@go-to-k/cdkd 0.285.7 → 0.285.9

package/dist/{program-CjlLza5f.js → program-B9vnKc3N.js}

@@ -1,8 +1,8 @@
-import { $ as DEFAULT_STATE_PREFIX, $n as CFN_TEMPLATE_BODY_LIMIT, $t as maskSecretsInError, A as bold, An as describeAwsFailure, Ar as NestedStackChildDirectDestroyError, At as requireConfigObject, B as secretBearingStateKeyWarning, Bn as Synthesizer, Bt as DiffCalculator, C as unsupportedFinalSnapshotError, Cn as getBootstrapMarkerKey, Cr as DeployCancelledError, Ct as assertRegionMatch, D as isStatefulRecreateTargetSync, Dn as validateAssetBucketName, Dr as LocalStartServiceError, Dt as readConfigString, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as readBootstrapMarkerBody, Er as LocalMigrateError, Et as configStringRefusal, F as yellow, Fn as partitionSensitiveEnv, Fr as StackHasActiveImportsError, Ft as s3BucketDomainName, G as clearOnUpdateRemoval, Gn as resolveAutoAssetStorage, Gr as isThrottlingError, Gt as TemplateParser, H as getCurrentResourceSecrets, Hn as getDefaultStateBucketName, Hr as withErrorHandling, Ht as describeTypeWithThrottleRetry, I as collectDeclaredOutputNames, In as runDockerForeground, Ir as StackTerminationProtectionError, It as s3BucketDualStackDomainName, J as findSilentDropProperties, Jn as resolveStateBucketWithDefault, Jr as markRedactedCause, Jt as TEMPLATE_SOURCED_RULES, K as ProviderRegistry, Kn as resolveCaptureObservedState, Kr as isTransientServerError, Kt as STATE_SOURCED_CROSS_GENERATION_RULES, L as collectPublishedOutputNames, Ln as runDockerStreaming, Lt as s3BucketRegionalDomainName, M as gray, Mn as dockerSpawnEnvWithSensitive, Mr as ProvisioningError, Mt as classifyReplaySecretRegion, N as green, Nn as formatDockerLoginError, Nr as ResourceTimeoutError, Nt as producerRegionsFromState, O as renderStatefulReason, On as validateContainerRepoName, Ot as replayWarn, P as red, Pn as getDockerCmd, Pr as ResourceUpdateNotSupportedError, Pt as s3BucketArn, Q as CUSTOM_RESOURCE_RESPONSE_PREFIX, Qn as warnDeprecatedNoPrefixCliFlag, Qt as isSingleDynamicReferenceToken, R as exportAliasCollisionScrubWarning, Rn as AssetManifestLoader, Rt as s3BucketWebsiteUrl, S as refusesFinalSnapshot, Sn as ensureAssetStorage, St as resolveExplicitPhysicalId, T as extractDeploymentEventError, Tn as parseBootstrapMarker, Tr as LocalInvokeBuildError$1, Tt as configBooleanRefusal, U as IAMRoleProvider, Un as getLegacyStateBucketName, Ur as isMarkedNonRetryable, Ut as withRetry, V as stateKeySecretExposure, Vn as synthesisStatusMessage, Vr as normalizeAwsError, Vt as INTRINSIC_KEYS, W as collectInlinePolicyNamesManagedBySiblings, Wn as resolveApp, Wr as isRetryableTransientError, Wt as DagBuilder, X as maskDeep, Xn as resolveUseCdkBootstrapAssets, Xt as dynamicReferenceTokens, Y as createMaskedRetryLogger, Yn as resolveStateBucketWithDefaultAndSource, Yr as retryClassificationText, Yt as createSecretMasker, Z as maskerOrIdentity, Zn as stateBucketExistenceConfirmed, Zt as errorCauseChain, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as escapeRegExp, _r as setAwsClients, _t as isUnboundTemplateParameter, a as DeploymentEventsStore, an as rebuildClientForBucketRegion, ar as displaySafe, at as CloudControlProvider, b as createPreDeleteFinalSnapshot, bn as BOOTSTRAP_MARKER_PREFIX, bt as WAFv2WebACLProvider, c as replayFailedOperations, cn as importableOutputs, cr as canonicalizeRegion, ct as deleteIndeterminateGuards, d as updatePartialReason, dn as stringifyValue, dr as processStackMessages, dt as isTerminationProtectionPropagationError, en as maskSecretsInText, er as CFN_TEMPLATE_URL_LIMIT, et as beginCommandInterruptScope, f as withResourceDeadline, fn as WorkGraph, ft as IntrinsicFunctionResolver, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as rewriteTemplateAssetReferences, gr as resetAwsClients, gt as getAccountInfo, h as computeImplicitDeleteEdges, hn as loadPublishableAssetManifest, hr as getAwsClients, ht as coerceParameterTypedValue, i as DeploymentEventsReader, in as S3StateBackend, ir as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, it as startInterruptWatch, j as cyan, jn as buildDockerImage, jr as PartialFailureError, jt as requireConfigString, k as formatResourceLine, kn as buildDenyExternalAccessPolicy, kr as MissingCdkCliError, kt as requireConfigArray, l as replayRollback, ln as shouldRetainResource, lr as derivePartitionAndUrlSuffix, lt as deleteSkipReason, m as IMPLICIT_DELETE_DEPENDENCIES, mn as createAssetRedirectResolver, mr as AwsClients, mt as cfnRefValueFromPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as scrubResourceRecord, nr as findLargeInlineResources, nt as interruptWatchListenerCount, o as planFailedOps, on as exportNamesCarriedFrom, or as expectedOwnerParam, ot as slowCcOperationTimeoutMs, p as maskingRetryLogger, pn as buildAssetRedirectMap, pr as resolveBucketRegion, pt as carriesDynamicReference, q as findActionableSilentDrops, qn as resolveSkipPrefix, qr as markNonRetryable, qt as STATE_SOURCED_READBACK_RULES, r as DeployEngine, rn as LockManager, rr as uploadCfnTemplate, rt as isInterruptedWaitError, s as planRollback, sn as importableOutputKeys, sr as PARTITION_TABLE, st as UNSPECIFIED_SKIP_REASON, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as redactSecretsForState, tr as MIGRATE_TMP_PREFIX, tt as endCommandInterruptScope, u as updatePartialMessage, un as AssetPublisher, ur as AssemblyReader, ut as disableInstanceApiTermination, v as buildFinalSnapshotIdentifier, vn as stripControlChars, vt as parameterTypeMayLoseSecretIdentity, w as makeCanonicalizePropertiesFn, wn as isCrossRegionRedirect, wr as DynamicReferenceRegionAmbiguousError, wt as coerceCfnBoolean, x as isFinalSnapshotError, xn as assertAssetBucketRegion, xr as CrossAccountSecretRefusalError, xt as normalizeAwsTagsToCfn, y as ccRoutedFinalSnapshotError, yn as AssetModeResolver, yr as CdkdError, yt as refStateLookupFromResource, z as isExportAliasCollision, zn as getDockerImageBySourceHash, zt as applyRoleArnIfSet } from "./deploy-engine-DmWPwiyQ.js";
-import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-DyTk5GeO.js";
+import { $ as DEFAULT_STATE_PREFIX, $n as resolveUseCdkBootstrapAssets, $t as isSingleDynamicReferenceToken, A as bold, An as validateAssetBucketName, Ar as LocalStartServiceError, At as requireConfigObject, B as secretBearingStateKeyWarning, Bn as runDockerStreaming, Bt as DiffCalculator, C as unsupportedFinalSnapshotError, Cn as BOOTSTRAP_MARKER_PREFIX, Ct as assertRegionMatch, D as isStatefulRecreateTargetSync, Dn as isCrossRegionRedirect, Dr as DynamicReferenceRegionAmbiguousError, Dt as readConfigString, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as getBootstrapMarkerKey, Er as DeployCancelledError, Et as configStringRefusal, F as yellow, Fn as dockerSpawnEnvWithSensitive, Fr as ProvisioningError, Ft as s3BucketDomainName, G as clearOnUpdateRemoval, Gn as getDefaultStateBucketName, Gr as withErrorHandling, Gt as TemplateParser, H as getCurrentResourceSecrets, Hn as getDockerImageBySourceHash, Ht as describeTypeWithThrottleRetry, I as collectDeclaredOutputNames, In as formatDockerLoginError, Ir as ResourceTimeoutError, It as s3BucketDualStackDomainName, J as findSilentDropProperties, Jn as resolveAutoAssetStorage, Jr as isThrottlingError, Jt as TEMPLATE_SOURCED_RULES, K as ProviderRegistry, Kn as getLegacyStateBucketName, Kr as isMarkedNonRetryable, Kt as STATE_SOURCED_CROSS_GENERATION_RULES, L as collectPublishedOutputNames, Ln as getDockerCmd, Lr as ResourceUpdateNotSupportedError, Lt as s3BucketRegionalDomainName, M as gray, Mn as buildDenyExternalAccessPolicy, Mr as MissingCdkCliError, Mt as classifyReplaySecretRegion, N as green, Nn as describeAwsFailure, Nr as NestedStackChildDirectDestroyError, Nt as producerRegionsFromState, O as renderStatefulReason, On as parseBootstrapMarker, Or as LocalInvokeBuildError$1, Ot as replayWarn, P as red, Pn as buildDockerImage, Pr as PartialFailureError, Pt as s3BucketArn, Q as CUSTOM_RESOURCE_RESPONSE_PREFIX, Qn as resolveStateBucketWithDefaultAndSource, Qr as retryClassificationText, Qt as errorCauseChain, R as exportAliasCollisionScrubWarning, Rn as partitionSensitiveEnv, Rr as StackHasActiveImportsError, Rt as s3BucketWebsiteUrl, S as refusesFinalSnapshot, Sn as AssetModeResolver, Sr as CdkdError, St as resolveExplicitPhysicalId, T as extractDeploymentEventError, Tn as ensureAssetStorage, Tt as configBooleanRefusal, U as IAMRoleProvider, Un as Synthesizer, Ut as withRetry, V as stateKeySecretExposure, Vn as AssetManifestLoader, Vt as INTRINSIC_KEYS, W as collectInlinePolicyNamesManagedBySiblings, Wn as synthesisStatusMessage, Wr as normalizeAwsError, Wt as DagBuilder, X as maskDeep, Xn as resolveSkipPrefix, Xr as markNonRetryable, Xt as createSecretMasker, Y as createMaskedRetryLogger, Yn as resolveCaptureObservedState, Yr as isTransientServerError, Yt as carriesSecretMask, Z as maskerOrIdentity, Zn as resolveStateBucketWithDefault, Zr as markRedactedCause, Zt as dynamicReferenceTokens, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as createAssetRedirectResolver, _r as AwsClients, _t as isUnboundTemplateParameter, a as DeploymentEventsStore, an as scrubResourceRecord, ar as findLargeInlineResources, at as CloudControlProvider, b as createPreDeleteFinalSnapshot, bn as escapeRegExp, br as setAwsClients, bt as WAFv2WebACLProvider, c as replayFailedOperations, cn as rebuildClientForBucketRegion, cr as displaySafe, ct as deleteIndeterminateGuards, d as updatePartialReason, dn as importableOutputs, dr as canonicalizeRegion, dt as isTerminationProtectionPropagationError, en as maskSecretsInError, er as stateBucketExistenceConfirmed, et as beginCommandInterruptScope, f as withResourceDeadline, fn as shouldRetainResource, fr as derivePartitionAndUrlSuffix, ft as IntrinsicFunctionResolver, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as buildAssetRedirectMap, gr as resolveBucketRegion, gt as getAccountInfo, h as computeImplicitDeleteEdges, hn as WorkGraph, ht as coerceParameterTypedValue, i as DeploymentEventsReader, in as redactSecretsForState, ir as MIGRATE_TMP_PREFIX, it as startInterruptWatch, j as cyan, jn as validateContainerRepoName, jt as requireConfigString, k as formatResourceLine, kn as readBootstrapMarkerBody, kr as LocalMigrateError, kt as requireConfigArray, l as replayRollback, ln as exportNamesCarriedFrom, lr as expectedOwnerParam, lt as deleteSkipReason, m as IMPLICIT_DELETE_DEPENDENCIES, mn as stringifyValue, mr as processStackMessages, mt as cfnRefValueFromPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as recordMaskOnlyValue, nr as CFN_TEMPLATE_BODY_LIMIT, nt as interruptWatchListenerCount, o as planFailedOps, on as LockManager, or as uploadCfnTemplate, ot as slowCcOperationTimeoutMs, p as maskingRetryLogger, pn as AssetPublisher, pr as AssemblyReader, pt as carriesDynamicReference, q as findActionableSilentDrops, qn as resolveApp, qr as isRetryableTransientError, qt as STATE_SOURCED_READBACK_RULES, r as DeployEngine, rn as recoverMaskedOutput, rr as CFN_TEMPLATE_URL_LIMIT, rt as isInterruptedWaitError, s as planRollback, sn as S3StateBackend, sr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, st as UNSPECIFIED_SKIP_REASON, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as maskSecretsInText, tr as warnDeprecatedNoPrefixCliFlag, tt as endCommandInterruptScope, u as updatePartialMessage, un as importableOutputKeys, ur as PARTITION_TABLE, ut as disableInstanceApiTermination, v as buildFinalSnapshotIdentifier, vn as loadPublishableAssetManifest, vr as getAwsClients, vt as parameterTypeMayLoseSecretIdentity, w as makeCanonicalizePropertiesFn, wn as assertAssetBucketRegion, wr as CrossAccountSecretRefusalError, wt as coerceCfnBoolean, x as isFinalSnapshotError, xn as stripControlChars, xt as normalizeAwsTagsToCfn, y as ccRoutedFinalSnapshotError, yn as rewriteTemplateAssetReferences, yr as resetAwsClients, yt as refStateLookupFromResource, z as isExportAliasCollision, zn as runDockerForeground, zr as StackTerminationProtectionError, zt as applyRoleArnIfSet } from "./deploy-engine-BhBR2d3w.js";
+import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-DlUEyyGa.js";
-import { t as ASGProvider } from "./asg-provider-B1EEjygi.js";
+import { t as getCdkdVersion } from "./version-BWsyP2sq.js";
+import { t as ASGProvider } from "./asg-provider-hNkWDuAJ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2675,14 +2675,32 @@ async function promptRecreateConfirm(input) {
 //#endregion
 //#region src/cli/commands/confirm-prompt.ts
 /**
-* Default-YES confirmation prompt (`[Y/n]`, empty input = yes). Used by the
-* issue #1007 asset-storage auto-create on interactive TTY deploys without
-* `--yes`. Kept in its own module (mirrors `recreate-confirm-prompt.ts`) so
-* the accept/decline parsing is unit-testable without importing the whole
-* deploy command.
+* The CLI's two shared confirmation-prompt helpers.
+*
+* They have OPPOSITE defaults and opposite non-interactive behaviour, which is
+* why both live here rather than one being expressed in terms of the other:
+*
+*  - {@link promptYesNo} — default-YES (`[Y/n]`, empty input accepts). Used by
+*    the issue #1007 asset-storage auto-create on interactive TTY deploys
+*    without `--yes`. It deliberately carries NO non-interactive guard: its
+*    only caller (`deploy.ts`, at the `options.yes || !process.stdin.isTTY`
+*    short-circuit) never reaches it on a non-TTY stdin, and a deploy that
+*    assumes "yes" is the one place in the CLI where auto-confirming is the
+*    documented choice.
+*  - {@link confirmOrRefuse} — default-NO (`[y/N]`), and REFUSES outright on a
+*    non-interactive stdin. This is the one every MUTATING command uses.
+*
+* Kept in its own module (mirrors `recreate-confirm-prompt.ts`) so the
+* accept/decline parsing is unit-testable without importing whole command
+* files.
+*/
+/**
+* Default-YES confirmation prompt (`[Y/n]`, empty input = yes).
+*
+* See the module doc for why this one is deliberately unguarded.
 */
 async function promptYesNo(prompt) {
-	const rl = readline.createInterface({
+	const rl = readline$1.createInterface({
 		input: process.stdin,
 		output: process.stdout
 	});
@@ -2693,6 +2711,79 @@ async function promptYesNo(prompt) {
 		rl.close();
 	}
 }
+/** Suffix appended to a {@link confirmOrRefuse} prompt when none is given. */
+const DEFAULT_CONFIRM_SUFFIX = " [y/N] ";
+/**
+* Default-NO confirmation prompt that REFUSES a non-interactive run instead of
+* hanging on it (issue #2275, the class issue #2259 fixed for `cdkd destroy`).
+*
+* `rl.question` never settles when stdin is already at EOF, and EOF delivers
+* no signal, so nothing wakes it: a command that prompts without this guard
+* parks FOREVER in CI rather than failing, burning the job's whole timeout
+* budget. Measured on Node 24.15.0, the version `.node-version` pins, against
+* real `node:readline/promises`: `echo y |` resolves `"y"`, while both
+* `printf 'y' |` (a real answer with no trailing newline) and `< /dev/null`
+* stay pending indefinitely.
+*
+* REFUSE rather than auto-confirm, at every one of the nine sites this helper
+* replaced. Every one of them guards a MUTATION — a rollback replay, a state
+* record removal, an observed-property refresh, an orphan, an import, an
+* export-then-delete-state, a drift accept/revert, a CloudFormation stack
+* retirement, a state-bucket migration — so silently answering "yes" on
+* behalf of an absent operator is never the safe reading. `deploy.ts`'s
+* auto-confirm (`options.yes || !process.stdin.isTTY` -> proceed) stays the
+* deliberate exception, because a deploy that assumes "yes" is recoverable.
+*
+* A first cut of this guard (in `state.ts`, see the long comment at the
+* `state destroy --all` prompt) raced the question against readline's `close`
+* event and turned EOF into a decline. That lost three measured ways — a real
+* answer with no trailing newline was silently discarded, a delayed answer
+* lost the race, and an interactive Ctrl-C landed on the EOF arm — so do not
+* reintroduce it. A refusal has none of those.
+*
+* POSITION IS LOAD-BEARING, and this helper gets it for free: every call site
+* sits INSIDE the caller's `--yes` / `--force` short-circuit
+* (`if (!options.yes && !options.force) { ... }`), so a flagged
+* non-interactive run never reaches this function and never consults stdin at
+* all. Keep it that way — hoisting a call above its flag check would make
+* `--yes` refuse instead of proceed, which is the inverse bug.
+*
+* Throws {@link CdkdError} with the `NON_INTERACTIVE_CONFIRM` code, matching
+* `gc.ts` and `bootstrap-destroy.ts` — the only two of the five originally
+* guarded prompts that carry a code (the other three throw a bare `Error` or
+* a `LocalMigrateError`). `handleError` maps it to exit 1, so CI can branch on
+* it.
+*
+* TWO GUARDED PROMPTS DELIBERATELY DO NOT ROUTE THROUGH HERE:
+* `destroy-runner.ts`'s per-stack prompt (the issue #2259 fix) and
+* `state.ts`'s `state destroy --all` batch prompt (issue #2247). Both already
+* carry this exact guard inline, and both differ in ways a shared helper would
+* have to grow parameters for — `destroy-runner.ts` has a default-YES bare
+* form alongside a default-NO `--remove-protection` form, and `state.ts`
+* passes an abort `signal` for the issue #2117 Ctrl-C handling. Folding them
+* in would also drag `destroy-runner.ts` (in the `integ-destroy` AND
+* `integ-broad` gate scopes) into a pure refactor's blast radius, buying a
+* real-AWS run for no behaviour change. The other five pre-existing guarded
+* prompts (`gc.ts`, `bootstrap-destroy.ts`, `recreate-confirm-prompt.ts`,
+* `prefix-migration-check.ts`, `migrate-command.ts`) stay put for the same
+* reason: each guards its own flow with its own error type.
+*
+* @param prompt the question, WITHOUT its trailing `[y/N]` marker
+* @returns `true` only for `y` / `yes` (any case, trimmed)
+*/
+async function confirmOrRefuse(prompt, options) {
+	if (process.stdin.isTTY !== true) throw new CdkdError(options.refusal, "NON_INTERACTIVE_CONFIRM");
+	const rl = readline$1.createInterface({
+		input: process.stdin,
+		output: options.output ?? process.stdout
+	});
+	try {
+		const ans = await rl.question(`${prompt}${options.suffix ?? " [y/N] "}`);
+		return /^y(es)?$/i.test(ans.trim());
+	} finally {
+		rl.close();
+	}
+}
 
 //#endregion
 //#region src/cli/commands/deployment-events-run.ts
@@ -60556,10 +60647,11 @@ var NestedStackProvider = class {
 		const resourceCount = Object.keys(childTemplate.Resources ?? {}).length;
 		this.logger.info(`Deploying nested stack ${childStackName} (logicalId=${logicalId}, ${resourceCount} resource(s))`);
 		await this.runChildDeploy(ctx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates);
-		const attributes = await this.readChildOutputsAsAttributes(ctx, childStackName, childRegion);
+		const childOutputs = await this.readChildOutputsAsAttributes(ctx, childStackName, childRegion);
 		return {
 			physicalId: this.synthesizeArn(ctx.accountId, childRegion, ctx.parentStackName, logicalId),
-			attributes
+			attributes: childOutputs.attributes,
+			...childOutputs.noEchoAttributeNames.length > 0 && { noEchoAttributeNames: childOutputs.noEchoAttributeNames }
 		};
 	}
 	async update(logicalId, physicalId, _resourceType, properties, _previousProperties) {
@@ -60575,10 +60667,12 @@ var NestedStackProvider = class {
 		const resourceCount = Object.keys(childTemplate.Resources ?? {}).length;
 		this.logger.info(`Updating nested stack ${childStackName} (logicalId=${logicalId}, ${resourceCount} resource(s))`);
 		await this.runChildDeploy(ctx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates);
+		const updatedOutputs = await this.readChildOutputsAsAttributes(ctx, childStackName, childRegion);
 		return {
 			physicalId,
 			wasReplaced: false,
-			attributes: await this.readChildOutputsAsAttributes(ctx, childStackName, childRegion)
+			attributes: updatedOutputs.attributes,
+			...updatedOutputs.noEchoAttributeNames.length > 0 && { noEchoAttributeNames: updatedOutputs.noEchoAttributeNames }
 		};
 	}
 	async delete(logicalId, _physicalId, _resourceType, _properties, deleteContext) {
@@ -60651,10 +60745,50 @@ var NestedStackProvider = class {
 			nestedTemplates: grandchildTemplates
 		}, () => childEngine.deploy(childStackName, childTemplate));
 	}
+	/**
+	* The child's outputs, as `Outputs.<Key>` attributes for the parent's
+	* `Fn::GetAtt` — plus the subset whose plaintext this run had to RECOVER
+	* (issue [#2274](https://github.com/go-to-k/cdkd/issues/2274)).
+	*
+	* WHY THE RECOVERY IS HERE. This method reads the child's PERSISTED state,
+	* and since #2274 an output whose value resolved a `NoEcho` custom resource's
+	* `Data` is persisted as the redaction mask. Handing the parent `***` would
+	* make the FIRST deploy of any such parent refuse — a template that deployed
+	* before the feature — so where the child engine masked that output moments
+	* ago IN THIS PROCESS, the plaintext is still available (see
+	* `recoverMaskedOutput`) and is what the parent gets. The reported names are
+	* what tells the deploy engine to re-register those values as MASK-ONLY
+	* needles, so the parent's own record and every parent resource that consumes
+	* one still persist `***`.
+	*
+	* PER ATTRIBUTE, not for the bag: a child typically exports one sensitive
+	* output among several ordinary ones, and declaring the whole bag would mask
+	* every unrelated output into the parent's state and into any parent resource
+	* that reads one.
+	*
+	* A mask this run did NOT produce (the child was deployed by an earlier run
+	* and its custom resource was `NO_CHANGE`, so no handler ran) is left as the
+	* mask, and the resolver refuses the consumer rather than writing `***` to
+	* AWS. That refusal is the feature's stated cost; recovering here removes it
+	* for the in-run case only.
+	*/
 	async readChildOutputsAsAttributes(ctx, childStackName, childRegion) {
 		const childStateData = await ctx.stateBackend.getState(childStackName, childRegion);
 		if (!childStateData) throw new Error(`Child stack state '${childStackName}' not found after deploy — NestedStackProvider invariant violated.`);
-		return this.buildOutputsAttributes(childStateData.state.outputs ?? {});
+		const attributes = this.buildOutputsAttributes(childStateData.state.outputs ?? {});
+		const noEchoAttributeNames = [];
+		for (const [outputKey, persisted] of Object.entries(childStateData.state.outputs ?? {})) {
+			if (!carriesSecretMask(persisted)) continue;
+			const recovered = recoverMaskedOutput(childStackName, childRegion, outputKey);
+			if (recovered === void 0) continue;
+			const attributeName = this.outputAttributeName(outputKey);
+			attributes[attributeName] = recovered;
+			noEchoAttributeNames.push(attributeName);
+		}
+		return {
+			attributes,
+			noEchoAttributeNames
+		};
 	}
 	requireContext() {
 		const ctx = getCurrentNestedStackContext();
@@ -60777,9 +60911,17 @@ var NestedStackProvider = class {
 	* make EVERY consumer persist it — but the count is "one resolution path",
 	* not "one reader".
 	*/
+	/**
+	* The ONE spelling of a child output's attribute name. Both this class's
+	* writers go through it, so the recovery pass (issue #2274) cannot name a key
+	* `buildOutputsAttributes` did not write.
+	*/
+	outputAttributeName(outputKey) {
+		return `Outputs.${outputKey}`;
+	}
 	buildOutputsAttributes(outputs) {
 		const attributes = {};
-		for (const [key, value] of Object.entries(outputs)) attributes[`Outputs.${key}`] = value;
+		for (const [key, value] of Object.entries(outputs)) attributes[this.outputAttributeName(key)] = value;
 		return attributes;
 	}
 };
@@ -62830,6 +62972,36 @@ const TEMPLATE_BODY_LIMIT = CFN_TEMPLATE_BODY_LIMIT;
 */
 const TEMPLATE_URL_LIMIT = CFN_TEMPLATE_URL_LIMIT;
 /**
+* Best-effort reaper for the transient template bodies this flow uploads to
+* the state bucket under `cdkd-migrate-tmp/`.
+*
+* ONE implementation because {@link retireCloudFormationStack} drains from
+* four different exits — the recursive walk's `catch`, the confirmation
+* gate's decline AND its non-interactive refusal, the no-modification fast
+* path, and the post-`UpdateStack` `finally`. Each used to carry its own copy
+* of this loop, and the copies were how the refusal exit came to have none at
+* all: a `throw` from the gate passes every one of the other three.
+*
+* Best-effort by design. A leaked transient object costs pennies and lives
+* under an explicitly-named prefix, while a failed DELETE that propagated
+* would turn a successful retire into a reported failure. The retire's
+* success is governed by CloudFormation, not by S3 — so each cleanup's own
+* error becomes a `warn` naming the prefix to sweep manually.
+*
+* `what` / `when` keep the four sites' distinct wording (a caller says
+* whether these are the parent's own upload or a nested child's, and whether
+* it is unwinding); the SENTENCE they sit in is shared.
+*/
+async function drainTemplateUploads(cleanups, stateBucket, labels) {
+	const logger = getLogger();
+	for (const cleanup of cleanups) try {
+		await cleanup();
+	} catch (cleanupErr) {
+		const msg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
+		logger.warn(`Failed to delete ${labels.what} from '${stateBucket}'${labels.when ? ` ${labels.when}` : ""}. Clean up manually under prefix '${MIGRATE_TMP_PREFIX}/'. Cause: ${msg}`);
+	}
+}
+/**
 * Retire a CloudFormation stack whose resources have just been adopted into
 * cdkd state. The 4-step procedure is the one AWS recommends for handing
 * over resources between management tools without deleting them:
@@ -62893,35 +63065,31 @@ async function retireCloudFormationStack(options) {
 			format = recursive.format;
 			nestedCleanups.push(...recursive.cleanups);
 		} catch (err) {
-			if (err instanceof RecursiveRetainInjectionError) for (const cleanup of err.cleanups) try {
-				await cleanup();
-			} catch (cleanupErr) {
-				const msg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
-				logger.warn(`Failed to delete partial nested-template upload from '${stateBucket}' during error recovery. Clean up manually under prefix '${MIGRATE_TMP_PREFIX}/'. Cause: ${msg}`);
-			}
+			if (err instanceof RecursiveRetainInjectionError) await drainTemplateUploads(err.cleanups, stateBucket, {
+				what: "partial nested-template upload",
+				when: "during error recovery"
+			});
 			throw err;
 		}
 	} else ({body: newBody, modified, format} = injectRetainPolicies(tpl.TemplateBody, cfnStackName));
 	if (!yes) {
-		if (!await confirmPrompt$6(`Set DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource in CloudFormation stack '${cfnStackName}', then delete the stack? AWS resources will NOT be deleted (cdkd state has been written).`)) {
+		let proceed = false;
+		try {
+			proceed = await confirmPrompt$6(`Set DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource in CloudFormation stack '${cfnStackName}', then delete the stack? AWS resources will NOT be deleted (cdkd state has been written).`);
+		} finally {
+			if (!proceed) await drainTemplateUploads(nestedCleanups, stateBucket, {
+				what: "temporary nested-template upload",
+				when: "during cancel cleanup"
+			});
+		}
+		if (!proceed) {
 			logger.info("CloudFormation stack retirement cancelled. cdkd state is unaffected.");
-			for (const cleanup of nestedCleanups) try {
-				await cleanup();
-			} catch (cleanupErr) {
-				const msg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
-				logger.warn(`Failed to delete temporary nested-template upload from '${stateBucket}' during cancel cleanup. Clean up manually under prefix '${MIGRATE_TMP_PREFIX}/'. Cause: ${msg}`);
-			}
 			return { outcome: "cancelled" };
 		}
 	}
 	if (!modified) {
 		logger.info(`[2/4] Template already has Retain on every resource — skipping UpdateStack.`);
-		if (nestedCleanups.length > 0) for (const cleanup of nestedCleanups) try {
-			await cleanup();
-		} catch (cleanupErr) {
-			const msg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
-			logger.warn(`Failed to delete temporary nested-template upload from '${stateBucket}'. Clean up manually under prefix '${MIGRATE_TMP_PREFIX}/'. Cause: ${msg}`);
-		}
+		await drainTemplateUploads(nestedCleanups, stateBucket, { what: "temporary nested-template upload" });
 	} else {
 		logger.info(`[2/4] Injected DeletionPolicy=Retain and UpdateReplacePolicy=Retain.`);
 		if (newBody.length > TEMPLATE_URL_LIMIT) throw new Error(`Modified template is ${newBody.length} bytes, exceeds the CloudFormation UpdateStack TemplateURL limit (${TEMPLATE_URL_LIMIT}). cdkd state has already been written; retire the stack manually with (1) shrink the template, then (2) UpdateStack with Retain policies, (3) DeleteStack — or split the stack and retry.`);
@@ -62967,13 +63135,7 @@ async function retireCloudFormationStack(options) {
 				maxDelay: 10
 			}, { StackName: cfnStackName });
 		} finally {
-			const allCleanups = [...s3Cleanup ? [s3Cleanup] : [], ...nestedCleanups];
-			for (const cleanup of allCleanups) try {
-				await cleanup();
-			} catch (cleanupErr) {
-				const msg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
-				logger.warn(`Failed to delete temporary template upload from '${stateBucket}'. Clean up manually under prefix '${MIGRATE_TMP_PREFIX}/'. Cause: ${msg}`);
-			}
+			await drainTemplateUploads([...s3Cleanup ? [s3Cleanup] : [], ...nestedCleanups], stateBucket, { what: "temporary template upload" });
 		}
 	}
 	logger.info(`[4/4] Deleting CloudFormation stack '${cfnStackName}' (resources retained)...`);
@@ -63284,17 +63446,30 @@ async function walkCfnStackTree(stackName, physicalId, cfnClient) {
 		nested
 	};
 }
+/**
+* The CloudFormation-stack retirement confirmation prompt, reached from
+* `cdkd import --migrate-from-cloudformation` and `cdkd migrate
+* --retire-cfn-stack` (both spell the skip flag `-y` / `--yes`). Its only call
+* site is inside the `if (!yes)` block above, which is what keeps
+* `confirmOrRefuse`'s non-interactive refusal (issue #2275) from firing on a
+* `--yes` run.
+*
+* TWO commands reach it, so the refusal NAMES BOTH. Every other site names one
+* command because it has one; a refusal that named neither would leave a CI
+* user knowing a flag is missing without knowing which invocation to put it
+* on, and `confirmOrRefuse`'s own contract is that the refusal is the only
+* thing that user sees.
+*
+* It also states that cdkd state has ALREADY been written. This prompt is the
+* only one of the nine that fires AFTER its command's state write, so a
+* refusal here leaves a genuine split brain — cdkd claims the resources while
+* the CloudFormation stack is still live — and the operator has to know that
+* before deciding whether to re-run or finish by hand.
+*
+* Exported for unit testing — internal to the command flow otherwise.
+*/
 async function confirmPrompt$6(prompt) {
-	const rl = readline$1.createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const ans = await rl.question(`${prompt} [y/N] `);
-		return /^y(es)?$/i.test(ans.trim());
-	} finally {
-		rl.close();
-	}
+	return confirmOrRefuse(prompt, { refusal: "The CloudFormation stack retirement confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes on whichever command you ran — cdkd import --migrate-from-cloudformation or cdkd migrate --retire-cfn-stack — or run it from a real terminal. NOTE cdkd state has already been written: the resources are recorded in cdkd state while the CloudFormation stack is still live, so re-run with -y / --yes (or retire the stack by hand) to finish the migration." });
 }
 /**
 * Flat `logicalId -> physicalId` map for ONE CloudFormation stack, or `null`
@@ -67724,6 +67899,37 @@ function collectDynamicReferencePaths(value, into, path = "") {
 	if (value !== null && typeof value === "object") for (const [k, v] of Object.entries(value)) collectDynamicReferencePaths(v, into, path === "" ? k : `${path}.${k}`);
 }
 /**
+* Record the dotted path of every leaf that IS {@link SECRET_MASK} — the
+* mask-only twin of {@link collectDynamicReferencePaths} (issue
+* [#2274](https://github.com/go-to-k/cdkd/issues/2274)).
+*
+* WITHOUT IT A NESTED MASK IS INVISIBLE, and that is a live disclosure rather
+* than a tidiness gap. `calculateResourceDrift` deliberately does not descend
+* arrays, so a masked leaf at `ContainerDefinitions.0.Environment.0.Value`
+* surfaces as ONE change at path `ContainerDefinitions` whose `stateValue` is
+* the WHOLE ARRAY — never equal to the mask. A whole-value equality test
+* therefore answers `false`, `secretBearing` stays false, the LIVE plaintext is
+* printed by the report, and `--accept` writes it into `state.json`, undoing
+* exactly the redaction this feature exists to perform.
+*
+* The expression class already answers this, and answers it this way: paths go
+* in at the LEAF's own coordinate and {@link isSecretBearingPath} bridges to the
+* comparator's coarser one by matching ANCESTORS. Seeded off the state bags,
+* exactly like the offline dynamic-reference seed, because a mask is a fact
+* about the RECORD and needs no AWS call to see.
+*/
+function collectSecretMaskPaths(value, into, path = "") {
+	if (typeof value === "string") {
+		if (value === "***") into.add(path);
+		return;
+	}
+	if (Array.isArray(value)) {
+		value.forEach((item, i) => collectSecretMaskPaths(item, into, path === "" ? String(i) : `${path}.${i}`));
+		return;
+	}
+	if (value !== null && typeof value === "object") for (const [k, v] of Object.entries(value)) collectSecretMaskPaths(v, into, path === "" ? k : `${path}.${k}`);
+}
+/**
 * The drift command's resolvers for ONE stack: the stack's own, plus one pinned
 * sibling per FOREIGN region an ARN-named reference asks for (issue
 * [#2108](https://github.com/go-to-k/cdkd/issues/2108)).
@@ -68093,7 +68299,7 @@ function redactDriftValue(value, secrets, secretBearing) {
 * cannot disagree — a `--dry-run` that promises a write the real run refuses is
 * worse than either behaviour on its own.
 *
-* Two refusals, both about a value cdkd could not identify rather than about
+* Three refusals, all about a value cdkd could not identify rather than about
 * secrecy as such:
 *
 * - A masked VALUE says AWS holds something at a known-secret path that is not
@@ -68103,6 +68309,10 @@ function redactDriftValue(value, secrets, secretBearing) {
 *   `setAtPath` would then create a key literally named `***` — and when
 *   `awsValue` is `undefined` it would INSERT that key rather than removing the
 *   real one, so the value check alone does not cover it.
+* - A masked BASELINE (issue #2274) says the state side itself is the mask —
+*   a `NoEcho` custom resource's `Data` redacted out of `state.json`. Accepting
+*   would write the live plaintext over a deliberate redaction, which is the
+*   opposite of what the mask is for.
 *
 * The path check is what makes the value exemptions safe: `redactDriftValue`
 * lets `undefined` / `null` / a whole expression through unmasked, which is
@@ -68112,6 +68322,7 @@ function acceptRefusalReason(change, maskedPaths) {
 	if (!maskedPaths.has(change.path)) return void 0;
 	if (change.path.includes("***")) return "its property NAME came back carrying a secret value, so cdkd cannot name the key to write — and no redaction pass can clear it either, since they all walk values and never keys. ROTATE the secret; that is the only remedy";
 	if (change.awsValue === void 0) return "AWS no longer reports it, and accepting an absence DELETES the key — which at or above a secret dynamic reference would erase the reference out of cdkd state. Use --revert to push it back, or re-deploy";
+	if (change.stateValue === "***") return "cdkd does not know the value that belongs at this position — the baseline holds only the redaction mask, so accepting would write AWS-held plaintext over a deliberate redaction. Re-deploy to refresh it";
 	return "it carries a secret dynamic reference and the value AWS currently holds is not the one the reference resolves to";
 }
 /**
@@ -68139,8 +68350,8 @@ function acceptRefusalReason(change, maskedPaths) {
 *
 * Returns the input array by identity when there is nothing to act on.
 */
-function redactDriftChanges(changes, secrets, secretPaths) {
-	if (secrets.size === 0 && secretPaths.size === 0) return {
+function redactDriftChanges(changes, secrets, secretPaths, maskPaths) {
+	if (secrets.size === 0 && secretPaths.size === 0 && maskPaths.size === 0 && !changes.some((change) => carriesSecretMask(change.stateValue))) return {
 		changes,
 		maskedPaths: /* @__PURE__ */ new Set()
 	};
@@ -68148,9 +68359,10 @@ function redactDriftChanges(changes, secrets, secretPaths) {
 	const redacted = [];
 	for (const change of changes) {
 		const maskedPath = maskSecretsInText(change.path, secrets);
-		const positionIsSecret = isSecretBearingPath(change.path, secretPaths);
+		const positionIsSecret = isSecretBearingPath(change.path, secretPaths) || isSecretBearingPath(change.path, maskPaths);
 		const nameCarriesSecret = maskedPath !== change.path;
-		const secretBearing = positionIsSecret || nameCarriesSecret;
+		const stateValueIsMask = carriesSecretMask(change.stateValue);
+		const secretBearing = positionIsSecret || nameCarriesSecret || stateValueIsMask;
 		if (secretPaths.has(change.path) && change.awsValue === void 0) continue;
 		const stateValue = redactDriftValue(change.stateValue, secrets, secretBearing);
 		const awsValue = redactDriftValue(change.awsValue, secrets, secretBearing);
@@ -68247,6 +68459,9 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				const seededSecretPaths = /* @__PURE__ */ new Set();
 				collectDynamicReferencePaths(baseline, seededSecretPaths);
 				if (useObserved) collectDynamicReferencePaths(resource.properties ?? {}, seededSecretPaths);
+				const maskSecretPaths = /* @__PURE__ */ new Set();
+				collectSecretMaskPaths(baseline, maskSecretPaths);
+				if (useObserved) collectSecretMaskPaths(resource.properties ?? {}, maskSecretPaths);
 				const unresolvedTokens = /* @__PURE__ */ new Set();
 				const noteUnresolved = (tokens) => {
 					for (const token of tokens) unresolvedTokens.add(token);
@@ -68287,7 +68502,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 					ignorePaths: observedIgnorePaths.length ? [...ignorePaths, ...observedIgnorePaths] : ignorePaths,
 					unionWalkObjects: useObserved,
 					unorderedPaths
-				}), secrets, secretResolutionFailed ? seededSecretPaths : secretPaths);
+				}), secrets, secretResolutionFailed ? seededSecretPaths : secretPaths, maskSecretPaths);
 				const notComparedCause = secretResolutionFailed ? "refused" : unresolvedTokens.size > 0 ? "unresolvedToken" : void 0;
 				if (reported.changes.length === 0) if (notComparedCause !== void 0) outcomes.push({
 					kind: "notCompared",
@@ -68889,6 +69104,101 @@ function preserveLiveValuesAtUnresolvedTokens(send, awsProperties, secrets) {
 	return walk(send, awsProperties);
 }
 /**
+* Keep `cdkd drift --revert` from pushing a REDACTION MASK to AWS (issue
+* [#2274](https://github.com/go-to-k/cdkd/issues/2274)).
+*
+* WHY THIS EXISTS AT ALL. A `NoEcho` custom resource's `Data` resolved into a
+* dependent's property is persisted as {@link SECRET_MASK}, because there is no
+* expression to store in its place. `--revert` pushes the BASELINE to AWS, so
+* without this a revert triggered by a SIBLING key would write the literal
+* `***` onto the live SSM parameter / secret / env var — the issue #1498 /
+* #1501 data-corruption class, and strictly worse than the disclosure the mask
+* exists to prevent. Shipping the mask without this guard would trade one for
+* the other.
+*
+* The sibling of {@link preserveLiveValuesAtUnresolvedTokens} and deliberately
+* a SEPARATE function rather than another branch inside it. That one is gated
+* on `unresolvedTokens.size > 0` at its call site, and this hazard is decided
+* by the SEND bag alone — a resource can carry a mask with no unresolved token
+* anywhere, so folding the two would put this check behind a condition that has
+* nothing to do with it.
+*
+* IT REGISTERS WHAT IT MOVES, exactly as the sibling does, and an earlier
+* revision's reason for not doing so was wrong: it said "the live value is one
+* cdkd never resolved and cannot recognise, so there is no needle to record".
+* The needle is `liveValue -> {@link SECRET_MASK}`, i.e. a MASK-ONLY entry, and
+* the evidence for it is the position — THE MASKED POSITION IS THE PROOF THE
+* VALUE IS SECRET, since nothing but this module's own redaction puts a mask at
+* a leaf. Without the registration this function copies live plaintext into the
+* send bag and then `collectNarrowedTopLevelKeys` persists that delta into
+* `observedProperties` against a `secrets` map holding no entry for it — the
+* same disclosure the mask exists to prevent, arriving through the mechanism
+* that is supposed to protect it — and the same omission un-masks it in
+* `maskSecretsInText(err.message, secrets)` and in the masker handed to
+* `provider.update`.
+*
+* `secrets` is therefore MUTATED, which is why it is a parameter rather than
+* something the caller could omit. `recordMaskOnlyValue` applies its own
+* refusals (an entry that already carries a real EXPRESSION wins; a plaintext
+* below the needle floor is not recorded), so this call site states only the
+* position fact and lets the module decide what is registrable.
+*
+* TWO OUTCOMES per masked leaf, and the second is why this returns a report
+* rather than just a bag:
+*
+* - AWS holds a value there -> copy the LIVE value in. The revert then leaves
+*   that position exactly as AWS has it while still reverting every other
+*   drifted key, which is the same trade `preserveLiveValuesAtUnresolvedTokens`
+*   makes.
+* - AWS holds nothing there (the position could not be aligned, or the key is
+*   absent live) -> there is no safe value to send, so the path is reported as
+*   UNPRESERVABLE and the caller refuses the whole resource. Sending the mask
+*   would be the corruption; dropping the key would delete a property the
+*   resource may require.
+*
+* Array descent is POSITIONAL and bails to "no live value" on any length
+* mismatch, matching the sibling: a reordered readback cannot be positioned
+* against, and guessing would put one element's live value at another's index.
+*
+* Returns the input bag BY IDENTITY when it holds no mask, so the ordinary
+* revert is byte-identical and pays one walk.
+*/
+function preserveLiveValuesAtMaskedLeaves(send, awsProperties, secrets) {
+	const unpreservablePaths = [];
+	let changed = false;
+	const walk = (value, live, path) => {
+		if (value === "***") {
+			if (live === void 0) {
+				unpreservablePaths.push(path);
+				return value;
+			}
+			changed = true;
+			if (typeof live === "string") recordMaskOnlyValue(secrets, live);
+			return live;
+		}
+		if (Array.isArray(value)) {
+			const liveItems = Array.isArray(live) && live.length === value.length ? live : void 0;
+			return value.map((item, i) => walk(item, liveItems?.[i], `${path}[${i}]`));
+		}
+		if (value !== null && typeof value === "object") {
+			const liveObject = isPlainRecord(live) ? live : void 0;
+			const out = {};
+			for (const [k, v] of Object.entries(value)) out[k] = walk(v, liveObject?.[k], path === "" ? k : `${path}.${k}`);
+			return out;
+		}
+		return value;
+	};
+	const properties = walk(send, awsProperties, "");
+	if (!changed && unpreservablePaths.length === 0) return {
+		properties: send,
+		unpreservablePaths
+	};
+	return {
+		properties,
+		unpreservablePaths
+	};
+}
+/**
 * Build the `newProperties` object passed to `provider.update` during
 * `--revert`. Strategy:
 *
@@ -69130,7 +69440,13 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 				let newProperties;
 				try {
 					const overlaid = buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 });
-					newProperties = unresolvedTokens.size > 0 ? preserveLiveValuesAtUnresolvedTokens(overlaid, outcome.awsProperties, secrets) : overlaid;
+					const maskPreserved = preserveLiveValuesAtMaskedLeaves(unresolvedTokens.size > 0 ? preserveLiveValuesAtUnresolvedTokens(overlaid, outcome.awsProperties, secrets) : overlaid, outcome.awsProperties, secrets);
+					if (maskPreserved.unpreservablePaths.length > 0) {
+						totalUnresolvable++;
+						logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): refused to revert ${maskPreserved.unpreservablePaths.join(", ")} — the recorded baseline holds only the redaction mask there (a NoEcho custom-resource value), and AWS reports nothing to preserve, so cdkd has no value it may write. Force that custom resource to update (change one of its properties, e.g. a nonce) and re-deploy, so its handler runs again and supplies the value — an ordinary re-deploy leaves it unchanged and the mask stays.`);
+						return;
+					}
+					newProperties = maskPreserved.properties;
 				} catch (err) {
 					totalFailed++;
 					logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): could not build the revert payload — ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
@@ -69335,24 +69651,26 @@ async function runWithConcurrency(tasks, concurrency) {
 	await Promise.all(workers);
 }
 /**
-* Ask the operator to confirm a mutation.
+* `cdkd drift --accept` / `--revert`'s confirmation prompt: ask the operator to
+* confirm a mutation. Both call sites sit inside an `if (!options.yes)` block,
+* which is what keeps `confirmOrRefuse`'s non-interactive refusal (issue
+* #2275) from firing on a `--yes` run.
+*
+* Issue #2230 is why this site passes an explicit `output`: the prompt is
+* written to `out.stream`, not unconditionally to `process.stdout` — under
+* `--json` that stream carries the payload, and a bare `[y/N] ` spliced into
+* it is the same corruption as a status line, so the sink is `process.stderr`
+* there. The prompt is still SHOWN; only its stream changes. See the
+* `HumanTextSink` doc above for why the STREAM (not a closure) is what gets
+* handed to `createInterface`.
 *
-* Issue #2230: the prompt is written to `out.stream`, not unconditionally to
-* `process.stdout` — under `--json` that stream carries the payload, and a
-* bare `[y/N] ` spliced into it is the same corruption as a status line.
-* The prompt is still SHOWN; only its stream changes.
+* Exported for unit testing — internal to the command flow otherwise.
 */
 async function confirmPrompt$5(prompt, out) {
-	const rl = readline$1.createInterface({
-		input: process.stdin,
-		output: out.stream
+	return confirmOrRefuse(prompt, {
+		output: out.stream,
+		refusal: "The cdkd drift confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm, or run the command from a real terminal."
 	});
-	try {
-		const ans = await rl.question(`${prompt} [y/N] `);
-		return /^y(es)?$/i.test(ans.trim());
-	} finally {
-		rl.close();
-	}
 }
 function writeJsonReport(reports) {
 	const payload = reports.map((r) => {
@@ -70083,17 +70401,15 @@ async function emptyBucketAllVersions(s3, bucket) {
 		versionIdMarker = resp.NextVersionIdMarker;
 	} while (keyMarker || versionIdMarker);
 }
+/**
+* `cdkd state migrate`'s confirmation prompt. Its only call site is inside the
+* `if (!options.yes)` block above, which is what keeps `confirmOrRefuse`'s
+* non-interactive refusal (issue #2275) from firing on a `--yes` run.
+*
+* Exported for unit testing — internal to the command flow otherwise.
+*/
 async function confirmPrompt$4(prompt) {
-	const rl = readline$1.createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const ans = await rl.question(`${prompt} [y/N] `);
-		return /^y(es)?$/i.test(ans.trim());
-	} finally {
-		rl.close();
-	}
+	return confirmOrRefuse(prompt, { refusal: "The cdkd state migrate confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm the migration, or run the command from a real terminal." });
 }
 /**
 * Create the `cdkd state migrate` subcommand.
@@ -72010,6 +72326,14 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 			});
 			continue;
 		}
+		if (carriesSecretMask(stateEntry.properties)) {
+			blocked.push({
+				logicalId,
+				resourceType,
+				reason: "cdkd state holds only the redaction mask ('***') for at least one property — a NoEcho custom-resource value cdkd cannot re-derive. Forcing the custom resource to update does NOT clear this: the handler supplies the value to the deploy, and cdkd re-masks it on the way into state, so the export still has nothing to declare. Stop setting NoEcho on that response and re-deploy, then export again; or export this stack without that resource and adopt it into CloudFormation by hand. See https://github.com/go-to-k/cdkd/issues/2274."
+			});
+			continue;
+		}
 		if (IMPORT_UNSUPPORTED_RECREATABLE_TYPES.has(resourceType)) {
 			if (options.recreateImportUnsupported) recreateBeforePhase2.push({
 				logicalId,
@@ -73705,17 +74029,18 @@ function printNextSteps(args) {
 	}
 	logger.info("");
 }
+/**
+* `cdkd export`'s confirmation prompt, shared by its THREE call sites (the
+* rollback-journal override, the single-stack migration confirm, and the
+* nested-stack tree-wide confirm in `runPerStackImportLoop`). Every one of
+* them sits inside an `if (!options.yes ...)` block, which is what keeps
+* `confirmOrRefuse`'s non-interactive refusal (issue #2275) from firing on a
+* `--yes` run.
+*
+* Exported for unit testing — internal to the export flow otherwise.
+*/
 async function confirmPrompt$3(prompt) {
-	const rl = readline$1.createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const ans = await rl.question(`${prompt} [y/N] `);
-		return /^y(es)?$/i.test(ans.trim());
-	} finally {
-		rl.close();
-	}
+	return confirmOrRefuse(prompt, { refusal: "The cdkd export confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm, or run the command from a real terminal." });
 }
 function createExportCommand() {
 	const cmd = new Command("export").description("Hand a cdkd-managed stack over to CloudFormation via CFn IMPORT (changeset). AWS resources are unchanged; cdkd state for the stack is deleted on success. Mirror of `cdkd import` (AWS → cdkd) in the reverse direction (cdkd → CFn). Accepts JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Aborts if any resource is not CFn-importable.").argument("[stack]", "Stack name to export (auto-detected for single-stack apps)").option("--cfn-stack-name <name>", "Name of the destination CloudFormation stack for the root stack. Defaults to the cdkd stack name (or the cdkd2cfnStackName mapping when the name contains '~'). For per-nested-child overrides, use --cfn-child-stack-name.").option("--cfn-child-stack-name <pair...>", "Per-nested-child CFn stack-name override. Repeatable. Format: '<cdkdName>=<cfnName>' (e.g. --cfn-child-stack-name 'MyApp~Database=my-app-db'). The cdkd stack name for a nested child is '<parent>~<childLogicalId>' (v6 state-key form). Without an override the CFn name is derived by replacing '~' with '-'. Only consulted when the exported stack tree contains nested children; ignored for flat stacks.").option("--template <path>", "Path to a pre-rendered CloudFormation template (JSON or YAML — format auto-detected). Skips synth.").option("--stack-region <region>", "Region of the cdkd state record to operate on. Required when the same stack name has state in multiple regions.").option("--dry-run", "Print the import plan without creating a changeset.", false).option("--accept-transient-context", "Allow CLI -c key=value overrides at export time even though they are not persisted to cdk.json / cdk.context.json (default: refuse). When set, the user is responsible for passing the same -c flags to every future cdk deploy.", false).option("--include-non-importable", "Run a 2-phase migration when the stack contains non-importable resources (Custom::*). Phase 1 imports the importable resources; phase 2 CFn-CREATEs the non-importable ones, which re-invokes each Custom Resource's onCreate handler. Make sure onCreate is idempotent before enabling.", false).option("--parameter <key=value...>", "CFn template Parameter override, repeatable. Required when the synthesized template has Parameters without Default values; otherwise overrides the template's default value. Format: --parameter Key=Value.").option("--strict-cross-stack", "Refuse to export when sibling cdkd stacks in the same CDK app reference the exporting stack via Fn::GetStackOutput. Without the flag, cdkd warns and proceeds — the consumers keep resolving via the CloudFormation fallback (weak reference) unless they deploy with --no-cfn-fallback.", false).option("--skip-import-support-preflight", "Skip the pre-flight that refuses resource types whose CloudFormation registry schema says CFn cannot IMPORT them (no read handler AND NON_PROVISIONABLE), and let CreateChangeSet answer instead. The pre-flight is a registry HEURISTIC, not AWS's supported-for-import list, so this is the escape hatch for a type AWS has since made importable. Expect the changeset to be rejected if the heuristic was right.", false).option("--no-recreate-import-unsupported", "Block instead of auto-handling resource types AWS does NOT support in IMPORT changesets (currently only AWS::ApiGatewayV2::Stage, emitted by CDK HttpApi). Default behavior: cdkd skips these from phase 1, deletes the AWS-side resource between phases, and lets CFn re-CREATE in phase 2 (brief unavailability window). With this flag, the export aborts with a clear error instead.").action(withErrorHandling(exportCommand));
@@ -73739,6 +74064,26 @@ function formatStackRef(ref) {
 	return ref.region ? `${ref.stackName} (${ref.region})` : ref.stackName;
 }
 /**
+* {@link formatStackRef} for a sentence a CONFIRMATION PROMPT renders.
+*
+* Both halves come from an S3 key segment (or, for a legacy record, a state
+* body), so both are attacker-influenced in exactly the way issue #2170 round
+* 4 found for the lock error sixty lines below this helper's callers: a
+* planted `\n` forged a whole line inside that sentence. A forged line in a
+* PROMPT is strictly worse than one in an error, because the sentence it
+* corrupts is the one the operator answers `y` to.
+*
+* `asciiOnly` matches the lock error's own call on these same values — a
+* stack name and an AWS region both have a known charset — and is a no-op on
+* every ordinary input, so the shipped prompt strings are byte-identical.
+* `UNRENDERABLE` stands in when sanitising leaves nothing, since an empty
+* `()` would read as "no region" rather than "a region cdkd will not print".
+*/
+function formatStackRefSafe(ref) {
+	const stack = displaySafe(ref.stackName, { asciiOnly: true }) || "<unrenderable>";
+	return ref.region ? `${stack} (${displaySafe(ref.region, { asciiOnly: true }) || "<unrenderable>"})` : stack;
+}
+/**
 * Resolve a stack name + optional region flag against the `listStacks` index
 * built up front. When a name resolves to multiple regions and the caller
 * didn't pin one, surface a clear error listing the candidates so the user
@@ -73842,7 +74187,7 @@ function sortRefs(refs) {
 async function stateListCommand(options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
-	if (options.json) reserveStdoutForPayload();
+	reserveStdoutForPayload();
 	const setup = await setupStateBackend(options);
 	try {
 		const refs = sortRefs(await setup.stateBackend.listStacks());
@@ -74311,16 +74656,9 @@ async function stateOrphanCommand(stackArgs, options) {
 				}
 			}
 			if (!options.yes && !options.force) {
-				const targetList = targets.map((t) => formatStackRef(t)).join(", ");
+				const targetList = targets.map((t) => formatStackRefSafe(t)).join(", ");
 				process.stdout.write(`\nWARNING: This removes cdkd's state record for [${targetList}] only. AWS resources will NOT be deleted.\nUse 'cdkd destroy ${stackName}' if you want to delete the actual resources.\n\n`);
-				const rl = readline$1.createInterface({
-					input: process.stdin,
-					output: process.stdout
-				});
-				const answer = await rl.question(`Remove state for ${targetList} from s3://${setup.bucket}/${setup.prefix}/? (y/N): `);
-				rl.close();
-				const trimmed = answer.trim().toLowerCase();
-				if (trimmed !== "y" && trimmed !== "yes") {
+				if (!await confirmStateOrphanRemoval(`Remove state for ${targetList} from s3://${setup.bucket}/${setup.prefix}/?`)) {
 					logger.info(`Cancelled removal of state for stack: ${stackName}`);
 					continue;
 				}
@@ -74886,7 +75224,7 @@ async function stateRefreshObservedCommand(stackArgs, options) {
 			}
 		}
 		if (!options.yes && !options.dryRun) {
-			const targetList = targets.map(formatStackRef).join(", ");
+			const targetList = targets.map(formatStackRefSafe).join(", ");
 			if (!await confirmRefresh(`Refresh observedProperties for ${targets.length} stack(s) (${targetList})?`)) {
 				logger.info("Aborted.");
 				return;
@@ -75067,17 +75405,34 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 		});
 	}
 }
-async function confirmRefresh(prompt) {
-	const rl = readline$1.createInterface({
-		input: process.stdin,
-		output: process.stdout
+/**
+* `cdkd state orphan`'s confirmation prompt. Its only call site is inside the
+* `if (!options.yes && !options.force)` block in `stateOrphanCommand`, which
+* is what keeps `confirmOrRefuse`'s non-interactive refusal (issue #2275)
+* from firing on a flagged run.
+*
+* The `(y/N): ` suffix is preserved verbatim from before issue #2275 folded
+* the guard in: it is user-visible output, and only this prompt and
+* `cdkd rollback` ever spelled it that way.
+*
+* Exported for unit testing — internal to the state-orphan flow otherwise.
+*/
+async function confirmStateOrphanRemoval(prompt) {
+	return confirmOrRefuse(prompt, {
+		suffix: " (y/N): ",
+		refusal: "The cdkd state orphan confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes (or -f / --force) to confirm the removal, or run the command from a real terminal."
 	});
-	try {
-		const ans = await rl.question(`${prompt} [y/N] `);
-		return /^y(es)?$/i.test(ans.trim());
-	} finally {
-		rl.close();
-	}
+}
+/**
+* `cdkd state refresh-observed`'s confirmation prompt. Its only call site is
+* inside the `if (!options.yes && !options.dryRun)` block above, which is what
+* keeps `confirmOrRefuse`'s non-interactive refusal (issue #2275) from firing
+* on a `--yes` run.
+*
+* Exported for unit testing — internal to the refresh-observed flow otherwise.
+*/
+async function confirmRefresh(prompt) {
+	return confirmOrRefuse(prompt, { refusal: "The cdkd state refresh-observed confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm the refresh, or run the command from a real terminal." });
 }
 /**
 * Create the `state refresh-observed` subcommand.
@@ -75208,17 +75563,20 @@ function failedActionLabel(item, skipFinalSnapshot) {
 		case "skip-failed-absent": return `  - skip     ${op.logicalId} (${op.resourceType}) — no previous state available`;
 	}
 }
+/**
+* `cdkd rollback`'s confirmation prompt. Exported for unit testing — internal
+* to the rollback flow otherwise, whose only call site is inside the
+* `if (!skipConfirmation)` block below.
+*
+* The `(y/N): ` suffix is preserved verbatim from before issue #2275 folded
+* the non-interactive guard into `confirmOrRefuse`: it is user-visible output,
+* and only this site and `cdkd state orphan` ever spelled it that way.
+*/
 async function confirm(question) {
-	const rl = readline$1.createInterface({
-		input: process.stdin,
-		output: process.stdout
+	return confirmOrRefuse(question, {
+		suffix: " (y/N): ",
+		refusal: "The cdkd rollback confirmation prompt cannot run in a non-interactive environment. Pass --force (or -y / --yes) to confirm the rollback, or run the command from a real terminal."
 	});
-	try {
-		const t = (await rl.question(`${question} (y/N): `)).trim().toLowerCase();
-		return t === "y" || t === "yes";
-	} finally {
-		rl.close();
-	}
 }
 async function rollbackCommand(stackArg, options) {
 	const logger = getLogger();
@@ -77691,17 +78049,16 @@ function stringifyForAudit(value) {
 	if (typeof value === "string") return JSON.stringify(value);
 	return JSON.stringify(value);
 }
+/**
+* `cdkd orphan`'s confirmation prompt. Its only call site is inside the
+* `if (!options.yes && !options.force)` block above, which is what keeps
+* `confirmOrRefuse`'s non-interactive refusal (issue #2275) from firing on a
+* flagged run.
+*
+* Exported for unit testing — internal to the command flow otherwise.
+*/
 async function confirmPrompt$1(prompt) {
-	const rl = readline$1.createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const ans = await rl.question(`${prompt} [y/N] `);
-		return /^y(es)?$/i.test(ans.trim());
-	} finally {
-		rl.close();
-	}
+	return confirmOrRefuse(prompt, { refusal: "The cdkd orphan confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes (or -f / --force) to confirm the orphan, or run the command from a real terminal." });
 }
 /**
 * Create the top-level `cdkd orphan` command.
@@ -78714,17 +79071,15 @@ function formatOutcome(outcome) {
 		case "failed": return "✗";
 	}
 }
+/**
+* `cdkd import`'s confirmation prompt. Its only call site is inside the
+* `if (!options.yes)` block above, which is what keeps `confirmOrRefuse`'s
+* non-interactive refusal (issue #2275) from firing on a `--yes` run.
+*
+* Exported for unit testing — internal to the command flow otherwise.
+*/
 async function confirmPrompt(prompt) {
-	const rl = readline$1.createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const ans = await rl.question(`${prompt} [y/N] `);
-		return /^y(es)?$/i.test(ans.trim());
-	} finally {
-		rl.close();
-	}
+	return confirmOrRefuse(prompt, { refusal: "The cdkd import confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm the state write, or run the command from a real terminal." });
 }
 /**
 * Create the `cdkd import` top-level command.
@@ -89038,4 +89393,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CjlLza5f.js.map
+//# sourceMappingURL=program-B9vnKc3N.js.map