@go-to-k/cdkd 0.220.3 → 0.220.4

package/dist/cli.js

@@ -1553,7 +1553,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.220.3";
+	return "0.220.4";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -1929,6 +1929,18 @@ function recordRunFailed(recorder, stackName, error) {
 *   lock + bounded retry. After exhaustion, the writer logs warn and
 *   continues; the index becomes stale until the next deploy/destroy
 *   updates it.
+*
+* Cross-region state bucket: like `S3StateBackend` and `LockManager`, the
+* store tolerates a state bucket that lives in a different AWS region from
+* the CLI's base region. Before its first S3 operation it resolves the
+* bucket's actual region via `GetBucketLocation` and, if it differs from
+* the supplied client's region, builds a private replacement client for
+* that region (issue #819 — without this, every index write/remove against
+* a cross-region bucket failed with S3's 301 PermanentRedirect, surfacing
+* as `Exports index ... failed (non-retryable): ... must be addressed using
+* the specified endpoint`; the index was silently never maintained
+* cross-region, although the canonical state.json — written through the
+* already-region-corrected `S3StateBackend` — stayed correct).
 */
 /** Schema version for the exports index file. Separate from state.json's version. */
 const EXPORT_INDEX_VERSION = 1;
@@ -1977,6 +1989,9 @@ var ExportIndexStore = class {
 	* where it actually matters. Reads (`lookup`) remain unsynchronized.
 	*/
 	writeChain = Promise.resolve();
+	/** Memoization for the one-time bucket-region resolution (issue #819). */
+	clientResolved = false;
+	resolveInFlight = null;
 	constructor(s3Client, bucket, prefix, region, stateBackend, opts = {}) {
 		this.s3Client = s3Client;
 		this.bucket = bucket;
@@ -1993,6 +2008,72 @@ var ExportIndexStore = class {
 		return `${this.prefix}/_index/${this.region}/exports.json`;
 	}
 	/**
+	* Resolve the state bucket's actual region and, if it differs from the
+	* supplied client's configured region, replace the client reference with
+	* a new S3Client pointed at the bucket's region (issue #819).
+	*
+	* Mirrors `LockManager.ensureClientForBucket()` (issue #803) with the same
+	* two deliberate differences from `S3StateBackend`:
+	*
+	* - The replacement client reuses the original client's resolved
+	*   credentials provider, so `--profile` / static credentials carry over
+	*   without the four `ExportIndexStore` call sites having to thread client
+	*   options.
+	* - The original client is NOT destroyed. It is the shared `AwsClients.s3`
+	*   instance that other components (state backend, lock manager) still hold
+	*   a reference to.
+	*
+	* `resolveBucketRegion` caches per bucket name for the process lifetime, so
+	* when the state backend / lock manager have already resolved the same
+	* bucket this incurs no additional `GetBucketLocation` call.
+	*
+	* Best-effort: if the supplied client does not expose the SDK
+	* `config.region()` shape (e.g. a hand-rolled test double) the resolution
+	* is skipped and the original client is used unchanged.
+	*/
+	async ensureClientForBucket() {
+		if (this.clientResolved) return;
+		if (this.resolveInFlight) return this.resolveInFlight;
+		this.resolveInFlight = (async () => {
+			try {
+				const config = this.s3Client.config;
+				if (!config || typeof config.region !== "function") {
+					this.clientResolved = true;
+					return;
+				}
+				const currentRegion = await config.region();
+				const fallbackRegion = typeof currentRegion === "string" ? currentRegion : void 0;
+				let probeCredentials;
+				try {
+					if (typeof config.credentials === "function") probeCredentials = await config.credentials();
+				} catch {
+					probeCredentials = void 0;
+				}
+				const bucketRegion = await resolveBucketRegion(this.bucket, {
+					...probeCredentials && { credentials: probeCredentials },
+					...fallbackRegion && { fallbackRegion }
+				});
+				if (bucketRegion !== currentRegion) {
+					this.logger.debug(`State bucket '${this.bucket}' is in '${bucketRegion}' (exports-index client was '${String(currentRegion)}'); building a region-corrected S3 client for index operations.`);
+					this.s3Client = new S3Client({
+						region: bucketRegion,
+						credentials: this.s3Client.config.credentials,
+						logger: {
+							debug: () => {},
+							info: () => {},
+							warn: () => {},
+							error: () => {}
+						}
+					});
+				}
+				this.clientResolved = true;
+			} finally {
+				this.resolveInFlight = null;
+			}
+		})();
+		return this.resolveInFlight;
+	}
+	/**
 	* Look up an exported value by name. Returns the cached entry on hit,
 	* or `undefined` on miss. The caller is responsible for falling back
 	* to a state.json scan and (if found) patching the index via
@@ -2113,6 +2194,7 @@ var ExportIndexStore = class {
 		}
 	}
 	async readIndexRaw() {
+		await this.ensureClientForBucket();
 		try {
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.bucket,
@@ -2128,6 +2210,7 @@ var ExportIndexStore = class {
 		}
 	}
 	async writeIndex(next, expectedEtag) {
+		await this.ensureClientForBucket();
 		const body = JSON.stringify(next, null, 2);
 		return (await this.s3Client.send(new PutObjectCommand({
 			Bucket: this.bucket,
@@ -53550,7 +53633,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.220.3");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.220.4");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());