@go-to-k/cdkd 0.220.0 → 0.220.2

package/dist/{deploy-engine-CFaK71E9.js → deploy-engine-CcOt3mUO.js}

@@ -3540,12 +3540,22 @@ function isNoSuchKey(error) {
 *
 * Locks have a TTL (time-to-live). Expired locks are automatically cleaned up
 * during acquisition attempts.
+*
+* Like `S3StateBackend`, the lock manager tolerates a state bucket that
+* lives in a different AWS region from the CLI's base region: before the
+* first S3 operation it resolves the bucket's actual region via
+* `GetBucketLocation` and, if it differs from the supplied client's region,
+* builds a private replacement client for that region (issue #803 — without
+* this, every lock acquisition against a cross-region bucket failed with
+* S3's 301 PermanentRedirect while state reads/writes succeeded).
 */
 var LockManager = class {
 	logger = getLogger().child("LockManager");
 	s3Client;
 	config;
 	ttlMs;
+	clientResolved = false;
+	resolveInFlight = null;
 	constructor(s3Client, config, options) {
 		this.s3Client = s3Client;
 		this.config = config;
@@ -3553,6 +3563,62 @@ var LockManager = class {
 		this.ttlMs = ttlMinutes * 60 * 1e3;
 	}
 	/**
+	* Resolve the state bucket's actual region and, if it differs from the
+	* supplied client's configured region, replace the client reference with
+	* a new S3Client pointed at the bucket's region.
+	*
+	* Mirrors `S3StateBackend.ensureClientForBucket()` (PR #60) with two
+	* deliberate differences:
+	*
+	* - The replacement client reuses the original client's resolved
+	*   credentials provider, so `--profile` / static credentials carry over
+	*   without the 8 LockManager call sites having to thread client options.
+	* - The original client is NOT destroyed. It is the shared `AwsClients.s3`
+	*   instance that other components (state backend, exports index) still
+	*   hold a reference to.
+	*
+	* `resolveBucketRegion` caches per bucket name for the process lifetime,
+	* so when the state backend has already resolved the same bucket this
+	* incurs no additional `GetBucketLocation` call.
+	*/
+	async ensureClientForBucket() {
+		if (this.clientResolved) return;
+		if (this.resolveInFlight) return this.resolveInFlight;
+		this.resolveInFlight = (async () => {
+			try {
+				const currentRegion = await this.s3Client.config.region();
+				const fallbackRegion = typeof currentRegion === "string" ? currentRegion : void 0;
+				let probeCredentials;
+				try {
+					probeCredentials = await this.s3Client.config.credentials();
+				} catch {
+					probeCredentials = void 0;
+				}
+				const bucketRegion = await resolveBucketRegion(this.config.bucket, {
+					...probeCredentials && { credentials: probeCredentials },
+					...fallbackRegion && { fallbackRegion }
+				});
+				if (bucketRegion !== currentRegion) {
+					this.logger.debug(`State bucket '${this.config.bucket}' is in '${bucketRegion}' (lock client was '${currentRegion}'); building a region-corrected S3 client for lock operations.`);
+					this.s3Client = new S3Client({
+						region: bucketRegion,
+						credentials: this.s3Client.config.credentials,
+						logger: {
+							debug: () => {},
+							info: () => {},
+							warn: () => {},
+							error: () => {}
+						}
+					});
+				}
+				this.clientResolved = true;
+			} finally {
+				this.resolveInFlight = null;
+			}
+		})();
+		return this.resolveInFlight;
+	}
+	/**
 	* Get the S3 key for a stack's lock file.
 	*
 	* Locks are region-scoped, mirroring the state key layout
@@ -3607,6 +3673,7 @@ var LockManager = class {
 	* @param operation Operation being performed (e.g., "deploy", "destroy")
 	*/
 	async acquireLock(stackName, region, owner, operation) {
+		await this.ensureClientForBucket();
 		const key = this.getLockKey(stackName, region);
 		const lockOwner = owner || this.getDefaultOwner();
 		const now = Date.now();
@@ -3669,6 +3736,7 @@ var LockManager = class {
 	* file (e.g. for state-listing tools that don't yet know the region).
 	*/
 	async getLockInfo(stackName, region) {
+		await this.ensureClientForBucket();
 		const key = this.getLockKey(stackName, region);
 		try {
 			this.logger.debug(`Getting lock info for stack: ${stackName}`);
@@ -3705,6 +3773,7 @@ var LockManager = class {
 	* Release a lock for a stack
 	*/
 	async releaseLock(stackName, region) {
+		await this.ensureClientForBucket();
 		const key = this.getLockKey(stackName, region);
 		try {
 			this.logger.debug(`Releasing lock for stack: ${stackName} (${region})`);
@@ -3739,6 +3808,7 @@ var LockManager = class {
 	* Internal method to delete the lock file from S3
 	*/
 	async deleteLock(stackName, region) {
+		await this.ensureClientForBucket();
 		const key = this.getLockKey(stackName, region);
 		await this.s3Client.send(new DeleteObjectCommand({
 			Bucket: this.config.bucket,
@@ -12673,4 +12743,4 @@ var DeployEngine = class {
 
 //#endregion
 export { resolveBucketRegion as $, stringifyValue as A, resolveApp as B, DiffCalculator as C, S3StateBackend as D, LockManager as E, runDockerForeground as F, warnDeprecatedNoPrefixCliFlag as G, resolveSkipPrefix as H, runDockerStreaming as I, MIGRATE_TMP_PREFIX as J, CFN_TEMPLATE_BODY_LIMIT as K, Synthesizer as L, buildDockerImage as M, formatDockerLoginError as N, shouldRetainResource as O, getDockerCmd as P, clearBucketRegionCache as Q, getDefaultStateBucketName as R, applyRoleArnIfSet as S, TemplateParser as T, resolveStateBucketWithDefault as U, resolveCaptureObservedState as V, resolveStateBucketWithDefaultAndSource as W, uploadCfnTemplate as X, findLargeInlineResources as Y, AssemblyReader as Z, collectInlinePolicyNamesManagedBySiblings as _, withRetry as a, CloudControlProvider as b, extractDeploymentEventError as c, cyan as d, gray as f, IAMRoleProvider as g, yellow as h, withResourceDeadline as i, WorkGraph as j, AssetPublisher as k, formatResourceLine as l, red as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isRetryableTransientError as o, green as p, CFN_TEMPLATE_URL_LIMIT as q, DeployEngine as r, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, bold as u, ProviderRegistry as v, DagBuilder as w, IntrinsicFunctionResolver as x, findActionableSilentDrops as y, getLegacyStateBucketName as z };
-//# sourceMappingURL=deploy-engine-CFaK71E9.js.map
+//# sourceMappingURL=deploy-engine-CcOt3mUO.js.map