@go-to-k/cdkd 0.280.11 → 0.280.13

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as applyRoleArnIfSet, A as red, At as AssetManifestLoader, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefault, C as isStatefulRecreateTargetSync, Ct as validateAssetBucketName, D as cyan, Dn as withErrorHandling, Dt as getDockerCmd, E as bold, En as normalizeAwsError, Et as formatDockerLoginError, F as ProviderRegistry, Ft as getLegacyStateBucketName, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_BODY_LIMIT, H as cfnRefValueFromPhysicalId, Ht as resolveUseCdkBootstrapAssets, I as findActionableSilentDrops, It as resolveApp, J as readConfigString, Jt as findLargeInlineResources, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_URL_LIMIT, L as CloudControlProvider, Lt as resolveAutoAssetStorage, M as IAMRoleProvider, Mt as Synthesizer, N as collectInlinePolicyNamesManagedBySiblings, Nt as synthesisStatusMessage, O as gray, Ot as runDockerForeground, P as clearOnUpdateRemoval, Pt as getDefaultStateBucketName, Q as requireConfigString, Qt as processStackMessages, R as slowCcOperationTimeoutMs, Rt as resolveCaptureObservedState, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as parseBootstrapMarker, T as formatResourceLine, Tt as buildDockerImage, U as refStateLookupFromResource, Ut as stateBucketExistenceConfirmed, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefaultAndSource, W as WAFv2WebACLProvider, Wt as warnDeprecatedNoPrefixCliFlag, X as requireConfigArray, Xt as expectedOwnerParam, Y as replayWarn, Yt as uploadCfnTemplate, Z as requireConfigObject, Zt as AssemblyReader, _ as createPreDeleteFinalSnapshot, _n as ProvisioningError, _t as rewriteTemplateAssetReferences, a as DeploymentEventsStore, at as DagBuilder, b as unsupportedFinalSnapshotError, bn as StackHasActiveImportsError, bt as ensureAssetStorage, c as replayFailedOperations, ct as S3StateBackend, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalMigrateError, dt as AssetPublisher, en as resolveBucketRegion, et as DiffCalculator, f as computeImplicitDeleteEdges, fn as LocalStartServiceError, ft as stringifyValue, g as ccRoutedFinalSnapshotError, gn as PartialFailureError, gt as loadPublishableAssetManifest, h as buildFinalSnapshotIdentifier, hn as NestedStackChildDirectDestroyError, ht as createAssetRedirectResolver, i as DeploymentEventsReader, in as setAwsClients, it as isThrottlingError, j as yellow, jt as getDockerImageBySourceHash, k as green, kt as runDockerStreaming, l as replayRollback, ln as DeployCancelledError, lt as rebuildClientForBucketRegion, m as PRE_DELETE_SNAPSHOT_TYPES, mn as MissingCdkCliError, mt as buildAssetRedirectMap, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as getAwsClients, nt as withRetry, o as planFailedOps, on as CdkdError, ot as TemplateParser, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as WorkGraph, q as assertRegionMatch, qt as MIGRATE_TMP_PREFIX, r as DeployEngine, rn as resetAwsClients, rt as isRetryableTransientError, s as planRollback, st as LockManager, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AwsClients, tt as describeTypeWithThrottleRetry, u as withResourceDeadline, un as LocalInvokeBuildError$1, ut as shouldRetainResource, v as isFinalSnapshotError, vn as ResourceTimeoutError, vt as AssetModeResolver, w as renderStatefulReason, wt as validateContainerRepoName, x as extractDeploymentEventError, xn as StackTerminationProtectionError, xt as getBootstrapMarkerKey, y as refusesFinalSnapshot, yn as ResourceUpdateNotSupportedError, yt as BOOTSTRAP_MARKER_PREFIX, z as disableInstanceApiTermination, zt as resolveSkipPrefix } from "./deploy-engine-DHGLmPWH.js";
+import { $ as applyRoleArnIfSet, A as red, At as AssetManifestLoader, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefault, C as isStatefulRecreateTargetSync, Ct as validateAssetBucketName, D as cyan, Dn as withErrorHandling, Dt as getDockerCmd, E as bold, En as normalizeAwsError, Et as formatDockerLoginError, F as ProviderRegistry, Ft as getLegacyStateBucketName, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_BODY_LIMIT, H as cfnRefValueFromPhysicalId, Ht as resolveUseCdkBootstrapAssets, I as findActionableSilentDrops, It as resolveApp, J as readConfigString, Jt as findLargeInlineResources, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_URL_LIMIT, L as CloudControlProvider, Lt as resolveAutoAssetStorage, M as IAMRoleProvider, Mt as Synthesizer, N as collectInlinePolicyNamesManagedBySiblings, Nt as synthesisStatusMessage, O as gray, Ot as runDockerForeground, P as clearOnUpdateRemoval, Pt as getDefaultStateBucketName, Q as requireConfigString, Qt as processStackMessages, R as slowCcOperationTimeoutMs, Rt as resolveCaptureObservedState, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as parseBootstrapMarker, T as formatResourceLine, Tt as buildDockerImage, U as refStateLookupFromResource, Ut as stateBucketExistenceConfirmed, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefaultAndSource, W as WAFv2WebACLProvider, Wt as warnDeprecatedNoPrefixCliFlag, X as requireConfigArray, Xt as expectedOwnerParam, Y as replayWarn, Yt as uploadCfnTemplate, Z as requireConfigObject, Zt as AssemblyReader, _ as createPreDeleteFinalSnapshot, _n as ProvisioningError, _t as rewriteTemplateAssetReferences, a as DeploymentEventsStore, at as DagBuilder, b as unsupportedFinalSnapshotError, bn as StackHasActiveImportsError, bt as ensureAssetStorage, c as replayFailedOperations, ct as S3StateBackend, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalMigrateError, dt as AssetPublisher, en as resolveBucketRegion, et as DiffCalculator, f as computeImplicitDeleteEdges, fn as LocalStartServiceError, ft as stringifyValue, g as ccRoutedFinalSnapshotError, gn as PartialFailureError, gt as loadPublishableAssetManifest, h as buildFinalSnapshotIdentifier, hn as NestedStackChildDirectDestroyError, ht as createAssetRedirectResolver, i as DeploymentEventsReader, in as setAwsClients, it as isThrottlingError, j as yellow, jt as getDockerImageBySourceHash, k as green, kt as runDockerStreaming, l as replayRollback, ln as DeployCancelledError, lt as rebuildClientForBucketRegion, m as PRE_DELETE_SNAPSHOT_TYPES, mn as MissingCdkCliError, mt as buildAssetRedirectMap, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as getAwsClients, nt as withRetry, o as planFailedOps, on as CdkdError, ot as TemplateParser, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as WorkGraph, q as assertRegionMatch, qt as MIGRATE_TMP_PREFIX, r as DeployEngine, rn as resetAwsClients, rt as isRetryableTransientError, s as planRollback, st as LockManager, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AwsClients, tt as describeTypeWithThrottleRetry, u as withResourceDeadline, un as LocalInvokeBuildError$1, ut as shouldRetainResource, v as isFinalSnapshotError, vn as ResourceTimeoutError, vt as AssetModeResolver, w as renderStatefulReason, wt as validateContainerRepoName, x as extractDeploymentEventError, xn as StackTerminationProtectionError, xt as getBootstrapMarkerKey, y as refusesFinalSnapshot, yn as ResourceUpdateNotSupportedError, yt as BOOTSTRAP_MARKER_PREFIX, z as disableInstanceApiTermination, zt as resolveSkipPrefix } from "./deploy-engine-CE-J9Vlu.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-CN0zTvF5.js";
+import { t as ASGProvider } from "./asg-provider-DJSCLI9C.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -31,7 +31,7 @@ import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { tmpdir } from "node:os";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
-import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupsCommand, ElasticLoadBalancingV2Client, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand, waitUntilLoadBalancerAvailable } from "@aws-sdk/client-elastic-load-balancing-v2";
+import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DeregisterTargetsCommand, DescribeCapacityReservationCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupAttributesCommand, DescribeTargetGroupsCommand, ElasticLoadBalancingV2Client, ModifyCapacityReservationCommand, ModifyIpPoolsCommand, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupAttributesCommand, ModifyTargetGroupCommand, RegisterTargetsCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand, waitUntilLoadBalancerAvailable } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { join as join$1 } from "path";
 import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$9, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotEmptyException, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
@@ -27508,6 +27508,36 @@ var ECSProvider = class {
 //#endregion
 //#region src/provisioning/providers/elbv2-provider.ts
 /**
+* Test seam for the capacity-reservation stabilize poll (mirrors
+* `finalSnapshotDelays` in ../final-snapshot.ts). Unit tests stub `sleep`
+* so the poll runs without wall-clock delay.
+*/
+const capacityReservationDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
+/**
+* Documented AWS defaults for TargetGroup attributes, used to reset a
+* removed `TargetGroupAttributes` entry. Unlike ModifyLoadBalancerAttributes
+* / ModifyListenerAttributes, ModifyTargetGroupAttributes REJECTS an empty
+* `Value` ("A target group attribute value must be specified" — live-verified
+* 2026-08-11), so clearing an override requires sending the documented
+* default explicitly. Keys whose default is target-type-dependent or
+* undocumented are deliberately absent — a removal of those warns and
+* retains the live value instead of guessing.
+* Source: ELBv2 API reference, TargetGroupAttribute key table.
+*/
+const TARGET_GROUP_ATTRIBUTE_DEFAULTS = {
+	"deregistration_delay.timeout_seconds": "300",
+	"deregistration_delay.connection_termination.enabled": "false",
+	"stickiness.enabled": "false",
+	"stickiness.lb_cookie.duration_seconds": "86400",
+	"stickiness.app_cookie.duration_seconds": "86400",
+	"load_balancing.algorithm.type": "round_robin",
+	"load_balancing.algorithm.anomaly_mitigation": "off",
+	"load_balancing.cross_zone.enabled": "use_load_balancer_configuration",
+	"slow_start.duration_seconds": "0",
+	"lambda.multi_value_headers.enabled": "false",
+	"proxy_protocol_v2.enabled": "false"
+};
+/**
 * AWS ELBv2 Provider
 *
 * Implements resource provisioning for ELBv2 resources:
@@ -27540,7 +27570,12 @@ var ELBv2Provider = class {
 			"Type",
 			"IpAddressType",
 			"LoadBalancerAttributes",
-			"Tags"
+			"Tags",
+			"EnablePrefixForIpv6SourceNat",
+			"EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic",
+			"Ipv4IpamPoolId",
+			"MinimumLoadBalancerCapacity",
+			"EnableCapacityReservationProvisionStabilize"
 		])],
 		["AWS::ElasticLoadBalancingV2::TargetGroup", /* @__PURE__ */ new Set([
 			"Protocol",
@@ -27558,7 +27593,11 @@ var ELBv2Provider = class {
 			"UnhealthyThresholdCount",
 			"Matcher",
 			"Name",
-			"Tags"
+			"Tags",
+			"IpAddressType",
+			"TargetControlPort",
+			"TargetGroupAttributes",
+			"Targets"
 		])],
 		["AWS::ElasticLoadBalancingV2::Listener", /* @__PURE__ */ new Set([
 			"LoadBalancerArn",
@@ -27614,6 +27653,7 @@ var ELBv2Provider = class {
 		try {
 			const tags = this.extractTags(properties);
 			const lbName = generateResourceNameWithFallback(properties["Name"], logicalId, { maxLength: 32 });
+			const ipv4IpamPoolId = properties["Ipv4IpamPoolId"];
 			const lb = (await this.getClient().send(new CreateLoadBalancerCommand({
 				Name: lbName,
 				Subnets: properties["Subnets"],
@@ -27622,6 +27662,8 @@ var ELBv2Provider = class {
 				Scheme: properties["Scheme"],
 				Type: properties["Type"],
 				IpAddressType: properties["IpAddressType"],
+				EnablePrefixForIpv6SourceNat: properties["EnablePrefixForIpv6SourceNat"],
+				...ipv4IpamPoolId !== void 0 && { IpamPools: { Ipv4IpamPoolId: ipv4IpamPoolId } },
 				...tags.length > 0 && { Tags: tags }
 			}))).LoadBalancers?.[0];
 			if (!lb || !lb.LoadBalancerArn) throw new Error("CreateLoadBalancer did not return LoadBalancer ARN");
@@ -27638,17 +27680,32 @@ var ELBv2Provider = class {
 					}, { LoadBalancerArns: [lbArn] });
 					this.logger.debug(`LoadBalancer ${logicalId} is active`);
 				} else this.logger.debug(`LoadBalancer ${logicalId} created (skipping active-state wait per --no-wait)`);
-				const lbAttributes = properties["LoadBalancerAttributes"];
-				if (lbAttributes && lbAttributes.length > 0) {
+				const lbAttributes = this.normalizeAttributes(properties["LoadBalancerAttributes"]);
+				if (lbAttributes.length > 0) {
 					await this.getClient().send(new ModifyLoadBalancerAttributesCommand({
 						LoadBalancerArn: lbArn,
-						Attributes: lbAttributes.map((attr) => ({
-							Key: attr.Key,
-							Value: attr.Value
-						}))
+						Attributes: lbAttributes
 					}));
 					this.logger.debug(`Applied ${lbAttributes.length} LoadBalancer attributes for ${logicalId}`);
 				}
+				const enforcePrivateLink = properties["EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic"];
+				if (enforcePrivateLink !== void 0) {
+					await this.getClient().send(new SetSecurityGroupsCommand({
+						LoadBalancerArn: lbArn,
+						SecurityGroups: properties["SecurityGroups"] ?? [],
+						EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic: enforcePrivateLink
+					}));
+					this.logger.debug(`Applied EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic=${enforcePrivateLink} for ${logicalId}`);
+				}
+				const minCapacity = properties["MinimumLoadBalancerCapacity"];
+				if (minCapacity?.CapacityUnits !== void 0) {
+					await this.getClient().send(new ModifyCapacityReservationCommand({
+						LoadBalancerArn: lbArn,
+						MinimumLoadBalancerCapacity: { CapacityUnits: Number(minCapacity.CapacityUnits) }
+					}));
+					this.logger.debug(`Requested capacity reservation of ${minCapacity.CapacityUnits} LCU for ${logicalId}`);
+					if (isTruthyCfnBoolean(properties["EnableCapacityReservationProvisionStabilize"]) && process.env["CDKD_NO_WAIT"] !== "true") await this.waitForCapacityReservationProvisioned(lbArn, logicalId);
+				}
 			} catch (innerError) {
 				try {
 					await this.getClient().send(new DeleteLoadBalancerCommand({ LoadBalancerArn: lbArn }));
@@ -27680,7 +27737,12 @@ var ELBv2Provider = class {
 			"SubnetMappings",
 			"SecurityGroups",
 			"IpAddressType",
-			"Tags"
+			"Tags",
+			"EnablePrefixForIpv6SourceNat",
+			"EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic",
+			"Ipv4IpamPoolId",
+			"MinimumLoadBalancerCapacity",
+			"EnableCapacityReservationProvisionStabilize"
 		]);
 		const stripHandled = (p) => {
 			const out = {};
@@ -27688,19 +27750,7 @@ var ELBv2Provider = class {
 			return out;
 		};
 		if (JSON.stringify(stripHandled(properties)) !== JSON.stringify(stripHandled(previousProperties))) throw new ResourceUpdateNotSupportedError("AWS::ElasticLoadBalancingV2::LoadBalancer", logicalId, "ELBv2 LoadBalancer Name / Type / Scheme are immutable on AWS — none of the ELBv2 Modify* / Set* APIs accept these fields; they are fixed at creation. cdkd handles LoadBalancerAttributes / Subnets / SubnetMappings / SecurityGroups / IpAddressType / Tags in-place; for Name / Type / Scheme re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.");
-		const newAttrs = properties["LoadBalancerAttributes"] ?? [];
-		const oldAttrs = previousProperties["LoadBalancerAttributes"] ?? [];
-		const newAttrMap = new Map(newAttrs.map((a) => [a.Key, a.Value]));
-		const oldAttrMap = new Map(oldAttrs.map((a) => [a.Key, a.Value]));
-		const submittedAttrs = [];
-		for (const [k, v] of newAttrMap) if (oldAttrMap.get(k) !== v) submittedAttrs.push({
-			Key: k,
-			Value: v
-		});
-		for (const [k] of oldAttrMap) if (!newAttrMap.has(k)) submittedAttrs.push({
-			Key: k,
-			Value: ""
-		});
+		const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["LoadBalancerAttributes"]), this.normalizeAttributes(previousProperties["LoadBalancerAttributes"]));
 		if (submittedAttrs.length > 0) {
 			await this.getClient().send(new ModifyLoadBalancerAttributesCommand({
 				LoadBalancerArn: physicalId,
@@ -27712,21 +27762,28 @@ var ELBv2Provider = class {
 		const oldSubnets = previousProperties["Subnets"];
 		const newMappings = properties["SubnetMappings"];
 		const oldMappings = previousProperties["SubnetMappings"];
+		const newIpv6SourceNat = properties["EnablePrefixForIpv6SourceNat"];
+		const oldIpv6SourceNat = previousProperties["EnablePrefixForIpv6SourceNat"];
 		const subnetsChanged = JSON.stringify(newSubnets) !== JSON.stringify(oldSubnets);
 		const mappingsChanged = JSON.stringify(newMappings) !== JSON.stringify(oldMappings);
-		if (subnetsChanged || mappingsChanged) {
+		if (subnetsChanged || mappingsChanged || newIpv6SourceNat !== void 0 && newIpv6SourceNat !== oldIpv6SourceNat) {
 			await this.getClient().send(new SetSubnetsCommand({
 				LoadBalancerArn: physicalId,
-				...newMappings && newMappings.length > 0 ? { SubnetMappings: newMappings } : { Subnets: newSubnets }
+				...newMappings && newMappings.length > 0 ? { SubnetMappings: newMappings } : { Subnets: newSubnets },
+				...newIpv6SourceNat !== void 0 && { EnablePrefixForIpv6SourceNat: newIpv6SourceNat }
 			}));
 			this.logger.debug(`Updated Subnets / SubnetMappings for ${logicalId}`);
 		}
 		const newSGs = properties["SecurityGroups"];
 		const oldSGs = previousProperties["SecurityGroups"];
-		if (JSON.stringify(newSGs) !== JSON.stringify(oldSGs)) {
+		const newEnforce = properties["EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic"];
+		const oldEnforce = previousProperties["EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic"];
+		const enforceChanged = newEnforce !== void 0 && newEnforce !== oldEnforce;
+		if (JSON.stringify(newSGs) !== JSON.stringify(oldSGs) || enforceChanged) {
 			await this.getClient().send(new SetSecurityGroupsCommand({
 				LoadBalancerArn: physicalId,
-				SecurityGroups: newSGs ?? []
+				SecurityGroups: newSGs ?? [],
+				...newEnforce !== void 0 && { EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic: newEnforce }
 			}));
 			this.logger.debug(`Updated SecurityGroups for ${logicalId}`);
 		}
@@ -27739,12 +27796,64 @@ var ELBv2Provider = class {
 			}));
 			this.logger.debug(`Updated IpAddressType for ${logicalId}`);
 		}
+		const newIpamPool = properties["Ipv4IpamPoolId"];
+		if (newIpamPool !== previousProperties["Ipv4IpamPoolId"]) {
+			await this.getClient().send(new ModifyIpPoolsCommand({
+				LoadBalancerArn: physicalId,
+				...newIpamPool !== void 0 ? { IpamPools: { Ipv4IpamPoolId: newIpamPool } } : { RemoveIpamPools: ["ipv4"] }
+			}));
+			this.logger.debug(newIpamPool !== void 0 ? `Updated Ipv4IpamPoolId for ${logicalId}` : `Removed IPAM pool association for ${logicalId}`);
+		}
+		const newCapacity = properties["MinimumLoadBalancerCapacity"];
+		const oldCapacity = previousProperties["MinimumLoadBalancerCapacity"];
+		const newCapacityUnits = newCapacity?.CapacityUnits !== void 0 ? Number(newCapacity.CapacityUnits) : void 0;
+		if (newCapacityUnits !== (oldCapacity?.CapacityUnits !== void 0 ? Number(oldCapacity.CapacityUnits) : void 0)) {
+			await this.getClient().send(new ModifyCapacityReservationCommand({
+				LoadBalancerArn: physicalId,
+				...newCapacityUnits !== void 0 ? { MinimumLoadBalancerCapacity: { CapacityUnits: newCapacityUnits } } : { ResetCapacityReservation: true }
+			}));
+			this.logger.debug(newCapacityUnits !== void 0 ? `Requested capacity reservation of ${newCapacityUnits} LCU for ${logicalId}` : `Reset capacity reservation for ${logicalId}`);
+			if (newCapacityUnits !== void 0 && isTruthyCfnBoolean(properties["EnableCapacityReservationProvisionStabilize"]) && process.env["CDKD_NO_WAIT"] !== "true") await this.waitForCapacityReservationProvisioned(physicalId, logicalId);
+		}
 		await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
 		return {
 			physicalId,
 			wasReplaced: false
 		};
 	}
+	/**
+	* Poll DescribeCapacityReservation until every zonal state reports
+	* `provisioned` — the semantics of the CFn-only
+	* `EnableCapacityReservationProvisionStabilize` flag (no SDK member; it
+	* opts the deploy into waiting for the reservation instead of returning
+	* while zones are still `pending`). Bounded at ~10 min / 15s interval;
+	* a timeout WARNS and continues (the reservation keeps provisioning
+	* asynchronously and the ModifyCapacityReservation was accepted), while a
+	* `failed` zonal state throws — that reservation will never provision.
+	*/
+	async waitForCapacityReservationProvisioned(lbArn, logicalId) {
+		const maxAttempts = 40;
+		const intervalMs = 15e3;
+		this.logger.debug(`Waiting for capacity reservation of ${logicalId} to provision...`);
+		for (let attempt = 0; attempt < maxAttempts; attempt++) {
+			let zones;
+			try {
+				zones = (await this.getClient().send(new DescribeCapacityReservationCommand({ LoadBalancerArn: lbArn }))).CapacityReservationState ?? [];
+			} catch (probeError) {
+				this.logger.debug(`DescribeCapacityReservation for ${logicalId} failed transiently (attempt ${attempt + 1}/${maxAttempts}): ${probeError instanceof Error ? probeError.message : String(probeError)}`);
+				await capacityReservationDelays.sleep(intervalMs);
+				continue;
+			}
+			const failed = zones.find((z) => z.State?.Code === "failed");
+			if (failed) throw new Error(`Capacity reservation for ${logicalId} failed in ${failed.AvailabilityZone ?? "an availability zone"}: ${failed.State?.Reason ?? "no reason reported"}`);
+			if (zones.length === 0 || zones.every((z) => z.State?.Code === "provisioned")) {
+				this.logger.debug(`Capacity reservation for ${logicalId} is provisioned`);
+				return;
+			}
+			await capacityReservationDelays.sleep(intervalMs);
+		}
+		this.logger.warn(`Capacity reservation for ${logicalId} did not reach 'provisioned' within ${maxAttempts * intervalMs / 6e4} minutes; continuing (provisioning completes asynchronously)`);
+	}
 	async deleteLoadBalancer(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting LoadBalancer ${logicalId}: ${physicalId}`);
 		if (context?.removeProtection === true) try {
@@ -27793,16 +27902,45 @@ var ELBv2Provider = class {
 				HealthCheckTimeoutSeconds: properties["HealthCheckTimeoutSeconds"] !== void 0 ? Number(properties["HealthCheckTimeoutSeconds"]) : void 0,
 				HealthyThresholdCount: properties["HealthyThresholdCount"] !== void 0 ? Number(properties["HealthyThresholdCount"]) : void 0,
 				UnhealthyThresholdCount: properties["UnhealthyThresholdCount"] !== void 0 ? Number(properties["UnhealthyThresholdCount"]) : void 0,
+				IpAddressType: properties["IpAddressType"],
+				TargetControlPort: properties["TargetControlPort"] !== void 0 ? Number(properties["TargetControlPort"]) : void 0,
 				...matcher && { Matcher: matcher },
 				...tags.length > 0 && { Tags: tags }
 			}))).TargetGroups?.[0];
 			if (!tg || !tg.TargetGroupArn) throw new Error("CreateTargetGroup did not return TargetGroup ARN");
-			this.logger.debug(`Successfully created TargetGroup ${logicalId}: ${tg.TargetGroupArn}`);
+			const tgArn = tg.TargetGroupArn;
+			this.logger.debug(`Successfully created TargetGroup ${logicalId}: ${tgArn}`);
+			try {
+				const tgAttributes = this.normalizeAttributes(properties["TargetGroupAttributes"]);
+				if (tgAttributes.length > 0) {
+					await this.getClient().send(new ModifyTargetGroupAttributesCommand({
+						TargetGroupArn: tgArn,
+						Attributes: tgAttributes
+					}));
+					this.logger.debug(`Applied ${tgAttributes.length} TargetGroup attribute(s) for ${logicalId}`);
+				}
+				const targets = this.convertTargets(properties["Targets"]);
+				if (targets.length > 0) {
+					await this.getClient().send(new RegisterTargetsCommand({
+						TargetGroupArn: tgArn,
+						Targets: targets
+					}));
+					this.logger.debug(`Registered ${targets.length} target(s) for ${logicalId}`);
+				}
+			} catch (innerError) {
+				try {
+					await this.getClient().send(new DeleteTargetGroupCommand({ TargetGroupArn: tgArn }));
+					this.logger.debug(`Cleaned up partially-created TargetGroup ${logicalId} (${tgArn}) after wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created TargetGroup ${logicalId} (${tgArn}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws elbv2 delete-target-group --target-group-arn ${tgArn}`);
+				}
+				throw innerError;
+			}
 			return {
-				physicalId: tg.TargetGroupArn,
+				physicalId: tgArn,
 				attributes: {
-					TargetGroupArn: tg.TargetGroupArn,
-					TargetGroupFullName: tg.TargetGroupArn?.split(":").pop()?.replace("targetgroup/", ""),
+					TargetGroupArn: tgArn,
+					TargetGroupFullName: tgArn.split(":").pop()?.replace("targetgroup/", ""),
 					TargetGroupName: tg.TargetGroupName
 				}
 			};
@@ -27813,6 +27951,13 @@ var ELBv2Provider = class {
 	}
 	async updateTargetGroup(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating TargetGroup ${logicalId}: ${physicalId}`);
+		const immutableChanged = (key, coerce) => {
+			const next = properties[key];
+			const prev = previousProperties[key];
+			if (coerce) return (next !== void 0 ? Number(next) : void 0) !== (prev !== void 0 ? Number(prev) : void 0);
+			return JSON.stringify(next) !== JSON.stringify(prev);
+		};
+		for (const [immutableKey, coerce] of [["IpAddressType", false], ["TargetControlPort", true]]) if (immutableChanged(immutableKey, coerce)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `ELBv2 TargetGroup ${immutableKey} is immutable on AWS — no Modify* API accepts it; it is fixed at creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
 		try {
 			const rawMatcher = properties["Matcher"];
 			const matcher = rawMatcher && (rawMatcher.HttpCode !== void 0 || rawMatcher.GrpcCode !== void 0) ? rawMatcher : void 0;
@@ -27829,6 +27974,43 @@ var ELBv2Provider = class {
 				UnhealthyThresholdCount: properties["UnhealthyThresholdCount"] !== void 0 ? Number(properties["UnhealthyThresholdCount"]) : void 0,
 				...matcher && { Matcher: matcher }
 			}));
+			const tgAttrDiff = this.diffAttributes(this.normalizeAttributes(properties["TargetGroupAttributes"]), this.normalizeAttributes(previousProperties["TargetGroupAttributes"]), (key) => {
+				const fallback = TARGET_GROUP_ATTRIBUTE_DEFAULTS[key];
+				if (fallback === void 0) this.logger.warn(`TargetGroup attribute ${key} was removed from the template but has no documented default cdkd can reset it to — the live value is retained. Set the attribute explicitly to change it.`);
+				return fallback;
+			});
+			if (tgAttrDiff.length > 0) {
+				await this.getClient().send(new ModifyTargetGroupAttributesCommand({
+					TargetGroupArn: physicalId,
+					Attributes: tgAttrDiff
+				}));
+				this.logger.debug(`Applied ${tgAttrDiff.length} TargetGroupAttributes change(s) for ${logicalId}`);
+			}
+			const newTargets = this.convertTargets(properties["Targets"]);
+			const oldTargets = this.convertTargets(previousProperties["Targets"]);
+			const targetKey = (t) => JSON.stringify([
+				t.Id,
+				t.Port ?? null,
+				t.AvailabilityZone ?? null
+			]);
+			const oldTargetKeys = new Set(oldTargets.map(targetKey));
+			const newTargetKeys = new Set(newTargets.map(targetKey));
+			const targetsToRegister = newTargets.filter((t) => !oldTargetKeys.has(targetKey(t)));
+			const targetsToDeregister = oldTargets.filter((t) => !newTargetKeys.has(targetKey(t)));
+			if (targetsToRegister.length > 0) {
+				await this.getClient().send(new RegisterTargetsCommand({
+					TargetGroupArn: physicalId,
+					Targets: targetsToRegister
+				}));
+				this.logger.debug(`Registered ${targetsToRegister.length} target(s) for ${logicalId}`);
+			}
+			if (targetsToDeregister.length > 0) {
+				await this.getClient().send(new DeregisterTargetsCommand({
+					TargetGroupArn: physicalId,
+					Targets: targetsToDeregister
+				}));
+				this.logger.debug(`Deregistered ${targetsToDeregister.length} target(s) for ${logicalId}`);
+			}
 			const tg = (await this.getClient().send(new DescribeTargetGroupsCommand({ TargetGroupArns: [physicalId] }))).TargetGroups?.[0];
 			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
 			this.logger.debug(`Successfully updated TargetGroup ${logicalId}`);
@@ -27927,19 +28109,7 @@ var ELBv2Provider = class {
 				...alpnPolicy && alpnPolicy.length > 0 && { AlpnPolicy: alpnPolicy },
 				...mutualAuth !== void 0 && { MutualAuthentication: mutualAuth }
 			}));
-			const newAttrs = this.normalizeAttributes(properties["ListenerAttributes"]);
-			const oldAttrs = this.normalizeAttributes(previousProperties["ListenerAttributes"]);
-			const newAttrMap = new Map(newAttrs.map((a) => [a.Key, a.Value]));
-			const oldAttrMap = new Map(oldAttrs.map((a) => [a.Key, a.Value]));
-			const submittedAttrs = [];
-			for (const [k, v] of newAttrMap) if (oldAttrMap.get(k) !== v) submittedAttrs.push({
-				Key: k,
-				Value: v
-			});
-			for (const [k] of oldAttrMap) if (!newAttrMap.has(k)) submittedAttrs.push({
-				Key: k,
-				Value: ""
-			});
+			const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["ListenerAttributes"]), this.normalizeAttributes(previousProperties["ListenerAttributes"]));
 			if (submittedAttrs.length > 0) {
 				await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
 					ListenerArn: physicalId,
@@ -28015,6 +28185,58 @@ var ELBv2Provider = class {
 		return out;
 	}
 	/**
+	* Key-diff two normalized `{Key, Value}` attribute lists into the payload
+	* for a Modify*Attributes call: changed values from `newAttrs` win, and
+	* keys present only in `oldAttrs` are pushed back through `removalValue` —
+	* by default the empty string, which ModifyLoadBalancerAttributes /
+	* ModifyListenerAttributes accept as "clear the override". A resolver
+	* returning `undefined` SKIPS the entry (the resolver owns any warn).
+	* An empty return means nothing changed and the call should be skipped.
+	* Shared by the LoadBalancer / TargetGroup / Listener update paths.
+	*/
+	diffAttributes(newAttrs, oldAttrs, removalValue = () => "") {
+		const newAttrMap = new Map(newAttrs.map((a) => [a.Key, a.Value]));
+		const oldAttrMap = new Map(oldAttrs.map((a) => [a.Key, a.Value]));
+		const submitted = [];
+		for (const [k, v] of newAttrMap) if (oldAttrMap.get(k) !== v) submitted.push({
+			Key: k,
+			Value: v
+		});
+		for (const [k] of oldAttrMap) if (!newAttrMap.has(k)) {
+			const value = removalValue(k);
+			if (value !== void 0) submitted.push({
+				Key: k,
+				Value: value
+			});
+		}
+		return submitted;
+	}
+	/**
+	* Normalize a CFn `Targets` value (an array of `{ Id, Port?,
+	* AvailabilityZone? }` objects) into the SDK's `TargetDescription[]` shape.
+	* Entries missing an `Id` are dropped (Id is the only required member);
+	* `Port` is numeric-coerced (CFn templates may carry it as a string).
+	* Returns `[]` for an absent / non-array value so callers can branch on
+	* `.length`.
+	*/
+	convertTargets(raw) {
+		if (!Array.isArray(raw)) return [];
+		const out = [];
+		for (const entry of raw) {
+			if (entry === null || typeof entry !== "object" || typeof entry.Id !== "string" || entry.Id.length === 0) {
+				this.logger.warn(`Dropping malformed TargetGroup Targets entry (missing string Id): ${JSON.stringify(entry)}`);
+				continue;
+			}
+			const e = entry;
+			out.push({
+				Id: e.Id,
+				...e.Port !== void 0 && { Port: Number(e.Port) },
+				...e.AvailabilityZone !== void 0 && { AvailabilityZone: e.AvailabilityZone }
+			});
+		}
+		return out;
+	}
+	/**
 	* Apply a diff between old and new CFn-shape Tags arrays via ELBv2's
 	* `AddTags` / `RemoveTags` APIs. Both accept `ResourceArns: [arn]`
 	* (single ARN), `Tags: [{Key, Value}]` for AddTags, and
@@ -28112,6 +28334,15 @@ var ELBv2Provider = class {
 		if (lb.Scheme !== void 0) result["Scheme"] = lb.Scheme;
 		if (lb.Type !== void 0) result["Type"] = lb.Type;
 		if (lb.IpAddressType !== void 0) result["IpAddressType"] = lb.IpAddressType;
+		if (lb.EnablePrefixForIpv6SourceNat !== void 0) result["EnablePrefixForIpv6SourceNat"] = lb.EnablePrefixForIpv6SourceNat;
+		if (lb.EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic !== void 0) result["EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic"] = lb.EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic;
+		if (lb.IpamPools?.Ipv4IpamPoolId !== void 0) result["Ipv4IpamPoolId"] = lb.IpamPools.Ipv4IpamPoolId;
+		try {
+			const units = (await this.getClient().send(new DescribeCapacityReservationCommand({ LoadBalancerArn: physicalId }))).MinimumLoadBalancerCapacity?.CapacityUnits;
+			if (units !== void 0 && units > 0) result["MinimumLoadBalancerCapacity"] = { CapacityUnits: units };
+		} catch (err) {
+			if (this.isNotFoundError(err)) return void 0;
+		}
 		try {
 			result["LoadBalancerAttributes"] = ((await this.getClient().send(new DescribeLoadBalancerAttributesCommand({ LoadBalancerArn: physicalId }))).Attributes ?? []).filter((a) => typeof a.Key === "string" && typeof a.Value === "string").map((a) => ({
 				Key: a.Key,
@@ -28147,13 +28378,30 @@ var ELBv2Provider = class {
 		if (tg.HealthCheckTimeoutSeconds !== void 0) result["HealthCheckTimeoutSeconds"] = tg.HealthCheckTimeoutSeconds;
 		if (tg.HealthyThresholdCount !== void 0) result["HealthyThresholdCount"] = tg.HealthyThresholdCount;
 		if (tg.UnhealthyThresholdCount !== void 0) result["UnhealthyThresholdCount"] = tg.UnhealthyThresholdCount;
+		if (tg.IpAddressType !== void 0) result["IpAddressType"] = tg.IpAddressType;
+		if (tg.TargetControlPort !== void 0) result["TargetControlPort"] = tg.TargetControlPort;
 		const matcher = {};
 		if (tg.Matcher?.HttpCode !== void 0) matcher["HttpCode"] = tg.Matcher.HttpCode;
 		if (tg.Matcher?.GrpcCode !== void 0) matcher["GrpcCode"] = tg.Matcher.GrpcCode;
 		result["Matcher"] = matcher;
+		try {
+			result["TargetGroupAttributes"] = ((await this.getClient().send(new DescribeTargetGroupAttributesCommand({ TargetGroupArn: physicalId }))).Attributes ?? []).filter((a) => typeof a.Key === "string" && typeof a.Value === "string").map((a) => ({
+				Key: a.Key,
+				Value: a.Value
+			})).sort((a, b) => a.Key.localeCompare(b.Key));
+		} catch (err) {
+			if (this.isNotFoundError(err)) return void 0;
+		}
 		await this.attachTags(result, physicalId);
 		return result;
 	}
+	getDriftUnknownPaths(resourceType) {
+		switch (resourceType) {
+			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return ["EnableCapacityReservationProvisionStabilize"];
+			case "AWS::ElasticLoadBalancingV2::TargetGroup": return ["Targets"];
+			default: return [];
+		}
+	}
 	async readListener(physicalId) {
 		let listener;
 		try {
@@ -50256,32 +50504,57 @@ function isIntrinsic(value) {
 	return keys.length === 1 && INTRINSIC_KEYS.has(keys[0]);
 }
 /**
-* Strip unchanged and intrinsic-only values from a diff value.
-*
-* Recursively compares `value` against `other` and keeps only the keys whose
-* values actually differ (excluding intrinsic vs resolved mismatches). This
-* produces a minimal diff showing only real changes.
+* Per-side rendering rule for a diff side that is NOT a plain object pair
+* (primitives, arrays, intrinsics). The both-plain-objects case is handled
+* jointly by {@link stripUnchangedValuePair}, which never delegates it here.
 */
 function stripUnchangedValues(value, other) {
 	if (value === null || value === void 0 || typeof value !== "object") return value;
 	if (Array.isArray(value)) return value;
 	if (isIntrinsic(value)) return void 0;
 	if (isIntrinsic(other)) return void 0;
-	if (other === null || other === void 0 || typeof other !== "object" || Array.isArray(other)) return value;
-	const valObj = value;
-	const otherObj = other;
-	const result = {};
-	for (const key of Object.keys(valObj)) {
-		const v = valObj[key];
-		const o = otherObj[key];
-		if (isIntrinsic(v) || isIntrinsic(o)) continue;
-		if (JSON.stringify(v) === JSON.stringify(o)) continue;
-		if (typeof v === "object" && v !== null && typeof o === "object" && o !== null) {
-			const filtered = stripUnchangedValues(v, o);
-			if (filtered !== void 0 && JSON.stringify(filtered) !== "{}") result[key] = filtered;
-		} else result[key] = v;
+	return value;
+}
+function isPlainNonIntrinsicObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && !isIntrinsic(value);
+}
+/**
+* Strip unchanged and intrinsic-only keys from BOTH sides of a property
+* change in ONE walk, so the two rendered sides stay symmetric (issue #1608).
+*
+* {@link stripUnchangedValues} runs per side, so a PURE KEY ADDITION pruned
+* the new side down to the added key while the old side — whose own keys are
+* all unchanged — hit the empty-result fallback and printed the FULL object.
+* That asymmetry reads as "the whole object is replaced by just the added
+* key" (i.e. everything else removed), the opposite of what deploy does.
+* Walking the UNION of keys once yields `old: {}` / `new: {AddedKey: ...}`
+* for an addition (and the mirror for a removal); the full-value fallback —
+* kept for sides differing only in key order or intrinsic-valued keys — now
+* fires only when BOTH sides pruned to nothing, so it can never be one-sided.
+* Non-object sides (primitives, arrays, intrinsics) keep the existing
+* per-side semantics via {@link stripUnchangedValues}.
+*/
+function stripUnchangedValuePair(oldValue, newValue) {
+	if (!isPlainNonIntrinsicObject(oldValue) || !isPlainNonIntrinsicObject(newValue)) return [stripUnchangedValues(oldValue, newValue), stripUnchangedValues(newValue, oldValue)];
+	const oldResult = {};
+	const newResult = {};
+	const keys = [...Object.keys(oldValue), ...Object.keys(newValue).filter((k) => !Object.hasOwn(oldValue, k))];
+	for (const key of keys) {
+		const o = oldValue[key];
+		const n = newValue[key];
+		if (isIntrinsic(o) || isIntrinsic(n)) continue;
+		if (JSON.stringify(o) === JSON.stringify(n)) continue;
+		if (isPlainNonIntrinsicObject(o) && isPlainNonIntrinsicObject(n)) {
+			const [fo, fn] = stripUnchangedValuePair(o, n);
+			if (fo !== void 0 && JSON.stringify(fo) !== "{}") oldResult[key] = fo;
+			if (fn !== void 0 && JSON.stringify(fn) !== "{}") newResult[key] = fn;
+		} else {
+			if (Object.hasOwn(oldValue, key)) oldResult[key] = o;
+			if (Object.hasOwn(newValue, key)) newResult[key] = n;
+		}
 	}
-	return Object.keys(result).length > 0 ? result : value;
+	if (Object.keys(oldResult).length === 0 && Object.keys(newResult).length === 0) return [oldValue, newValue];
+	return [oldResult, newResult];
 }
 /**
 * Render one side of a property change for the diff output.
@@ -50290,18 +50563,18 @@ function stripUnchangedValues(value, other) {
 * against current state — most commonly a `Ref` / `Fn::GetAtt` to a resource
 * this same deploy will CREATE (the CDK logical-id-churn dance: an
 * `AWS::ApiGateway::Deployment` hash rotation, a `fn.currentVersion` Lambda
-* Version). Rendering that via {@link stripUnchangedValues} collapsed it to
+* Version). Rendering that via the strip-unchanged pass collapsed it to
 * the literal string `undefined`, which reads as "this property is being
 * removed" (issue #1017). Instead, render the raw intrinsic compactly and —
 * on the NEW side — annotate that the value only exists after the deploy.
-* Everything else keeps the existing strip-unchanged rendering.
+* Everything else renders the pre-filtered value computed jointly for both
+* sides by {@link stripUnchangedValuePair}.
 */
-function renderDiffValue(own, opposite, indent, isNewSide) {
+function renderDiffValue(own, filtered, indent, isNewSide) {
 	if (isIntrinsic(own)) {
 		const suffix = isNewSide ? " (known after deploy)" : "";
 		return `${JSON.stringify(own)}${suffix}`;
 	}
-	const filtered = stripUnchangedValues(own, opposite);
 	return (JSON.stringify(filtered, null, 2) ?? "undefined").replace(/\n/g, `\n${indent}`);
 }
 /**
@@ -50336,8 +50609,9 @@ function renderChangeLines(changes, logFn, ccApiRoutes) {
 				const requiresReplace = propChange.requiresReplacement ? " [requires replacement]" : "";
 				const propagated = propChange.replacementPropagated ? " [replacement propagated]" : "";
 				const indent = "              ";
-				const oldStr = renderDiffValue(propChange.oldValue, propChange.newValue, indent, false);
-				const newStr = renderDiffValue(propChange.newValue, propChange.oldValue, indent, true);
+				const [oldFiltered, newFiltered] = stripUnchangedValuePair(propChange.oldValue, propChange.newValue);
+				const oldStr = renderDiffValue(propChange.oldValue, oldFiltered, indent, false);
+				const newStr = renderDiffValue(propChange.newValue, newFiltered, indent, true);
 				logFn(`      - ${propChange.path}:${requiresReplace}${propagated}`);
 				logFn(`          old: ${oldStr}`);
 				logFn(`          new: ${newStr}`);
@@ -68913,7 +69187,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.11");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.13");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;