@go-to-k/cdkd 0.220.2 → 0.220.4

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { A as withErrorHandling, B as generateResourceNameWithFallback, C as StackHasActiveImportsError, F as getLiveRenderer, H as withStackName, I as PATTERN_B_NAME_PROPERTIES, L as PATTERN_B_RESOURCE_TYPES, M as getLogger, P as runStackBuffered, S as ResourceUpdateNotSupportedError, V as withSkipPrefix, _ as MissingCdkCliError, a as assertRegionMatch, b as ProvisioningError, f as LocalInvokeBuildError$1, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as matchesCdkPath, o as disableInstanceApiTermination, p as LocalMigrateError, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, t as CDK_PATH_TAG, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError, z as generateResourceName } from "./import-helpers-wLipXr5g.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as resolveBucketRegion, A as stringifyValue, B as resolveApp, C as DiffCalculator, D as S3StateBackend, E as LockManager, F as runDockerForeground, G as warnDeprecatedNoPrefixCliFlag, H as resolveSkipPrefix, I as runDockerStreaming, J as MIGRATE_TMP_PREFIX, K as CFN_TEMPLATE_BODY_LIMIT, L as Synthesizer, M as buildDockerImage, N as formatDockerLoginError, O as shouldRetainResource, P as getDockerCmd, R as getDefaultStateBucketName, S as applyRoleArnIfSet, T as TemplateParser, U as resolveStateBucketWithDefault, V as resolveCaptureObservedState, W as resolveStateBucketWithDefaultAndSource, X as uploadCfnTemplate, Y as findLargeInlineResources, Z as AssemblyReader, _ as collectInlinePolicyNamesManagedBySiblings, a as withRetry, b as CloudControlProvider, c as extractDeploymentEventError, d as cyan, f as gray, g as IAMRoleProvider, h as yellow, i as withResourceDeadline, j as WorkGraph, k as AssetPublisher, l as formatResourceLine, m as red, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as isRetryableTransientError, p as green, q as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as bold, v as ProviderRegistry, w as DagBuilder, x as IntrinsicFunctionResolver, y as findActionableSilentDrops, z as getLegacyStateBucketName } from "./deploy-engine-CcOt3mUO.js";
+import { $ as resolveBucketRegion, A as stringifyValue, B as resolveApp, C as DiffCalculator, D as S3StateBackend, E as LockManager, F as runDockerForeground, G as warnDeprecatedNoPrefixCliFlag, H as resolveSkipPrefix, I as runDockerStreaming, J as MIGRATE_TMP_PREFIX, K as CFN_TEMPLATE_BODY_LIMIT, L as Synthesizer, M as buildDockerImage, N as formatDockerLoginError, O as shouldRetainResource, P as getDockerCmd, R as getDefaultStateBucketName, S as applyRoleArnIfSet, T as TemplateParser, U as resolveStateBucketWithDefault, V as resolveCaptureObservedState, W as resolveStateBucketWithDefaultAndSource, X as uploadCfnTemplate, Y as findLargeInlineResources, Z as AssemblyReader, _ as collectInlinePolicyNamesManagedBySiblings, a as withRetry, b as CloudControlProvider, c as extractDeploymentEventError, d as cyan, f as gray, g as IAMRoleProvider, h as yellow, i as withResourceDeadline, j as WorkGraph, k as AssetPublisher, l as formatResourceLine, m as red, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as isRetryableTransientError, p as green, q as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as bold, v as ProviderRegistry, w as DagBuilder, x as IntrinsicFunctionResolver, y as findActionableSilentDrops, z as getLegacyStateBucketName } from "./deploy-engine-xlz3wc4W.js";
 import { t as ASGProvider } from "./asg-provider-B_hrCxRx.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes, randomUUID } from "node:crypto";
@@ -1553,7 +1553,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.220.2";
+	return "0.220.4";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -1929,6 +1929,18 @@ function recordRunFailed(recorder, stackName, error) {
 *   lock + bounded retry. After exhaustion, the writer logs warn and
 *   continues; the index becomes stale until the next deploy/destroy
 *   updates it.
+*
+* Cross-region state bucket: like `S3StateBackend` and `LockManager`, the
+* store tolerates a state bucket that lives in a different AWS region from
+* the CLI's base region. Before its first S3 operation it resolves the
+* bucket's actual region via `GetBucketLocation` and, if it differs from
+* the supplied client's region, builds a private replacement client for
+* that region (issue #819 — without this, every index write/remove against
+* a cross-region bucket failed with S3's 301 PermanentRedirect, surfacing
+* as `Exports index ... failed (non-retryable): ... must be addressed using
+* the specified endpoint`; the index was silently never maintained
+* cross-region, although the canonical state.json — written through the
+* already-region-corrected `S3StateBackend` — stayed correct).
 */
 /** Schema version for the exports index file. Separate from state.json's version. */
 const EXPORT_INDEX_VERSION = 1;
@@ -1977,6 +1989,9 @@ var ExportIndexStore = class {
 	* where it actually matters. Reads (`lookup`) remain unsynchronized.
 	*/
 	writeChain = Promise.resolve();
+	/** Memoization for the one-time bucket-region resolution (issue #819). */
+	clientResolved = false;
+	resolveInFlight = null;
 	constructor(s3Client, bucket, prefix, region, stateBackend, opts = {}) {
 		this.s3Client = s3Client;
 		this.bucket = bucket;
@@ -1993,6 +2008,72 @@ var ExportIndexStore = class {
 		return `${this.prefix}/_index/${this.region}/exports.json`;
 	}
 	/**
+	* Resolve the state bucket's actual region and, if it differs from the
+	* supplied client's configured region, replace the client reference with
+	* a new S3Client pointed at the bucket's region (issue #819).
+	*
+	* Mirrors `LockManager.ensureClientForBucket()` (issue #803) with the same
+	* two deliberate differences from `S3StateBackend`:
+	*
+	* - The replacement client reuses the original client's resolved
+	*   credentials provider, so `--profile` / static credentials carry over
+	*   without the four `ExportIndexStore` call sites having to thread client
+	*   options.
+	* - The original client is NOT destroyed. It is the shared `AwsClients.s3`
+	*   instance that other components (state backend, lock manager) still hold
+	*   a reference to.
+	*
+	* `resolveBucketRegion` caches per bucket name for the process lifetime, so
+	* when the state backend / lock manager have already resolved the same
+	* bucket this incurs no additional `GetBucketLocation` call.
+	*
+	* Best-effort: if the supplied client does not expose the SDK
+	* `config.region()` shape (e.g. a hand-rolled test double) the resolution
+	* is skipped and the original client is used unchanged.
+	*/
+	async ensureClientForBucket() {
+		if (this.clientResolved) return;
+		if (this.resolveInFlight) return this.resolveInFlight;
+		this.resolveInFlight = (async () => {
+			try {
+				const config = this.s3Client.config;
+				if (!config || typeof config.region !== "function") {
+					this.clientResolved = true;
+					return;
+				}
+				const currentRegion = await config.region();
+				const fallbackRegion = typeof currentRegion === "string" ? currentRegion : void 0;
+				let probeCredentials;
+				try {
+					if (typeof config.credentials === "function") probeCredentials = await config.credentials();
+				} catch {
+					probeCredentials = void 0;
+				}
+				const bucketRegion = await resolveBucketRegion(this.bucket, {
+					...probeCredentials && { credentials: probeCredentials },
+					...fallbackRegion && { fallbackRegion }
+				});
+				if (bucketRegion !== currentRegion) {
+					this.logger.debug(`State bucket '${this.bucket}' is in '${bucketRegion}' (exports-index client was '${String(currentRegion)}'); building a region-corrected S3 client for index operations.`);
+					this.s3Client = new S3Client({
+						region: bucketRegion,
+						credentials: this.s3Client.config.credentials,
+						logger: {
+							debug: () => {},
+							info: () => {},
+							warn: () => {},
+							error: () => {}
+						}
+					});
+				}
+				this.clientResolved = true;
+			} finally {
+				this.resolveInFlight = null;
+			}
+		})();
+		return this.resolveInFlight;
+	}
+	/**
 	* Look up an exported value by name. Returns the cached entry on hit,
 	* or `undefined` on miss. The caller is responsible for falling back
 	* to a state.json scan and (if found) patching the index via
@@ -2113,6 +2194,7 @@ var ExportIndexStore = class {
 		}
 	}
 	async readIndexRaw() {
+		await this.ensureClientForBucket();
 		try {
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.bucket,
@@ -2128,6 +2210,7 @@ var ExportIndexStore = class {
 		}
 	}
 	async writeIndex(next, expectedEtag) {
+		await this.ensureClientForBucket();
 		const body = JSON.stringify(next, null, 2);
 		return (await this.s3Client.send(new PutObjectCommand({
 			Bucket: this.bucket,
@@ -53550,7 +53633,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.220.2");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.220.4");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());