without the flag, cdkd warns and proceeds — the consumers keep resolving via the CloudFormation fallback (weak reference) unless they deploy with --no-cfn-fallback.", false).option("--skip-import-support-preflight", "Skip the pre-flight that refuses resource types whose CloudFormation registry schema says CFn cannot IMPORT them (no read handler AND NON_PROVISIONABLE), and let CreateChangeSet answer instead. The pre-flight is a registry HEURISTIC, not AWS's supported-for-import list, so this is the escape hatch for a type AWS has since made importable. Expect the changeset to be rejected if the heuristic was right.", false).option("--no-recreate-import-unsupported", "Block instead of auto-handling resource types AWS does NOT support in IMPORT changesets (AWS::ApiGatewayV2::Stage and AWS::IAM::Policy). Default behavior: cdkd skips these from phase 1, deletes the AWS-side resource between phases, and lets CFn re-CREATE in phase 2 (brief unavailability window). With this flag, the export aborts with a clear error instead.").action(withErrorHandling(exportCommand));
+	const cmd = new Command("export").description("Hand a cdkd-managed stack over to CloudFormation via CFn IMPORT (changeset). AWS resources are unchanged; cdkd state for the stack is deleted on success. Mirror of `cdkd import` (AWS → cdkd) in the reverse direction (cdkd → CFn). Accepts JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Aborts if any resource is not CFn-importable.").argument("[stack]", "Stack name to export (auto-detected for single-stack apps)").option("--cfn-stack-name <name>", "Name of the destination CloudFormation stack for the root stack. Defaults to the cdkd stack name (or the cdkd2cfnStackName mapping when the name contains '~'). For per-nested-child overrides, use --cfn-child-stack-name.").option("--cfn-child-stack-name <pair...>", "Per-nested-child CFn stack-name override. Repeatable. Format: '<cdkdName>=<cfnName>' (e.g. --cfn-child-stack-name 'MyApp~Database=my-app-db'). The cdkd stack name for a nested child is '<parent>~<childLogicalId>' (v6 state-key form). Without an override the CFn name is derived by replacing '~' with '-'. Only consulted when the exported stack tree contains nested children; ignored for flat stacks.").option("--template <path>", "Path to a pre-rendered CloudFormation template (JSON or YAML — format auto-detected). Skips synth.").option("--stack-region <region>", "Region of the cdkd state record to operate on. Required when the same stack name has state in multiple regions.", parseStackRegion).option("--dry-run", "Print the import plan without creating a changeset.", false).option("--accept-transient-context", "Allow CLI -c key=value overrides at export time even though they are not persisted to cdk.json / cdk.context.json (default: refuse). When set, the user is responsible for passing the same -c flags to every future cdk deploy.", false).option("--include-non-importable", "Run a 2-phase migration when the stack contains non-importable resources (Custom::*). Phase 1 imports the importable resources; phase 2 CFn-CREATEs the non-importable ones, which re-invokes each Custom Resource's onCreate handler. Make sure onCreate is idempotent before enabling.", false).option("--parameter <key=value...>", "CFn template Parameter override, repeatable. Required when the synthesized template has Parameters without Default values; otherwise overrides the template's default value. Format: --parameter Key=Value.").option("--strict-cross-stack", "Refuse to export when sibling cdkd stacks in the same CDK app reference the exporting stack via Fn::GetStackOutput. Without the flag, cdkd warns and proceeds — the consumers keep resolving via the CloudFormation fallback (weak reference) unless they deploy with --no-cfn-fallback.", false).option("--skip-import-support-preflight", "Skip the pre-flight that refuses resource types whose CloudFormation registry schema says CFn cannot IMPORT them (no read handler AND NON_PROVISIONABLE), AND cdkd's short list of types measured refused by CreateChangeSet despite their registry schema (AWS::AppSync::GraphQLApi), and let CreateChangeSet answer instead. Neither check is AWS's supported-for-import list, so this is the escape hatch for a type AWS has since made importable. Expect the changeset to be rejected if the check was right.", false).option("--no-recreate-import-unsupported", "Block instead of auto-handling resource types AWS does NOT support in IMPORT changesets (AWS::ApiGatewayV2::Stage and AWS::IAM::Policy). Default behavior: cdkd skips these from phase 1, deletes the AWS-side resource between phases, and lets CFn re-CREATE in phase 2 (brief unavailability window). With this flag, the export aborts with a clear error instead.").action(withErrorHandling(exportCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -80176,11 +80478,12 @@ async function stateOrphanCommand(stackArgs, options) {
 			if (!options.force) {
 				for (const target of targets) if (await setup.lockManager.isLocked(stackName, target.region)) {
 					const where = target.region ? displaySafe(target.region, { asciiOnly: true }) || "<unrenderable>" : "legacy";
-					throw new Error(`Stack '${displaySafe(stackName, { asciiOnly: true })}' (${where}) is locked. Run: ${buildForceUnlockCommand(stackName, target.region, {
+					const recoveryCommand = buildForceUnlockCommand(stackName, target.region, {
 						profile: options.profile,
 						stateBucket: setup.bucket,
 						statePrefix: options.statePrefix
-					}) || "a command cdkd cannot show safely: the recorded name or region would not survive a command line intact, so inspect the lock object directly"} first, or pass --force to remove anyway.`);
+					});
+					throw new Error(`Stack '${displaySafe(stackName, { asciiOnly: true })}' (${where}) is locked. ` + (recoveryCommand ? `Run: ${recoveryCommand} first, or pass --force to remove anyway.` : `${UNREPRODUCIBLE_LOCK_CLAUSE} Or pass --force to remove anyway.`));
 				}
 			}
 			if (!options.yes && !options.force) {
@@ -88249,11 +88552,11 @@ async function pullEcrImage(imageUri, options) {
 		const cached = ASSUMED_ROLE_CACHE.get(cacheKey);
 		if (cached && isCredentialFresh(cached)) {
 			assumed = cached;
-			logger.debug(`Reusing cached AssumeRole credentials for ${options.ecrRoleArn}`);
+			logger.debug(`Reusing cached AssumeRole credentials for ${displayIdent(options.ecrRoleArn, { maxCodePoints: 612 })}`);
 		} else {
 			assumed = await assumeRoleForEcr(options.ecrRoleArn, callerRegion, logger);
 			ASSUMED_ROLE_CACHE.set(cacheKey, assumed);
-			logger.info(`Assumed role ${options.ecrRoleArn} for ECR pull (account=${parsed.accountId}, region=${parsed.region})`);
+			logger.info(`Assumed role ${displayIdent(options.ecrRoleArn, { maxCodePoints: 612 })} for ECR pull (account=${parsed.accountId}, region=${parsed.region})`);
 		}
 	} else if (crossAccount) logger.info(`Cross-account ECR pull: image account ${parsed.accountId} != caller ${callerAccount}. Using the caller's credentials; pass --ecr-role-arn <arn> if AWS rejects with AccessDenied.`);
 	if (crossRegion) logger.info(`Cross-region ECR pull: image region ${parsed.region} != caller ${callerRegion ?? "(unset)"}. Authenticating against the image region directly.`);
@@ -88284,7 +88587,7 @@ async function pullEcrImage(imageUri, options) {
 * mirrors the convention used by `src/utils/role-arn.ts`.
 */
 async function assumeRoleForEcr(roleArn, callerRegion, logger) {
-	logger.debug(`Assuming role ${roleArn} for ECR pull...`);
+	logger.debug(`Assuming role ${displayIdent(roleArn, { maxCodePoints: 612 })} for ECR pull...`);
 	const sts = new STSClient({
 		...awsClientDefaults(),
 		...callerRegion && { region: callerRegion }
@@ -88295,7 +88598,7 @@ async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 			RoleSessionName: `cdkd-local-ecr-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds || !creds.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new LocalInvokeBuildError$1(`AssumeRole(${roleArn}) returned no usable credentials. Verify the role's trust policy allows your identity to assume it.`);
+		if (!creds || !creds.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new LocalInvokeBuildError$1(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials. Verify the role's trust policy allows your identity to assume it.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -88305,7 +88608,7 @@ async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 	} catch (err) {
 		if (err instanceof LocalInvokeBuildError$1) throw err;
 		const reason = err instanceof Error ? err.message : String(err);
-		throw new LocalInvokeBuildError$1(`Failed to assume role ${roleArn} for ECR pull: ${reason}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
+		throw new LocalInvokeBuildError$1(`Failed to assume role ${displayIdent(roleArn, { maxCodePoints: 612 })} for ECR pull: ${displaySafe(reason)}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
 	} finally {
 		sts.destroy();
 	}
@@ -88623,7 +88926,7 @@ const CONTAINER_AWS_CREDENTIALS_PATH = "/cdkd-aws/credentials";
 */
 async function writeProfileCredentialsFile(profileName, creds) {
 	if (profileName === "") throw new Error("writeProfileCredentialsFile: profile name must not be empty.");
-	if (/[\r\n[\]]/.test(profileName)) throw new Error(`writeProfileCredentialsFile: profile name '${profileName}' contains a forbidden character (any of CR, LF, '[', ']' would corrupt the INI file or the docker -e env var).`);
+	if (/[\r\n[\]]/.test(profileName)) throw new Error(`writeProfileCredentialsFile: profile name ${displayIdent(profileName)} contains a forbidden character (any of CR, LF, '[', ']' would corrupt the INI file or the docker -e env var).`);
 	const dir = await mkdtemp(path.join(tmpdir(), "cdkd-profile-creds-"));
 	const hostPath = path.join(dir, "credentials");
 	const lines = [
@@ -88632,7 +88935,15 @@ async function writeProfileCredentialsFile(profileName, creds) {
 		`aws_secret_access_key = ${creds.secretAccessKey}`
 	];
 	if (creds.sessionToken) lines.push(`aws_session_token = ${creds.sessionToken}`);
-	await writeFile(hostPath, lines.join("\n") + "\n", { mode: 384 });
+	try {
+		await writeFile(hostPath, lines.join("\n") + "\n", { mode: 384 });
+	} catch (err) {
+		await rm(dir, {
+			recursive: true,
+			force: true
+		}).catch(() => {});
+		throw err;
+	}
 	return {
 		hostPath,
 		containerPath: CONTAINER_AWS_CREDENTIALS_PATH,
@@ -90645,7 +90956,11 @@ async function resolveProfileCredentials(profile) {
 	try {
 		const credsProvider = sts.config.credentials;
 		const creds = typeof credsProvider === "function" ? await credsProvider() : credsProvider;
-		if (!creds || !creds.accessKeyId || !creds.secretAccessKey) throw new Error(`--profile '${profile}': credential provider chain resolved without usable credentials. Check \`aws sso login --profile ` + profile + "` for SSO profiles, or `~/.aws/credentials` / `~/.aws/config` for regular profiles.");
+		if (!creds || !creds.accessKeyId || !creds.secretAccessKey) {
+			const shownProfile = displayIdent(profile);
+			const ssoHint = isPasteableIdent(profile) ? "run `aws sso login --profile " + profile + "`" : "run `aws sso login` for that profile -- cdkd is not writing the command out, because it cannot vouch that the name as rendered is the one your shell would act on";
+			throw new Error(`--profile ${shownProfile}: credential provider chain resolved without usable credentials. For SSO profiles, ${ssoHint}. For regular profiles, check \`~/.aws/credentials\` / \`~/.aws/config\`.`);
+		}
 		return {
 			accessKeyId: creds.accessKeyId,
 			secretAccessKey: creds.secretAccessKey,
@@ -90672,7 +90987,7 @@ async function assumeLambdaExecutionRole$1(roleArn, region) {
 			RoleSessionName: `cdkd-local-start-api-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${roleArn}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -91234,7 +91549,7 @@ async function resolveEcsSecrets(entries, options = {}) {
 	try {
 		return await Promise.all(entries.map(async (entry) => {
 			const value = await resolveOne(entry, secretsClient, ssmClient);
-			logger.debug(`Resolved secret ${entry.containerName}.${entry.name} (${entry.valueFrom})`);
+			logger.debug(`Resolved secret ${displayIdent(entry.containerName)}.${displayIdent(entry.name)} (${displayIdent(entry.valueFrom, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })})`);
 			return {
 				...entry,
 				value
@@ -91251,7 +91566,7 @@ async function resolveOne(entry, secretsClient, ssmClient) {
 	switch (shape.kind) {
 		case "secrets-manager": return resolveSecretsManager(entry, shape, secretsClient);
 		case "ssm": return resolveSsm(entry, shape, ssmClient);
-		case "unknown": throw new EcsSecretsResolutionError(`Container '${entry.containerName}' secret '${entry.name}' references an unsupported ValueFrom shape '${arn}'. Expected Secrets Manager ARN (optionally with :<json-key>::) or SSM Parameter ARN.`);
+		case "unknown": throw new EcsSecretsResolutionError(`Container '${displayIdent(entry.containerName)}' secret '${displayIdent(entry.name)}' references an unsupported ValueFrom shape ${displayIdent(arn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}. Expected Secrets Manager ARN (optionally with :<json-key>::) or SSM Parameter ARN.`);
 	}
 }
 /**
@@ -91284,20 +91599,20 @@ async function resolveSecretsManager(entry, shape, client) {
 	try {
 		secretString = (await client.send(new GetSecretValueCommand({ SecretId: shape.baseArn }))).SecretString;
 	} catch (err) {
-		throw new EcsSecretsResolutionError(`Failed to resolve Secrets Manager secret for container '${entry.containerName}' / env '${entry.name}' (${shape.baseArn}): ${err instanceof Error ? err.message : String(err)}`);
+		throw new EcsSecretsResolutionError(`Failed to resolve Secrets Manager secret for container '${displayIdent(entry.containerName)}' / env '${displayIdent(entry.name)}' (${displayIdent(shape.baseArn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}): ${displaySafe(err instanceof Error ? err.message : String(err))}`);
 	}
-	if (secretString === void 0) throw new EcsSecretsResolutionError(`Secrets Manager returned no SecretString for container '${entry.containerName}' / env '${entry.name}' (${shape.baseArn}). Binary secrets are not supported.`);
+	if (secretString === void 0) throw new EcsSecretsResolutionError(`Secrets Manager returned no SecretString for container '${displayIdent(entry.containerName)}' / env '${displayIdent(entry.name)}' (${displayIdent(shape.baseArn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}). Binary secrets are not supported.`);
 	if (shape.jsonKey === void 0) return secretString;
 	let parsed;
 	try {
 		parsed = JSON.parse(secretString);
 	} catch (err) {
 		const kind = err instanceof Error ? err.name : "unknown";
-		throw new EcsSecretsResolutionError(`Container '${entry.containerName}' secret '${entry.name}' specified json-key '${shape.jsonKey}' but the secret value is not valid JSON (${kind}). The parser detail is withheld because it would echo the secret plaintext.`);
+		throw new EcsSecretsResolutionError(`Container '${displayIdent(entry.containerName)}' secret '${displayIdent(entry.name)}' specified json-key '${displaySafe(shape.jsonKey)}' but the secret value is not valid JSON (${displayIdent(kind)}). The parser detail is withheld because it would echo the secret plaintext.`);
 	}
-	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new EcsSecretsResolutionError(`Container '${entry.containerName}' secret '${entry.name}' specified json-key '${shape.jsonKey}' but the secret root is not a JSON object.`);
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new EcsSecretsResolutionError(`Container '${displayIdent(entry.containerName)}' secret '${displayIdent(entry.name)}' specified json-key '${displaySafe(shape.jsonKey)}' but the secret root is not a JSON object.`);
 	const value = parsed[shape.jsonKey];
-	if (value === void 0) throw new EcsSecretsResolutionError(`Container '${entry.containerName}' secret '${entry.name}' specified json-key '${shape.jsonKey}' but no such key exists in the secret JSON.`);
+	if (value === void 0) throw new EcsSecretsResolutionError(`Container '${displayIdent(entry.containerName)}' secret '${displayIdent(entry.name)}' specified json-key '${displaySafe(shape.jsonKey)}' but no such key exists in the secret JSON.`);
 	return typeof value === "string" ? value : JSON.stringify(value);
 }
 async function resolveSsm(entry, shape, client) {
@@ -91306,11 +91621,11 @@ async function resolveSsm(entry, shape, client) {
 			Name: shape.name,
 			WithDecryption: true
 		}))).Parameter?.Value;
-		if (value === void 0) throw new EcsSecretsResolutionError(`SSM parameter '${shape.name}' returned no Value for container '${entry.containerName}' / env '${entry.name}'.`);
+		if (value === void 0) throw new EcsSecretsResolutionError(`SSM parameter '${displayIdent(shape.name, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}' returned no Value for container '${displayIdent(entry.containerName)}' / env '${displayIdent(entry.name)}'.`);
 		return value;
 	} catch (err) {
 		if (err instanceof EcsSecretsResolutionError) throw err;
-		throw new EcsSecretsResolutionError(`Failed to resolve SSM parameter for container '${entry.containerName}' / env '${entry.name}' (${shape.name}): ${err instanceof Error ? err.message : String(err)}`);
+		throw new EcsSecretsResolutionError(`Failed to resolve SSM parameter for container '${displayIdent(entry.containerName)}' / env '${displayIdent(entry.name)}' (${displayIdent(shape.name, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}): ${displaySafe(err instanceof Error ? err.message : String(err))}`);
 	}
 }
 
@@ -91914,8 +92229,9 @@ async function localRunTaskCommand(target, options) {
 	const state = createEcsRunState();
 	let sigintHandler;
 	let sigintCount = 0;
+	let detachedSuccessfully = false;
 	let stateProvider;
-	let profileCredsFile;
+	let channels;
 	let cleanupPromise;
 	const cleanup = async () => {
 		if (!cleanupPromise) cleanupPromise = (async () => {
@@ -91924,10 +92240,10 @@ async function localRunTaskCommand(target, options) {
 			} catch (err) {
 				getLogger().debug(`cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
 			}
-			if (profileCredsFile) try {
-				await profileCredsFile.dispose();
+			if (channels?.profileCredsFile) try {
+				await channels.profileCredsFile.dispose();
 			} catch (err) {
-				getLogger().debug(`Failed to remove profile credentials tmpdir ${profileCredsFile.hostPath}: ${err instanceof Error ? err.message : String(err)}`);
+				getLogger().debug(`Failed to remove profile credentials tmpdir ${channels.profileCredsFile.hostPath}: ${err instanceof Error ? err.message : String(err)}`);
 			}
 		})();
 		await cleanupPromise;
@@ -91993,33 +92309,20 @@ async function localRunTaskCommand(target, options) {
 			resolvedRoleArn = options.assumeTaskRole;
 			assumedCredentials = await assumeTaskRole(resolvedRoleArn, options.region);
 		}
-		const sidecarCredentials = await resolveSidecarCredentials(options, assumedCredentials);
-		if (options.profile && sidecarCredentials && !assumedCredentials) profileCredsFile = await writeProfileCredentialsFile(options.profile, sidecarCredentials);
+		channels = await resolveTaskCredentialChannels(options, assumedCredentials);
 		const envOverrides = readEnvOverridesFile$2(options.envVars);
-		const runOpts = {
-			cluster: options.cluster,
-			containerHost: options.containerHost,
-			skipPull: options.pull === false,
-			keepRunning: options.keepRunning,
-			detach: options.detach
-		};
-		if (envOverrides) runOpts.envOverrides = envOverrides;
-		if (sidecarCredentials) runOpts.taskCredentials = sidecarCredentials;
-		if (resolvedRoleArn) runOpts.taskRoleArn = resolvedRoleArn;
-		if (options.platform) runOpts.platformOverride = options.platform;
-		if (options.region) runOpts.region = options.region;
-		if (options.ecrRoleArn) runOpts.ecrRoleArn = options.ecrRoleArn;
-		if (profileCredsFile) runOpts.profileCredentialsFile = {
-			hostPath: profileCredsFile.hostPath,
-			containerPath: profileCredsFile.containerPath,
-			profileName: profileCredsFile.profileName
-		};
+		const runOpts = buildRunEcsTaskOptions(options, channels, {
+			...envOverrides !== void 0 && { envOverrides },
+			...resolvedRoleArn !== void 0 && { resolvedRoleArn }
+		});
 		const hostGatewayExtraHosts = await resolveHostGatewayExtraHosts();
 		if (hostGatewayExtraHosts.length > 0) runOpts.hostGatewayExtraHosts = hostGatewayExtraHosts;
 		const result = await runEcsTask(task, runOpts, state);
 		if (options.detach) {
 			logger.info("Task containers started in detached mode; cdkd is exiting.");
 			logger.info(`Use 'docker ps -a --filter network=${result.state.network?.networkName ?? "<network>"}' to inspect; tear down with 'docker rm -f' and 'docker network rm'.`);
+			if (channels.profileCredsFile) logger.info(`The AWS credentials file mounted into the containers is NOT removed in detached mode: delete ${displayIdent(channels.profileCredsFile.hostPath)} once you tear them down.`);
+			detachedSuccessfully = true;
 			sigintCount = 99;
 			return;
 		}
@@ -92028,7 +92331,7 @@ async function localRunTaskCommand(target, options) {
 	} finally {
 		if (sigintHandler) process.off("SIGINT", sigintHandler);
 		if (stateProvider) stateProvider.dispose();
-		if (!options.detach) await cleanup();
+		if (!detachedSuccessfully) await cleanup();
 	}
 }
 /**
@@ -92047,7 +92350,7 @@ async function resolvePlaceholderAccount(arn, region) {
 	});
 	try {
 		const account = (await sts.send(new GetCallerIdentityCommand({}))).Account;
-		if (!account) throw new Error(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN '${arn}'. Pass the ARN explicitly: --assume-task-role <arn>`);
+		if (!account) throw new Error(`--assume-task-role: GetCallerIdentity returned no Account; cannot resolve placeholder ARN ${displayIdent(arn, { maxCodePoints: 612 })}. Pass the ARN explicitly: --assume-task-role <arn>`);
 		return arn.split(TASK_ROLE_ACCOUNT_PLACEHOLDER).join(account);
 	} finally {
 		sts.destroy();
@@ -92069,7 +92372,7 @@ async function assumeTaskRole(roleArn, region) {
 			RoleSessionName: `cdkd-local-run-task-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${roleArn}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -92256,6 +92559,106 @@ async function resolveSidecarCredentials(options, assumedCredentials) {
 	if (assumedCredentials) return assumedCredentials;
 	if (options.profile) return resolveProfileCredentials(options.profile);
 }
+/**
+* Resolve BOTH credential channels a locally-run ECS task receives, and decide
+* whether the second one exists at all.
+*
+* 1. `sidecarCredentials` — what the AWS-published
+*    `amazon-ecs-local-container-endpoints` sidecar serves at
+*    `169.254.170.2/role/<role>`; {@link resolveSidecarCredentials} owns the
+*    precedence (issue #658).
+* 2. `profileCredsFile` — the ECS analogue of PR #670 (Lambda-container
+*    fix-back finding #1). When `--profile <p>` is set AND `--assume-task-role`
+*    did NOT produce credentials for this task, a host-side AWS shared
+*    credentials file is written under `[<options.profile>]` and bind-mounted
+*    read-only into every user container, so handler code calling
+*    `fromIni({ profile: '<options.profile>' })` resolves to the same creds the
+*    sidecar serves. Without it the SDK looks for `[<options.profile>]` in
+*    `~/.aws/credentials` INSIDE the container and fails.
+*
+*    Gating on `!assumedCredentials` preserves the documented precedence
+*    (assume-task-role > profile-file > sidecar): when `--assume-task-role`
+*    won, the sidecar's `/role/<arn>` endpoint already serves the assumed creds
+*    and the file's env vars must NOT override them.
+*
+* ONE helper rather than two, and that is the substance of issue
+* go-to-k/cdkd#3378 rather than a tidying choice. Both of these lived inline in
+* `localRunTaskCommand`'s body, which meant the gate's annotation below was
+* fenced only for EXISTING (`local-surface-env-identity.test.ts` checks that an
+* annotation is there and carries a reason — it cannot check that the reason is
+* TRUE). And the reason is not a property of the `if` at all: it is a property
+* of the COMPOSITION, that `sidecarCredentials` on the `!assumedCredentials`
+* path can only have come from {@link resolveSidecarCredentials}'s `--profile`
+* arm. Extracting the three-line gate ALONE would have re-tested the same three
+* booleans and proved nothing; a test over this helper writes a real file and
+* can read the bytes back. `resolveSidecarCredentials`'s own doc already set
+* the precedent for the seam over a command-level harness — that harness would
+* have to mock the whole Synth + Docker + AWS pipeline, and a mock is exactly
+* what cannot answer "which identity's bytes landed in the file".
+*
+* cdkd-local-env-identity: the `!assumedCredentials` gate means
+* `resolveSidecarCredentials` reached its `--profile` arm, so this is
+* `resolveProfileCredentials` through
+* `awsClientDefaults({ ignoreAssumedRole: true })` — the caller's own chain,
+* never the `--role-arn` role — and never an `--assume-task-role` STS result,
+* which wins earlier and is served by the metadata sidecar instead.
+*/
+async function resolveTaskCredentialChannels(options, assumedCredentials) {
+	const sidecarCredentials = await resolveSidecarCredentials(options, assumedCredentials);
+	if (options.profile && sidecarCredentials && !assumedCredentials) return {
+		sidecarCredentials,
+		profileCredsFile: await writeProfileCredentialsFile(options.profile, sidecarCredentials)
+	};
+	return {
+		sidecarCredentials,
+		profileCredsFile: void 0
+	};
+}
+/**
+* Build the `RunEcsTaskOptions` bag from the options and the resolved credential
+* channels.
+*
+* Extracted for the WIRING, which is the half
+* {@link resolveTaskCredentialChannels} could not cover (go-to-k/cdkd#3390 round
+* 2, on go-to-k/cdkd#3394). That helper decides WHETHER a credentials file
+* exists and whose bytes are in it; this one decides whether the answer reaches
+* the runner at all. Between them sat a single assignment, and mutating it to
+* `undefined` left 114 tests green across five files: no file is bind-mounted,
+* so every handler calling `fromIni({ profile })` inside the task container
+* fails -- the exact defect PR go-to-k/cdkd#670 shipped this path to fix. "A
+* probed callee says nothing about its WIRING" is the rule, and this is the
+* seam that lets a unit test say something about it.
+*
+* PURE, and it takes the whole `channels` object rather than a pre-destructured
+* file so the test subject is the same value the resolver returns -- a helper
+* taking `profileCredsFile` alone would move the untested assignment rather
+* than remove it.
+*
+* The file is COPIED field by field rather than passed through: `dispose` stays
+* with the command, which owns the lifetime, and `RunEcsTaskOptions` deliberately
+* declares only the three fields the runner mounts with.
+*/
+function buildRunEcsTaskOptions(options, channels, extra = {}) {
+	const runOpts = {
+		cluster: options.cluster,
+		containerHost: options.containerHost,
+		skipPull: options.pull === false,
+		keepRunning: options.keepRunning,
+		detach: options.detach
+	};
+	if (extra.envOverrides) runOpts.envOverrides = extra.envOverrides;
+	if (channels.sidecarCredentials) runOpts.taskCredentials = channels.sidecarCredentials;
+	if (extra.resolvedRoleArn) runOpts.taskRoleArn = extra.resolvedRoleArn;
+	if (options.platform) runOpts.platformOverride = options.platform;
+	if (options.region) runOpts.region = options.region;
+	if (options.ecrRoleArn) runOpts.ecrRoleArn = options.ecrRoleArn;
+	if (channels.profileCredsFile) runOpts.profileCredentialsFile = {
+		hostPath: channels.profileCredsFile.hostPath,
+		containerPath: channels.profileCredsFile.containerPath,
+		profileName: channels.profileCredsFile.profileName
+	};
+	return runOpts;
+}
 function createLocalRunTaskCommand() {
 	const cmd = new Command("run-task").description("Run an AWS::ECS::TaskDefinition locally — pulls/builds images, sets up a per-task docker network with the AWS-published metadata-endpoints sidecar, and starts every container in dependsOn order. Target accepts a CDK display path (MyStack/MyService/TaskDef) or stack-qualified logical ID (MyStack:MyServiceTaskDefXYZ1234). Single-stack apps may omit the stack prefix.").argument("<target>", "CDK display path or stack-qualified logical ID of the AWS::ECS::TaskDefinition to run").addOption(new Option("--cluster <name>", "Cluster name surfaced to ECS_CONTAINER_METADATA_URI_V4 and used as the docker network prefix").default("cdkd-local")).addOption(new Option("--env-vars <file>", "JSON env-var overrides (SAM-compatible: {\"ContainerName\":{\"KEY\":\"VALUE\"}, \"Parameters\":{}})")).addOption(new Option("--container-host <ip>", "Host IP to bind published container ports to. Must be a numeric IP (Docker rejects hostnames here)").default("127.0.0.1")).addOption(new Option("--assume-task-role [arn]", "Assume the task definition's TaskRoleArn (or the supplied ARN) and forward STS-issued temp credentials via the metadata sidecar so containers run with the deployed function role. Bare flag uses the template's TaskRoleArn; pass an explicit ARN to override.")).addOption(new Option("--no-pull", "Skip docker pull for every container image and the metadata sidecar")).addOption(new Option("--ecr-role-arn <arn>", "Role ARN to assume before authenticating against ECR for cross-account / centralized registries (#455). Issues sts:AssumeRole via the default credential chain and uses the temporary credentials for ecr:GetAuthorizationToken + docker pull. Required when the caller does not have direct cross-account access to the target repository. A same-account pull in ANY region does not need this flag: the ECR client is built for the image URI's own region, so crossing a region costs nothing extra (issue #2536).")).addOption(new Option("--platform <platform>", "Force docker --platform (linux/amd64 or linux/arm64). Default: inferred from task RuntimePlatform.CpuArchitecture")).addOption(new Option("--keep-running", "Don't docker rm -f the user containers on task exit (network + sidecar are still torn down). Use when you want to docker exec into a stopped container for post-mortems.").default(false)).addOption(new Option("--detach", "Start the containers in the background and exit (skip log streaming + auto teardown). Useful in CI smoke tests; caller manages container lifecycle.").default(false)).addOption(new Option("--from-state", "Read cdkd S3 state for the target stack and substitute Fn::Sub / Fn::GetAtt references to same-stack AWS::ECR::Repository resources with the deployed URI. Off by default — only the AWS pseudo-parameter tier (${AWS::AccountId} / ${AWS::Region}) is resolved without this flag.").default(false)).addOption(new Option("--from-cfn-stack [cfn-stack-name]", "Read a deployed CloudFormation stack via ListStackResources and substitute Ref / Fn::ImportValue in container env vars / secrets / image URIs with the deployed physical IDs / exports. Use for CDK apps deployed via the upstream CDK CLI (`cdk deploy`). Bare form uses the cdkd stack name; pass an explicit value when the CFn stack name differs. Mutually exclusive with --from-state. Fn::GetAtt is warn-and-dropped in v1 (CFn ListStackResources does not return per-attribute values).")).addOption(new Option("--stack-region <region>", "Region of the state record to read. Used with --from-state when the same stack name has state in multiple regions, and with --from-cfn-stack as the CFn client region (cdkd does not have a separate --cfn-stack-region flag).").argParser(parseStackRegion)).action(withErrorHandling(localRunTaskCommand));
 	[
@@ -93126,7 +93529,13 @@ async function resolveHostCredentialsForSigV4(options, resolved, loaded, region)
 	if (assumeRoleArn) try {
 		return await assumeAgentCoreExecutionRole(assumeRoleArn, region);
 	} catch (err) {
-		logger.warn(`--assume-role: STS AssumeRole(${assumeRoleArn}) failed for --sigv4 signing: ${err instanceof Error ? err.message : String(err)}. Falling back to ${options.profile ? `--profile ${options.profile}` : "shell credentials"}.`);
+		logger.warn(assumeRoleFallbackWarning({
+			assumeRoleArn,
+			purpose: "--sigv4 signing",
+			error: err,
+			profile: options.profile,
+			fallbackWithoutProfile: "shell credentials"
+		}));
 	}
 	if (options.profile) {
 		const creds = await resolveProfileCredentials(options.profile);
@@ -93241,7 +93650,13 @@ async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options
 	if (assumeRoleArn) try {
 		credentials = await assumeAgentCoreExecutionRole(assumeRoleArn, region);
 	} catch (err) {
-		logger.warn(`--assume-role: STS AssumeRole(${assumeRoleArn}) failed for the fromS3 bundle download: ${err instanceof Error ? err.message : String(err)}. Falling back to ${options.profile ? `--profile ${options.profile}` : "the default credentials"}.`);
+		logger.warn(assumeRoleFallbackWarning({
+			assumeRoleArn,
+			purpose: "the fromS3 bundle download",
+			error: err,
+			profile: options.profile,
+			fallbackWithoutProfile: "the default credentials"
+		}));
 	}
 	const bundle = await downloadAndExtractS3Bundle(location, {
 		...region !== void 0 && { region },
@@ -93439,7 +93854,7 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 			if (stsRegion) dockerEnv["AWS_REGION"] = stsRegion;
 			assumeSucceeded = true;
 		} catch (err) {
-			logger.warn(`--assume-role: STS AssumeRole(${args.assumeRoleArn}) failed: ${err instanceof Error ? err.message : String(err)}. Falling back to the developer's shell credentials.`);
+			logger.warn(`--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 612 })}) failed: ${displaySafe(err instanceof Error ? err.message : String(err))}. Falling back to the developer's shell credentials.`);
 		}
 	}
 	if (!assumeSucceeded) {
@@ -93452,6 +93867,53 @@ async function applyAgentCoreCredentialEnv(dockerEnv, args) {
 	}
 }
 /**
+* The `--assume-role: STS AssumeRole(...) failed` warning, for the two sites
+* that emit the FALLBACK form of it — the `--sigv4` signing path and the fromS3 bundle download.
+*
+* ONE builder rather than two near-identical template literals, and that is
+* go-to-k/cdkd#3390's test review rather than tidiness. The two were twins, and
+* a twin is where a sanitizing rule goes half-applied: dropping `displayIdent`
+* from the fromS3 copy alone reddened only the source-shape fence, because the
+* `--sigv4` copy was the one with a behavioural case. As one PURE function both
+* sites inherit whatever this is tested to do, and there is one subject to test
+* rather than a second one somebody has to remember exists.
+*
+* TWO untrusted values, and both take `displayIdent` (issue
+* [#3377](https://github.com/go-to-k/cdkd/issues/3377) for the first, this PR's
+* security review for the second):
+*
+* - `profile` is user-supplied argv, and `ConsoleLogger.formatMessage`
+*   sanitizes only a call's EXTRA ARGS, never the message itself — so the
+*   message text is the last place it can be made safe. A MESSAGE, not a
+*   command to paste, so `displayIdent` and not `isPasteableIdent`;
+*   `resolveProfileCredentials` in `local-start-api.ts` is the site that needs
+*   both spellings and shows the difference.
+* - `assumeRoleArn` is the WIDER boundary of the two, which is why it is here
+*   at all: nothing validates it before `assumeAgentCoreExecutionRole` (whose
+*   own throw lands in the very `catch` that calls this), and
+*   `resolveAssumeRoleArn` can source it from a DEPLOYED STATE RECORD rather
+*   than from argv. Every character of a legitimate ARN is in `PLAIN_IDENT`, so
+*   it renders bare exactly as before. cdk-local's twin of this line flattens
+*   the same value for the same reason; cdkd had nothing.
+*
+* `error` takes `displaySafe` — the DENYLIST, since an SDK error message is
+* free-form text rather than an identifier, which is the line
+* `display-safe.ts`'s header draws. The first cut stringified it and sanitized
+* NOTHING, and go-to-k/cdkd#3390's round-2 security review showed that was the
+* hole the other two guards leave open: STS answers an unparseable RoleArn with
+* a `ValidationError` that ECHOES THE SUBMITTED VALUE VERBATIM, so the
+* attacker-controlled ARN comes back through the error string and lands on the
+* same line the `displayIdent` two expressions to its left was added to
+* protect. A C1 byte, `U+0085`, `U+2028` and the bidi overrides all survive an
+* XML 1.0 response body. `formatError` sanitizes a `cause` for exactly this
+* reason and cannot help here, because this is a logger MESSAGE and
+* `ConsoleLogger.formatMessage` sanitizes only a call's EXTRA ARGS.
+*/
+function assumeRoleFallbackWarning(args) {
+	const fallback = args.profile ? `--profile ${displayIdent(args.profile)}` : args.fallbackWithoutProfile;
+	return `--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 612 })}) failed for ${args.purpose}: ${displaySafe(args.error instanceof Error ? args.error.message : String(args.error))}. Falling back to ${fallback}.`;
+}
+/**
 * Resolve the role ARN to assume, honoring the three `--assume-role` forms.
 * Bare `--assume-role` uses the runtime's literal `RoleArn`; when that is an
 * intrinsic (the common L2 case — `Fn::GetAtt` to an auto-created role) it
@@ -93465,7 +93927,7 @@ function resolveAssumeRoleArn(options, resolved, loaded) {
 		if (loaded) {
 			const fromState = resolveExecutionRoleArnFromState(loaded, resolved.logicalId, "RoleArn");
 			if (fromState) {
-				getLogger().debug(`--assume-role: resolved RoleArn from state: ${fromState}`);
+				getLogger().debug(`--assume-role: resolved RoleArn from state: ${displayIdent(fromState)}`);
 				return fromState;
 			}
 		}
@@ -93610,7 +94072,7 @@ async function assumeAgentCoreExecutionRole(roleArn, region) {
 			RoleSessionName: `${getEmbedConfig().resourceNamePrefix}-invoke-agentcore-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new CdkdError(`AssumeRole(${roleArn}) returned no usable credentials.`, "LOCAL_INVOKE_AGENTCORE_ASSUMEROLE_NO_CREDS");
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new CdkdError(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`, "LOCAL_INVOKE_AGENTCORE_ASSUMEROLE_NO_CREDS");
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -94223,7 +94685,7 @@ async function localInvokeCommand(target, options) {
 				const arn = resolveExecutionRoleArnFromState(stateForRoleHint, lambda.logicalId);
 				if (arn) {
 					resolvedAssumeRoleArn = arn;
-					logger.info(`--assume-role: auto-resolved execution role from cdkd state: ${arn}`);
+					logger.info(`--assume-role: auto-resolved execution role from cdkd state: ${displayIdent(arn, { maxCodePoints: 612 })}`);
 				} else logger.warn(`--assume-role: could not resolve the execution role ARN from cdkd state for '${lambda.logicalId}'. Pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.`);
 			}
 		} else maybeSuggestAssumeRole(options, stateForRoleHint, lambda.logicalId);
@@ -94691,7 +95153,7 @@ async function applyLambdaCredentialEnv(dockerEnv, args) {
 			assumeSucceeded = true;
 		} catch (err) {
 			const reason = err instanceof Error ? err.message : String(err);
-			logger.warn(`--assume-role: STS AssumeRole(${args.assumeRoleArn}) failed: ${reason}. Falling back to the developer's shell credentials.`);
+			logger.warn(`--assume-role: STS AssumeRole(${displayIdent(args.assumeRoleArn, { maxCodePoints: 612 })}) failed: ${displaySafe(reason)}. Falling back to the developer's shell credentials.`);
 		}
 	}
 	if (!assumeSucceeded) {
@@ -94729,7 +95191,7 @@ async function assumeLambdaExecutionRole(roleArn, region) {
 			RoleSessionName: `cdkd-local-invoke-${Date.now()}`,
 			DurationSeconds: 3600
 		}))).Credentials;
-		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${roleArn}) returned no usable credentials.`);
+		if (!creds?.AccessKeyId || !creds.SecretAccessKey || !creds.SessionToken) throw new Error(`AssumeRole(${displayIdent(roleArn, { maxCodePoints: 612 })}) returned no usable credentials.`);
 		return {
 			accessKeyId: creds.AccessKeyId,
 			secretAccessKey: creds.SecretAccessKey,
@@ -94850,7 +95312,7 @@ function materializeInlineCode(handler, source, fileExtension) {
 function suggestAssumeRoleFromState(state, logicalId) {
 	const logger = getLogger();
 	const roleArn = resolveExecutionRoleArnFromState(state, logicalId);
-	if (roleArn) logger.info(`Hint: the deployed function uses execution role ${roleArn}. Re-run with --assume-role to invoke under the deployed function's narrow permissions.`);
+	if (roleArn) logger.info(`Hint: the deployed function uses execution role ${displayIdent(roleArn, { maxCodePoints: 612 })}. Re-run with --assume-role to invoke under the deployed function's narrow permissions.`);
 }
 /**
 * Emit the "re-run with `--assume-role`" hint, if it applies.
@@ -95010,4 +95472,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-dYPgGoOv.js.map
+//# sourceMappingURL=program-PCCyP9-O.js.map