#1732 Share single AwsS3Client instance across lock, sync, and verifier

Summary

S3DatastoreProviderImpl creates a separate S3Client (wrapping AwsS3Client) in each factory method:

• createLock() — new S3Client(this.s3ClientConfig()) (s3.ts:146)
• createSyncService() — new S3Client(this.s3ClientConfig()) (s3.ts:154)
• createVerifier() — new S3DatastoreVerifier(this.config) which internally creates new S3Client(config) (s3_verifier.ts:36)

Each AwsS3Client gets its own TCP/TLS connection pool, middleware stack, and credential resolution chain. On a typical command that uses lock + sync + verifier, that's 3 independent AWS SDK clients with 3 separate TLS handshakes to S3.

Suggested fix

Lazily create one S3Client on first use and share it across all factory methods:

class S3DatastoreProviderImpl implements DatastoreProvider {
    private _s3?: S3Client;

    private s3(): S3Client {
        if (!this._s3) this._s3 = new S3Client(this.s3ClientConfig());
        return this._s3;
    }

    createLock(...): DistributedLock {
        return new S3Lock(this.s3(), options);
    }

    createSyncService(...): DatastoreSyncService {
        return new S3CacheSyncService(this.s3(), cachePath, ...);
    }
    // etc.
}

References

• s3.ts:120-163 (S3DatastoreProviderImpl)
• s3_client.ts:336-382 (S3Client constructor — AwsS3Client creation)
• s3_verifier.ts:34-37 (separate S3Client for verifier)

Upstream repository: https://github.com/systeminit/swamp-extensions

Environment

• Extension: @swamp/s3-datastore@2026.08.12.1
• swamp: 20260819.011806.0-sha.a9c7ee9a
• OS: darwin (x86_64)
• Deno: 2.8.3
• Shell: /bin/zsh