@go-to-k/cdkd 0.284.65 → 0.284.66

package/dist/{program-BfK9a98r.js → program-COX2YwSA.js}

@@ -1,7 +1,7 @@
-import { $ as maskerOrIdentity, $n as findLargeInlineResources, $t as TemplateParser, A as renderStatefulReason, An as formatDockerLoginError, Ar as StackHasActiveImportsError, At as STATE_SOURCED_READBACK_RULES, B as exportAliasCollisionScrubWarning, Bn as getLegacyStateBucketName, Br as isThrottlingError, Bt as classifyReplaySecretRegion, C as isFinalSnapshotError, Cn as parseBootstrapMarker, Ct as configStringRefusal, D as extractDeploymentEventError, Dn as buildDenyExternalAccessPolicy, Dr as ProvisioningError, Dt as requireConfigObject, E as makeCanonicalizePropertiesFn, En as validateContainerRepoName, Er as PartialFailureError, Et as requireConfigArray, F as green, Fn as AssetManifestLoader, Ft as isSingleDynamicReferenceToken, G as IAMRoleProvider, Gn as resolveStateBucketWithDefault, Gt as s3BucketRegionalDomainName, H as secretBearingStateKeyWarning, Hn as resolveAutoAssetStorage, Ht as s3BucketArn, I as red, In as getDockerImageBySourceHash, Ir as normalizeAwsError, It as maskSecretsInError, J as ProviderRegistry, Jn as stateBucketExistenceConfirmed, Jt as DiffCalculator, K as collectInlinePolicyNamesManagedBySiblings, Kn as resolveStateBucketWithDefaultAndSource, Kt as s3BucketWebsiteUrl, L as yellow, Ln as Synthesizer, Lr as withErrorHandling, Lt as maskSecretsInText, M as bold, Mn as partitionSensitiveEnv, Mt as createSecretMasker, N as cyan, Nn as runDockerForeground, Nt as dynamicReferenceTokens, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as buildDockerImage, Or as ResourceTimeoutError, Ot as requireConfigString, P as gray, Pn as runDockerStreaming, Pt as errorCauseChain, Q as maskDeep, Qn as MIGRATE_TMP_PREFIX, Qt as DagBuilder, R as collectDeclaredOutputNames, Rn as synthesisStatusMessage, Rr as isMarkedNonRetryable, Rt as redactSecretsForState, S as createPreDeleteFinalSnapshot, Sn as isCrossRegionRedirect, Sr as LocalStartServiceError, St as configBooleanRefusal, T as unsupportedFinalSnapshotError, Tn as validateAssetBucketName, Tr as NestedStackChildDirectDestroyError, Tt as replayWarn, U as stateKeySecretExposure, Un as resolveCaptureObservedState, Ut as s3BucketDomainName, V as isExportAliasCollision, Vn as resolveApp, Vr as markNonRetryable, Vt as producerRegionsFromState, W as getCurrentResourceSecrets, Wn as resolveSkipPrefix, Wt as s3BucketDualStackDomainName, X as findSilentDropProperties, Xn as CFN_TEMPLATE_BODY_LIMIT, Xt as describeTypeWithThrottleRetry, Y as findActionableSilentDrops, Yn as warnDeprecatedNoPrefixCliFlag, Yt as INTRINSIC_KEYS, Z as createMaskedRetryLogger, Zn as CFN_TEMPLATE_URL_LIMIT, Zt as withRetry, _ as computeImplicitDeleteEdges, _n as AssetModeResolver, _t as WAFv2WebACLProvider, a as DeploymentEventsStore, an as importableOutputKeys, ar as AssemblyReader, at as isInterruptedWaitError, b as buildFinalSnapshotIdentifier, bn as ensureAssetStorage, br as LocalInvokeBuildError$1, bt as assertRegionMatch, c as replayFailedOperations, cn as AssetPublisher, cr as resolveBucketRegion, ct as slowCcOperationTimeoutMs, d as updatePartialReason, dn as buildAssetRedirectMap, dr as resetAwsClients, dt as IntrinsicFunctionResolver, en as LockManager, er as uploadCfnTemplate, et as CUSTOM_RESOURCE_RESPONSE_PREFIX, f as UNSPECIFIED_SKIP_REASON, fn as createAssetRedirectResolver, fr as setAwsClients, ft as carriesDynamicReference, g as IMPLICIT_DELETE_DEPENDENCIES, gn as stripControlChars, gr as CrossAccountSecretRefusalError, gt as refStateLookupFromResource, h as maskingRetryLogger, hn as escapeRegExp, ht as parameterTypeMayLoseSecretIdentity, i as DeploymentEventsReader, in as exportNamesCarriedFrom, ir as derivePartitionAndUrlSuffix, it as interruptWatchListenerCount, j as formatResourceLine, jn as getDockerCmd, jr as StackTerminationProtectionError, jt as TEMPLATE_SOURCED_RULES, k as isStatefulRecreateTargetSync, kn as dockerSpawnEnvWithSensitive, kr as ResourceUpdateNotSupportedError, kt as STATE_SOURCED_CROSS_GENERATION_RULES, l as replayRollback, ln as stringifyValue, lr as AwsClients, lt as disableInstanceApiTermination, m as withResourceDeadline, mn as rewriteTemplateAssetReferences, mr as CdkdError, mt as getAccountInfo, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as S3StateBackend, nr as PARTITION_TABLE, nt as beginCommandInterruptScope, o as planFailedOps, on as importableOutputs, or as processStackMessages, ot as startInterruptWatch, p as deleteSkipReason, pn as loadPublishableAssetManifest, pt as cfnRefValueFromPhysicalId, q as clearOnUpdateRemoval, qn as resolveUseCdkBootstrapAssets, qt as applyRoleArnIfSet, r as DeployEngine, rn as rebuildClientForBucketRegion, rr as canonicalizeRegion, rt as endCommandInterruptScope, s as planRollback, sn as shouldRetainResource, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as displaySafe, tr as expectedOwnerParam, tt as DEFAULT_STATE_PREFIX, u as updatePartialMessage, un as WorkGraph, ur as getAwsClients, ut as isTerminationProtectionPropagationError, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as BOOTSTRAP_MARKER_PREFIX, vr as DeployCancelledError, vt as normalizeAwsTagsToCfn, w as refusesFinalSnapshot, wn as readBootstrapMarkerBody, wr as MissingCdkCliError, wt as readConfigString, x as ccRoutedFinalSnapshotError, xn as getBootstrapMarkerKey, xr as LocalMigrateError, xt as coerceCfnBoolean, y as PRE_DELETE_SNAPSHOT_TYPES, yn as assertAssetBucketRegion, yr as DynamicReferenceRegionAmbiguousError, yt as resolveExplicitPhysicalId, z as collectPublishedOutputNames, zn as getDefaultStateBucketName, zr as isRetryableTransientError, zt as scrubResourceRecord } from "./deploy-engine-52VBVCWI.js";
-import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as getCdkdVersion } from "./version-BtkYYOb6.js";
-import { t as ASGProvider } from "./asg-provider-CNwOmQGg.js";
+import { $ as maskerOrIdentity, $n as findLargeInlineResources, $t as TemplateParser, A as renderStatefulReason, An as formatDockerLoginError, Ar as StackHasActiveImportsError, At as STATE_SOURCED_READBACK_RULES, B as exportAliasCollisionScrubWarning, Bn as getLegacyStateBucketName, Br as isThrottlingError, Bt as classifyReplaySecretRegion, C as isFinalSnapshotError, Cn as parseBootstrapMarker, Ct as configStringRefusal, D as extractDeploymentEventError, Dn as buildDenyExternalAccessPolicy, Dr as ProvisioningError, Dt as requireConfigObject, E as makeCanonicalizePropertiesFn, En as validateContainerRepoName, Er as PartialFailureError, Et as requireConfigArray, F as green, Fn as AssetManifestLoader, Ft as isSingleDynamicReferenceToken, G as IAMRoleProvider, Gn as resolveStateBucketWithDefault, Gt as s3BucketRegionalDomainName, H as secretBearingStateKeyWarning, Hn as resolveAutoAssetStorage, Ht as s3BucketArn, I as red, In as getDockerImageBySourceHash, Ir as normalizeAwsError, It as maskSecretsInError, J as ProviderRegistry, Jn as stateBucketExistenceConfirmed, Jt as DiffCalculator, K as collectInlinePolicyNamesManagedBySiblings, Kn as resolveStateBucketWithDefaultAndSource, Kt as s3BucketWebsiteUrl, L as yellow, Ln as Synthesizer, Lr as withErrorHandling, Lt as maskSecretsInText, M as bold, Mn as partitionSensitiveEnv, Mt as createSecretMasker, N as cyan, Nn as runDockerForeground, Nt as dynamicReferenceTokens, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as buildDockerImage, Or as ResourceTimeoutError, Ot as requireConfigString, P as gray, Pn as runDockerStreaming, Pt as errorCauseChain, Q as maskDeep, Qn as MIGRATE_TMP_PREFIX, Qt as DagBuilder, R as collectDeclaredOutputNames, Rn as synthesisStatusMessage, Rr as isMarkedNonRetryable, Rt as redactSecretsForState, S as createPreDeleteFinalSnapshot, Sn as isCrossRegionRedirect, Sr as LocalStartServiceError, St as configBooleanRefusal, T as unsupportedFinalSnapshotError, Tn as validateAssetBucketName, Tr as NestedStackChildDirectDestroyError, Tt as replayWarn, U as stateKeySecretExposure, Un as resolveCaptureObservedState, Ut as s3BucketDomainName, V as isExportAliasCollision, Vn as resolveApp, Vr as markNonRetryable, Vt as producerRegionsFromState, W as getCurrentResourceSecrets, Wn as resolveSkipPrefix, Wt as s3BucketDualStackDomainName, X as findSilentDropProperties, Xn as CFN_TEMPLATE_BODY_LIMIT, Xt as describeTypeWithThrottleRetry, Y as findActionableSilentDrops, Yn as warnDeprecatedNoPrefixCliFlag, Yt as INTRINSIC_KEYS, Z as createMaskedRetryLogger, Zn as CFN_TEMPLATE_URL_LIMIT, Zt as withRetry, _ as computeImplicitDeleteEdges, _n as AssetModeResolver, _t as WAFv2WebACLProvider, a as DeploymentEventsStore, an as importableOutputKeys, ar as AssemblyReader, at as isInterruptedWaitError, b as buildFinalSnapshotIdentifier, bn as ensureAssetStorage, br as LocalInvokeBuildError$1, bt as assertRegionMatch, c as replayFailedOperations, cn as AssetPublisher, cr as resolveBucketRegion, ct as slowCcOperationTimeoutMs, d as updatePartialReason, dn as buildAssetRedirectMap, dr as resetAwsClients, dt as IntrinsicFunctionResolver, en as LockManager, er as uploadCfnTemplate, et as CUSTOM_RESOURCE_RESPONSE_PREFIX, f as UNSPECIFIED_SKIP_REASON, fn as createAssetRedirectResolver, fr as setAwsClients, ft as carriesDynamicReference, g as IMPLICIT_DELETE_DEPENDENCIES, gn as stripControlChars, gr as CrossAccountSecretRefusalError, gt as refStateLookupFromResource, h as maskingRetryLogger, hn as escapeRegExp, ht as parameterTypeMayLoseSecretIdentity, i as DeploymentEventsReader, in as exportNamesCarriedFrom, ir as derivePartitionAndUrlSuffix, it as interruptWatchListenerCount, j as formatResourceLine, jn as getDockerCmd, jr as StackTerminationProtectionError, jt as TEMPLATE_SOURCED_RULES, k as isStatefulRecreateTargetSync, kn as dockerSpawnEnvWithSensitive, kr as ResourceUpdateNotSupportedError, kt as STATE_SOURCED_CROSS_GENERATION_RULES, l as replayRollback, ln as stringifyValue, lr as AwsClients, lt as disableInstanceApiTermination, m as withResourceDeadline, mn as rewriteTemplateAssetReferences, mr as CdkdError, mt as getAccountInfo, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as S3StateBackend, nr as PARTITION_TABLE, nt as beginCommandInterruptScope, o as planFailedOps, on as importableOutputs, or as processStackMessages, ot as startInterruptWatch, p as deleteSkipReason, pn as loadPublishableAssetManifest, pt as cfnRefValueFromPhysicalId, q as clearOnUpdateRemoval, qn as resolveUseCdkBootstrapAssets, qt as applyRoleArnIfSet, r as DeployEngine, rn as rebuildClientForBucketRegion, rr as canonicalizeRegion, rt as endCommandInterruptScope, s as planRollback, sn as shouldRetainResource, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as displaySafe, tr as expectedOwnerParam, tt as DEFAULT_STATE_PREFIX, u as updatePartialMessage, un as WorkGraph, ur as getAwsClients, ut as isTerminationProtectionPropagationError, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as BOOTSTRAP_MARKER_PREFIX, vr as DeployCancelledError, vt as normalizeAwsTagsToCfn, w as refusesFinalSnapshot, wn as readBootstrapMarkerBody, wr as MissingCdkCliError, wt as readConfigString, x as ccRoutedFinalSnapshotError, xn as getBootstrapMarkerKey, xr as LocalMigrateError, xt as coerceCfnBoolean, y as PRE_DELETE_SNAPSHOT_TYPES, yn as assertAssetBucketRegion, yr as DynamicReferenceRegionAmbiguousError, yt as resolveExplicitPhysicalId, z as collectPublishedOutputNames, zn as getDefaultStateBucketName, zr as isRetryableTransientError, zt as scrubResourceRecord } from "./deploy-engine-CgAjJmth.js";
+import { a as runStackBuffered, c as PATTERN_B_NAME_PROPERTIES, d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, h as withSkipPrefix, l as PATTERN_B_RESOURCE_TYPES, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, r as reserveStdoutForPayload, s as PATTERN_B_NAME_OPTIONS } from "./logger-C9-E73FI.js";
+import { t as getCdkdVersion } from "./version-B2nyZsKC.js";
+import { t as ASGProvider } from "./asg-provider-CIhU7iyC.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -66661,6 +66661,7 @@ function incompleteRemediationMessage(reports, mode) {
 async function driftCommand(stacks, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
+	if (options.json) reserveStdoutForPayload();
 	warnIfDeprecatedRegion(options);
 	if (options.accept && options.revert) throw new Error("--accept and --revert are mutually exclusive. Use --accept to update cdkd state from AWS, or --revert to push cdkd state values back into AWS.");
 	foldRegionOption(options);
@@ -67615,18 +67616,19 @@ function setAtPath(target, path, value) {
 */
 async function runAccept(reports, stateBackend, stateConfig, awsClients, options) {
 	const logger = getLogger();
+	const out = humanTextSink(options.json);
 	const lockRecovery = {
 		profile: options.profile,
 		stateBucket: stateConfig.bucket,
 		statePrefix: stateConfig.prefix
 	};
-	printAcceptPlan(reports);
+	printAcceptPlan(reports, out);
 	if (options.dryRun) {
 		logger.info("--dry-run: state will NOT be written. Re-run without --dry-run to apply.");
 		return;
 	}
 	if (!options.yes) {
-		if (!await confirmPrompt$5(`Update cdkd state with the AWS-current values shown above?`)) {
+		if (!await confirmPrompt$5(`Update cdkd state with the AWS-current values shown above?`, out)) {
 			logger.info("Aborted.");
 			return;
 		}
@@ -68249,18 +68251,19 @@ function deepEqualUnordered(a, b) {
 */
 async function runRevert(reports, providerRegistry, stateBackend, stateConfig, awsClients, options) {
 	const logger = getLogger();
+	const out = humanTextSink(options.json);
 	const lockRecovery = {
 		profile: options.profile,
 		stateBucket: stateConfig.bucket,
 		statePrefix: stateConfig.prefix
 	};
-	printRevertPlan(reports);
+	printRevertPlan(reports, out);
 	if (options.dryRun) {
 		logger.info("--dry-run: AWS will NOT be modified. Re-run without --dry-run to apply.");
 		return;
 	}
 	if (!options.yes) {
-		if (!await confirmPrompt$5(`Push cdkd state values back into AWS for the resources shown above?`)) {
+		if (!await confirmPrompt$5(`Push cdkd state values back into AWS for the resources shown above?`, out)) {
 			logger.info("Aborted.");
 			return;
 		}
@@ -68427,13 +68430,26 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 	if (totalUnsupported > 0) logger.warn(`${totalUnsupported} resource(s) cannot be reverted in place — re-deploy the stack with cdkd deploy --replace, or destroy + redeploy to push the cdkd-state values back into AWS.`);
 	if (totalFailed > 0 || totalUnsupported > 0 || totalUnresolvable > 0) throw new PartialFailureError(`Revert completed with ${totalFailed + totalUnsupported + totalUnresolvable} resource error(s) (${totalFailed} AWS update failure(s), ${totalUnsupported} update-not-supported, ${totalUnresolvable} whose dynamic reference(s) could not be resolved — those never reached provider.update; grant the caller secretsmanager:GetSecretValue / ssm:GetParameter, or fix the reference). Re-run 'cdkd drift <stack>' to see the remaining drift, then 'cdkd drift <stack> --revert' to retry.`);
 }
+function humanTextSink(json) {
+	return json ? {
+		write: (chunk) => {
+			process.stderr.write(chunk);
+		},
+		stream: process.stderr
+	} : {
+		write: (chunk) => {
+			process.stdout.write(chunk);
+		},
+		stream: process.stdout
+	};
+}
 /**
 * Print the planned state mutations for `--accept` (no AWS calls). One
 * line per resource per property path, mirroring the human report's
 * +/- diff format but flipped: the value on disk after this command
 * runs is the `+` side.
 */
-function printAcceptPlan(reports) {
+function printAcceptPlan(reports, out) {
 	for (const report of reports) {
 		const drifted = report.outcomes.flatMap((o) => matchOutcome(o, {
 			drifted: (d) => [d],
@@ -68457,8 +68473,8 @@ function printAcceptPlan(reports) {
 				lines.push(`    ${change.path}: ${formatScalar(change.stateValue)} -> ${formatScalar(change.awsValue)}\n`);
 			}
 		}
-		process.stdout.write(plannedWrites === 0 ? `\nPlan (--accept): no accepted values will be written to cdkd state for ${report.stackName} (${report.region}) — every drifted change below is refused (the run still writes the positioned re-redaction):\n` : `\nPlan (--accept): update cdkd state for ${report.stackName} (${report.region}):\n`);
-		for (const line of lines) process.stdout.write(line);
+		out.write(plannedWrites === 0 ? `\nPlan (--accept): no accepted values will be written to cdkd state for ${report.stackName} (${report.region}) — every drifted change below is refused (the run still writes the positioned re-redaction):\n` : `\nPlan (--accept): update cdkd state for ${report.stackName} (${report.region}):\n`);
+		for (const line of lines) out.write(line);
 	}
 }
 /**
@@ -68466,7 +68482,7 @@ function printAcceptPlan(reports) {
 * One line per resource summarising how many property paths will be
 * overwritten on the AWS side.
 */
-function printRevertPlan(reports) {
+function printRevertPlan(reports, out) {
 	for (const report of reports) {
 		const drifted = report.outcomes.flatMap((o) => matchOutcome(o, {
 			drifted: (d) => [d],
@@ -68476,31 +68492,31 @@ function printRevertPlan(reports) {
 			skipped: () => []
 		}));
 		if (drifted.length === 0) continue;
-		process.stdout.write(`\nPlan (--revert): push cdkd state values back into AWS for ${report.stackName} (${report.region}):\n`);
+		out.write(`\nPlan (--revert): push cdkd state values back into AWS for ${report.stackName} (${report.region}):\n`);
 		for (const o of drifted) {
 			const word = o.changes.length === 1 ? "property path" : "property paths";
-			process.stdout.write(`  → provider.update on ${o.logicalId} (${o.resourceType}): revert ${o.changes.length} ${word}\n`);
-			for (const change of o.changes) process.stdout.write(`    ${change.path}: ${formatScalar(change.awsValue)} -> ${formatScalar(change.stateValue)}\n`);
+			out.write(`  → provider.update on ${o.logicalId} (${o.resourceType}): revert ${o.changes.length} ${word}\n`);
+			for (const change of o.changes) out.write(`    ${change.path}: ${formatScalar(change.awsValue)} -> ${formatScalar(change.stateValue)}\n`);
 			const stateResource = report.state.resources[o.logicalId];
 			if (stateResource) {
 				const preserved = findRevertPreservedTagKeys(o.changes, stateResource.observedProperties ?? stateResource.properties ?? {}, o.awsProperties);
-				if (o.notComparedCause !== void 0 && preserved.length > 0) process.stdout.write(`    ! ${preserved.length} AWS-authored tag(s) will be preserved, but cdkd could not resolve this resource's dynamic reference(s), so their names are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
+				if (o.notComparedCause !== void 0 && preserved.length > 0) out.write(`    ! ${preserved.length} AWS-authored tag(s) will be preserved, but cdkd could not resolve this resource's dynamic reference(s), so their names are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
 				else if (preserved.length > 0) {
 					const tagWord = preserved.length === 1 ? "tag" : "tags";
-					process.stdout.write(`    ! reverting this tag list KEEPS ${preserved.length} AWS-authored ${tagWord} the baseline does not carry:\n`);
-					for (const path of preserved) process.stdout.write(`        ${maskSecretsInText(path, o.secrets)}\n`);
+					out.write(`    ! reverting this tag list KEEPS ${preserved.length} AWS-authored ${tagWord} the baseline does not carry:\n`);
+					for (const path of preserved) out.write(`        ${maskSecretsInText(path, o.secrets)}\n`);
 					const othersRevert = stateResource.observedProperties === void 0 ? "" : `Every other tag reverts normally. `;
-					process.stdout.write(`      ${othersRevert}A service may require these (ECS needs AmazonECSManaged for managed scaling); 'aws:'-prefixed keys are AWS-reserved and cannot be removed by hand.\n`);
+					out.write(`      ${othersRevert}A service may require these (ECS needs AmazonECSManaged for managed scaling); 'aws:'-prefixed keys are AWS-reserved and cannot be removed by hand.\n`);
 				}
 			}
 			if (stateResource && stateResource.observedProperties === void 0) {
 				const unbaselined = findRevertUnbaselinedAwsKeys(o.changes, stateResource.properties ?? {}, o.awsProperties);
-				if (o.notComparedCause !== void 0 && unbaselined.length > 0) process.stdout.write(`    ! ${unbaselined.length} AWS-authored value(s) will be left untouched, but cdkd could not resolve this resource's dynamic reference(s), so their paths are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
+				if (o.notComparedCause !== void 0 && unbaselined.length > 0) out.write(`    ! ${unbaselined.length} AWS-authored value(s) will be left untouched, but cdkd could not resolve this resource's dynamic reference(s), so their paths are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
 				else if (unbaselined.length > 0) {
 					const word = unbaselined.length === 1 ? "value" : "values";
-					process.stdout.write(`    ! this resource has no observed-capture baseline, so the revert pushes the raw TEMPLATE and LEAVES ${unbaselined.length} AWS-authored ${word} untouched:\n`);
-					for (const path of unbaselined) process.stdout.write(`        ${maskSecretsInText(path, o.secrets)}\n`);
-					process.stdout.write(`      The template does not declare these, so cdkd cannot tell an AWS-authored value from an out-of-band change and will not reset either (issue #1626). Run 'cdkd state refresh-observed ${report.stackName}' (or re-deploy) to populate observedProperties if you want them reverted too.\n`);
+					out.write(`    ! this resource has no observed-capture baseline, so the revert pushes the raw TEMPLATE and LEAVES ${unbaselined.length} AWS-authored ${word} untouched:\n`);
+					for (const path of unbaselined) out.write(`        ${maskSecretsInText(path, o.secrets)}\n`);
+					out.write(`      The template does not declare these, so cdkd cannot tell an AWS-authored value from an out-of-band change and will not reset either (issue #1626). Run 'cdkd state refresh-observed ${report.stackName}' (or re-deploy) to populate observedProperties if you want them reverted too.\n`);
 				}
 			}
 		}
@@ -68523,10 +68539,18 @@ async function runWithConcurrency(tasks, concurrency) {
 	})());
 	await Promise.all(workers);
 }
-async function confirmPrompt$5(prompt) {
+/**
+* Ask the operator to confirm a mutation.
+*
+* Issue #2230: the prompt is written to `out.stream`, not unconditionally to
+* `process.stdout` — under `--json` that stream carries the payload, and a
+* bare `[y/N] ` spliced into it is the same corruption as a status line.
+* The prompt is still SHOWN; only its stream changes.
+*/
+async function confirmPrompt$5(prompt, out) {
 	const rl = readline$1.createInterface({
 		input: process.stdin,
-		output: process.stdout
+		output: out.stream
 	});
 	try {
 		const ans = await rl.question(`${prompt} [y/N] `);
@@ -77955,9 +77979,29 @@ async function captureObservedForImportedResources(stackState, providerRegistry,
 * than silently using a non-ARN string. The format MUST match
 * `NestedStackProvider.synthesizeArn` so an import-then-deploy cycle does
 * not surface phantom property changes on the nested-stack row.
-*/
-function synthesizeNestedStackArn(region, accountId, parentStackName, logicalId) {
-	return `arn:cdkd-local:${region}:${accountId}:nested-stack/${parentStackName}/${logicalId}`;
+*
+* THE REGION SEGMENT IS READ BACK, so it must be the CHILD's region and must
+* not be collapsed with the parent's (issue
+* [#2055](https://github.com/go-to-k/cdkd/issues/2055)).
+* `nestedStackChildRegionFromLocalArn` in
+* [src/deployment/intrinsic-function-resolver.ts](../../deployment/intrinsic-function-resolver.ts)
+* parses this segment to learn which region to resolve a child's persisted
+* `{{resolve:...}}` output in — a secret NAME is regional, so resolving it in
+* the wrong region can answer with a DIFFERENT secret. Reading the child's own
+* state record instead is not an option: the region is part of that record's S3
+* key, so the lookup would be circular. That reader's doc block carries the
+* full rationale; this note exists because the value is produced HERE and the
+* next edit to the import walk would otherwise have nothing in front of it.
+*
+* Both call sites already pass a child-scoped value — the top-level walk passes
+* `targetRegion` (the stack being imported) and the recursive nested walk
+* passes `childRegion` — and parent and child region are necessarily equal
+* until cross-region nested stacks ship. The parameter is named `childRegion`
+* anyway, matching `NestedStackProvider.synthesizeArn`, so the requirement is
+* visible at the signature rather than only in prose.
+*/
+function synthesizeNestedStackArn(childRegion, accountId, parentStackName, logicalId) {
+	return `arn:cdkd-local:${childRegion}:${accountId}:nested-stack/${parentStackName}/${logicalId}`;
 }
 /**
 * Validate the parent template ↔ AWS CFn tree shape consistency before any
@@ -88015,4 +88059,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BfK9a98r.js.map
+//# sourceMappingURL=program-COX2YwSA.js.map