@go-to-k/cdkd 0.283.25 → 0.283.27

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as resolveAutoAssetStorage, A as cyan, An as LocalMigrateError, At as loadPublishableAssetManifest, B as findSilentDropProperties, Bn as StackTerminationProtectionError, Bt as buildDenyExternalAccessPolicy, C as makeCanonicalizePropertiesFn, Cn as setAwsClients, Ct as rebuildClientForBucketRegion, D as renderStatefulReason, Dt as WorkGraph, E as isStatefulRecreateTargetSync, Et as stringifyValue, F as IAMRoleProvider, Fn as PartialFailureError, Ft as ensureAssetStorage, G as IntrinsicFunctionResolver, Gn as normalizeAwsError, Gt as runDockerStreaming, H as slowCcOperationTimeoutMs, Ht as formatDockerLoginError, I as collectInlinePolicyNamesManagedBySiblings, In as ProvisioningError, It as getBootstrapMarkerKey, J as refStateLookupFromResource, Jn as isRetryableTransientError, Jt as Synthesizer, K as cfnRefValueFromPhysicalId, Kn as withErrorHandling, Kt as AssetManifestLoader, L as clearOnUpdateRemoval, Ln as ResourceTimeoutError, Lt as parseBootstrapMarker, M as green, Mt as escapeRegExp, N as red, Nn as MissingCdkCliError, Nt as AssetModeResolver, O as formatResourceLine, On as DeployCancelledError, Ot as buildAssetRedirectMap, P as yellow, Pn as NestedStackChildDirectDestroyError, Pt as BOOTSTRAP_MARKER_PREFIX, Q as assertRegionMatch, Qt as resolveApp, R as ProviderRegistry, Rn as ResourceUpdateNotSupportedError, Rt as validateAssetBucketName, S as unsupportedFinalSnapshotError, Sn as resetAwsClients, St as S3StateBackend, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as CdkdError, Tt as AssetPublisher, U as disableInstanceApiTermination, Ut as getDockerCmd, V as CloudControlProvider, Vt as buildDockerImage, W as isTerminationProtectionPropagationError, Wt as runDockerForeground, X as normalizeAwsTagsToCfn, Xn as markNonRetryable, Xt as getDefaultStateBucketName, Y as WAFv2WebACLProvider, Yn as isThrottlingError, Yt as synthesisStatusMessage, Z as resolveExplicitPhysicalId, Zt as getLegacyStateBucketName, _ as buildFinalSnapshotIdentifier, _n as processStackMessages, _t as describeTypeWithThrottleRetry, a as DeploymentEventsStore, an as stateBucketExistenceConfirmed, at as requireConfigObject, b as isFinalSnapshotError, bn as AwsClients, bt as TemplateParser, c as replayFailedOperations, cn as CFN_TEMPLATE_URL_LIMIT, ct as redactSecretsForState, d as deleteSkipReason, dn as uploadCfnTemplate, dt as s3BucketDomainName, en as resolveCaptureObservedState, et as configBooleanRefusal, f as withResourceDeadline, fn as expectedOwnerParam, ft as s3BucketDualStackDomainName, g as PRE_DELETE_SNAPSHOT_TYPES, gn as AssemblyReader, gt as DiffCalculator, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as derivePartitionAndUrlSuffix, ht as applyRoleArnIfSet, i as DeploymentEventsReader, in as resolveUseCdkBootstrapAssets, it as requireConfigArray, j as gray, jn as LocalStartServiceError, jt as rewriteTemplateAssetReferences, k as bold, kn as LocalInvokeBuildError$1, kt as createAssetRedirectResolver, l as replayRollback, ln as MIGRATE_TMP_PREFIX, lt as scrubResourceRecord, m as computeImplicitDeleteEdges, mn as canonicalizeRegion, mt as s3BucketWebsiteUrl, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveStateBucketWithDefault, nt as readConfigString, o as planFailedOps, on as warnDeprecatedNoPrefixCliFlag, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as PARTITION_TABLE, pt as s3BucketRegionalDomainName, q as getAccountInfo, qn as isMarkedNonRetryable, qt as getDockerImageBySourceHash, r as DeployEngine, rn as resolveStateBucketWithDefaultAndSource, rt as replayWarn, s as planRollback, sn as CFN_TEMPLATE_BODY_LIMIT, st as TEMPLATE_SOURCED_READBACK_RULES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveSkipPrefix, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as findLargeInlineResources, ut as s3BucketArn, v as ccRoutedFinalSnapshotError, vt as withRetry, w as extractDeploymentEventError, wt as shouldRetainResource, x as refusesFinalSnapshot, xn as getAwsClients, xt as LockManager, y as createPreDeleteFinalSnapshot, yn as resolveBucketRegion, yt as DagBuilder, z as findActionableSilentDrops, zn as StackHasActiveImportsError, zt as validateContainerRepoName } from "./deploy-engine-MHqWGHl9.js";
+import { $ as coerceCfnBoolean, $t as resolveApp, A as cyan, An as LocalInvokeBuildError$1, At as createAssetRedirectResolver, B as findSilentDropProperties, Bn as StackHasActiveImportsError, Bt as validateContainerRepoName, C as makeCanonicalizePropertiesFn, Cn as resetAwsClients, Ct as S3StateBackend, D as renderStatefulReason, Dt as stringifyValue, E as isStatefulRecreateTargetSync, En as CdkdError, Et as AssetPublisher, F as IAMRoleProvider, Fn as NestedStackChildDirectDestroyError, Ft as BOOTSTRAP_MARKER_PREFIX, G as IntrinsicFunctionResolver, Gt as runDockerForeground, H as slowCcOperationTimeoutMs, Ht as buildDockerImage, I as collectInlinePolicyNamesManagedBySiblings, In as PartialFailureError, It as ensureAssetStorage, J as refStateLookupFromResource, Jn as isMarkedNonRetryable, Jt as getDockerImageBySourceHash, K as cfnRefValueFromPhysicalId, Kn as normalizeAwsError, Kt as runDockerStreaming, L as clearOnUpdateRemoval, Ln as ProvisioningError, Lt as getBootstrapMarkerKey, M as green, Mn as LocalStartServiceError, Mt as rewriteTemplateAssetReferences, N as red, Nt as escapeRegExp, O as formatResourceLine, Ot as WorkGraph, P as yellow, Pn as MissingCdkCliError, Pt as AssetModeResolver, Q as assertRegionMatch, Qt as getLegacyStateBucketName, R as ProviderRegistry, Rn as ResourceTimeoutError, Rt as parseBootstrapMarker, S as unsupportedFinalSnapshotError, Sn as getAwsClients, St as LockManager, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tt as shouldRetainResource, U as disableInstanceApiTermination, Ut as formatDockerLoginError, V as CloudControlProvider, Vn as StackTerminationProtectionError, Vt as buildDenyExternalAccessPolicy, W as isTerminationProtectionPropagationError, Wt as getDockerCmd, X as normalizeAwsTagsToCfn, Xn as isThrottlingError, Xt as synthesisStatusMessage, Y as WAFv2WebACLProvider, Yn as isRetryableTransientError, Yt as Synthesizer, Z as resolveExplicitPhysicalId, Zn as markNonRetryable, Zt as getDefaultStateBucketName, _ as buildFinalSnapshotIdentifier, _n as AssemblyReader, _t as INTRINSIC_KEYS, a as DeploymentEventsStore, an as resolveUseCdkBootstrapAssets, at as requireConfigObject, b as isFinalSnapshotError, bn as resolveBucketRegion, bt as DagBuilder, c as replayFailedOperations, cn as CFN_TEMPLATE_BODY_LIMIT, ct as redactSecretsForState, d as deleteSkipReason, dn as findLargeInlineResources, dt as s3BucketDomainName, en as resolveAutoAssetStorage, et as configBooleanRefusal, f as withResourceDeadline, fn as uploadCfnTemplate, ft as s3BucketDualStackDomainName, g as PRE_DELETE_SNAPSHOT_TYPES, gn as derivePartitionAndUrlSuffix, gt as DiffCalculator, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as canonicalizeRegion, ht as applyRoleArnIfSet, i as DeploymentEventsReader, in as resolveStateBucketWithDefaultAndSource, it as requireConfigArray, j as gray, jn as LocalMigrateError, jt as loadPublishableAssetManifest, k as bold, kn as DeployCancelledError, kt as buildAssetRedirectMap, l as replayRollback, ln as CFN_TEMPLATE_URL_LIMIT, lt as scrubResourceRecord, m as computeImplicitDeleteEdges, mn as PARTITION_TABLE, mt as s3BucketWebsiteUrl, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveSkipPrefix, nt as readConfigString, o as planFailedOps, on as stateBucketExistenceConfirmed, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as expectedOwnerParam, pt as s3BucketRegionalDomainName, q as getAccountInfo, qn as withErrorHandling, qt as AssetManifestLoader, r as DeployEngine, rn as resolveStateBucketWithDefault, rt as replayWarn, s as planRollback, sn as warnDeprecatedNoPrefixCliFlag, st as TEMPLATE_SOURCED_READBACK_RULES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveCaptureObservedState, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as MIGRATE_TMP_PREFIX, ut as s3BucketArn, v as ccRoutedFinalSnapshotError, vn as processStackMessages, vt as describeTypeWithThrottleRetry, w as extractDeploymentEventError, wn as setAwsClients, wt as rebuildClientForBucketRegion, x as refusesFinalSnapshot, xn as AwsClients, xt as TemplateParser, y as createPreDeleteFinalSnapshot, yt as withRetry, z as findActionableSilentDrops, zn as ResourceUpdateNotSupportedError, zt as validateAssetBucketName } from "./deploy-engine-CsvKYG0d.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-BqKgMaXN.js";
+import { t as ASGProvider } from "./asg-provider-uNJDVURJ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -21914,13 +21914,13 @@ const SG_INGRESS_IP_PROTOCOL_PATH = "AWS::EC2::SecurityGroupIngress IpProtocol";
 * hang a deploy; reaching it records nothing rather than answering from a
 * partial view.
 */
-const MAX_SG_RULE_PAGES = 20;
+const MAX_SG_RULE_PAGES$1 = 20;
 /**
 * `MaxResults` for that walk. `DescribeSecurityGroupRules` accepts 5-1000; the
 * ceiling is what makes {@link MAX_SG_RULE_PAGES}'s "20,000 rules" true and
 * keeps the common case (a group with a handful of rules) to ONE round trip.
 */
-const SG_RULE_PAGE_SIZE = 1e3;
+const SG_RULE_PAGE_SIZE$1 = 1e3;
 /**
 * The `sgr-…` security-group rule id, anchored.
 *
@@ -23339,8 +23339,8 @@ var EC2Provider = class {
 			let nextToken;
 			let pages = 0;
 			do {
-				if (pages >= MAX_SG_RULE_PAGES) {
-					this.logger.debug(`SecurityGroupIngress ${logicalId}: DescribeSecurityGroupRules on ${groupId} still paginating after ${MAX_SG_RULE_PAGES} pages — cannot prove the match is unique, so not recording an Id attribute`);
+				if (pages >= MAX_SG_RULE_PAGES$1) {
+					this.logger.debug(`SecurityGroupIngress ${logicalId}: DescribeSecurityGroupRules on ${groupId} still paginating after ${MAX_SG_RULE_PAGES$1} pages — cannot prove the match is unique, so not recording an Id attribute`);
 					return;
 				}
 				const resp = await this.ec2Client.send(new DescribeSecurityGroupRulesCommand({
@@ -23348,7 +23348,7 @@ var EC2Provider = class {
 						Name: "group-id",
 						Values: [groupId]
 					}],
-					MaxResults: SG_RULE_PAGE_SIZE,
+					MaxResults: SG_RULE_PAGE_SIZE$1,
 					...nextToken && { NextToken: nextToken }
 				}));
 				rules.push(...resp.SecurityGroupRules ?? []);
@@ -56744,6 +56744,307 @@ function createDeployCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/analyzer/outputs-diff.ts
+/**
+* A `${...}` placeholder `Fn::Sub` did NOT substitute.
+*
+* `resolveSub` catches a genuine `Ref` / `Fn::GetAtt` miss, WARNS, and keeps the
+* literal `${Foo}` in the output string — it neither throws nor leaves an
+* intrinsic object behind. So a half-substituted `Fn::Sub` reaches this module
+* looking like an ordinary resolved string, and comparing it against state
+* reports a phantom change whose printed value is `"arn:...${NewBucket}"`.
+*
+* Only consulted for a value whose TEMPLATE source actually contained an
+* `Fn::Sub` (see {@link templateUsesSub}). Applying it to every string
+* over-matches badly: an IAM policy body with `${aws:username}`, a UserData
+* snippet with a shell `${VAR}`, or any literal a user wrote would set
+* `resolutionFailed` and suppress the WHOLE Outputs section for that stack, on
+* every run, forever.
+*
+* Within `Fn::Sub`-sourced values one false positive remains and is accepted:
+* `${!Literal}` is `Fn::Sub`'s ESCAPE and resolves to the literal text
+* `${Literal}`, which post-resolution is indistinguishable from a placeholder
+* that failed to substitute. That case merely SUPPRESSES the section (the
+* pre-#1921 behavior) whereas the alternative is a phantom reported every run.
+*/
+const UNSUBSTITUTED_SUB_PLACEHOLDER = /\$\{[^}]*\}/;
+/**
+* True when `value` is, or anywhere CONTAINS, something the diff could not
+* fully resolve against current state.
+*
+* The deploy engine's twin check is `Object.values(bag).some(v => v ===
+* undefined)` — its resolver THROWS on failure and the catch stores `undefined`.
+* The diff's resolver is best-effort and fails in three further ways that all
+* have to count as "unresolved" here, because anything that slips through is
+* compared against state and reported as a change the apply will never make:
+*
+* 1. `undefined` — the SAME signal the deploy side keys on. `resolve` returns it
+*    WITHOUT throwing for a constructible-but-unknown attribute
+*    (`AWS::DynamoDB::Table.StreamArn`, `AWS::IAM::Policy.PolicyId`,
+*    `AWS::EC2::SecurityGroup.VpcId`, ...). `JSON.stringify` drops an
+*    `undefined`-valued key, so state can never hold one and such an output
+*    would otherwise report a PERMANENT phantom `ADD` printing `new: undefined`.
+* 2. A symbol — `Ref: AWS::NoValue` resolves to a sentinel symbol, which
+*    `resolveValue` strips only INSIDE arrays / objects; a top-level
+*    `Fn::If` selecting `AWS::NoValue` returns it bare. Not persistable, so
+*    again a permanent phantom.
+* 3. A surviving intrinsic OBJECT, or — only when the template source used
+*    `Fn::Sub` — an unsubstituted placeholder STRING (see
+*    {@link UNSUBSTITUTED_SUB_PLACEHOLDER}).
+*
+* DEEP rather than shallow: an unresolved leaf can sit anywhere inside an array
+* or object an outer intrinsic already built.
+*/
+function isUnresolvedValue(value, sourceUsedSub) {
+	if (value === void 0) return true;
+	if (typeof value === "symbol") return true;
+	if (typeof value === "string") return sourceUsedSub && UNSUBSTITUTED_SUB_PLACEHOLDER.test(value);
+	if (value === null || typeof value !== "object") return false;
+	if (Array.isArray(value)) return value.some((v) => isUnresolvedValue(v, sourceUsedSub));
+	const keys = Object.keys(value);
+	if (keys.length === 1 && INTRINSIC_KEYS.has(keys[0])) return true;
+	return Object.values(value).some((v) => isUnresolvedValue(v, sourceUsedSub));
+}
+/**
+* True when this output's RAW template value contains an `Fn::Sub` anywhere —
+* including nested inside an `Fn::Join` / `Fn::If`, since those resolve their
+* arguments and a laundered placeholder from an inner `Fn::Sub` surfaces in the
+* outer result.
+*/
+function templateUsesSub(templateValue) {
+	if (templateValue === null || typeof templateValue !== "object") return false;
+	if (Array.isArray(templateValue)) return templateValue.some(templateUsesSub);
+	const record = templateValue;
+	if (Object.prototype.hasOwnProperty.call(record, "Fn::Sub")) return true;
+	return Object.values(record).some(templateUsesSub);
+}
+/**
+* True when `value` is a string carrying a SECRET-BEARING CloudFormation
+* dynamic reference — `{{resolve:secretsmanager:` or `{{resolve:ssm-secure:`,
+* the two spellings that are secret regardless of what they point at.
+*
+* The diff resolves with `skipDynamicReferences`, so a secret-bearing output
+* arrives here as its unresolved `{{resolve:...}}` expression — which is also
+* what post-GHSA state stores. A state record written by an OLDER binary can
+* still hold the resolved PLAINTEXT instead (that mismatch is exactly what
+* `cdkd scrub` exists to repair), and printing it is this module's problem
+* because it is the first code path that DISPLAYS a stored output value.
+*/
+function isSecretDynamicReference(value) {
+	if (typeof value !== "string") return false;
+	return value.includes("{{resolve:secretsmanager:") || value.includes("{{resolve:ssm-secure:");
+}
+/** Structural equality, mirroring the deploy engine's `outputMapsEqual` leaf rule. */
+function valuesEqual(a, b) {
+	if (a === b) return true;
+	if (a == null || b == null) return a === b;
+	if (typeof a !== typeof b) return false;
+	if (typeof a !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => valuesEqual(v, b[i]));
+	}
+	const ao = a;
+	const bo = b;
+	const ak = Object.keys(ao);
+	if (ak.length !== Object.keys(bo).length) return false;
+	for (const k of ak) {
+		if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
+		if (!valuesEqual(ao[k], bo[k])) return false;
+	}
+	return true;
+}
+/**
+* Resolve a template's `Outputs` section into the exact bag shape the deploy
+* engine persists to `StackState.outputs` (issue #1921).
+*
+* This is the preview twin of `DeployEngine.resolveOutputs`, and the three
+* semantics below are load-bearing for parity — a preview that builds a
+* DIFFERENT bag than the apply persists reports a phantom change on every run,
+* which is this issue's own bug class inverted. `tests/unit/analyzer/
+* outputs-diff.test.ts` fences each one against drift on the deploy side.
+*
+* 1. An output whose `Condition` evaluates false is SKIPPED, not resolved —
+*    CloudFormation simply does not create it (mirrors the resource side's
+*    `filterResourcesByCondition`; an unknown condition name is kept).
+* 2. An `Export.Name` is stored as a SECOND key holding the same value, so
+*    `Fn::ImportValue` can find it by export name. Both keys land in state, so
+*    both must land here.
+* 3. Resolution is best-effort and never throws — a diff must never harden into
+*    an error where the deploy would have succeeded.
+*
+* The parity claim is scoped to the deploy engine's NO-CHANGE branch, which is
+* the one this preview stands in for. Its changed-resources branch resolves
+* outputs with no `resolutionFailed` gate at all — correctly, because by then
+* every resource exists and resolution is expected to succeed, whereas a diff
+* runs BEFORE any of them are created.
+*
+* Deliberately does NOT redact secrets the way the deploy side does: this
+* resolver runs with `skipDynamicReferences`, so a `{{resolve:...}}` reference
+* is never resolved to plaintext in the first place and the bag already holds
+* the expression that state stores post-redaction.
+*/
+async function resolveTemplateOutputs(template, resolveFn, conditions) {
+	const logger = getLogger().child("OutputsDiff");
+	const outputs = {};
+	const exportNames = /* @__PURE__ */ new Set();
+	const failedKeys = /* @__PURE__ */ new Set();
+	const secretSourceKeys = /* @__PURE__ */ new Set();
+	let resolutionFailed = false;
+	if (!template.Outputs) return {
+		outputs,
+		exportNames,
+		failedKeys,
+		secretSourceKeys,
+		resolutionFailed
+	};
+	/**
+	* Record a key the resolver DROPPED — plus the literal `Export.Name` alias the
+	* deploy would have written alongside it. Both are absent from the bag, so
+	* both would otherwise read as phantom REMOVEs and make the suppression
+	* warning fire on the ordinary pending-resource case.
+	*/
+	const recordFailure = (outputKey, output) => {
+		failedKeys.add(outputKey);
+		if (typeof output.Export?.Name === "string") failedKeys.add(output.Export.Name);
+	};
+	for (const [outputKey, output] of Object.entries(template.Outputs)) {
+		if (!isSecretDynamicReference(output.Value)) continue;
+		secretSourceKeys.add(outputKey);
+		if (typeof output.Export?.Name === "string") secretSourceKeys.add(output.Export.Name);
+	}
+	for (const [outputKey, output] of Object.entries(template.Outputs)) {
+		if (output.Condition !== void 0 && conditions?.[output.Condition] === false) {
+			logger.debug(`Skipping output ${outputKey} — condition ${output.Condition} is false`);
+			continue;
+		}
+		const sourceUsedSub = templateUsesSub(output.Value);
+		let value;
+		try {
+			value = await resolveFn(structuredClone(output.Value));
+		} catch (error) {
+			logger.debug(`Diff could not resolve output ${outputKey}: ${String(error)}`);
+			resolutionFailed = true;
+			recordFailure(outputKey, output);
+			continue;
+		}
+		if (isUnresolvedValue(value, sourceUsedSub)) {
+			logger.debug(`Diff left output ${outputKey} unresolved (references a pending resource)`);
+			resolutionFailed = true;
+			recordFailure(outputKey, output);
+			continue;
+		}
+		outputs[outputKey] = value;
+		if (output.Export?.Name) {
+			let exportName = output.Export.Name;
+			const exportSourceUsedSub = templateUsesSub(output.Export.Name);
+			if (typeof exportName !== "string") try {
+				exportName = await resolveFn(structuredClone(exportName));
+			} catch (error) {
+				logger.debug(`Diff could not resolve Export.Name of ${outputKey}: ${String(error)}`);
+				resolutionFailed = true;
+				continue;
+			}
+			if (typeof exportName === "string" && !isUnresolvedValue(exportName, exportSourceUsedSub)) {
+				outputs[exportName] = value;
+				exportNames.add(exportName);
+			} else resolutionFailed = true;
+		}
+	}
+	return {
+		outputs,
+		exportNames,
+		failedKeys,
+		secretSourceKeys,
+		resolutionFailed
+	};
+}
+/**
+* Compare the persisted Outputs bag against the one the next deploy would
+* write, key by key (issue #1921).
+*
+* Compares BAG KEYS rather than template output names on purpose. The bag is
+* what actually lands in `StackState.outputs` AND what
+* `ExportIndexStore.updateForStack` publishes, so a key-level comparison is
+* exactly the `outputMapsEqual` predicate the deploy engine gates its persist
+* on — no interpretive layer in between that could drift from apply semantics.
+* The practical payoff is that the motivating #875 case shows the user the
+* literal export name their downstream `Fn::ImportValue` needs.
+*
+* ## Withholding legacy secret plaintext
+*
+* This is the first code path that DISPLAYS a stored output value, and
+* `cdkd diff` is routinely run in CI — so a value that turns out to be secret
+* plaintext would land in build logs. `StackState.outputs` is only guaranteed
+* redacted for records written after the GHSA fix; an older binary persisted
+* the RESOLVED plaintext, which is the condition `cdkd scrub` repairs.
+*
+* Two independent signals identify such a record, and BOTH are needed:
+*
+* - the desired side is still a secret-bearing expression per
+*   {@link isSecretDynamicReference} (this resolver runs with
+*   `skipDynamicReferences`) while the stored side is not; and
+* - `secretSourceKeys` — the template itself declares the key's value as such a
+*   reference. This one reaches cases the first cannot: a
+*   condition-skipped secret output, or one deleted from the template, has NO
+*   desired side at all and would otherwise print in full as a REMOVE row.
+*
+* A hit on either makes the WHOLE record suspect, not just that key: the
+* record was written by a pre-GHSA binary, so every value in it is unredacted.
+* Withholding is therefore record-level. The change is still REPORTED — only
+* the value is withheld — so `--fail` and the exports story are unaffected.
+*/
+function computeOutputsDiff(current, desired, exportNames, secretSourceKeys = /* @__PURE__ */ new Set()) {
+	const changes = [];
+	const currentBag = current ?? {};
+	const legacyRecord = Object.entries(currentBag).some(([name, oldValue]) => {
+		if (isSecretDynamicReference(oldValue)) return false;
+		return isSecretDynamicReference(desired[name]) || secretSourceKeys.has(name);
+	});
+	const push = (change) => {
+		if (legacyRecord && change.changeType !== "ADD") {
+			const { oldValue: _dropped, ...rest } = change;
+			changes.push({
+				...rest,
+				oldValueRedacted: true
+			});
+			return;
+		}
+		changes.push(change);
+	};
+	for (const [name, newValue] of Object.entries(desired)) {
+		const isExport = exportNames.has(name);
+		if (!Object.prototype.hasOwnProperty.call(currentBag, name)) {
+			changes.push({
+				name,
+				changeType: "ADD",
+				newValue,
+				isExport
+			});
+			continue;
+		}
+		const oldValue = currentBag[name];
+		if (!valuesEqual(oldValue, newValue)) push({
+			name,
+			changeType: "MODIFY",
+			oldValue,
+			newValue,
+			isExport
+		});
+	}
+	for (const [name, oldValue] of Object.entries(currentBag)) {
+		if (Object.prototype.hasOwnProperty.call(desired, name)) continue;
+		push({
+			name,
+			changeType: "REMOVE",
+			oldValue,
+			isExport: false
+		});
+	}
+	return changes;
+}
+
 //#endregion
 //#region src/cli/cfn-stack-states.ts
 /**
@@ -57705,6 +58006,11 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 * resolver so changes buried inside intrinsics (e.g. `Fn::Join` literal
 * args) are detected against resolved values in state.
 *
+* Also computes the `Outputs` delta (issue #1921) — an Outputs-only change has
+* a byte-identical `Resources` section, so without it such a stack previews as
+* "No changes detected" while the apply persists new outputs and republishes
+* the exports index.
+*
 * Pure with respect to AWS state mutation — only reads state (the resolver
 * may read producer state for `Fn::ImportValue` / `Fn::GetStackOutput`).
 */
@@ -57749,7 +58055,16 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		...conditions && { conditions },
 		skipDynamicReferences: true
 	});
-	return diffCalculator.calculateDiff(currentState, effectiveTemplate, resolveFn, canonicalizeProperties);
+	const changes = await diffCalculator.calculateDiff(currentState, effectiveTemplate, resolveFn, canonicalizeProperties);
+	const resolved = await resolveTemplateOutputs(effectiveTemplate, resolveFn, conditions);
+	let outputChanges = [];
+	if (resolved.resolutionFailed) {
+		if (computeOutputsDiff(currentState.outputs, resolved.outputs, resolved.exportNames, resolved.secretSourceKeys).filter((change) => !resolved.failedKeys.has(change.name)).length > 0) logger.warn(`Outputs of stack ${stackName} may have changed, but one or more could not be resolved against current state — omitting the Outputs section from this diff. It is usually an output referencing a resource this deploy has yet to create.`);
+	} else outputChanges = computeOutputsDiff(currentState.outputs, resolved.outputs, resolved.exportNames, resolved.secretSourceKeys);
+	return {
+		changes,
+		outputChanges
+	};
 }
 /**
 * Resolve a nested-stack child's input `Parameters` (declared on the parent's
@@ -57812,12 +58127,14 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 async function buildDiffTree(args) {
 	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parameters, canonicalizeProperties, assetRedirect, cfnFallback } = args;
 	const state = await loadStateOrEmpty(stackName, region, stateBackend);
+	const { changes, outputChanges } = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, parameters, canonicalizeProperties, cfnFallback);
 	const node = {
 		stackName,
 		displayName,
 		region,
-		changes: await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, parameters, canonicalizeProperties, cfnFallback),
+		changes,
 		ccApiRoutes: collectCcApiRoutes(template, state),
+		outputChanges,
 		children: []
 	};
 	if (!recursive) return node;
@@ -57862,12 +58179,14 @@ async function buildDiffTree(args) {
 */
 async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculator) {
 	const state = await loadStateOrEmpty(stackName, region, stateBackend);
+	const { changes, outputChanges } = await computeStackDiff(state, EMPTY_TEMPLATE, region, stackName, stateBackend, diffCalculator);
 	const node = {
 		stackName,
 		displayName: stackName,
 		region,
-		changes: await computeStackDiff(state, EMPTY_TEMPLATE, region, stackName, stateBackend, diffCalculator),
+		changes,
 		ccApiRoutes: /* @__PURE__ */ new Map(),
+		outputChanges,
 		children: []
 	};
 	for (const [logicalId, resource] of Object.entries(state.resources)) {
@@ -57925,7 +58244,7 @@ function collectCcApiRoutes(template, state) {
 /** True when this node has at least one real (non-`NO_CHANGE`) change. */
 function nodeHasChanges(node) {
 	for (const change of node.changes.values()) if (change.changeType !== "NO_CHANGE") return true;
-	return false;
+	return node.outputChanges.length > 0;
 }
 /** True when this node OR any descendant has a real change (tree-wide drift detector for `--fail`). */
 function treeHasChanges(node) {
@@ -57956,26 +58275,17 @@ function diffTreeToJson(node) {
 		stack: node.stackName,
 		region: node.region,
 		changes,
+		outputChanges: node.outputChanges.map((change) => ({
+			name: change.name,
+			changeType: change.changeType,
+			...change.changeType !== "ADD" && !change.oldValueRedacted ? { oldValue: change.oldValue } : {},
+			...change.oldValueRedacted ? { oldValueRedacted: true } : {},
+			...change.changeType !== "REMOVE" ? { newValue: change.newValue } : {},
+			export: change.isExport
+		})),
 		children: node.children.map(diffTreeToJson)
 	};
 }
-const INTRINSIC_KEYS = /* @__PURE__ */ new Set([
-	"Ref",
-	"Fn::Sub",
-	"Fn::GetAtt",
-	"Fn::Join",
-	"Fn::Select",
-	"Fn::Split",
-	"Fn::If",
-	"Fn::ImportValue",
-	"Fn::FindInMap",
-	"Fn::Base64",
-	"Fn::GetAZs",
-	"Fn::Equals",
-	"Fn::And",
-	"Fn::Or",
-	"Fn::Not"
-]);
 function isIntrinsic(value) {
 	if (value === null || value === void 0 || typeof value !== "object" || Array.isArray(value)) return false;
 	const keys = Object.keys(value);
@@ -58111,6 +58421,84 @@ function renderChangeLines(changes, logFn, ccApiRoutes) {
 		delete: deleteCount
 	};
 }
+/** Stand-in printed instead of a withheld legacy-plaintext output value. */
+const REDACTED_LEGACY_PLAINTEXT = "<redacted: legacy plaintext in state — run `cdkd scrub`>";
+/**
+* Strip characters that let a template-controlled string manipulate the
+* TERMINAL rather than merely appear in it: C0 (incl. ESC, so no ANSI sequence
+* survives), DEL, C1 (the 8-bit CSI forms some terminals still honor), and the
+* bidi / format overrides that visually reorder a rendered line.
+*
+* Applied only on the human-render path. The `--json` payload is deliberately
+* left byte-faithful: it is a machine interface, an export NAME is data a
+* consumer may match on, and silently mutating it there would trade a real
+* correctness regression for a display concern belonging to whatever renders
+* the JSON. `JSON.stringify` already escapes everything below 0x20.
+*/
+function stripControlChars(value) {
+	return value.replace(/[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
+}
+/**
+* The same guard for an already-JSON-SERIALIZED value: C1 and the bidi marks
+* only, deliberately NOT C0.
+*
+* `JSON.stringify` escapes every character below 0x20 that occurs INSIDE a
+* string, so the only C0 left on this path is the pretty-printer's own
+* structural newlines — stripping those collapses a multi-line value onto a
+* single line. What `JSON.stringify` passes through unchanged is the C1 range
+* and the bidi overrides, and those are what this removes.
+*/
+function stripDisplayOnlyChars(value) {
+	return value.replace(/[\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
+}
+/**
+* Render one node's Outputs delta (issue #1921) via `logFn`, returning the
+* per-kind counts. Emits nothing when there is no delta, so an unchanged
+* Outputs section adds no noise to a resource-only diff.
+*
+* Rows are keyed by the PERSISTED bag key, which is what `StackState.outputs`
+* holds and what the exports index publishes. An output carrying an
+* `Export.Name` therefore shows TWO rows — its logical name and its export
+* name — because the deploy writes both keys. That is the useful half for the
+* motivating case: the `[export]`-tagged row IS the string a downstream
+* `Fn::ImportValue` resolves, so the user can match it against the consumer
+* that was failing with "export not found".
+*/
+function renderOutputChangeLines(outputChanges, logFn) {
+	const counts = {
+		add: 0,
+		change: 0,
+		remove: 0
+	};
+	if (outputChanges.length === 0) return counts;
+	logFn("\n  Outputs:");
+	const indent = "            ";
+	const render = (value) => stripDisplayOnlyChars((JSON.stringify(value, null, 2) ?? "undefined").replace(/\n/g, `\n${indent}`));
+	const renderOld = (change) => change.oldValueRedacted ? REDACTED_LEGACY_PLAINTEXT : render(change.oldValue);
+	for (const change of outputChanges) {
+		const exported = change.isExport ? " [export]" : "";
+		const name = stripControlChars(change.name);
+		switch (change.changeType) {
+			case "ADD":
+				counts.add++;
+				logFn(`    [+] ${name}${exported}`);
+				logFn(`          new: ${render(change.newValue)}`);
+				break;
+			case "MODIFY":
+				counts.change++;
+				logFn(`    [~] ${name}${exported}`);
+				logFn(`          old: ${renderOld(change)}`);
+				logFn(`          new: ${render(change.newValue)}`);
+				break;
+			case "REMOVE":
+				counts.remove++;
+				logFn(`    [-] ${name}${exported}`);
+				logFn(`          old: ${renderOld(change)}`);
+				break;
+		}
+	}
+	return counts;
+}
 /**
 * Render a diff tree (root + nested children, DFS) via `logFn`. Only nodes
 * that actually have changes get a block — unchanged nested children are
@@ -58123,7 +58511,9 @@ function renderDiffTree(node, isRoot, logFn) {
 	if (nodeHasChanges(node)) {
 		logFn(isRoot ? `\nStack ${node.stackName}:` : `\nNested stack: ${node.displayName}`);
 		const { create, update, delete: del } = renderChangeLines(node.changes, logFn, node.ccApiRoutes);
+		const outputs = renderOutputChangeLines(node.outputChanges, logFn);
 		logFn(`\n${create} to create, ${update} to update, ${del} to delete`);
+		if (outputs.add + outputs.change + outputs.remove > 0) logFn(`${outputs.add} output(s) to add, ${outputs.change} to change, ${outputs.remove} to remove`);
 	}
 	for (const child of node.children) renderDiffTree(child, false, logFn);
 }
@@ -61855,6 +62245,18 @@ function readStringProperty(properties, key, resourceType) {
 	return v;
 }
 /**
+* Build the live-read seam for ONE {@link buildImportPlan} call, with a fresh
+* memo. A factory rather than an inline object literal so the cache cannot be
+* forgotten at a future call site (the field is required, so omitting it is a
+* type error, and sharing one across calls has to be written deliberately).
+*/
+function createIdentifierBackfillDeps(ec2Client) {
+	return {
+		ec2Client,
+		securityGroupRuleCache: /* @__PURE__ */ new Map()
+	};
+}
+/**
 * Types whose cdkd physicalId is a COMPOSITE (`|`-joined) string while
 * CloudFormation's `primaryIdentifier` is a SINGLE field — so the physicalId is
 * NOT the identifier value, and it is not a SPLIT of the composite either
@@ -61987,6 +62389,7 @@ function recordedRuleIdIdentifier() {
 	const isUsableIdentifier = (value) => SG_RULE_ID_PATTERN.test(value.trim());
 	return {
 		field: "Id",
+		backfill: backfillSecurityGroupIngressRuleId,
 		resolve: ({ logicalId, physicalId, attributes }) => {
 			const recorded = attributes["Id"];
 			if (typeof recorded === "string" && isUsableIdentifier(recorded)) return recorded.trim();
@@ -61997,6 +62400,292 @@ function recordedRuleIdIdentifier() {
 	};
 }
 /**
+* Page ceiling for the {@link backfillSecurityGroupIngressRuleId} walk, and its
+* `MaxResults`. The twins of `MAX_SG_RULE_PAGES` / `SG_RULE_PAGE_SIZE` in
+* `src/provisioning/providers/ec2-provider.ts`, restated here for the same
+* reason {@link SG_RULE_ID_PATTERN} is: neither module may pull the other's
+* graph.
+*
+* 20 pages x 1000 rules covers 20,000 rules on ONE security group, far beyond
+* any real one (AWS's default quota is 60 rules per SG, 1000 at the maximum
+* increase). That arithmetic only holds because the request pins `MaxResults` —
+* without it AWS applies its own page size and the bound would cap an unknown
+* number of rules. Exhausting it is treated as "could not see the whole group",
+* which is a REFUSAL here rather than the provider's silent `undefined`: the
+* uniqueness verdict below is a statement about the whole group, so answering
+* from a partial view is exactly how a genuine 2-match becomes a false
+* "exactly one".
+*/
+const MAX_SG_RULE_PAGES = 20;
+const SG_RULE_PAGE_SIZE = 1e3;
+/**
+* Parse cdkd's `<groupId>|<ipProtocol>|<fromPort>|<toPort>` physical id, or
+* `undefined` when it is not that shape.
+*
+* EXACTLY four segments, all non-blank. A longer id is the issue
+* [#1672](https://github.com/go-to-k/cdkd/issues/1672) ambiguity — a segment
+* carrying the separator — and decoding its first four parts would silently
+* look up a DIFFERENT rule's tuple, so it is refused like any other unparseable
+* shape.
+*
+* The ports are the `'-1'` AWS itself uses for "all ports", which is what
+* `EC2Provider` packs when the template declares no `FromPort` / `ToPort`; a
+* segment that is not a finite number yields `undefined` rather than `NaN`, so
+* a malformed id refuses instead of matching nothing and blaming AWS.
+*
+* A BLANK port segment is refused EXPLICITLY, before `Number()` ever sees it,
+* because `Number('')` is `0` rather than `NaN` — so `sg-x|tcp||443` would
+* otherwise parse to `fromPort: 0` and go and look up a REAL tuple (ICMP type
+* 0 is echo reply, a live rule shape), adopting an id for a rule the record
+* does not name. That is also why the blank is not simply folded to `-1`: this
+* module and `EC2Provider.cfnIngressPortValue` disagree about what a blank
+* MEANS — the provider reads it as `-1` (all ports) because its input is a CFn
+* property the template legitimately omits, while here it is a SEGMENT of an
+* id cdkd itself wrote, and cdkd never writes an empty one. A blank segment is
+* therefore evidence the id is damaged, not evidence of an absent port.
+*/
+function parseSecurityGroupIngressComposite(physicalId) {
+	const parts = physicalId.trim().split("|");
+	if (parts.length !== 4) return void 0;
+	const [groupId, ipProtocol, fromPort, toPort] = parts;
+	if (!groupId.trim() || !ipProtocol.trim()) return void 0;
+	const fromRaw = fromPort.trim();
+	const toRaw = toPort.trim();
+	if (!fromRaw || !toRaw) return void 0;
+	const from = Number(fromRaw);
+	const to = Number(toRaw);
+	if (!Number.isFinite(from) || !Number.isFinite(to)) return void 0;
+	return {
+		groupId: groupId.trim(),
+		ipProtocol: ipProtocol.trim(),
+		fromPort: from,
+		toPort: to
+	};
+}
+/**
+* Does this `DescribeSecurityGroupRules` row describe the rule cdkd's composite
+* physical id names?
+*
+* The protocol goes through {@link canonicalizeIpProtocolValue} on BOTH sides
+* rather than a raw compare: EC2 rewrites the four protocol numbers it has a
+* name for before storing the rule, so a record packed from `IpProtocol: 6`
+* carries `'6'` while the readback says `'tcp'` and a raw compare would match
+* nothing (the issue #1643 fold, at a fourth call site).
+*
+* An omitted port reads back as `-1`, which is the same spelling the composite
+* carries for an absent one — so the two sides are directly comparable.
+*/
+function ruleMatchesIngressTuple(rule, tuple) {
+	if (rule.IsEgress === true) return false;
+	if (canonicalizeIpProtocolValue(rule.IpProtocol) !== canonicalizeIpProtocolValue(tuple.ipProtocol)) return false;
+	if ((rule.FromPort ?? -1) !== tuple.fromPort) return false;
+	if ((rule.ToPort ?? -1) !== tuple.toPort) return false;
+	return true;
+}
+/**
+* Test seam: overriding `sleep` lets unit tests drive the throttle backoff
+* without real waits. Mirrors `describeTypeRetryDelays` in
+* `src/provisioning/describe-type.ts`, which this retry is modeled on.
+*/
+const securityGroupRuleLookupRetryDelays = {};
+/**
+* Retries after the first attempt, THROTTLE-shaped failures only. At the
+* default backoff (1s -> 2s -> 4s -> 8s) this adds at most ~15s of sleep,
+* which is small next to what it prevents: `cdkd export` is all-or-nothing, so
+* one `RequestLimitExceeded` — the commonest EC2 Describe failure there is —
+* would otherwise abort the WHOLE run. A non-throttle failure (a missing
+* `ec2:DescribeSecurityGroupRules` being the important one) is surfaced
+* immediately, since it cannot heal by waiting.
+*/
+const MAX_SG_RULE_THROTTLE_RETRIES = 4;
+/**
+* Does this failure say the CALLER lacks permission, as opposed to anything
+* else AWS can fail with?
+*
+* Only these get the "Grant ec2:DescribeSecurityGroupRules" sentence. Sending
+* every failure to that remedy is how a throttle got reported as a permissions
+* problem: the user checks a policy that was correct all along, while the
+* actual advice ("re-run it") goes unsaid.
+*/
+function isAuthorizationShapedError(err) {
+	const name = err instanceof Error ? err.name : "";
+	const message = err instanceof Error ? err.message : String(err);
+	return /AccessDenied|UnauthorizedOperation|AuthFailure|not authorized to perform/i.test(`${name} ${message}`);
+}
+/**
+* Walk EVERY ingress/egress rule AWS holds on one security group, retrying a
+* throttled page (issue [#1791](https://github.com/go-to-k/cdkd/issues/1791)
+* review).
+*
+* Returns the failure rather than throwing it, because the caller owns the
+* message: every refusal here names the cdkd ROW that could not be resolved,
+* and this function does not know which row (possibly rows, via the memo)
+* asked.
+*/
+async function describeAllSecurityGroupRules(groupId, ec2Client) {
+	const rules = [];
+	let nextToken;
+	let pages = 0;
+	do {
+		if (pages >= MAX_SG_RULE_PAGES) return {
+			ok: false,
+			kind: "truncated"
+		};
+		let resp;
+		try {
+			resp = await withRetry(() => ec2Client.send(new DescribeSecurityGroupRulesCommand({
+				Filters: [{
+					Name: "group-id",
+					Values: [groupId]
+				}],
+				MaxResults: SG_RULE_PAGE_SIZE,
+				...nextToken && { NextToken: nextToken }
+			})), `DescribeSecurityGroupRules(${groupId})`, {
+				maxRetries: MAX_SG_RULE_THROTTLE_RETRIES,
+				isRetryable: (_message, error) => isThrottlingError(error),
+				logger: getLogger().child("Export"),
+				...securityGroupRuleLookupRetryDelays.sleep ? { sleep: securityGroupRuleLookupRetryDelays.sleep } : {}
+			});
+		} catch (err) {
+			const detail = err instanceof Error ? err.message : String(err);
+			return {
+				ok: false,
+				kind: isAuthorizationShapedError(err) ? "auth" : isThrottlingError(err) ? "throttled" : "failed",
+				detail
+			};
+		}
+		rules.push(...resp.SecurityGroupRules ?? []);
+		nextToken = resp.NextToken;
+		pages += 1;
+	} while (nextToken);
+	return {
+		ok: true,
+		rules
+	};
+}
+/**
+* {@link describeAllSecurityGroupRules}, memoized per GROUP for the lifetime of
+* one {@link buildImportPlan} call — see
+* {@link IdentifierBackfillDeps.securityGroupRuleCache}.
+*
+* The PROMISE is cached, not its resolution, so rows resolved concurrently on
+* one group also share a single walk rather than racing to start their own.
+*/
+function cachedSecurityGroupRules(groupId, { ec2Client, securityGroupRuleCache }) {
+	const cached = securityGroupRuleCache.get(groupId);
+	if (cached) return cached;
+	const pending = describeAllSecurityGroupRules(groupId, ec2Client);
+	securityGroupRuleCache.set(groupId, pending);
+	return pending;
+}
+/**
+* What to DO about a row more than one AWS rule matches — the part of the
+* refusal that is about the ambiguity itself rather than about how cdkd
+* noticed it.
+*
+* Written once because TWO arms below report a matched count above one: the
+* plain `> 1` refusal, and the unusable-id refusal (whose own remedy is "open
+* a cdkd issue" — right about the unreadable id, useless about the ambiguity).
+* A row that hits the second arm has BOTH problems, and before this was shared
+* it was the one row whose user never saw these two causes at all.
+*
+* Carries no row identity, so it can be appended to either message.
+*/
+const SG_INGRESS_AMBIGUITY_REMEDY = "Two causes, with different remedies. (1) ONE resource declaring MORE THAN ONE source (e.g. both CidrIp and CidrIpv6 on the same resource), for which AWS mints one rule per source: split it into one AWS::EC2::SecurityGroupIngress resource per source, which is also the shape CloudFormation will manage after the export. (2) TWO DISTINCT AWS::EC2::SecurityGroupIngress resources that differ only by SOURCE — port 443 from a CIDR and port 443 from a peer security group, say. cdkd's composite physical id carries no source, so those two rows carry byte-identical ids and splitting is not their remedy: set the row's attributes.Id to the 'sgr-...' id that belongs to it (cdkd then resolves from state and issues no lookup at all), or remove the row from the stack before exporting. Then re-run cdkd export.";
+/** The remedy every refusal below ends with — one place, so they cannot drift. */
+function sgIngressExportEscapeHatch(logicalId) {
+	return `You can instead remove '${logicalId}' from the stack before exporting — the rule stays in AWS and can be re-declared in CloudFormation afterwards.`;
+}
+/**
+* Live-read backfill of the `sgr-...` rule id for an
+* `AWS::EC2::SecurityGroupIngress` row that state does not carry one for
+* (issue [#1791](https://github.com/go-to-k/cdkd/issues/1791)).
+*
+* ## Why a live read at all
+*
+* Every row written by a cdkd older than issue #1761 has `attributes: {}`, and
+* `cdkd export` is ALL-OR-NOTHING — so ONE such row makes a whole stack
+* un-exportable. The obvious workaround does not exist: AWS returns the id only
+* from `AuthorizeSecurityGroupIngress`'s own response, so a no-op `cdkd deploy`
+* records nothing and the row is exactly as unexportable afterwards. Only a
+* re-authorization (a property change, or a destroy + deploy) heals it, which
+* is a traffic interruption to pay for a read cdkd can perform itself.
+*
+* ## Why the match is on the composite's tuple, and why EXACTLY ONE
+*
+* The row's identity, as far as cdkd state is concerned, IS
+* `<groupId>|<ipProtocol>|<fromPort>|<toPort>` — the tuple its own revoke call
+* needs. So the tuple is the most cdkd can filter on, and two AWS rules sharing
+* it are two rules cdkd's own physical id cannot tell apart either. Adopting
+* one of them would record an identifier that names the wrong AWS object, which
+* is the failure mode the #1761 already-exists arm's "exactly one" rule exists
+* to prevent — so ambiguity REFUSES, naming the candidates.
+*
+* The commonest ambiguity is the multi-source rule the state-only message
+* already describes: a resource declaring both `CidrIp` and `CidrIpv6` makes
+* AWS mint one rule PER SOURCE, both with this exact tuple. Splitting the
+* resource is the remedy in that case, and it is the same remedy CloudFormation
+* will want after the export. It is NOT the only cause, which is why the
+* refusal names two: TWO DISTINCT `AWS::EC2::SecurityGroupIngress` resources
+* differing only by source share one tuple as well — cdkd's composite carries
+* no source — and those are already one resource per source, so the remedy
+* there is to repair the row's `attributes.Id` (or drop the row) instead.
+*
+* Deliberately NOT narrowed by the recorded SOURCE (`CidrIp` and friends) even
+* though state carries it: {@link CompositePhysicalIdContext} does not carry
+* `properties`, and widening it to make ONE ambiguous case resolvable would
+* also make the export adopt a rule the physical id in state does not uniquely
+* name — a row that looks adopted while `cdkd destroy` would revoke a different
+* one. Refusing is the answer that keeps state and AWS agreeing.
+*/
+async function backfillSecurityGroupIngressRuleId({ logicalId, physicalId }, deps) {
+	const tuple = parseSecurityGroupIngressComposite(physicalId);
+	if (!tuple) throw new Error(`cdkd state records no 'sgr-...' security-group rule id for '${logicalId}', and its physical id '${physicalId}' is not cdkd's '<groupId>|<ipProtocol>|<fromPort>|<toPort>' composite either, so cdkd cannot look the rule up in AWS to recover the id CloudFormation IMPORT needs. Repair the record's physicalId (or its attributes.Id, which may be the 'sgr-...' id verbatim) and re-run cdkd export. ${sgIngressExportEscapeHatch(logicalId)}`);
+	const portRange = tuple.fromPort === tuple.toPort ? `${tuple.fromPort}` : `${tuple.fromPort}-${tuple.toPort}`;
+	const tupleNote = `protocol '${tuple.ipProtocol}', ports ${portRange} on security group '${tuple.groupId}'`;
+	const lookup = await cachedSecurityGroupRules(tuple.groupId, deps);
+	if (!lookup.ok) {
+		if (lookup.kind === "truncated") throw new Error(`cdkd state records no 'sgr-...' security-group rule id for '${logicalId}', and the DescribeSecurityGroupRules lookup on '${tuple.groupId}' was still paginating after ${MAX_SG_RULE_PAGES} pages — cdkd cannot prove a match is unique without seeing the whole group, and adopting an unproven id would name the wrong rule. ${sgIngressExportEscapeHatch(logicalId)}`);
+		const remedy = lookup.kind === "auth" ? `Grant ec2:DescribeSecurityGroupRules and re-run cdkd export.` : lookup.kind === "throttled" ? `AWS throttled the lookup and cdkd retried it ${MAX_SG_RULE_THROTTLE_RETRIES} times before giving up — no permission is missing. Re-run cdkd export once the account's EC2 describe rate has recovered.` : `Re-run cdkd export once that cause is resolved.`;
+		throw new Error(`cdkd state records no 'sgr-...' security-group rule id for '${logicalId}' (the rule was deployed by a cdkd older than https://github.com/go-to-k/cdkd/issues/1761), and the DescribeSecurityGroupRules lookup that would have recovered it failed: ${lookup.detail}. ${remedy} ${sgIngressExportEscapeHatch(logicalId)}`);
+	}
+	const matched = lookup.rules.filter((rule) => ruleMatchesIngressTuple(rule, tuple));
+	const ids = matched.map((rule) => rule.SecurityGroupRuleId).filter((id) => typeof id === "string" && SG_RULE_ID_PATTERN.test(id.trim())).map((id) => id.trim());
+	if (ids.length < matched.length) {
+		const unusable = matched.filter((rule) => !(typeof rule.SecurityGroupRuleId === "string" && SG_RULE_ID_PATTERN.test(rule.SecurityGroupRuleId.trim()))).map((rule) => typeof rule.SecurityGroupRuleId === "string" ? `'${rule.SecurityGroupRuleId}'` : "<absent>");
+		const readableNote = ids.length > 0 ? ` The readable candidates cdkd did see: ${ids.map((id) => `'${id}'`).join(", ")}.` : "";
+		const ambiguityNote = matched.length > 1 ? ` Note that ${matched.length} rules matching one row is an ambiguity in its own right, which cdkd could not resolve even if every id were readable: ${SG_INGRESS_AMBIGUITY_REMEDY}${readableNote}` : "";
+		throw new Error(`cdkd state records no 'sgr-...' security-group rule id for '${logicalId}', and a live DescribeSecurityGroupRules lookup found ${matched.length} ingress rule(s) matching ${tupleNote}, but ${unusable.length} of them carry no usable 'sgr-...' rule id (AWS reported ${unusable.join(", ")}). cdkd adopts an id only on an EXACTLY ONE match, and that is a count of MATCHING RULES — so discarding the unreadable ones first would let a genuine two-match pass as "exactly one" and record an identifier naming the wrong rule. cdkd refuses instead. This is a DescribeSecurityGroupRules response shape cdkd does not expect; please open a cdkd issue if it persists.${ambiguityNote} ${sgIngressExportEscapeHatch(logicalId)}`);
+	}
+	if (ids.length === 1) return ids[0];
+	if (ids.length === 0) throw new Error(`cdkd state records no 'sgr-...' security-group rule id for '${logicalId}' (the rule was deployed by a cdkd older than https://github.com/go-to-k/cdkd/issues/1761), and a live DescribeSecurityGroupRules lookup found NO ingress rule matching ${tupleNote} — so cdkd has no id to hand CloudFormation IMPORT. Either the rule was revoked outside cdkd, or the group lives in a region other than the one this export is running against. Run cdkd deploy to reconcile the stack, then re-run cdkd export. ${sgIngressExportEscapeHatch(logicalId)}`);
+	throw new Error(`cdkd state records no 'sgr-...' security-group rule id for '${logicalId}', and a live DescribeSecurityGroupRules lookup found ${ids.length} ingress rules matching ${tupleNote} (${ids.join(", ")}). cdkd's physical id identifies a rule only by group, protocol and port range, so it cannot say which of them '${logicalId}' is, and CloudFormation IMPORT needs exactly one — adopting either would record the wrong rule. ${SG_INGRESS_AMBIGUITY_REMEDY} ${sgIngressExportEscapeHatch(logicalId)}`);
+}
+/**
+* Resolve a registered type's CFn identifier VALUE, consulting AWS only when
+* cdkd state could not answer (issue
+* [#1791](https://github.com/go-to-k/cdkd/issues/1791)).
+*
+* The ordering is the whole design: `resolve` is tried FIRST and its throw is
+* the only trigger for the live read, so a row whose state already carries the
+* identifier — every row written by a current cdkd — issues no AWS call at all,
+* and a caller with no {@link IdentifierBackfillDeps} keeps exactly the
+* pre-#1791 behavior (the state-only refusal, verbatim).
+*
+* The backfill's own error REPLACES the state-only one when it fires: by then
+* cdkd has asked AWS, so the state-only message's central remedy ("re-deploy so
+* cdkd records the id") is not merely unhelpful but has been disproven for this
+* row — the live read already found zero, or too many.
+*/
+async function resolveIdentifierValue(entry, ctx, deps) {
+	try {
+		return entry.resolve(ctx);
+	} catch (stateOnlyError) {
+		if (!entry.backfill || !deps) throw stateOnlyError;
+		return await entry.backfill(ctx, deps);
+	}
+}
+/**
 * Build the {@link CompositePhysicalIdIdentifier} for a type whose CFn
 * identifier is an ARN cdkd records in `attributes` under the SAME name as the
 * `primaryIdentifier` field.
@@ -62217,7 +62906,8 @@ async function exportCommand(stackArg, options) {
 		}
 		const { phase1Imports, phase2Creates, recreateBeforePhase2, nestedStackRows, blocked } = await buildImportPlan(state, template, awsClients.cloudFormation, resolvedStackName, {
 			recreateImportUnsupported: options.recreateImportUnsupported,
-			skipImportSupportPreflight: options.skipImportSupportPreflight
+			skipImportSupportPreflight: options.skipImportSupportPreflight,
+			ec2Client: awsClients.ec2
 		});
 		if (blocked.length > 0) {
 			logger.error("The following resources block migration:");
@@ -62259,6 +62949,7 @@ async function exportCommand(stackArg, options) {
 					rootParameters: rootParametersForNested,
 					deps: {
 						cfnClient: awsClients.cloudFormation,
+						ec2Client: awsClients.ec2,
 						stateBackend,
 						lockManager,
 						uploadOpts: {
@@ -62753,6 +63444,7 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 	const nestedStackRows = [];
 	const blocked = [];
 	const identifierCache = /* @__PURE__ */ new Map();
+	const backfillDeps = options.ec2Client ? createIdentifierBackfillDeps(options.ec2Client) : void 0;
 	for (const [logicalId, raw] of Object.entries(templateResources)) {
 		if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
 		const resourceType = raw.Type ?? "";
@@ -62820,7 +63512,7 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 				});
 				continue;
 			}
-			resolved = resolveResourceIdentifier(resourceType, logicalId, stateEntry.physicalId, stateEntry.properties ?? {}, stateEntry.attributes ?? {}, schemaInfo);
+			resolved = await resolveResourceIdentifier(resourceType, logicalId, stateEntry.physicalId, stateEntry.properties ?? {}, stateEntry.attributes ?? {}, schemaInfo, backfillDeps);
 		} catch (err) {
 			blocked.push({
 				logicalId,
@@ -62907,15 +63599,15 @@ function groupBlockedReasons(blocked) {
 * what keeps `buildImportPlan` to ONE DescribeType per type across both the
 * IMPORT pre-flight and this resolution.
 */
-function resolveResourceIdentifier(resourceType, logicalId, physicalId, properties, attributes, entry) {
+async function resolveResourceIdentifier(resourceType, logicalId, physicalId, properties, attributes, entry, backfillDeps) {
 	const compositeIdentifier = Object.hasOwn(COMPOSITE_PHYSICAL_ID_IDENTIFIERS, resourceType) ? COMPOSITE_PHYSICAL_ID_IDENTIFIERS[resourceType] : void 0;
 	if (compositeIdentifier) {
 		if (entry.fields.length !== 1 || entry.fields[0] !== compositeIdentifier.field) throw new Error(`${resourceType} is registered in COMPOSITE_PHYSICAL_ID_IDENTIFIERS as identified by '${compositeIdentifier.field}', but CloudFormation now reports primaryIdentifier [${entry.fields.join(", ")}]. The registry schema changed under cdkd — update the entry in src/cli/commands/export.ts (or move the type to COMPOSITE_ID_SPLITTERS if its identifier is now composite too)`);
-		const value = compositeIdentifier.resolve({
+		const value = await resolveIdentifierValue(compositeIdentifier, {
 			logicalId,
 			physicalId,
 			attributes
-		});
+		}, backfillDeps);
 		return {
 			resourceIdentifier: { [compositeIdentifier.field]: value },
 			propertiesOverlay: {}
@@ -64077,7 +64769,8 @@ async function runPerStackImportLoop(args) {
 		const meta = nodesByCdkdName.get(node.stackName);
 		const plan = await buildImportPlan(meta.state, meta.template, deps.cfnClient, meta.cdkdStackName, {
 			recreateImportUnsupported: options.recreateImportUnsupported,
-			skipImportSupportPreflight: options.skipImportSupportPreflight === true
+			skipImportSupportPreflight: options.skipImportSupportPreflight === true,
+			...deps.ec2Client && { ec2Client: deps.ec2Client }
 		});
 		if (plan.blocked.length > 0) {
 			const lines = groupBlockedReasons(plan.blocked);
@@ -79087,7 +79780,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.25");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.27");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;