@go-to-k/cdkd 0.221.0 → 0.221.1

package/dist/{deploy-engine-xlz3wc4W.js → deploy-engine-OWyYqmlc.js}

@@ -3017,6 +3017,75 @@ function shouldRetainResource(deletionPolicy) {
 	return deletionPolicy === "Retain" || deletionPolicy === "RetainExceptOnCreate";
 }
 
+//#endregion
+//#region src/utils/bucket-region-client.ts
+/**
+* Resolve a state bucket's actual region and, if it differs from the supplied
+* client's configured region, return a fresh `S3Client` pointed at the bucket's
+* region (reusing the caller's credentials). Returns `null` when no rebuild is
+* needed — the bucket is already in the client's region — so the caller keeps
+* using the original client.
+*
+* This is the shared core of the (previously triplicated) `ensureClientForBucket`
+* pattern in `S3StateBackend` (PR #60), `LockManager` (#803), and
+* `ExportIndexStore` (#819). Each store keeps its own per-instance memoization
+* (`clientResolved` flag / single-flight `resolveInFlight` promise) and just
+* delegates the probe + short-circuit + rebuild here.
+*
+* The probe goes through the cached `resolveBucketRegion`, so when several
+* stores resolve the same bucket only the FIRST issues a `GetBucketLocation`.
+* `resolveBucketRegion` never throws — on any error it returns the supplied
+* `fallbackRegion` (the client's current region), so a missing / forbidden
+* bucket degrades to "no rebuild" rather than blocking the caller.
+*
+* Credential / ownership / test-double behavior is controlled by
+* {@link RebuildClientForBucketRegionOptions} — see each field for the per-store
+* rationale.
+*
+* @returns A region-corrected `S3Client` to swap in, or `null` to signal
+*   "no rebuild needed; keep the original client".
+*/
+async function rebuildClientForBucketRegion(client, bucket, opts = {}) {
+	const config = client.config;
+	if (!config || typeof config.region !== "function") {
+		if (opts.tolerateNonStandardClient) return null;
+	}
+	const currentRegion = await config.region();
+	const fallbackRegion = typeof currentRegion === "string" ? currentRegion : void 0;
+	let probeCredentials;
+	if (opts.credentials) probeCredentials = opts.credentials;
+	else if (opts.reuseClientCredentials && typeof config.credentials === "function") try {
+		probeCredentials = await config.credentials();
+	} catch {
+		probeCredentials = void 0;
+	}
+	const bucketRegion = await resolveBucketRegion(bucket, {
+		...opts.profile && { profile: opts.profile },
+		...probeCredentials && { credentials: probeCredentials },
+		...fallbackRegion && { fallbackRegion }
+	});
+	if (bucketRegion === currentRegion) return null;
+	opts.onRebuild?.({
+		bucket,
+		bucketRegion,
+		currentRegion
+	});
+	const rebuiltCredentials = opts.credentials ? opts.credentials : opts.reuseClientCredentials ? client.config.credentials : void 0;
+	const replacement = new S3Client({
+		region: bucketRegion,
+		...opts.profile && { profile: opts.profile },
+		...rebuiltCredentials !== void 0 && { credentials: rebuiltCredentials },
+		logger: {
+			debug: () => {},
+			info: () => {},
+			warn: () => {},
+			error: () => {}
+		}
+	});
+	if (opts.destroyOldClient) client.destroy();
+	return replacement;
+}
+
 //#endregion
 //#region src/state/s3-state-backend.ts
 /**
@@ -3100,29 +3169,15 @@ var S3StateBackend = class {
 		if (this.resolveInFlight) return this.resolveInFlight;
 		this.resolveInFlight = (async () => {
 			try {
-				const currentRegion = await this.s3Client.config.region();
-				const fallbackRegion = typeof currentRegion === "string" ? currentRegion : void 0;
-				const bucketRegion = await resolveBucketRegion(this.config.bucket, {
+				const replacement = await rebuildClientForBucketRegion(this.s3Client, this.config.bucket, {
 					...this.clientOpts.profile && { profile: this.clientOpts.profile },
 					...this.clientOpts.credentials && { credentials: this.clientOpts.credentials },
-					...fallbackRegion && { fallbackRegion }
+					destroyOldClient: true,
+					onRebuild: ({ bucketRegion, currentRegion }) => {
+						this.logger.debug(`State bucket '${this.config.bucket}' is in '${bucketRegion}' (client was '${String(currentRegion)}'); rebuilding S3 client.`);
+					}
 				});
-				if (bucketRegion !== currentRegion) {
-					this.logger.debug(`State bucket '${this.config.bucket}' is in '${bucketRegion}' (client was '${currentRegion}'); rebuilding S3 client.`);
-					const oldClient = this.s3Client;
-					this.s3Client = new S3Client({
-						region: bucketRegion,
-						...this.clientOpts.profile && { profile: this.clientOpts.profile },
-						...this.clientOpts.credentials && { credentials: this.clientOpts.credentials },
-						logger: {
-							debug: () => {},
-							info: () => {},
-							warn: () => {},
-							error: () => {}
-						}
-					});
-					oldClient.destroy();
-				}
+				if (replacement) this.s3Client = replacement;
 				this.clientResolved = true;
 			} finally {
 				this.resolveInFlight = null;
@@ -3586,31 +3641,13 @@ var LockManager = class {
 		if (this.resolveInFlight) return this.resolveInFlight;
 		this.resolveInFlight = (async () => {
 			try {
-				const currentRegion = await this.s3Client.config.region();
-				const fallbackRegion = typeof currentRegion === "string" ? currentRegion : void 0;
-				let probeCredentials;
-				try {
-					probeCredentials = await this.s3Client.config.credentials();
-				} catch {
-					probeCredentials = void 0;
-				}
-				const bucketRegion = await resolveBucketRegion(this.config.bucket, {
-					...probeCredentials && { credentials: probeCredentials },
-					...fallbackRegion && { fallbackRegion }
+				const replacement = await rebuildClientForBucketRegion(this.s3Client, this.config.bucket, {
+					reuseClientCredentials: true,
+					onRebuild: ({ bucketRegion, currentRegion }) => {
+						this.logger.debug(`State bucket '${this.config.bucket}' is in '${bucketRegion}' (lock client was '${String(currentRegion)}'); building a region-corrected S3 client for lock operations.`);
+					}
 				});
-				if (bucketRegion !== currentRegion) {
-					this.logger.debug(`State bucket '${this.config.bucket}' is in '${bucketRegion}' (lock client was '${currentRegion}'); building a region-corrected S3 client for lock operations.`);
-					this.s3Client = new S3Client({
-						region: bucketRegion,
-						credentials: this.s3Client.config.credentials,
-						logger: {
-							debug: () => {},
-							info: () => {},
-							warn: () => {},
-							error: () => {}
-						}
-					});
-				}
+				if (replacement) this.s3Client = replacement;
 				this.clientResolved = true;
 			} finally {
 				this.resolveInFlight = null;
@@ -11277,6 +11314,8 @@ const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
 	"does not exist",
 	"Schema is currently being altered",
 	"Invalid principal in policy",
+	"Policy Error: PrincipalNotFound",
+	"Invalid value for the parameter Policy",
 	"required permissions for: ENHANCED_MONITORING",
 	"Caught ServiceAccessDeniedException",
 	"conflicting conditional operation",
@@ -12743,5 +12782,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { resolveBucketRegion as $, stringifyValue as A, resolveApp as B, DiffCalculator as C, S3StateBackend as D, LockManager as E, runDockerForeground as F, warnDeprecatedNoPrefixCliFlag as G, resolveSkipPrefix as H, runDockerStreaming as I, MIGRATE_TMP_PREFIX as J, CFN_TEMPLATE_BODY_LIMIT as K, Synthesizer as L, buildDockerImage as M, formatDockerLoginError as N, shouldRetainResource as O, getDockerCmd as P, clearBucketRegionCache as Q, getDefaultStateBucketName as R, applyRoleArnIfSet as S, TemplateParser as T, resolveStateBucketWithDefault as U, resolveCaptureObservedState as V, resolveStateBucketWithDefaultAndSource as W, uploadCfnTemplate as X, findLargeInlineResources as Y, AssemblyReader as Z, collectInlinePolicyNamesManagedBySiblings as _, withRetry as a, CloudControlProvider as b, extractDeploymentEventError as c, cyan as d, gray as f, IAMRoleProvider as g, yellow as h, withResourceDeadline as i, WorkGraph as j, AssetPublisher as k, formatResourceLine as l, red as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isRetryableTransientError as o, green as p, CFN_TEMPLATE_URL_LIMIT as q, DeployEngine as r, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, bold as u, ProviderRegistry as v, DagBuilder as w, IntrinsicFunctionResolver as x, findActionableSilentDrops as y, getLegacyStateBucketName as z };
-//# sourceMappingURL=deploy-engine-xlz3wc4W.js.map
+export { clearBucketRegionCache as $, AssetPublisher as A, getLegacyStateBucketName as B, DiffCalculator as C, S3StateBackend as D, LockManager as E, getDockerCmd as F, resolveStateBucketWithDefaultAndSource as G, resolveCaptureObservedState as H, runDockerForeground as I, CFN_TEMPLATE_URL_LIMIT as J, warnDeprecatedNoPrefixCliFlag as K, runDockerStreaming as L, WorkGraph as M, buildDockerImage as N, rebuildClientForBucketRegion as O, formatDockerLoginError as P, AssemblyReader as Q, Synthesizer as R, applyRoleArnIfSet as S, TemplateParser as T, resolveSkipPrefix as U, resolveApp as V, resolveStateBucketWithDefault as W, findLargeInlineResources as X, MIGRATE_TMP_PREFIX as Y, uploadCfnTemplate as Z, collectInlinePolicyNamesManagedBySiblings as _, withRetry as a, CloudControlProvider as b, extractDeploymentEventError as c, cyan as d, resolveBucketRegion as et, gray as f, IAMRoleProvider as g, yellow as h, withResourceDeadline as i, stringifyValue as j, shouldRetainResource as k, formatResourceLine as l, red as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isRetryableTransientError as o, green as p, CFN_TEMPLATE_BODY_LIMIT as q, DeployEngine as r, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, bold as u, ProviderRegistry as v, DagBuilder as w, IntrinsicFunctionResolver as x, findActionableSilentDrops as y, getDefaultStateBucketName as z };
+//# sourceMappingURL=deploy-engine-OWyYqmlc.js.map