@go-to-k/cdkd 0.284.57 → 0.284.59

package/dist/index.js

@@ -1,4 +1,4 @@
-import { An as Synthesizer, Dr as formatError, Er as SynthesisError, Jt as TemplateParser, Or as isCdkdError, Qn as AssemblyReader, Tr as StateError, Ut as DiffCalculator, W as IAMRoleProvider, Yt as LockManager, Zt as S3StateBackend, ar as setAwsClients, br as ProvisioningError, cr as ConfigError, er as clearBucketRegionCache, gr as LockError, ir as resetAwsClients, kr as normalizeAwsError, nr as AwsClients, or as AssetError, q as ProviderRegistry, qt as DagBuilder, r as DeployEngine, rn as AssetPublisher, rr as getAwsClients, rt as CloudControlProvider, sr as CdkdError, tr as resolveBucketRegion, ur as DependencyError } from "./deploy-engine-E_IU0Fwy.js";
+import { An as Synthesizer, Dr as formatError, Er as SynthesisError, Jt as TemplateParser, Or as isCdkdError, Qn as AssemblyReader, Tr as StateError, Ut as DiffCalculator, W as IAMRoleProvider, Yt as LockManager, Zt as S3StateBackend, ar as setAwsClients, br as ProvisioningError, cr as ConfigError, er as clearBucketRegionCache, gr as LockError, ir as resetAwsClients, kr as normalizeAwsError, nr as AwsClients, or as AssetError, q as ProviderRegistry, qt as DagBuilder, r as DeployEngine, rn as AssetPublisher, rr as getAwsClients, rt as CloudControlProvider, sr as CdkdError, tr as resolveBucketRegion, ur as DependencyError } from "./deploy-engine-B6cbj8-j.js";
 import { n as getLogger, r as setLogger, t as ConsoleLogger } from "./logger-zRrlbaQt.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-DvPWR2xV.js → program-D2zqjYCT.js}

@@ -1,7 +1,7 @@
-import { $ as endCommandInterruptScope, $n as processStackMessages, $t as exportNamesCarriedFrom, A as renderStatefulReason, An as Synthesizer, Ar as withErrorHandling, At as isSingleDynamicReferenceToken, B as exportAliasCollisionScrubWarning, Bn as resolveUseCdkBootstrapAssets, Bt as s3BucketRegionalDomainName, C as isFinalSnapshotError, Cn as formatDockerLoginError, Cr as StackHasActiveImportsError, Ct as requireConfigString, D as extractDeploymentEventError, Dn as runDockerStreaming, Dt as createSecretMasker, E as makeCanonicalizePropertiesFn, En as runDockerForeground, Et as TEMPLATE_SOURCED_RULES, F as green, Fn as resolveAutoAssetStorage, Ft as classifyReplaySecretRegion, G as collectInlinePolicyNamesManagedBySiblings, Gn as MIGRATE_TMP_PREFIX, Gt as describeTypeWithThrottleRetry, H as secretBearingStateKeyWarning, Hn as warnDeprecatedNoPrefixCliFlag, Ht as applyRoleArnIfSet, I as red, In as resolveCaptureObservedState, It as producerRegionsFromState, J as findActionableSilentDrops, Jn as expectedOwnerParam, Jt as TemplateParser, K as clearOnUpdateRemoval, Kn as findLargeInlineResources, Kt as withRetry, L as yellow, Ln as resolveSkipPrefix, Lt as s3BucketArn, M as bold, Mn as getDefaultStateBucketName, Mr as isRetryableTransientError, Mt as maskSecretsInText, N as cyan, Nn as getLegacyStateBucketName, Nr as isThrottlingError, Nt as redactSecretsForState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as AssetManifestLoader, Ot as dynamicReferenceTokens, P as gray, Pn as resolveApp, Pr as markNonRetryable, Pt as scrubResourceRecord, Q as beginCommandInterruptScope, Qn as AssemblyReader, Qt as rebuildClientForBucketRegion, R as collectDeclaredOutputNames, Rn as resolveStateBucketWithDefault, Rt as s3BucketDomainName, S as createPreDeleteFinalSnapshot, Sn as dockerSpawnEnvWithSensitive, Sr as ResourceUpdateNotSupportedError, St as requireConfigObject, T as unsupportedFinalSnapshotError, Tn as partitionSensitiveEnv, Tt as STATE_SOURCED_READBACK_RULES, U as stateKeySecretExposure, Un as CFN_TEMPLATE_BODY_LIMIT, Ut as DiffCalculator, V as isExportAliasCollision, Vn as stateBucketExistenceConfirmed, Vt as s3BucketWebsiteUrl, W as IAMRoleProvider, Wn as CFN_TEMPLATE_URL_LIMIT, Wt as INTRINSIC_KEYS, X as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as canonicalizeRegion, Xt as displaySafe, Y as findSilentDropProperties, Yn as PARTITION_TABLE, Yt as LockManager, Z as DEFAULT_STATE_PREFIX, Zn as derivePartitionAndUrlSuffix, Zt as S3StateBackend, _ as computeImplicitDeleteEdges, _n as readBootstrapMarkerBody, _r as MissingCdkCliError, _t as configBooleanRefusal, a as DeploymentEventsStore, an as WorkGraph, ar as setAwsClients, at as disableInstanceApiTermination, b as buildFinalSnapshotIdentifier, bn as buildDenyExternalAccessPolicy, br as ProvisioningError, bt as replayWarn, c as replayFailedOperations, cn as loadPublishableAssetManifest, ct as carriesDynamicReference, d as updatePartialReason, dn as stripControlChars, dr as DeployCancelledError, dt as refStateLookupFromResource, en as importableOutputKeys, et as interruptWatchListenerCount, f as UNSPECIFIED_SKIP_REASON, fn as AssetModeResolver, fr as DynamicReferenceRegionAmbiguousError, ft as WAFv2WebACLProvider, g as IMPLICIT_DELETE_DEPENDENCIES, gn as parseBootstrapMarker, gt as coerceCfnBoolean, h as maskingRetryLogger, hn as getBootstrapMarkerKey, hr as LocalStartServiceError, ht as assertRegionMatch, i as DeploymentEventsReader, in as stringifyValue, ir as resetAwsClients, it as slowCcOperationTimeoutMs, j as formatResourceLine, jn as synthesisStatusMessage, jr as isMarkedNonRetryable, jt as maskSecretsInError, k as isStatefulRecreateTargetSync, kn as getDockerImageBySourceHash, kr as normalizeAwsError, kt as errorCauseChain, l as replayRollback, ln as rewriteTemplateAssetReferences, lr as CrossAccountSecretRefusalError, lt as cfnRefValueFromPhysicalId, m as withResourceDeadline, mn as ensureAssetStorage, mr as LocalMigrateError, mt as resolveExplicitPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as shouldRetainResource, nr as AwsClients, nt as startInterruptWatch, o as planFailedOps, on as buildAssetRedirectMap, ot as isTerminationProtectionPropagationError, p as deleteSkipReason, pn as BOOTSTRAP_MARKER_PREFIX, pr as LocalInvokeBuildError$1, pt as normalizeAwsTagsToCfn, q as ProviderRegistry, qn as uploadCfnTemplate, qt as DagBuilder, r as DeployEngine, rn as AssetPublisher, rr as getAwsClients, rt as CloudControlProvider, s as planRollback, sn as createAssetRedirectResolver, sr as CdkdError, st as IntrinsicFunctionResolver, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as importableOutputs, tr as resolveBucketRegion, tt as isInterruptedWaitError, u as updatePartialMessage, un as escapeRegExp, ut as getAccountInfo, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as validateAssetBucketName, vr as NestedStackChildDirectDestroyError, vt as configStringRefusal, w as refusesFinalSnapshot, wn as getDockerCmd, wr as StackTerminationProtectionError, wt as STATE_SOURCED_CROSS_GENERATION_RULES, x as ccRoutedFinalSnapshotError, xn as buildDockerImage, xr as ResourceTimeoutError, xt as requireConfigArray, y as PRE_DELETE_SNAPSHOT_TYPES, yn as validateContainerRepoName, yr as PartialFailureError, yt as readConfigString, z as collectPublishedOutputNames, zn as resolveStateBucketWithDefaultAndSource, zt as s3BucketDualStackDomainName } from "./deploy-engine-E_IU0Fwy.js";
+import { $ as endCommandInterruptScope, $n as processStackMessages, $t as exportNamesCarriedFrom, A as renderStatefulReason, An as Synthesizer, Ar as withErrorHandling, At as isSingleDynamicReferenceToken, B as exportAliasCollisionScrubWarning, Bn as resolveUseCdkBootstrapAssets, Bt as s3BucketRegionalDomainName, C as isFinalSnapshotError, Cn as formatDockerLoginError, Cr as StackHasActiveImportsError, Ct as requireConfigString, D as extractDeploymentEventError, Dn as runDockerStreaming, Dt as createSecretMasker, E as makeCanonicalizePropertiesFn, En as runDockerForeground, Et as TEMPLATE_SOURCED_RULES, F as green, Fn as resolveAutoAssetStorage, Ft as classifyReplaySecretRegion, G as collectInlinePolicyNamesManagedBySiblings, Gn as MIGRATE_TMP_PREFIX, Gt as describeTypeWithThrottleRetry, H as secretBearingStateKeyWarning, Hn as warnDeprecatedNoPrefixCliFlag, Ht as applyRoleArnIfSet, I as red, In as resolveCaptureObservedState, It as producerRegionsFromState, J as findActionableSilentDrops, Jn as expectedOwnerParam, Jt as TemplateParser, K as clearOnUpdateRemoval, Kn as findLargeInlineResources, Kt as withRetry, L as yellow, Ln as resolveSkipPrefix, Lt as s3BucketArn, M as bold, Mn as getDefaultStateBucketName, Mr as isRetryableTransientError, Mt as maskSecretsInText, N as cyan, Nn as getLegacyStateBucketName, Nr as isThrottlingError, Nt as redactSecretsForState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as AssetManifestLoader, Ot as dynamicReferenceTokens, P as gray, Pn as resolveApp, Pr as markNonRetryable, Pt as scrubResourceRecord, Q as beginCommandInterruptScope, Qn as AssemblyReader, Qt as rebuildClientForBucketRegion, R as collectDeclaredOutputNames, Rn as resolveStateBucketWithDefault, Rt as s3BucketDomainName, S as createPreDeleteFinalSnapshot, Sn as dockerSpawnEnvWithSensitive, Sr as ResourceUpdateNotSupportedError, St as requireConfigObject, T as unsupportedFinalSnapshotError, Tn as partitionSensitiveEnv, Tt as STATE_SOURCED_READBACK_RULES, U as stateKeySecretExposure, Un as CFN_TEMPLATE_BODY_LIMIT, Ut as DiffCalculator, V as isExportAliasCollision, Vn as stateBucketExistenceConfirmed, Vt as s3BucketWebsiteUrl, W as IAMRoleProvider, Wn as CFN_TEMPLATE_URL_LIMIT, Wt as INTRINSIC_KEYS, X as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as canonicalizeRegion, Xt as displaySafe, Y as findSilentDropProperties, Yn as PARTITION_TABLE, Yt as LockManager, Z as DEFAULT_STATE_PREFIX, Zn as derivePartitionAndUrlSuffix, Zt as S3StateBackend, _ as computeImplicitDeleteEdges, _n as readBootstrapMarkerBody, _r as MissingCdkCliError, _t as configBooleanRefusal, a as DeploymentEventsStore, an as WorkGraph, ar as setAwsClients, at as disableInstanceApiTermination, b as buildFinalSnapshotIdentifier, bn as buildDenyExternalAccessPolicy, br as ProvisioningError, bt as replayWarn, c as replayFailedOperations, cn as loadPublishableAssetManifest, ct as carriesDynamicReference, d as updatePartialReason, dn as stripControlChars, dr as DeployCancelledError, dt as refStateLookupFromResource, en as importableOutputKeys, et as interruptWatchListenerCount, f as UNSPECIFIED_SKIP_REASON, fn as AssetModeResolver, fr as DynamicReferenceRegionAmbiguousError, ft as WAFv2WebACLProvider, g as IMPLICIT_DELETE_DEPENDENCIES, gn as parseBootstrapMarker, gt as coerceCfnBoolean, h as maskingRetryLogger, hn as getBootstrapMarkerKey, hr as LocalStartServiceError, ht as assertRegionMatch, i as DeploymentEventsReader, in as stringifyValue, ir as resetAwsClients, it as slowCcOperationTimeoutMs, j as formatResourceLine, jn as synthesisStatusMessage, jr as isMarkedNonRetryable, jt as maskSecretsInError, k as isStatefulRecreateTargetSync, kn as getDockerImageBySourceHash, kr as normalizeAwsError, kt as errorCauseChain, l as replayRollback, ln as rewriteTemplateAssetReferences, lr as CrossAccountSecretRefusalError, lt as cfnRefValueFromPhysicalId, m as withResourceDeadline, mn as ensureAssetStorage, mr as LocalMigrateError, mt as resolveExplicitPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as shouldRetainResource, nr as AwsClients, nt as startInterruptWatch, o as planFailedOps, on as buildAssetRedirectMap, ot as isTerminationProtectionPropagationError, p as deleteSkipReason, pn as BOOTSTRAP_MARKER_PREFIX, pr as LocalInvokeBuildError$1, pt as normalizeAwsTagsToCfn, q as ProviderRegistry, qn as uploadCfnTemplate, qt as DagBuilder, r as DeployEngine, rn as AssetPublisher, rr as getAwsClients, rt as CloudControlProvider, s as planRollback, sn as createAssetRedirectResolver, sr as CdkdError, st as IntrinsicFunctionResolver, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as importableOutputs, tr as resolveBucketRegion, tt as isInterruptedWaitError, u as updatePartialMessage, un as escapeRegExp, ut as getAccountInfo, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as validateAssetBucketName, vr as NestedStackChildDirectDestroyError, vt as configStringRefusal, w as refusesFinalSnapshot, wn as getDockerCmd, wr as StackTerminationProtectionError, wt as STATE_SOURCED_CROSS_GENERATION_RULES, x as ccRoutedFinalSnapshotError, xn as buildDockerImage, xr as ResourceTimeoutError, xt as requireConfigArray, y as PRE_DELETE_SNAPSHOT_TYPES, yn as validateContainerRepoName, yr as PartialFailureError, yt as readConfigString, z as collectPublishedOutputNames, zn as resolveStateBucketWithDefaultAndSource, zt as s3BucketDualStackDomainName } from "./deploy-engine-B6cbj8-j.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as getCdkdVersion } from "./version-D_smZOwC.js";
-import { t as ASGProvider } from "./asg-provider-DxXwlbI8.js";
+import { t as getCdkdVersion } from "./version-Biow6J38.js";
+import { t as ASGProvider } from "./asg-provider-BkbyCmqe.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -6868,6 +6868,51 @@ function mergeLegacySingular(plural, singular, onCollision) {
 * S3's CreateBucket is synchronous - no polling needed, unlike CC API which
 * requires async polling (1s→1.5s→2.25s...) adding seconds per resource.
 */
+/**
+* The bucket's real region as reported on an S3 error response, if present.
+*
+* S3 puts `x-amz-bucket-region` on the `BucketAlreadyOwnedByYou` 409 itself,
+* which is what lets the issue #2227 guard answer without a second API call.
+* Measured 2026-08-26 against a bucket in `us-west-2`: clients pinned to
+* `us-east-1`, `eu-west-1` and `ap-northeast-1` all received it. Both header
+* bags are read because only `$response.headers` was populated on those three
+* -- `$metadata.httpHeaders` was absent -- and the SDK is not consistent about
+* which one carries headers across error paths.
+*
+* The lookup is per-KEY across both bags, not a `??` between the bags
+* themselves: selecting a bag would pick an EMPTY `$response.headers` over a
+* populated `$metadata.httpHeaders`, so a future SDK that attaches both would
+* silently lose the header. Missing it only costs the `GetBucketLocation`
+* fallback (the guard still fails closed), but the cost is avoidable.
+*/
+function readBucketRegionHeader(error) {
+	const candidate = error;
+	const value = candidate?.$response?.headers?.["x-amz-bucket-region"] ?? candidate?.$metadata?.httpHeaders?.["x-amz-bucket-region"];
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	return trimmed === "" ? void 0 : trimmed;
+}
+/**
+* The region a `GetBucketLocation` answer denotes, canonicalized.
+*
+* Two legacy wire shapes, both original to the S3 API and both still returned,
+* which is why this is a function rather than a field read:
+*
+*  - a bucket in `us-east-1` answers with an EMPTY / null `LocationConstraint`.
+*    Absent therefore means `us-east-1`, NEVER "unknown" -- treating it as
+*    unknown and failing closed would refuse correct deploys in the commonest
+*    region. Measured 2026-08-26: `get-bucket-location` on a us-east-1 bucket
+*    returns `{"LocationConstraint": null}`. `src/utils/aws-region-resolver.ts`
+*    folds the same quirk the same way.
+*  - `EU` is a legacy alias for `eu-west-1`, matching the fold that
+*    `src/cli/commands/state.ts` already applies.
+*/
+function bucketLocationToRegion(constraint) {
+	const value = canonicalizeRegion((constraint ?? "").trim());
+	if (value === "") return "us-east-1";
+	if (value === "eu") return "eu-west-1";
+	return value;
+}
 var S3BucketProvider = class S3BucketProvider {
 	s3Client;
 	logger = getLogger().child("S3BucketProvider");
@@ -8575,6 +8620,75 @@ var S3BucketProvider = class S3BucketProvider {
 		return overrides;
 	}
 	/**
+	* Refuse to adopt an already-owned bucket that does not live in
+	* `expectedRegion`.
+	*
+	* `CreateBucket` answers `BucketAlreadyOwnedByYou` on OWNERSHIP, which is
+	* account-global, but a bucket is regional. So the error alone cannot
+	* distinguish the case the short-circuit was written for -- a retry of a
+	* create whose first attempt already succeeded, in THIS region -- from a
+	* bucket of ours that lives somewhere else entirely.
+	*
+	* The region is taken from the `x-amz-bucket-region` header on the 409
+	* ITSELF, so the common path costs no extra API call and needs no extra IAM
+	* permission. Measured 2026-08-26 against a bucket in `us-west-2`: clients
+	* pinned to `us-east-1`, `eu-west-1` and `ap-northeast-1` each got
+	* `name: BucketAlreadyOwnedByYou`, HTTP 409, `x-amz-bucket-region:
+	* us-west-2`. The header lives on `$response.headers`; `$metadata.httpHeaders`
+	* was absent on all three, which is why both are read.
+	*
+	* `GetBucketLocation` is the fallback when the header is missing.
+	* Deliberately NOT `HeadBucket`: `src/utils/aws-region-resolver.ts` already
+	* records why, and this guard's first cut re-learned it the expensive way. A
+	* cross-region `HeadBucket` 301s, and SDK v3's region-redirect middleware
+	* mishandles the empty-body HEAD response, yielding a synthetic
+	* `name: 'Unknown', message: 'UnknownError'`. The AWS CLI hides this by
+	* following the redirect; the SDK client does not. Unit tests that mocked the
+	* CLI's shape passed while the guard could not fire, and only a real-AWS integ
+	* arm caught it.
+	*
+	* Deliberately NOT `resolveBucketRegion` from that module either, despite the
+	* overlap: that helper NEVER THROWS and returns `fallbackRegion` on a failed
+	* probe, so wiring it here would turn this fail-CLOSED guard into a
+	* fail-OPEN one -- a probe failure would report the deploy's own region, the
+	* comparison would match, and the foreign bucket would be adopted. Its cache
+	* would also make a second call in one process skip the probe entirely.
+	*
+	* The refusal is `markNonRetryable` because it is deterministic and
+	* user-actionable: without it `withRetry` re-runs the whole create for its
+	* full budget before surfacing the same message, which reads as flaky AWS.
+	* The wording avoids the phrase "does not exist" for the same reason -- it is
+	* a literal member of `OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS`
+	* (`retryable-errors.ts`), so a message containing it is classified transient
+	* even when the throw is not.
+	*
+	* Issue [#2227](https://github.com/go-to-k/cdkd/issues/2227). Note the
+	* mid-delete mechanism that issue was FILED for is not reachable: measured, a
+	* `DeleteBucket` followed immediately by a `CreateBucket` of the same name
+	* SUCCEEDS outright in `us-east-1` and `us-west-2` alike, so there is no
+	* window in which this error can mean "being deleted". The cross-region adopt
+	* is the reachable defect in these lines.
+	*/
+	async assertExistingBucketRegion(logicalId, resourceType, bucketName, expectedRegion, createError) {
+		const wantRegion = canonicalizeRegion(expectedRegion);
+		const actualRegion = await this.resolveOwnedBucketRegion(bucketName, createError);
+		if (actualRegion === wantRegion) return;
+		throw markNonRetryable(new ProvisioningError(`Refusing to adopt existing S3 bucket ${bucketName} for ${logicalId} (${resourceType}): it is owned by this account but lives in ${actualRegion}, while this stack deploys to ${wantRegion}. S3 bucket names are globally unique, so 'BucketAlreadyOwnedByYou' does not mean the bucket is in this region. Adopting it would apply this stack's bucket configuration to a bucket in ${actualRegion}, and would record a physical id that denotes no bucket in ${wantRegion}. Either give this stack a bucket name unique to ${wantRegion}, or deploy the stack to ${actualRegion}.`, resourceType, logicalId, bucketName, createError));
+	}
+	/**
+	* The region an already-owned bucket actually lives in, canonicalized.
+	*
+	* Header first (free), `GetBucketLocation` second. A `GetBucketLocation`
+	* failure PROPAGATES rather than degrading to a guess: the caller is a
+	* fail-closed guard, and a guessed region is exactly what would make it
+	* adopt the wrong bucket.
+	*/
+	async resolveOwnedBucketRegion(bucketName, createError) {
+		const fromHeader = readBucketRegionHeader(createError);
+		if (fromHeader) return canonicalizeRegion(fromHeader);
+		return bucketLocationToRegion((await this.s3Client.send(new GetBucketLocationCommand({ Bucket: bucketName }))).LocationConstraint);
+	}
+	/**
 	* Create an S3 bucket
 	*/
 	async create(logicalId, resourceType, properties, context) {
@@ -8595,8 +8709,10 @@ var S3BucketProvider = class S3BucketProvider {
 				createdNewBucket = true;
 				this.logger.debug(`Created S3 bucket: ${bucketName}`);
 			} catch (createError) {
-				if (createError instanceof Error && (createError.name === "BucketAlreadyOwnedByYou" || createError.message.includes("you already own it"))) this.logger.debug(`S3 bucket ${bucketName} already exists and is owned by you`);
-				else throw createError;
+				if (createError instanceof Error && (createError.name === "BucketAlreadyOwnedByYou" || createError.message.includes("you already own it"))) {
+					await this.assertExistingBucketRegion(logicalId, resourceType, bucketName, region, createError);
+					this.logger.debug(`S3 bucket ${bucketName} already exists and is owned by you`);
+				} else throw createError;
 			}
 			let effectiveOverrides;
 			try {
@@ -87588,4 +87704,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-DvPWR2xV.js.map
+//# sourceMappingURL=program-D2zqjYCT.js.map