@go-to-k/cdkd 0.280.10 → 0.280.12

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as applyRoleArnIfSet, A as red, At as AssetManifestLoader, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefault, C as isStatefulRecreateTargetSync, Ct as validateAssetBucketName, D as cyan, Dn as withErrorHandling, Dt as getDockerCmd, E as bold, En as normalizeAwsError, Et as formatDockerLoginError, F as ProviderRegistry, Ft as getLegacyStateBucketName, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_BODY_LIMIT, H as cfnRefValueFromPhysicalId, Ht as resolveUseCdkBootstrapAssets, I as findActionableSilentDrops, It as resolveApp, J as readConfigString, Jt as findLargeInlineResources, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_URL_LIMIT, L as CloudControlProvider, Lt as resolveAutoAssetStorage, M as IAMRoleProvider, Mt as Synthesizer, N as collectInlinePolicyNamesManagedBySiblings, Nt as synthesisStatusMessage, O as gray, Ot as runDockerForeground, P as clearOnUpdateRemoval, Pt as getDefaultStateBucketName, Q as requireConfigString, Qt as processStackMessages, R as slowCcOperationTimeoutMs, Rt as resolveCaptureObservedState, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as parseBootstrapMarker, T as formatResourceLine, Tt as buildDockerImage, U as refStateLookupFromResource, Ut as stateBucketExistenceConfirmed, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefaultAndSource, W as WAFv2WebACLProvider, Wt as warnDeprecatedNoPrefixCliFlag, X as requireConfigArray, Xt as expectedOwnerParam, Y as replayWarn, Yt as uploadCfnTemplate, Z as requireConfigObject, Zt as AssemblyReader, _ as createPreDeleteFinalSnapshot, _n as ProvisioningError, _t as rewriteTemplateAssetReferences, a as DeploymentEventsStore, at as DagBuilder, b as unsupportedFinalSnapshotError, bn as StackHasActiveImportsError, bt as ensureAssetStorage, c as replayFailedOperations, ct as S3StateBackend, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalMigrateError, dt as AssetPublisher, en as resolveBucketRegion, et as DiffCalculator, f as computeImplicitDeleteEdges, fn as LocalStartServiceError, ft as stringifyValue, g as ccRoutedFinalSnapshotError, gn as PartialFailureError, gt as loadPublishableAssetManifest, h as buildFinalSnapshotIdentifier, hn as NestedStackChildDirectDestroyError, ht as createAssetRedirectResolver, i as DeploymentEventsReader, in as setAwsClients, it as isThrottlingError, j as yellow, jt as getDockerImageBySourceHash, k as green, kt as runDockerStreaming, l as replayRollback, ln as DeployCancelledError, lt as rebuildClientForBucketRegion, m as PRE_DELETE_SNAPSHOT_TYPES, mn as MissingCdkCliError, mt as buildAssetRedirectMap, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as getAwsClients, nt as withRetry, o as planFailedOps, on as CdkdError, ot as TemplateParser, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as WorkGraph, q as assertRegionMatch, qt as MIGRATE_TMP_PREFIX, r as DeployEngine, rn as resetAwsClients, rt as isRetryableTransientError, s as planRollback, st as LockManager, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AwsClients, tt as describeTypeWithThrottleRetry, u as withResourceDeadline, un as LocalInvokeBuildError$1, ut as shouldRetainResource, v as isFinalSnapshotError, vn as ResourceTimeoutError, vt as AssetModeResolver, w as renderStatefulReason, wt as validateContainerRepoName, x as extractDeploymentEventError, xn as StackTerminationProtectionError, xt as getBootstrapMarkerKey, y as refusesFinalSnapshot, yn as ResourceUpdateNotSupportedError, yt as BOOTSTRAP_MARKER_PREFIX, z as disableInstanceApiTermination, zt as resolveSkipPrefix } from "./deploy-engine-BJATTy_n.js";
+import { $ as applyRoleArnIfSet, A as red, At as AssetManifestLoader, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefault, C as isStatefulRecreateTargetSync, Ct as validateAssetBucketName, D as cyan, Dn as withErrorHandling, Dt as getDockerCmd, E as bold, En as normalizeAwsError, Et as formatDockerLoginError, F as ProviderRegistry, Ft as getLegacyStateBucketName, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_BODY_LIMIT, H as cfnRefValueFromPhysicalId, Ht as resolveUseCdkBootstrapAssets, I as findActionableSilentDrops, It as resolveApp, J as readConfigString, Jt as findLargeInlineResources, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_URL_LIMIT, L as CloudControlProvider, Lt as resolveAutoAssetStorage, M as IAMRoleProvider, Mt as Synthesizer, N as collectInlinePolicyNamesManagedBySiblings, Nt as synthesisStatusMessage, O as gray, Ot as runDockerForeground, P as clearOnUpdateRemoval, Pt as getDefaultStateBucketName, Q as requireConfigString, Qt as processStackMessages, R as slowCcOperationTimeoutMs, Rt as resolveCaptureObservedState, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as parseBootstrapMarker, T as formatResourceLine, Tt as buildDockerImage, U as refStateLookupFromResource, Ut as stateBucketExistenceConfirmed, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefaultAndSource, W as WAFv2WebACLProvider, Wt as warnDeprecatedNoPrefixCliFlag, X as requireConfigArray, Xt as expectedOwnerParam, Y as replayWarn, Yt as uploadCfnTemplate, Z as requireConfigObject, Zt as AssemblyReader, _ as createPreDeleteFinalSnapshot, _n as ProvisioningError, _t as rewriteTemplateAssetReferences, a as DeploymentEventsStore, at as DagBuilder, b as unsupportedFinalSnapshotError, bn as StackHasActiveImportsError, bt as ensureAssetStorage, c as replayFailedOperations, ct as S3StateBackend, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalMigrateError, dt as AssetPublisher, en as resolveBucketRegion, et as DiffCalculator, f as computeImplicitDeleteEdges, fn as LocalStartServiceError, ft as stringifyValue, g as ccRoutedFinalSnapshotError, gn as PartialFailureError, gt as loadPublishableAssetManifest, h as buildFinalSnapshotIdentifier, hn as NestedStackChildDirectDestroyError, ht as createAssetRedirectResolver, i as DeploymentEventsReader, in as setAwsClients, it as isThrottlingError, j as yellow, jt as getDockerImageBySourceHash, k as green, kt as runDockerStreaming, l as replayRollback, ln as DeployCancelledError, lt as rebuildClientForBucketRegion, m as PRE_DELETE_SNAPSHOT_TYPES, mn as MissingCdkCliError, mt as buildAssetRedirectMap, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as getAwsClients, nt as withRetry, o as planFailedOps, on as CdkdError, ot as TemplateParser, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as WorkGraph, q as assertRegionMatch, qt as MIGRATE_TMP_PREFIX, r as DeployEngine, rn as resetAwsClients, rt as isRetryableTransientError, s as planRollback, st as LockManager, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AwsClients, tt as describeTypeWithThrottleRetry, u as withResourceDeadline, un as LocalInvokeBuildError$1, ut as shouldRetainResource, v as isFinalSnapshotError, vn as ResourceTimeoutError, vt as AssetModeResolver, w as renderStatefulReason, wt as validateContainerRepoName, x as extractDeploymentEventError, xn as StackTerminationProtectionError, xt as getBootstrapMarkerKey, y as refusesFinalSnapshot, yn as ResourceUpdateNotSupportedError, yt as BOOTSTRAP_MARKER_PREFIX, z as disableInstanceApiTermination, zt as resolveSkipPrefix } from "./deploy-engine-CHhLFsDu.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-BVnACl8U.js";
+import { t as ASGProvider } from "./asg-provider-BjmkUhRq.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -31,7 +31,7 @@ import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { tmpdir } from "node:os";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
-import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupsCommand, ElasticLoadBalancingV2Client, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand, waitUntilLoadBalancerAvailable } from "@aws-sdk/client-elastic-load-balancing-v2";
+import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DeregisterTargetsCommand, DescribeCapacityReservationCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupAttributesCommand, DescribeTargetGroupsCommand, ElasticLoadBalancingV2Client, ModifyCapacityReservationCommand, ModifyIpPoolsCommand, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupAttributesCommand, ModifyTargetGroupCommand, RegisterTargetsCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand, waitUntilLoadBalancerAvailable } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { join as join$1 } from "path";
 import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$9, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotEmptyException, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
@@ -22003,7 +22003,17 @@ var ApiGatewayV2Provider = class {
 			"PayloadFormatVersion",
 			"TimeoutInMillis",
 			"RequestParameters",
-			"Description"
+			"Description",
+			"ConnectionId",
+			"ConnectionType",
+			"ContentHandlingStrategy",
+			"CredentialsArn",
+			"IntegrationSubtype",
+			"PassthroughBehavior",
+			"RequestTemplates",
+			"ResponseParameters",
+			"TemplateSelectionExpression",
+			"TlsConfig"
 		])],
 		["AWS::ApiGatewayV2::Route", /* @__PURE__ */ new Set([
 			"ApiId",
@@ -22229,7 +22239,17 @@ var ApiGatewayV2Provider = class {
 				PayloadFormatVersion: properties["PayloadFormatVersion"],
 				TimeoutInMillis: properties["TimeoutInMillis"],
 				RequestParameters: properties["RequestParameters"],
-				Description: properties["Description"]
+				Description: properties["Description"],
+				ConnectionId: properties["ConnectionId"],
+				ConnectionType: properties["ConnectionType"],
+				ContentHandlingStrategy: properties["ContentHandlingStrategy"],
+				CredentialsArn: properties["CredentialsArn"],
+				IntegrationSubtype: properties["IntegrationSubtype"],
+				PassthroughBehavior: properties["PassthroughBehavior"],
+				RequestTemplates: properties["RequestTemplates"],
+				ResponseParameters: this.toSdkResponseParameters(properties["ResponseParameters"]),
+				TemplateSelectionExpression: properties["TemplateSelectionExpression"],
+				TlsConfig: properties["TlsConfig"]
 			}))).IntegrationId;
 			this.logger.debug(`Successfully created API Gateway V2 Integration ${logicalId}: ${integrationId}`);
 			return {
@@ -22448,6 +22468,16 @@ var ApiGatewayV2Provider = class {
 			if (resp.TimeoutInMillis !== void 0) result["TimeoutInMillis"] = resp.TimeoutInMillis;
 			if (resp.RequestParameters !== void 0) result["RequestParameters"] = resp.RequestParameters;
 			if (resp.Description !== void 0) result["Description"] = resp.Description;
+			if (resp.ConnectionId !== void 0) result["ConnectionId"] = resp.ConnectionId;
+			if (resp.ConnectionType !== void 0) result["ConnectionType"] = resp.ConnectionType;
+			if (resp.ContentHandlingStrategy !== void 0) result["ContentHandlingStrategy"] = resp.ContentHandlingStrategy;
+			if (resp.CredentialsArn !== void 0) result["CredentialsArn"] = resp.CredentialsArn;
+			if (resp.IntegrationSubtype !== void 0) result["IntegrationSubtype"] = resp.IntegrationSubtype;
+			if (resp.PassthroughBehavior !== void 0) result["PassthroughBehavior"] = resp.PassthroughBehavior;
+			if (resp.RequestTemplates !== void 0) result["RequestTemplates"] = resp.RequestTemplates;
+			if (resp.ResponseParameters !== void 0) result["ResponseParameters"] = this.toCfnResponseParameters(resp.ResponseParameters);
+			if (resp.TemplateSelectionExpression !== void 0) result["TemplateSelectionExpression"] = resp.TemplateSelectionExpression;
+			if (resp.TlsConfig !== void 0) result["TlsConfig"] = resp.TlsConfig;
 			return result;
 		} catch (err) {
 			if (err instanceof NotFoundException$3) return void 0;
@@ -22730,7 +22760,11 @@ var ApiGatewayV2Provider = class {
 	* `UpdateIntegration` keys on `(ApiId, IntegrationId)`. Mutable
 	* fields cdkd manages: `IntegrationType` / `IntegrationUri` /
 	* `IntegrationMethod` / `PayloadFormatVersion` / `TimeoutInMillis` /
-	* `RequestParameters` / `Description`.
+	* `RequestParameters` / `Description`, plus the issue #609 backfill
+	* (`ConnectionId` / `ConnectionType` / `ContentHandlingStrategy` /
+	* `CredentialsArn` / `IntegrationSubtype` / `PassthroughBehavior` /
+	* `RequestTemplates` / `ResponseParameters` / `TemplateSelectionExpression`
+	* / `TlsConfig`).
 	*/
 	async updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties) {
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
@@ -22775,6 +22809,50 @@ var ApiGatewayV2Provider = class {
 				changed = true;
 			}
 		}
+		if (properties["ConnectionId"] != null && properties["ConnectionId"] !== previousProperties["ConnectionId"]) {
+			input.ConnectionId = properties["ConnectionId"];
+			changed = true;
+		}
+		if (properties["ConnectionType"] != null && properties["ConnectionType"] !== previousProperties["ConnectionType"]) {
+			input.ConnectionType = properties["ConnectionType"];
+			changed = true;
+		}
+		if (properties["ContentHandlingStrategy"] != null && properties["ContentHandlingStrategy"] !== previousProperties["ContentHandlingStrategy"]) {
+			input.ContentHandlingStrategy = properties["ContentHandlingStrategy"];
+			changed = true;
+		}
+		if (properties["CredentialsArn"] != null && properties["CredentialsArn"] !== previousProperties["CredentialsArn"]) {
+			input.CredentialsArn = properties["CredentialsArn"];
+			changed = true;
+		}
+		if (properties["IntegrationSubtype"] != null && properties["IntegrationSubtype"] !== previousProperties["IntegrationSubtype"]) {
+			input.IntegrationSubtype = properties["IntegrationSubtype"];
+			changed = true;
+		}
+		if (input.IntegrationSubtype === void 0) {
+			const liveSubtype = properties["IntegrationSubtype"] ?? previousProperties["IntegrationSubtype"];
+			if (liveSubtype !== void 0) input.IntegrationSubtype = liveSubtype;
+		}
+		if (properties["PassthroughBehavior"] != null && properties["PassthroughBehavior"] !== previousProperties["PassthroughBehavior"]) {
+			input.PassthroughBehavior = properties["PassthroughBehavior"];
+			changed = true;
+		}
+		if (properties["RequestTemplates"] != null && !this.deepEqual(properties["RequestTemplates"], previousProperties["RequestTemplates"])) {
+			input.RequestTemplates = properties["RequestTemplates"];
+			changed = true;
+		}
+		if (properties["ResponseParameters"] != null && !this.deepEqual(properties["ResponseParameters"], previousProperties["ResponseParameters"])) {
+			input.ResponseParameters = this.toSdkResponseParameters(properties["ResponseParameters"]);
+			changed = true;
+		}
+		if (properties["TemplateSelectionExpression"] != null && properties["TemplateSelectionExpression"] !== previousProperties["TemplateSelectionExpression"]) {
+			input.TemplateSelectionExpression = properties["TemplateSelectionExpression"];
+			changed = true;
+		}
+		if (properties["TlsConfig"] != null && !this.deepEqual(properties["TlsConfig"], previousProperties["TlsConfig"])) {
+			input.TlsConfig = properties["TlsConfig"];
+			changed = true;
+		}
 		if (!changed) {
 			this.logger.debug(`No mutable Integration fields changed for ${logicalId}; skipping UpdateIntegration`);
 			return {
@@ -23125,6 +23203,84 @@ var ApiGatewayV2Provider = class {
 		return merged;
 	}
 	/**
+	* `ResponseParameters` is the one `AWS::ApiGatewayV2::Integration` property
+	* whose CFn shape does NOT match the SDK's, so forwarding it verbatim is not
+	* an option (issue #609). CloudFormation models it as
+	* `{ "<statusCode>": { ResponseParameters: [{ Destination, Source }, ...] } }`
+	* while `CreateIntegration` / `UpdateIntegration` take the flattened
+	* `{ "<statusCode>": { "<Destination>": "<Source>" } }`. The AWS SDK v3
+	* serializer drops members it cannot model, so the un-converted CFn shape
+	* would deliver an EMPTY map per status code — the silent-drop class one
+	* level down.
+	*
+	* Anything that is not the expected object / array shape (an unresolved
+	* intrinsic, a malformed block) passes through untouched so AWS surfaces the
+	* real validation error instead of cdkd inventing one.
+	*
+	* `Source` is COERCED from a number / boolean rather than skipped. CFn types
+	* `ResponseParameters` as free-form `object` and coerces scalars, cdkd does
+	* not (the `coerceNumber` class in `.claude/rules/providers.md`), so an
+	* unquoted `Source: 403` under the canonical `overwrite:statuscode`
+	* destination is a perfectly legal template whose value arrives as a NUMBER.
+	* Skipping it would re-introduce the silent drop this method exists to close.
+	* A `Destination` is never coerced — it becomes an SDK map KEY, and a
+	* non-string there is a malformed template, not a scalar shorthand.
+	*/
+	toSdkResponseParameters(value) {
+		if (value == null) return void 0;
+		if (typeof value !== "object" || Array.isArray(value)) return value;
+		const out = {};
+		for (const [statusCode, block] of Object.entries(value)) {
+			if (block == null || typeof block !== "object" || Array.isArray(block)) {
+				out[statusCode] = block;
+				continue;
+			}
+			const entries = block["ResponseParameters"];
+			if (!Array.isArray(entries)) {
+				out[statusCode] = block;
+				continue;
+			}
+			const mapped = {};
+			for (const entry of entries) {
+				const destination = entry != null && typeof entry === "object" && !Array.isArray(entry) ? entry["Destination"] : void 0;
+				const source = entry != null && typeof entry === "object" && !Array.isArray(entry) ? entry["Source"] : void 0;
+				const coerced = typeof source === "string" ? source : typeof source === "number" || typeof source === "boolean" ? String(source) : void 0;
+				if (typeof destination !== "string" || coerced === void 0) {
+					this.logger.warn(`AWS::ApiGatewayV2::Integration ResponseParameters['${statusCode}'] has an entry cdkd cannot deliver (Destination must be a string and Source a string / number / boolean; got ${JSON.stringify(destination)} / ${JSON.stringify(source)}); skipping that entry.`);
+					continue;
+				}
+				mapped[destination] = coerced;
+			}
+			out[statusCode] = mapped;
+		}
+		return out;
+	}
+	/**
+	* Inverse of {@link toSdkResponseParameters}, for `readCurrentState`. Without
+	* it the AWS-current side would carry the flat SDK map while the cdkd
+	* baseline carries the CFn list-of-pairs, and every `cdkd drift` run would
+	* report permanent phantom drift on a resource nobody touched.
+	*
+	* The pairs are sorted by `Destination` because this turns an UNORDERED SDK
+	* map into an ARRAY, and `calculateResourceDrift` compares arrays
+	* POSITIONALLY — AWS does not guarantee map readback order, so an unsorted
+	* rebuild would trade the shape-mismatch phantom drift for an ordering one
+	* (and `--revert` would re-push an identical value forever). Same reasoning
+	* as `src/analyzer/drift-normalize.ts`, applied at the source instead.
+	*/
+	toCfnResponseParameters(value) {
+		if (value == null) return void 0;
+		const out = {};
+		for (const [statusCode, flat] of Object.entries(value)) {
+			if (flat == null || typeof flat !== "object" || Array.isArray(flat)) continue;
+			out[statusCode] = { ResponseParameters: Object.entries(flat).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([destination, source]) => ({
+				Destination: destination,
+				Source: source
+			})) };
+		}
+		return out;
+	}
+	/**
 	* Convert CloudFormation Tags (Array<{Key, Value}>) to SDK Tags (Record<string, string>).
 	*/
 	cfnTagsToRecord(tags) {
@@ -27352,6 +27508,36 @@ var ECSProvider = class {
 //#endregion
 //#region src/provisioning/providers/elbv2-provider.ts
 /**
+* Test seam for the capacity-reservation stabilize poll (mirrors
+* `finalSnapshotDelays` in ../final-snapshot.ts). Unit tests stub `sleep`
+* so the poll runs without wall-clock delay.
+*/
+const capacityReservationDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
+/**
+* Documented AWS defaults for TargetGroup attributes, used to reset a
+* removed `TargetGroupAttributes` entry. Unlike ModifyLoadBalancerAttributes
+* / ModifyListenerAttributes, ModifyTargetGroupAttributes REJECTS an empty
+* `Value` ("A target group attribute value must be specified" — live-verified
+* 2026-08-11), so clearing an override requires sending the documented
+* default explicitly. Keys whose default is target-type-dependent or
+* undocumented are deliberately absent — a removal of those warns and
+* retains the live value instead of guessing.
+* Source: ELBv2 API reference, TargetGroupAttribute key table.
+*/
+const TARGET_GROUP_ATTRIBUTE_DEFAULTS = {
+	"deregistration_delay.timeout_seconds": "300",
+	"deregistration_delay.connection_termination.enabled": "false",
+	"stickiness.enabled": "false",
+	"stickiness.lb_cookie.duration_seconds": "86400",
+	"stickiness.app_cookie.duration_seconds": "86400",
+	"load_balancing.algorithm.type": "round_robin",
+	"load_balancing.algorithm.anomaly_mitigation": "off",
+	"load_balancing.cross_zone.enabled": "use_load_balancer_configuration",
+	"slow_start.duration_seconds": "0",
+	"lambda.multi_value_headers.enabled": "false",
+	"proxy_protocol_v2.enabled": "false"
+};
+/**
 * AWS ELBv2 Provider
 *
 * Implements resource provisioning for ELBv2 resources:
@@ -27384,7 +27570,12 @@ var ELBv2Provider = class {
 			"Type",
 			"IpAddressType",
 			"LoadBalancerAttributes",
-			"Tags"
+			"Tags",
+			"EnablePrefixForIpv6SourceNat",
+			"EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic",
+			"Ipv4IpamPoolId",
+			"MinimumLoadBalancerCapacity",
+			"EnableCapacityReservationProvisionStabilize"
 		])],
 		["AWS::ElasticLoadBalancingV2::TargetGroup", /* @__PURE__ */ new Set([
 			"Protocol",
@@ -27402,7 +27593,11 @@ var ELBv2Provider = class {
 			"UnhealthyThresholdCount",
 			"Matcher",
 			"Name",
-			"Tags"
+			"Tags",
+			"IpAddressType",
+			"TargetControlPort",
+			"TargetGroupAttributes",
+			"Targets"
 		])],
 		["AWS::ElasticLoadBalancingV2::Listener", /* @__PURE__ */ new Set([
 			"LoadBalancerArn",
@@ -27458,6 +27653,7 @@ var ELBv2Provider = class {
 		try {
 			const tags = this.extractTags(properties);
 			const lbName = generateResourceNameWithFallback(properties["Name"], logicalId, { maxLength: 32 });
+			const ipv4IpamPoolId = properties["Ipv4IpamPoolId"];
 			const lb = (await this.getClient().send(new CreateLoadBalancerCommand({
 				Name: lbName,
 				Subnets: properties["Subnets"],
@@ -27466,6 +27662,8 @@ var ELBv2Provider = class {
 				Scheme: properties["Scheme"],
 				Type: properties["Type"],
 				IpAddressType: properties["IpAddressType"],
+				EnablePrefixForIpv6SourceNat: properties["EnablePrefixForIpv6SourceNat"],
+				...ipv4IpamPoolId !== void 0 && { IpamPools: { Ipv4IpamPoolId: ipv4IpamPoolId } },
 				...tags.length > 0 && { Tags: tags }
 			}))).LoadBalancers?.[0];
 			if (!lb || !lb.LoadBalancerArn) throw new Error("CreateLoadBalancer did not return LoadBalancer ARN");
@@ -27482,17 +27680,32 @@ var ELBv2Provider = class {
 					}, { LoadBalancerArns: [lbArn] });
 					this.logger.debug(`LoadBalancer ${logicalId} is active`);
 				} else this.logger.debug(`LoadBalancer ${logicalId} created (skipping active-state wait per --no-wait)`);
-				const lbAttributes = properties["LoadBalancerAttributes"];
-				if (lbAttributes && lbAttributes.length > 0) {
+				const lbAttributes = this.normalizeAttributes(properties["LoadBalancerAttributes"]);
+				if (lbAttributes.length > 0) {
 					await this.getClient().send(new ModifyLoadBalancerAttributesCommand({
 						LoadBalancerArn: lbArn,
-						Attributes: lbAttributes.map((attr) => ({
-							Key: attr.Key,
-							Value: attr.Value
-						}))
+						Attributes: lbAttributes
 					}));
 					this.logger.debug(`Applied ${lbAttributes.length} LoadBalancer attributes for ${logicalId}`);
 				}
+				const enforcePrivateLink = properties["EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic"];
+				if (enforcePrivateLink !== void 0) {
+					await this.getClient().send(new SetSecurityGroupsCommand({
+						LoadBalancerArn: lbArn,
+						SecurityGroups: properties["SecurityGroups"] ?? [],
+						EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic: enforcePrivateLink
+					}));
+					this.logger.debug(`Applied EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic=${enforcePrivateLink} for ${logicalId}`);
+				}
+				const minCapacity = properties["MinimumLoadBalancerCapacity"];
+				if (minCapacity?.CapacityUnits !== void 0) {
+					await this.getClient().send(new ModifyCapacityReservationCommand({
+						LoadBalancerArn: lbArn,
+						MinimumLoadBalancerCapacity: { CapacityUnits: Number(minCapacity.CapacityUnits) }
+					}));
+					this.logger.debug(`Requested capacity reservation of ${minCapacity.CapacityUnits} LCU for ${logicalId}`);
+					if (isTruthyCfnBoolean(properties["EnableCapacityReservationProvisionStabilize"]) && process.env["CDKD_NO_WAIT"] !== "true") await this.waitForCapacityReservationProvisioned(lbArn, logicalId);
+				}
 			} catch (innerError) {
 				try {
 					await this.getClient().send(new DeleteLoadBalancerCommand({ LoadBalancerArn: lbArn }));
@@ -27524,7 +27737,12 @@ var ELBv2Provider = class {
 			"SubnetMappings",
 			"SecurityGroups",
 			"IpAddressType",
-			"Tags"
+			"Tags",
+			"EnablePrefixForIpv6SourceNat",
+			"EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic",
+			"Ipv4IpamPoolId",
+			"MinimumLoadBalancerCapacity",
+			"EnableCapacityReservationProvisionStabilize"
 		]);
 		const stripHandled = (p) => {
 			const out = {};
@@ -27532,19 +27750,7 @@ var ELBv2Provider = class {
 			return out;
 		};
 		if (JSON.stringify(stripHandled(properties)) !== JSON.stringify(stripHandled(previousProperties))) throw new ResourceUpdateNotSupportedError("AWS::ElasticLoadBalancingV2::LoadBalancer", logicalId, "ELBv2 LoadBalancer Name / Type / Scheme are immutable on AWS — none of the ELBv2 Modify* / Set* APIs accept these fields; they are fixed at creation. cdkd handles LoadBalancerAttributes / Subnets / SubnetMappings / SecurityGroups / IpAddressType / Tags in-place; for Name / Type / Scheme re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.");
-		const newAttrs = properties["LoadBalancerAttributes"] ?? [];
-		const oldAttrs = previousProperties["LoadBalancerAttributes"] ?? [];
-		const newAttrMap = new Map(newAttrs.map((a) => [a.Key, a.Value]));
-		const oldAttrMap = new Map(oldAttrs.map((a) => [a.Key, a.Value]));
-		const submittedAttrs = [];
-		for (const [k, v] of newAttrMap) if (oldAttrMap.get(k) !== v) submittedAttrs.push({
-			Key: k,
-			Value: v
-		});
-		for (const [k] of oldAttrMap) if (!newAttrMap.has(k)) submittedAttrs.push({
-			Key: k,
-			Value: ""
-		});
+		const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["LoadBalancerAttributes"]), this.normalizeAttributes(previousProperties["LoadBalancerAttributes"]));
 		if (submittedAttrs.length > 0) {
 			await this.getClient().send(new ModifyLoadBalancerAttributesCommand({
 				LoadBalancerArn: physicalId,
@@ -27556,21 +27762,28 @@ var ELBv2Provider = class {
 		const oldSubnets = previousProperties["Subnets"];
 		const newMappings = properties["SubnetMappings"];
 		const oldMappings = previousProperties["SubnetMappings"];
+		const newIpv6SourceNat = properties["EnablePrefixForIpv6SourceNat"];
+		const oldIpv6SourceNat = previousProperties["EnablePrefixForIpv6SourceNat"];
 		const subnetsChanged = JSON.stringify(newSubnets) !== JSON.stringify(oldSubnets);
 		const mappingsChanged = JSON.stringify(newMappings) !== JSON.stringify(oldMappings);
-		if (subnetsChanged || mappingsChanged) {
+		if (subnetsChanged || mappingsChanged || newIpv6SourceNat !== void 0 && newIpv6SourceNat !== oldIpv6SourceNat) {
 			await this.getClient().send(new SetSubnetsCommand({
 				LoadBalancerArn: physicalId,
-				...newMappings && newMappings.length > 0 ? { SubnetMappings: newMappings } : { Subnets: newSubnets }
+				...newMappings && newMappings.length > 0 ? { SubnetMappings: newMappings } : { Subnets: newSubnets },
+				...newIpv6SourceNat !== void 0 && { EnablePrefixForIpv6SourceNat: newIpv6SourceNat }
 			}));
 			this.logger.debug(`Updated Subnets / SubnetMappings for ${logicalId}`);
 		}
 		const newSGs = properties["SecurityGroups"];
 		const oldSGs = previousProperties["SecurityGroups"];
-		if (JSON.stringify(newSGs) !== JSON.stringify(oldSGs)) {
+		const newEnforce = properties["EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic"];
+		const oldEnforce = previousProperties["EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic"];
+		const enforceChanged = newEnforce !== void 0 && newEnforce !== oldEnforce;
+		if (JSON.stringify(newSGs) !== JSON.stringify(oldSGs) || enforceChanged) {
 			await this.getClient().send(new SetSecurityGroupsCommand({
 				LoadBalancerArn: physicalId,
-				SecurityGroups: newSGs ?? []
+				SecurityGroups: newSGs ?? [],
+				...newEnforce !== void 0 && { EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic: newEnforce }
 			}));
 			this.logger.debug(`Updated SecurityGroups for ${logicalId}`);
 		}
@@ -27583,12 +27796,64 @@ var ELBv2Provider = class {
 			}));
 			this.logger.debug(`Updated IpAddressType for ${logicalId}`);
 		}
+		const newIpamPool = properties["Ipv4IpamPoolId"];
+		if (newIpamPool !== previousProperties["Ipv4IpamPoolId"]) {
+			await this.getClient().send(new ModifyIpPoolsCommand({
+				LoadBalancerArn: physicalId,
+				...newIpamPool !== void 0 ? { IpamPools: { Ipv4IpamPoolId: newIpamPool } } : { RemoveIpamPools: ["ipv4"] }
+			}));
+			this.logger.debug(newIpamPool !== void 0 ? `Updated Ipv4IpamPoolId for ${logicalId}` : `Removed IPAM pool association for ${logicalId}`);
+		}
+		const newCapacity = properties["MinimumLoadBalancerCapacity"];
+		const oldCapacity = previousProperties["MinimumLoadBalancerCapacity"];
+		const newCapacityUnits = newCapacity?.CapacityUnits !== void 0 ? Number(newCapacity.CapacityUnits) : void 0;
+		if (newCapacityUnits !== (oldCapacity?.CapacityUnits !== void 0 ? Number(oldCapacity.CapacityUnits) : void 0)) {
+			await this.getClient().send(new ModifyCapacityReservationCommand({
+				LoadBalancerArn: physicalId,
+				...newCapacityUnits !== void 0 ? { MinimumLoadBalancerCapacity: { CapacityUnits: newCapacityUnits } } : { ResetCapacityReservation: true }
+			}));
+			this.logger.debug(newCapacityUnits !== void 0 ? `Requested capacity reservation of ${newCapacityUnits} LCU for ${logicalId}` : `Reset capacity reservation for ${logicalId}`);
+			if (newCapacityUnits !== void 0 && isTruthyCfnBoolean(properties["EnableCapacityReservationProvisionStabilize"]) && process.env["CDKD_NO_WAIT"] !== "true") await this.waitForCapacityReservationProvisioned(physicalId, logicalId);
+		}
 		await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
 		return {
 			physicalId,
 			wasReplaced: false
 		};
 	}
+	/**
+	* Poll DescribeCapacityReservation until every zonal state reports
+	* `provisioned` — the semantics of the CFn-only
+	* `EnableCapacityReservationProvisionStabilize` flag (no SDK member; it
+	* opts the deploy into waiting for the reservation instead of returning
+	* while zones are still `pending`). Bounded at ~10 min / 15s interval;
+	* a timeout WARNS and continues (the reservation keeps provisioning
+	* asynchronously and the ModifyCapacityReservation was accepted), while a
+	* `failed` zonal state throws — that reservation will never provision.
+	*/
+	async waitForCapacityReservationProvisioned(lbArn, logicalId) {
+		const maxAttempts = 40;
+		const intervalMs = 15e3;
+		this.logger.debug(`Waiting for capacity reservation of ${logicalId} to provision...`);
+		for (let attempt = 0; attempt < maxAttempts; attempt++) {
+			let zones;
+			try {
+				zones = (await this.getClient().send(new DescribeCapacityReservationCommand({ LoadBalancerArn: lbArn }))).CapacityReservationState ?? [];
+			} catch (probeError) {
+				this.logger.debug(`DescribeCapacityReservation for ${logicalId} failed transiently (attempt ${attempt + 1}/${maxAttempts}): ${probeError instanceof Error ? probeError.message : String(probeError)}`);
+				await capacityReservationDelays.sleep(intervalMs);
+				continue;
+			}
+			const failed = zones.find((z) => z.State?.Code === "failed");
+			if (failed) throw new Error(`Capacity reservation for ${logicalId} failed in ${failed.AvailabilityZone ?? "an availability zone"}: ${failed.State?.Reason ?? "no reason reported"}`);
+			if (zones.length === 0 || zones.every((z) => z.State?.Code === "provisioned")) {
+				this.logger.debug(`Capacity reservation for ${logicalId} is provisioned`);
+				return;
+			}
+			await capacityReservationDelays.sleep(intervalMs);
+		}
+		this.logger.warn(`Capacity reservation for ${logicalId} did not reach 'provisioned' within ${maxAttempts * intervalMs / 6e4} minutes; continuing (provisioning completes asynchronously)`);
+	}
 	async deleteLoadBalancer(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting LoadBalancer ${logicalId}: ${physicalId}`);
 		if (context?.removeProtection === true) try {
@@ -27637,16 +27902,45 @@ var ELBv2Provider = class {
 				HealthCheckTimeoutSeconds: properties["HealthCheckTimeoutSeconds"] !== void 0 ? Number(properties["HealthCheckTimeoutSeconds"]) : void 0,
 				HealthyThresholdCount: properties["HealthyThresholdCount"] !== void 0 ? Number(properties["HealthyThresholdCount"]) : void 0,
 				UnhealthyThresholdCount: properties["UnhealthyThresholdCount"] !== void 0 ? Number(properties["UnhealthyThresholdCount"]) : void 0,
+				IpAddressType: properties["IpAddressType"],
+				TargetControlPort: properties["TargetControlPort"] !== void 0 ? Number(properties["TargetControlPort"]) : void 0,
 				...matcher && { Matcher: matcher },
 				...tags.length > 0 && { Tags: tags }
 			}))).TargetGroups?.[0];
 			if (!tg || !tg.TargetGroupArn) throw new Error("CreateTargetGroup did not return TargetGroup ARN");
-			this.logger.debug(`Successfully created TargetGroup ${logicalId}: ${tg.TargetGroupArn}`);
+			const tgArn = tg.TargetGroupArn;
+			this.logger.debug(`Successfully created TargetGroup ${logicalId}: ${tgArn}`);
+			try {
+				const tgAttributes = this.normalizeAttributes(properties["TargetGroupAttributes"]);
+				if (tgAttributes.length > 0) {
+					await this.getClient().send(new ModifyTargetGroupAttributesCommand({
+						TargetGroupArn: tgArn,
+						Attributes: tgAttributes
+					}));
+					this.logger.debug(`Applied ${tgAttributes.length} TargetGroup attribute(s) for ${logicalId}`);
+				}
+				const targets = this.convertTargets(properties["Targets"]);
+				if (targets.length > 0) {
+					await this.getClient().send(new RegisterTargetsCommand({
+						TargetGroupArn: tgArn,
+						Targets: targets
+					}));
+					this.logger.debug(`Registered ${targets.length} target(s) for ${logicalId}`);
+				}
+			} catch (innerError) {
+				try {
+					await this.getClient().send(new DeleteTargetGroupCommand({ TargetGroupArn: tgArn }));
+					this.logger.debug(`Cleaned up partially-created TargetGroup ${logicalId} (${tgArn}) after wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created TargetGroup ${logicalId} (${tgArn}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws elbv2 delete-target-group --target-group-arn ${tgArn}`);
+				}
+				throw innerError;
+			}
 			return {
-				physicalId: tg.TargetGroupArn,
+				physicalId: tgArn,
 				attributes: {
-					TargetGroupArn: tg.TargetGroupArn,
-					TargetGroupFullName: tg.TargetGroupArn?.split(":").pop()?.replace("targetgroup/", ""),
+					TargetGroupArn: tgArn,
+					TargetGroupFullName: tgArn.split(":").pop()?.replace("targetgroup/", ""),
 					TargetGroupName: tg.TargetGroupName
 				}
 			};
@@ -27657,6 +27951,13 @@ var ELBv2Provider = class {
 	}
 	async updateTargetGroup(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating TargetGroup ${logicalId}: ${physicalId}`);
+		const immutableChanged = (key, coerce) => {
+			const next = properties[key];
+			const prev = previousProperties[key];
+			if (coerce) return (next !== void 0 ? Number(next) : void 0) !== (prev !== void 0 ? Number(prev) : void 0);
+			return JSON.stringify(next) !== JSON.stringify(prev);
+		};
+		for (const [immutableKey, coerce] of [["IpAddressType", false], ["TargetControlPort", true]]) if (immutableChanged(immutableKey, coerce)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `ELBv2 TargetGroup ${immutableKey} is immutable on AWS — no Modify* API accepts it; it is fixed at creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
 		try {
 			const rawMatcher = properties["Matcher"];
 			const matcher = rawMatcher && (rawMatcher.HttpCode !== void 0 || rawMatcher.GrpcCode !== void 0) ? rawMatcher : void 0;
@@ -27673,6 +27974,43 @@ var ELBv2Provider = class {
 				UnhealthyThresholdCount: properties["UnhealthyThresholdCount"] !== void 0 ? Number(properties["UnhealthyThresholdCount"]) : void 0,
 				...matcher && { Matcher: matcher }
 			}));
+			const tgAttrDiff = this.diffAttributes(this.normalizeAttributes(properties["TargetGroupAttributes"]), this.normalizeAttributes(previousProperties["TargetGroupAttributes"]), (key) => {
+				const fallback = TARGET_GROUP_ATTRIBUTE_DEFAULTS[key];
+				if (fallback === void 0) this.logger.warn(`TargetGroup attribute ${key} was removed from the template but has no documented default cdkd can reset it to — the live value is retained. Set the attribute explicitly to change it.`);
+				return fallback;
+			});
+			if (tgAttrDiff.length > 0) {
+				await this.getClient().send(new ModifyTargetGroupAttributesCommand({
+					TargetGroupArn: physicalId,
+					Attributes: tgAttrDiff
+				}));
+				this.logger.debug(`Applied ${tgAttrDiff.length} TargetGroupAttributes change(s) for ${logicalId}`);
+			}
+			const newTargets = this.convertTargets(properties["Targets"]);
+			const oldTargets = this.convertTargets(previousProperties["Targets"]);
+			const targetKey = (t) => JSON.stringify([
+				t.Id,
+				t.Port ?? null,
+				t.AvailabilityZone ?? null
+			]);
+			const oldTargetKeys = new Set(oldTargets.map(targetKey));
+			const newTargetKeys = new Set(newTargets.map(targetKey));
+			const targetsToRegister = newTargets.filter((t) => !oldTargetKeys.has(targetKey(t)));
+			const targetsToDeregister = oldTargets.filter((t) => !newTargetKeys.has(targetKey(t)));
+			if (targetsToRegister.length > 0) {
+				await this.getClient().send(new RegisterTargetsCommand({
+					TargetGroupArn: physicalId,
+					Targets: targetsToRegister
+				}));
+				this.logger.debug(`Registered ${targetsToRegister.length} target(s) for ${logicalId}`);
+			}
+			if (targetsToDeregister.length > 0) {
+				await this.getClient().send(new DeregisterTargetsCommand({
+					TargetGroupArn: physicalId,
+					Targets: targetsToDeregister
+				}));
+				this.logger.debug(`Deregistered ${targetsToDeregister.length} target(s) for ${logicalId}`);
+			}
 			const tg = (await this.getClient().send(new DescribeTargetGroupsCommand({ TargetGroupArns: [physicalId] }))).TargetGroups?.[0];
 			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
 			this.logger.debug(`Successfully updated TargetGroup ${logicalId}`);
@@ -27771,19 +28109,7 @@ var ELBv2Provider = class {
 				...alpnPolicy && alpnPolicy.length > 0 && { AlpnPolicy: alpnPolicy },
 				...mutualAuth !== void 0 && { MutualAuthentication: mutualAuth }
 			}));
-			const newAttrs = this.normalizeAttributes(properties["ListenerAttributes"]);
-			const oldAttrs = this.normalizeAttributes(previousProperties["ListenerAttributes"]);
-			const newAttrMap = new Map(newAttrs.map((a) => [a.Key, a.Value]));
-			const oldAttrMap = new Map(oldAttrs.map((a) => [a.Key, a.Value]));
-			const submittedAttrs = [];
-			for (const [k, v] of newAttrMap) if (oldAttrMap.get(k) !== v) submittedAttrs.push({
-				Key: k,
-				Value: v
-			});
-			for (const [k] of oldAttrMap) if (!newAttrMap.has(k)) submittedAttrs.push({
-				Key: k,
-				Value: ""
-			});
+			const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["ListenerAttributes"]), this.normalizeAttributes(previousProperties["ListenerAttributes"]));
 			if (submittedAttrs.length > 0) {
 				await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
 					ListenerArn: physicalId,
@@ -27859,6 +28185,58 @@ var ELBv2Provider = class {
 		return out;
 	}
 	/**
+	* Key-diff two normalized `{Key, Value}` attribute lists into the payload
+	* for a Modify*Attributes call: changed values from `newAttrs` win, and
+	* keys present only in `oldAttrs` are pushed back through `removalValue` —
+	* by default the empty string, which ModifyLoadBalancerAttributes /
+	* ModifyListenerAttributes accept as "clear the override". A resolver
+	* returning `undefined` SKIPS the entry (the resolver owns any warn).
+	* An empty return means nothing changed and the call should be skipped.
+	* Shared by the LoadBalancer / TargetGroup / Listener update paths.
+	*/
+	diffAttributes(newAttrs, oldAttrs, removalValue = () => "") {
+		const newAttrMap = new Map(newAttrs.map((a) => [a.Key, a.Value]));
+		const oldAttrMap = new Map(oldAttrs.map((a) => [a.Key, a.Value]));
+		const submitted = [];
+		for (const [k, v] of newAttrMap) if (oldAttrMap.get(k) !== v) submitted.push({
+			Key: k,
+			Value: v
+		});
+		for (const [k] of oldAttrMap) if (!newAttrMap.has(k)) {
+			const value = removalValue(k);
+			if (value !== void 0) submitted.push({
+				Key: k,
+				Value: value
+			});
+		}
+		return submitted;
+	}
+	/**
+	* Normalize a CFn `Targets` value (an array of `{ Id, Port?,
+	* AvailabilityZone? }` objects) into the SDK's `TargetDescription[]` shape.
+	* Entries missing an `Id` are dropped (Id is the only required member);
+	* `Port` is numeric-coerced (CFn templates may carry it as a string).
+	* Returns `[]` for an absent / non-array value so callers can branch on
+	* `.length`.
+	*/
+	convertTargets(raw) {
+		if (!Array.isArray(raw)) return [];
+		const out = [];
+		for (const entry of raw) {
+			if (entry === null || typeof entry !== "object" || typeof entry.Id !== "string" || entry.Id.length === 0) {
+				this.logger.warn(`Dropping malformed TargetGroup Targets entry (missing string Id): ${JSON.stringify(entry)}`);
+				continue;
+			}
+			const e = entry;
+			out.push({
+				Id: e.Id,
+				...e.Port !== void 0 && { Port: Number(e.Port) },
+				...e.AvailabilityZone !== void 0 && { AvailabilityZone: e.AvailabilityZone }
+			});
+		}
+		return out;
+	}
+	/**
 	* Apply a diff between old and new CFn-shape Tags arrays via ELBv2's
 	* `AddTags` / `RemoveTags` APIs. Both accept `ResourceArns: [arn]`
 	* (single ARN), `Tags: [{Key, Value}]` for AddTags, and
@@ -27956,6 +28334,15 @@ var ELBv2Provider = class {
 		if (lb.Scheme !== void 0) result["Scheme"] = lb.Scheme;
 		if (lb.Type !== void 0) result["Type"] = lb.Type;
 		if (lb.IpAddressType !== void 0) result["IpAddressType"] = lb.IpAddressType;
+		if (lb.EnablePrefixForIpv6SourceNat !== void 0) result["EnablePrefixForIpv6SourceNat"] = lb.EnablePrefixForIpv6SourceNat;
+		if (lb.EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic !== void 0) result["EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic"] = lb.EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic;
+		if (lb.IpamPools?.Ipv4IpamPoolId !== void 0) result["Ipv4IpamPoolId"] = lb.IpamPools.Ipv4IpamPoolId;
+		try {
+			const units = (await this.getClient().send(new DescribeCapacityReservationCommand({ LoadBalancerArn: physicalId }))).MinimumLoadBalancerCapacity?.CapacityUnits;
+			if (units !== void 0 && units > 0) result["MinimumLoadBalancerCapacity"] = { CapacityUnits: units };
+		} catch (err) {
+			if (this.isNotFoundError(err)) return void 0;
+		}
 		try {
 			result["LoadBalancerAttributes"] = ((await this.getClient().send(new DescribeLoadBalancerAttributesCommand({ LoadBalancerArn: physicalId }))).Attributes ?? []).filter((a) => typeof a.Key === "string" && typeof a.Value === "string").map((a) => ({
 				Key: a.Key,
@@ -27991,13 +28378,30 @@ var ELBv2Provider = class {
 		if (tg.HealthCheckTimeoutSeconds !== void 0) result["HealthCheckTimeoutSeconds"] = tg.HealthCheckTimeoutSeconds;
 		if (tg.HealthyThresholdCount !== void 0) result["HealthyThresholdCount"] = tg.HealthyThresholdCount;
 		if (tg.UnhealthyThresholdCount !== void 0) result["UnhealthyThresholdCount"] = tg.UnhealthyThresholdCount;
+		if (tg.IpAddressType !== void 0) result["IpAddressType"] = tg.IpAddressType;
+		if (tg.TargetControlPort !== void 0) result["TargetControlPort"] = tg.TargetControlPort;
 		const matcher = {};
 		if (tg.Matcher?.HttpCode !== void 0) matcher["HttpCode"] = tg.Matcher.HttpCode;
 		if (tg.Matcher?.GrpcCode !== void 0) matcher["GrpcCode"] = tg.Matcher.GrpcCode;
 		result["Matcher"] = matcher;
+		try {
+			result["TargetGroupAttributes"] = ((await this.getClient().send(new DescribeTargetGroupAttributesCommand({ TargetGroupArn: physicalId }))).Attributes ?? []).filter((a) => typeof a.Key === "string" && typeof a.Value === "string").map((a) => ({
+				Key: a.Key,
+				Value: a.Value
+			})).sort((a, b) => a.Key.localeCompare(b.Key));
+		} catch (err) {
+			if (this.isNotFoundError(err)) return void 0;
+		}
 		await this.attachTags(result, physicalId);
 		return result;
 	}
+	getDriftUnknownPaths(resourceType) {
+		switch (resourceType) {
+			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return ["EnableCapacityReservationProvisionStabilize"];
+			case "AWS::ElasticLoadBalancingV2::TargetGroup": return ["Targets"];
+			default: return [];
+		}
+	}
 	async readListener(physicalId) {
 		let listener;
 		try {
@@ -68757,7 +69161,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.10");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.12");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;