@go-to-k/cdkd 0.285.7 → 0.285.8

package/dist/{program-CjlLza5f.js → program-CjJoJOIE.js}

@@ -1,8 +1,8 @@
-import { $ as DEFAULT_STATE_PREFIX, $n as CFN_TEMPLATE_BODY_LIMIT, $t as maskSecretsInError, A as bold, An as describeAwsFailure, Ar as NestedStackChildDirectDestroyError, At as requireConfigObject, B as secretBearingStateKeyWarning, Bn as Synthesizer, Bt as DiffCalculator, C as unsupportedFinalSnapshotError, Cn as getBootstrapMarkerKey, Cr as DeployCancelledError, Ct as assertRegionMatch, D as isStatefulRecreateTargetSync, Dn as validateAssetBucketName, Dr as LocalStartServiceError, Dt as readConfigString, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as readBootstrapMarkerBody, Er as LocalMigrateError, Et as configStringRefusal, F as yellow, Fn as partitionSensitiveEnv, Fr as StackHasActiveImportsError, Ft as s3BucketDomainName, G as clearOnUpdateRemoval, Gn as resolveAutoAssetStorage, Gr as isThrottlingError, Gt as TemplateParser, H as getCurrentResourceSecrets, Hn as getDefaultStateBucketName, Hr as withErrorHandling, Ht as describeTypeWithThrottleRetry, I as collectDeclaredOutputNames, In as runDockerForeground, Ir as StackTerminationProtectionError, It as s3BucketDualStackDomainName, J as findSilentDropProperties, Jn as resolveStateBucketWithDefault, Jr as markRedactedCause, Jt as TEMPLATE_SOURCED_RULES, K as ProviderRegistry, Kn as resolveCaptureObservedState, Kr as isTransientServerError, Kt as STATE_SOURCED_CROSS_GENERATION_RULES, L as collectPublishedOutputNames, Ln as runDockerStreaming, Lt as s3BucketRegionalDomainName, M as gray, Mn as dockerSpawnEnvWithSensitive, Mr as ProvisioningError, Mt as classifyReplaySecretRegion, N as green, Nn as formatDockerLoginError, Nr as ResourceTimeoutError, Nt as producerRegionsFromState, O as renderStatefulReason, On as validateContainerRepoName, Ot as replayWarn, P as red, Pn as getDockerCmd, Pr as ResourceUpdateNotSupportedError, Pt as s3BucketArn, Q as CUSTOM_RESOURCE_RESPONSE_PREFIX, Qn as warnDeprecatedNoPrefixCliFlag, Qt as isSingleDynamicReferenceToken, R as exportAliasCollisionScrubWarning, Rn as AssetManifestLoader, Rt as s3BucketWebsiteUrl, S as refusesFinalSnapshot, Sn as ensureAssetStorage, St as resolveExplicitPhysicalId, T as extractDeploymentEventError, Tn as parseBootstrapMarker, Tr as LocalInvokeBuildError$1, Tt as configBooleanRefusal, U as IAMRoleProvider, Un as getLegacyStateBucketName, Ur as isMarkedNonRetryable, Ut as withRetry, V as stateKeySecretExposure, Vn as synthesisStatusMessage, Vr as normalizeAwsError, Vt as INTRINSIC_KEYS, W as collectInlinePolicyNamesManagedBySiblings, Wn as resolveApp, Wr as isRetryableTransientError, Wt as DagBuilder, X as maskDeep, Xn as resolveUseCdkBootstrapAssets, Xt as dynamicReferenceTokens, Y as createMaskedRetryLogger, Yn as resolveStateBucketWithDefaultAndSource, Yr as retryClassificationText, Yt as createSecretMasker, Z as maskerOrIdentity, Zn as stateBucketExistenceConfirmed, Zt as errorCauseChain, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as escapeRegExp, _r as setAwsClients, _t as isUnboundTemplateParameter, a as DeploymentEventsStore, an as rebuildClientForBucketRegion, ar as displaySafe, at as CloudControlProvider, b as createPreDeleteFinalSnapshot, bn as BOOTSTRAP_MARKER_PREFIX, bt as WAFv2WebACLProvider, c as replayFailedOperations, cn as importableOutputs, cr as canonicalizeRegion, ct as deleteIndeterminateGuards, d as updatePartialReason, dn as stringifyValue, dr as processStackMessages, dt as isTerminationProtectionPropagationError, en as maskSecretsInText, er as CFN_TEMPLATE_URL_LIMIT, et as beginCommandInterruptScope, f as withResourceDeadline, fn as WorkGraph, ft as IntrinsicFunctionResolver, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as rewriteTemplateAssetReferences, gr as resetAwsClients, gt as getAccountInfo, h as computeImplicitDeleteEdges, hn as loadPublishableAssetManifest, hr as getAwsClients, ht as coerceParameterTypedValue, i as DeploymentEventsReader, in as S3StateBackend, ir as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, it as startInterruptWatch, j as cyan, jn as buildDockerImage, jr as PartialFailureError, jt as requireConfigString, k as formatResourceLine, kn as buildDenyExternalAccessPolicy, kr as MissingCdkCliError, kt as requireConfigArray, l as replayRollback, ln as shouldRetainResource, lr as derivePartitionAndUrlSuffix, lt as deleteSkipReason, m as IMPLICIT_DELETE_DEPENDENCIES, mn as createAssetRedirectResolver, mr as AwsClients, mt as cfnRefValueFromPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as scrubResourceRecord, nr as findLargeInlineResources, nt as interruptWatchListenerCount, o as planFailedOps, on as exportNamesCarriedFrom, or as expectedOwnerParam, ot as slowCcOperationTimeoutMs, p as maskingRetryLogger, pn as buildAssetRedirectMap, pr as resolveBucketRegion, pt as carriesDynamicReference, q as findActionableSilentDrops, qn as resolveSkipPrefix, qr as markNonRetryable, qt as STATE_SOURCED_READBACK_RULES, r as DeployEngine, rn as LockManager, rr as uploadCfnTemplate, rt as isInterruptedWaitError, s as planRollback, sn as importableOutputKeys, sr as PARTITION_TABLE, st as UNSPECIFIED_SKIP_REASON, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as redactSecretsForState, tr as MIGRATE_TMP_PREFIX, tt as endCommandInterruptScope, u as updatePartialMessage, un as AssetPublisher, ur as AssemblyReader, ut as disableInstanceApiTermination, v as buildFinalSnapshotIdentifier, vn as stripControlChars, vt as parameterTypeMayLoseSecretIdentity, w as makeCanonicalizePropertiesFn, wn as isCrossRegionRedirect, wr as DynamicReferenceRegionAmbiguousError, wt as coerceCfnBoolean, x as isFinalSnapshotError, xn as assertAssetBucketRegion, xr as CrossAccountSecretRefusalError, xt as normalizeAwsTagsToCfn, y as ccRoutedFinalSnapshotError, yn as AssetModeResolver, yr as CdkdError, yt as refStateLookupFromResource, z as isExportAliasCollision, zn as getDockerImageBySourceHash, zt as applyRoleArnIfSet } from "./deploy-engine-DmWPwiyQ.js";
-import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-DyTk5GeO.js";
+import { $ as DEFAULT_STATE_PREFIX, $n as CFN_TEMPLATE_BODY_LIMIT, $t as maskSecretsInError, A as bold, An as describeAwsFailure, Ar as NestedStackChildDirectDestroyError, At as requireConfigObject, B as secretBearingStateKeyWarning, Bn as Synthesizer, Bt as DiffCalculator, C as unsupportedFinalSnapshotError, Cn as getBootstrapMarkerKey, Cr as DeployCancelledError, Ct as assertRegionMatch, D as isStatefulRecreateTargetSync, Dn as validateAssetBucketName, Dr as LocalStartServiceError, Dt as readConfigString, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as readBootstrapMarkerBody, Er as LocalMigrateError, Et as configStringRefusal, F as yellow, Fn as partitionSensitiveEnv, Fr as StackHasActiveImportsError, Ft as s3BucketDomainName, G as clearOnUpdateRemoval, Gn as resolveAutoAssetStorage, Gr as isThrottlingError, Gt as TemplateParser, H as getCurrentResourceSecrets, Hn as getDefaultStateBucketName, Hr as withErrorHandling, Ht as describeTypeWithThrottleRetry, I as collectDeclaredOutputNames, In as runDockerForeground, Ir as StackTerminationProtectionError, It as s3BucketDualStackDomainName, J as findSilentDropProperties, Jn as resolveStateBucketWithDefault, Jr as markRedactedCause, Jt as TEMPLATE_SOURCED_RULES, K as ProviderRegistry, Kn as resolveCaptureObservedState, Kr as isTransientServerError, Kt as STATE_SOURCED_CROSS_GENERATION_RULES, L as collectPublishedOutputNames, Ln as runDockerStreaming, Lt as s3BucketRegionalDomainName, M as gray, Mn as dockerSpawnEnvWithSensitive, Mr as ProvisioningError, Mt as classifyReplaySecretRegion, N as green, Nn as formatDockerLoginError, Nr as ResourceTimeoutError, Nt as producerRegionsFromState, O as renderStatefulReason, On as validateContainerRepoName, Ot as replayWarn, P as red, Pn as getDockerCmd, Pr as ResourceUpdateNotSupportedError, Pt as s3BucketArn, Q as CUSTOM_RESOURCE_RESPONSE_PREFIX, Qn as warnDeprecatedNoPrefixCliFlag, Qt as isSingleDynamicReferenceToken, R as exportAliasCollisionScrubWarning, Rn as AssetManifestLoader, Rt as s3BucketWebsiteUrl, S as refusesFinalSnapshot, Sn as ensureAssetStorage, St as resolveExplicitPhysicalId, T as extractDeploymentEventError, Tn as parseBootstrapMarker, Tr as LocalInvokeBuildError$1, Tt as configBooleanRefusal, U as IAMRoleProvider, Un as getLegacyStateBucketName, Ur as isMarkedNonRetryable, Ut as withRetry, V as stateKeySecretExposure, Vn as synthesisStatusMessage, Vr as normalizeAwsError, Vt as INTRINSIC_KEYS, W as collectInlinePolicyNamesManagedBySiblings, Wn as resolveApp, Wr as isRetryableTransientError, Wt as DagBuilder, X as maskDeep, Xn as resolveUseCdkBootstrapAssets, Xt as dynamicReferenceTokens, Y as createMaskedRetryLogger, Yn as resolveStateBucketWithDefaultAndSource, Yr as retryClassificationText, Yt as createSecretMasker, Z as maskerOrIdentity, Zn as stateBucketExistenceConfirmed, Zt as errorCauseChain, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as escapeRegExp, _r as setAwsClients, _t as isUnboundTemplateParameter, a as DeploymentEventsStore, an as rebuildClientForBucketRegion, ar as displaySafe, at as CloudControlProvider, b as createPreDeleteFinalSnapshot, bn as BOOTSTRAP_MARKER_PREFIX, bt as WAFv2WebACLProvider, c as replayFailedOperations, cn as importableOutputs, cr as canonicalizeRegion, ct as deleteIndeterminateGuards, d as updatePartialReason, dn as stringifyValue, dr as processStackMessages, dt as isTerminationProtectionPropagationError, en as maskSecretsInText, er as CFN_TEMPLATE_URL_LIMIT, et as beginCommandInterruptScope, f as withResourceDeadline, fn as WorkGraph, ft as IntrinsicFunctionResolver, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as rewriteTemplateAssetReferences, gr as resetAwsClients, gt as getAccountInfo, h as computeImplicitDeleteEdges, hn as loadPublishableAssetManifest, hr as getAwsClients, ht as coerceParameterTypedValue, i as DeploymentEventsReader, in as S3StateBackend, ir as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, it as startInterruptWatch, j as cyan, jn as buildDockerImage, jr as PartialFailureError, jt as requireConfigString, k as formatResourceLine, kn as buildDenyExternalAccessPolicy, kr as MissingCdkCliError, kt as requireConfigArray, l as replayRollback, ln as shouldRetainResource, lr as derivePartitionAndUrlSuffix, lt as deleteSkipReason, m as IMPLICIT_DELETE_DEPENDENCIES, mn as createAssetRedirectResolver, mr as AwsClients, mt as cfnRefValueFromPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as scrubResourceRecord, nr as findLargeInlineResources, nt as interruptWatchListenerCount, o as planFailedOps, on as exportNamesCarriedFrom, or as expectedOwnerParam, ot as slowCcOperationTimeoutMs, p as maskingRetryLogger, pn as buildAssetRedirectMap, pr as resolveBucketRegion, pt as carriesDynamicReference, q as findActionableSilentDrops, qn as resolveSkipPrefix, qr as markNonRetryable, qt as STATE_SOURCED_READBACK_RULES, r as DeployEngine, rn as LockManager, rr as uploadCfnTemplate, rt as isInterruptedWaitError, s as planRollback, sn as importableOutputKeys, sr as PARTITION_TABLE, st as UNSPECIFIED_SKIP_REASON, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as redactSecretsForState, tr as MIGRATE_TMP_PREFIX, tt as endCommandInterruptScope, u as updatePartialMessage, un as AssetPublisher, ur as AssemblyReader, ut as disableInstanceApiTermination, v as buildFinalSnapshotIdentifier, vn as stripControlChars, vt as parameterTypeMayLoseSecretIdentity, w as makeCanonicalizePropertiesFn, wn as isCrossRegionRedirect, wr as DynamicReferenceRegionAmbiguousError, wt as coerceCfnBoolean, x as isFinalSnapshotError, xn as assertAssetBucketRegion, xr as CrossAccountSecretRefusalError, xt as normalizeAwsTagsToCfn, y as ccRoutedFinalSnapshotError, yn as AssetModeResolver, yr as CdkdError, yt as refStateLookupFromResource, z as isExportAliasCollision, zn as getDockerImageBySourceHash, zt as applyRoleArnIfSet } from "./deploy-engine-D4QA_B1V.js";
+import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-DlUEyyGa.js";
-import { t as ASGProvider } from "./asg-provider-B1EEjygi.js";
+import { t as getCdkdVersion } from "./version-DFdq83MF.js";
+import { t as ASGProvider } from "./asg-provider-CvYAGRMV.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2675,14 +2675,32 @@ async function promptRecreateConfirm(input) {
 //#endregion
 //#region src/cli/commands/confirm-prompt.ts
 /**
-* Default-YES confirmation prompt (`[Y/n]`, empty input = yes). Used by the
-* issue #1007 asset-storage auto-create on interactive TTY deploys without
-* `--yes`. Kept in its own module (mirrors `recreate-confirm-prompt.ts`) so
-* the accept/decline parsing is unit-testable without importing the whole
-* deploy command.
+* The CLI's two shared confirmation-prompt helpers.
+*
+* They have OPPOSITE defaults and opposite non-interactive behaviour, which is
+* why both live here rather than one being expressed in terms of the other:
+*
+*  - {@link promptYesNo} — default-YES (`[Y/n]`, empty input accepts). Used by
+*    the issue #1007 asset-storage auto-create on interactive TTY deploys
+*    without `--yes`. It deliberately carries NO non-interactive guard: its
+*    only caller (`deploy.ts`, at the `options.yes || !process.stdin.isTTY`
+*    short-circuit) never reaches it on a non-TTY stdin, and a deploy that
+*    assumes "yes" is the one place in the CLI where auto-confirming is the
+*    documented choice.
+*  - {@link confirmOrRefuse} — default-NO (`[y/N]`), and REFUSES outright on a
+*    non-interactive stdin. This is the one every MUTATING command uses.
+*
+* Kept in its own module (mirrors `recreate-confirm-prompt.ts`) so the
+* accept/decline parsing is unit-testable without importing whole command
+* files.
+*/
+/**
+* Default-YES confirmation prompt (`[Y/n]`, empty input = yes).
+*
+* See the module doc for why this one is deliberately unguarded.
 */
 async function promptYesNo(prompt) {
-	const rl = readline.createInterface({
+	const rl = readline$1.createInterface({
 		input: process.stdin,
 		output: process.stdout
 	});
@@ -2693,6 +2711,79 @@ async function promptYesNo(prompt) {
 		rl.close();
 	}
 }
+/** Suffix appended to a {@link confirmOrRefuse} prompt when none is given. */
+const DEFAULT_CONFIRM_SUFFIX = " [y/N] ";
+/**
+* Default-NO confirmation prompt that REFUSES a non-interactive run instead of
+* hanging on it (issue #2275, the class issue #2259 fixed for `cdkd destroy`).
+*
+* `rl.question` never settles when stdin is already at EOF, and EOF delivers
+* no signal, so nothing wakes it: a command that prompts without this guard
+* parks FOREVER in CI rather than failing, burning the job's whole timeout
+* budget. Measured on Node 24.15.0, the version `.node-version` pins, against
+* real `node:readline/promises`: `echo y |` resolves `"y"`, while both
+* `printf 'y' |` (a real answer with no trailing newline) and `< /dev/null`
+* stay pending indefinitely.
+*
+* REFUSE rather than auto-confirm, at every one of the nine sites this helper
+* replaced. Every one of them guards a MUTATION — a rollback replay, a state
+* record removal, an observed-property refresh, an orphan, an import, an
+* export-then-delete-state, a drift accept/revert, a CloudFormation stack
+* retirement, a state-bucket migration — so silently answering "yes" on
+* behalf of an absent operator is never the safe reading. `deploy.ts`'s
+* auto-confirm (`options.yes || !process.stdin.isTTY` -> proceed) stays the
+* deliberate exception, because a deploy that assumes "yes" is recoverable.
+*
+* A first cut of this guard (in `state.ts`, see the long comment at the
+* `state destroy --all` prompt) raced the question against readline's `close`
+* event and turned EOF into a decline. That lost three measured ways — a real
+* answer with no trailing newline was silently discarded, a delayed answer
+* lost the race, and an interactive Ctrl-C landed on the EOF arm — so do not
+* reintroduce it. A refusal has none of those.
+*
+* POSITION IS LOAD-BEARING, and this helper gets it for free: every call site
+* sits INSIDE the caller's `--yes` / `--force` short-circuit
+* (`if (!options.yes && !options.force) { ... }`), so a flagged
+* non-interactive run never reaches this function and never consults stdin at
+* all. Keep it that way — hoisting a call above its flag check would make
+* `--yes` refuse instead of proceed, which is the inverse bug.
+*
+* Throws {@link CdkdError} with the `NON_INTERACTIVE_CONFIRM` code, matching
+* `gc.ts` and `bootstrap-destroy.ts` — the only two of the five originally
+* guarded prompts that carry a code (the other three throw a bare `Error` or
+* a `LocalMigrateError`). `handleError` maps it to exit 1, so CI can branch on
+* it.
+*
+* TWO GUARDED PROMPTS DELIBERATELY DO NOT ROUTE THROUGH HERE:
+* `destroy-runner.ts`'s per-stack prompt (the issue #2259 fix) and
+* `state.ts`'s `state destroy --all` batch prompt (issue #2247). Both already
+* carry this exact guard inline, and both differ in ways a shared helper would
+* have to grow parameters for — `destroy-runner.ts` has a default-YES bare
+* form alongside a default-NO `--remove-protection` form, and `state.ts`
+* passes an abort `signal` for the issue #2117 Ctrl-C handling. Folding them
+* in would also drag `destroy-runner.ts` (in the `integ-destroy` AND
+* `integ-broad` gate scopes) into a pure refactor's blast radius, buying a
+* real-AWS run for no behaviour change. The other five pre-existing guarded
+* prompts (`gc.ts`, `bootstrap-destroy.ts`, `recreate-confirm-prompt.ts`,
+* `prefix-migration-check.ts`, `migrate-command.ts`) stay put for the same
+* reason: each guards its own flow with its own error type.
+*
+* @param prompt the question, WITHOUT its trailing `[y/N]` marker
+* @returns `true` only for `y` / `yes` (any case, trimmed)
+*/
+async function confirmOrRefuse(prompt, options) {
+	if (process.stdin.isTTY !== true) throw new CdkdError(options.refusal, "NON_INTERACTIVE_CONFIRM");
+	const rl = readline$1.createInterface({
+		input: process.stdin,
+		output: options.output ?? process.stdout
+	});
+	try {
+		const ans = await rl.question(`${prompt}${options.suffix ?? " [y/N] "}`);
+		return /^y(es)?$/i.test(ans.trim());
+	} finally {
+		rl.close();
+	}
+}
 
 //#endregion
 //#region src/cli/commands/deployment-events-run.ts
@@ -62830,6 +62921,36 @@ const TEMPLATE_BODY_LIMIT = CFN_TEMPLATE_BODY_LIMIT;
 */
 const TEMPLATE_URL_LIMIT = CFN_TEMPLATE_URL_LIMIT;
 /**
+* Best-effort reaper for the transient template bodies this flow uploads to
+* the state bucket under `cdkd-migrate-tmp/`.
+*
+* ONE implementation because {@link retireCloudFormationStack} drains from
+* four different exits — the recursive walk's `catch`, the confirmation
+* gate's decline AND its non-interactive refusal, the no-modification fast
+* path, and the post-`UpdateStack` `finally`. Each used to carry its own copy
+* of this loop, and the copies were how the refusal exit came to have none at
+* all: a `throw` from the gate passes every one of the other three.
+*
+* Best-effort by design. A leaked transient object costs pennies and lives
+* under an explicitly-named prefix, while a failed DELETE that propagated
+* would turn a successful retire into a reported failure. The retire's
+* success is governed by CloudFormation, not by S3 — so each cleanup's own
+* error becomes a `warn` naming the prefix to sweep manually.
+*
+* `what` / `when` keep the four sites' distinct wording (a caller says
+* whether these are the parent's own upload or a nested child's, and whether
+* it is unwinding); the SENTENCE they sit in is shared.
+*/
+async function drainTemplateUploads(cleanups, stateBucket, labels) {
+	const logger = getLogger();
+	for (const cleanup of cleanups) try {
+		await cleanup();
+	} catch (cleanupErr) {
+		const msg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
+		logger.warn(`Failed to delete ${labels.what} from '${stateBucket}'${labels.when ? ` ${labels.when}` : ""}. Clean up manually under prefix '${MIGRATE_TMP_PREFIX}/'. Cause: ${msg}`);
+	}
+}
+/**
 * Retire a CloudFormation stack whose resources have just been adopted into
 * cdkd state. The 4-step procedure is the one AWS recommends for handing
 * over resources between management tools without deleting them:
@@ -62893,35 +63014,31 @@ async function retireCloudFormationStack(options) {
 			format = recursive.format;
 			nestedCleanups.push(...recursive.cleanups);
 		} catch (err) {
-			if (err instanceof RecursiveRetainInjectionError) for (const cleanup of err.cleanups) try {
-				await cleanup();
-			} catch (cleanupErr) {
-				const msg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
-				logger.warn(`Failed to delete partial nested-template upload from '${stateBucket}' during error recovery. Clean up manually under prefix '${MIGRATE_TMP_PREFIX}/'. Cause: ${msg}`);
-			}
+			if (err instanceof RecursiveRetainInjectionError) await drainTemplateUploads(err.cleanups, stateBucket, {
+				what: "partial nested-template upload",
+				when: "during error recovery"
+			});
 			throw err;
 		}
 	} else ({body: newBody, modified, format} = injectRetainPolicies(tpl.TemplateBody, cfnStackName));
 	if (!yes) {
-		if (!await confirmPrompt$6(`Set DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource in CloudFormation stack '${cfnStackName}', then delete the stack? AWS resources will NOT be deleted (cdkd state has been written).`)) {
+		let proceed = false;
+		try {
+			proceed = await confirmPrompt$6(`Set DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource in CloudFormation stack '${cfnStackName}', then delete the stack? AWS resources will NOT be deleted (cdkd state has been written).`);
+		} finally {
+			if (!proceed) await drainTemplateUploads(nestedCleanups, stateBucket, {
+				what: "temporary nested-template upload",
+				when: "during cancel cleanup"
+			});
+		}
+		if (!proceed) {
 			logger.info("CloudFormation stack retirement cancelled. cdkd state is unaffected.");
-			for (const cleanup of nestedCleanups) try {
-				await cleanup();
-			} catch (cleanupErr) {
-				const msg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
-				logger.warn(`Failed to delete temporary nested-template upload from '${stateBucket}' during cancel cleanup. Clean up manually under prefix '${MIGRATE_TMP_PREFIX}/'. Cause: ${msg}`);
-			}
 			return { outcome: "cancelled" };
 		}
 	}
 	if (!modified) {
 		logger.info(`[2/4] Template already has Retain on every resource — skipping UpdateStack.`);
-		if (nestedCleanups.length > 0) for (const cleanup of nestedCleanups) try {
-			await cleanup();
-		} catch (cleanupErr) {
-			const msg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
-			logger.warn(`Failed to delete temporary nested-template upload from '${stateBucket}'. Clean up manually under prefix '${MIGRATE_TMP_PREFIX}/'. Cause: ${msg}`);
-		}
+		await drainTemplateUploads(nestedCleanups, stateBucket, { what: "temporary nested-template upload" });
 	} else {
 		logger.info(`[2/4] Injected DeletionPolicy=Retain and UpdateReplacePolicy=Retain.`);
 		if (newBody.length > TEMPLATE_URL_LIMIT) throw new Error(`Modified template is ${newBody.length} bytes, exceeds the CloudFormation UpdateStack TemplateURL limit (${TEMPLATE_URL_LIMIT}). cdkd state has already been written; retire the stack manually with (1) shrink the template, then (2) UpdateStack with Retain policies, (3) DeleteStack — or split the stack and retry.`);
@@ -62967,13 +63084,7 @@ async function retireCloudFormationStack(options) {
 				maxDelay: 10
 			}, { StackName: cfnStackName });
 		} finally {
-			const allCleanups = [...s3Cleanup ? [s3Cleanup] : [], ...nestedCleanups];
-			for (const cleanup of allCleanups) try {
-				await cleanup();
-			} catch (cleanupErr) {
-				const msg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
-				logger.warn(`Failed to delete temporary template upload from '${stateBucket}'. Clean up manually under prefix '${MIGRATE_TMP_PREFIX}/'. Cause: ${msg}`);
-			}
+			await drainTemplateUploads([...s3Cleanup ? [s3Cleanup] : [], ...nestedCleanups], stateBucket, { what: "temporary template upload" });
 		}
 	}
 	logger.info(`[4/4] Deleting CloudFormation stack '${cfnStackName}' (resources retained)...`);
@@ -63284,17 +63395,30 @@ async function walkCfnStackTree(stackName, physicalId, cfnClient) {
 		nested
 	};
 }
+/**
+* The CloudFormation-stack retirement confirmation prompt, reached from
+* `cdkd import --migrate-from-cloudformation` and `cdkd migrate
+* --retire-cfn-stack` (both spell the skip flag `-y` / `--yes`). Its only call
+* site is inside the `if (!yes)` block above, which is what keeps
+* `confirmOrRefuse`'s non-interactive refusal (issue #2275) from firing on a
+* `--yes` run.
+*
+* TWO commands reach it, so the refusal NAMES BOTH. Every other site names one
+* command because it has one; a refusal that named neither would leave a CI
+* user knowing a flag is missing without knowing which invocation to put it
+* on, and `confirmOrRefuse`'s own contract is that the refusal is the only
+* thing that user sees.
+*
+* It also states that cdkd state has ALREADY been written. This prompt is the
+* only one of the nine that fires AFTER its command's state write, so a
+* refusal here leaves a genuine split brain — cdkd claims the resources while
+* the CloudFormation stack is still live — and the operator has to know that
+* before deciding whether to re-run or finish by hand.
+*
+* Exported for unit testing — internal to the command flow otherwise.
+*/
 async function confirmPrompt$6(prompt) {
-	const rl = readline$1.createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const ans = await rl.question(`${prompt} [y/N] `);
-		return /^y(es)?$/i.test(ans.trim());
-	} finally {
-		rl.close();
-	}
+	return confirmOrRefuse(prompt, { refusal: "The CloudFormation stack retirement confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes on whichever command you ran — cdkd import --migrate-from-cloudformation or cdkd migrate --retire-cfn-stack — or run it from a real terminal. NOTE cdkd state has already been written: the resources are recorded in cdkd state while the CloudFormation stack is still live, so re-run with -y / --yes (or retire the stack by hand) to finish the migration." });
 }
 /**
 * Flat `logicalId -> physicalId` map for ONE CloudFormation stack, or `null`
@@ -69335,24 +69459,26 @@ async function runWithConcurrency(tasks, concurrency) {
 	await Promise.all(workers);
 }
 /**
-* Ask the operator to confirm a mutation.
+* `cdkd drift --accept` / `--revert`'s confirmation prompt: ask the operator to
+* confirm a mutation. Both call sites sit inside an `if (!options.yes)` block,
+* which is what keeps `confirmOrRefuse`'s non-interactive refusal (issue
+* #2275) from firing on a `--yes` run.
+*
+* Issue #2230 is why this site passes an explicit `output`: the prompt is
+* written to `out.stream`, not unconditionally to `process.stdout` — under
+* `--json` that stream carries the payload, and a bare `[y/N] ` spliced into
+* it is the same corruption as a status line, so the sink is `process.stderr`
+* there. The prompt is still SHOWN; only its stream changes. See the
+* `HumanTextSink` doc above for why the STREAM (not a closure) is what gets
+* handed to `createInterface`.
 *
-* Issue #2230: the prompt is written to `out.stream`, not unconditionally to
-* `process.stdout` — under `--json` that stream carries the payload, and a
-* bare `[y/N] ` spliced into it is the same corruption as a status line.
-* The prompt is still SHOWN; only its stream changes.
+* Exported for unit testing — internal to the command flow otherwise.
 */
 async function confirmPrompt$5(prompt, out) {
-	const rl = readline$1.createInterface({
-		input: process.stdin,
-		output: out.stream
+	return confirmOrRefuse(prompt, {
+		output: out.stream,
+		refusal: "The cdkd drift confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm, or run the command from a real terminal."
 	});
-	try {
-		const ans = await rl.question(`${prompt} [y/N] `);
-		return /^y(es)?$/i.test(ans.trim());
-	} finally {
-		rl.close();
-	}
 }
 function writeJsonReport(reports) {
 	const payload = reports.map((r) => {
@@ -70083,17 +70209,15 @@ async function emptyBucketAllVersions(s3, bucket) {
 		versionIdMarker = resp.NextVersionIdMarker;
 	} while (keyMarker || versionIdMarker);
 }
+/**
+* `cdkd state migrate`'s confirmation prompt. Its only call site is inside the
+* `if (!options.yes)` block above, which is what keeps `confirmOrRefuse`'s
+* non-interactive refusal (issue #2275) from firing on a `--yes` run.
+*
+* Exported for unit testing — internal to the command flow otherwise.
+*/
 async function confirmPrompt$4(prompt) {
-	const rl = readline$1.createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const ans = await rl.question(`${prompt} [y/N] `);
-		return /^y(es)?$/i.test(ans.trim());
-	} finally {
-		rl.close();
-	}
+	return confirmOrRefuse(prompt, { refusal: "The cdkd state migrate confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm the migration, or run the command from a real terminal." });
 }
 /**
 * Create the `cdkd state migrate` subcommand.
@@ -73705,17 +73829,18 @@ function printNextSteps(args) {
 	}
 	logger.info("");
 }
+/**
+* `cdkd export`'s confirmation prompt, shared by its THREE call sites (the
+* rollback-journal override, the single-stack migration confirm, and the
+* nested-stack tree-wide confirm in `runPerStackImportLoop`). Every one of
+* them sits inside an `if (!options.yes ...)` block, which is what keeps
+* `confirmOrRefuse`'s non-interactive refusal (issue #2275) from firing on a
+* `--yes` run.
+*
+* Exported for unit testing — internal to the export flow otherwise.
+*/
 async function confirmPrompt$3(prompt) {
-	const rl = readline$1.createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const ans = await rl.question(`${prompt} [y/N] `);
-		return /^y(es)?$/i.test(ans.trim());
-	} finally {
-		rl.close();
-	}
+	return confirmOrRefuse(prompt, { refusal: "The cdkd export confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm, or run the command from a real terminal." });
 }
 function createExportCommand() {
 	const cmd = new Command("export").description("Hand a cdkd-managed stack over to CloudFormation via CFn IMPORT (changeset). AWS resources are unchanged; cdkd state for the stack is deleted on success. Mirror of `cdkd import` (AWS → cdkd) in the reverse direction (cdkd → CFn). Accepts JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Aborts if any resource is not CFn-importable.").argument("[stack]", "Stack name to export (auto-detected for single-stack apps)").option("--cfn-stack-name <name>", "Name of the destination CloudFormation stack for the root stack. Defaults to the cdkd stack name (or the cdkd2cfnStackName mapping when the name contains '~'). For per-nested-child overrides, use --cfn-child-stack-name.").option("--cfn-child-stack-name <pair...>", "Per-nested-child CFn stack-name override. Repeatable. Format: '<cdkdName>=<cfnName>' (e.g. --cfn-child-stack-name 'MyApp~Database=my-app-db'). The cdkd stack name for a nested child is '<parent>~<childLogicalId>' (v6 state-key form). Without an override the CFn name is derived by replacing '~' with '-'. Only consulted when the exported stack tree contains nested children; ignored for flat stacks.").option("--template <path>", "Path to a pre-rendered CloudFormation template (JSON or YAML — format auto-detected). Skips synth.").option("--stack-region <region>", "Region of the cdkd state record to operate on. Required when the same stack name has state in multiple regions.").option("--dry-run", "Print the import plan without creating a changeset.", false).option("--accept-transient-context", "Allow CLI -c key=value overrides at export time even though they are not persisted to cdk.json / cdk.context.json (default: refuse). When set, the user is responsible for passing the same -c flags to every future cdk deploy.", false).option("--include-non-importable", "Run a 2-phase migration when the stack contains non-importable resources (Custom::*). Phase 1 imports the importable resources; phase 2 CFn-CREATEs the non-importable ones, which re-invokes each Custom Resource's onCreate handler. Make sure onCreate is idempotent before enabling.", false).option("--parameter <key=value...>", "CFn template Parameter override, repeatable. Required when the synthesized template has Parameters without Default values; otherwise overrides the template's default value. Format: --parameter Key=Value.").option("--strict-cross-stack", "Refuse to export when sibling cdkd stacks in the same CDK app reference the exporting stack via Fn::GetStackOutput. Without the flag, cdkd warns and proceeds — the consumers keep resolving via the CloudFormation fallback (weak reference) unless they deploy with --no-cfn-fallback.", false).option("--skip-import-support-preflight", "Skip the pre-flight that refuses resource types whose CloudFormation registry schema says CFn cannot IMPORT them (no read handler AND NON_PROVISIONABLE), and let CreateChangeSet answer instead. The pre-flight is a registry HEURISTIC, not AWS's supported-for-import list, so this is the escape hatch for a type AWS has since made importable. Expect the changeset to be rejected if the heuristic was right.", false).option("--no-recreate-import-unsupported", "Block instead of auto-handling resource types AWS does NOT support in IMPORT changesets (currently only AWS::ApiGatewayV2::Stage, emitted by CDK HttpApi). Default behavior: cdkd skips these from phase 1, deletes the AWS-side resource between phases, and lets CFn re-CREATE in phase 2 (brief unavailability window). With this flag, the export aborts with a clear error instead.").action(withErrorHandling(exportCommand));
@@ -73739,6 +73864,26 @@ function formatStackRef(ref) {
 	return ref.region ? `${ref.stackName} (${ref.region})` : ref.stackName;
 }
 /**
+* {@link formatStackRef} for a sentence a CONFIRMATION PROMPT renders.
+*
+* Both halves come from an S3 key segment (or, for a legacy record, a state
+* body), so both are attacker-influenced in exactly the way issue #2170 round
+* 4 found for the lock error sixty lines below this helper's callers: a
+* planted `\n` forged a whole line inside that sentence. A forged line in a
+* PROMPT is strictly worse than one in an error, because the sentence it
+* corrupts is the one the operator answers `y` to.
+*
+* `asciiOnly` matches the lock error's own call on these same values — a
+* stack name and an AWS region both have a known charset — and is a no-op on
+* every ordinary input, so the shipped prompt strings are byte-identical.
+* `UNRENDERABLE` stands in when sanitising leaves nothing, since an empty
+* `()` would read as "no region" rather than "a region cdkd will not print".
+*/
+function formatStackRefSafe(ref) {
+	const stack = displaySafe(ref.stackName, { asciiOnly: true }) || "<unrenderable>";
+	return ref.region ? `${stack} (${displaySafe(ref.region, { asciiOnly: true }) || "<unrenderable>"})` : stack;
+}
+/**
 * Resolve a stack name + optional region flag against the `listStacks` index
 * built up front. When a name resolves to multiple regions and the caller
 * didn't pin one, surface a clear error listing the candidates so the user
@@ -73842,7 +73987,7 @@ function sortRefs(refs) {
 async function stateListCommand(options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
-	if (options.json) reserveStdoutForPayload();
+	reserveStdoutForPayload();
 	const setup = await setupStateBackend(options);
 	try {
 		const refs = sortRefs(await setup.stateBackend.listStacks());
@@ -74311,16 +74456,9 @@ async function stateOrphanCommand(stackArgs, options) {
 				}
 			}
 			if (!options.yes && !options.force) {
-				const targetList = targets.map((t) => formatStackRef(t)).join(", ");
+				const targetList = targets.map((t) => formatStackRefSafe(t)).join(", ");
 				process.stdout.write(`\nWARNING: This removes cdkd's state record for [${targetList}] only. AWS resources will NOT be deleted.\nUse 'cdkd destroy ${stackName}' if you want to delete the actual resources.\n\n`);
-				const rl = readline$1.createInterface({
-					input: process.stdin,
-					output: process.stdout
-				});
-				const answer = await rl.question(`Remove state for ${targetList} from s3://${setup.bucket}/${setup.prefix}/? (y/N): `);
-				rl.close();
-				const trimmed = answer.trim().toLowerCase();
-				if (trimmed !== "y" && trimmed !== "yes") {
+				if (!await confirmStateOrphanRemoval(`Remove state for ${targetList} from s3://${setup.bucket}/${setup.prefix}/?`)) {
 					logger.info(`Cancelled removal of state for stack: ${stackName}`);
 					continue;
 				}
@@ -74886,7 +75024,7 @@ async function stateRefreshObservedCommand(stackArgs, options) {
 			}
 		}
 		if (!options.yes && !options.dryRun) {
-			const targetList = targets.map(formatStackRef).join(", ");
+			const targetList = targets.map(formatStackRefSafe).join(", ");
 			if (!await confirmRefresh(`Refresh observedProperties for ${targets.length} stack(s) (${targetList})?`)) {
 				logger.info("Aborted.");
 				return;
@@ -75067,17 +75205,34 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 		});
 	}
 }
-async function confirmRefresh(prompt) {
-	const rl = readline$1.createInterface({
-		input: process.stdin,
-		output: process.stdout
+/**
+* `cdkd state orphan`'s confirmation prompt. Its only call site is inside the
+* `if (!options.yes && !options.force)` block in `stateOrphanCommand`, which
+* is what keeps `confirmOrRefuse`'s non-interactive refusal (issue #2275)
+* from firing on a flagged run.
+*
+* The `(y/N): ` suffix is preserved verbatim from before issue #2275 folded
+* the guard in: it is user-visible output, and only this prompt and
+* `cdkd rollback` ever spelled it that way.
+*
+* Exported for unit testing — internal to the state-orphan flow otherwise.
+*/
+async function confirmStateOrphanRemoval(prompt) {
+	return confirmOrRefuse(prompt, {
+		suffix: " (y/N): ",
+		refusal: "The cdkd state orphan confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes (or -f / --force) to confirm the removal, or run the command from a real terminal."
 	});
-	try {
-		const ans = await rl.question(`${prompt} [y/N] `);
-		return /^y(es)?$/i.test(ans.trim());
-	} finally {
-		rl.close();
-	}
+}
+/**
+* `cdkd state refresh-observed`'s confirmation prompt. Its only call site is
+* inside the `if (!options.yes && !options.dryRun)` block above, which is what
+* keeps `confirmOrRefuse`'s non-interactive refusal (issue #2275) from firing
+* on a `--yes` run.
+*
+* Exported for unit testing — internal to the refresh-observed flow otherwise.
+*/
+async function confirmRefresh(prompt) {
+	return confirmOrRefuse(prompt, { refusal: "The cdkd state refresh-observed confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm the refresh, or run the command from a real terminal." });
 }
 /**
 * Create the `state refresh-observed` subcommand.
@@ -75208,17 +75363,20 @@ function failedActionLabel(item, skipFinalSnapshot) {
 		case "skip-failed-absent": return `  - skip     ${op.logicalId} (${op.resourceType}) — no previous state available`;
 	}
 }
+/**
+* `cdkd rollback`'s confirmation prompt. Exported for unit testing — internal
+* to the rollback flow otherwise, whose only call site is inside the
+* `if (!skipConfirmation)` block below.
+*
+* The `(y/N): ` suffix is preserved verbatim from before issue #2275 folded
+* the non-interactive guard into `confirmOrRefuse`: it is user-visible output,
+* and only this site and `cdkd state orphan` ever spelled it that way.
+*/
 async function confirm(question) {
-	const rl = readline$1.createInterface({
-		input: process.stdin,
-		output: process.stdout
+	return confirmOrRefuse(question, {
+		suffix: " (y/N): ",
+		refusal: "The cdkd rollback confirmation prompt cannot run in a non-interactive environment. Pass --force (or -y / --yes) to confirm the rollback, or run the command from a real terminal."
 	});
-	try {
-		const t = (await rl.question(`${question} (y/N): `)).trim().toLowerCase();
-		return t === "y" || t === "yes";
-	} finally {
-		rl.close();
-	}
 }
 async function rollbackCommand(stackArg, options) {
 	const logger = getLogger();
@@ -77691,17 +77849,16 @@ function stringifyForAudit(value) {
 	if (typeof value === "string") return JSON.stringify(value);
 	return JSON.stringify(value);
 }
+/**
+* `cdkd orphan`'s confirmation prompt. Its only call site is inside the
+* `if (!options.yes && !options.force)` block above, which is what keeps
+* `confirmOrRefuse`'s non-interactive refusal (issue #2275) from firing on a
+* flagged run.
+*
+* Exported for unit testing — internal to the command flow otherwise.
+*/
 async function confirmPrompt$1(prompt) {
-	const rl = readline$1.createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const ans = await rl.question(`${prompt} [y/N] `);
-		return /^y(es)?$/i.test(ans.trim());
-	} finally {
-		rl.close();
-	}
+	return confirmOrRefuse(prompt, { refusal: "The cdkd orphan confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes (or -f / --force) to confirm the orphan, or run the command from a real terminal." });
 }
 /**
 * Create the top-level `cdkd orphan` command.
@@ -78714,17 +78871,15 @@ function formatOutcome(outcome) {
 		case "failed": return "✗";
 	}
 }
+/**
+* `cdkd import`'s confirmation prompt. Its only call site is inside the
+* `if (!options.yes)` block above, which is what keeps `confirmOrRefuse`'s
+* non-interactive refusal (issue #2275) from firing on a `--yes` run.
+*
+* Exported for unit testing — internal to the command flow otherwise.
+*/
 async function confirmPrompt(prompt) {
-	const rl = readline$1.createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const ans = await rl.question(`${prompt} [y/N] `);
-		return /^y(es)?$/i.test(ans.trim());
-	} finally {
-		rl.close();
-	}
+	return confirmOrRefuse(prompt, { refusal: "The cdkd import confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm the state write, or run the command from a real terminal." });
 }
 /**
 * Create the `cdkd import` top-level command.
@@ -89038,4 +89193,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CjlLza5f.js.map
+//# sourceMappingURL=program-CjJoJOIE.js.map