@go-to-k/cdkd 0.280.33 → 0.280.35

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-Dn60Zkq5.js";
+import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-DjdMx6fC.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-DrM2HEGB.js";
+import { t as ASGProvider } from "./asg-provider-CL2zlhEi.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -18008,6 +18008,95 @@ var EventBridgeBusProvider = class {
 	}
 };
 
+//#endregion
+//#region src/utils/ip-protocol.ts
+/**
+* EC2 `IpProtocol` value canonicalization (issue
+* [#1643](https://github.com/go-to-k/cdkd/issues/1643)).
+*
+* EC2 owns the spelling of a security-group rule's protocol: it accepts an
+* IANA protocol NUMBER or a protocol NAME, rewrites the four numbers it has a
+* name for before storing the rule, and lower-cases a name it is given. So the
+* value cdkd SENDS and the value AWS REPORTS are routinely two spellings of
+* ONE protocol.
+*
+* This lives in `src/utils/` rather than beside either consumer because it has
+* TWO, in different layers: `src/analyzer/drift-protocol-normalize.ts` (the
+* drift comparator) and `src/provisioning/providers/ec2-provider.ts` (rule
+* IDENTITY — the standalone-rule lookup, the inline-rule reconcile, and the
+* write-side revoke/authorize diff). Hosting it in the analyzer made the
+* provider carry the tree's only `src/provisioning/**` -> `src/analyzer/**`
+* import, which is both a layering break and a real hazard: an edit made for
+* the drift comparator would silently change which AWS rule a revoke matches.
+*
+* ## The rename set is MEASURED, not guessed
+*
+* Probed against real AWS (us-east-1, 2026-08-12) by authorizing one rule per
+* protocol on a scratch security group and reading `IpProtocol` back, for
+* ingress AND egress:
+*
+* - RENAMED: `1` -> `icmp`, `6` -> `tcp`, `17` -> `udp`, `58` -> `icmpv6`.
+* - NOT renamed: `-1`, `0`, `2`, `4`, `27`, `41`, `47`, `50`, `51`, `88`,
+*   `89`, `94`, `103`, `112`, `132`, `255` — all read back as the number.
+*
+* So the rename set is exactly the four protocols EC2 has a NAME for — a
+* CLOSED set, not the open-ended IANA list the issue worried about. `-1` is
+* unaffected, which is why #1633's live test came back clean.
+*
+* Case is also AWS's to decide: `TCP` / `Tcp` / `tcp` authorized on the same
+* port collapsed into ONE `tcp` permission in the readback, so a name is
+* matched case-insensitively and canonicalized to lower case. Only the four
+* KNOWN names are lowered — an unrecognized string is left exactly as-is
+* rather than folded, so this can never make two genuinely different values
+* compare equal.
+*
+* Known bound: only the CANONICAL decimal spelling is recognized. A
+* zero-padded `'06'` or a `'0x6'` misses the table and is returned verbatim,
+* so such a template still phantom-drifts. Neither form has been observed in
+* a CDK-synthesized template, and accepting them would mean parsing rather
+* than table lookup — which is what keeps the "closed, measured set" property
+* that makes this safe.
+*/
+/**
+* The protocol numbers AWS rewrites to a name, measured (see the module
+* docstring). Keyed by the number's STRING form, since that is the shape every
+* input is normalized to first.
+*/
+const PROTOCOL_NUMBER_TO_NAME = /* @__PURE__ */ new Map([
+	["1", "icmp"],
+	["6", "tcp"],
+	["17", "udp"],
+	["58", "icmpv6"]
+]);
+/** The four names EC2 canonicalizes to, for the case-insensitive match. */
+const CANONICAL_PROTOCOL_NAMES = new Set(PROTOCOL_NUMBER_TO_NAME.values());
+/**
+* Canonicalize ONE `IpProtocol` value the way EC2 does.
+*
+* Returns the input unchanged for any shape that is not a protocol value — an
+* unresolved intrinsic object (`{Ref: ...}`), `null`, a boolean.
+*
+* EVERY number is stringified, not only an integer one: an unquoted YAML
+* `IpProtocol: 47` parses to a number while AWS always reads back a string, and
+* `ec2-provider.ts`'s rule-identity key has stringified every number since
+* #1633 specifically so a legacy record holding the NUMBER `-1` still matches
+* AWS's `'-1'`. Narrowing that to integers would have silently regressed a
+* malformed `6.5` from `'6.5'` to the number `6.5`, and collapsed `NaN` /
+* `Infinity` onto one JSON `null` bucket — the exact merging that key exists
+* to avoid. The rename lookup is a table hit, so a non-integer simply misses it.
+*/
+function canonicalizeIpProtocolValue(value) {
+	let text;
+	if (typeof value === "string") text = value;
+	else if (typeof value === "number") text = String(value);
+	else return value;
+	const renamed = PROTOCOL_NUMBER_TO_NAME.get(text);
+	if (renamed !== void 0) return renamed;
+	const lowered = text.toLowerCase();
+	if (CANONICAL_PROTOCOL_NAMES.has(lowered)) return lowered;
+	return text;
+}
+
 //#endregion
 //#region src/provisioning/providers/ec2-provider.ts
 /**
@@ -18113,6 +18202,49 @@ function narrowIngressIpProtocol(properties, onUnusable) {
 	};
 }
 /**
+* Fold a rule bag's `IpProtocol` to the spelling AWS will hold (issue #1648).
+*
+* DIFF-side only — see the call site in `canonicalizeDesiredProperties` for why
+* this is not done inside `narrowIngressIpProtocol`, which also feeds the wire.
+* Returns the original object when nothing changes, so an ordinary rule
+* compares byte-for-byte as before.
+*/
+function canonicalizeSgRuleProtocol(rule) {
+	if (!("IpProtocol" in rule)) return rule;
+	const next = canonicalizeIpProtocolValue(rule["IpProtocol"]);
+	if (next === rule["IpProtocol"]) return rule;
+	return {
+		...rule,
+		IpProtocol: next
+	};
+}
+/**
+* The `AWS::EC2::SecurityGroup` inline-rule twin of
+* {@link canonicalizeSgRuleProtocol}: fold every element of the two rule lists.
+* Identity-returns when nothing changes, and leaves a non-array list or a
+* non-object element alone so a malformed template still reaches AWS's own
+* validation rather than being reshaped here.
+*/
+function canonicalizeSgInlineRuleProtocols(properties) {
+	let out = properties;
+	for (const key of ["SecurityGroupIngress", "SecurityGroupEgress"]) {
+		const list = out[key];
+		if (!Array.isArray(list)) continue;
+		let changed = false;
+		const mapped = list.map((el) => {
+			if (el === null || typeof el !== "object" || Array.isArray(el)) return el;
+			const next = canonicalizeSgRuleProtocol(el);
+			if (next !== el) changed = true;
+			return next;
+		});
+		if (changed) out = {
+			...out,
+			[key]: mapped
+		};
+	}
+	return out;
+}
+/**
 * AWS EC2 Networking Provider
 *
 * Implements resource provisioning for EC2 networking resources:
@@ -19906,7 +20038,7 @@ var EC2Provider = class {
 			const prefixKey = direction === "egress" ? rule["DestinationPrefixListId"] : rule["SourcePrefixListId"];
 			const peerOwner = direction === "ingress" ? rule["SourceSecurityGroupOwnerId"] : void 0;
 			return JSON.stringify({
-				p: rule["IpProtocol"] ?? "-1",
+				p: sgProtocolKey(rule["IpProtocol"]),
 				f: rule["FromPort"] ?? null,
 				t: rule["ToPort"] ?? null,
 				c4: rule["CidrIp"] ?? null,
@@ -20293,7 +20425,11 @@ var EC2Provider = class {
 	*    `AllocationId`, `ConnectivityType`, `PrivateIpAddress`.
 	*  - **AWS::EC2::RouteTable**: `DescribeRouteTables` for `VpcId`.
 	*  - **AWS::EC2::SecurityGroup**: `DescribeSecurityGroups` for
-	*    `GroupName`, `GroupDescription`, `VpcId`, plus `SecurityGroupIngress`
+	*    `GroupName`, `GroupDescription`, `VpcId`, `Tags` (issue #1649 — the
+	*    same call returns them in the CFn `[{Key,Value}]` shape, so they are
+	*    read rather than declared unreadable the way every sibling standalone
+	*    type declares them; reserved `aws:`-prefixed entries are stripped and
+	*    the key is omitted entirely when AWS reports none), plus `SecurityGroupIngress`
 	*    and `SecurityGroupEgress` reverse-mapped from AWS's normalized
 	*    `IpPermissions[]` / `IpPermissionsEgress[]` form. Each AWS
 	*    `IpPermission` is flattened into one CFn rule per `IpRanges` /
@@ -20445,8 +20581,9 @@ var EC2Provider = class {
 	canonicalizeDesiredProperties(resourceType, properties) {
 		if (resourceType === "AWS::EC2::SecurityGroupIngress") {
 			const { narrowed } = narrowIngressIpProtocol(properties, () => {});
-			return narrowed;
+			return canonicalizeSgRuleProtocol(narrowed);
 		}
+		if (resourceType === "AWS::EC2::SecurityGroup") return canonicalizeSgInlineRuleProtocols(properties);
 		if (resourceType !== "AWS::EC2::Route") return properties;
 		const { declared, narrowed } = narrowRouteDestinations(properties);
 		return declared.length > 1 ? narrowed : properties;
@@ -20516,6 +20653,8 @@ var EC2Provider = class {
 		if (sg.GroupName !== void 0) result["GroupName"] = sg.GroupName;
 		if (sg.Description !== void 0) result["GroupDescription"] = sg.Description;
 		if (sg.VpcId !== void 0) result["VpcId"] = sg.VpcId;
+		const tags = normalizeAwsTagsToCfn(sg.Tags);
+		if (tags.length > 0) result["Tags"] = tags;
 		const stateIngress = Array.isArray(properties?.["SecurityGroupIngress"]) ? properties["SecurityGroupIngress"] : void 0;
 		result["SecurityGroupIngress"] = reconcileSgRules(flattenIpPermissions(sg.IpPermissions ?? [], "ingress"), stateIngress, "ingress");
 		const stateEgress = Array.isArray(properties?.["SecurityGroupEgress"]) ? properties["SecurityGroupEgress"] : void 0;
@@ -20725,7 +20864,8 @@ var EC2Provider = class {
 		const toPort = parts[3] === "-1" ? void 0 : parseInt(parts[3], 10);
 		const sg = (await this.ec2Client.send(new DescribeSecurityGroupsCommand({ GroupIds: [groupId] }))).SecurityGroups?.[0];
 		if (!sg) return void 0;
-		const candidates = (sg.IpPermissions ?? []).filter((p) => (p.IpProtocol ?? "-1") === protocol && (p.FromPort ?? void 0) === fromPort && (p.ToPort ?? void 0) === toPort);
+		const wantedProtocol = sgProtocolKey(protocol);
+		const candidates = (sg.IpPermissions ?? []).filter((p) => sgProtocolKey(p.IpProtocol) === wantedProtocol && (p.FromPort ?? void 0) === fromPort && (p.ToPort ?? void 0) === toPort);
 		if (candidates.length === 0) return void 0;
 		const flat = flattenIpPermissions(candidates, "ingress");
 		if (properties && Object.keys(properties).length > 0) {
@@ -20946,8 +21086,7 @@ function flattenIpPermissions(perms, direction) {
 * non-match honest instead of manufacturing a fake identity.
 */
 function sgProtocolKey(value) {
-	if (typeof value === "number") return String(value);
-	return value ?? "-1";
+	return canonicalizeIpProtocolValue(value ?? "-1");
 }
 function sgRuleKey(rule, direction) {
 	const peerKey = direction === "egress" ? rule["DestinationSecurityGroupId"] : rule["SourceSecurityGroupId"];
@@ -52818,6 +52957,145 @@ async function canonicalizePrincipalUniqueIds(baseline, aws, resolve) {
 	};
 }
 
+//#endregion
+//#region src/analyzer/drift-protocol-normalize.ts
+/**
+* EC2 security-group `IpProtocol` VALUE canonicalization for the drift
+* comparator (issue
+* [#1643](https://github.com/go-to-k/cdkd/issues/1643)) — a sibling of
+* `drift-normalize.ts` for a difference that is not about ORDER, in the same
+* spirit as `drift-principal-normalize.ts`.
+*
+* EC2 owns the spelling of `IpProtocol`: it accepts an IANA protocol NUMBER or
+* a protocol NAME, and rewrites a subset of the numbers to their canonical
+* name before storing the rule. cdkd records what it SENT (the template's
+* value, post-#1633), AWS holds the canonical name, and
+* `readSecurityGroupIngressCurrentState` reads the name back — so the two
+* sides are two spellings of ONE protocol and every `cdkd drift` run reports
+* the difference forever. `drift --revert` cannot clear it either: it revokes
+* and re-authorizes into the same state, which is the permanent phantom drift
+* the #1591 / #1633 fixes address for their own arms.
+*
+* Unlike the send-side narrowing #1633 does, this is a READBACK-normalization
+* concern, so it lives here and runs on BOTH comparison sides. That placement
+* is load-bearing for two reasons: the baseline may be the user's TEMPLATE
+* (a resource deployed before observed-capture), where the value is whatever
+* they wrote; and it covers the inline
+* `AWS::EC2::SecurityGroup.SecurityGroupIngress[]` / `SecurityGroupEgress[]`
+* rules, which #1633 deliberately does not touch.
+*
+* ## The rename set is MEASURED, not guessed
+*
+* Probed against real AWS (us-east-1, 2026-08-12) by authorizing one rule per
+* protocol on a scratch security group and reading `IpProtocol` back, for
+* ingress AND egress:
+*
+* - RENAMED: `1` -> `icmp`, `6` -> `tcp`, `17` -> `udp`, `58` -> `icmpv6`.
+* - NOT renamed: `-1`, `0`, `2`, `4`, `27`, `41`, `47`, `50`, `51`, `88`,
+*   `89`, `94`, `103`, `112`, `132`, `255` — all read back as the number.
+*
+* So the rename set is exactly the four protocols EC2 has a NAME for, and it
+* is a CLOSED set rather than the open-ended IANA list the issue worried
+* about. `-1` is unaffected, which is why #1633's live test came back clean.
+*
+* The measured rename table, the case-folding rule and their bounds live with
+* the shared value canonicalizer in `src/utils/ip-protocol.ts` — this module
+* owns only WHERE in a resource's properties that canonicalization applies.
+*
+* **This pass matters for the `properties`-fallback baseline, not for a fresh
+* deploy.** A resource deployed by a current binary captures
+* `observedProperties` from the same `readCurrentState` the drift run uses, so
+* both sides already hold AWS's spelling and this is a no-op. The population it
+* is FOR is the one whose baseline is the user's TEMPLATE: state written before
+* observed-capture existed, or a provider that captures none. That is also why
+* the integ fixture has to strip `observedProperties` to exercise it — the
+* first version of this change asserted a fresh deploy would fail without the
+* module, and three independent reviews showed it would not.
+*/
+/**
+* The resource types carrying an `IpProtocol` this pass rewrites, mapped to
+* the property path(s) it lives at. The standalone rule types carry it at the
+* top level; `AWS::EC2::SecurityGroup` carries it inside each element of its
+* two inline rule arrays.
+*
+* Deliberately a CLOSED table rather than a walk for any key named
+* `IpProtocol`: a blanket rewrite would turn an unrelated property whose value
+* happens to be `'6'` into `'tcp'`.
+*/
+const IP_PROTOCOL_PATHS = /* @__PURE__ */ new Map([
+	["AWS::EC2::SecurityGroupIngress", ["IpProtocol"]],
+	["AWS::EC2::SecurityGroupEgress", ["IpProtocol"]],
+	["AWS::EC2::SecurityGroup", ["SecurityGroupIngress[].IpProtocol", "SecurityGroupEgress[].IpProtocol"]]
+]);
+/**
+* Rewrite the `IpProtocol` at `path` inside `properties`, returning a copy
+* when anything changed and the original object otherwise.
+*
+* `path` is either a plain key (`'IpProtocol'`) or an array-crossing form
+* (`'SecurityGroupIngress[].IpProtocol'`) whose left half names an array
+* whose every element carries the key.
+*/
+function rewriteAtPath(properties, path) {
+	if (properties === null || typeof properties !== "object" || Array.isArray(properties)) return properties;
+	const bag = properties;
+	const arrayMarker = path.indexOf("[].");
+	if (arrayMarker === -1) {
+		if (!(path in bag)) return properties;
+		const next = canonicalizeIpProtocolValue(bag[path]);
+		if (next === bag[path]) return properties;
+		return {
+			...bag,
+			[path]: next
+		};
+	}
+	const arrayKey = path.slice(0, arrayMarker);
+	const elementKey = path.slice(arrayMarker + 3);
+	const list = bag[arrayKey];
+	if (!Array.isArray(list)) return properties;
+	let changed = false;
+	const mapped = list.map((element) => {
+		if (element === null || typeof element !== "object" || Array.isArray(element)) return element;
+		const rule = element;
+		if (!(elementKey in rule)) return element;
+		const next = canonicalizeIpProtocolValue(rule[elementKey]);
+		if (next === rule[elementKey]) return element;
+		changed = true;
+		return {
+			...rule,
+			[elementKey]: next
+		};
+	});
+	if (!changed) return properties;
+	return {
+		...bag,
+		[arrayKey]: mapped
+	};
+}
+/**
+* Canonicalize every `IpProtocol` on BOTH drift-comparison sides for the
+* security-group resource types that carry one.
+*
+* A resource type with no `IpProtocol` is returned untouched, so the caller
+* can invoke this unconditionally.
+*/
+function canonicalizeIpProtocols(baseline, aws, resourceType) {
+	const paths = IP_PROTOCOL_PATHS.get(resourceType);
+	if (paths === void 0) return {
+		baseline,
+		aws
+	};
+	let nextBaseline = baseline;
+	let nextAws = aws;
+	for (const path of paths) {
+		nextBaseline = rewriteAtPath(nextBaseline, path);
+		nextAws = rewriteAtPath(nextAws, path);
+	}
+	return {
+		baseline: nextBaseline,
+		aws: nextAws
+	};
+}
+
 //#endregion
 //#region src/analyzer/drift-cc-api-deny-list.ts
 /**
@@ -53234,7 +53512,8 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 			const baseline = useObserved ? resource.observedProperties : resource.properties ?? {};
 			const observedIgnorePaths = useObserved ? undeclaredEmptyObservedKeys(resource.observedProperties, resource.properties ?? {}) : [];
 			const normalized = await canonicalizePrincipalUniqueIds(baseline, aws, resolvePrincipalUniqueId);
-			const changes = calculateResourceDrift(normalized.baseline, normalized.aws, {
+			const protocolNormalized = canonicalizeIpProtocols(normalized.baseline, normalized.aws, resource.resourceType);
+			const changes = calculateResourceDrift(protocolNormalized.baseline, protocolNormalized.aws, {
 				ignorePaths: observedIgnorePaths.length ? [...ignorePaths, ...observedIgnorePaths] : ignorePaths,
 				unionWalkObjects: useObserved,
 				unorderedPaths
@@ -70984,7 +71263,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.33");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.35");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;