@go-to-k/cdkd 0.284.45 → 0.284.47

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as startInterruptWatch, $n as setAwsClients, $t as WorkGraph, A as renderStatefulReason, An as resolveCaptureObservedState, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as findLargeInlineResources, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as getDockerImageBySourceHash, Cr as normalizeAwsError, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as getLegacyStateBucketName, Dr as isThrottlingError, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as getDefaultStateBucketName, Er as isRetryableTransientError, Et as errorCauseChain, F as green, Fn as stateBucketExistenceConfirmed, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as derivePartitionAndUrlSuffix, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as expectedOwnerParam, Ht as describeTypeWithThrottleRetry, I as red, In as warnDeprecatedNoPrefixCliFlag, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jt as S3StateBackend, K as clearOnUpdateRemoval, Kn as AssemblyReader, Kt as LockManager, L as yellow, Ln as CFN_TEMPLATE_BODY_LIMIT, Lt as s3BucketRegionalDomainName, M as bold, Mn as resolveStateBucketWithDefault, Mt as classifyReplaySecretRegion, N as cyan, Nn as resolveStateBucketWithDefaultAndSource, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveApp, Or as markNonRetryable, Ot as maskSecretsInError, P as gray, Pn as resolveUseCdkBootstrapAssets, Pt as s3BucketArn, Q as isInterruptedWaitError, Qn as resetAwsClients, Qt as stringifyValue, R as collectDeclaredOutputNames, Rn as CFN_TEMPLATE_URL_LIMIT, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as AssetManifestLoader, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as synthesisStatusMessage, Tr as isMarkedNonRetryable, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as PARTITION_TABLE, Ut as withRetry, V as isExportAliasCollision, Vn as uploadCfnTemplate, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as canonicalizeRegion, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as AwsClients, Xt as shouldRetainResource, Y as findSilentDropProperties, Yn as resolveBucketRegion, Yt as rebuildClientForBucketRegion, Z as endCommandInterruptScope, Zn as getAwsClients, Zt as AssetPublisher, _ as computeImplicitDeleteEdges, _n as formatDockerLoginError, _r as StackHasActiveImportsError, _t as replayWarn, a as DeploymentEventsStore, an as stripControlChars, ar as DeployCancelledError, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as runDockerForeground, bt as requireConfigString, c as replayFailedOperations, cn as ensureAssetStorage, cr as LocalMigrateError, ct as refStateLookupFromResource, d as updatePartialReason, dn as readBootstrapMarkerBody, dr as MissingCdkCliError, dt as resolveExplicitPhysicalId, en as buildAssetRedirectMap, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateAssetBucketName, fr as NestedStackChildDirectDestroyError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as dockerSpawnEnvWithSensitive, gr as ResourceUpdateNotSupportedError, gt as readConfigString, h as maskingRetryLogger, hn as buildDockerImage, hr as ResourceTimeoutError, ht as configStringRefusal, i as DeploymentEventsReader, in as escapeRegExp, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveSkipPrefix, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveAutoAssetStorage, kt as maskSecretsInText, l as replayRollback, ln as getBootstrapMarkerKey, lr as LocalStartServiceError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDenyExternalAccessPolicy, mr as ProvisioningError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as loadPublishableAssetManifest, nt as disableInstanceApiTermination, o as planFailedOps, on as AssetModeResolver, or as DynamicReferenceRegionAmbiguousError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as validateContainerRepoName, pr as PartialFailureError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as processStackMessages, qt as displaySafe, r as DeployEngine, rn as rewriteTemplateAssetReferences, rr as CrossAccountSecretRefusalError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as BOOTSTRAP_MARKER_PREFIX, sr as LocalInvokeBuildError$1, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as createAssetRedirectResolver, tr as CdkdError, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as parseBootstrapMarker, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as getDockerCmd, vr as StackTerminationProtectionError, vt as requireConfigArray, w as refusesFinalSnapshot, wn as Synthesizer, wr as withErrorHandling, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as runDockerStreaming, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as partitionSensitiveEnv, yt as requireConfigObject, z as collectPublishedOutputNames, zn as MIGRATE_TMP_PREFIX, zt as applyRoleArnIfSet } from "./deploy-engine-BM0TxXk2.js";
+import { $ as startInterruptWatch, $n as setAwsClients, $t as WorkGraph, A as renderStatefulReason, An as resolveCaptureObservedState, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as findLargeInlineResources, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as getDockerImageBySourceHash, Cr as normalizeAwsError, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as getLegacyStateBucketName, Dr as isThrottlingError, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as getDefaultStateBucketName, Er as isRetryableTransientError, Et as errorCauseChain, F as green, Fn as stateBucketExistenceConfirmed, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as derivePartitionAndUrlSuffix, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as expectedOwnerParam, Ht as describeTypeWithThrottleRetry, I as red, In as warnDeprecatedNoPrefixCliFlag, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jt as S3StateBackend, K as clearOnUpdateRemoval, Kn as AssemblyReader, Kt as LockManager, L as yellow, Ln as CFN_TEMPLATE_BODY_LIMIT, Lt as s3BucketRegionalDomainName, M as bold, Mn as resolveStateBucketWithDefault, Mt as classifyReplaySecretRegion, N as cyan, Nn as resolveStateBucketWithDefaultAndSource, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveApp, Or as markNonRetryable, Ot as maskSecretsInError, P as gray, Pn as resolveUseCdkBootstrapAssets, Pt as s3BucketArn, Q as isInterruptedWaitError, Qn as resetAwsClients, Qt as stringifyValue, R as collectDeclaredOutputNames, Rn as CFN_TEMPLATE_URL_LIMIT, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as AssetManifestLoader, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as synthesisStatusMessage, Tr as isMarkedNonRetryable, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as PARTITION_TABLE, Ut as withRetry, V as isExportAliasCollision, Vn as uploadCfnTemplate, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as canonicalizeRegion, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as AwsClients, Xt as shouldRetainResource, Y as findSilentDropProperties, Yn as resolveBucketRegion, Yt as rebuildClientForBucketRegion, Z as endCommandInterruptScope, Zn as getAwsClients, Zt as AssetPublisher, _ as computeImplicitDeleteEdges, _n as formatDockerLoginError, _r as StackHasActiveImportsError, _t as replayWarn, a as DeploymentEventsStore, an as stripControlChars, ar as DeployCancelledError, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as runDockerForeground, bt as requireConfigString, c as replayFailedOperations, cn as ensureAssetStorage, cr as LocalMigrateError, ct as refStateLookupFromResource, d as updatePartialReason, dn as readBootstrapMarkerBody, dr as MissingCdkCliError, dt as resolveExplicitPhysicalId, en as buildAssetRedirectMap, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateAssetBucketName, fr as NestedStackChildDirectDestroyError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as dockerSpawnEnvWithSensitive, gr as ResourceUpdateNotSupportedError, gt as readConfigString, h as maskingRetryLogger, hn as buildDockerImage, hr as ResourceTimeoutError, ht as configStringRefusal, i as DeploymentEventsReader, in as escapeRegExp, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveSkipPrefix, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveAutoAssetStorage, kt as maskSecretsInText, l as replayRollback, ln as getBootstrapMarkerKey, lr as LocalStartServiceError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDenyExternalAccessPolicy, mr as ProvisioningError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as loadPublishableAssetManifest, nt as disableInstanceApiTermination, o as planFailedOps, on as AssetModeResolver, or as DynamicReferenceRegionAmbiguousError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as validateContainerRepoName, pr as PartialFailureError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as processStackMessages, qt as displaySafe, r as DeployEngine, rn as rewriteTemplateAssetReferences, rr as CrossAccountSecretRefusalError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as BOOTSTRAP_MARKER_PREFIX, sr as LocalInvokeBuildError$1, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as createAssetRedirectResolver, tr as CdkdError, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as parseBootstrapMarker, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as getDockerCmd, vr as StackTerminationProtectionError, vt as requireConfigArray, w as refusesFinalSnapshot, wn as Synthesizer, wr as withErrorHandling, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as runDockerStreaming, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as partitionSensitiveEnv, yt as requireConfigObject, z as collectPublishedOutputNames, zn as MIGRATE_TMP_PREFIX, zt as applyRoleArnIfSet } from "./deploy-engine-yvTKD2qC.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-kMX2xn6Q.js";
+import { t as ASGProvider } from "./asg-provider-_PwR0OUM.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -65513,16 +65513,25 @@ var DriftDetectedError = class DriftDetectedError extends CdkdError {
 	}
 };
 /**
-* Detection found NO drift, but cdkd DELIBERATELY REFUSED to compare at least
-* one resource's secret-bearing properties (issue #2108).
-*
-* SCOPED TO REFUSALS, not to everything the report calls `notCompared`. The
-* roll-up also contains resources whose only problem is a surviving
-* `{{resolve:ssm-secure:...}}` token — a pre-existing population cdkd resolves
+* Detection found NO drift, but at least one resource's comparison did not
+* happen for a reason the user can ACT ON: cdkd deliberately refused to resolve
+* its secret-bearing properties (issue #2108), or the read / comparison itself
+* threw (issues [#2151](https://github.com/go-to-k/cdkd/issues/2151) /
+* [#1945](https://github.com/go-to-k/cdkd/issues/1945)).
+*
+* The class was `DriftComparisonRefusedError` while `refused` was the only
+* clearable cause. `readFailed` joins it on exactly the property the scoping
+* argument below turns on -- actionable and clearable on a re-run -- so it takes
+* the same exit code rather than a fourth one, and the name now states the
+* CONDITION rather than one of its causes.
+*
+* SCOPED TO THE CLEARABLE CAUSES, not to everything the report calls
+* `notCompared`. The roll-up also contains resources whose only problem is a
+* surviving `{{resolve:ssm-secure:...}}` token — a pre-existing population cdkd resolves
 * for nobody, which can never clear on a re-run, and which this change did not
 * create. Exiting non-zero for them would break `cdkd drift` in CI forever over
-* an unrelated defect, so the exit reads the `refused` cause alone while the
-* report covers both. See `NotComparedCause` and `outcomeExitSignal`.
+* an unrelated defect, so the exit reads `refused` and `readFailed` while the
+* report covers all three. See `NotComparedCause` and `outcomeExitSignal`.
 *
 * WHY A NON-ZERO EXIT, and why it is a PRESERVATION rather than a new signal.
 * Pre-#2108 that population resolved the reference in the WRONG region, the
@@ -65560,17 +65569,17 @@ var DriftDetectedError = class DriftDetectedError extends CdkdError {
 * Carries no message of its own for the same reason {@link DriftDetectedError}
 * does -- the report was already printed.
 */
-var DriftComparisonRefusedError = class DriftComparisonRefusedError extends CdkdError {
+var DriftComparisonIncompleteError = class DriftComparisonIncompleteError extends CdkdError {
 	silent = true;
 	exitCode = 2;
 	constructor() {
-		super("drift comparison refused", "DRIFT_COMPARISON_REFUSED");
-		this.name = "DriftComparisonRefusedError";
-		Object.setPrototypeOf(this, DriftComparisonRefusedError.prototype);
+		super("drift comparison incomplete", "DRIFT_COMPARISON_INCOMPLETE");
+		this.name = "DriftComparisonIncompleteError";
+		Object.setPrototypeOf(this, DriftComparisonIncompleteError.prototype);
 	}
 };
 /**
-* Every outcome on one report that was only PARTIALLY compared -- the
+* Every outcome on one report that cdkd did not FULLY compare -- the
 * `notCompared` variant, plus a `drifted` one whose `notComparedCause` is set
 * (issues #2108 / #2135).
 *
@@ -65580,13 +65589,33 @@ var DriftComparisonRefusedError = class DriftComparisonRefusedError extends Cdkd
 * A roll-up spelled per reader is how the payload and the human summary come to
 * disagree.
 *
+* Since issues #2151 / #1945 the roll-up is NOT all "partially" compared: a
+* `readFailed` member had nothing compared at all. Both renderings say so per
+* entry via {@link notComparedReason}; this predicate stays the single spelling
+* of "was the comparison complete", which is the question both still ask.
+*
 * The EXIT CODE deliberately does NOT read this — see {@link outcomeExitSignal}
-* and {@link NotComparedCause} for why it is scoped to refusals alone.
+* and {@link NotComparedCause} for why it is scoped to the clearable causes.
+*
+* Returns the CAUSE beside each outcome rather than leaving readers to re-derive
+* it. This function is where the invariant is established — a `drifted` outcome
+* is admitted only when its optional `notComparedCause` is set — and at the type
+* level that field stays optional on the variant, so every reader that wants the
+* cause otherwise needs a `?? <something>` fallback for a case this filter has
+* already excluded. One such fallback is one unreachable default that is wrong
+* if it is ever reached; issues #2151 / #1945 added a reader that needs the
+* cause (the `--json` entry), so the invariant is carried instead of restated.
 */
 function notComparedOutcomes(report) {
 	return report.outcomes.flatMap((o) => matchOutcome(o, {
-		drifted: (d) => d.notComparedCause === void 0 ? [] : [d],
-		notCompared: (n) => [n],
+		drifted: (d) => d.notComparedCause === void 0 ? [] : [{
+			outcome: d,
+			cause: d.notComparedCause
+		}],
+		notCompared: (n) => [{
+			outcome: n,
+			cause: n.notComparedCause
+		}],
 		clean: () => [],
 		unsupported: () => [],
 		skipped: () => []
@@ -65600,10 +65629,11 @@ function notComparedOutcomes(report) {
 * compared as a pass is precisely the round-2 defect #2135 exists to make
 * impossible.
 *
-* `refused` is a STRICT SUBSET of what {@link notComparedOutcomes} rolls up, and
-* the asymmetry is the point: the REPORT covers everything that was not
-* compared, because as information both causes matter equally, while the exit
-* code covers only the population #2108 created. Exiting non-zero on
+* `incomplete` is a STRICT SUBSET of what {@link notComparedOutcomes} rolls up,
+* and the asymmetry is the point: the REPORT covers everything that was not
+* compared, because as information every cause matters equally, while the exit
+* code covers only the CLEARABLE ones — `refused` (the population #2108 created)
+* and `readFailed` (issues #2151 / #1945). Exiting non-zero on
 * `unresolvedToken` would break `cdkd drift` in CI forever for every stack
 * holding an `{{resolve:ssm-secure:...}}` reference — permanent, unclearable,
 * and unrelated. See {@link NotComparedCause}.
@@ -65615,7 +65645,7 @@ function notComparedOutcomes(report) {
 function outcomeExitSignal(outcome) {
 	return matchOutcome(outcome, {
 		drifted: () => "drifted",
-		notCompared: (n) => n.notComparedCause === "refused" ? "refused" : "none",
+		notCompared: (n) => n.notComparedCause === "unresolvedToken" ? "none" : "incomplete",
 		clean: () => "none",
 		unsupported: () => "none",
 		skipped: () => "none"
@@ -65691,10 +65721,10 @@ async function driftCommand(stacks, options) {
 		else writeHumanReport(reports);
 		const signals = reports.flatMap((r) => r.outcomes.map(outcomeExitSignal));
 		const drifted = signals.includes("drifted");
-		const anyRefused = signals.includes("refused");
+		const anyIncomplete = signals.includes("incomplete");
 		if (!options.accept && !options.revert) {
 			if (drifted) throw new DriftDetectedError();
-			if (anyRefused) throw new DriftComparisonRefusedError();
+			if (anyIncomplete) throw new DriftComparisonIncompleteError();
 			return;
 		}
 		if (!drifted) {
@@ -66003,6 +66033,89 @@ function isDriftSecretRefusal(err) {
 	return err instanceof DriftSecretRefusalError;
 }
 /**
+* One-line human phrasing for a {@link NotComparedCause}, used per entry in the
+* human report's `NOT fully compared` block.
+*
+* Written as an exhaustive record rather than a `switch` with a default, so
+* adding a cause is a COMPILE ERROR here instead of silently rendering as
+* whatever the default said. That is the same guarantee #2135 bought at the
+* variant level, applied to the cause level -- and it is the level that
+* defaulted quietly when issues #2151 / #1945 added `readFailed`.
+*/
+function notComparedReason(cause) {
+	return {
+		refused: "cdkd refused to resolve a dynamic reference its state records (spell the reference as a full ARN, which names its region)",
+		unresolvedToken: "its state records a `{{resolve:...}}` spelling cdkd resolves for nobody (permanent; a re-run cannot clear it)",
+		readFailed: "the read or comparison threw, so NONE of its properties were compared"
+	}[cause];
+}
+/**
+* The two Cloud Control error names that mean "this type has no READ handler".
+* `CloudControlProvider.handleError` recognizes the same pair, so the two sites
+* agree on the population by construction.
+*/
+const NO_READ_HANDLER_NAMES = /* @__PURE__ */ new Set(["UnsupportedActionException", "TypeNotFoundException"]);
+/**
+* The FULL phrase, deliberately -- see {@link isNoReadHandlerError}. Matching
+* loosely on `does not support` would route a genuine read failure to exit 0.
+*/
+const NO_READ_HANDLER_MESSAGE = /does not support READ action/i;
+/**
+* Whether a throw out of the per-resource read means the type has NO READ PATH,
+* as opposed to a read that could have worked and did not.
+*
+* This is the taxonomy question issue
+* [#2151](https://github.com/go-to-k/cdkd/issues/2151) raised, and the property
+* it turns on is whether a RE-RUN CAN CLEAR IT. A type Cloud Control has no READ
+* handler for is permanent by construction, so routing it to `readFailed` would
+* make `cdkd drift` exit non-zero forever for every stack holding one -- the
+* same "unclearable in CI" hazard `unresolvedToken` is kept out of the exit code
+* for. It reports `unsupported` instead, which is not a new claim about it:
+* `CloudControlProvider.readCurrentState` signals the SAME condition by
+* returning `undefined` when the response carries no properties, and that
+* already reports `unsupported`. Which spelling arrives is AWS's choice, so the
+* two must not produce different outcomes.
+*
+* Matches on `name`, and WALKS THE CAUSE CHAIN rather than reading the top level
+* only. Be precise about why, because the obvious justification is wrong:
+* `CloudControlProvider.readCurrentState` re-throws everything but
+* `ResourceNotFoundException` RAW and never routes through that class's
+* `handleError`, so on today's code the only shape reaching here is the bare SDK
+* error -- which is what #2151 measured live, and which the top-level `name`
+* alone would catch.
+*
+* The walk is therefore for a wrap that does not exist YET, and it is cheap
+* insurance rather than dead code: `handleError` already recognizes this exact
+* pair and preserves the original as `cause`, so the day any read path is routed
+* through it -- or wrapped by a caller -- the top-level name becomes
+* `ProvisioningError` and a name-only check would silently start reporting a
+* permanent no-read-path condition as an actionable failure, at exit 2, forever.
+* A reader deleting the walk as unreachable should know that is the failure they
+* are buying.
+*
+* The message check is a FALLBACK for a re-wrap that kept neither the name nor
+* the cause, and it is deliberately the full phrase rather than `does not
+* support`: matching loosely would route a genuine read failure to `unsupported`
+* and exit 0 over a resource nobody compared, which is the direction this whole
+* lane exists to stop erring in. An error that loses its name AND its cause AND
+* its wording is reported `readFailed` and exits 2 -- loud, which is the safe
+* side.
+*/
+function isNoReadHandlerError(err) {
+	try {
+		let current = err;
+		for (let depth = 0; depth < 10 && current !== null && current !== void 0; depth += 1) {
+			const candidate = current;
+			if (typeof candidate.name === "string" && NO_READ_HANDLER_NAMES.has(candidate.name)) return true;
+			if (typeof candidate.message === "string" && NO_READ_HANDLER_MESSAGE.test(candidate.message)) return true;
+			current = candidate.cause;
+		}
+	} catch {
+		return false;
+	}
+	return false;
+}
+/**
 * The refusal a region-AMBIGUOUS drift reference throws (issue #2108).
 *
 * A plain throw: BOTH call sites already wrap `resolveStateSecretExpressions`
@@ -66302,6 +66415,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				continue;
 			}
 			let provider;
+			const secrets = /* @__PURE__ */ new Map();
 			try {
 				provider = providerRegistry.getProviderFor({
 					resourceType: resource.resourceType,
@@ -66315,10 +66429,30 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				});
 				continue;
 			}
-			let aws;
-			if (provider.readCurrentState) aws = await provider.readCurrentState(resource.physicalId, logicalId, resource.resourceType, resource.properties ?? {}, buildReadCurrentStateContext(state, logicalId));
-			else {
-				if (CC_API_FALLBACK_DENY_LIST[resource.resourceType]) {
+			try {
+				let aws;
+				if (provider.readCurrentState) aws = await provider.readCurrentState(resource.physicalId, logicalId, resource.resourceType, resource.properties ?? {}, buildReadCurrentStateContext(state, logicalId));
+				else {
+					if (CC_API_FALLBACK_DENY_LIST[resource.resourceType]) {
+						outcomes.push({
+							kind: "unsupported",
+							logicalId,
+							resourceType: resource.resourceType
+						});
+						continue;
+					}
+					const ccApiAws = await ccApiFallback.readCurrentState(resource.physicalId, logicalId, resource.resourceType, resource.properties ?? {});
+					if (ccApiAws === void 0) {
+						outcomes.push({
+							kind: "unsupported",
+							logicalId,
+							resourceType: resource.resourceType
+						});
+						continue;
+					}
+					aws = stripCcApiAwsManagedFields(resource.resourceType, ccApiAws);
+				}
+				if (aws === void 0) {
 					outcomes.push({
 						kind: "unsupported",
 						logicalId,
@@ -66326,8 +66460,79 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 					});
 					continue;
 				}
-				const ccApiAws = await ccApiFallback.readCurrentState(resource.physicalId, logicalId, resource.resourceType, resource.properties ?? {});
-				if (ccApiAws === void 0) {
+				const ignorePaths = provider.getDriftUnknownPaths ? provider.getDriftUnknownPaths(resource.resourceType, resource.properties ?? {}) : [];
+				const unorderedPaths = provider.getDriftUnorderedPaths ? provider.getDriftUnorderedPaths(resource.resourceType) : [];
+				const useObserved = resource.observedProperties !== void 0;
+				const baseline = useObserved ? resource.observedProperties : resource.properties ?? {};
+				const secretPaths = /* @__PURE__ */ new Set();
+				const seededSecretPaths = /* @__PURE__ */ new Set();
+				collectDynamicReferencePaths(baseline, seededSecretPaths);
+				if (useObserved) collectDynamicReferencePaths(resource.properties ?? {}, seededSecretPaths);
+				const unresolvedTokens = /* @__PURE__ */ new Set();
+				const noteUnresolved = (tokens) => {
+					for (const token of tokens) unresolvedTokens.add(token);
+				};
+				let comparisonBaseline = baseline;
+				let secretResolutionFailed = false;
+				try {
+					comparisonBaseline = await resolveStateSecretExpressions(baseline, secretResolvers, secrets, {
+						secretPaths,
+						onUnresolved: noteUnresolved,
+						logicalId,
+						consumerRegion: region,
+						producerRegions
+					});
+					if (useObserved) await resolveStateSecretExpressions(resource.properties ?? {}, secretResolvers, secrets, {
+						secretPaths,
+						onUnresolved: noteUnresolved,
+						logicalId,
+						consumerRegion: region,
+						producerRegions
+					});
+				} catch (err) {
+					secretResolutionFailed = true;
+					comparisonBaseline = baseline;
+					const refused = isDriftSecretRefusal(err);
+					logger.warn(`${logicalId} (${resource.resourceType}): ` + (refused ? "refused to resolve a dynamic reference this resource's state records, so its secret-bearing properties are NOT compared — " : "could not resolve the dynamic reference(s) this resource's state records, so its secret-bearing properties are NOT compared — ") + `${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+					secrets.clear();
+				}
+				if (unresolvedTokens.size > 0) logger.warn(`${logicalId} (${resource.resourceType}): cdkd cannot resolve ${maskSecretsInText([...unresolvedTokens].join(", "), secrets)} — those properties are NOT compared. A revert leaves a property whose WHOLE value is one of these tokens untouched; where a token is EMBEDDED in a longer string, the revert writes that string with the token literal, exactly as 'cdkd deploy' does — so a resolved value AWS holds there WOULD be overwritten. cdkd resolves 'secretsmanager' and 'ssm' references only.`);
+				const observedIgnorePaths = useObserved ? undeclaredEmptyObservedKeys(resource.observedProperties, resource.properties ?? {}) : [];
+				const normalized = await canonicalizePrincipalUniqueIds(comparisonBaseline, aws, resolvePrincipalUniqueId);
+				const protocolNormalized = canonicalizeIpProtocols(normalized.baseline, normalized.aws, resource.resourceType);
+				const canonicalized = provider.canonicalizeDriftProperties ? {
+					baseline: provider.canonicalizeDriftProperties(resource.resourceType, protocolNormalized.baseline),
+					aws: provider.canonicalizeDriftProperties(resource.resourceType, protocolNormalized.aws)
+				} : protocolNormalized;
+				const reported = redactDriftChanges(calculateResourceDrift(canonicalized.baseline, canonicalized.aws, {
+					ignorePaths: observedIgnorePaths.length ? [...ignorePaths, ...observedIgnorePaths] : ignorePaths,
+					unionWalkObjects: useObserved,
+					unorderedPaths
+				}), secrets, secretResolutionFailed ? seededSecretPaths : secretPaths);
+				const notComparedCause = secretResolutionFailed ? "refused" : unresolvedTokens.size > 0 ? "unresolvedToken" : void 0;
+				if (reported.changes.length === 0) if (notComparedCause !== void 0) outcomes.push({
+					kind: "notCompared",
+					logicalId,
+					resourceType: resource.resourceType,
+					notComparedCause
+				});
+				else outcomes.push({
+					kind: "clean",
+					logicalId,
+					resourceType: resource.resourceType
+				});
+				else outcomes.push({
+					kind: "drifted",
+					logicalId,
+					resourceType: resource.resourceType,
+					...reported,
+					awsProperties: aws,
+					secrets,
+					notComparedCause
+				});
+			} catch (err) {
+				if (isNoReadHandlerError(err)) {
+					logger.debug(`${logicalId} (${resource.resourceType}): read threw with a no-READ-handler signature, reported as drift unknown — ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
 					outcomes.push({
 						kind: "unsupported",
 						logicalId,
@@ -66335,87 +66540,16 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 					});
 					continue;
 				}
-				aws = stripCcApiAwsManagedFields(resource.resourceType, ccApiAws);
-			}
-			if (aws === void 0) {
 				outcomes.push({
-					kind: "unsupported",
+					kind: "notCompared",
 					logicalId,
-					resourceType: resource.resourceType
+					resourceType: resource.resourceType,
+					notComparedCause: "readFailed"
 				});
+				logger.warn(`${logicalId} (${resource.resourceType}): could not be compared — the read or comparison failed, so NONE of its properties were checked. Every other resource in this stack was still compared. ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+				if (err instanceof Error && err.stack) logger.debug(`${logicalId} (${resource.resourceType}): comparison failure detail`, maskSecretsInError(err, secrets).stack);
 				continue;
 			}
-			const ignorePaths = provider.getDriftUnknownPaths ? provider.getDriftUnknownPaths(resource.resourceType, resource.properties ?? {}) : [];
-			const unorderedPaths = provider.getDriftUnorderedPaths ? provider.getDriftUnorderedPaths(resource.resourceType) : [];
-			const useObserved = resource.observedProperties !== void 0;
-			const baseline = useObserved ? resource.observedProperties : resource.properties ?? {};
-			const secrets = /* @__PURE__ */ new Map();
-			const secretPaths = /* @__PURE__ */ new Set();
-			const seededSecretPaths = /* @__PURE__ */ new Set();
-			collectDynamicReferencePaths(baseline, seededSecretPaths);
-			if (useObserved) collectDynamicReferencePaths(resource.properties ?? {}, seededSecretPaths);
-			const unresolvedTokens = /* @__PURE__ */ new Set();
-			const noteUnresolved = (tokens) => {
-				for (const token of tokens) unresolvedTokens.add(token);
-			};
-			let comparisonBaseline = baseline;
-			let secretResolutionFailed = false;
-			try {
-				comparisonBaseline = await resolveStateSecretExpressions(baseline, secretResolvers, secrets, {
-					secretPaths,
-					onUnresolved: noteUnresolved,
-					logicalId,
-					consumerRegion: region,
-					producerRegions
-				});
-				if (useObserved) await resolveStateSecretExpressions(resource.properties ?? {}, secretResolvers, secrets, {
-					secretPaths,
-					onUnresolved: noteUnresolved,
-					logicalId,
-					consumerRegion: region,
-					producerRegions
-				});
-			} catch (err) {
-				secretResolutionFailed = true;
-				comparisonBaseline = baseline;
-				const refused = isDriftSecretRefusal(err);
-				logger.warn(`${logicalId} (${resource.resourceType}): ` + (refused ? "refused to resolve a dynamic reference this resource's state records, so its secret-bearing properties are NOT compared — " : "could not resolve the dynamic reference(s) this resource's state records, so its secret-bearing properties are NOT compared — ") + `${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
-				secrets.clear();
-			}
-			if (unresolvedTokens.size > 0) logger.warn(`${logicalId} (${resource.resourceType}): cdkd cannot resolve ${maskSecretsInText([...unresolvedTokens].join(", "), secrets)} — those properties are NOT compared. A revert leaves a property whose WHOLE value is one of these tokens untouched; where a token is EMBEDDED in a longer string, the revert writes that string with the token literal, exactly as 'cdkd deploy' does — so a resolved value AWS holds there WOULD be overwritten. cdkd resolves 'secretsmanager' and 'ssm' references only.`);
-			const observedIgnorePaths = useObserved ? undeclaredEmptyObservedKeys(resource.observedProperties, resource.properties ?? {}) : [];
-			const normalized = await canonicalizePrincipalUniqueIds(comparisonBaseline, aws, resolvePrincipalUniqueId);
-			const protocolNormalized = canonicalizeIpProtocols(normalized.baseline, normalized.aws, resource.resourceType);
-			const canonicalized = provider.canonicalizeDriftProperties ? {
-				baseline: provider.canonicalizeDriftProperties(resource.resourceType, protocolNormalized.baseline),
-				aws: provider.canonicalizeDriftProperties(resource.resourceType, protocolNormalized.aws)
-			} : protocolNormalized;
-			const reported = redactDriftChanges(calculateResourceDrift(canonicalized.baseline, canonicalized.aws, {
-				ignorePaths: observedIgnorePaths.length ? [...ignorePaths, ...observedIgnorePaths] : ignorePaths,
-				unionWalkObjects: useObserved,
-				unorderedPaths
-			}), secrets, secretResolutionFailed ? seededSecretPaths : secretPaths);
-			const notComparedCause = secretResolutionFailed ? "refused" : unresolvedTokens.size > 0 ? "unresolvedToken" : void 0;
-			if (reported.changes.length === 0) if (notComparedCause !== void 0) outcomes.push({
-				kind: "notCompared",
-				logicalId,
-				resourceType: resource.resourceType,
-				notComparedCause
-			});
-			else outcomes.push({
-				kind: "clean",
-				logicalId,
-				resourceType: resource.resourceType
-			});
-			else outcomes.push({
-				kind: "drifted",
-				logicalId,
-				resourceType: resource.resourceType,
-				...reported,
-				awsProperties: aws,
-				secrets,
-				notComparedCause
-			});
 		}
 		return {
 			stackName,
@@ -67445,10 +67579,11 @@ function writeJsonReport(reports) {
 				});
 			}
 		});
-		const notCompared = notComparedOutcomes(r).map((o) => ({
-			logicalId: o.logicalId,
-			type: o.resourceType,
-			referencesUnresolved: true
+		const notCompared = notComparedOutcomes(r).map(({ outcome, cause }) => ({
+			logicalId: outcome.logicalId,
+			type: outcome.resourceType,
+			referencesUnresolved: cause !== "readFailed",
+			cause
 		}));
 		return {
 			stack: r.stackName,
@@ -67467,6 +67602,7 @@ function writeHumanReport(reports) {
 		const drifted = [];
 		const unsupported = [];
 		let inspectedCount = 0;
+		let skippedCount = 0;
 		for (const o of report.outcomes) matchOutcome(o, {
 			drifted: (d) => {
 				drifted.push(d);
@@ -67475,7 +67611,9 @@ function writeHumanReport(reports) {
 			unsupported: (u) => {
 				unsupported.push(u);
 			},
-			skipped: () => {},
+			skipped: () => {
+				skippedCount += 1;
+			},
 			clean: () => {
 				inspectedCount += 1;
 			},
@@ -67486,7 +67624,8 @@ function writeHumanReport(reports) {
 		const inspected = inspectedCount;
 		const notCompared = notComparedOutcomes(report);
 		const checked = inspected - notCompared.length;
-		if (drifted.length === 0) if (notCompared.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but ${checked} of ${inspected} resource${inspected === 1 ? "" : "s"} fully checked (${notCompared.length} only partially compared), ${unsupported.length} unsupported\n`);
+		if (drifted.length === 0) if (notCompared.length === 0 && checked === 0 && report.outcomes.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but NOTHING was compared — 0 of ${report.outcomes.length} resource${report.outcomes.length === 1 ? "" : "s"} checked (${unsupported.length} unsupported, ${skippedCount} skipped)\n`);
+		else if (notCompared.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but ${checked} of ${inspected} resource${inspected === 1 ? "" : "s"} fully checked ` + (notCompared.some((n) => n.cause === "readFailed") ? `(${notCompared.length} not fully compared), ` : `(${notCompared.length} only partially compared), `) + `${unsupported.length} unsupported\n`);
 		else process.stdout.write(`✓ ${report.stackName} (${report.region}): no drift detected (${checked} resource${checked === 1 ? "" : "s"} checked, ${unsupported.length} unsupported)\n`);
 		else {
 			const word = drifted.length === 1 ? "resource" : "resources";
@@ -67501,8 +67640,10 @@ function writeHumanReport(reports) {
 			}
 		}
 		if (notCompared.length > 0) {
-			process.stdout.write(`\n  ${notCompared.length} resource(s) only PARTIALLY compared — cdkd could not, or refused to, resolve a dynamic reference their state records, so their secret-bearing properties were NOT compared:\n`);
-			for (const o of notCompared) process.stdout.write(`    ! ${o.logicalId} (${o.resourceType})\n`);
+			const readFailed = notCompared.filter((n) => n.cause === "readFailed").length;
+			const referenceCaused = notCompared.length - readFailed;
+			process.stdout.write(readFailed === 0 ? `\n  ${notCompared.length} resource(s) only PARTIALLY compared — cdkd could not, or refused to, resolve a dynamic reference their state records, so their secret-bearing properties were NOT compared:\n` : `\n  ${notCompared.length} resource(s) NOT fully compared — ${readFailed} not compared AT ALL (the read or comparison failed)` + (referenceCaused > 0 ? `, ${referenceCaused} only PARTIALLY compared (a dynamic reference cdkd could not, or refused to, resolve)` : "") + `:\n`);
+			for (const { outcome, cause } of notCompared) process.stdout.write(`    ! ${outcome.logicalId} (${outcome.resourceType}) — ${notComparedReason(cause)}\n`);
 		}
 		if (unsupported.length > 0) {
 			process.stdout.write(`\n  ${unsupported.length} resource(s) reported as drift unknown — provider does not yet support drift detection:\n`);
@@ -86637,7 +86778,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.45");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.47");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;