@go-to-k/cdkd 0.280.32 → 0.280.34

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-REAC5UGa.js";
+import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-DYDL4JxX.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-l4OlfWQo.js";
+import { t as ASGProvider } from "./asg-provider-Gk-TB9L0.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -11930,6 +11930,55 @@ function hasUsableTableCapacity(value) {
 	return true;
 }
 /**
+* A capacity member, or `undefined` when the value is not a usable number.
+*
+* `Number()` coercion is NOT good enough here and the first draft of this
+* helper shipped that bug: `Number(null)`, `Number('')`, `Number([])` and
+* `Number(false)` are all **0**, not `NaN` — so a live `0` would have compared
+* EQUAL to a desired `null` / `''` / `[]` / `false` and suppressed the call.
+* The blast radius on DynamoDB is small (a PROVISIONED index's capacity is
+* always >= 1), but the rule this encodes is copied to other providers, so it
+* is spelled correctly rather than relying on the type that happens to be
+* unreachable today.
+*
+* A YAML-borne numeric STRING is still accepted, because that is a real
+* template shape and `'5'` genuinely means 5.
+*/
+function capacityNumber(value) {
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value === "string" && value.trim() !== "") {
+		const n = Number(value);
+		return Number.isFinite(n) ? n : void 0;
+	}
+}
+/**
+* Does the capacity AWS currently holds for a GSI already equal the pair the
+* template requests? (issue #1630)
+*
+* Compared member by member, deliberately not with `deepEqual` /
+* `JSON.stringify`: `DescribeTable` returns a `ProvisionedThroughputDescription`
+* carrying `NumberOfDecreasesToday` / `LastIncreaseDateTime` /
+* `LastDecreaseDateTime` alongside the two capacities, so a structural compare
+* against the two-member desired object could never match and the suppression
+* would be dead code that only LOOKED safe.
+*
+* Anything that is not a usable number on EITHER side fails OPEN (the
+* `UpdateTable` is still issued): an absent live entry, a malformed template
+* value, an unresolved intrinsic. That is the correct direction — the worst
+* case is the pre-fix behavior, whereas a false MATCH would silently drop a
+* capacity change the user asked for.
+*/
+function liveCapacityAlreadyMatches(live, requested) {
+	if (live === void 0) return false;
+	const liveRead = capacityNumber(live.ReadCapacityUnits);
+	const liveWrite = capacityNumber(live.WriteCapacityUnits);
+	const wantRead = capacityNumber(requested.ReadCapacityUnits);
+	const wantWrite = capacityNumber(requested.WriteCapacityUnits);
+	if (liveRead === void 0 || liveWrite === void 0) return false;
+	if (wantRead === void 0 || wantWrite === void 0) return false;
+	return liveRead === wantRead && liveWrite === wantWrite;
+}
+/**
 * `DescribeTable` poll budget (seconds, 1 poll/s) after an ordinary
 * `UpdateTable` — capacity, TTL, tags, table class. Calibrated on those and
 * sufficient for them.
@@ -12105,6 +12154,8 @@ var DynamoDBTableProvider = class {
 				}
 			}
 			const currentLiveIndexNames = table ? new Set(liveIndexes.map((live) => live.IndexName).filter((name) => typeof name === "string").filter((name) => !preFlipDeletedIndexNames.has(name))) : void 0;
+			const currentLiveIndexByName = table ? new Map(liveIndexes.filter((live) => typeof live.IndexName === "string").filter((live) => !preFlipDeletedIndexNames.has(live.IndexName)).map((live) => [live.IndexName, live])) : void 0;
+			const liveCapacityComparable = liveBillingMode === "PROVISIONED";
 			const gsiHandledByBillingFlip = /* @__PURE__ */ new Set();
 			if (billingOrThroughputChanged || tableClassChanged) {
 				const updateInput = { TableName: physicalId };
@@ -12219,7 +12270,7 @@ var DynamoDBTableProvider = class {
 					this.logger.debug(`Disabled DynamoDB Stream on table ${physicalId}`);
 				}
 			}
-			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames);
+			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable);
 			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"]);
 			if (JSON.stringify(properties["TimeToLiveSpecification"]) !== JSON.stringify(previousProperties["TimeToLiveSpecification"])) {
 				this.assertNoActiveTtlAttributeNameChange(logicalId, resourceType, physicalId, properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"]);
@@ -12657,7 +12708,7 @@ var DynamoDBTableProvider = class {
 	*    a remove-then-add pair, so this method throws on such a change rather than
 	*    silently dropping it.
 	*/
-	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip = /* @__PURE__ */ new Set(), liveIndexNames) {
+	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip = /* @__PURE__ */ new Set(), liveIndexNames, liveIndexByName, liveCapacityComparable = false) {
 		const prev = previousGsis ?? [];
 		const desired = desiredGsis ?? [];
 		const prevByName = new Map(prev.filter((g) => g.IndexName).map((g) => [g.IndexName, g]));
@@ -12672,7 +12723,17 @@ var DynamoDBTableProvider = class {
 			ops.push({ Delete: { IndexName: name } });
 		}
 		for (const [name, gsi] of desiredByName) if (!prevByName.has(name)) {
+			const live = liveIndexByName?.get(name);
 			if (!gsi.KeySchema) throw new ProvisioningError(`GlobalSecondaryIndex ${name} on DynamoDB table ${logicalId} is missing KeySchema`, resourceType, logicalId, physicalId);
+			if (live !== void 0 && live.IndexStatus !== "DELETING") {
+				this.logger.warn(`GSI ${name} on DynamoDB table ${physicalId} already exists in AWS but is absent from cdkd's recorded previous state, so its Create is being skipped. This usually means an earlier deploy created the index and then failed before state was written.`);
+				if (liveCapacityComparable && gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && !liveCapacityAlreadyMatches(live.ProvisionedThroughput, gsi.ProvisionedThroughput)) ops.push({ Update: {
+					IndexName: name,
+					ProvisionedThroughput: gsi.ProvisionedThroughput
+				} });
+				this.logger.warn(`GSI ${name} was adopted from AWS rather than created, so cdkd could not verify its KeySchema / Projection match the template. Run \`cdkd drift ${physicalId}\` to confirm, and \`cdkd drift --accept\` if AWS is the source of truth.`);
+				continue;
+			}
 			ops.push({ Create: {
 				IndexName: name,
 				KeySchema: gsi.KeySchema,
@@ -12683,7 +12744,8 @@ var DynamoDBTableProvider = class {
 		} else {
 			const before = prevByName.get(name);
 			if (JSON.stringify(before.KeySchema) !== JSON.stringify(gsi.KeySchema) || JSON.stringify(before.Projection) !== JSON.stringify(gsi.Projection)) throw new ProvisioningError(`GlobalSecondaryIndex ${name} on DynamoDB table ${logicalId} changed its KeySchema or Projection, which DynamoDB cannot modify in place. Rename the index (so it is dropped and re-created) or replace the table.`, resourceType, logicalId, physicalId);
-			if (gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && JSON.stringify(before.ProvisionedThroughput) !== JSON.stringify(gsi.ProvisionedThroughput)) ops.push({ Update: {
+			if (gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && JSON.stringify(before.ProvisionedThroughput) !== JSON.stringify(gsi.ProvisionedThroughput)) if (liveCapacityComparable && liveCapacityAlreadyMatches(liveIndexByName?.get(name)?.ProvisionedThroughput, gsi.ProvisionedThroughput)) this.logger.debug(`GSI ${name} on DynamoDB table ${physicalId} already carries the requested capacity in AWS; skipping its throughput Update`);
+			else ops.push({ Update: {
 				IndexName: name,
 				ProvisionedThroughput: gsi.ProvisionedThroughput
 			} });
@@ -17946,6 +18008,95 @@ var EventBridgeBusProvider = class {
 	}
 };
 
+//#endregion
+//#region src/utils/ip-protocol.ts
+/**
+* EC2 `IpProtocol` value canonicalization (issue
+* [#1643](https://github.com/go-to-k/cdkd/issues/1643)).
+*
+* EC2 owns the spelling of a security-group rule's protocol: it accepts an
+* IANA protocol NUMBER or a protocol NAME, rewrites the four numbers it has a
+* name for before storing the rule, and lower-cases a name it is given. So the
+* value cdkd SENDS and the value AWS REPORTS are routinely two spellings of
+* ONE protocol.
+*
+* This lives in `src/utils/` rather than beside either consumer because it has
+* TWO, in different layers: `src/analyzer/drift-protocol-normalize.ts` (the
+* drift comparator) and `src/provisioning/providers/ec2-provider.ts` (rule
+* IDENTITY — the standalone-rule lookup, the inline-rule reconcile, and the
+* write-side revoke/authorize diff). Hosting it in the analyzer made the
+* provider carry the tree's only `src/provisioning/**` -> `src/analyzer/**`
+* import, which is both a layering break and a real hazard: an edit made for
+* the drift comparator would silently change which AWS rule a revoke matches.
+*
+* ## The rename set is MEASURED, not guessed
+*
+* Probed against real AWS (us-east-1, 2026-08-12) by authorizing one rule per
+* protocol on a scratch security group and reading `IpProtocol` back, for
+* ingress AND egress:
+*
+* - RENAMED: `1` -> `icmp`, `6` -> `tcp`, `17` -> `udp`, `58` -> `icmpv6`.
+* - NOT renamed: `-1`, `0`, `2`, `4`, `27`, `41`, `47`, `50`, `51`, `88`,
+*   `89`, `94`, `103`, `112`, `132`, `255` — all read back as the number.
+*
+* So the rename set is exactly the four protocols EC2 has a NAME for — a
+* CLOSED set, not the open-ended IANA list the issue worried about. `-1` is
+* unaffected, which is why #1633's live test came back clean.
+*
+* Case is also AWS's to decide: `TCP` / `Tcp` / `tcp` authorized on the same
+* port collapsed into ONE `tcp` permission in the readback, so a name is
+* matched case-insensitively and canonicalized to lower case. Only the four
+* KNOWN names are lowered — an unrecognized string is left exactly as-is
+* rather than folded, so this can never make two genuinely different values
+* compare equal.
+*
+* Known bound: only the CANONICAL decimal spelling is recognized. A
+* zero-padded `'06'` or a `'0x6'` misses the table and is returned verbatim,
+* so such a template still phantom-drifts. Neither form has been observed in
+* a CDK-synthesized template, and accepting them would mean parsing rather
+* than table lookup — which is what keeps the "closed, measured set" property
+* that makes this safe.
+*/
+/**
+* The protocol numbers AWS rewrites to a name, measured (see the module
+* docstring). Keyed by the number's STRING form, since that is the shape every
+* input is normalized to first.
+*/
+const PROTOCOL_NUMBER_TO_NAME = /* @__PURE__ */ new Map([
+	["1", "icmp"],
+	["6", "tcp"],
+	["17", "udp"],
+	["58", "icmpv6"]
+]);
+/** The four names EC2 canonicalizes to, for the case-insensitive match. */
+const CANONICAL_PROTOCOL_NAMES = new Set(PROTOCOL_NUMBER_TO_NAME.values());
+/**
+* Canonicalize ONE `IpProtocol` value the way EC2 does.
+*
+* Returns the input unchanged for any shape that is not a protocol value — an
+* unresolved intrinsic object (`{Ref: ...}`), `null`, a boolean.
+*
+* EVERY number is stringified, not only an integer one: an unquoted YAML
+* `IpProtocol: 47` parses to a number while AWS always reads back a string, and
+* `ec2-provider.ts`'s rule-identity key has stringified every number since
+* #1633 specifically so a legacy record holding the NUMBER `-1` still matches
+* AWS's `'-1'`. Narrowing that to integers would have silently regressed a
+* malformed `6.5` from `'6.5'` to the number `6.5`, and collapsed `NaN` /
+* `Infinity` onto one JSON `null` bucket — the exact merging that key exists
+* to avoid. The rename lookup is a table hit, so a non-integer simply misses it.
+*/
+function canonicalizeIpProtocolValue(value) {
+	let text;
+	if (typeof value === "string") text = value;
+	else if (typeof value === "number") text = String(value);
+	else return value;
+	const renamed = PROTOCOL_NUMBER_TO_NAME.get(text);
+	if (renamed !== void 0) return renamed;
+	const lowered = text.toLowerCase();
+	if (CANONICAL_PROTOCOL_NAMES.has(lowered)) return lowered;
+	return text;
+}
+
 //#endregion
 //#region src/provisioning/providers/ec2-provider.ts
 /**
@@ -19844,7 +19995,7 @@ var EC2Provider = class {
 			const prefixKey = direction === "egress" ? rule["DestinationPrefixListId"] : rule["SourcePrefixListId"];
 			const peerOwner = direction === "ingress" ? rule["SourceSecurityGroupOwnerId"] : void 0;
 			return JSON.stringify({
-				p: rule["IpProtocol"] ?? "-1",
+				p: sgProtocolKey(rule["IpProtocol"]),
 				f: rule["FromPort"] ?? null,
 				t: rule["ToPort"] ?? null,
 				c4: rule["CidrIp"] ?? null,
@@ -20663,7 +20814,8 @@ var EC2Provider = class {
 		const toPort = parts[3] === "-1" ? void 0 : parseInt(parts[3], 10);
 		const sg = (await this.ec2Client.send(new DescribeSecurityGroupsCommand({ GroupIds: [groupId] }))).SecurityGroups?.[0];
 		if (!sg) return void 0;
-		const candidates = (sg.IpPermissions ?? []).filter((p) => (p.IpProtocol ?? "-1") === protocol && (p.FromPort ?? void 0) === fromPort && (p.ToPort ?? void 0) === toPort);
+		const wantedProtocol = sgProtocolKey(protocol);
+		const candidates = (sg.IpPermissions ?? []).filter((p) => sgProtocolKey(p.IpProtocol) === wantedProtocol && (p.FromPort ?? void 0) === fromPort && (p.ToPort ?? void 0) === toPort);
 		if (candidates.length === 0) return void 0;
 		const flat = flattenIpPermissions(candidates, "ingress");
 		if (properties && Object.keys(properties).length > 0) {
@@ -20884,8 +21036,7 @@ function flattenIpPermissions(perms, direction) {
 * non-match honest instead of manufacturing a fake identity.
 */
 function sgProtocolKey(value) {
-	if (typeof value === "number") return String(value);
-	return value ?? "-1";
+	return canonicalizeIpProtocolValue(value ?? "-1");
 }
 function sgRuleKey(rule, direction) {
 	const peerKey = direction === "egress" ? rule["DestinationSecurityGroupId"] : rule["SourceSecurityGroupId"];
@@ -52756,6 +52907,145 @@ async function canonicalizePrincipalUniqueIds(baseline, aws, resolve) {
 	};
 }
 
+//#endregion
+//#region src/analyzer/drift-protocol-normalize.ts
+/**
+* EC2 security-group `IpProtocol` VALUE canonicalization for the drift
+* comparator (issue
+* [#1643](https://github.com/go-to-k/cdkd/issues/1643)) — a sibling of
+* `drift-normalize.ts` for a difference that is not about ORDER, in the same
+* spirit as `drift-principal-normalize.ts`.
+*
+* EC2 owns the spelling of `IpProtocol`: it accepts an IANA protocol NUMBER or
+* a protocol NAME, and rewrites a subset of the numbers to their canonical
+* name before storing the rule. cdkd records what it SENT (the template's
+* value, post-#1633), AWS holds the canonical name, and
+* `readSecurityGroupIngressCurrentState` reads the name back — so the two
+* sides are two spellings of ONE protocol and every `cdkd drift` run reports
+* the difference forever. `drift --revert` cannot clear it either: it revokes
+* and re-authorizes into the same state, which is the permanent phantom drift
+* the #1591 / #1633 fixes address for their own arms.
+*
+* Unlike the send-side narrowing #1633 does, this is a READBACK-normalization
+* concern, so it lives here and runs on BOTH comparison sides. That placement
+* is load-bearing for two reasons: the baseline may be the user's TEMPLATE
+* (a resource deployed before observed-capture), where the value is whatever
+* they wrote; and it covers the inline
+* `AWS::EC2::SecurityGroup.SecurityGroupIngress[]` / `SecurityGroupEgress[]`
+* rules, which #1633 deliberately does not touch.
+*
+* ## The rename set is MEASURED, not guessed
+*
+* Probed against real AWS (us-east-1, 2026-08-12) by authorizing one rule per
+* protocol on a scratch security group and reading `IpProtocol` back, for
+* ingress AND egress:
+*
+* - RENAMED: `1` -> `icmp`, `6` -> `tcp`, `17` -> `udp`, `58` -> `icmpv6`.
+* - NOT renamed: `-1`, `0`, `2`, `4`, `27`, `41`, `47`, `50`, `51`, `88`,
+*   `89`, `94`, `103`, `112`, `132`, `255` — all read back as the number.
+*
+* So the rename set is exactly the four protocols EC2 has a NAME for, and it
+* is a CLOSED set rather than the open-ended IANA list the issue worried
+* about. `-1` is unaffected, which is why #1633's live test came back clean.
+*
+* The measured rename table, the case-folding rule and their bounds live with
+* the shared value canonicalizer in `src/utils/ip-protocol.ts` — this module
+* owns only WHERE in a resource's properties that canonicalization applies.
+*
+* **This pass matters for the `properties`-fallback baseline, not for a fresh
+* deploy.** A resource deployed by a current binary captures
+* `observedProperties` from the same `readCurrentState` the drift run uses, so
+* both sides already hold AWS's spelling and this is a no-op. The population it
+* is FOR is the one whose baseline is the user's TEMPLATE: state written before
+* observed-capture existed, or a provider that captures none. That is also why
+* the integ fixture has to strip `observedProperties` to exercise it — the
+* first version of this change asserted a fresh deploy would fail without the
+* module, and three independent reviews showed it would not.
+*/
+/**
+* The resource types carrying an `IpProtocol` this pass rewrites, mapped to
+* the property path(s) it lives at. The standalone rule types carry it at the
+* top level; `AWS::EC2::SecurityGroup` carries it inside each element of its
+* two inline rule arrays.
+*
+* Deliberately a CLOSED table rather than a walk for any key named
+* `IpProtocol`: a blanket rewrite would turn an unrelated property whose value
+* happens to be `'6'` into `'tcp'`.
+*/
+const IP_PROTOCOL_PATHS = /* @__PURE__ */ new Map([
+	["AWS::EC2::SecurityGroupIngress", ["IpProtocol"]],
+	["AWS::EC2::SecurityGroupEgress", ["IpProtocol"]],
+	["AWS::EC2::SecurityGroup", ["SecurityGroupIngress[].IpProtocol", "SecurityGroupEgress[].IpProtocol"]]
+]);
+/**
+* Rewrite the `IpProtocol` at `path` inside `properties`, returning a copy
+* when anything changed and the original object otherwise.
+*
+* `path` is either a plain key (`'IpProtocol'`) or an array-crossing form
+* (`'SecurityGroupIngress[].IpProtocol'`) whose left half names an array
+* whose every element carries the key.
+*/
+function rewriteAtPath(properties, path) {
+	if (properties === null || typeof properties !== "object" || Array.isArray(properties)) return properties;
+	const bag = properties;
+	const arrayMarker = path.indexOf("[].");
+	if (arrayMarker === -1) {
+		if (!(path in bag)) return properties;
+		const next = canonicalizeIpProtocolValue(bag[path]);
+		if (next === bag[path]) return properties;
+		return {
+			...bag,
+			[path]: next
+		};
+	}
+	const arrayKey = path.slice(0, arrayMarker);
+	const elementKey = path.slice(arrayMarker + 3);
+	const list = bag[arrayKey];
+	if (!Array.isArray(list)) return properties;
+	let changed = false;
+	const mapped = list.map((element) => {
+		if (element === null || typeof element !== "object" || Array.isArray(element)) return element;
+		const rule = element;
+		if (!(elementKey in rule)) return element;
+		const next = canonicalizeIpProtocolValue(rule[elementKey]);
+		if (next === rule[elementKey]) return element;
+		changed = true;
+		return {
+			...rule,
+			[elementKey]: next
+		};
+	});
+	if (!changed) return properties;
+	return {
+		...bag,
+		[arrayKey]: mapped
+	};
+}
+/**
+* Canonicalize every `IpProtocol` on BOTH drift-comparison sides for the
+* security-group resource types that carry one.
+*
+* A resource type with no `IpProtocol` is returned untouched, so the caller
+* can invoke this unconditionally.
+*/
+function canonicalizeIpProtocols(baseline, aws, resourceType) {
+	const paths = IP_PROTOCOL_PATHS.get(resourceType);
+	if (paths === void 0) return {
+		baseline,
+		aws
+	};
+	let nextBaseline = baseline;
+	let nextAws = aws;
+	for (const path of paths) {
+		nextBaseline = rewriteAtPath(nextBaseline, path);
+		nextAws = rewriteAtPath(nextAws, path);
+	}
+	return {
+		baseline: nextBaseline,
+		aws: nextAws
+	};
+}
+
 //#endregion
 //#region src/analyzer/drift-cc-api-deny-list.ts
 /**
@@ -53172,7 +53462,8 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 			const baseline = useObserved ? resource.observedProperties : resource.properties ?? {};
 			const observedIgnorePaths = useObserved ? undeclaredEmptyObservedKeys(resource.observedProperties, resource.properties ?? {}) : [];
 			const normalized = await canonicalizePrincipalUniqueIds(baseline, aws, resolvePrincipalUniqueId);
-			const changes = calculateResourceDrift(normalized.baseline, normalized.aws, {
+			const protocolNormalized = canonicalizeIpProtocols(normalized.baseline, normalized.aws, resource.resourceType);
+			const changes = calculateResourceDrift(protocolNormalized.baseline, protocolNormalized.aws, {
 				ignorePaths: observedIgnorePaths.length ? [...ignorePaths, ...observedIgnorePaths] : ignorePaths,
 				unionWalkObjects: useObserved,
 				unorderedPaths
@@ -70922,7 +71213,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.32");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.34");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;