@go-to-k/cdkd 0.282.7 → 0.283.1

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as resolveStateBucketWithDefaultAndSource, A as green, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bt as runDockerForeground, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ct as stringifyValue, D as bold, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as formatResourceLine, En as LocalMigrateError, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as getAccountInfo, Gt as synthesisStatusMessage, H as isTerminationProtectionPropagationError, Hn as withErrorHandling, Ht as AssetManifestLoader, I as ProviderRegistry, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as normalizeAwsTagsToCfn, Jt as resolveApp, K as refStateLookupFromResource, Kt as getDefaultStateBucketName, L as findActionableSilentDrops, Lt as buildDockerImage, M as yellow, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as cyan, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefault, R as findSilentDropProperties, Rt as formatDockerLoginError, S as extractDeploymentEventError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as getDockerImageBySourceHash, V as disableInstanceApiTermination, Vn as normalizeAwsError, Vt as runDockerStreaming, W as cfnRefValueFromPhysicalId, Wt as Synthesizer, X as assertRegionMatch, Xt as resolveCaptureObservedState, Y as resolveExplicitPhysicalId, Yt as resolveAutoAssetStorage, Z as coerceCfnBoolean, Zt as resolveSkipPrefix, _ as createPreDeleteFinalSnapshot, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as s3BucketArn, b as unsupportedFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as derivePartitionAndUrlSuffix, dt as DiffCalculator, en as resolveUseCdkBootstrapAssets, et as readConfigString, f as computeImplicitDeleteEdges, fn as AssemblyReader, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as AwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as resolveBucketRegion, ht as isThrottlingError, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigString, j as red, jn as PartialFailureError, jt as ensureAssetStorage, k as gray, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as requireConfigArray, o as planFailedOps, on as findLargeInlineResources, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as processStackMessages, pt as withRetry, q as WAFv2WebACLProvider, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as requireConfigObject, s as planRollback, sn as uploadCfnTemplate, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as replayWarn, u as withResourceDeadline, un as canonicalizeRegion, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as isStatefulRecreateTargetSync, wn as DeployCancelledError, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xn as CdkdError, xt as shouldRetainResource, y as refusesFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as CloudControlProvider, zt as getDockerCmd } from "./deploy-engine-NA36xDvk.js";
+import { $ as configStringRefusal, $t as resolveStateBucketWithDefaultAndSource, A as green, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bt as runDockerForeground, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ct as stringifyValue, D as bold, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as formatResourceLine, En as LocalMigrateError, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as getAccountInfo, Gt as synthesisStatusMessage, H as isTerminationProtectionPropagationError, Hn as withErrorHandling, Ht as AssetManifestLoader, I as ProviderRegistry, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as normalizeAwsTagsToCfn, Jt as resolveApp, K as refStateLookupFromResource, Kt as getDefaultStateBucketName, L as findActionableSilentDrops, Lt as buildDockerImage, M as yellow, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as cyan, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefault, R as findSilentDropProperties, Rt as formatDockerLoginError, S as extractDeploymentEventError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as getDockerImageBySourceHash, V as disableInstanceApiTermination, Vn as normalizeAwsError, Vt as runDockerStreaming, W as cfnRefValueFromPhysicalId, Wt as Synthesizer, X as assertRegionMatch, Xt as resolveCaptureObservedState, Y as resolveExplicitPhysicalId, Yt as resolveAutoAssetStorage, Z as coerceCfnBoolean, Zt as resolveSkipPrefix, _ as createPreDeleteFinalSnapshot, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as s3BucketArn, b as unsupportedFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as derivePartitionAndUrlSuffix, dt as DiffCalculator, en as resolveUseCdkBootstrapAssets, et as readConfigString, f as computeImplicitDeleteEdges, fn as AssemblyReader, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as AwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as resolveBucketRegion, ht as isThrottlingError, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigString, j as red, jn as PartialFailureError, jt as ensureAssetStorage, k as gray, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as requireConfigArray, o as planFailedOps, on as findLargeInlineResources, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as processStackMessages, pt as withRetry, q as WAFv2WebACLProvider, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as requireConfigObject, s as planRollback, sn as uploadCfnTemplate, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as replayWarn, u as withResourceDeadline, un as canonicalizeRegion, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as isStatefulRecreateTargetSync, wn as DeployCancelledError, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xn as CdkdError, xt as shouldRetainResource, y as refusesFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as CloudControlProvider, zt as getDockerCmd } from "./deploy-engine-InwDI9o0.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-DulIbRCK.js";
+import { t as ASGProvider } from "./asg-provider-R3IdAR_3.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -10,7 +10,7 @@ import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQ
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCodeSigningConfigCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCodeSigningConfigCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, GetRuntimeManagementConfigCommand, LambdaClient, ListTagsCommand, PublishLayerVersionCommand, PutFunctionCodeSigningConfigCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, PutRuntimeManagementConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceNetworkAclAssociationCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
+import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceNetworkAclAssociationCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
 import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeStackEventsCommand, DescribeStackResourcesCommand, DescribeStacksCommand, ExecuteChangeSetCommand, GetTemplateCommand, UpdateStackCommand, waitUntilChangeSetCreateComplete, waitUntilStackDeleteComplete, waitUntilStackImportComplete, waitUntilStackUpdateComplete } from "@aws-sdk/client-cloudformation";
 import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteMethodCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetDeploymentCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
@@ -15484,10 +15484,16 @@ var DynamoDBGlobalTableProvider = class {
 			};
 			if (tableArn) await this.applyTagDiff(tableArn, extractLocalTags(previousProperties), extractLocalTags(properties));
 			const recordedOldBilling = previousProperties["BillingMode"];
-			const recordedOldBillingUsable = recordedOldBilling === void 0 || typeof recordedOldBilling === "string" && recordedOldBilling.trim() !== "";
-			const liveBillingMode = describeResp.Table?.BillingModeSummary?.BillingMode ?? "PROVISIONED";
-			const oldBilling = recordedOldBillingUsable ? recordedOldBilling ?? "PAY_PER_REQUEST" : liveBillingMode;
-			if (!recordedOldBillingUsable) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the recorded previous BillingMode is unusable (${JSON.stringify(recordedOldBilling)}) — using the table's actual billing mode (${oldBilling}) as the comparison baseline for this update so a corrected template does not issue a same-mode UpdateTable.`);
+			const recordedOldBillingAbsent = recordedOldBilling === void 0;
+			const recordedOldBillingUsable = typeof recordedOldBilling === "string" && recordedOldBilling.trim() !== "";
+			const rawLiveBillingMode = describeResp.Table?.BillingModeSummary?.BillingMode;
+			const reportedBillingMode = rawLiveBillingMode === "PROVISIONED" || rawLiveBillingMode === "PAY_PER_REQUEST" ? rawLiveBillingMode : void 0;
+			const liveBillingMode = reportedBillingMode ?? "PROVISIONED";
+			const desiredDeclaresBillingMode = properties["BillingMode"] !== void 0;
+			const seedAbsentFromLive = recordedOldBillingAbsent && desiredDeclaresBillingMode;
+			const oldBilling = recordedOldBillingUsable ? recordedOldBilling : recordedOldBillingAbsent ? seedAbsentFromLive ? liveBillingMode : "PAY_PER_REQUEST" : liveBillingMode;
+			if (!recordedOldBillingUsable && !recordedOldBillingAbsent) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the recorded previous BillingMode is unusable (${JSON.stringify(recordedOldBilling)}) — using the table's actual billing mode (${oldBilling}) as the comparison baseline for this update so a corrected template does not issue a same-mode UpdateTable.`);
+			if (seedAbsentFromLive && oldBilling !== "PAY_PER_REQUEST") this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the cdkd state record declares no BillingMode — using ${oldBilling} as the comparison baseline for this update (${reportedBillingMode !== void 0 ? "the mode DescribeTable reports" : "inferred: DescribeTable reports no BillingModeSummary, which means the table was created without an explicit mode"}), so a template declaring a different mode still applies the flip instead of comparing equal to the create-path default.`);
 			let billingUnusable = false;
 			const requestedBilling = requireConfigString(properties["BillingMode"], "PAY_PER_REQUEST", "AWS::DynamoDB::GlobalTable BillingMode", { onUnusable: (message) => {
 				billingUnusable = true;
@@ -15575,6 +15581,7 @@ var DynamoDBGlobalTableProvider = class {
 				effectiveProperties = { ...effectiveProperties ?? properties };
 				if (recordedOldBilling === void 0) delete effectiveProperties["BillingMode"];
 				else effectiveProperties["BillingMode"] = oldBilling;
+				effectiveProperties = retainUnsendableCapacityMembers(effectiveProperties, previousProperties, newBilling);
 			}
 			const awsOnDemand = describeResp.Table?.OnDemandThroughput;
 			const onDemandPayload = {};
@@ -17533,6 +17540,185 @@ function stripProvisionedCapacityKeys(properties) {
 	return result;
 }
 /**
+* The capacity member keys that can only reach AWS while the table is
+* PROVISIONED, per container level (issue #1738).
+*
+* Identical to the set {@link stripProvisionedCapacityKeys} removes, and that
+* is not a coincidence: both answer "which members are unsendable once the mode
+* is PAY_PER_REQUEST". The two spellings a pre-#1387 cdkd wrote into state
+* (`ProvisionedThroughput` / `ProvisionedThroughputOverride`) are included for
+* the same reason — a state replay is exactly that population.
+*/
+const PROVISIONED_ONLY_CAPACITY_KEYS = {
+	table: ["WriteProvisionedThroughputSettings"],
+	index: [
+		"WriteProvisionedThroughputSettings",
+		"ReadProvisionedThroughputSettings",
+		"ProvisionedThroughput"
+	],
+	replica: ["ReadProvisionedThroughputSettings", "ProvisionedThroughputOverride"],
+	replicaIndex: ["ReadProvisionedThroughputSettings", "ProvisionedThroughputOverride"]
+};
+/**
+* The mirror set: capacity members that can only reach AWS while the table is
+* PAY_PER_REQUEST (issue #1738).
+*
+* `stripProvisionedCapacityKeys` has no equivalent because the create arm it
+* serves always substitutes PAY_PER_REQUEST — the mode under which these ARE
+* sent, which is why its header says they are deliberately not stripped. On the
+* UPDATE path the kept mode can be PROVISIONED, and then it is this half that
+* never leaves the process.
+*/
+const ON_DEMAND_ONLY_CAPACITY_KEYS = {
+	table: ["WriteOnDemandThroughputSettings"],
+	index: [
+		"WriteOnDemandThroughputSettings",
+		"ReadOnDemandThroughputSettings",
+		"OnDemandThroughput"
+	],
+	replica: ["ReadOnDemandThroughputSettings", "OnDemandThroughputOverride"],
+	replicaIndex: ["ReadOnDemandThroughputSettings", "OnDemandThroughputOverride"]
+};
+/**
+* Replace every capacity member the KEPT billing mode cannot send with the
+* PREVIOUS record's value (issue #1738).
+*
+* Called from `update()`'s `BillingMode` warn-and-KEEP arm, where an unusable
+* desired mode suppresses the flip: AWS is left holding the mode it already
+* had, so every block belonging to the OTHER mode was silently dropped on the
+* way out while the engine recorded what the template declared.
+*
+* **The split is per MEMBER against the KEPT mode**, and each side was read off
+* the gates in this file rather than off the member's name-shape (the
+* name-shape trap #1726 records — an on-demand ceiling looks like capacity and
+* goes on the wire under precisely the on-demand mode):
+*
+* - KEPT `PROVISIONED` — the on-demand half is unsendable. Step 3's table-level
+*   `OnDemandThroughput` is gated on `newBilling !== 'PROVISIONED'`;
+*   `toSdkGlobalSecondaryIndexes` and `toSdkReplicaThroughputOverrides` both
+*   drop their on-demand branch under PROVISIONED. The provisioned half is NOT
+*   retained: step 4b and step 6b's auto-scaling reconcile are live whenever
+*   either side is PROVISIONED, and step 6's GSI diff carries per-index
+*   `ProvisionedThroughput` — those blocks really are applied.
+* - KEPT `PAY_PER_REQUEST` — the provisioned half is unsendable. The table-level
+*   `ProvisionedThroughput` rides step 4's flip and nothing else, the two
+*   auto-scaling reconciles are gated on either side being PROVISIONED, and both
+*   translators drop their provisioned branch. The on-demand half is NOT
+*   retained: step 3 sends the table-level ceilings and step 6 the per-index
+*   ones under exactly this mode.
+*
+* One residual is deliberately NOT covered, because the suppression did not
+* create it: the TABLE-level provisioned capacity NUMBER rides step 4's flip
+* and nothing else, so on ANY non-flip PROVISIONED -> PROVISIONED update it is
+* unsent while its `*CapacityAutoScalingSettings` sibling in the same block IS
+* reconciled. Retaining the block wholesale under a kept PROVISIONED mode would
+* therefore erase a real auto-scaling update to hide a pre-existing gap — so
+* the block stays as declared and the gap stays where it already lives.
+*
+* Retaining rather than DROPPING is the UPDATE row of
+* `.claude/rules/providers.md`: the call never ran, so AWS still holds the
+* previously-applied block and that IS what state should describe. Dropping
+* would leave a later template that REMOVES the block deriving no removal, so
+* the live setting would survive forever.
+*
+* **The previous side is VALIDATED before it is retained** (the #1653-review
+* rule) through `asRecord` — the SAME predicate every wire read of these blocks
+* applies, so the two cannot disagree about what a bare string / an array / a
+* number means. Be honest about what that buys: it refuses exactly the
+* not-a-plain-object shapes, and a block whose NUMERIC member is an unresolved
+* intrinsic passes it, because the wire accepts that block too (and then sends
+* nothing for the member, which is the same "AWS keeps what it had" outcome).
+* When the previous side is unusable OR absent the key is DROPPED — there is no
+* value cdkd can vouch for either way.
+*
+* COPIES each retained block one level rather than aliasing it: the rollback
+* executor spreads the returned bag shallowly, so handing back the previous
+* record's own object would leave two state records sharing one mutable value.
+* Scope that claim honestly — it covers the retained blocks only; every other
+* key of the input bag stays aliased, exactly as the sibling arms leave it.
+*
+* Deliberately NOT paired with a `canonicalizeDesiredProperties` twin: this is
+* a SKIP, not a narrowing, so there is no pure function of the desired bag to
+* fold both comparison sides with, and folding one would derive a REMOVAL of a
+* live capacity block from a template whose only fault is `BillingMode`.
+*
+* Pure and non-mutating at every level.
+*/
+function retainUnsendableCapacityMembers(desired, previous, keptBillingMode) {
+	const unsendable = keptBillingMode === "PROVISIONED" ? ON_DEMAND_ONLY_CAPACITY_KEYS : PROVISIONED_ONLY_CAPACITY_KEYS;
+	const result = retainCapacityKeys({ ...desired }, previous, unsendable.table);
+	const indexes = result["GlobalSecondaryIndexes"];
+	if (Array.isArray(indexes)) {
+		const previousIndexes = indexCapacityContainers(previous["GlobalSecondaryIndexes"], "IndexName");
+		result["GlobalSecondaryIndexes"] = indexes.map((entry) => {
+			const gsi = asRecord$1(entry);
+			if (!gsi) return entry;
+			const previousGsi = previousIndexes.get(gsi["IndexName"]);
+			return retainCapacityKeys({ ...gsi }, previousGsi, unsendable.index);
+		});
+	}
+	const replicas = result["Replicas"];
+	if (Array.isArray(replicas)) {
+		const previousReplicas = indexCapacityContainers(previous["Replicas"], "Region");
+		result["Replicas"] = replicas.map((entry) => {
+			const replica = asRecord$1(entry);
+			if (!replica) return entry;
+			const previousReplica = previousReplicas.get(replica["Region"]);
+			const copy = retainCapacityKeys({ ...replica }, previousReplica, unsendable.replica);
+			const replicaIndexes = copy["GlobalSecondaryIndexes"];
+			if (Array.isArray(replicaIndexes)) {
+				const previousReplicaIndexes = indexCapacityContainers(previousReplica?.["GlobalSecondaryIndexes"], "IndexName");
+				const kept = replicaIndexes.map((indexEntry) => {
+					const gsi = asRecord$1(indexEntry);
+					if (!gsi) return indexEntry;
+					const previousGsi = previousReplicaIndexes.get(gsi["IndexName"]);
+					return retainCapacityKeys({ ...gsi }, previousGsi, unsendable.replicaIndex);
+				}).filter((entry) => {
+					const gsi = asRecord$1(entry);
+					if (!gsi) return true;
+					return Object.keys(gsi).some((k) => k !== "IndexName");
+				});
+				if (kept.length > 0) copy["GlobalSecondaryIndexes"] = kept;
+				else delete copy["GlobalSecondaryIndexes"];
+			}
+			return copy;
+		});
+	}
+	return result;
+}
+/**
+* Retain (or drop) one container's unsendable capacity members, in place on a
+* bag the caller already copied.
+*
+* The counterpart container being `undefined` — no matching index / replica in
+* the previous record — is the ABSENT case, not a special one: there is nothing
+* to vouch for, so the key is dropped exactly as it is for an unusable value.
+*/
+function retainCapacityKeys(target, previousContainer, keys) {
+	for (const key of keys) {
+		const previousValue = asRecord$1(previousContainer?.[key]);
+		if (previousValue) target[key] = { ...previousValue };
+		else delete target[key];
+	}
+	return target;
+}
+/**
+* Index a previous-side array by its identity member, so a per-index /
+* per-replica retain reads the counterpart entry rather than the positional
+* one — AWS does not guarantee readback order and a template edit can reorder
+* either list.
+*/
+function indexCapacityContainers(value, identityKey) {
+	const byIdentity = /* @__PURE__ */ new Map();
+	if (!Array.isArray(value)) return byIdentity;
+	for (const entry of value) {
+		const record = asRecord$1(entry);
+		const identity = record?.[identityKey];
+		if (record && typeof identity === "string") byIdentity.set(identity, record);
+	}
+	return byIdentity;
+}
+/**
 * True when a CFn sub-object is nothing but an unresolved intrinsic
 * (`{"Fn::If": […]}` / `{"Ref": …}`), i.e. the template DID declare the block
 * but its value could not be resolved to a shape with members.
@@ -20380,6 +20566,43 @@ const SG_INGRESS_IP_PROTOCOL_DEFAULT = "-1";
 /** The refusal path both the create guard and the canonicalizer report under. */
 const SG_INGRESS_IP_PROTOCOL_PATH = "AWS::EC2::SecurityGroupIngress IpProtocol";
 /**
+* Page ceiling for {@link EC2Provider.lookupIngressRuleId}'s
+* `DescribeSecurityGroupRules` walk (issue #1761).
+*
+* The walk asks for {@link SG_RULE_PAGE_SIZE} rules per page, so 20 pages cover
+* 20,000 rules on a single security group — far beyond any real one (AWS's
+* default quota is 60 rules per SG, 1000 at the maximum quota increase). That
+* arithmetic only holds because the request pins `MaxResults`; without it AWS
+* applies its own default page size and the bound would mean an unknown number
+* of rules. The bound exists only so a pathological / looping `NextToken` cannot
+* hang a deploy; reaching it records nothing rather than answering from a
+* partial view.
+*/
+const MAX_SG_RULE_PAGES = 20;
+/**
+* `MaxResults` for that walk. `DescribeSecurityGroupRules` accepts 5-1000; the
+* ceiling is what makes {@link MAX_SG_RULE_PAGES}'s "20,000 rules" true and
+* keeps the common case (a group with a handful of rules) to ONE round trip.
+*/
+const SG_RULE_PAGE_SIZE = 1e3;
+/**
+* The `sgr-…` security-group rule id, anchored.
+*
+* The twin of `SG_RULE_ID_PATTERN` in `src/cli/commands/export.ts`, restated
+* rather than imported for the same reason that file restates
+* `ROUTE_DESTINATION_KEYS` instead of importing it from here: neither module may
+* pull the other's graph (the export command would drag in this provider and its
+* SDK client).
+*
+* Anchoring is what discriminates. `startsWith('sgr-')` also accepts
+* `sgr-0abc|tcp|443|443` — a composite wearing the identifier's prefix — which
+* on the import path reaches AWS as a malformed id and raises
+* `InvalidSecurityGroupRuleId.Malformed`, an error `isNotFoundError` does not
+* match, so `verifyExplicit` would THROW and abort the whole `cdkd import` run
+* instead of declining that one row.
+*/
+const SG_RULE_ID_PATTERN$1 = /^sgr-[0-9a-f]+$/;
+/**
 * Resolve the `IpProtocol` an `AWS::EC2::SecurityGroupIngress` rule actually
 * SENDS, plus the bag that describes it (issue #1633).
 *
@@ -21713,25 +21936,29 @@ var EC2Provider = class {
 			}
 		], onUnusableProtocol ? { onRefusal: onUnusableProtocol } : void 0);
 		try {
-			await this.ec2Client.send(new AuthorizeSecurityGroupIngressCommand({
+			const ruleId = singleSecurityGroupRuleId((await this.ec2Client.send(new AuthorizeSecurityGroupIngressCommand({
 				GroupId: groupId,
 				IpPermissions: [{
 					...this.buildIpPermission(properties),
 					IpProtocol: ipProtocol
 				}]
-			}));
+			}))).SecurityGroupRules);
 			this.logger.debug(`Successfully created SecurityGroupIngress ${logicalId}: ${physicalId}`);
 			return {
 				physicalId,
-				attributes: {},
+				attributes: ruleId ? { Id: ruleId } : {},
 				...effectiveProperties && { effectiveProperties }
 			};
 		} catch (error) {
 			if (error instanceof Error && error.message.includes("already exists")) {
 				this.logger.debug(`SecurityGroupIngress ${logicalId} already exists, treating as success`);
+				const existingRuleId = await this.lookupIngressRuleId(logicalId, groupId, {
+					...properties,
+					IpProtocol: ipProtocol
+				});
 				return {
 					physicalId,
-					attributes: {},
+					attributes: existingRuleId ? { Id: existingRuleId } : {},
 					...effectiveProperties && { effectiveProperties }
 				};
 			}
@@ -21739,6 +21966,70 @@ var EC2Provider = class {
 			throw new ProvisioningError(`Failed to create SecurityGroupIngress ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
+	/**
+	* Best-effort lookup of the `sgr-...` id of an ALREADY-EXISTING ingress rule
+	* (issue #1761).
+	*
+	* Only the idempotent "already exists" arm of {@link createSecurityGroupIngress}
+	* calls this: the successful arm reads the id straight off
+	* `AuthorizeSecurityGroupIngress`'s own response, which is what keeps the
+	* mutating path free of the issue #1710 orphan hazard.
+	*
+	* **Never throws.** A `DescribeSecurityGroupRules` failure (permissions,
+	* throttle, a rule that no longer matches) degrades to `undefined`, which
+	* records no attribute — `cdkd export` then refuses that one resource with
+	* its own actionable message, which is strictly better than failing a deploy
+	* that AWS already considers satisfied.
+	*
+	* Returns a value only when EXACTLY ONE non-egress rule on the group matches
+	* the requested `(protocol, ports, source)` triple. Zero matches means the
+	* "already exists" error came from a rule cdkd cannot pin down; two or more
+	* means the identifier would be ambiguous, and adopting an ambiguous id is
+	* the #1658 failure mode (a state row that looks adopted but names the wrong
+	* AWS object).
+	*
+	* **Paginated, unlike every other `Describe*` in this file.** That is not an
+	* inconsistency to tidy away: the "exactly one" verdict above is a statement
+	* about the WHOLE group, so a truncated first page turns a genuine 2-match
+	* into a false "exactly one" and records the wrong `sgr-` id — the precise
+	* outcome the ambiguity fence exists to prevent. A group can hold thousands
+	* of rules (the account-level quota is per-SG, not per-page), so truncation
+	* is reachable. `MAX_SG_RULE_PAGES` bounds the walk; exhausting it is treated
+	* as "could not see the whole group" and records nothing, same as a throw.
+	*/
+	async lookupIngressRuleId(logicalId, groupId, properties) {
+		try {
+			const rules = [];
+			let nextToken;
+			let pages = 0;
+			do {
+				if (pages >= MAX_SG_RULE_PAGES) {
+					this.logger.debug(`SecurityGroupIngress ${logicalId}: DescribeSecurityGroupRules on ${groupId} still paginating after ${MAX_SG_RULE_PAGES} pages — cannot prove the match is unique, so not recording an Id attribute`);
+					return;
+				}
+				const resp = await this.ec2Client.send(new DescribeSecurityGroupRulesCommand({
+					Filters: [{
+						Name: "group-id",
+						Values: [groupId]
+					}],
+					MaxResults: SG_RULE_PAGE_SIZE,
+					...nextToken && { NextToken: nextToken }
+				}));
+				rules.push(...resp.SecurityGroupRules ?? []);
+				nextToken = resp.NextToken;
+				pages += 1;
+			} while (nextToken);
+			const ids = rules.filter((rule) => rule.IsEgress !== true && securityGroupRuleMatchesCfnIngress(rule, properties)).map((rule) => rule.SecurityGroupRuleId).filter((id) => typeof id === "string" && id.trim() !== "");
+			if (ids.length !== 1) {
+				this.logger.debug(`SecurityGroupIngress ${logicalId}: ${ids.length} existing rule(s) on ${groupId} match the requested protocol/ports/source — not recording an Id attribute`);
+				return;
+			}
+			return ids[0];
+		} catch (error) {
+			this.logger.debug(`SecurityGroupIngress ${logicalId}: could not look up the existing rule id on ${groupId} (${error instanceof Error ? error.message : String(error)}) — not recording an Id attribute`);
+			return;
+		}
+	}
 	async updateSecurityGroupIngress(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating SecurityGroupIngress ${logicalId}: ${physicalId}`);
 		if (JSON.stringify(properties) === JSON.stringify(previousProperties)) return {
@@ -22681,13 +22972,28 @@ var EC2Provider = class {
 	/**
 	* Adopt an existing EC2 networking resource into cdkd state.
 	*
-	* Supported types: `AWS::EC2::VPC`, `AWS::EC2::Subnet`,
-	* `AWS::EC2::SecurityGroup`. Other EC2 types this provider creates
-	* (RouteTable, Route, InternetGateway, VPCGatewayAttachment,
-	* NetworkAcl, Instance) return `null` from import — most have no
-	* stable identity to look up by tag (Routes are derived; SGIngress
-	* is rule-level), and the typical adoption story is "find the VPC,
-	* cdkd reconstructs the rest at deploy time".
+	* Every arm here is OVERRIDE-ONLY: `import()` returns `null` unless the
+	* caller passed `--resource <logicalId>=<physicalId>`, and `verifyExplicit`
+	* then confirms that id against AWS. Supported types:
+	*
+	* - `AWS::EC2::VPC`, `AWS::EC2::Subnet`, `AWS::EC2::SecurityGroup` — verified
+	*   by id, recorded verbatim with no attributes.
+	* - `AWS::EC2::NatGateway` — verified by id, ignoring a gateway already in
+	*   `deleted` / `deleting` state.
+	* - `AWS::EC2::EIP` — accepts an allocation id, a public IP, or the composite
+	*   `<publicIp>|<allocationId>`, and records the composite plus the
+	*   `AllocationId` / `PublicIp` attributes.
+	* - `AWS::EC2::SecurityGroupIngress` — accepts the `sgr-...` rule id
+	*   (CloudFormation's own identifier for the type), declines an EGRESS rule
+	*   id, and records cdkd's composite `<groupId>|<ipProtocol>|<fromPort>|<toPort>`
+	*   plus the rule id as the `Id` attribute (issue #1761).
+	*
+	* The remaining EC2 types this provider creates (RouteTable, Route,
+	* InternetGateway, VPCGatewayAttachment, NetworkAcl, NetworkAclEntry,
+	* SubnetRouteTableAssociation, SubnetNetworkAclAssociation, Instance) return
+	* `null` — Routes and associations are derived from their parent, and the
+	* typical adoption story is "find the VPC, cdkd reconstructs the rest at
+	* deploy time".
 	*
 	* There is no `aws:cdk:path` tag lookup: AWS rejects `aws:`-prefixed tag
 	* writes, so that tag never exists on a real resource and a
@@ -23273,6 +23579,39 @@ var EC2Provider = class {
 					physicalId,
 					attributes: {}
 				} : null;
+				case "AWS::EC2::SecurityGroupIngress": {
+					if (!SG_RULE_ID_PATTERN$1.test(physicalId)) return null;
+					const rule = (await this.ec2Client.send(new DescribeSecurityGroupRulesCommand({ SecurityGroupRuleIds: [physicalId] }))).SecurityGroupRules?.[0];
+					if (!rule || rule.IsEgress === true) return null;
+					if (!rule.GroupId || !rule.IpProtocol || !rule.SecurityGroupRuleId) return null;
+					const segments = [
+						{
+							name: "groupId",
+							value: rule.GroupId
+						},
+						{
+							name: "ipProtocol",
+							value: rule.IpProtocol
+						},
+						{
+							name: "fromPort",
+							value: rule.FromPort ?? "-1"
+						},
+						{
+							name: "toPort",
+							value: rule.ToPort ?? "-1"
+						}
+					];
+					const refusal = compositeIdSeparatorRefusal("AWS::EC2::SecurityGroupIngress", logicalId, segments);
+					if (refusal !== void 0) {
+						this.logger.warn(`${refusal} Skipping import.`);
+						return null;
+					}
+					return {
+						physicalId: packCompositeId("AWS::EC2::SecurityGroupIngress", logicalId, segments),
+						attributes: { Id: rule.SecurityGroupRuleId }
+					};
+				}
 				case "AWS::EC2::NatGateway": return (await this.ec2Client.send(new DescribeNatGatewaysCommand({ NatGatewayIds: [physicalId] }))).NatGateways?.find((g) => g.State !== "deleted" && g.State !== "deleting") ? {
 					physicalId,
 					attributes: {}
@@ -23393,6 +23732,93 @@ function flattenIpPermissions(perms, direction) {
 function sgProtocolKey(value) {
 	return canonicalizeIpProtocolValue(value ?? "-1");
 }
+/**
+* The single `sgr-...` id an `AuthorizeSecurityGroupIngress` response reports
+* for a standalone `AWS::EC2::SecurityGroupIngress` (issue #1761).
+*
+* Pure by design: {@link EC2Provider.createSecurityGroupIngress} calls it
+* between the mutating Authorize and its return, where an `await` of anything
+* that can throw would re-create the issue #1710 orphan class.
+*
+* `undefined` unless the response carries EXACTLY ONE rule id. AWS mints one
+* rule per source entry, and cdkd sends one `IpPermission` per CFn resource —
+* but a template declaring both `CidrIp` and `CidrIpv6` on the same ingress
+* resource makes `buildIpPermission` emit two sources and AWS answers with two
+* rules. Neither is "the" CloudFormation identifier for the resource, so
+* recording nothing (and letting `cdkd export` refuse with its own message) is
+* the only answer that cannot silently name the wrong rule.
+*/
+function singleSecurityGroupRuleId(rules) {
+	const ids = (rules ?? []).map((rule) => rule.SecurityGroupRuleId).filter((id) => typeof id === "string" && id.trim() !== "");
+	return ids.length === 1 ? ids[0] : void 0;
+}
+/**
+* A CFn `FromPort` / `ToPort` in the NUMBER form `DescribeSecurityGroupRules`
+* reports, for {@link securityGroupRuleMatchesCfnIngress}'s compare.
+*
+* An identity compare against `properties['FromPort'] as number` was wrong for
+* the same reason issue #1513 documents one property over: a YAML / JSON
+* template may spell a port as the STRING `"443"`, and `buildIpPermission`
+* passes it through to AWS unchanged, so such a rule deploys fine and would
+* then never match its own AWS-side row.
+*
+* Absent, `null`, and blank (INCLUDING whitespace-only) are AWS's `-1`, "all
+* ports". Everything that is not a number or a numeric string is `NaN`, which
+* compares unequal to everything — so the lookup records nothing rather than
+* matching some unrelated rule.
+*
+* A bare `Number(value)` was NOT enough for that last sentence, which an earlier
+* cut of this function claimed anyway: `Number` maps `' '` and `[]` to `0`,
+* `true` to `1`, and `['443']` to `443`. A whitespace-only port would then have
+* matched an ICMP **type-0** rule — a different rule, silently recorded — which
+* is the exact outcome the claim promised it could not produce.
+*/
+function cfnIngressPortValue(value) {
+	if (value === void 0 || value === null) return -1;
+	if (typeof value === "number") return Number.isFinite(value) ? value : NaN;
+	if (typeof value === "string") {
+		const trimmed = value.trim();
+		if (trimmed === "") return -1;
+		const parsed = Number(trimmed);
+		return Number.isFinite(parsed) ? parsed : NaN;
+	}
+	return NaN;
+}
+/**
+* Does a `DescribeSecurityGroupRules` rule describe the same ingress rule the
+* given CFn `AWS::EC2::SecurityGroupIngress` properties ask for?
+*
+* Deliberately NOT expressed via {@link sgRuleKey}: that key includes
+* `SourceSecurityGroupOwnerId` and `Description`, both of which AWS fills in on
+* the read side even when the template omits them, so a whole-key compare
+* would report "no match" for the ordinary same-account SG-to-SG rule this
+* lookup exists to find. Matching the fields the template actually pins —
+* protocol, port range, and whichever ONE source key it declares — is what
+* makes the comparison decidable from a partial template.
+*
+* The protocol goes through {@link sgProtocolKey} on BOTH sides, not a raw
+* compare: AWS substitutes the canonical NAME for the four protocols that have
+* one, so a template declaring `IpProtocol: 6` (or `'6'`) is read back as
+* `'tcp'` and would otherwise match nothing (the issue #1643 fold, one call site
+* further along).
+*
+* Ports are compared with AWS's own `-1` ("all") spelling on both sides, since
+* an omitted `FromPort` / `ToPort` reads back as `-1`, and the template side is
+* NUMERICALLY coerced — see {@link cfnIngressPortValue}.
+*/
+function securityGroupRuleMatchesCfnIngress(rule, properties) {
+	if (sgProtocolKey(rule.IpProtocol) !== sgProtocolKey(properties["IpProtocol"])) return false;
+	if ((rule.FromPort ?? -1) !== cfnIngressPortValue(properties["FromPort"])) return false;
+	if ((rule.ToPort ?? -1) !== cfnIngressPortValue(properties["ToPort"])) return false;
+	const sources = [
+		[properties["CidrIp"], rule.CidrIpv4],
+		[properties["CidrIpv6"], rule.CidrIpv6],
+		[properties["SourceSecurityGroupId"], rule.ReferencedGroupInfo?.GroupId],
+		[properties["SourcePrefixListId"], rule.PrefixListId]
+	];
+	for (const [declared, actual] of sources) if (declared !== void 0 && declared !== null && declared !== actual) return false;
+	return true;
+}
 function sgRuleKey(rule, direction) {
 	const peerKey = direction === "egress" ? rule["DestinationSecurityGroupId"] : rule["SourceSecurityGroupId"];
 	const prefixKey = direction === "egress" ? rule["DestinationPrefixListId"] : rule["SourcePrefixListId"];
@@ -59473,7 +59899,7 @@ function readStringProperty(properties, key, resourceType) {
 * entry reads the value cdkd recorded in state (`attributes`), and refuses when
 * it is absent rather than guessing.
 *
-* ## Live measurement (us-east-1, 2026-08-13)
+* ## Live measurement (us-east-1, 2026-08-13; the SG-ingress row 2026-08-14)
 *
 * Every field below is BOTH the type's single-field `primaryIdentifier` AND
 * `readOnlyProperties`, which is why each resolution returns an EMPTY
@@ -59485,7 +59911,19 @@ function readStringProperty(properties, key, resourceType) {
 * | `AWS::AppSync::DataSource` | `DataSourceArn` | `attributes.DataSourceArn` |
 * | `AWS::AppSync::Resolver` | `ResolverArn` | `attributes.ResolverArn` |
 * | `AWS::S3Tables::Table` | `TableARN` | `attributes.TableARN` |
-* | `AWS::EC2::SecurityGroupIngress` | `Id` | NOTHING (issue #1761) |
+* | `AWS::EC2::SecurityGroupIngress` | `Id` | `attributes.Id` (issue #1761) |
+*
+* The SG-ingress row is measured the same way as the rest, and separately
+* against a real CloudFormation stack because the three strings that name one
+* resource can disagree (issue #1771 found CFn reporting an EIP as the bare
+* public IP while Cloud Control reports the composite, and the two disagreeing
+* on field ORDER for `AWS::EC2::VPCGatewayAttachment`). For this type they all
+* AGREE: `describe-type` says `primaryIdentifier` / `readOnlyProperties` are
+* both exactly `["/properties/Id"]` with a full `create`/`delete`/`list`/
+* `read`/`update` handler set and `ProvisioningType: FULLY_MUTABLE`, and a live
+* stack carrying a standalone ingress rule reports `PhysicalResourceId`
+* `sgr-02345615af6d2db0d`, with `Ref` and `Fn::GetAtt .Id` both returning that
+* same value.
 *
 * All four declare a `read` handler, so CFn genuinely does accept them for
 * IMPORT — unlike `AWS::Glue::Table`, the type issue #1659's title names, which
@@ -59510,13 +59948,70 @@ const COMPOSITE_PHYSICAL_ID_IDENTIFIERS = {
 		physicalIdShape: "<tableBucketARN>|<namespace>|<name>",
 		arnServiceSegment: "s3tables"
 	}),
-	"AWS::EC2::SecurityGroupIngress": {
+	"AWS::EC2::SecurityGroupIngress": recordedRuleIdIdentifier()
+};
+/**
+* The `sgr-…` shape, anchored. Shape-only — the hex body's LENGTH is not
+* pinned, because this exists to tell the identifier apart from the two other
+* strings that can sit in the same state row, not to validate an id AWS itself
+* minted:
+*
+*  - cdkd's own composite physicalId, which starts `sg-` (the parent group) and
+*    carries `|` separators; and
+*  - a bare `sg-…` group id, which a hand-edited row could put under
+*    `attributes.Id`.
+*
+* Anchoring is what does the discriminating: `^sgr-[0-9a-f]+$` cannot match
+* either, because `|` and the composite's trailing segments have nowhere to go.
+* A bare `startsWith('sgr-')` would accept `sgr-abc|tcp|443|443`.
+*
+* Measured live (us-east-1, 2026-08-14) from a CloudFormation stack carrying a
+* standalone ingress rule: `PhysicalResourceId` = `sgr-02345615af6d2db0d`, and
+* both `Ref` and `Fn::GetAtt .Id` return that same value.
+*/
+const SG_RULE_ID_PATTERN = /^sgr-[0-9a-f]+$/;
+/**
+* The {@link CompositePhysicalIdIdentifier} for `AWS::EC2::SecurityGroupIngress`.
+*
+* The `recordedArnIdentifier` sibling of the family, differing only in that the
+* identifier is an `sgr-` rule id rather than an ARN — so it gets its own
+* builder rather than an `isUsable` callback threaded through that one, which
+* would make the ARN family's every message ("which is not a <service> ARN",
+* "so cdkd records <field>") conditional on a shape it no longer owns.
+*
+* Two accepted sources, validated by the SAME predicate — the point #1771
+* made about the EIP splitter's segment binding applies here verbatim:
+* validating one side is not a discriminator.
+*
+* 1. `attributes.Id`, which every writer produces today — a fresh deploy, a
+*    `cdkd import --resource <logicalId>=sgr-…`, and the recursive
+*    `--migrate-from-cloudformation` walk (which hands CFn's
+*    `PhysicalResourceId` to `EC2Provider.import` as `knownPhysicalId`, and
+*    that value IS the `sgr-` id — measured above).
+* 2. A physicalId that is ALREADY the bare rule id. **No cdkd path writes this
+*    shape today** — unlike `AWS::S3Tables::Table`, whose Cloud-Control import
+*    genuinely records the bare ARN — so it is accepted defensively rather than
+*    because it is live: CFn's `PhysicalResourceId` for the type is exactly
+*    this string, so a row hand-repaired from a CFn console listing, or written
+*    by some future Cloud-Control routing of the type, carries an unambiguous
+*    identifier that it would be perverse to refuse. Such a row is separately
+*    BROKEN for `cdkd destroy` (`deleteSecurityGroupIngress` needs the 4-part
+*    tuple), which is another reason to let the export hand it to CFn rather
+*    than strand it.
+*/
+function recordedRuleIdIdentifier() {
+	const isUsableIdentifier = (value) => SG_RULE_ID_PATTERN.test(value.trim());
+	return {
 		field: "Id",
-		resolve: ({ logicalId }) => {
-			throw new Error(`cdkd's physical id for AWS::EC2::SecurityGroupIngress is the composite '<groupId>|<ipProtocol>|<fromPort>|<toPort>', but CloudFormation IMPORT identifies the rule by the 'sgr-...' security-group rule id AWS assigns, which cdkd does not record in state (tracked in https://github.com/go-to-k/cdkd/issues/1761). Remove '${logicalId}' from the stack before exporting (the rule stays in AWS and can be re-declared in CloudFormation afterwards), or destroy it first and let CloudFormation create it fresh.`);
+		resolve: ({ logicalId, physicalId, attributes }) => {
+			const recorded = attributes["Id"];
+			if (typeof recorded === "string" && isUsableIdentifier(recorded)) return recorded.trim();
+			if (isUsableIdentifier(physicalId)) return physicalId.trim();
+			const recordedNote = typeof recorded === "string" && recorded.trim() ? `attributes.Id is recorded as '${recorded.trim()}', which is not an 'sgr-…' security-group rule id` : `attributes.Id is missing or empty`;
+			throw new Error(`cdkd's physical id for AWS::EC2::SecurityGroupIngress is the composite '<groupId>|<ipProtocol>|<fromPort>|<toPort>', but CloudFormation IMPORT identifies the rule by the 'sgr-...' security-group rule id AWS assigns, which cdkd state does not record usably for '${logicalId}' (${recordedNote}). Two causes, with different remedies. (1) The rule declares MORE THAN ONE source — e.g. both CidrIp and CidrIpv6 on the same resource — so AWS minted one rule per source and cdkd deliberately recorded neither id, because neither is 'the' identifier for this resource. Re-deploying does not help; split it into one AWS::EC2::SecurityGroupIngress resource per source, which is also the shape CloudFormation will manage after the export. (2) Otherwise the rule was deployed by a cdkd older than https://github.com/go-to-k/cdkd/issues/1761, which did not record the id at all. AWS returns it only from AuthorizeSecurityGroupIngress itself, so a no-op re-deploy will NOT heal the record either: change any property of the rule (cdkd revokes and re-authorizes, minting a fresh id, with a momentary traffic interruption) or destroy and re-deploy it, then re-run cdkd export. In both cases you can instead remove '${logicalId}' from the stack before exporting — the rule stays in AWS and can be re-declared in CloudFormation afterwards.`);
 		}
-	}
-};
+	};
+}
 /**
 * Build the {@link CompositePhysicalIdIdentifier} for a type whose CFn
 * identifier is an ARN cdkd records in `attributes` under the SAME name as the
@@ -75943,7 +76438,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.282.7");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.1");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;