@go-to-k/cdkd 0.222.0 → 0.223.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { A as withErrorHandling, B as generateResourceNameWithFallback, C as StackHasActiveImportsError, F as getLiveRenderer, H as withStackName, I as PATTERN_B_NAME_PROPERTIES, L as PATTERN_B_RESOURCE_TYPES, M as getLogger, P as runStackBuffered, S as ResourceUpdateNotSupportedError, V as withSkipPrefix, _ as MissingCdkCliError, a as assertRegionMatch, b as ProvisioningError, f as LocalInvokeBuildError$1, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as matchesCdkPath, o as disableInstanceApiTermination, p as LocalMigrateError, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, t as CDK_PATH_TAG, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError, z as generateResourceName } from "./import-helpers-wLipXr5g.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as AssemblyReader, A as shouldRetainResource, B as getDefaultStateBucketName, C as applyRoleArnIfSet, D as LockManager, E as TemplateParser, F as formatDockerLoginError, G as resolveStateBucketWithDefault, H as resolveApp, I as getDockerCmd, J as CFN_TEMPLATE_BODY_LIMIT, K as resolveStateBucketWithDefaultAndSource, L as runDockerForeground, M as stringifyValue, N as WorkGraph, O as S3StateBackend, P as buildDockerImage, Q as uploadCfnTemplate, R as runDockerStreaming, S as IntrinsicFunctionResolver, T as DagBuilder, U as resolveCaptureObservedState, V as getLegacyStateBucketName, W as resolveSkipPrefix, X as MIGRATE_TMP_PREFIX, Y as CFN_TEMPLATE_URL_LIMIT, Z as findLargeInlineResources, _ as IAMRoleProvider, a as withRetry, b as findActionableSilentDrops, c as computeImplicitDeleteEdges, d as bold, f as cyan, g as yellow, h as red, i as withResourceDeadline, j as AssetPublisher, k as rebuildClientForBucketRegion, l as extractDeploymentEventError, m as green, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as isRetryableTransientError, p as gray, q as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as resolveBucketRegion, u as formatResourceLine, v as collectInlinePolicyNamesManagedBySiblings, w as DiffCalculator, x as CloudControlProvider, y as ProviderRegistry, z as Synthesizer } from "./deploy-engine-DsPQH0fw.js";
+import { $ as AssemblyReader, A as shouldRetainResource, B as getDefaultStateBucketName, C as applyRoleArnIfSet, D as LockManager, E as TemplateParser, F as formatDockerLoginError, G as resolveStateBucketWithDefault, H as resolveApp, I as getDockerCmd, J as CFN_TEMPLATE_BODY_LIMIT, K as resolveStateBucketWithDefaultAndSource, L as runDockerForeground, M as stringifyValue, N as WorkGraph, O as S3StateBackend, P as buildDockerImage, Q as uploadCfnTemplate, R as runDockerStreaming, S as IntrinsicFunctionResolver, T as DagBuilder, U as resolveCaptureObservedState, V as getLegacyStateBucketName, W as resolveSkipPrefix, X as MIGRATE_TMP_PREFIX, Y as CFN_TEMPLATE_URL_LIMIT, Z as findLargeInlineResources, _ as IAMRoleProvider, a as withRetry, b as findActionableSilentDrops, c as computeImplicitDeleteEdges, d as bold, f as cyan, g as yellow, h as red, i as withResourceDeadline, j as AssetPublisher, k as rebuildClientForBucketRegion, l as extractDeploymentEventError, m as green, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as isRetryableTransientError, p as gray, q as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as resolveBucketRegion, u as formatResourceLine, v as collectInlinePolicyNamesManagedBySiblings, w as DiffCalculator, x as CloudControlProvider, y as ProviderRegistry, z as Synthesizer } from "./deploy-engine-CmN65bEv.js";
 import { t as ASGProvider } from "./asg-provider-B_hrCxRx.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes, randomUUID } from "node:crypto";
@@ -53,7 +53,7 @@ import { CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCom
 import { CreatePrivateDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceCommand, ListNamespacesCommand, ListServicesCommand as ListServicesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, UpdatePrivateDnsNamespaceCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$13, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
-import { CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetDatabasesCommand, GetJobCommand, GetSecurityConfigurationCommand, GetSecurityConfigurationsCommand, GetTableCommand, GetTablesCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, ListWorkflowsCommand, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
+import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetDatabasesCommand, GetJobCommand, GetSecurityConfigurationCommand, GetSecurityConfigurationsCommand, GetTableCommand, GetTablesCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, ListWorkflowsCommand, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
 import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$14, UpdateShardCountCommand } from "@aws-sdk/client-kinesis";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$9, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
@@ -1553,7 +1553,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.222.0";
+	return "0.223.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -18384,6 +18384,88 @@ var CloudFrontDistributionProvider = class {
 		}
 	}
 	/**
+	* Read the AWS-current `DistributionConfig` for drift detection.
+	*
+	* Calls the read-only `GetDistributionConfigCommand` and inverts the
+	* provider's own `convertToSdkFormat` (the CFn-shape → SDK-shape
+	* `{ Quantity, Items }` mapping the create / update path applies) back
+	* into the CloudFormation `DistributionConfig` shape that cdkd state
+	* stores — so the drift comparator sees the same structure on both
+	* the deploy-time observed snapshot and a later drift read.
+	*
+	* The comparator only descends into keys present in cdkd state (or the
+	* union of state + AWS when an observed baseline exists), so this does
+	* not need to surface every AWS-injected field; it returns the same
+	* `DistributionConfig` / `Tags` keys the provider manages.
+	*
+	* `CallerReference` (a create-time idempotency token AWS echoes back
+	* but CDK never templates) is dropped so it cannot fire phantom drift.
+	* The remaining write-only / never-readable sub-fields are declared in
+	* `getDriftUnknownPaths`.
+	*/
+	async readCurrentState(physicalId, _logicalId, resourceType, _properties) {
+		if (resourceType !== "AWS::CloudFront::Distribution") return void 0;
+		let config;
+		try {
+			config = (await this.cloudFrontClient.send(new GetDistributionConfigCommand({ Id: physicalId }))).DistributionConfig;
+		} catch (error) {
+			if (error instanceof NoSuchDistribution) return void 0;
+			throw error;
+		}
+		if (!config) return void 0;
+		const result = { DistributionConfig: this.convertToCfnFormat(config) };
+		try {
+			const arn = (await this.cloudFrontClient.send(new GetDistributionCommand({ Id: physicalId }))).Distribution?.ARN;
+			if (arn) {
+				const cfnTags = ((await this.cloudFrontClient.send(new ListTagsForResourceCommand$3({ Resource: arn }))).Tags?.Items ?? []).filter((t) => typeof t.Key === "string" && !t.Key.startsWith("aws:cdk:")).map((t) => ({
+					Key: t.Key,
+					Value: t.Value ?? ""
+				}));
+				if (cfnTags.length > 0) result["Tags"] = cfnTags;
+			}
+		} catch (error) {
+			this.logger.debug(`Tag read for CloudFront Distribution ${physicalId} failed during drift read: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		return result;
+	}
+	/**
+	* State property paths cdkd cannot read back faithfully from AWS, so
+	* the drift comparator skips them rather than firing a guaranteed
+	* false positive every run (mirrors the Lambda `Code.S3*` precedent).
+	*
+	* - `DistributionConfig.CallerReference`: a create-time idempotency
+	*   token. cdkd generates it internally (`<ts>-<logicalId>-<rand>`);
+	*   AWS echoes it back, but it is never templated by CDK, so comparing
+	*   it would diff cdkd's generated value on every run. `convertToCfnFormat`
+	*   already drops it from the AWS side; declaring it here also excludes
+	*   it from the observed-baseline side.
+	* - `DistributionConfig.Logging.Bucket`: CloudFront normalizes the S3
+	*   logging bucket to its `<bucket>.s3.amazonaws.com` regional domain on
+	*   read, which never matches the bare bucket domain a template may
+	*   carry; treat it as drift-unknown to avoid a guaranteed mismatch.
+	* - `DistributionConfig.OriginGroups`: each origin group carries its own
+	*   inner `{ Quantity, Items }` wrappers (`Members`,
+	*   `FailoverCriteria.StatusCodes`) that `convertToCfnFormat` does not yet
+	*   unwrap symmetrically (only the top-level OriginGroups list is unwrapped;
+	*   there is no `revertOriginGroup` pass, and `convertToSdkFormat` likewise
+	*   does not descend into them). Against the observed baseline both sides go
+	*   through the same `readCurrentState` so this never false-positives on a
+	*   normal deploy, but against the `properties`-fallback baseline (older
+	*   state without `observedProperties`) the raw `{ Quantity, Items }` shape
+	*   would diff the bare-array template form. Suppress it until a dedicated
+	*   fix lands a `revertOriginGroup` + a real OriginGroups integ fixture
+	*   (there is no OriginGroups fixture to verify the inner shape today). See
+	*   the PR #871 review thread.
+	*/
+	getDriftUnknownPaths(resourceType) {
+		if (resourceType !== "AWS::CloudFront::Distribution") return [];
+		return [
+			"DistributionConfig.CallerReference",
+			"DistributionConfig.Logging.Bucket",
+			"DistributionConfig.OriginGroups"
+		];
+	}
+	/**
 	* Get resource attribute (for Fn::GetAtt resolution)
 	*/
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -18462,6 +18544,105 @@ var CloudFrontDistributionProvider = class {
 		return result;
 	}
 	/**
+	* Invert {@link convertToSdkFormat}: map an AWS-returned SDK-shape
+	* `DistributionConfig` ({@link GetDistributionConfigCommand} output) back
+	* into the CloudFormation `DistributionConfig` shape cdkd state stores.
+	*
+	* The inversion is the mirror image of the create / update conversion:
+	* every `{ Quantity, Items }` wrapper becomes its bare `Items` array
+	* (top-level list fields + the nested cache-behavior / origin fields),
+	* and `CallerReference` is dropped (a create-time idempotency token CDK
+	* never templates — see `getDriftUnknownPaths`).
+	*
+	* Lossiness note: the conversion is NOT perfectly lossless because
+	* `convertToSdkFormat` injects SDK-required defaults the CFn template may
+	* omit (`Comment: ''`, `Logging.{Enabled,IncludeCookies,Prefix}`,
+	* `CustomOriginConfig.HTTP{,S}Port`). Those defaults are preserved on the
+	* inverted side, which is correct for the drift comparator: the
+	* deploy-time observed baseline (also produced by THIS method) carries the
+	* same defaults, so they compare equal. They would only matter against the
+	* `properties` fallback baseline (resources with no observedProperties),
+	* where an AWS-injected default the template omitted is legitimately a
+	* key cdkd never set — but the comparator's state-keys-only walk in that
+	* mode never descends into a key absent from the template, so the extra
+	* defaults cannot fire false drift there either.
+	*/
+	convertToCfnFormat(config) {
+		const result = { ...config };
+		delete result["CallerReference"];
+		for (const field of QUANTITY_ITEM_FIELDS) if (result[field] !== void 0) result[field] = this.unwrapQuantity(result[field]);
+		if (result["DefaultCacheBehavior"] && typeof result["DefaultCacheBehavior"] === "object") result["DefaultCacheBehavior"] = this.revertCacheBehavior(result["DefaultCacheBehavior"]);
+		if (Array.isArray(result["CacheBehaviors"])) result["CacheBehaviors"] = result["CacheBehaviors"].map((cb) => this.revertCacheBehavior(cb));
+		if (Array.isArray(result["Origins"])) result["Origins"] = result["Origins"].map((origin) => this.revertOrigin(origin));
+		return result;
+	}
+	/**
+	* Inverse of {@link wrapWithQuantity}: a `{ Quantity, Items }` object
+	* becomes its bare `Items` array; anything else is returned unchanged.
+	*/
+	unwrapQuantity(value) {
+		if (value && typeof value === "object" && !Array.isArray(value)) {
+			const obj = value;
+			if (Array.isArray(obj["Items"])) return obj["Items"];
+		}
+		return value;
+	}
+	/**
+	* Inverse of {@link convertCacheBehavior}: unwrap the Quantity + Items
+	* fields nested inside a CacheBehavior back to bare arrays.
+	*/
+	revertCacheBehavior(behavior) {
+		const result = { ...behavior };
+		if (result["AllowedMethods"] && typeof result["AllowedMethods"] === "object") {
+			const allowed = result["AllowedMethods"];
+			if (allowed["CachedMethods"] !== void 0 && result["CachedMethods"] === void 0) {
+				result["CachedMethods"] = allowed["CachedMethods"];
+				const allowedCopy = { ...allowed };
+				delete allowedCopy["CachedMethods"];
+				result["AllowedMethods"] = allowedCopy;
+			}
+		}
+		for (const fieldPath of CACHE_BEHAVIOR_QUANTITY_FIELDS) {
+			const parts = fieldPath.split(".");
+			this.unwrapQuantityAtPath(result, parts);
+		}
+		return result;
+	}
+	/**
+	* Inverse of {@link convertOrigin}: unwrap CustomHeaders and
+	* CustomOriginConfig.OriginSslProtocols back to bare arrays.
+	*/
+	revertOrigin(origin) {
+		const result = { ...origin };
+		if (result["CustomHeaders"] !== void 0) result["CustomHeaders"] = this.unwrapQuantity(result["CustomHeaders"]);
+		if (result["CustomOriginConfig"] && typeof result["CustomOriginConfig"] === "object") {
+			const customOriginConfig = { ...result["CustomOriginConfig"] };
+			if (customOriginConfig["OriginSslProtocols"] !== void 0) customOriginConfig["OriginSslProtocols"] = this.unwrapQuantity(customOriginConfig["OriginSslProtocols"]);
+			result["CustomOriginConfig"] = customOriginConfig;
+		}
+		return result;
+	}
+	/**
+	* Inverse of {@link applyQuantityAtPath}: unwrap a `{ Quantity, Items }`
+	* value at a nested path (e.g. "ForwardedValues.Headers") back to a bare
+	* array.
+	*/
+	unwrapQuantityAtPath(obj, path) {
+		if (path.length === 0) return;
+		if (path.length === 1) {
+			const key = path[0];
+			if (obj[key] !== void 0) obj[key] = this.unwrapQuantity(obj[key]);
+			return;
+		}
+		const [head, ...rest] = path;
+		const headKey = head;
+		if (obj[headKey] && typeof obj[headKey] === "object") {
+			const nested = { ...obj[headKey] };
+			obj[headKey] = nested;
+			this.unwrapQuantityAtPath(nested, rest);
+		}
+	}
+	/**
 	* Wrap a value with the Quantity + Items pattern if needed.
 	*
 	* Handles three cases:
@@ -28173,12 +28354,13 @@ var GlueWorkflowProvider = class {
 		const name = properties["Name"];
 		if (!name) throw new ProvisioningError(`Name is required for Glue Workflow ${logicalId}`, resourceType, logicalId);
 		try {
-			const tags = workflowTagsForCreate(properties["Tags"]);
+			const tagsMap = cfnTagsToMap(properties["Tags"]);
+			const tags = tagsMap && Object.keys(tagsMap).length > 0 ? tagsMap : void 0;
 			await this.getClient().send(new CreateWorkflowCommand({
 				Name: name,
 				...properties["Description"] !== void 0 && { Description: properties["Description"] },
 				...properties["DefaultRunProperties"] !== void 0 && { DefaultRunProperties: properties["DefaultRunProperties"] },
-				...properties["MaxConcurrentRuns"] !== void 0 && { MaxConcurrentRuns: properties["MaxConcurrentRuns"] },
+				...properties["MaxConcurrentRuns"] !== void 0 && { MaxConcurrentRuns: coerceNumber(properties["MaxConcurrentRuns"]) },
 				...tags && { Tags: tags }
 			}));
 			this.logger.debug(`Successfully created Glue Workflow ${logicalId}: ${name}`);
@@ -28198,7 +28380,7 @@ var GlueWorkflowProvider = class {
 				Name: physicalId,
 				...properties["Description"] !== void 0 && { Description: properties["Description"] },
 				...properties["DefaultRunProperties"] !== void 0 && { DefaultRunProperties: properties["DefaultRunProperties"] },
-				...properties["MaxConcurrentRuns"] !== void 0 && { MaxConcurrentRuns: properties["MaxConcurrentRuns"] }
+				...properties["MaxConcurrentRuns"] !== void 0 && { MaxConcurrentRuns: coerceNumber(properties["MaxConcurrentRuns"]) }
 			}));
 			this.logger.debug(`Successfully updated Glue Workflow ${logicalId}`);
 			return {
@@ -28432,22 +28614,17 @@ var GlueSecurityConfigurationProvider = class {
 		return null;
 	}
 };
-/**
-* Normalize the CFn `Tags` shape (`Array<{Key,Value}>`) into the SDK's
-* `TagsMap` (`Record<string,string>`) for `CreateWorkflow`. Returns
-* `undefined` when no tags — the caller drops the key.
-*/
-function workflowTagsForCreate(tags) {
-	if (!Array.isArray(tags) || tags.length === 0) return void 0;
-	const out = {};
-	for (const t of tags) {
-		const obj = t;
-		const k = typeof obj["Key"] === "string" ? obj["Key"] : void 0;
-		const v = typeof obj["Value"] === "string" ? obj["Value"] : "";
-		if (!k) continue;
-		out[k] = v;
-	}
-	return Object.keys(out).length > 0 ? out : void 0;
+/** Max GetCrawler polls while waiting for a stopped crawler to settle. */
+const CRAWLER_STOP_MAX_ATTEMPTS = 30;
+/** Delay between GetCrawler polls while waiting for a crawler to stop. */
+const CRAWLER_STOP_POLL_INTERVAL_MS = 2e3;
+/** Max GetTrigger polls while waiting for a trigger to reach DEACTIVATED. */
+const TRIGGER_DEACTIVATE_MAX_ATTEMPTS = 30;
+/** Delay between GetTrigger polls while waiting for a trigger to deactivate. */
+const TRIGGER_DEACTIVATE_POLL_INTERVAL_MS = 1e3;
+/** Promise-based sleep used by the crawler / trigger state-machine waiters. */
+function sleep$1(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 /**
 * Build the SDK `EncryptionConfiguration` from the CFn-shape input
@@ -28768,24 +28945,51 @@ function buildJobCommonFields(p) {
 		"LogUri",
 		"DefaultArguments",
 		"NonOverridableArguments",
-		"MaxRetries",
-		"AllocatedCapacity",
-		"Timeout",
-		"MaxCapacity",
 		"WorkerType",
-		"NumberOfWorkers",
 		"SecurityConfiguration",
 		"GlueVersion",
 		"ExecutionClass",
 		"MaintenanceWindow"
 	]) if (p[k] !== void 0) r[k] = p[k];
-	if (p["ExecutionProperty"] !== void 0) r.ExecutionProperty = p["ExecutionProperty"];
+	for (const k of [
+		"MaxRetries",
+		"AllocatedCapacity",
+		"Timeout",
+		"MaxCapacity",
+		"NumberOfWorkers"
+	]) {
+		const v = p[k];
+		if (v !== void 0) r[k] = coerceNumber(v);
+	}
+	if (p["ExecutionProperty"] !== void 0) {
+		const ep = { ...p["ExecutionProperty"] };
+		if (ep["MaxConcurrentRuns"] !== void 0) ep["MaxConcurrentRuns"] = coerceNumber(ep["MaxConcurrentRuns"]);
+		r.ExecutionProperty = ep;
+	}
 	if (p["Connections"] !== void 0) r.Connections = { Connections: p["Connections"]["Connections"] ?? [] };
-	if (p["NotificationProperty"] !== void 0) r.NotificationProperty = p["NotificationProperty"];
+	if (p["NotificationProperty"] !== void 0) {
+		const np = { ...p["NotificationProperty"] };
+		if (np["NotifyDelayAfter"] !== void 0) np["NotifyDelayAfter"] = coerceNumber(np["NotifyDelayAfter"]);
+		r.NotificationProperty = np;
+	}
 	if (p["SourceControlDetails"] !== void 0) r.SourceControlDetails = p["SourceControlDetails"];
 	return r;
 }
 /**
+* Coerce a CFn-delivered numeric property (often a string like `"10"`) to a
+* JS number at the SDK wire boundary. Non-finite / unparseable inputs are
+* returned unchanged so AWS surfaces a clear validation error rather than
+* silently sending `NaN`.
+*/
+function coerceNumber(value) {
+	if (typeof value === "number") return value;
+	if (typeof value === "string" && value.trim() !== "") {
+		const n = Number(value);
+		if (Number.isFinite(n)) return n;
+	}
+	return value;
+}
+/**
 * Convert CFn `Tags: [{Key,Value}]` (or a tag map) to AWS Glue's
 * `Record<string,string>` shape used by Create commands and TagResource. Returns
 * `undefined` when the input is undefined so callers can elide the key.
@@ -28894,12 +29098,21 @@ var GlueCrawlerProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Glue Crawler ${logicalId}: ${physicalId}`);
 		try {
-			await this.getClient().send(new UpdateCrawlerCommand({
+			const updateInput = {
 				Name: physicalId,
 				...properties["Role"] !== void 0 && { Role: properties["Role"] },
 				...properties["Targets"] !== void 0 && { Targets: properties["Targets"] },
 				...buildCrawlerCommonFields(properties)
-			}));
+			};
+			try {
+				await this.getClient().send(new UpdateCrawlerCommand(updateInput));
+			} catch (err) {
+				if (err instanceof CrawlerRunningException) {
+					this.logger.debug(`Glue Crawler ${physicalId} is running; stopping before update and retrying`);
+					await this.stopCrawlerAndWait(physicalId);
+					await this.getClient().send(new UpdateCrawlerCommand(updateInput));
+				} else throw err;
+			}
 			const oldTags = cfnTagsToMap(previousProperties["Tags"]) ?? {};
 			const newTags = cfnTagsToMap(properties["Tags"]) ?? {};
 			await this.applyTagDiff(physicalId, oldTags, newTags);
@@ -28922,10 +29135,39 @@ var GlueCrawlerProvider = class {
 				this.logger.debug(`Glue Crawler ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
+			if (error instanceof CrawlerRunningException) {
+				this.logger.debug(`Glue Crawler ${physicalId} is running; stopping before delete and retrying`);
+				await this.stopCrawlerAndWait(physicalId);
+				await this.getClient().send(new DeleteCrawlerCommand({ Name: physicalId }));
+				return;
+			}
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to delete Glue Crawler ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
+	/**
+	* Stop a running crawler and poll until it leaves the RUNNING / STOPPING
+	* state (or until {@link CRAWLER_STOP_MAX_ATTEMPTS} is exhausted). Tolerates a
+	* CrawlerStoppingException / "not running" race (the crawler may have just
+	* finished on its own) so callers can unconditionally retry their delete /
+	* update afterwards.
+	*/
+	async stopCrawlerAndWait(physicalId) {
+		try {
+			await this.getClient().send(new StopCrawlerCommand({ Name: physicalId }));
+		} catch (err) {
+			this.logger.debug(`StopCrawler for ${physicalId} returned ${err instanceof Error ? err.name : String(err)}; continuing to wait`);
+		}
+		for (let attempt = 0; attempt < CRAWLER_STOP_MAX_ATTEMPTS; attempt++) {
+			try {
+				const state = (await this.getClient().send(new GetCrawlerCommand({ Name: physicalId }))).Crawler?.State;
+				if (state !== "RUNNING" && state !== "STOPPING") return;
+			} catch (err) {
+				if (err instanceof EntityNotFoundException) return;
+			}
+			await sleep$1(CRAWLER_STOP_POLL_INTERVAL_MS);
+		}
+	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
 		if (attributeName === "Id" || attributeName === "Ref" || attributeName === "Name") return physicalId;
 	}
@@ -29248,6 +29490,7 @@ var GlueTriggerProvider = class {
 				if ((await this.getClient().send(new GetTriggerCommand({ Name: physicalId }))).Trigger?.State === "ACTIVATED") {
 					restart = true;
 					await this.getClient().send(new StopTriggerCommand({ Name: physicalId }));
+					await this.waitForTriggerDeactivated(physicalId);
 				}
 			} catch (err) {
 				if (!(err instanceof EntityNotFoundException)) this.logger.debug(`GetTrigger pre-check failed for ${physicalId}; continuing anyway: ${err instanceof Error ? err.message : String(err)}`);
@@ -29259,11 +29502,22 @@ var GlueTriggerProvider = class {
 				...properties["Predicate"] !== void 0 && { Predicate: properties["Predicate"] },
 				...properties["EventBatchingCondition"] !== void 0 && { EventBatchingCondition: properties["EventBatchingCondition"] }
 			};
-			await this.getClient().send(new UpdateTriggerCommand({
-				Name: physicalId,
-				TriggerUpdate: update
-			}));
-			if (restart) await this.getClient().send(new StartTriggerCommand({ Name: physicalId }));
+			let updateError;
+			try {
+				await this.getClient().send(new UpdateTriggerCommand({
+					Name: physicalId,
+					TriggerUpdate: update
+				}));
+			} catch (err) {
+				updateError = err;
+			}
+			if (restart) try {
+				await this.getClient().send(new StartTriggerCommand({ Name: physicalId }));
+			} catch (restartError) {
+				if (updateError === void 0) throw restartError;
+				this.logger.warn(`Failed to re-activate Glue Trigger ${physicalId} after a failed update: ${restartError.message}`);
+			}
+			if (updateError !== void 0) throw updateError;
 			const oldTags = cfnTagsToMap(previousProperties["Tags"]) ?? {};
 			const newTags = cfnTagsToMap(properties["Tags"]) ?? {};
 			await this.applyTagDiff(physicalId, oldTags, newTags);
@@ -29276,9 +29530,34 @@ var GlueTriggerProvider = class {
 			throw new ProvisioningError(`Failed to update Glue Trigger ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
+	/**
+	* Poll GetTrigger until the trigger leaves the ACTIVATED / ACTIVATING state
+	* (StopTrigger is async). Returns once DEACTIVATED (or any non-active state)
+	* is observed, the trigger is gone, or the attempt budget is exhausted —
+	* callers then proceed with UpdateTrigger / DeleteTrigger.
+	*/
+	async waitForTriggerDeactivated(physicalId) {
+		for (let attempt = 0; attempt < TRIGGER_DEACTIVATE_MAX_ATTEMPTS; attempt++) {
+			try {
+				const state = (await this.getClient().send(new GetTriggerCommand({ Name: physicalId }))).Trigger?.State;
+				if (state !== "ACTIVATED" && state !== "ACTIVATING") return;
+			} catch (err) {
+				if (err instanceof EntityNotFoundException) return;
+			}
+			await sleep$1(TRIGGER_DEACTIVATE_POLL_INTERVAL_MS);
+		}
+	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting Glue Trigger ${logicalId}: ${physicalId}`);
 		try {
+			try {
+				if ((await this.getClient().send(new GetTriggerCommand({ Name: physicalId }))).Trigger?.State === "ACTIVATED") {
+					await this.getClient().send(new StopTriggerCommand({ Name: physicalId }));
+					await this.waitForTriggerDeactivated(physicalId);
+				}
+			} catch (err) {
+				if (!(err instanceof EntityNotFoundException)) this.logger.debug(`GetTrigger pre-delete check failed for ${physicalId}; continuing: ${err instanceof Error ? err.message : String(err)}`);
+			}
 			await this.getClient().send(new DeleteTriggerCommand({ Name: physicalId }));
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
@@ -54100,7 +54379,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.222.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.223.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());