@go-to-k/cdkd 0.283.24 → 0.283.26

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as resolveCaptureObservedState, A as cyan, An as LocalStartServiceError, At as rewriteTemplateAssetReferences, B as findSilentDropProperties, Bt as buildDockerImage, C as makeCanonicalizePropertiesFn, Ct as shouldRetainResource, D as renderStatefulReason, Dn as DeployCancelledError, Dt as buildAssetRedirectMap, E as isStatefulRecreateTargetSync, Et as WorkGraph, F as IAMRoleProvider, Fn as ProvisioningError, Ft as getBootstrapMarkerKey, G as IntrinsicFunctionResolver, Gn as withErrorHandling, Gt as AssetManifestLoader, H as slowCcOperationTimeoutMs, Ht as getDockerCmd, I as collectInlinePolicyNamesManagedBySiblings, In as ResourceTimeoutError, It as parseBootstrapMarker, J as refStateLookupFromResource, Jn as isThrottlingError, Jt as synthesisStatusMessage, K as cfnRefValueFromPhysicalId, Kn as isMarkedNonRetryable, Kt as getDockerImageBySourceHash, L as clearOnUpdateRemoval, Ln as ResourceUpdateNotSupportedError, Lt as validateAssetBucketName, M as green, Mn as MissingCdkCliError, Mt as AssetModeResolver, N as red, Nn as NestedStackChildDirectDestroyError, Nt as BOOTSTRAP_MARKER_PREFIX, O as formatResourceLine, On as LocalInvokeBuildError$1, Ot as createAssetRedirectResolver, P as yellow, Pn as PartialFailureError, Pt as ensureAssetStorage, Q as assertRegionMatch, Qt as resolveAutoAssetStorage, R as ProviderRegistry, Rn as StackHasActiveImportsError, Rt as validateContainerRepoName, S as unsupportedFinalSnapshotError, Sn as setAwsClients, St as rebuildClientForBucketRegion, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tt as stringifyValue, U as disableInstanceApiTermination, Ut as runDockerForeground, V as CloudControlProvider, Vt as formatDockerLoginError, W as isTerminationProtectionPropagationError, Wn as normalizeAwsError, Wt as runDockerStreaming, X as normalizeAwsTagsToCfn, Xt as getLegacyStateBucketName, Y as WAFv2WebACLProvider, Yn as markNonRetryable, Yt as getDefaultStateBucketName, Z as resolveExplicitPhysicalId, Zt as resolveApp, _ as buildFinalSnapshotIdentifier, _t as withRetry, a as DeploymentEventsStore, an as warnDeprecatedNoPrefixCliFlag, at as requireConfigObject, b as isFinalSnapshotError, bn as getAwsClients, bt as LockManager, c as replayFailedOperations, cn as MIGRATE_TMP_PREFIX, ct as scrubResourceRecord, d as deleteSkipReason, dn as expectedOwnerParam, dt as s3BucketDualStackDomainName, en as resolveSkipPrefix, et as configBooleanRefusal, f as withResourceDeadline, fn as PARTITION_TABLE, ft as s3BucketRegionalDomainName, g as PRE_DELETE_SNAPSHOT_TYPES, gn as processStackMessages, gt as describeTypeWithThrottleRetry, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as AssemblyReader, ht as DiffCalculator, i as DeploymentEventsReader, in as stateBucketExistenceConfirmed, it as requireConfigArray, j as gray, jt as escapeRegExp, k as bold, kn as LocalMigrateError, kt as loadPublishableAssetManifest, l as replayRollback, ln as findLargeInlineResources, lt as s3BucketArn, m as computeImplicitDeleteEdges, mn as derivePartitionAndUrlSuffix, mt as applyRoleArnIfSet, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveStateBucketWithDefaultAndSource, nt as readConfigString, o as planFailedOps, on as CFN_TEMPLATE_BODY_LIMIT, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as canonicalizeRegion, pt as s3BucketWebsiteUrl, q as getAccountInfo, qn as isRetryableTransientError, qt as Synthesizer, r as DeployEngine, rn as resolveUseCdkBootstrapAssets, rt as replayWarn, s as planRollback, sn as CFN_TEMPLATE_URL_LIMIT, st as redactSecretsForState, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveStateBucketWithDefault, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as uploadCfnTemplate, ut as s3BucketDomainName, v as ccRoutedFinalSnapshotError, vn as resolveBucketRegion, vt as DagBuilder, w as extractDeploymentEventError, wn as CdkdError, wt as AssetPublisher, x as refusesFinalSnapshot, xn as resetAwsClients, xt as S3StateBackend, y as createPreDeleteFinalSnapshot, yn as AwsClients, yt as TemplateParser, z as findActionableSilentDrops, zn as StackTerminationProtectionError, zt as buildDenyExternalAccessPolicy } from "./deploy-engine-Cu6OO-8t.js";
+import { $ as coerceCfnBoolean, $t as resolveAutoAssetStorage, A as cyan, An as LocalMigrateError, At as loadPublishableAssetManifest, B as findSilentDropProperties, Bn as StackTerminationProtectionError, Bt as buildDenyExternalAccessPolicy, C as makeCanonicalizePropertiesFn, Cn as setAwsClients, Ct as rebuildClientForBucketRegion, D as renderStatefulReason, Dt as WorkGraph, E as isStatefulRecreateTargetSync, Et as stringifyValue, F as IAMRoleProvider, Fn as PartialFailureError, Ft as ensureAssetStorage, G as IntrinsicFunctionResolver, Gn as normalizeAwsError, Gt as runDockerStreaming, H as slowCcOperationTimeoutMs, Ht as formatDockerLoginError, I as collectInlinePolicyNamesManagedBySiblings, In as ProvisioningError, It as getBootstrapMarkerKey, J as refStateLookupFromResource, Jn as isRetryableTransientError, Jt as Synthesizer, K as cfnRefValueFromPhysicalId, Kn as withErrorHandling, Kt as AssetManifestLoader, L as clearOnUpdateRemoval, Ln as ResourceTimeoutError, Lt as parseBootstrapMarker, M as green, Mt as escapeRegExp, N as red, Nn as MissingCdkCliError, Nt as AssetModeResolver, O as formatResourceLine, On as DeployCancelledError, Ot as buildAssetRedirectMap, P as yellow, Pn as NestedStackChildDirectDestroyError, Pt as BOOTSTRAP_MARKER_PREFIX, Q as assertRegionMatch, Qt as resolveApp, R as ProviderRegistry, Rn as ResourceUpdateNotSupportedError, Rt as validateAssetBucketName, S as unsupportedFinalSnapshotError, Sn as resetAwsClients, St as S3StateBackend, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as CdkdError, Tt as AssetPublisher, U as disableInstanceApiTermination, Ut as getDockerCmd, V as CloudControlProvider, Vt as buildDockerImage, W as isTerminationProtectionPropagationError, Wt as runDockerForeground, X as normalizeAwsTagsToCfn, Xn as markNonRetryable, Xt as getDefaultStateBucketName, Y as WAFv2WebACLProvider, Yn as isThrottlingError, Yt as synthesisStatusMessage, Z as resolveExplicitPhysicalId, Zt as getLegacyStateBucketName, _ as buildFinalSnapshotIdentifier, _n as processStackMessages, _t as describeTypeWithThrottleRetry, a as DeploymentEventsStore, an as stateBucketExistenceConfirmed, at as requireConfigObject, b as isFinalSnapshotError, bn as AwsClients, bt as TemplateParser, c as replayFailedOperations, cn as CFN_TEMPLATE_URL_LIMIT, ct as redactSecretsForState, d as deleteSkipReason, dn as uploadCfnTemplate, dt as s3BucketDomainName, en as resolveCaptureObservedState, et as configBooleanRefusal, f as withResourceDeadline, fn as expectedOwnerParam, ft as s3BucketDualStackDomainName, g as PRE_DELETE_SNAPSHOT_TYPES, gn as AssemblyReader, gt as DiffCalculator, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as derivePartitionAndUrlSuffix, ht as applyRoleArnIfSet, i as DeploymentEventsReader, in as resolveUseCdkBootstrapAssets, it as requireConfigArray, j as gray, jn as LocalStartServiceError, jt as rewriteTemplateAssetReferences, k as bold, kn as LocalInvokeBuildError$1, kt as createAssetRedirectResolver, l as replayRollback, ln as MIGRATE_TMP_PREFIX, lt as scrubResourceRecord, m as computeImplicitDeleteEdges, mn as canonicalizeRegion, mt as s3BucketWebsiteUrl, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveStateBucketWithDefault, nt as readConfigString, o as planFailedOps, on as warnDeprecatedNoPrefixCliFlag, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as PARTITION_TABLE, pt as s3BucketRegionalDomainName, q as getAccountInfo, qn as isMarkedNonRetryable, qt as getDockerImageBySourceHash, r as DeployEngine, rn as resolveStateBucketWithDefaultAndSource, rt as replayWarn, s as planRollback, sn as CFN_TEMPLATE_BODY_LIMIT, st as TEMPLATE_SOURCED_READBACK_RULES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveSkipPrefix, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as findLargeInlineResources, ut as s3BucketArn, v as ccRoutedFinalSnapshotError, vt as withRetry, w as extractDeploymentEventError, wt as shouldRetainResource, x as refusesFinalSnapshot, xn as getAwsClients, xt as LockManager, y as createPreDeleteFinalSnapshot, yn as resolveBucketRegion, yt as DagBuilder, z as findActionableSilentDrops, zn as StackHasActiveImportsError, zt as validateContainerRepoName } from "./deploy-engine-B6z9CCAL.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-C9Mq493c.js";
+import { t as ASGProvider } from "./asg-provider-CshsD-Pi.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -21914,13 +21914,13 @@ const SG_INGRESS_IP_PROTOCOL_PATH = "AWS::EC2::SecurityGroupIngress IpProtocol";
 * hang a deploy; reaching it records nothing rather than answering from a
 * partial view.
 */
-const MAX_SG_RULE_PAGES = 20;
+const MAX_SG_RULE_PAGES$1 = 20;
 /**
 * `MaxResults` for that walk. `DescribeSecurityGroupRules` accepts 5-1000; the
 * ceiling is what makes {@link MAX_SG_RULE_PAGES}'s "20,000 rules" true and
 * keeps the common case (a group with a handful of rules) to ONE round trip.
 */
-const SG_RULE_PAGE_SIZE = 1e3;
+const SG_RULE_PAGE_SIZE$1 = 1e3;
 /**
 * The `sgr-…` security-group rule id, anchored.
 *
@@ -23339,8 +23339,8 @@ var EC2Provider = class {
 			let nextToken;
 			let pages = 0;
 			do {
-				if (pages >= MAX_SG_RULE_PAGES) {
-					this.logger.debug(`SecurityGroupIngress ${logicalId}: DescribeSecurityGroupRules on ${groupId} still paginating after ${MAX_SG_RULE_PAGES} pages — cannot prove the match is unique, so not recording an Id attribute`);
+				if (pages >= MAX_SG_RULE_PAGES$1) {
+					this.logger.debug(`SecurityGroupIngress ${logicalId}: DescribeSecurityGroupRules on ${groupId} still paginating after ${MAX_SG_RULE_PAGES$1} pages — cannot prove the match is unique, so not recording an Id attribute`);
 					return;
 				}
 				const resp = await this.ec2Client.send(new DescribeSecurityGroupRulesCommand({
@@ -23348,7 +23348,7 @@ var EC2Provider = class {
 						Name: "group-id",
 						Values: [groupId]
 					}],
-					MaxResults: SG_RULE_PAGE_SIZE,
+					MaxResults: SG_RULE_PAGE_SIZE$1,
 					...nextToken && { NextToken: nextToken }
 				}));
 				rules.push(...resp.SecurityGroupRules ?? []);
@@ -58412,7 +58412,9 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		}
 		const state = loaded.state;
 		const perResourceSecrets = /* @__PURE__ */ new Map();
+		const perResourceTemplateProps = /* @__PURE__ */ new Map();
 		const outputSecrets = /* @__PURE__ */ new Map();
+		const outputsTemplateSource = {};
 		const resolver = new IntrinsicFunctionResolver(region);
 		let parameters = {};
 		let conditions = {};
@@ -58450,11 +58452,15 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				logger.debug(`Resolution of ${logicalId} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`);
 			}
 			if (recordedSecretValues.size > 0) perResourceSecrets.set(logicalId, recordedSecretValues);
+			perResourceTemplateProps.set(logicalId, templateResource.Properties);
 		}
 		const templateOutputs = stack.template.Outputs ?? {};
 		for (const [name, output] of Object.entries(templateOutputs)) {
 			const value = output.Value;
 			if (value === void 0) continue;
+			outputsTemplateSource[name] = value;
+			const exportName = output.Export?.Name;
+			if (typeof exportName === "string") outputsTemplateSource[exportName] = value;
 			try {
 				await resolver.resolve(value, {
 					template: stack.template,
@@ -58478,11 +58484,17 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		const newResources = {};
 		for (const [logicalId, record] of Object.entries(state.resources)) {
 			const secrets = perResourceSecrets.get(logicalId);
-			const scrubbed = secrets ? scrubResourceRecord(record, secrets) : record;
+			const templateProps = perResourceTemplateProps.get(logicalId);
+			const ownSecrets = secrets ?? /* @__PURE__ */ new Map();
+			const positioned = templateProps ? {
+				...record,
+				properties: redactSecretsForState(record.properties, ownSecrets, templateProps, TEMPLATE_SOURCED_READBACK_RULES)
+			} : record;
+			const scrubbed = secrets || templateProps ? scrubResourceRecord(positioned, ownSecrets) : record;
 			if (JSON.stringify(scrubbed) !== JSON.stringify(record)) recordsChanged++;
 			newResources[logicalId] = scrubbed;
 		}
-		const newOutputs = outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets) : state.outputs;
+		const newOutputs = outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsTemplateSource) : state.outputs;
 		if (JSON.stringify(newOutputs) !== JSON.stringify(state.outputs)) recordsChanged++;
 		if (recordsChanged > 0 && !opts.dryRun) {
 			const nextState = {
@@ -61843,6 +61855,18 @@ function readStringProperty(properties, key, resourceType) {
 	return v;
 }
 /**
+* Build the live-read seam for ONE {@link buildImportPlan} call, with a fresh
+* memo. A factory rather than an inline object literal so the cache cannot be
+* forgotten at a future call site (the field is required, so omitting it is a
+* type error, and sharing one across calls has to be written deliberately).
+*/
+function createIdentifierBackfillDeps(ec2Client) {
+	return {
+		ec2Client,
+		securityGroupRuleCache: /* @__PURE__ */ new Map()
+	};
+}
+/**
 * Types whose cdkd physicalId is a COMPOSITE (`|`-joined) string while
 * CloudFormation's `primaryIdentifier` is a SINGLE field — so the physicalId is
 * NOT the identifier value, and it is not a SPLIT of the composite either
@@ -61975,6 +61999,7 @@ function recordedRuleIdIdentifier() {
 	const isUsableIdentifier = (value) => SG_RULE_ID_PATTERN.test(value.trim());
 	return {
 		field: "Id",
+		backfill: backfillSecurityGroupIngressRuleId,
 		resolve: ({ logicalId, physicalId, attributes }) => {
 			const recorded = attributes["Id"];
 			if (typeof recorded === "string" && isUsableIdentifier(recorded)) return recorded.trim();
@@ -61985,6 +62010,292 @@ function recordedRuleIdIdentifier() {
 	};
 }
 /**
+* Page ceiling for the {@link backfillSecurityGroupIngressRuleId} walk, and its
+* `MaxResults`. The twins of `MAX_SG_RULE_PAGES` / `SG_RULE_PAGE_SIZE` in
+* `src/provisioning/providers/ec2-provider.ts`, restated here for the same
+* reason {@link SG_RULE_ID_PATTERN} is: neither module may pull the other's
+* graph.
+*
+* 20 pages x 1000 rules covers 20,000 rules on ONE security group, far beyond
+* any real one (AWS's default quota is 60 rules per SG, 1000 at the maximum
+* increase). That arithmetic only holds because the request pins `MaxResults` —
+* without it AWS applies its own page size and the bound would cap an unknown
+* number of rules. Exhausting it is treated as "could not see the whole group",
+* which is a REFUSAL here rather than the provider's silent `undefined`: the
+* uniqueness verdict below is a statement about the whole group, so answering
+* from a partial view is exactly how a genuine 2-match becomes a false
+* "exactly one".
+*/
+const MAX_SG_RULE_PAGES = 20;
+const SG_RULE_PAGE_SIZE = 1e3;
+/**
+* Parse cdkd's `<groupId>|<ipProtocol>|<fromPort>|<toPort>` physical id, or
+* `undefined` when it is not that shape.
+*
+* EXACTLY four segments, all non-blank. A longer id is the issue
+* [#1672](https://github.com/go-to-k/cdkd/issues/1672) ambiguity — a segment
+* carrying the separator — and decoding its first four parts would silently
+* look up a DIFFERENT rule's tuple, so it is refused like any other unparseable
+* shape.
+*
+* The ports are the `'-1'` AWS itself uses for "all ports", which is what
+* `EC2Provider` packs when the template declares no `FromPort` / `ToPort`; a
+* segment that is not a finite number yields `undefined` rather than `NaN`, so
+* a malformed id refuses instead of matching nothing and blaming AWS.
+*
+* A BLANK port segment is refused EXPLICITLY, before `Number()` ever sees it,
+* because `Number('')` is `0` rather than `NaN` — so `sg-x|tcp||443` would
+* otherwise parse to `fromPort: 0` and go and look up a REAL tuple (ICMP type
+* 0 is echo reply, a live rule shape), adopting an id for a rule the record
+* does not name. That is also why the blank is not simply folded to `-1`: this
+* module and `EC2Provider.cfnIngressPortValue` disagree about what a blank
+* MEANS — the provider reads it as `-1` (all ports) because its input is a CFn
+* property the template legitimately omits, while here it is a SEGMENT of an
+* id cdkd itself wrote, and cdkd never writes an empty one. A blank segment is
+* therefore evidence the id is damaged, not evidence of an absent port.
+*/
+function parseSecurityGroupIngressComposite(physicalId) {
+	const parts = physicalId.trim().split("|");
+	if (parts.length !== 4) return void 0;
+	const [groupId, ipProtocol, fromPort, toPort] = parts;
+	if (!groupId.trim() || !ipProtocol.trim()) return void 0;
+	const fromRaw = fromPort.trim();
+	const toRaw = toPort.trim();
+	if (!fromRaw || !toRaw) return void 0;
+	const from = Number(fromRaw);
+	const to = Number(toRaw);
+	if (!Number.isFinite(from) || !Number.isFinite(to)) return void 0;
+	return {
+		groupId: groupId.trim(),
+		ipProtocol: ipProtocol.trim(),
+		fromPort: from,
+		toPort: to
+	};
+}
+/**
+* Does this `DescribeSecurityGroupRules` row describe the rule cdkd's composite
+* physical id names?
+*
+* The protocol goes through {@link canonicalizeIpProtocolValue} on BOTH sides
+* rather than a raw compare: EC2 rewrites the four protocol numbers it has a
+* name for before storing the rule, so a record packed from `IpProtocol: 6`
+* carries `'6'` while the readback says `'tcp'` and a raw compare would match
+* nothing (the issue #1643 fold, at a fourth call site).
+*
+* An omitted port reads back as `-1`, which is the same spelling the composite
+* carries for an absent one — so the two sides are directly comparable.
+*/
+function ruleMatchesIngressTuple(rule, tuple) {
+	if (rule.IsEgress === true) return false;
+	if (canonicalizeIpProtocolValue(rule.IpProtocol) !== canonicalizeIpProtocolValue(tuple.ipProtocol)) return false;
+	if ((rule.FromPort ?? -1) !== tuple.fromPort) return false;
+	if ((rule.ToPort ?? -1) !== tuple.toPort) return false;
+	return true;
+}
+/**
+* Test seam: overriding `sleep` lets unit tests drive the throttle backoff
+* without real waits. Mirrors `describeTypeRetryDelays` in
+* `src/provisioning/describe-type.ts`, which this retry is modeled on.
+*/
+const securityGroupRuleLookupRetryDelays = {};
+/**
+* Retries after the first attempt, THROTTLE-shaped failures only. At the
+* default backoff (1s -> 2s -> 4s -> 8s) this adds at most ~15s of sleep,
+* which is small next to what it prevents: `cdkd export` is all-or-nothing, so
+* one `RequestLimitExceeded` — the commonest EC2 Describe failure there is —
+* would otherwise abort the WHOLE run. A non-throttle failure (a missing
+* `ec2:DescribeSecurityGroupRules` being the important one) is surfaced
+* immediately, since it cannot heal by waiting.
+*/
+const MAX_SG_RULE_THROTTLE_RETRIES = 4;
+/**
+* Does this failure say the CALLER lacks permission, as opposed to anything
+* else AWS can fail with?
+*
+* Only these get the "Grant ec2:DescribeSecurityGroupRules" sentence. Sending
+* every failure to that remedy is how a throttle got reported as a permissions
+* problem: the user checks a policy that was correct all along, while the
+* actual advice ("re-run it") goes unsaid.
+*/
+function isAuthorizationShapedError(err) {
+	const name = err instanceof Error ? err.name : "";
+	const message = err instanceof Error ? err.message : String(err);
+	return /AccessDenied|UnauthorizedOperation|AuthFailure|not authorized to perform/i.test(`${name} ${message}`);
+}
+/**
+* Walk EVERY ingress/egress rule AWS holds on one security group, retrying a
+* throttled page (issue [#1791](https://github.com/go-to-k/cdkd/issues/1791)
+* review).
+*
+* Returns the failure rather than throwing it, because the caller owns the
+* message: every refusal here names the cdkd ROW that could not be resolved,
+* and this function does not know which row (possibly rows, via the memo)
+* asked.
+*/
+async function describeAllSecurityGroupRules(groupId, ec2Client) {
+	const rules = [];
+	let nextToken;
+	let pages = 0;
+	do {
+		if (pages >= MAX_SG_RULE_PAGES) return {
+			ok: false,
+			kind: "truncated"
+		};
+		let resp;
+		try {
+			resp = await withRetry(() => ec2Client.send(new DescribeSecurityGroupRulesCommand({
+				Filters: [{
+					Name: "group-id",
+					Values: [groupId]
+				}],
+				MaxResults: SG_RULE_PAGE_SIZE,
+				...nextToken && { NextToken: nextToken }
+			})), `DescribeSecurityGroupRules(${groupId})`, {
+				maxRetries: MAX_SG_RULE_THROTTLE_RETRIES,
+				isRetryable: (_message, error) => isThrottlingError(error),
+				logger: getLogger().child("Export"),
+				...securityGroupRuleLookupRetryDelays.sleep ? { sleep: securityGroupRuleLookupRetryDelays.sleep } : {}
+			});
+		} catch (err) {
+			const detail = err instanceof Error ? err.message : String(err);
+			return {
+				ok: false,
+				kind: isAuthorizationShapedError(err) ? "auth" : isThrottlingError(err) ? "throttled" : "failed",
+				detail
+			};
+		}
+		rules.push(...resp.SecurityGroupRules ?? []);
+		nextToken = resp.NextToken;
+		pages += 1;
+	} while (nextToken);
+	return {
+		ok: true,
+		rules
+	};
+}
+/**
+* {@link describeAllSecurityGroupRules}, memoized per GROUP for the lifetime of
+* one {@link buildImportPlan} call — see
+* {@link IdentifierBackfillDeps.securityGroupRuleCache}.
+*
+* The PROMISE is cached, not its resolution, so rows resolved concurrently on
+* one group also share a single walk rather than racing to start their own.
+*/
+function cachedSecurityGroupRules(groupId, { ec2Client, securityGroupRuleCache }) {
+	const cached = securityGroupRuleCache.get(groupId);
+	if (cached) return cached;
+	const pending = describeAllSecurityGroupRules(groupId, ec2Client);
+	securityGroupRuleCache.set(groupId, pending);
+	return pending;
+}
+/**
+* What to DO about a row more than one AWS rule matches — the part of the
+* refusal that is about the ambiguity itself rather than about how cdkd
+* noticed it.
+*
+* Written once because TWO arms below report a matched count above one: the
+* plain `> 1` refusal, and the unusable-id refusal (whose own remedy is "open
+* a cdkd issue" — right about the unreadable id, useless about the ambiguity).
+* A row that hits the second arm has BOTH problems, and before this was shared
+* it was the one row whose user never saw these two causes at all.
+*
+* Carries no row identity, so it can be appended to either message.
+*/
+const SG_INGRESS_AMBIGUITY_REMEDY = "Two causes, with different remedies. (1) ONE resource declaring MORE THAN ONE source (e.g. both CidrIp and CidrIpv6 on the same resource), for which AWS mints one rule per source: split it into one AWS::EC2::SecurityGroupIngress resource per source, which is also the shape CloudFormation will manage after the export. (2) TWO DISTINCT AWS::EC2::SecurityGroupIngress resources that differ only by SOURCE — port 443 from a CIDR and port 443 from a peer security group, say. cdkd's composite physical id carries no source, so those two rows carry byte-identical ids and splitting is not their remedy: set the row's attributes.Id to the 'sgr-...' id that belongs to it (cdkd then resolves from state and issues no lookup at all), or remove the row from the stack before exporting. Then re-run cdkd export.";
+/** The remedy every refusal below ends with — one place, so they cannot drift. */
+function sgIngressExportEscapeHatch(logicalId) {
+	return `You can instead remove '${logicalId}' from the stack before exporting — the rule stays in AWS and can be re-declared in CloudFormation afterwards.`;
+}
+/**
+* Live-read backfill of the `sgr-...` rule id for an
+* `AWS::EC2::SecurityGroupIngress` row that state does not carry one for
+* (issue [#1791](https://github.com/go-to-k/cdkd/issues/1791)).
+*
+* ## Why a live read at all
+*
+* Every row written by a cdkd older than issue #1761 has `attributes: {}`, and
+* `cdkd export` is ALL-OR-NOTHING — so ONE such row makes a whole stack
+* un-exportable. The obvious workaround does not exist: AWS returns the id only
+* from `AuthorizeSecurityGroupIngress`'s own response, so a no-op `cdkd deploy`
+* records nothing and the row is exactly as unexportable afterwards. Only a
+* re-authorization (a property change, or a destroy + deploy) heals it, which
+* is a traffic interruption to pay for a read cdkd can perform itself.
+*
+* ## Why the match is on the composite's tuple, and why EXACTLY ONE
+*
+* The row's identity, as far as cdkd state is concerned, IS
+* `<groupId>|<ipProtocol>|<fromPort>|<toPort>` — the tuple its own revoke call
+* needs. So the tuple is the most cdkd can filter on, and two AWS rules sharing
+* it are two rules cdkd's own physical id cannot tell apart either. Adopting
+* one of them would record an identifier that names the wrong AWS object, which
+* is the failure mode the #1761 already-exists arm's "exactly one" rule exists
+* to prevent — so ambiguity REFUSES, naming the candidates.
+*
+* The commonest ambiguity is the multi-source rule the state-only message
+* already describes: a resource declaring both `CidrIp` and `CidrIpv6` makes
+* AWS mint one rule PER SOURCE, both with this exact tuple. Splitting the
+* resource is the remedy in that case, and it is the same remedy CloudFormation
+* will want after the export. It is NOT the only cause, which is why the
+* refusal names two: TWO DISTINCT `AWS::EC2::SecurityGroupIngress` resources
+* differing only by source share one tuple as well — cdkd's composite carries
+* no source — and those are already one resource per source, so the remedy
+* there is to repair the row's `attributes.Id` (or drop the row) instead.
+*
+* Deliberately NOT narrowed by the recorded SOURCE (`CidrIp` and friends) even
+* though state carries it: {@link CompositePhysicalIdContext} does not carry
+* `properties`, and widening it to make ONE ambiguous case resolvable would
+* also make the export adopt a rule the physical id in state does not uniquely
+* name — a row that looks adopted while `cdkd destroy` would revoke a different
+* one. Refusing is the answer that keeps state and AWS agreeing.
+*/
+async function backfillSecurityGroupIngressRuleId({ logicalId, physicalId }, deps) {
+	const tuple = parseSecurityGroupIngressComposite(physicalId);
+	if (!tuple) throw new Error(`cdkd state records no 'sgr-...' security-group rule id for '${logicalId}', and its physical id '${physicalId}' is not cdkd's '<groupId>|<ipProtocol>|<fromPort>|<toPort>' composite either, so cdkd cannot look the rule up in AWS to recover the id CloudFormation IMPORT needs. Repair the record's physicalId (or its attributes.Id, which may be the 'sgr-...' id verbatim) and re-run cdkd export. ${sgIngressExportEscapeHatch(logicalId)}`);
+	const portRange = tuple.fromPort === tuple.toPort ? `${tuple.fromPort}` : `${tuple.fromPort}-${tuple.toPort}`;
+	const tupleNote = `protocol '${tuple.ipProtocol}', ports ${portRange} on security group '${tuple.groupId}'`;
+	const lookup = await cachedSecurityGroupRules(tuple.groupId, deps);
+	if (!lookup.ok) {
+		if (lookup.kind === "truncated") throw new Error(`cdkd state records no 'sgr-...' security-group rule id for '${logicalId}', and the DescribeSecurityGroupRules lookup on '${tuple.groupId}' was still paginating after ${MAX_SG_RULE_PAGES} pages — cdkd cannot prove a match is unique without seeing the whole group, and adopting an unproven id would name the wrong rule. ${sgIngressExportEscapeHatch(logicalId)}`);
+		const remedy = lookup.kind === "auth" ? `Grant ec2:DescribeSecurityGroupRules and re-run cdkd export.` : lookup.kind === "throttled" ? `AWS throttled the lookup and cdkd retried it ${MAX_SG_RULE_THROTTLE_RETRIES} times before giving up — no permission is missing. Re-run cdkd export once the account's EC2 describe rate has recovered.` : `Re-run cdkd export once that cause is resolved.`;
+		throw new Error(`cdkd state records no 'sgr-...' security-group rule id for '${logicalId}' (the rule was deployed by a cdkd older than https://github.com/go-to-k/cdkd/issues/1761), and the DescribeSecurityGroupRules lookup that would have recovered it failed: ${lookup.detail}. ${remedy} ${sgIngressExportEscapeHatch(logicalId)}`);
+	}
+	const matched = lookup.rules.filter((rule) => ruleMatchesIngressTuple(rule, tuple));
+	const ids = matched.map((rule) => rule.SecurityGroupRuleId).filter((id) => typeof id === "string" && SG_RULE_ID_PATTERN.test(id.trim())).map((id) => id.trim());
+	if (ids.length < matched.length) {
+		const unusable = matched.filter((rule) => !(typeof rule.SecurityGroupRuleId === "string" && SG_RULE_ID_PATTERN.test(rule.SecurityGroupRuleId.trim()))).map((rule) => typeof rule.SecurityGroupRuleId === "string" ? `'${rule.SecurityGroupRuleId}'` : "<absent>");
+		const readableNote = ids.length > 0 ? ` The readable candidates cdkd did see: ${ids.map((id) => `'${id}'`).join(", ")}.` : "";
+		const ambiguityNote = matched.length > 1 ? ` Note that ${matched.length} rules matching one row is an ambiguity in its own right, which cdkd could not resolve even if every id were readable: ${SG_INGRESS_AMBIGUITY_REMEDY}${readableNote}` : "";
+		throw new Error(`cdkd state records no 'sgr-...' security-group rule id for '${logicalId}', and a live DescribeSecurityGroupRules lookup found ${matched.length} ingress rule(s) matching ${tupleNote}, but ${unusable.length} of them carry no usable 'sgr-...' rule id (AWS reported ${unusable.join(", ")}). cdkd adopts an id only on an EXACTLY ONE match, and that is a count of MATCHING RULES — so discarding the unreadable ones first would let a genuine two-match pass as "exactly one" and record an identifier naming the wrong rule. cdkd refuses instead. This is a DescribeSecurityGroupRules response shape cdkd does not expect; please open a cdkd issue if it persists.${ambiguityNote} ${sgIngressExportEscapeHatch(logicalId)}`);
+	}
+	if (ids.length === 1) return ids[0];
+	if (ids.length === 0) throw new Error(`cdkd state records no 'sgr-...' security-group rule id for '${logicalId}' (the rule was deployed by a cdkd older than https://github.com/go-to-k/cdkd/issues/1761), and a live DescribeSecurityGroupRules lookup found NO ingress rule matching ${tupleNote} — so cdkd has no id to hand CloudFormation IMPORT. Either the rule was revoked outside cdkd, or the group lives in a region other than the one this export is running against. Run cdkd deploy to reconcile the stack, then re-run cdkd export. ${sgIngressExportEscapeHatch(logicalId)}`);
+	throw new Error(`cdkd state records no 'sgr-...' security-group rule id for '${logicalId}', and a live DescribeSecurityGroupRules lookup found ${ids.length} ingress rules matching ${tupleNote} (${ids.join(", ")}). cdkd's physical id identifies a rule only by group, protocol and port range, so it cannot say which of them '${logicalId}' is, and CloudFormation IMPORT needs exactly one — adopting either would record the wrong rule. ${SG_INGRESS_AMBIGUITY_REMEDY} ${sgIngressExportEscapeHatch(logicalId)}`);
+}
+/**
+* Resolve a registered type's CFn identifier VALUE, consulting AWS only when
+* cdkd state could not answer (issue
+* [#1791](https://github.com/go-to-k/cdkd/issues/1791)).
+*
+* The ordering is the whole design: `resolve` is tried FIRST and its throw is
+* the only trigger for the live read, so a row whose state already carries the
+* identifier — every row written by a current cdkd — issues no AWS call at all,
+* and a caller with no {@link IdentifierBackfillDeps} keeps exactly the
+* pre-#1791 behavior (the state-only refusal, verbatim).
+*
+* The backfill's own error REPLACES the state-only one when it fires: by then
+* cdkd has asked AWS, so the state-only message's central remedy ("re-deploy so
+* cdkd records the id") is not merely unhelpful but has been disproven for this
+* row — the live read already found zero, or too many.
+*/
+async function resolveIdentifierValue(entry, ctx, deps) {
+	try {
+		return entry.resolve(ctx);
+	} catch (stateOnlyError) {
+		if (!entry.backfill || !deps) throw stateOnlyError;
+		return await entry.backfill(ctx, deps);
+	}
+}
+/**
 * Build the {@link CompositePhysicalIdIdentifier} for a type whose CFn
 * identifier is an ARN cdkd records in `attributes` under the SAME name as the
 * `primaryIdentifier` field.
@@ -62205,7 +62516,8 @@ async function exportCommand(stackArg, options) {
 		}
 		const { phase1Imports, phase2Creates, recreateBeforePhase2, nestedStackRows, blocked } = await buildImportPlan(state, template, awsClients.cloudFormation, resolvedStackName, {
 			recreateImportUnsupported: options.recreateImportUnsupported,
-			skipImportSupportPreflight: options.skipImportSupportPreflight
+			skipImportSupportPreflight: options.skipImportSupportPreflight,
+			ec2Client: awsClients.ec2
 		});
 		if (blocked.length > 0) {
 			logger.error("The following resources block migration:");
@@ -62247,6 +62559,7 @@ async function exportCommand(stackArg, options) {
 					rootParameters: rootParametersForNested,
 					deps: {
 						cfnClient: awsClients.cloudFormation,
+						ec2Client: awsClients.ec2,
 						stateBackend,
 						lockManager,
 						uploadOpts: {
@@ -62741,6 +63054,7 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 	const nestedStackRows = [];
 	const blocked = [];
 	const identifierCache = /* @__PURE__ */ new Map();
+	const backfillDeps = options.ec2Client ? createIdentifierBackfillDeps(options.ec2Client) : void 0;
 	for (const [logicalId, raw] of Object.entries(templateResources)) {
 		if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
 		const resourceType = raw.Type ?? "";
@@ -62808,7 +63122,7 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 				});
 				continue;
 			}
-			resolved = resolveResourceIdentifier(resourceType, logicalId, stateEntry.physicalId, stateEntry.properties ?? {}, stateEntry.attributes ?? {}, schemaInfo);
+			resolved = await resolveResourceIdentifier(resourceType, logicalId, stateEntry.physicalId, stateEntry.properties ?? {}, stateEntry.attributes ?? {}, schemaInfo, backfillDeps);
 		} catch (err) {
 			blocked.push({
 				logicalId,
@@ -62895,15 +63209,15 @@ function groupBlockedReasons(blocked) {
 * what keeps `buildImportPlan` to ONE DescribeType per type across both the
 * IMPORT pre-flight and this resolution.
 */
-function resolveResourceIdentifier(resourceType, logicalId, physicalId, properties, attributes, entry) {
+async function resolveResourceIdentifier(resourceType, logicalId, physicalId, properties, attributes, entry, backfillDeps) {
 	const compositeIdentifier = Object.hasOwn(COMPOSITE_PHYSICAL_ID_IDENTIFIERS, resourceType) ? COMPOSITE_PHYSICAL_ID_IDENTIFIERS[resourceType] : void 0;
 	if (compositeIdentifier) {
 		if (entry.fields.length !== 1 || entry.fields[0] !== compositeIdentifier.field) throw new Error(`${resourceType} is registered in COMPOSITE_PHYSICAL_ID_IDENTIFIERS as identified by '${compositeIdentifier.field}', but CloudFormation now reports primaryIdentifier [${entry.fields.join(", ")}]. The registry schema changed under cdkd — update the entry in src/cli/commands/export.ts (or move the type to COMPOSITE_ID_SPLITTERS if its identifier is now composite too)`);
-		const value = compositeIdentifier.resolve({
+		const value = await resolveIdentifierValue(compositeIdentifier, {
 			logicalId,
 			physicalId,
 			attributes
-		});
+		}, backfillDeps);
 		return {
 			resourceIdentifier: { [compositeIdentifier.field]: value },
 			propertiesOverlay: {}
@@ -64065,7 +64379,8 @@ async function runPerStackImportLoop(args) {
 		const meta = nodesByCdkdName.get(node.stackName);
 		const plan = await buildImportPlan(meta.state, meta.template, deps.cfnClient, meta.cdkdStackName, {
 			recreateImportUnsupported: options.recreateImportUnsupported,
-			skipImportSupportPreflight: options.skipImportSupportPreflight === true
+			skipImportSupportPreflight: options.skipImportSupportPreflight === true,
+			...deps.ec2Client && { ec2Client: deps.ec2Client }
 		});
 		if (plan.blocked.length > 0) {
 			const lines = groupBlockedReasons(plan.blocked);
@@ -68911,11 +69226,12 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 	};
 	for (const [logicalId, resource] of entries) try {
 		const recordedSecretValues = /* @__PURE__ */ new Map();
-		const resolved = await resolver.resolve(resource.properties ?? {}, {
+		const unresolvedProperties = resource.properties ?? {};
+		const resolved = await resolver.resolve(unresolvedProperties, {
 			...baseContext,
 			recordedSecretValues
 		});
-		resource.properties = recordedSecretValues.size > 0 ? redactSecretsForState(resolved, recordedSecretValues) : resolved;
+		resource.properties = recordedSecretValues.size > 0 ? redactSecretsForState(resolved, recordedSecretValues, unresolvedProperties) : resolved;
 	} catch (err) {
 		logger.warn(`Failed to resolve intrinsics in Properties for imported resource '${logicalId}' (${resource.resourceType}): ${err instanceof Error ? err.message : String(err)}. State will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource via 'cdkd state orphan'.`);
 	}
@@ -79074,7 +79390,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.24");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.26");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;