@go-to-k/cdkd 0.290.8 → 0.290.9

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $r as setAwsClients, Cr as Synthesizer, Dn as LockManager, Jr as clearBucketRegionCache, Kr as AssemblyReader, On as S3StateBackend, Qr as resetAwsClients, Si as normalizeAwsError, Un as AssetPublisher, Xr as AwsClients, Yr as resolveBucketRegion, Zr as getAwsClients, bi as formatError, cn as DagBuilder, ei as AssetError, gt as CloudControlProvider, ii as DependencyError, ln as TemplateParser, ni as ConfigError, nn as DiffCalculator, ot as ProviderRegistry, pi as ProvisioningError, r as DeployEngine, rt as IAMRoleProvider, ti as CdkdError, ui as LockError, vi as StateError, xi as isCdkdError, yi as SynthesisError } from "./deploy-engine-Bq0TJ9iN.js";
+import { $r as setAwsClients, Cr as Synthesizer, Dn as LockManager, Jr as clearBucketRegionCache, Kr as AssemblyReader, On as S3StateBackend, Qr as resetAwsClients, Si as normalizeAwsError, Un as AssetPublisher, Xr as AwsClients, Yr as resolveBucketRegion, Zr as getAwsClients, bi as formatError, cn as DagBuilder, ei as AssetError, gt as CloudControlProvider, ii as DependencyError, ln as TemplateParser, ni as ConfigError, nn as DiffCalculator, ot as ProviderRegistry, pi as ProvisioningError, r as DeployEngine, rt as IAMRoleProvider, ti as CdkdError, ui as LockError, vi as StateError, xi as isCdkdError, yi as SynthesisError } from "./deploy-engine-B3yP0pHa.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-H8n5Qjhq.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-C7UAuWDp.js → program-BslZXdJR.js}

@@ -1,8 +1,8 @@
-import { $ as secretBearing, $n as ensureAssetStorage, $r as setAwsClients, $t as s3BucketRegionalDomainName, A as extractDeploymentEventError, Ai as retryClassificationText, An as buildForceUnlockCommand, Ar as resolveSkipPrefix, At as parameterTypeMayLoseSecretIdentity, B as toCfnInteger, Bn as orphansAfterRollback, Br as uploadCfnTemplate, Bt as configIntegerRefusal, C as buildFinalSnapshotIdentifier, Ci as withErrorHandling, Cn as recordMaskOnlyValue, Cr as Synthesizer, Ct as IntrinsicFunctionResolver, D as refusesFinalSnapshot, Di as isTransientServerError, Dn as LockManager, Dr as resolveApp, Dt as getAccountInfo, E as isFinalSnapshotError, Ei as isThrottlingError, En as scrubResourceRecord, Er as getLegacyStateBucketName, Et as coerceParameterTypedValue, F as isStatefulRecreateTargetSync, Fn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Fr as warnDeprecatedNoPrefixCliFlag, Ft as resolveExplicitPhysicalId, G as gray, Gn as WorkGraph, Gr as derivePartitionAndUrlSuffix, Gt as requireConfigObject, H as formatResourceLine, Hn as shouldRetainResource, Hr as expectedOwnerParam, Ht as readConfigString, I as renderStatefulReason, In as DEFAULT_STATE_PREFIX, Ir as CFN_TEMPLATE_BODY_LIMIT, It as assertRegionMatch, J as yellow, Jn as loadPublishableAssetManifest, Jt as producerRegionsFromState, K as green, Kn as buildAssetRedirectMap, Kr as AssemblyReader, Kt as requireConfigString, L as WARM_THROUGHPUT_MEMBERS, Ln as exportNamesCarriedFrom, Lr as CFN_TEMPLATE_URL_LIMIT, Lt as coerceCfnBoolean, M as planOrphanAdoption, Mn as forceQuitRecoveryClause, Mr as resolveStateBucketWithDefaultAndSource, Mt as isSettledInstanceState, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as formatLockExpiry, Nr as resolveUseCdkBootstrapAssets, Nt as WAFv2WebACLProvider, O as unsupportedFinalSnapshotError, Oi as markNonRetryable, On as S3StateBackend, Or as resolveAutoAssetStorage, Ot as isImpossibleEmptyStoredAttribute, P as isStatefulRecreateTargetForReplace, Pn as shellQuote, Pr as stateBucketExistenceConfirmed, Pt as normalizeAwsTagsToCfn, Q as isExportAliasCollision, Qn as assertAssetBucketRegion, Qr as resetAwsClients, Qt as s3BucketDualStackDomainName, R as coerceWarmThroughput$1, Rn as importableOutputKeys, Rr as MIGRATE_TMP_PREFIX, Rt as coerceCfnInteger, S as PRE_DELETE_SNAPSHOT_TYPES, Si as normalizeAwsError, Sn as maskSecretsInText, Sr as getDockerImageBySourceHash, St as isTerminationProtectionPropagationError, T as createPreDeleteFinalSnapshot, Ti as isRetryableTransientError, Tn as redactSecretsForState, Tr as getDefaultStateBucketName, Tt as cfnRefValueFromPhysicalId, U as bold, Un as AssetPublisher, Ur as PARTITION_TABLE, Ut as replayWarn, V as toFiniteNumber, Vn as orphansCarriedFrom, Vr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Vt as configStringRefusal, W as cyan, Wn as stringifyValue, Wr as canonicalizeRegion, Wt as requireConfigArray, X as collectPublishedOutputNames, Xn as AssetModeResolver, Xr as AwsClients, Xt as s3BucketArn, Y as collectDeclaredOutputNames, Yn as rewriteTemplateAssetReferences, Yr as resolveBucketRegion, Yt as withSharedDrainBudget, Z as exportAliasCollisionScrubWarning, Zn as BOOTSTRAP_MARKER_PREFIX, Zr as getAwsClients, Zt as s3BucketDomainName, _ as isSecretBearingReferenceString, _i as StackTerminationProtectionError, _n as errorCauseChain, _r as runDockerForeground, _t as slowCcOperationTimeoutMs, a as DeploymentEventsStore, ai as DeployCancelledError, an as findSilentDropProperties, ar as validateContainerRepoName, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bn as markSameGenerationBag, br as stripControlChars, bt as deleteSkipReason, c as replayFailedOperations, ci as LocalInvokeBuildError$1, cn as DagBuilder, cr as buildDockerImage, ct as createMaskedRetryLogger, d as updatePartialReason, di as NestedStackChildDirectDestroyError, dn as STATE_SOURCED_CROSS_GENERATION_RULES, dr as describeDockerFailure, dt as beginCommandInterruptScope, en as s3BucketWebsiteUrl, er as getBootstrapMarkerKey, et as secretBearingStateKeyWarning, f as withResourceDeadline, fi as PartialFailureError, fn as STATE_SOURCED_READBACK_RULES, fr as dockerSpawnEnvWithSensitive, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as StackHasActiveImportsError, gn as dynamicReferenceTokens, gr as redactDockerArgvValues, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as ResourceUpdateNotSupportedError, hn as createSecretMasker, hr as partitionSensitiveEnv, ht as startInterruptWatch, i as DeploymentEventsReader, in as findActionableSilentDrops, ir as validateAssetBucketName, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, jn as buildLockContentionMessage, jr as resolveStateBucketWithDefault, jt as refStateLookupFromResource, k as makeCanonicalizePropertiesFn, ki as markRedactedCause, kn as rebuildClientForBucketRegion, kr as resolveCaptureObservedState, kt as isUnboundTemplateParameter, l as replayRollback, li as LocalStartServiceError, ln as TemplateParser, lr as describeDockerCapturedOutput, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as ResourceTimeoutError, mn as carriesSecretMask, mr as getDockerCmd, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as DiffCalculator, nr as parseBootstrapMarker, nt as getCurrentResourceSecrets, o as planFailedOps, oi as DynamicReferenceRegionAmbiguousError, on as describeTypeWithThrottleRetry, or as buildDenyExternalAccessPolicy, ot as ProviderRegistry, p as maskingRetryLogger, pi as ProvisioningError, pn as TEMPLATE_SOURCED_RULES, pr as formatDockerLoginError, pt as interruptWatchListenerCount, q as red, qn as createAssetRedirectResolver, qr as processStackMessages, qt as classifyReplaySecretRegion, r as DeployEngine, ri as CrossAccountSecretRefusalError, rn as INTRINSIC_KEYS, rr as readBootstrapMarkerBody, rt as IAMRoleProvider, s as planRollback, si as IntrinsicResolutionRefusalError, sn as withRetry, sr as describeAwsFailure, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as CdkdError, tn as applyRoleArnIfSet, tr as isCrossRegionRedirect, tt as secretSafeKeyDisplay, u as updatePartialMessage, un as STATE_SOURCED_BASELINE_RULES, ur as describeDockerExecFailure, ut as maskerOrIdentity, v as keptWholeReasonText, vn as identityKeyFor, vr as runDockerStreaming, vt as UNSPECIFIED_SKIP_REASON, w as ccRoutedFinalSnapshotError, wi as isMarkedNonRetryable, wn as recoverMaskedOutput, wr as synthesisStatusMessage, wt as carriesDynamicReference, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xn as maskSecretsInError, xr as AssetManifestLoader, xt as disableInstanceApiTermination, y as mergeNoChangeOutputs, yn as isSingleDynamicReferenceToken, yr as escapeRegExp, yt as deleteIndeterminateGuards, z as isWarmThroughputDecrease, zn as importableOutputs, zr as findLargeInlineResources, zt as configBooleanRefusal } from "./deploy-engine-Bq0TJ9iN.js";
+import { $ as secretBearing, $n as ensureAssetStorage, $r as setAwsClients, $t as s3BucketRegionalDomainName, A as extractDeploymentEventError, Ai as retryClassificationText, An as buildForceUnlockCommand, Ar as resolveSkipPrefix, At as parameterTypeMayLoseSecretIdentity, B as toCfnInteger, Bn as orphansAfterRollback, Br as uploadCfnTemplate, Bt as configIntegerRefusal, C as buildFinalSnapshotIdentifier, Ci as withErrorHandling, Cn as recordMaskOnlyValue, Cr as Synthesizer, Ct as IntrinsicFunctionResolver, D as refusesFinalSnapshot, Di as isTransientServerError, Dn as LockManager, Dr as resolveApp, Dt as getAccountInfo, E as isFinalSnapshotError, Ei as isThrottlingError, En as scrubResourceRecord, Er as getLegacyStateBucketName, Et as coerceParameterTypedValue, F as isStatefulRecreateTargetSync, Fn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Fr as warnDeprecatedNoPrefixCliFlag, Ft as resolveExplicitPhysicalId, G as gray, Gn as WorkGraph, Gr as derivePartitionAndUrlSuffix, Gt as requireConfigObject, H as formatResourceLine, Hn as shouldRetainResource, Hr as expectedOwnerParam, Ht as readConfigString, I as renderStatefulReason, In as DEFAULT_STATE_PREFIX, Ir as CFN_TEMPLATE_BODY_LIMIT, It as assertRegionMatch, J as yellow, Jn as loadPublishableAssetManifest, Jt as producerRegionsFromState, K as green, Kn as buildAssetRedirectMap, Kr as AssemblyReader, Kt as requireConfigString, L as WARM_THROUGHPUT_MEMBERS, Ln as exportNamesCarriedFrom, Lr as CFN_TEMPLATE_URL_LIMIT, Lt as coerceCfnBoolean, M as planOrphanAdoption, Mn as forceQuitRecoveryClause, Mr as resolveStateBucketWithDefaultAndSource, Mt as isSettledInstanceState, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as formatLockExpiry, Nr as resolveUseCdkBootstrapAssets, Nt as WAFv2WebACLProvider, O as unsupportedFinalSnapshotError, Oi as markNonRetryable, On as S3StateBackend, Or as resolveAutoAssetStorage, Ot as isImpossibleEmptyStoredAttribute, P as isStatefulRecreateTargetForReplace, Pn as shellQuote, Pr as stateBucketExistenceConfirmed, Pt as normalizeAwsTagsToCfn, Q as isExportAliasCollision, Qn as assertAssetBucketRegion, Qr as resetAwsClients, Qt as s3BucketDualStackDomainName, R as coerceWarmThroughput$1, Rn as importableOutputKeys, Rr as MIGRATE_TMP_PREFIX, Rt as coerceCfnInteger, S as PRE_DELETE_SNAPSHOT_TYPES, Si as normalizeAwsError, Sn as maskSecretsInText, Sr as getDockerImageBySourceHash, St as isTerminationProtectionPropagationError, T as createPreDeleteFinalSnapshot, Ti as isRetryableTransientError, Tn as redactSecretsForState, Tr as getDefaultStateBucketName, Tt as cfnRefValueFromPhysicalId, U as bold, Un as AssetPublisher, Ur as PARTITION_TABLE, Ut as replayWarn, V as toFiniteNumber, Vn as orphansCarriedFrom, Vr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Vt as configStringRefusal, W as cyan, Wn as stringifyValue, Wr as canonicalizeRegion, Wt as requireConfigArray, X as collectPublishedOutputNames, Xn as AssetModeResolver, Xr as AwsClients, Xt as s3BucketArn, Y as collectDeclaredOutputNames, Yn as rewriteTemplateAssetReferences, Yr as resolveBucketRegion, Yt as withSharedDrainBudget, Z as exportAliasCollisionScrubWarning, Zn as BOOTSTRAP_MARKER_PREFIX, Zr as getAwsClients, Zt as s3BucketDomainName, _ as isSecretBearingReferenceString, _i as StackTerminationProtectionError, _n as errorCauseChain, _r as runDockerForeground, _t as slowCcOperationTimeoutMs, a as DeploymentEventsStore, ai as DeployCancelledError, an as findSilentDropProperties, ar as validateContainerRepoName, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bn as markSameGenerationBag, br as stripControlChars, bt as deleteSkipReason, c as replayFailedOperations, ci as LocalInvokeBuildError$1, cn as DagBuilder, cr as buildDockerImage, ct as createMaskedRetryLogger, d as updatePartialReason, di as NestedStackChildDirectDestroyError, dn as STATE_SOURCED_CROSS_GENERATION_RULES, dr as describeDockerFailure, dt as beginCommandInterruptScope, en as s3BucketWebsiteUrl, er as getBootstrapMarkerKey, et as secretBearingStateKeyWarning, f as withResourceDeadline, fi as PartialFailureError, fn as STATE_SOURCED_READBACK_RULES, fr as dockerSpawnEnvWithSensitive, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as StackHasActiveImportsError, gn as dynamicReferenceTokens, gr as redactDockerArgvValues, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as ResourceUpdateNotSupportedError, hn as createSecretMasker, hr as partitionSensitiveEnv, ht as startInterruptWatch, i as DeploymentEventsReader, in as findActionableSilentDrops, ir as validateAssetBucketName, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, jn as buildLockContentionMessage, jr as resolveStateBucketWithDefault, jt as refStateLookupFromResource, k as makeCanonicalizePropertiesFn, ki as markRedactedCause, kn as rebuildClientForBucketRegion, kr as resolveCaptureObservedState, kt as isUnboundTemplateParameter, l as replayRollback, li as LocalStartServiceError, ln as TemplateParser, lr as describeDockerCapturedOutput, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as ResourceTimeoutError, mn as carriesSecretMask, mr as getDockerCmd, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as DiffCalculator, nr as parseBootstrapMarker, nt as getCurrentResourceSecrets, o as planFailedOps, oi as DynamicReferenceRegionAmbiguousError, on as describeTypeWithThrottleRetry, or as buildDenyExternalAccessPolicy, ot as ProviderRegistry, p as maskingRetryLogger, pi as ProvisioningError, pn as TEMPLATE_SOURCED_RULES, pr as formatDockerLoginError, pt as interruptWatchListenerCount, q as red, qn as createAssetRedirectResolver, qr as processStackMessages, qt as classifyReplaySecretRegion, r as DeployEngine, ri as CrossAccountSecretRefusalError, rn as INTRINSIC_KEYS, rr as readBootstrapMarkerBody, rt as IAMRoleProvider, s as planRollback, si as IntrinsicResolutionRefusalError, sn as withRetry, sr as describeAwsFailure, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as CdkdError, tn as applyRoleArnIfSet, tr as isCrossRegionRedirect, tt as secretSafeKeyDisplay, u as updatePartialMessage, un as STATE_SOURCED_BASELINE_RULES, ur as describeDockerExecFailure, ut as maskerOrIdentity, v as keptWholeReasonText, vn as identityKeyFor, vr as runDockerStreaming, vt as UNSPECIFIED_SKIP_REASON, w as ccRoutedFinalSnapshotError, wi as isMarkedNonRetryable, wn as recoverMaskedOutput, wr as synthesisStatusMessage, wt as carriesDynamicReference, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xn as maskSecretsInError, xr as AssetManifestLoader, xt as disableInstanceApiTermination, y as mergeNoChangeOutputs, yn as isSingleDynamicReferenceToken, yr as escapeRegExp, yt as deleteIndeterminateGuards, z as isWarmThroughputDecrease, zn as importableOutputs, zr as findLargeInlineResources, zt as configBooleanRefusal } from "./deploy-engine-B3yP0pHa.js";
 import { C as truncateCodePoints, S as displaySafe, _ as withSkipPrefix, b as UNRENDERABLE, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, x as displayIdent, y as STACK_REF_MAX_CODE_POINTS } from "./logger-H8n5Qjhq.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CFdjI1Tq.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-B4m3magB.js";
+import { t as getCdkdVersion } from "./version-wXpog0Ci.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BTsQjH_E.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -67048,6 +67048,7 @@ async function scrubCommand(stacks, options) {
 	let totalStacksScrubbed = 0;
 	let totalStacksWithUnscrubbableKeys = 0;
 	let totalStacksWithUnverifiableReads = 0;
+	let totalStacksWithUnverifiableLeaves = 0;
 	/**
 	* Stacks this `--dry-run` proceeded over with an UNREADABLE resources map
 	* (issue go-to-k/cdkd#3018). Tracked exactly like `indexUnreadable`: an
@@ -67129,8 +67130,12 @@ async function scrubCommand(stacks, options) {
 		if (scrubbed.recordsChanged > 0) {
 			totalStacksScrubbed++;
 			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${stack.stackName}`);
-		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
+		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && scrubbed.unverifiableLeaves === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
 		if (scrubbed.malformedResources) malformedRecords.push(stack.stackName);
+		if (scrubbed.unverifiableLeaves > 0) {
+			totalStacksWithUnverifiableLeaves++;
+			logger.warn(`${scrubbed.unverifiableLeaves} scan(s) in ${stack.stackName} were ABANDONED mid-value because a {{resolve:...}} reference could not be resolved (see the warnings above). The resolver stops at the first failing token, so a real secret after it in the same value recorded no needle — this stack is not reported clean. The count is per abandoned SCAN, not per secret: one record can contribute more than once (an output whose Export.Name and Value both abandon), and one abandoned scan can hide several unexamined leaves.`);
+		}
 		if (scrubbed.unverifiableReads > 0) {
 			totalStacksWithUnverifiableReads++;
 			logger.warn(`${scrubbed.unverifiableReads} cross-stack read(s) in ${stack.stackName} could NOT be verified — cdkd declines them by design (see the warnings above), so this stack is not reported clean.`);
@@ -67161,7 +67166,7 @@ async function scrubCommand(stacks, options) {
 		totalIndexEntriesUnexamined += unexamined.length;
 		logger.info(`Exports index (${indexRegion}): ${unexamined.length} entr${unexamined.length === 1 ? "y is" : "ies are"} published by a producer this run did not scrub, so nothing here read ${unexamined.length === 1 ? "its" : "their"} value. Coverage composes across the apps sharing this bucket and region — run each app's own cdkd scrub to reach its entries.`);
 	}
-	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0) {
+	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalStacksWithUnverifiableLeaves === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0) {
 		if (failures.length === 0) {
 			logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
 			return;
@@ -67171,6 +67176,7 @@ async function scrubCommand(stacks, options) {
 	}
 	const failureNote = failures.length > 0 ? ` ${failures.length} stack(s) could NOT be scrubbed at all and are NOT covered by this summary — see the errors above.` : "";
 	const keyNote = totalStacksWithUnscrubbableKeys > 0 ? ` ${totalStacksWithUnscrubbableKeys} stack(s) hold plaintext in an output KEY, which cdkd scrub cannot rewrite — rename that output's Export.Name and redeploy.` : "";
+	const leafNote = totalStacksWithUnverifiableLeaves > 0 ? ` ${totalStacksWithUnverifiableLeaves} stack(s) had a {{resolve:...}} scan ABANDONED mid-value, so part of their state was never examined (see the warnings above).` : "";
 	const unverifiableNote = totalStacksWithUnverifiableReads > 0 ? ` ${totalStacksWithUnverifiableReads} stack(s) carry a cross-stack read cdkd declines to perform, so their imported values could NOT be checked — export a non-secret value (e.g. the secret's ARN) from the producer, or reference it from within its own account.` : "";
 	const indexNote = (() => {
 		const parts = [];
@@ -67180,20 +67186,20 @@ async function scrubCommand(stacks, options) {
 		return parts.join("");
 	})();
 	if (options.dryRun) {
-		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote}${unverifiableNote}${indexNote}${failureNote} ROTATE any exposed secret in Secrets Manager.`);
-		else logger.info(`\nPlan: no state record can be rewritten.${keyNote}${unverifiableNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
+		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote}${unverifiableNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret in Secrets Manager.`);
+		else logger.info(`\nPlan: no state record can be rewritten.${keyNote}${unverifiableNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 		if (failures.length > 0) throw scrubStacksFailedError(failures);
 		if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, true);
 		if (malformedRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords);
 		if (options.fail) throw new ScrubNeededError();
 		return;
 	}
-	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The CURRENT state.json no longer holds the plaintext. Where the state bucket is VERSIONED — which cdkd bootstrap enables — the pre-scrub body survives as a noncurrent version, stays readable with GetObject and a VersionId, and scrub does not purge it. So a value that was ever persisted must be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating); rotation is what makes any surviving version harmless.${keyNote}${unverifiableNote}${indexNote}${failureNote}`);
-	else logger.info(`\nNo state record was rewritten.${keyNote}${unverifiableNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
+	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The CURRENT state.json no longer holds the plaintext. Where the state bucket is VERSIONED — which cdkd bootstrap enables — the pre-scrub body survives as a noncurrent version, stays readable with GetObject and a VersionId, and scrub does not purge it. So a value that was ever persisted must be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating); rotation is what makes any surviving version harmless.${keyNote}${unverifiableNote}${leafNote}${indexNote}${failureNote}`);
+	else logger.info(`\nNo state record was rewritten.${keyNote}${unverifiableNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 	if (failures.length > 0) throw scrubStacksFailedError(failures);
 	if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, false);
 	if (malformedRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords);
-	if (options.fail && (totalStacksWithUnscrubbableKeys > 0 || totalStacksWithUnverifiableReads > 0)) throw new ScrubNeededError();
+	if (options.fail && (totalStacksWithUnscrubbableKeys > 0 || totalStacksWithUnverifiableReads > 0 || totalStacksWithUnverifiableLeaves > 0)) throw new ScrubNeededError();
 }
 /**
 * Every secret plaintext this run recorded, from ANY position in the template
@@ -68477,6 +68483,205 @@ function isNamelessDynamicReferenceFailure(err) {
 	return err instanceof Error && errorCauseChain(err).some((link) => link instanceof Error && link.message.includes(DYNAMIC_REFERENCE_PREFIX) && NAMELESS_DYNAMIC_REFERENCE_MARKERS.some((marker) => link.message.includes(marker)));
 }
 /**
+* The per-record line each counting site prints. Deliberately ONE SHORT
+* SENTENCE, and that is a fix rather than a style choice: the first cut emitted
+* a ~440-character paragraph PER RECORD at default verbosity, and the arm it
+* fires on is one a single `Default`-less parameter triggers for every resource
+* in the stack at once. Dozens of identical paragraphs bury the record names,
+* which are the only part a reader cannot reconstruct.
+*
+* The explanation is emitted ONCE PER STACK instead, by
+* {@link abandonedScanStackNote}.
+*
+* The CAUSE is absent on both arms: the sibling log at each site already prints
+* it through `maskSecretsInText`, and a resolver error echoes what it was
+* handed — which, after `pinCrossRegionSecrets`, can be a foreign plaintext.
+*
+* RESIDUAL on the `subject` the call sites pass. They compose
+* `maskSecretsInText(... displaySafe(id) ...)` — sanitise, then mask — and
+* `displaySafe` REPLACES a control character with a space rather than deleting
+* it, so it cannot JOIN a split needle (the go-to-k/cdkd#2874 direction) but it
+* can BREAK one, and it leaves `U+200B`-`U+200D` / `U+FEFF` untouched. A secret
+* would have to sit inside a template logical id or Outputs key to be reachable,
+* which is why `secretSafeKeyDisplay` is not used here — that one is for RESOLVED
+* state-bag keys. Recorded rather than closed: go-to-k/cdkd#3178 security review.
+*/
+function abandonedScanWarning(subject, verdict) {
+	return verdict === "count" ? `The {{resolve:...}} scan of ${subject} was ABANDONED — this record is NOT certified clean.` : `The {{resolve:...}} scan of ${subject} was cut short by a TEMPLATE problem — this record is NOT certified clean.`;
+}
+/**
+* The one-per-stack explanation behind {@link abandonedScanWarning}'s lines.
+*
+* Two arms, because they need opposite things said. The `count` arm is a
+* FINDING and gates; the reader needs the cause, which is verbose-only. The
+* `warn` arm does NOT gate, and a reader seeing "NOT certified clean" beside a
+* green exit has no way to tell a passing run from a broken one unless it says
+* so.
+*
+* The `warn` arm's remedy is deliberately two-sided. The dominant population is
+* a parameter with no `Default` — legal CloudFormation, no defect to fix — so
+* telling the reader only to "fix the template reference" describes a repair
+* that does not exist for them. It names what they CAN do and then says plainly
+* that scrub may simply not be able to certify the record.
+*/
+function abandonedScanStackNote(verdict, records) {
+	const subject = `${records} record(s) above`;
+	return verdict === "count" ? `${subject}: the resolver stops at the first {{resolve:...}} token it cannot fetch, so any secret after it in the same value recorded no needle and could not be rewritten. Re-run with --verbose for the cause of each.` : `${subject}: the scan stopped on something cdkd scrub cannot resolve with template defaults alone — an unresolvable Ref or Fn::GetAtt, a parameter with no Default, or a reference whose own argument still holds an unsubstituted \${...}. These do NOT fail --fail, because scrub takes no --parameters and a gate failure here could not be cleared. Give the parameter a Default, or resolve the reference, to let scrub certify these records; otherwise accept that it cannot.`;
+}
+/**
+* The verdict a counting site acts on: `count` (a finding — warn AND raise the
+* exit code), `warn` (say it, but do not gate) or `silent`.
+*
+* The middle arm exists because the EXCLUSION has a cost in
+* go-to-k/cdkd#3160's OWN harm direction, and two round-4 reviewers found it
+* independently. `resolver.resolve` walks the whole properties bag and ONE
+* throw aborts the rest of it — so a bag holding `{A: {Ref: NoSuchThing},
+* B: '{{resolve:secretsmanager:prod/db:...}}'}` has `B` abandoned by a failure
+* that is nothing to do with `B`. Excluding it means `B` records no needle, its
+* legacy plaintext is never rewritten, and the stack can still print
+* `No plaintext secrets found` at exit 0. Reachable accidentally (one
+* `Default`-less parameter empties the bag, so every `{Ref: <param>}` throws)
+* and, on a repo whose CI runs `--dry-run --fail`, defeatable on purpose by
+* adding one dangling `Ref` ahead of the secret. That loss is REAL and is not
+* repaired by making it visible — go-to-k/cdkd#3196 tracks scoping the resolve
+* per property so the sibling reference is still scanned.
+*
+* Counting it is not the answer — that is the round-2 blocker, an unclearable
+* red gate on a healthy stack. What the two failure modes do NOT share is
+* VISIBILITY: an operator can act on a warning naming the record, and a warning
+* gates nothing. So the excluded arm still speaks, and only the exit code is
+* withheld.
+*
+* **The ORDER of the three tests is load-bearing, and getting it wrong is how
+* round 5 nearly shipped a silent regression.** An earlier cut asked
+* `carriesFetchableDynamicReference` FIRST and returned `silent` on a miss,
+* which made a gate-downgrade test into a universal silencer. Because
+* `DYNAMIC_REFERENCE_INNER_CHAR` is `[^}]`, a token with a placeholder
+* ANYWHERE in it fails that test — including the dominant CDK spelling, where
+* the reference is assembled by an `Fn::Sub` over parameters that DO have
+* defaults:
+*
+* ```json
+* {"A": {"Fn::Sub": "{{resolve:ssm-secure:/deleted/${Env}/p}}"},
+*  "B": {"Fn::Sub": "{{resolve:secretsmanager:${Db}:SecretString:password}}"}}
+* ```
+*
+* Those assemble fine, `A` raises a RAW `ParameterNotFound`, `B` is abandoned
+* and records no needle — and the earlier order printed nothing at all. That is
+* go-to-k/cdkd#3160's own headline repro, silenced by the fix for a different
+* false positive.
+*
+* So the tests are separated by what each one is EVIDENCE of:
+*
+* - `carriesDynamicReference` — did this bag hold a reference at all? If not,
+*   nothing was lost and the pre-existing `logger.debug` is the right level.
+*   This, and only this, decides SILENCE.
+* - `isTemplateShapeResolutionFailure` / `carriesFetchableDynamicReference` —
+*   is the abandonment one an operator could act on? If not, it still gets said;
+*   it just does not gate. These decide the EXIT CODE, never the visibility.
+*/
+function abandonedScanVerdict(source, err) {
+	if (!carriesDynamicReference(source)) return "silent";
+	if (isTemplateShapeResolutionFailure(err) || !carriesFetchableDynamicReference(source)) return "warn";
+	return "count";
+}
+/**
+* `source` carries a `{{resolve:...}}` token cdkd could actually have FETCHED —
+* i.e. one whose argument holds no surviving `${...}` placeholder.
+*
+* `carriesDynamicReference` alone is too generous here, and the gap is not
+* theoretical: scrub resolves with `bestEffort`, under which
+* `rethrowStructuralSubFailure` returns EARLY, so an `Fn::Sub` over an unbound
+* placeholder does not throw — it warn-and-KEEPS the literal `${Field}`. The
+* assembled token is then a request for a JSON key literally named `${Field}`,
+* which fails as `Dynamic reference: key '${Field}' not found in secret '<id>'`.
+* That is not a fetch that failed; it is a token that was never fetchable,
+* because scrub has only template DEFAULTS and accepts no `--parameters`. It is
+* ALSO not excludable by message, since `key ... not found` is a class
+* go-to-k/cdkd#3160 asks to COUNT when the key was real. So the discriminator
+* has to be the TOKEN, not the error.
+*
+* `some`, not `every`: a bag holding one placeholder-bearing token and one
+* fully substituted token still counts, because the second one genuinely was
+* fetchable and its scan genuinely stopped.
+*
+* WHAT THIS DOES AND DOES NOT BUY, since round 5 shipped a cut that confused
+* the two. A `false` here downgrades the GATE only — the record is still named
+* at default verbosity by the `warn` arm. It must never decide SILENCE: the
+* inner class is `[^}]`, so a placeholder ANYWHERE in a token fails this test,
+* and the reference assembled by an `Fn::Sub` over DEFAULTED parameters is the
+* dominant CDK spelling rather than an edge case.
+*
+* STATED RESIDUALS, both UNDER-counts against the gate, neither a silence:
+*
+* - A two-argument `Fn::Sub` whose placeholder IS bound
+*   (`{'Fn::Sub': ['{{resolve:ssm:${N}}}', {N: 'x'}]}`) substitutes fine and
+*   yields a fetchable token, but the raw bag still spells `${`, so a real
+*   fetch failure there warns instead of gating.
+* - The same for a single-argument `Fn::Sub` over a defaulted parameter, and
+*   for a placeholder mid-token, which yields no token at all.
+*
+* And one OVER-count, recorded for symmetry: this predicate is BAG-scoped while
+* the failure is TOKEN-scoped, so a bag holding a placeholder-bearing token
+* BESIDE a genuinely fetchable one returns `true`, and a `key '${Field}' not
+* found` raised for the first is gated as if it came from the second. Safety
+* is in the right direction (a gate that fires, not a plaintext under `clean`),
+* and same-bag co-location bounds it.
+*
+* go-to-k/cdkd#3181 is the fix that removes the need for any of these proxies.
+*/
+function carriesFetchableDynamicReference(source) {
+	if (typeof source === "string") return dynamicReferenceTokens(source).some((token) => !token.includes("${"));
+	if (Array.isArray(source)) return source.some(carriesFetchableDynamicReference);
+	if (source !== null && typeof source === "object") return Object.values(source).some(carriesFetchableDynamicReference);
+	return false;
+}
+/**
+* `err` is cdkd's OWN refusal to resolve a template SHAPE — a `Ref`, an
+* `Fn::GetAtt`, a parameter binding — rather than a failure to fetch a
+* `{{resolve:...}}` reference.
+*
+* Matched on cdkd-authored prose, which is sound here for the reason the
+* inverse is not: every string below is built by `intrinsic-function-resolver.ts`
+* itself, so it changes only when this repo changes it, and the fence in
+* `tests/unit/cli/scrub-abandoned-scan-origin.test.ts` reds when a throw site
+* there stops matching. An AWS-authored message could never carry that
+* guarantee.
+*/
+function isTemplateShapeResolutionFailure(err) {
+	if (!(err instanceof Error)) return false;
+	return TEMPLATE_SHAPE_FAILURE_PATTERNS.some((pattern) => pattern.test(err.message));
+}
+/**
+* The cdkd-authored messages {@link isTemplateShapeResolutionFailure} excludes,
+* ANCHORED. A substring test cannot be used here and the reason is concrete:
+* `'Parameter '` alone also matches the SDK's own `Parameter /deleted not
+* found.` — `ParameterNotFound`, this issue's HEADLINE repro — so the loose
+* spelling would have excluded the very case the positional half exists to
+* catch. Each pattern must stay tight enough that no AWS-authored message can
+* satisfy it.
+*
+* Deliberately just these THREE, not every shape failure the resolver can
+* raise. They are the ones that fire EN MASSE on a healthy stack:
+* `resolveParameters` is caught wholesale by `scrubStack`, so one
+* `Default`-less parameter empties the whole bag and every `{Ref: <param>}`
+* throws; and `resolveGetAtt` refuses on the same condition as `resolveRef`,
+* which a branch adding a not-yet-deployed resource hits for every
+* `Fn::GetAtt` to it. A rarer shape failure (an `Fn::Select` over a
+* non-array, say) is a genuine template defect, and counting a leaf whose
+* scan it abandoned is not wrong — the scan really did stop. Over-counting
+* THERE costs a warn on a broken template; over-counting on the three below
+* would cost a red CI gate on a working one.
+*
+* Per-pattern throw sites, and the fence that keeps them true, are in
+* `tests/unit/cli/scrub-abandoned-scan-origin.test.ts`.
+*/
+const TEMPLATE_SHAPE_FAILURE_PATTERNS = [
+	/^Ref \S+ not found$/,
+	/^Resource \S+ not found for Fn::GetAtt$/,
+	/^Parameter \S+ is required but no value was provided/
+];
+/**
 * A secrets map with its OWN identity whose entries ARE `target`'s (issue
 * #2531): every read and write goes to `target`; nothing is stored here.
 *
@@ -68907,6 +69112,33 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	*/
 	const orphanSecrets = /* @__PURE__ */ new Map();
 	const prePassFindings = { unverifiable: [] };
+	/**
+	* Leaves whose dynamic-reference scan was ABANDONED mid-token (issue
+	* go-to-k/cdkd#3160). A counted finding, not a refusal — see
+	* `abandonedScanVerdict` for why these cannot refuse.
+	*/
+	let unverifiableLeaves = 0;
+	let ungateableAbandonedScans = 0;
+	/**
+	* ONE note per stack per arm. The per-record lines are deliberately short
+	* (see `abandonedScanWarning`), so this is where the explanation lives, and
+	* emitting it after the loops rather than at the first occurrence is what
+	* lets it say HOW MANY records it is explaining.
+	*
+	* A CLOSURE called at BOTH returns, not a block at the late one. The early
+	* `totalSecrets === 0` return is the DOMINANT path for an abandoned scan --
+	* an abandoned scan records no needle, which is the whole defect -- so a
+	* single late emission left the note unreachable for exactly the case it
+	* exists to explain. `emitted` because the two call sites are exclusive
+	* today and a third would not be.
+	*/
+	let notesEmitted = false;
+	const emitAbandonedScanNotes = () => {
+		if (notesEmitted) return;
+		notesEmitted = true;
+		if (unverifiableLeaves > 0) logger.warn(abandonedScanStackNote("count", unverifiableLeaves));
+		if (ungateableAbandonedScans > 0) logger.warn(abandonedScanStackNote("warn", ungateableAbandonedScans));
+	};
 	try {
 		const loaded = await stateBackend.getState(stack.stackName, region);
 		if (!loaded) {
@@ -68916,6 +69148,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				secretsFound: 0,
 				secretBearingKeys: 0,
 				unverifiableReads: 0,
+				unverifiableLeaves: 0,
 				exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 			};
 		}
@@ -68989,6 +69222,12 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					await resolver.resolve(resolveInput, resourceContext);
 				} catch (err) {
 					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
+					const leafVerdict = abandonedScanVerdict(resolveInput, err);
+					if (leafVerdict !== "silent") {
+						if (leafVerdict === "count") unverifiableLeaves++;
+						else ungateableAbandonedScans++;
+						logger.warn(maskSecretsInText(abandonedScanWarning(`resource '${displaySafe(logicalId)}'`, leafVerdict), recordedSecretValues));
+					}
 					logger.debug(`Resolution of ${logicalId} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}`);
 				}
 				perResourceTemplateProps.set(logicalId, templateResource.Properties);
@@ -69011,6 +69250,12 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					await resolver.resolve(resolveInput, resolverContext(recordedSecretValues));
 				} catch (err) {
 					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
+					const leafVerdict = abandonedScanVerdict(resolveInput, err);
+					if (leafVerdict !== "silent") {
+						if (leafVerdict === "count") unverifiableLeaves++;
+						else ungateableAbandonedScans++;
+						logger.warn(maskSecretsInText(abandonedScanWarning(`orphan record '${displaySafe(record.logicalId)}'`, leafVerdict), recordedSecretValues));
+					}
 					logger.debug(`Resolution of orphan record ${record.logicalId} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}`);
 				}
 			}
@@ -69034,6 +69279,12 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 						exportName = await resolver.resolve(nameSource, nameContext);
 					} catch (err) {
 						if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
+						const leafVerdict = abandonedScanVerdict(nameSource, err);
+						if (leafVerdict !== "silent") {
+							if (leafVerdict === "count") unverifiableLeaves++;
+							else ungateableAbandonedScans++;
+							logger.warn(maskSecretsInText(abandonedScanWarning(`the Export.Name of output '${displaySafe(name)}'`, leafVerdict), outputSecrets));
+						}
 						nameFailed = true;
 						nameError = err;
 					}
@@ -69072,6 +69323,12 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					await resolver.resolve(valueSource, valueContext);
 				} catch (err) {
 					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
+					const leafVerdict = abandonedScanVerdict(valueSource, err);
+					if (leafVerdict !== "silent") {
+						if (leafVerdict === "count") unverifiableLeaves++;
+						else ungateableAbandonedScans++;
+						logger.warn(maskSecretsInText(abandonedScanWarning(`output '${displaySafe(name)}'`, leafVerdict), outputSecrets));
+					}
 					logger.debug(`Resolution of output ${name} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 				}
 			}
@@ -69085,15 +69342,19 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			logger.warn(secretBearingStateKeyWarning(stack.stackName, display));
 		}
 		const totalSecrets = outputSecrets.size + [...perResourceSecrets.values()].reduce((n, m) => n + m.size, 0) + [...orphanSecrets.values()].reduce((n, m) => n + m.size, 0);
-		if (totalSecrets === 0) return {
-			recordsChanged: 0,
-			secretsFound: 0,
-			secretBearingKeys: secretBearingKeys.length,
-			unverifiableReads: prePassFindings.unverifiable.length,
-			...malformedResources ? { malformedResources } : {},
-			outputs: state.outputs,
-			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
-		};
+		if (totalSecrets === 0) {
+			emitAbandonedScanNotes();
+			return {
+				recordsChanged: 0,
+				secretsFound: 0,
+				secretBearingKeys: secretBearingKeys.length,
+				unverifiableReads: prePassFindings.unverifiable.length,
+				unverifiableLeaves,
+				...malformedResources ? { malformedResources } : {},
+				outputs: state.outputs,
+				exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
+			};
+		}
 		let recordsChanged = 0;
 		const newResources = {};
 		for (const [logicalId, record] of Object.entries(state.resources ?? {})) {
@@ -69122,6 +69383,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			};
 		});
 		const newOutputs = redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource, TEMPLATE_SOURCED_RULES) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets));
+		emitAbandonedScanNotes();
 		if (JSON.stringify(newOutputs) !== JSON.stringify(state.outputs)) recordsChanged++;
 		if (recordsChanged > 0 && !opts.dryRun) {
 			const { skippedOutputs: _droppedByScrub, ...carriedState } = state;
@@ -69139,6 +69401,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			secretsFound: totalSecrets,
 			secretBearingKeys: secretBearingKeys.length,
 			unverifiableReads: prePassFindings.unverifiable.length,
+			unverifiableLeaves,
 			...malformedResources ? { malformedResources } : {},
 			outputs: newOutputs,
 			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
@@ -93473,4 +93736,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-C7UAuWDp.js.map
+//# sourceMappingURL=program-BslZXdJR.js.map