@go-to-k/cdkd 0.284.63 → 0.284.64

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $t as S3StateBackend, Ar as SynthesisError, G as IAMRoleProvider, Gt as DiffCalculator, J as ProviderRegistry, Mr as isCdkdError, Nr as normalizeAwsError, Pn as Synthesizer, Xt as TemplateParser, Yt as DagBuilder, Zt as LockManager, an as AssetPublisher, ar as resolveBucketRegion, br as LockError, cr as resetAwsClients, dr as CdkdError, fr as ConfigError, ir as clearBucketRegionCache, it as CloudControlProvider, jr as formatError, kr as StateError, lr as setAwsClients, mr as DependencyError, nr as AssemblyReader, or as AwsClients, r as DeployEngine, sr as getAwsClients, ur as AssetError, wr as ProvisioningError } from "./deploy-engine-B-RuozdO.js";
+import { $t as S3StateBackend, Ar as SynthesisError, G as IAMRoleProvider, Gt as DiffCalculator, J as ProviderRegistry, Mr as isCdkdError, Nr as normalizeAwsError, Pn as Synthesizer, Xt as TemplateParser, Yt as DagBuilder, Zt as LockManager, an as AssetPublisher, ar as resolveBucketRegion, br as LockError, cr as resetAwsClients, dr as CdkdError, fr as ConfigError, ir as clearBucketRegionCache, it as CloudControlProvider, jr as formatError, kr as StateError, lr as setAwsClients, mr as DependencyError, nr as AssemblyReader, or as AwsClients, r as DeployEngine, sr as getAwsClients, ur as AssetError, wr as ProvisioningError } from "./deploy-engine-BtqjWvh5.js";
 import { n as getLogger, r as setLogger, t as ConsoleLogger } from "./logger-zRrlbaQt.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-alOnKpLV.js → program-I-xR_ceK.js}

@@ -1,7 +1,7 @@
-import { $ as beginCommandInterruptScope, $n as PARTITION_TABLE, $t as S3StateBackend, A as renderStatefulReason, An as runDockerForeground, At as dynamicReferenceTokens, B as exportAliasCollisionScrubWarning, Bn as resolveCaptureObservedState, Bt as s3BucketDomainName, C as isFinalSnapshotError, Cn as validateContainerRepoName, Cr as PartialFailureError, Ct as requireConfigArray, D as extractDeploymentEventError, Dn as formatDockerLoginError, Dr as StackHasActiveImportsError, Dt as STATE_SOURCED_READBACK_RULES, E as makeCanonicalizePropertiesFn, En as dockerSpawnEnvWithSensitive, Er as ResourceUpdateNotSupportedError, Et as STATE_SOURCED_CROSS_GENERATION_RULES, F as green, Fn as synthesisStatusMessage, Fr as isMarkedNonRetryable, Ft as redactSecretsForState, G as IAMRoleProvider, Gn as stateBucketExistenceConfirmed, Gt as DiffCalculator, H as secretBearingStateKeyWarning, Hn as resolveStateBucketWithDefault, Ht as s3BucketRegionalDomainName, I as red, In as getDefaultStateBucketName, Ir as isRetryableTransientError, It as scrubResourceRecord, J as ProviderRegistry, Jn as CFN_TEMPLATE_URL_LIMIT, Jt as withRetry, K as collectInlinePolicyNamesManagedBySiblings, Kn as warnDeprecatedNoPrefixCliFlag, Kt as INTRINSIC_KEYS, L as yellow, Ln as getLegacyStateBucketName, Lr as isThrottlingError, Lt as classifyReplaySecretRegion, M as bold, Mn as AssetManifestLoader, Mt as isSingleDynamicReferenceToken, N as cyan, Nn as getDockerImageBySourceHash, Nr as normalizeAwsError, Nt as maskSecretsInError, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as getDockerCmd, Or as StackTerminationProtectionError, Ot as TEMPLATE_SOURCED_RULES, P as gray, Pn as Synthesizer, Pr as withErrorHandling, Pt as maskSecretsInText, Q as DEFAULT_STATE_PREFIX, Qn as expectedOwnerParam, Qt as displaySafe, R as collectDeclaredOutputNames, Rn as resolveApp, Rr as markNonRetryable, Rt as producerRegionsFromState, S as createPreDeleteFinalSnapshot, Sn as validateAssetBucketName, Sr as NestedStackChildDirectDestroyError, St as replayWarn, T as unsupportedFinalSnapshotError, Tn as buildDockerImage, Tr as ResourceTimeoutError, Tt as requireConfigString, U as stateKeySecretExposure, Un as resolveStateBucketWithDefaultAndSource, Ut as s3BucketWebsiteUrl, V as isExportAliasCollision, Vn as resolveSkipPrefix, Vt as s3BucketDualStackDomainName, W as getCurrentResourceSecrets, Wn as resolveUseCdkBootstrapAssets, Wt as applyRoleArnIfSet, X as findSilentDropProperties, Xn as findLargeInlineResources, Xt as TemplateParser, Y as findActionableSilentDrops, Yn as MIGRATE_TMP_PREFIX, Yt as DagBuilder, Z as CUSTOM_RESOURCE_RESPONSE_PREFIX, Zn as uploadCfnTemplate, Zt as LockManager, _ as computeImplicitDeleteEdges, _n as ensureAssetStorage, _r as LocalInvokeBuildError$1, _t as assertRegionMatch, a as DeploymentEventsStore, an as AssetPublisher, ar as resolveBucketRegion, at as slowCcOperationTimeoutMs, b as buildFinalSnapshotIdentifier, bn as parseBootstrapMarker, bt as configStringRefusal, c as replayFailedOperations, cn as buildAssetRedirectMap, cr as resetAwsClients, ct as IntrinsicFunctionResolver, d as updatePartialReason, dn as rewriteTemplateAssetReferences, dr as CdkdError, dt as getAccountInfo, en as rebuildClientForBucketRegion, er as canonicalizeRegion, et as endCommandInterruptScope, f as UNSPECIFIED_SKIP_REASON, fn as escapeRegExp, ft as parameterTypeMayLoseSecretIdentity, g as IMPLICIT_DELETE_DEPENDENCIES, gn as assertAssetBucketRegion, gr as DynamicReferenceRegionAmbiguousError, gt as resolveExplicitPhysicalId, h as maskingRetryLogger, hn as BOOTSTRAP_MARKER_PREFIX, hr as DeployCancelledError, ht as normalizeAwsTagsToCfn, i as DeploymentEventsReader, in as shouldRetainResource, it as CloudControlProvider, j as formatResourceLine, jn as runDockerStreaming, jt as errorCauseChain, k as isStatefulRecreateTargetSync, kn as partitionSensitiveEnv, kt as createSecretMasker, l as replayRollback, ln as createAssetRedirectResolver, lr as setAwsClients, lt as carriesDynamicReference, m as withResourceDeadline, mn as AssetModeResolver, mt as WAFv2WebACLProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as importableOutputKeys, nr as AssemblyReader, nt as isInterruptedWaitError, o as planFailedOps, on as stringifyValue, or as AwsClients, ot as disableInstanceApiTermination, p as deleteSkipReason, pn as stripControlChars, pr as CrossAccountSecretRefusalError, pt as refStateLookupFromResource, q as clearOnUpdateRemoval, qn as CFN_TEMPLATE_BODY_LIMIT, qt as describeTypeWithThrottleRetry, r as DeployEngine, rn as importableOutputs, rr as processStackMessages, rt as startInterruptWatch, s as planRollback, sn as WorkGraph, sr as getAwsClients, st as isTerminationProtectionPropagationError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as exportNamesCarriedFrom, tr as derivePartitionAndUrlSuffix, tt as interruptWatchListenerCount, u as updatePartialMessage, un as loadPublishableAssetManifest, ut as cfnRefValueFromPhysicalId, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as getBootstrapMarkerKey, vr as LocalMigrateError, vt as coerceCfnBoolean, w as refusesFinalSnapshot, wn as buildDenyExternalAccessPolicy, wr as ProvisioningError, wt as requireConfigObject, x as ccRoutedFinalSnapshotError, xn as readBootstrapMarkerBody, xr as MissingCdkCliError, xt as readConfigString, y as PRE_DELETE_SNAPSHOT_TYPES, yn as isCrossRegionRedirect, yr as LocalStartServiceError, yt as configBooleanRefusal, z as collectPublishedOutputNames, zn as resolveAutoAssetStorage, zt as s3BucketArn } from "./deploy-engine-B-RuozdO.js";
+import { $ as beginCommandInterruptScope, $n as PARTITION_TABLE, $t as S3StateBackend, A as renderStatefulReason, An as runDockerForeground, At as dynamicReferenceTokens, B as exportAliasCollisionScrubWarning, Bn as resolveCaptureObservedState, Bt as s3BucketDomainName, C as isFinalSnapshotError, Cn as validateContainerRepoName, Cr as PartialFailureError, Ct as requireConfigArray, D as extractDeploymentEventError, Dn as formatDockerLoginError, Dr as StackHasActiveImportsError, Dt as STATE_SOURCED_READBACK_RULES, E as makeCanonicalizePropertiesFn, En as dockerSpawnEnvWithSensitive, Er as ResourceUpdateNotSupportedError, Et as STATE_SOURCED_CROSS_GENERATION_RULES, F as green, Fn as synthesisStatusMessage, Fr as isMarkedNonRetryable, Ft as redactSecretsForState, G as IAMRoleProvider, Gn as stateBucketExistenceConfirmed, Gt as DiffCalculator, H as secretBearingStateKeyWarning, Hn as resolveStateBucketWithDefault, Ht as s3BucketRegionalDomainName, I as red, In as getDefaultStateBucketName, Ir as isRetryableTransientError, It as scrubResourceRecord, J as ProviderRegistry, Jn as CFN_TEMPLATE_URL_LIMIT, Jt as withRetry, K as collectInlinePolicyNamesManagedBySiblings, Kn as warnDeprecatedNoPrefixCliFlag, Kt as INTRINSIC_KEYS, L as yellow, Ln as getLegacyStateBucketName, Lr as isThrottlingError, Lt as classifyReplaySecretRegion, M as bold, Mn as AssetManifestLoader, Mt as isSingleDynamicReferenceToken, N as cyan, Nn as getDockerImageBySourceHash, Nr as normalizeAwsError, Nt as maskSecretsInError, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as getDockerCmd, Or as StackTerminationProtectionError, Ot as TEMPLATE_SOURCED_RULES, P as gray, Pn as Synthesizer, Pr as withErrorHandling, Pt as maskSecretsInText, Q as DEFAULT_STATE_PREFIX, Qn as expectedOwnerParam, Qt as displaySafe, R as collectDeclaredOutputNames, Rn as resolveApp, Rr as markNonRetryable, Rt as producerRegionsFromState, S as createPreDeleteFinalSnapshot, Sn as validateAssetBucketName, Sr as NestedStackChildDirectDestroyError, St as replayWarn, T as unsupportedFinalSnapshotError, Tn as buildDockerImage, Tr as ResourceTimeoutError, Tt as requireConfigString, U as stateKeySecretExposure, Un as resolveStateBucketWithDefaultAndSource, Ut as s3BucketWebsiteUrl, V as isExportAliasCollision, Vn as resolveSkipPrefix, Vt as s3BucketDualStackDomainName, W as getCurrentResourceSecrets, Wn as resolveUseCdkBootstrapAssets, Wt as applyRoleArnIfSet, X as findSilentDropProperties, Xn as findLargeInlineResources, Xt as TemplateParser, Y as findActionableSilentDrops, Yn as MIGRATE_TMP_PREFIX, Yt as DagBuilder, Z as CUSTOM_RESOURCE_RESPONSE_PREFIX, Zn as uploadCfnTemplate, Zt as LockManager, _ as computeImplicitDeleteEdges, _n as ensureAssetStorage, _r as LocalInvokeBuildError$1, _t as assertRegionMatch, a as DeploymentEventsStore, an as AssetPublisher, ar as resolveBucketRegion, at as slowCcOperationTimeoutMs, b as buildFinalSnapshotIdentifier, bn as parseBootstrapMarker, bt as configStringRefusal, c as replayFailedOperations, cn as buildAssetRedirectMap, cr as resetAwsClients, ct as IntrinsicFunctionResolver, d as updatePartialReason, dn as rewriteTemplateAssetReferences, dr as CdkdError, dt as getAccountInfo, en as rebuildClientForBucketRegion, er as canonicalizeRegion, et as endCommandInterruptScope, f as UNSPECIFIED_SKIP_REASON, fn as escapeRegExp, ft as parameterTypeMayLoseSecretIdentity, g as IMPLICIT_DELETE_DEPENDENCIES, gn as assertAssetBucketRegion, gr as DynamicReferenceRegionAmbiguousError, gt as resolveExplicitPhysicalId, h as maskingRetryLogger, hn as BOOTSTRAP_MARKER_PREFIX, hr as DeployCancelledError, ht as normalizeAwsTagsToCfn, i as DeploymentEventsReader, in as shouldRetainResource, it as CloudControlProvider, j as formatResourceLine, jn as runDockerStreaming, jt as errorCauseChain, k as isStatefulRecreateTargetSync, kn as partitionSensitiveEnv, kt as createSecretMasker, l as replayRollback, ln as createAssetRedirectResolver, lr as setAwsClients, lt as carriesDynamicReference, m as withResourceDeadline, mn as AssetModeResolver, mt as WAFv2WebACLProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as importableOutputKeys, nr as AssemblyReader, nt as isInterruptedWaitError, o as planFailedOps, on as stringifyValue, or as AwsClients, ot as disableInstanceApiTermination, p as deleteSkipReason, pn as stripControlChars, pr as CrossAccountSecretRefusalError, pt as refStateLookupFromResource, q as clearOnUpdateRemoval, qn as CFN_TEMPLATE_BODY_LIMIT, qt as describeTypeWithThrottleRetry, r as DeployEngine, rn as importableOutputs, rr as processStackMessages, rt as startInterruptWatch, s as planRollback, sn as WorkGraph, sr as getAwsClients, st as isTerminationProtectionPropagationError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as exportNamesCarriedFrom, tr as derivePartitionAndUrlSuffix, tt as interruptWatchListenerCount, u as updatePartialMessage, un as loadPublishableAssetManifest, ut as cfnRefValueFromPhysicalId, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as getBootstrapMarkerKey, vr as LocalMigrateError, vt as coerceCfnBoolean, w as refusesFinalSnapshot, wn as buildDenyExternalAccessPolicy, wr as ProvisioningError, wt as requireConfigObject, x as ccRoutedFinalSnapshotError, xn as readBootstrapMarkerBody, xr as MissingCdkCliError, xt as readConfigString, y as PRE_DELETE_SNAPSHOT_TYPES, yn as isCrossRegionRedirect, yr as LocalStartServiceError, yt as configBooleanRefusal, z as collectPublishedOutputNames, zn as resolveAutoAssetStorage, zt as s3BucketArn } from "./deploy-engine-BtqjWvh5.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as getCdkdVersion } from "./version-Cmw63bLc.js";
-import { t as ASGProvider } from "./asg-provider-B9V61Fbq.js";
+import { t as getCdkdVersion } from "./version-BtSUTHs5.js";
+import { t as ASGProvider } from "./asg-provider-DGJz_iFy.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -65184,7 +65184,7 @@ function makeCrossStackPrePass(deps) {
 			try {
 				loaded = await backend.getState(producer.stack, producer.region);
 			} catch (err) {
-				logger.debug(`Scrub of ${stackName}: could not re-read producer '${producer.stack}' (${producer.region}) to classify its stored value: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+				logger.debug(`Scrub of ${stackName}: could not re-read producer '${maskSecretsInText(producer.stack, secrets)}' (${producer.region}) to classify its stored value: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
 				return;
 			}
 			const outputs = loaded?.state?.outputs;
@@ -65197,15 +65197,16 @@ function makeCrossStackPrePass(deps) {
 				recordedImports: [],
 				recordedOutputReads: []
 			};
+			const where = `${key} in ${origin}${path ? ` at ${path}` : ""}`;
 			try {
 				await resolver.resolve({ [key]: node[key] }, probe);
 			} catch (err) {
 				if (!nodeCanRefuse) {
-					logger.debug(`Scrub of ${stackName}: ${key} in ${origin}${path ? ` at ${path}` : ""} could not be resolved, and this position cannot refuse: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+					logger.debug(`Scrub of ${stackName}: ${where} could not be resolved, and this position cannot refuse: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
 					return;
 				}
 				if (isByDesignRefusal(err)) {
-					const detail = `${key} in ${origin}${path ? ` at ${path}` : ""}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`;
+					const detail = `${where}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`;
 					findings.unverifiable.push(detail);
 					logger.warn(`Scrub of ${stackName} cannot verify ${detail} — cdkd declines this read by design, so no re-run can change it. The rest of the stack is still scrubbed; this stack is NOT reported clean.`);
 					return;
@@ -65213,19 +65214,36 @@ function makeCrossStackPrePass(deps) {
 				throw unresolvableCrossStackReadError(origin, stackName, key, path, err, secrets);
 			}
 			const producer = recordedProducer(key, probe);
-			if (!producer) return;
-			if (!producerTemplates.has(producer.stack)) return;
+			if (!producer) {
+				logger.debug(`Scrub of ${stackName}: ${where} resolved, but the resolver recorded no cdkd cross-stack read for it — the value came from a CloudFormation fallback or a cross-account arm that records nothing, so scrub cannot name a producer to classify. Not classified as a plaintext producer.`);
+				return;
+			}
+			const loggedKey = maskSecretsInText(producer.key, secrets);
+			const loggedStack = maskSecretsInText(producer.stack, secrets);
+			if (!producerTemplates.has(producer.stack)) {
+				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}' (${producer.region}), which is not a stack of this app — scrub has no template to classify export '${loggedKey}' with. Not classified as a plaintext producer.`);
+				return;
+			}
 			const verdict = secretExpressionVerdict(producer.stack, producer.key);
-			if (verdict.kind === "no") return;
+			if (verdict.kind === "no") {
+				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}', whose template declares no {{resolve:...}} expression for '${loggedKey}' and no re-export chain reaching one. Not classified as a plaintext producer.`);
+				return;
+			}
 			const stored = await storedProducerValue(producer, context.stateBackend);
-			if (!stored) return;
-			if (carriesDynamicReference(stored.stored)) return;
+			if (!stored) {
+				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}' (${producer.region}), whose state record could not be read or does not carry the key '${loggedKey}' — cannot classify, so this is not classified as a plaintext producer.`);
+				return;
+			}
+			if (carriesDynamicReference(stored.stored)) {
+				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}', whose stored value for '${loggedKey}' already carries a {{resolve:...}} expression — the producer is scrubbed and there is nothing wrong with this read.`);
+				return;
+			}
 			if (storedValueCarriesNoPlaintext(stored.stored)) {
-				logger.debug(`Scrub of ${stackName}: ${key} in ${origin}${path ? ` at ${path}` : ""} resolved through producer '${producer.stack}', whose stored value for that key carries no text — nothing to redact, so this is not classified as a plaintext producer.`);
+				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}', whose stored value for that key carries no text — nothing to redact, so this is not classified as a plaintext producer.`);
 				return;
 			}
 			if (!nodeCanRefuse) {
-				logger.debug(`Scrub of ${stackName}: ${key} in ${origin}${path ? ` at ${path}` : ""} resolved to a plaintext from unscrubbed producer '${producer.stack}', and this position cannot refuse.`);
+				logger.debug(`Scrub of ${stackName}: ${where} resolved to a plaintext from unscrubbed producer '${loggedStack}', and this position cannot refuse.`);
 				return;
 			}
 			throw plaintextProducerCrossStackReadError(origin, stackName, key, path, producer.stack, producer.key, verdict, secrets);
@@ -67737,6 +67755,7 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 		}));
 		try {
 			const resources = { ...report.state.resources };
+			let acceptedResourceCount = 0;
 			for (const outcome of driftedOutcomes) {
 				const existing = resources[outcome.logicalId];
 				if (!existing) continue;
@@ -67754,10 +67773,15 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 					accepted.push(change);
 				}
 				const redactedBaseline = redactSecretsForState(newBaseline, outcome.secrets, existing.properties ?? {}, STATE_SOURCED_READBACK_RULES);
+				let recordedChanges = 0;
 				for (const change of accepted) {
-					if (deepEqualUnordered(getAtPath(redactedBaseline, change.path), change.awsValue)) continue;
+					if (deepEqualUnordered(getAtPath(redactedBaseline, change.path), change.awsValue)) {
+						recordedChanges++;
+						continue;
+					}
 					logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): '${change.path}' was NOT recorded — cdkd state holds an unresolved '{{resolve:...}}' reference at that property, and the reference wins over an accepted value. Change the template if that reference is wrong.`);
 				}
+				if (recordedChanges > 0) acceptedResourceCount++;
 				resources[outcome.logicalId] = hasObserved ? {
 					...existing,
 					observedProperties: redactedBaseline
@@ -67774,7 +67798,7 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 			const saveOptions = { expectedEtag: report.etag };
 			if (report.migrationPending) saveOptions.migrateLegacy = true;
 			await stateBackend.saveState(report.stackName, report.region, newState, saveOptions);
-			logger.info(`✓ State updated for ${report.stackName} (${report.region}): accepted drift on ${driftedOutcomes.length} resource(s).`);
+			logger.info(`✓ State updated for ${report.stackName} (${report.region}): ` + (acceptedResourceCount === 0 ? "0 resource(s) accepted — no drifted change was recorded, and this write carried only the positioned re-redaction." : `accepted drift on ${acceptedResourceCount} resource(s).`));
 		} finally {
 			await lockManager.releaseLock(report.stackName, report.region).catch((err) => {
 				logger.warn(`Failed to release lock for ${report.stackName} (${report.region}): ` + (err instanceof Error ? err.message : String(err)));
@@ -68125,11 +68149,10 @@ function mergeUntemplatedValue(awsValue, desiredValue) {
 }
 /**
 * Replace every leaf of a revert payload that still holds a `{{resolve:...}}`
-* token with the value AWS currently has at that position (issue #1914,
-* round-3 review).
+* token with the value AWS currently has at that position (issue #1914).
 *
-* The round-3 change downgraded an unresolvable reference from a per-resource
-* failure to a warning, on the premise that `cdkd deploy` resolves through the
+* cdkd downgrades an unresolvable reference from a per-resource failure to a
+* warning, on the premise that `cdkd deploy` resolves through the
 * resolver's same unsupported-service arm — so AWS already holds the literal
 * and replaying it is a no-op. **That premise holds only for records cdkd
 * deployed.** CloudFormation resolves `ssm-secure` SERVER-side, so a record
@@ -68525,18 +68548,22 @@ function printAcceptPlan(reports) {
 			skipped: () => []
 		}));
 		if (drifted.length === 0) continue;
-		process.stdout.write(`\nPlan (--accept): update cdkd state for ${report.stackName} (${report.region}):\n`);
+		const lines = [];
+		let plannedWrites = 0;
 		for (const o of drifted) {
-			process.stdout.write(`  ~ ${o.logicalId} (${o.resourceType})\n`);
+			lines.push(`  ~ ${o.logicalId} (${o.resourceType})\n`);
 			for (const change of o.changes) {
 				const refusal = acceptRefusalReason(change, o.maskedPaths);
 				if (refusal !== void 0) {
-					process.stdout.write(`    ${change.path}: SKIPPED — ${refusal}\n`);
+					lines.push(`    ${change.path}: SKIPPED — ${refusal}\n`);
 					continue;
 				}
-				process.stdout.write(`    ${change.path}: ${formatScalar(change.stateValue)} -> ${formatScalar(change.awsValue)}\n`);
+				plannedWrites++;
+				lines.push(`    ${change.path}: ${formatScalar(change.stateValue)} -> ${formatScalar(change.awsValue)}\n`);
 			}
 		}
+		process.stdout.write(plannedWrites === 0 ? `\nPlan (--accept): no accepted values will be written to cdkd state for ${report.stackName} (${report.region}) — every drifted change below is refused (the run still writes the positioned re-redaction):\n` : `\nPlan (--accept): update cdkd state for ${report.stackName} (${report.region}):\n`);
+		for (const line of lines) process.stdout.write(line);
 	}
 }
 /**
@@ -68562,9 +68589,8 @@ function printRevertPlan(reports) {
 			const stateResource = report.state.resources[o.logicalId];
 			if (stateResource) {
 				const preserved = findRevertPreservedTagKeys(o.changes, stateResource.observedProperties ?? stateResource.properties ?? {}, o.awsProperties);
-				const cannotMaskKeys = o.notComparedCause !== void 0;
-				if (cannotMaskKeys && preserved.length > 0) process.stdout.write(`    ! ${preserved.length} AWS-authored tag(s) will be preserved, but cdkd could not resolve this resource's dynamic reference(s), so their names are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
-				if (!cannotMaskKeys && preserved.length > 0) {
+				if (o.notComparedCause !== void 0 && preserved.length > 0) process.stdout.write(`    ! ${preserved.length} AWS-authored tag(s) will be preserved, but cdkd could not resolve this resource's dynamic reference(s), so their names are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
+				else if (preserved.length > 0) {
 					const tagWord = preserved.length === 1 ? "tag" : "tags";
 					process.stdout.write(`    ! reverting this tag list KEEPS ${preserved.length} AWS-authored ${tagWord} the baseline does not carry:\n`);
 					for (const path of preserved) process.stdout.write(`        ${maskSecretsInText(path, o.secrets)}\n`);
@@ -88094,4 +88120,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-alOnKpLV.js.map
+//# sourceMappingURL=program-I-xR_ceK.js.map