@go-to-k/cdkd 0.280.24 → 0.280.26

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-60FIug-P.js";
+import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-Sb8KbTlA.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-Dpx4B6UA.js";
+import { t as ASGProvider } from "./asg-provider-BJsjMRaA.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -31,7 +31,7 @@ import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { tmpdir } from "node:os";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
-import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DeregisterTargetsCommand, DescribeCapacityReservationCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupAttributesCommand, DescribeTargetGroupsCommand, ElasticLoadBalancingV2Client, ModifyCapacityReservationCommand, ModifyIpPoolsCommand, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupAttributesCommand, ModifyTargetGroupCommand, RegisterTargetsCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand, waitUntilLoadBalancerAvailable } from "@aws-sdk/client-elastic-load-balancing-v2";
+import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DeregisterTargetsCommand, DescribeCapacityReservationCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupAttributesCommand, DescribeTargetGroupsCommand, DescribeTargetHealthCommand, ElasticLoadBalancingV2Client, ModifyCapacityReservationCommand, ModifyIpPoolsCommand, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupAttributesCommand, ModifyTargetGroupCommand, RegisterTargetsCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand, waitUntilLoadBalancerAvailable } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { join as join$1 } from "path";
 import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$9, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotEmptyException, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
@@ -28759,8 +28759,8 @@ var ELBv2Provider = class {
 				}));
 				this.logger.debug(`Applied ${tgAttrDiff.length} TargetGroupAttributes change(s) for ${logicalId}`);
 			}
-			const newTargets = this.convertTargets(properties["Targets"]);
-			const oldTargets = this.convertTargets(previousProperties["Targets"]);
+			const newTargets = this.convertTargets(properties["Targets"], properties["Port"]);
+			const oldTargets = this.convertTargets(previousProperties["Targets"], properties["Port"]);
 			const targetKey = (t) => JSON.stringify([
 				t.Id,
 				t.Port ?? null,
@@ -29039,8 +29039,21 @@ var ELBv2Provider = class {
 	* `Port` is numeric-coerced (CFn templates may carry it as a string).
 	* Returns `[]` for an absent / non-array value so callers can branch on
 	* `.length`.
-	*/
-	convertTargets(raw) {
+	*
+	* `groupPort` defaults an OMITTED `Port` to the target group's own port,
+	* which is what AWS substitutes when a target is registered without one.
+	* This is load-bearing for the update diff, not cosmetic: `targetKey` below
+	* keys on `Port ?? null`, so without the default a template-shaped
+	* `[{Id}]` and an AWS-readback-shaped `[{Id, Port: 80}]` describe the SAME
+	* live target under two different keys — and the diff then registers the
+	* "new" one (a no-op, it lands on the group port) and DEREGISTERS the live
+	* one. `cdkd drift --revert` hits exactly that, since it hands `update()`
+	* the AWS snapshot as the previous side and a template-shaped desired side.
+	* Absent for a `lambda` target group (no port), where both sides stay
+	* undefined and therefore still key identically.
+	*/
+	convertTargets(raw, groupPort) {
+		const defaultPort = groupPort === void 0 || groupPort === null || Number.isNaN(Number(groupPort)) ? void 0 : Number(groupPort);
 		if (!Array.isArray(raw)) return [];
 		const out = [];
 		for (const entry of raw) {
@@ -29049,9 +29062,10 @@ var ELBv2Provider = class {
 				continue;
 			}
 			const e = entry;
+			const port = e.Port !== void 0 ? Number(e.Port) : defaultPort;
 			out.push({
 				Id: e.Id,
-				...e.Port !== void 0 && { Port: Number(e.Port) },
+				...port !== void 0 && { Port: port },
 				...e.AvailabilityZone !== void 0 && { AvailabilityZone: e.AvailabilityZone }
 			});
 		}
@@ -29213,16 +29227,129 @@ var ELBv2Provider = class {
 		} catch (err) {
 			if (this.isNotFoundError(err)) return void 0;
 		}
+		await this.attachRegisteredTargets(result, physicalId);
 		await this.attachTags(result, physicalId);
 		return result;
 	}
-	getDriftUnknownPaths(resourceType) {
+	/**
+	* Read the target group's REGISTERED targets back in CFn `Targets` shape via
+	* `DescribeTargetHealth` (issue
+	* [#1620](https://github.com/go-to-k/cdkd/issues/1620)).
+	*
+	* Two things make this safe to compare, and both were the reason `Targets`
+	* sat in {@link getDriftUnknownPaths} until now:
+	*
+	*  - **Order.** AWS does not guarantee a readback order for the target list,
+	*    and the drift comparator compares arrays positionally. The type now
+	*    declares `Targets` in {@link getDriftUnorderedPaths}, which sorts the
+	*    list on BOTH comparison sides — so a reorder is not drift.
+	*  - **Draining.** Deregistration is asynchronous: a just-removed target
+	*    keeps reporting for minutes with `TargetHealth.State === 'draining'`.
+	*    Including one would freeze it into the deploy-time `observedProperties`
+	*    snapshot and produce PERMANENT phantom drift against every later read,
+	*    once it finally disappears. `draining` means "being removed", so the
+	*    registered set deliberately excludes it. Every other state (`initial`
+	*    right after `RegisterTargets`, `unused` for a target with no listener,
+	*    `unhealthy`, `unavailable`) IS a registered target and is included —
+	*    health is not registration.
+	*
+	* Two AWS-SUBSTITUTED values are dropped, because echoing back a value the
+	* template never wrote is phantom drift against a `properties`-fallback
+	* baseline — and, worse, a DESTRUCTIVE one: `updateTargetGroup` keys its
+	* register / deregister diff on the whole `(Id, Port, AvailabilityZone)`
+	* tuple, so one extra member makes the SAME live target read as a different
+	* one and `--revert` deregisters it.
+	*
+	*  - `Port` when it equals the target group's own port — what AWS
+	*    substitutes for a target registered without one. (`convertTargets`
+	*    closes the same gap from the other direction, so a template that DOES
+	*    spell the port out still keys identically.)
+	*  - `AvailabilityZone` unless the group is `ip`-typed and AWS reported
+	*    something other than its `all` default. CFn only accepts the member for
+	*    `ip` targets, and `DeregisterTargets` rejects it on an instance group.
+	*
+	* Known bound: if `DescribeTargetHealth` were to return an empty list in the
+	* window right after `RegisterTargets`, the deploy-time snapshot would
+	* freeze `Targets: []` against a template that declares some. Not observed —
+	* `RegisterTargets` is synchronous and the integ's post-deploy drift run
+	* sees all three fixture targets — and left unguarded deliberately, since
+	* treating an empty readback as unreadable would also blind a legitimately
+	* emptied target group.
+	*
+	* On error the key is left ABSENT rather than emitted empty. That is not
+	* silent: against an observed baseline that HOLDS targets, an absent key
+	* still reports them as drifted. It is the honest option available — the
+	* read failed, so the live set is unknown — and it keeps `--revert` from
+	* acting on a fabricated empty list.
+	*/
+	async attachRegisteredTargets(result, targetGroupArn) {
+		try {
+			const resp = await this.getClient().send(new DescribeTargetHealthCommand({ TargetGroupArn: targetGroupArn }));
+			const groupPort = typeof result["Port"] === "number" ? result["Port"] : void 0;
+			const isIpTargetGroup = result["TargetType"] === "ip";
+			const targets = [];
+			for (const desc of resp.TargetHealthDescriptions ?? []) {
+				if (desc.TargetHealth?.State === "draining") continue;
+				const id = desc.Target?.Id;
+				if (typeof id !== "string" || id.length === 0) continue;
+				const port = desc.Target?.Port;
+				const az = desc.Target?.AvailabilityZone;
+				targets.push({
+					Id: id,
+					...port !== void 0 && port !== groupPort && { Port: port },
+					...isIpTargetGroup && az !== void 0 && az !== "all" && { AvailabilityZone: az }
+				});
+			}
+			result["Targets"] = targets;
+		} catch (err) {
+			this.logger.debug(`ELBv2 DescribeTargetHealth(${targetGroupArn}) failed: ${err instanceof Error ? err.message : String(err)}`);
+		}
+	}
+	/**
+	* `Targets` is scoped PER RESOURCE (issue
+	* [#1602](https://github.com/go-to-k/cdkd/issues/1602)'s seam), not switched
+	* off for the type: it is compared only for a target group whose TEMPLATE
+	* declares `Targets`.
+	*
+	* The reason is the issue [#1498](https://github.com/go-to-k/cdkd/issues/1498)
+	* class. A target group fronting an ECS service or an ASG declares NO
+	* `Targets` — the sibling resource registers them, and it keeps
+	* re-registering as it scales. Comparing an undeclared target list would
+	* therefore report drift on every scale event of an untouched stack, and
+	* `--revert` would DEREGISTER the tasks the service just placed. The
+	* `undeclaredEmptyObservedKeys` guard only covers the case where the capture
+	* happened to be EMPTY, which for a redeployed running service it is not.
+	*
+	* An absent properties bag falls back to COMPARING, per the method's
+	* contract — hiding real drift is the worse failure, and the only caller
+	* that omits the bag today is not `cdkd drift`.
+	*/
+	getDriftUnknownPaths(resourceType, properties) {
 		switch (resourceType) {
 			case "AWS::ElasticLoadBalancingV2::LoadBalancer": return ["EnableCapacityReservationProvisionStabilize"];
-			case "AWS::ElasticLoadBalancingV2::TargetGroup": return ["Targets"];
+			case "AWS::ElasticLoadBalancingV2::TargetGroup":
+				if (properties !== void 0 && Object.keys(properties).length > 0 && properties["Targets"] === void 0) return ["Targets"];
+				return [];
 			default: return [];
 		}
 	}
+	/**
+	* `Targets` is a semantically UNORDERED set: `RegisterTargets` /
+	* `DeregisterTargets` are set operations (the provider's own update path
+	* key-diffs them rather than comparing positions), and `DescribeTargetHealth`
+	* documents no ordering guarantee. Declared here rather than sorted inside
+	* {@link attachRegisteredTargets} so the sort applies to BOTH comparison
+	* sides — see {@link ResourceProvider.getDriftUnorderedPaths}, whose header
+	* records why one-sided sorting manufactures drift on the
+	* `properties`-fallback baseline.
+	*
+	* `TargetGroupAttributes` needs no declaration: it is a `{Key, Value}` list,
+	* which the shared tag-list canonicalizer already sorts on both sides.
+	*/
+	getDriftUnorderedPaths(resourceType) {
+		if (resourceType !== "AWS::ElasticLoadBalancingV2::TargetGroup") return [];
+		return ["Targets"];
+	}
 	async readListener(physicalId) {
 		let listener;
 		try {
@@ -35641,6 +35768,31 @@ var AppSyncProvider = class {
 		throw new ProvisioningError(message, resourceType, options?.logicalId ?? "");
 	}
 	/**
+	* CFn declares `DeltaSyncConfig.BaseTableTTL` / `.DeltaSyncTableTTL` as
+	* STRINGS (CDK's L1 types them `string` too) while the SDK models both as
+	* longs, so the value needs a real conversion rather than a cast — a string
+	* handed to the number member is dropped by the serializer, which is the
+	* silent-drop shape this batch closes.
+	*
+	* A non-numeric value is refused LOUDLY: `Number('abc')` is `NaN`, and NaN
+	* would serialize to `null` and reach AWS as a confusing type error far from
+	* the template line that caused it.
+	*
+	* `Number()` alone is NOT that refusal, which is the trap this guard exists
+	* for: it coerces `''` / `'  '` / `null` / `[]` / `false` to `0` and `true`
+	* to `1`, all of which are finite. An unresolved intrinsic or an empty CFn
+	* value would therefore have deployed a live data source with a ZERO-minute
+	* delta-sync TTL — the "validate the FIELD, not just the container" class in
+	* .claude/rules/providers.md. So the accepted shapes are enumerated instead:
+	* a finite NUMBER, or a NON-BLANK string that parses to one.
+	*/
+	toDeltaSyncTtl(value, path, logicalId, resourceType) {
+		const numeric = typeof value === "number" ? value : typeof value === "string" ? value.trim() : void 0;
+		const parsed = numeric === void 0 || numeric === "" ? NaN : Number(numeric);
+		if (!Number.isFinite(parsed)) throw new ProvisioningError(`${resourceType} ${path} must be a number of minutes (CFn types it as a string), got ${JSON.stringify(value)} — cdkd refuses to drop it silently`, resourceType, logicalId);
+		return parsed;
+	}
+	/**
 	* NOTE: `awsRegion` / `defaultAction` are passed through VERBATIM, including
 	* when the template omits them. cdkd deliberately does NOT substitute a
 	* default: `DefaultAction` decides whether an unauthenticated request is
@@ -35985,15 +36137,40 @@ var AppSyncProvider = class {
 		if (properties["Description"] !== void 0) input.description = properties["Description"];
 		if (properties["ServiceRoleArn"] !== void 0) input.serviceRoleArn = properties["ServiceRoleArn"];
 		const dynamo = this.asObject(properties["DynamoDBConfig"], "DynamoDBConfig", { logicalId }, resourceType);
-		if (dynamo) input.dynamodbConfig = {
-			tableName: dynamo["TableName"],
-			awsRegion: dynamo["AwsRegion"],
-			...dynamo["UseCallerCredentials"] !== void 0 ? { useCallerCredentials: dynamo["UseCallerCredentials"] } : {}
-		};
+		if (dynamo) {
+			const ddbConfig = {
+				tableName: dynamo["TableName"],
+				awsRegion: dynamo["AwsRegion"],
+				...dynamo["UseCallerCredentials"] !== void 0 ? { useCallerCredentials: dynamo["UseCallerCredentials"] } : {},
+				...dynamo["Versioned"] !== void 0 ? { versioned: dynamo["Versioned"] } : {}
+			};
+			const delta = this.asObject(dynamo["DeltaSyncConfig"], "DynamoDBConfig.DeltaSyncConfig", { logicalId }, resourceType);
+			if (delta) {
+				const deltaConfig = {};
+				if (delta["BaseTableTTL"] !== void 0) deltaConfig.baseTableTTL = this.toDeltaSyncTtl(delta["BaseTableTTL"], "DynamoDBConfig.DeltaSyncConfig.BaseTableTTL", logicalId, resourceType);
+				if (delta["DeltaSyncTableName"] !== void 0) deltaConfig.deltaSyncTableName = delta["DeltaSyncTableName"];
+				if (delta["DeltaSyncTableTTL"] !== void 0) deltaConfig.deltaSyncTableTTL = this.toDeltaSyncTtl(delta["DeltaSyncTableTTL"], "DynamoDBConfig.DeltaSyncConfig.DeltaSyncTableTTL", logicalId, resourceType);
+				ddbConfig.deltaSyncConfig = deltaConfig;
+			}
+			input.dynamodbConfig = ddbConfig;
+		}
 		const lambda = this.asObject(properties["LambdaConfig"], "LambdaConfig", { logicalId }, resourceType);
 		if (lambda) input.lambdaConfig = { lambdaFunctionArn: lambda["LambdaFunctionArn"] };
 		const http = this.asObject(properties["HttpConfig"], "HttpConfig", { logicalId }, resourceType);
-		if (http) input.httpConfig = { endpoint: http["Endpoint"] };
+		if (http) {
+			const httpConfig = { endpoint: http["Endpoint"] };
+			const auth = this.asObject(http["AuthorizationConfig"], "HttpConfig.AuthorizationConfig", { logicalId }, resourceType);
+			if (auth) {
+				const authConfig = { authorizationType: auth["AuthorizationType"] };
+				const iam = this.asObject(auth["AwsIamConfig"], "HttpConfig.AuthorizationConfig.AwsIamConfig", { logicalId }, resourceType);
+				if (iam) authConfig.awsIamConfig = {
+					...iam["SigningRegion"] !== void 0 ? { signingRegion: iam["SigningRegion"] } : {},
+					...iam["SigningServiceName"] !== void 0 ? { signingServiceName: iam["SigningServiceName"] } : {}
+				};
+				httpConfig.authorizationConfig = authConfig;
+			}
+			input.httpConfig = httpConfig;
+		}
 		const es = this.asObject(properties["ElasticsearchConfig"], "ElasticsearchConfig", { logicalId }, resourceType);
 		if (es) input.elasticsearchConfig = {
 			endpoint: es["Endpoint"],
@@ -36470,10 +36647,36 @@ var AppSyncProvider = class {
 			if (ds.dynamodbConfig.tableName !== void 0) dynamo["TableName"] = ds.dynamodbConfig.tableName;
 			if (ds.dynamodbConfig.awsRegion !== void 0) dynamo["AwsRegion"] = ds.dynamodbConfig.awsRegion;
 			if (ds.dynamodbConfig.useCallerCredentials !== void 0) dynamo["UseCallerCredentials"] = ds.dynamodbConfig.useCallerCredentials;
+			if (ds.dynamodbConfig.versioned !== void 0) dynamo["Versioned"] = ds.dynamodbConfig.versioned;
+			const delta = ds.dynamodbConfig.deltaSyncConfig;
+			if (delta) {
+				const deltaOut = {};
+				if (delta.baseTableTTL !== void 0) deltaOut["BaseTableTTL"] = String(delta.baseTableTTL);
+				if (delta.deltaSyncTableName !== void 0) deltaOut["DeltaSyncTableName"] = delta.deltaSyncTableName;
+				if (delta.deltaSyncTableTTL !== void 0) deltaOut["DeltaSyncTableTTL"] = String(delta.deltaSyncTableTTL);
+				if (Object.keys(deltaOut).length > 0) dynamo["DeltaSyncConfig"] = deltaOut;
+			}
 			if (Object.keys(dynamo).length > 0) result["DynamoDBConfig"] = dynamo;
 		}
 		if (ds.lambdaConfig?.lambdaFunctionArn !== void 0) result["LambdaConfig"] = { LambdaFunctionArn: ds.lambdaConfig.lambdaFunctionArn };
-		if (ds.httpConfig?.endpoint !== void 0) result["HttpConfig"] = { Endpoint: ds.httpConfig.endpoint };
+		if (ds.httpConfig) {
+			const httpOut = {};
+			if (ds.httpConfig.endpoint !== void 0) httpOut["Endpoint"] = ds.httpConfig.endpoint;
+			const authRead = ds.httpConfig.authorizationConfig;
+			if (authRead) {
+				const authOut = {};
+				if (authRead.authorizationType !== void 0) authOut["AuthorizationType"] = authRead.authorizationType;
+				const iamRead = authRead.awsIamConfig;
+				if (iamRead) {
+					const iamOut = {};
+					if (iamRead.signingRegion !== void 0) iamOut["SigningRegion"] = iamRead.signingRegion;
+					if (iamRead.signingServiceName !== void 0) iamOut["SigningServiceName"] = iamRead.signingServiceName;
+					if (Object.keys(iamOut).length > 0) authOut["AwsIamConfig"] = iamOut;
+				}
+				if (Object.keys(authOut).length > 0) httpOut["AuthorizationConfig"] = authOut;
+			}
+			if (Object.keys(httpOut).length > 0) result["HttpConfig"] = httpOut;
+		}
 		if (ds.elasticsearchConfig) {
 			const es = {};
 			if (ds.elasticsearchConfig.endpoint !== void 0) es["Endpoint"] = ds.elasticsearchConfig.endpoint;
@@ -51909,10 +52112,11 @@ function createDiffCommand() {
 * the sibling cdk-real-drift (cdkrd) tool, which hit the same false-positive
 * classes against the same kind of AWS-snapshot baseline.
 *
-* Plain-string arrays are NOT canonicalized by the two heuristic passes above,
-* because a scalar list can be order-significant. But several CFn inputs are
-* semantically unordered sets of plain strings (FSx `WindowsConfiguration.Aliases`,
-* `...SelfManagedActiveDirectoryConfiguration.DnsIps`, ...), so
+* Plain-string arrays and NON-tag object arrays are NOT canonicalized by the
+* two heuristic passes above, because either can be order-significant. But
+* several CFn inputs are semantically unordered sets of plain strings (FSx
+* `WindowsConfiguration.Aliases`) or of objects (ELBv2
+* `TargetGroup.Targets`), so
 * {@link canonicalizeUnorderedArraysAtPaths} sorts them at an explicit,
 * provider-declared path list only — an opt-in seam mirroring
 * `getDriftUnknownPaths` (see `ResourceProvider.getDriftUnorderedPaths`).
@@ -51976,10 +52180,11 @@ function matchesPathPrefix(path, entries) {
 	return false;
 }
 /**
-* Sort plain-string arrays found at one of the provider-declared `paths`, and
-* ONLY there. Unlike the two heuristic passes above, this one is opt-in per
-* resource type via `ResourceProvider.getDriftUnorderedPaths` — a scalar list
-* is order-significant unless the provider says otherwise.
+* Sort plain-string arrays AND object arrays found at one of the
+* provider-declared `paths`, and ONLY there. Unlike the two heuristic passes
+* above, this one is opt-in per resource type via
+* `ResourceProvider.getDriftUnorderedPaths` — a list is order-significant
+* unless the provider says otherwise.
 *
 * Paths use dot-notation for nested keys and are matched by the shared
 * {@link matchesPathPrefix} rule, the same one `getDriftUnknownPaths` uses. So
@@ -51997,21 +52202,68 @@ function matchesPathPrefix(path, entries) {
 * is strictly more permissive; nothing that matches for ignore-paths fails to
 * match here.
 *
-* Only arrays whose every element is a plain string are sorted, so a
-* mis-declared path can never reorder object or mixed-type elements. Nested
-* arrays are also left alone: an array element that is itself an array is not
-* descended into, so `{P: [['b','a']]}` never has its INNER list sorted by a
-* `'P'` declaration (no CFn shape in tree is an array-of-arrays, and sorting
-* one would contradict the plain-string-elements-only rule).
+* TWO element shapes are sorted, each only when the array is HOMOGENEOUS in it:
+*
+* 1. every element a plain string — sorted lexically;
+* 2. every element a plain object — sorted by {@link canonicalJson}, a
+*    key-order-independent serialization (issue
+*    [#1620](https://github.com/go-to-k/cdkd/issues/1620)). Key order must not
+*    participate: AWS's readback order for an object's own keys is no more
+*    guaranteed than its order for the list, so sorting on raw
+*    `JSON.stringify` would make the comparison depend on it and reintroduce
+*    the phantom drift this pass exists to remove. `ElasticLoadBalancingV2::
+*    TargetGroup.Targets` is the first consumer.
+*
+* A MIXED array (strings and objects, or anything else) is left untouched, so
+* a mis-declared path can never reorder a heterogeneous list. Nested arrays are
+* also left alone: an array element that is itself an array is not descended
+* into, so `{P: [['b','a']]}` never has its INNER list sorted by a `'P'`
+* declaration. That exclusion is a deliberate decision rather than an
+* inherited accident — no CFn shape in tree is an array-of-arrays, and an
+* inner list's own order-significance is a separate question from its
+* container's, which the single declared path cannot express.
 */
 function canonicalizeUnorderedArraysAtPaths(v, paths) {
 	if (paths.length === 0) return v;
 	return walkUnordered(v, "", paths);
 }
+/**
+* Serialize a value with every object's keys emitted in sorted order, so two
+* structurally equal objects produce the same string regardless of the key
+* order they were built in. Used ONLY as a sort key — the returned string is
+* never compared for equality by the drift comparator, which keeps its own
+* `deepEqual`.
+*
+* Keys are emitted `JSON.stringify`-quoted so a key containing `:` or `,`
+* cannot forge a different object's serialization, and `undefined`-valued
+* keys are SKIPPED exactly as `JSON.stringify` drops them — one side of the
+* comparison arrives via a raw SDK response (where an absent member is
+* `undefined`) and the other via JSON round-tripped state (where it is simply
+* gone), so without the skip the same target would key two different ways.
+*/
+function canonicalJson(v) {
+	if (Array.isArray(v)) return `[${v.map(canonicalJson).join(",")}]`;
+	if (v && typeof v === "object") {
+		const bag = v;
+		return `{${Object.keys(bag).filter((k) => bag[k] !== void 0).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(bag[k])}`).join(",")}}`;
+	}
+	return JSON.stringify(v) ?? "null";
+}
+const isPlainObjectElement = (el) => el !== null && typeof el === "object" && !Array.isArray(el);
 function walkUnordered(v, path, paths) {
 	if (Array.isArray(v)) {
 		const mapped = v.map((el) => Array.isArray(el) ? el : walkUnordered(el, path, paths));
-		if (mapped.length > 1 && matchesPathPrefix(path, paths) && mapped.every((el) => typeof el === "string")) return [...mapped].sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+		if (mapped.length > 1 && matchesPathPrefix(path, paths)) {
+			if (mapped.every((el) => typeof el === "string")) return [...mapped].sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+			if (mapped.every(isPlainObjectElement)) {
+				const keyed = mapped.map((el) => ({
+					el,
+					key: canonicalJson(el)
+				}));
+				keyed.sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+				return keyed.map((k) => k.el);
+			}
+		}
 		return mapped;
 	}
 	if (v && typeof v === "object") {
@@ -52082,10 +52334,12 @@ function walkUnordered(v, path, paths) {
 * `'VpcConfig.SubnetIds'` excludes only that leaf.
 *
 * `options.unorderedPaths` is supplied by the provider (via
-* `getDriftUnorderedPaths`) for plain-string arrays that are semantically
-* UNORDERED sets — e.g. FSx `WindowsConfiguration.Aliases`. Those are sorted on
-* BOTH sides before comparison so an AWS-side reorder is not phantom drift.
-* Path matching uses the same prefix rule as `ignorePaths`.
+* `getDriftUnorderedPaths`) for arrays that are semantically UNORDERED sets —
+* of plain strings (FSx `WindowsConfiguration.Aliases`) or of OBJECTS (ELBv2
+* `TargetGroup.Targets`, issue #1620, ordered by a key-order-independent
+* canonical serialization). Those are sorted on BOTH sides before comparison
+* so an AWS-side reorder is not phantom drift. Path matching uses the same
+* prefix rule as `ignorePaths`.
 */
 function calculateResourceDrift(stateProperties, awsProperties, options) {
 	const drifts = [];
@@ -70341,7 +70595,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.24");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.26");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;