@go-to-k/cdkd 0.284.50 → 0.284.51

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $n as setAwsClients, Bt as DiffCalculator, Cr as normalizeAwsError, Gt as TemplateParser, Jn as clearBucketRegionCache, Jt as S3StateBackend, Kn as AssemblyReader, Kt as LockManager, Qn as resetAwsClients, Sr as isCdkdError, W as IAMRoleProvider, Wt as DagBuilder, Xn as AwsClients, Yn as resolveBucketRegion, Zn as getAwsClients, Zt as AssetPublisher, br as SynthesisError, er as AssetError, et as CloudControlProvider, ir as DependencyError, mr as ProvisioningError, nr as ConfigError, q as ProviderRegistry, r as DeployEngine, tr as CdkdError, ur as LockError, wn as Synthesizer, xr as formatError, yr as StateError } from "./deploy-engine-tBUjmzHn.js";
+import { $n as setAwsClients, Bt as DiffCalculator, Cr as normalizeAwsError, Gt as TemplateParser, Jn as clearBucketRegionCache, Jt as S3StateBackend, Kn as AssemblyReader, Kt as LockManager, Qn as resetAwsClients, Sr as isCdkdError, W as IAMRoleProvider, Wt as DagBuilder, Xn as AwsClients, Yn as resolveBucketRegion, Zn as getAwsClients, Zt as AssetPublisher, br as SynthesisError, er as AssetError, et as CloudControlProvider, ir as DependencyError, mr as ProvisioningError, nr as ConfigError, q as ProviderRegistry, r as DeployEngine, tr as CdkdError, ur as LockError, wn as Synthesizer, xr as formatError, yr as StateError } from "./deploy-engine-Dnp730rc.js";
 import { n as getLogger, r as setLogger, t as ConsoleLogger } from "./logger-zRrlbaQt.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-CMiO_i__.js → program-DjH_cfVU.js}

@@ -1,7 +1,7 @@
-import { $ as startInterruptWatch, $n as setAwsClients, $t as WorkGraph, A as renderStatefulReason, An as resolveCaptureObservedState, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as findLargeInlineResources, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as getDockerImageBySourceHash, Cr as normalizeAwsError, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as getLegacyStateBucketName, Dr as isThrottlingError, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as getDefaultStateBucketName, Er as isRetryableTransientError, Et as errorCauseChain, F as green, Fn as stateBucketExistenceConfirmed, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as derivePartitionAndUrlSuffix, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as expectedOwnerParam, Ht as describeTypeWithThrottleRetry, I as red, In as warnDeprecatedNoPrefixCliFlag, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jt as S3StateBackend, K as clearOnUpdateRemoval, Kn as AssemblyReader, Kt as LockManager, L as yellow, Ln as CFN_TEMPLATE_BODY_LIMIT, Lt as s3BucketRegionalDomainName, M as bold, Mn as resolveStateBucketWithDefault, Mt as classifyReplaySecretRegion, N as cyan, Nn as resolveStateBucketWithDefaultAndSource, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveApp, Or as markNonRetryable, Ot as maskSecretsInError, P as gray, Pn as resolveUseCdkBootstrapAssets, Pt as s3BucketArn, Q as isInterruptedWaitError, Qn as resetAwsClients, Qt as stringifyValue, R as collectDeclaredOutputNames, Rn as CFN_TEMPLATE_URL_LIMIT, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as AssetManifestLoader, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as synthesisStatusMessage, Tr as isMarkedNonRetryable, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as PARTITION_TABLE, Ut as withRetry, V as isExportAliasCollision, Vn as uploadCfnTemplate, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as canonicalizeRegion, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as AwsClients, Xt as shouldRetainResource, Y as findSilentDropProperties, Yn as resolveBucketRegion, Yt as rebuildClientForBucketRegion, Z as endCommandInterruptScope, Zn as getAwsClients, Zt as AssetPublisher, _ as computeImplicitDeleteEdges, _n as formatDockerLoginError, _r as StackHasActiveImportsError, _t as replayWarn, a as DeploymentEventsStore, an as stripControlChars, ar as DeployCancelledError, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as runDockerForeground, bt as requireConfigString, c as replayFailedOperations, cn as ensureAssetStorage, cr as LocalMigrateError, ct as refStateLookupFromResource, d as updatePartialReason, dn as readBootstrapMarkerBody, dr as MissingCdkCliError, dt as resolveExplicitPhysicalId, en as buildAssetRedirectMap, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateAssetBucketName, fr as NestedStackChildDirectDestroyError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as dockerSpawnEnvWithSensitive, gr as ResourceUpdateNotSupportedError, gt as readConfigString, h as maskingRetryLogger, hn as buildDockerImage, hr as ResourceTimeoutError, ht as configStringRefusal, i as DeploymentEventsReader, in as escapeRegExp, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveSkipPrefix, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveAutoAssetStorage, kt as maskSecretsInText, l as replayRollback, ln as getBootstrapMarkerKey, lr as LocalStartServiceError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDenyExternalAccessPolicy, mr as ProvisioningError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as loadPublishableAssetManifest, nt as disableInstanceApiTermination, o as planFailedOps, on as AssetModeResolver, or as DynamicReferenceRegionAmbiguousError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as validateContainerRepoName, pr as PartialFailureError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as processStackMessages, qt as displaySafe, r as DeployEngine, rn as rewriteTemplateAssetReferences, rr as CrossAccountSecretRefusalError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as BOOTSTRAP_MARKER_PREFIX, sr as LocalInvokeBuildError$1, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as createAssetRedirectResolver, tr as CdkdError, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as parseBootstrapMarker, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as getDockerCmd, vr as StackTerminationProtectionError, vt as requireConfigArray, w as refusesFinalSnapshot, wn as Synthesizer, wr as withErrorHandling, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as runDockerStreaming, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as partitionSensitiveEnv, yt as requireConfigObject, z as collectPublishedOutputNames, zn as MIGRATE_TMP_PREFIX, zt as applyRoleArnIfSet } from "./deploy-engine-tBUjmzHn.js";
+import { $ as startInterruptWatch, $n as setAwsClients, $t as WorkGraph, A as renderStatefulReason, An as resolveCaptureObservedState, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as findLargeInlineResources, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as getDockerImageBySourceHash, Cr as normalizeAwsError, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as getLegacyStateBucketName, Dr as isThrottlingError, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as getDefaultStateBucketName, Er as isRetryableTransientError, Et as errorCauseChain, F as green, Fn as stateBucketExistenceConfirmed, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as derivePartitionAndUrlSuffix, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as expectedOwnerParam, Ht as describeTypeWithThrottleRetry, I as red, In as warnDeprecatedNoPrefixCliFlag, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jt as S3StateBackend, K as clearOnUpdateRemoval, Kn as AssemblyReader, Kt as LockManager, L as yellow, Ln as CFN_TEMPLATE_BODY_LIMIT, Lt as s3BucketRegionalDomainName, M as bold, Mn as resolveStateBucketWithDefault, Mt as classifyReplaySecretRegion, N as cyan, Nn as resolveStateBucketWithDefaultAndSource, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveApp, Or as markNonRetryable, Ot as maskSecretsInError, P as gray, Pn as resolveUseCdkBootstrapAssets, Pt as s3BucketArn, Q as isInterruptedWaitError, Qn as resetAwsClients, Qt as stringifyValue, R as collectDeclaredOutputNames, Rn as CFN_TEMPLATE_URL_LIMIT, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as AssetManifestLoader, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as synthesisStatusMessage, Tr as isMarkedNonRetryable, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as PARTITION_TABLE, Ut as withRetry, V as isExportAliasCollision, Vn as uploadCfnTemplate, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as canonicalizeRegion, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as AwsClients, Xt as shouldRetainResource, Y as findSilentDropProperties, Yn as resolveBucketRegion, Yt as rebuildClientForBucketRegion, Z as endCommandInterruptScope, Zn as getAwsClients, Zt as AssetPublisher, _ as computeImplicitDeleteEdges, _n as formatDockerLoginError, _r as StackHasActiveImportsError, _t as replayWarn, a as DeploymentEventsStore, an as stripControlChars, ar as DeployCancelledError, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as runDockerForeground, bt as requireConfigString, c as replayFailedOperations, cn as ensureAssetStorage, cr as LocalMigrateError, ct as refStateLookupFromResource, d as updatePartialReason, dn as readBootstrapMarkerBody, dr as MissingCdkCliError, dt as resolveExplicitPhysicalId, en as buildAssetRedirectMap, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateAssetBucketName, fr as NestedStackChildDirectDestroyError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as dockerSpawnEnvWithSensitive, gr as ResourceUpdateNotSupportedError, gt as readConfigString, h as maskingRetryLogger, hn as buildDockerImage, hr as ResourceTimeoutError, ht as configStringRefusal, i as DeploymentEventsReader, in as escapeRegExp, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveSkipPrefix, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveAutoAssetStorage, kt as maskSecretsInText, l as replayRollback, ln as getBootstrapMarkerKey, lr as LocalStartServiceError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDenyExternalAccessPolicy, mr as ProvisioningError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as loadPublishableAssetManifest, nt as disableInstanceApiTermination, o as planFailedOps, on as AssetModeResolver, or as DynamicReferenceRegionAmbiguousError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as validateContainerRepoName, pr as PartialFailureError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as processStackMessages, qt as displaySafe, r as DeployEngine, rn as rewriteTemplateAssetReferences, rr as CrossAccountSecretRefusalError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as BOOTSTRAP_MARKER_PREFIX, sr as LocalInvokeBuildError$1, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as createAssetRedirectResolver, tr as CdkdError, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as parseBootstrapMarker, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as getDockerCmd, vr as StackTerminationProtectionError, vt as requireConfigArray, w as refusesFinalSnapshot, wn as Synthesizer, wr as withErrorHandling, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as runDockerStreaming, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as partitionSensitiveEnv, yt as requireConfigObject, z as collectPublishedOutputNames, zn as MIGRATE_TMP_PREFIX, zt as applyRoleArnIfSet } from "./deploy-engine-Dnp730rc.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as getCdkdVersion } from "./version-pYF8nPNw.js";
-import { t as ASGProvider } from "./asg-provider-tVXU-L28.js";
+import { t as getCdkdVersion } from "./version-CJG_PFNb.js";
+import { t as ASGProvider } from "./asg-provider-CynKJdi4.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -65809,6 +65809,10 @@ var DriftDetectedError = class DriftDetectedError extends CdkdError {
 * a partially-failed `--revert` still exits 2 through `PartialFailureError`) --
 * those modes report per-resource refusals on their own paths, and changing them
 * would alter what a remediation run means, which is not what this closes.
+* Issue [#2208](https://github.com/go-to-k/cdkd/issues/2208) re-examined that
+* scoping and KEPT it: what those modes owed was not this exit code but an
+* honest SENTENCE, since their no-drift line claimed a clean bill of health for
+* a stack they had not read. See {@link incompleteRemediationMessage}.
 *
 * WHAT DOES NOT TRIGGER IT: a stack whose properties reference
 * `{{resolve:ssm-secure:...}}` still exits 0. Those properties genuinely are not
@@ -65903,6 +65907,171 @@ function outcomeExitSignal(outcome) {
 	});
 }
 /**
+* What {@link incompleteRemediationMessage} says about each reason, and WHICH
+* CLAIM it is allowed to make about it.
+*
+* An exhaustive `Record`, for the same reason {@link notComparedReason} is one:
+* adding a cause must be a COMPILE ERROR here rather than falling into an
+* `else` that describes it as something it is not. The first cut of this
+* function had that `else`, and it was worse than a wrong default -- it
+* described any unknown cause as a dynamic-reference problem, while
+* {@link outcomeExitSignal} deliberately routes every NEW cause to the
+* incomplete side. The two together meant the next cause added would be
+* reported, at once, to the widest audience and under the wrong name. Carrying
+* `kind` in the SAME record rather than a second one beside it means a new
+* reason cannot be given a phrase while quietly inheriting a claim.
+*
+* `kind` exists because one blanket tail overclaimed. The line used to end
+* `..., so cdkd does not know whether they drifted`, which is true of a
+* throttled read and FALSE of a `Custom::*` resource -- for that one, issue
+* [#323](https://github.com/go-to-k/cdkd/issues/323)'s position is that drift is
+* not APPLICABLE, not that cdkd is uncertain. A stack with one throttle and five
+* `Custom::S3AutoDeleteObjects` would have claimed uncertainty about all six.
+*
+* The insertion ORDER is the order the phrases are emitted in, so the line is
+* deterministic without a second list to keep in sync: "not compared at all"
+* first, then the partial ones, then the two structural reasons.
+*
+* The wording splits on "was ANY of it compared", which is the same split the
+* human report's `NOT fully compared` heading makes -- a `readFailed` resource
+* is not "partially" anything.
+*/
+const UNCOMPARED_REASONS = {
+	readFailed: {
+		kind: "unknown",
+		phrase: "not compared AT ALL: the read or comparison failed"
+	},
+	refused: {
+		kind: "unknown",
+		phrase: "only PARTIALLY compared: cdkd refused to resolve a dynamic reference their state records"
+	},
+	unresolvedToken: {
+		kind: "unknown",
+		phrase: "only PARTIALLY compared: their state records a `{{resolve:...}}` spelling cdkd resolves for nobody, which no re-run can clear"
+	},
+	unsupported: {
+		kind: "byDesign",
+		phrase: "not compared AT ALL: their provider does not support drift detection yet"
+	},
+	skipped: {
+		kind: "byDesign",
+		phrase: "not compared AT ALL: cdkd does not drift-check the type"
+	}
+};
+/**
+* The sentence lead each {@link UncomparedKind} group is reported under.
+*
+* Exhaustive for the same reason the record above is, and SEPARATE from it
+* because the lead is per GROUP while the phrase is per reason: writing the
+* claim into each phrase would put five copies of two sentences in the file,
+* and five copies is how two of them come to disagree.
+*
+* Insertion order is emit order, and `unknown` comes first deliberately: it is
+* the half the user can do something about.
+*/
+const UNCOMPARED_KIND_LEADS = {
+	unknown: "cdkd does not know whether these drifted",
+	byDesign: "Not drift-checked by cdkd at all, which is a coverage limit rather than uncertainty"
+};
+/**
+* How many resources across every report ended UNCOMPARED, per reason.
+*
+* The `notCompared` population is read through {@link notComparedOutcomes} --
+* the single spelling both renderings already share -- and the other two come
+* from an exhaustive `matchOutcome`, so a new outcome variant cannot join the
+* "nothing to say about it" side by omission. That is the same guarantee
+* {@link outcomeExitSignal} carries at the exit code, applied to the count.
+*/
+function uncomparedTally(reports) {
+	const tally = /* @__PURE__ */ new Map();
+	const bump = (reason) => {
+		tally.set(reason, (tally.get(reason) ?? 0) + 1);
+	};
+	for (const report of reports) {
+		for (const { cause } of notComparedOutcomes(report)) bump(cause);
+		for (const outcome of report.outcomes) matchOutcome(outcome, {
+			drifted: () => {},
+			clean: () => {},
+			notCompared: () => {},
+			unsupported: () => bump("unsupported"),
+			skipped: () => bump("skipped")
+		});
+	}
+	return tally;
+}
+/**
+* The lines `--accept` / `--revert` print INSTEAD of `No drift detected --
+* nothing to accept.` when the run found no drift but did not manage to compare
+* everything ([issue #2208](https://github.com/go-to-k/cdkd/issues/2208)).
+*
+* MESSAGE-ONLY, and the EXIT CODE deliberately stays `0`. The remediation
+* modes' exit codes are a documented user contract -- #2108 scoped its `2` to
+* detection-only mode on purpose, and {@link DriftComparisonIncompleteError}'s
+* note says why: "changing them would alter what a remediation run means".
+* Nothing about that reasoning expired. The defect this closes is entirely in
+* what the run REPORTS: `--accept` / `--revert` already correctly leave an
+* uncompared resource alone (both iterate the drifted outcomes only, asserted
+* in `tests/unit/cli/drift-per-resource-failure.test.ts`), so the state and AWS
+* are right and only the sentence is wrong. Making the remediation path exit
+* non-zero would break the CI of everyone running `cdkd drift --accept` over a
+* stack that hits a throttle, to fix a wording problem.
+*
+* What the lines have to carry, since the exit code will not carry it: that the
+* comparison was INCOMPLETE (never that no drift was detected), HOW MANY
+* resources were not compared and WHY, WHICH of those cdkd is actually
+* uncertain about, and the pointer to the detection-only run, which is the mode
+* whose exit code does report it (`2`).
+*
+* THE TRIGGER AND THE COUNT ARE DIFFERENT POPULATIONS, deliberately, and
+* collapsing them is the defect review round 1 found here.
+*
+*   - The TRIGGER is `anyIncomplete`, i.e. {@link outcomeExitSignal}'s
+*     `incomplete`. It is narrow on purpose: a stack whose ONLY uncompared
+*     resource holds a `{{resolve:ssm-secure:...}}` token must not start
+*     shouting on every run about a comparison no action of the user's can ever
+*     complete -- the same CI-forever hazard that cause is kept out of the exit
+*     code on.
+*   - The COUNT and the LABELS, once the line is triggered, cover EVERY
+*     uncompared resource, each named by its own reason (see
+*     {@link uncomparedTally}). A resource that was not compared was not
+*     compared, whatever the reason, and counting only the clearable ones
+*     printed `1 of 3` on a stack the report a few lines above called
+*     `2 resource(s) NOT fully compared` -- two lines disagreeing about one
+*     run, with the newer and quieter one being the one written to stop a
+*     command from being quietly reassuring.
+*
+* WHAT `N` AND `M` ARE, stated because the alternatives are all defensible and
+* silence about the choice is what made the first cut wrong. `M` is the total
+* number of resource outcomes, and `N` is every one of them that was not
+* compared -- so `unsupported` and `skipped` land in `N`, WITH their own
+* phrase, rather than sitting only in the denominator where they would inflate
+* `M` and go unnamed. On a remediation path, erring LOUD is the correct
+* direction. Note this makes `N` deliberately WIDER than the report's
+* `NOT fully compared` heading, which counts the reference / read population
+* only and reports `drift unknown` separately: the question this line answers
+* is #2154's, "was everything actually compared", not "how many entries are in
+* that block". What being in `N` does NOT buy is a uniform claim about the
+* resource -- see {@link UNCOMPARED_REASONS}'s `kind`, and see
+* {@link UncomparedReason} for why counting a `skipped` resource here is not a
+* reversal of #323's silence.
+*/
+function incompleteRemediationMessage(reports, mode) {
+	const tally = uncomparedTally(reports);
+	const total = reports.reduce((n, report) => n + report.outcomes.length, 0);
+	const uncompared = [...tally.values()].reduce((a, b) => a + b, 0);
+	const kinds = Object.keys(UNCOMPARED_KIND_LEADS);
+	const reasons = Object.keys(UNCOMPARED_REASONS);
+	const groups = kinds.flatMap((kind) => {
+		const parts = reasons.filter((reason) => UNCOMPARED_REASONS[reason].kind === kind && (tally.get(reason) ?? 0) > 0).map((reason) => `${tally.get(reason)} ${UNCOMPARED_REASONS[reason].phrase}`);
+		return parts.length === 0 ? [] : [`${UNCOMPARED_KIND_LEADS[kind]} — ${parts.join("; ")}.`];
+	});
+	return [
+		`Comparison INCOMPLETE — nothing to ${mode}, and that is NOT a clean bill of health: ${uncompared} of ${total} resource(s) could not be compared.`,
+		...groups,
+		`Re-run 'cdkd drift' without --${mode} to see which resources and why — a detection-only run exits 2 while a comparison is incomplete.`
+	];
+}
+/**
 * `cdkd drift [<stack>...]` command implementation.
 *
 * Three operating modes (mutually exclusive):
@@ -65979,6 +66148,10 @@ async function driftCommand(stacks, options) {
 			return;
 		}
 		if (!drifted) {
+			if (anyIncomplete) {
+				for (const line of incompleteRemediationMessage(reports, options.accept ? "accept" : "revert")) logger.info(line);
+				return;
+			}
 			logger.info(options.accept ? "No drift detected — nothing to accept." : "No drift detected — nothing to revert.");
 			return;
 		}
@@ -87059,4 +87232,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CMiO_i__.js.map
+//# sourceMappingURL=program-DjH_cfVU.js.map