@fjall/deploy-core 2.22.1 → 2.23.1

package/dist/.minified

@@ -1 +1 @@
-174 files minified at 2026-06-30T21:20:24.926Z
+174 files minified at 2026-07-02T12:17:52.811Z

package/dist/src/orchestration/application/dockerBuildHelper.js

@@ -1 +1 @@
-import{isAbsolute as _,join as B,dirname as j,resolve as $}from"node:path";import{existsSync as x}from"node:fs";import{success as R,failure as l}from"@fjall/generator";import{deriveContentHashTag as F,maskSensitiveOutput as f,toKebab as I}from"@fjall/util";import{evaluateBakeGuard as U,evaluateResolvedBuildArgValues as G,acknowledgedBuildArgKeys as H,BAKE_GUARD_EXPOSURE_CLAUSE as V}from"@fjall/util/docker";import{logger as w}from"@fjall/util/logger";import{parseDockerServicesFromManifest as M}from"@fjall/util/manifest";import{STEP_IDS as k}from"../../types/stepDefinitions.js";import{resolveBuildSecrets as W,resolveSecretRefValue as z,resolveBuildSecretSessionProvider as X,sourcedRefsFromBuildArgs as Y}from"./buildSecretResolver.js";import{partitionForRegion as q}from"./buildSecretSession.js";import{resolveBuildArgs as J}from"./buildArgResolver.js";import{validateBuildGroup as Q}from"./buildGroupValidator.js";const P="dockerBuildHelper",A="Building and pushing Docker image";function Z(e,o,r){const t=B(o,e);if(x(t))return{path:t,base:o};if(r!==""&&r!==o){const a=B(r,e);if(x(a))return{path:a,base:r}}return{path:t,base:o}}function ee(e,o,r){const t=e.docker.path,a=e.docker.context;let s,n;if(_(t))s=t,n=o;else{const c=Z(t,o,r);s=c.path,n=c.base}return{buildContext:a?_(a)?$(a):$(n,a):$(j(s)),dockerfilePath:s,target:e.docker.target,resolvedViaFallback:n!==o}}function te(e){return`${e.buildContext}|${e.dockerfilePath}|${e.target??""}`}function re(e,o){return`Dockerfile not found for service '${e}' at ${o}. Checked the synth directory and the working directory. If your Dockerfile lives at the project root with the CDK app in a subdirectory, set an absolute docker.context (the build context must share the Dockerfile's directory).`}function ne(e){return e.startsWith("cn-")?"amazonaws.com.cn":"amazonaws.com"}function oe(e,o,r){return`${e}.dkr.ecr.${o}.${ne(o)}/${I(r)}`}function ie(e,o,r){const t=new Map;for(const a of e){const s=ee(a,o,r),n=te(s),g=t.get(n);g?g.members.push(a):t.set(n,{identity:s,members:[a]})}return Array.from(t.values())}async function se(e,o,r,t,a){const s=await e.buildAndPush({appName:o.appName,appPath:o.path,region:r,accountId:t},(n,g,c,v)=>{a.onDockerProgress?.(f(n),g,c,v)});return s.success?R({imageUri:s.data.imageUri,imageTag:s.data.imageTag}):l(s.error)}async function ae(e,o,r,t,a,s,n,g,c,v,p,h){const d=e.members[0];if(!x(e.identity.dockerfilePath))return l(new Error(re(d.name,e.identity.dockerfilePath)));e.identity.resolvedViaFallback&&n.onLog?.(`Building service '${d.name}' from ${e.identity.dockerfilePath} (resolved at the project root).`,"info");const i=[...d.docker.buildSecrets??[],...h??[]],m=Q({serviceName:d.name,dockerfilePath:e.identity.dockerfilePath,buildContext:e.identity.buildContext,...e.identity.target!==void 0&&{target:e.identity.target},...d.docker.buildArgs!==void 0&&{buildArgs:d.docker.buildArgs},...i.length>0&&{buildSecrets:i},members:e.members.map(u=>({serviceName:u.name,...u.docker.buildArgs!==void 0&&{buildArgs:u.docker.buildArgs},...u.docker.buildSecrets!==void 0&&{buildSecrets:u.docker.buildSecrets}}))});if(!m.success)return l(m.error);const b=U(d.docker.buildArgs,I(r.appName));for(const u of b.warnings)n.onLog?.(f(u.message),"warn");if(b.findings.length>0)return l(new Error(f(b.findings.map(u=>u.message).join(" "))));const y=i,S=Y(d.docker.buildArgs),C={appName:r.appName,region:t,accountId:a,partition:q(t)},N=await X(g,[...y,...S],C);if(!N.success)return l(N.error);const T=N.data,E=await J({manifestBuildArgs:d.docker.buildArgs,serviceDir:e.identity.buildContext,appDir:r.path,...v!==void 0&&{stage:v},shellEnv:process.env,...p!==void 0&&{flagBuildArgs:p},resolveSourcedValue:(u,K)=>z(T,{id:u,...K},c)});if(!E.success)return l(E.error);const O=E.data.buildArgs;for(const u of E.data.inferredDotenvKeys)n.onLog?.(f(`buildArg "${u}" was auto-declared from a .env file and will be baked into the image \u2014 ${V}.`),"warn");const L=G(O,I(r.appName),H(d.docker.buildArgs));if(L.length>0)return l(new Error(f(L.map(u=>u.message).join(" "))));let D;if(y.length>0){const u=await W(T,y,c);if(!u.success)return l(u.error);D=u.data}try{const u={appName:r.appName,appPath:e.identity.buildContext,region:t,accountId:a,buildContext:e.identity.buildContext,dockerfilePath:e.identity.dockerfilePath,pushByDigest:!0,serviceName:d.name,...e.identity.target!==void 0&&{target:e.identity.target},...Object.keys(O).length>0&&{buildArgs:O},...D!==void 0&&{buildSecrets:D.resolved}};return await de(e,u,o,s,n)}finally{D!==void 0&&await D.cleanup().catch(()=>n.onLog?.("Build-secret cleanup failed.","warn"))}}async function de(e,o,r,t,a){const s=await r.buildAndPush(o,(p,h,d,i)=>{a.onDockerProgress?.(f(p),h,d,i)});if(!s.success)return l(s.error);const n=s.data.imageDigest;if(typeof n!="string"||!n.startsWith("sha256:"))return l(new Error(`Buildx push succeeded but returned an invalid digest: ${f(String(n))}`));const g={},c=[];for(const p of e.members){const h=p.docker.target,d=F(n,p.name,h);if(!d.success)return l(d.error);const i=d.data,m=p.name;g[m]=i,c.push(`${t}:${i}`)}const v=await r.tagByDigest({sourceImage:t,digest:n,tags:c});return v.success?R({contentHashTagsByService:g}):l(v.error)}async function ke(e,o,r,t){const a=e.dockerProvider;if(!a)return R({});const s=o.awsProvider.getAccountId();if(!s)return t.onLog?.("Skipping Docker build \u2014 account ID not available","warn"),R({});const n=o.awsProvider.getRegion(),g=B(r.path,"cdk.out"),c=M(g),v=oe(s,n,r.appName);if(w.debug(P,"runDockerBuild starting",{appName:r.appName,appPath:r.path,accountId:s,region:n,cdkOutPath:g,manifestServiceCount:c.length,manifestServices:c.map(i=>({name:i.name,path:i.docker.path,context:i.docker.context,target:i.docker.target})),stepId:k.DOCKER_OPERATIONS,stepName:A}),t.onStepStart?.(k.DOCKER_OPERATIONS,A),c.length===0){t.onLog?.("Initialising ECR repository\u2026","info");const i=await a.initialiseECR({appName:r.appName,region:n,accountId:s});i.success||t.onLog?.(`ECR initialisation failed: ${f(i.error.message)}`,"warn"),t.onLog?.("Building and pushing Docker image\u2026","info");const m=await se(a,r,n,s,t);if(!m.success){w.debug(P,"Docker buildAndPush (legacy) failed",{appName:r.appName,error:f(m.error.message)}),t.onStepComplete?.(k.DOCKER_OPERATIONS,A,"error");const b=new Error(f(m.error.message));return t.onError?.(b),l(b)}return t.onStepComplete?.(k.DOCKER_OPERATIONS,A,"completed"),t.onLog?.(`Docker image pushed: ${m.data.imageUri}`,"info"),R({})}const p=await a.preflight?.();if(p!==void 0&&!p.success){t.onStepComplete?.(k.DOCKER_OPERATIONS,A,"error");const i=new Error(f(p.error.message));return t.onError?.(i),l(i)}const h=ie(c,r.path,e.workingDirectory);t.onLog?.(`Building and pushing ${c.length} service image(s) in ${h.length} group(s)\u2026`,"info");const d={};for(let i=0;i<h.length;i++){const m=h[i],b=m.members.map(S=>S.name).join(", ");t.onLog?.(`Building group ${i+1}/${h.length} (${b})\u2026`,"info");const y=await ae(m,a,r,n,s,v,t,o.awsProvider,e.abortSignal,e.options?.environment,e.options?.flagBuildArgs,e.options?.flagBuildSecrets);if(!y.success){w.debug(P,"Docker buildAndPush failed",{appName:r.appName,leader:m.members[0]?.name,members:b,error:f(y.error.message)}),t.onStepComplete?.(k.DOCKER_OPERATIONS,A,"error");const S=new Error(f(y.error.message));return t.onError?.(S),l(S)}for(const[S,C]of Object.entries(y.data.contentHashTagsByService))d[S]=C}return w.debug(P,"Docker buildAndPush succeeded",{appName:r.appName,services:c.map(i=>i.name),groupCount:h.length,contentHashTags:d}),t.onStepComplete?.(k.DOCKER_OPERATIONS,A,"completed"),t.onLog?.(`Docker images pushed for ${c.length} service(s)`,"info"),R(d)}export{A as DOCKER_BUILD_STEP_NAME,ke as runDockerBuild};
+import{isAbsolute as _,join as B,dirname as j,resolve as $}from"node:path";import{existsSync as x}from"node:fs";import{success as k,failure as l}from"@fjall/generator";import{deriveContentHashTag as F,maskSensitiveOutput as f,toKebab as I}from"@fjall/util";import{evaluateBakeGuard as U,evaluateResolvedBuildArgValues as G,acknowledgedBuildArgKeys as H,BAKE_GUARD_EXPOSURE_CLAUSE as V}from"@fjall/util/docker";import{logger as C}from"@fjall/util/logger";import{parseDockerServicesFromManifest as M}from"@fjall/util/manifest";import{STEP_IDS as y}from"../../types/stepDefinitions.js";import{resolveBuildSecrets as W,resolveSecretRefValue as z,resolveBuildSecretSessionProvider as X,sourcedRefsFromBuildArgs as Y}from"./buildSecretResolver.js";import{partitionForRegion as q}from"./buildSecretSession.js";import{resolveBuildArgs as J}from"./buildArgResolver.js";import{validateBuildGroup as Q}from"./buildGroupValidator.js";const P="dockerBuildHelper",E="Building and pushing Docker image";function Z(e,s,t){const r=B(s,e);if(x(r))return{path:r,base:s};if(t!==""&&t!==s){const o=B(t,e);if(x(o))return{path:o,base:t}}return{path:r,base:s}}function ee(e,s,t){const r=e.docker.path,o=e.docker.context;let a,i;if(_(r))a=r,i=s;else{const g=Z(r,s,t);a=g.path,i=g.base}return{buildContext:o?_(o)?$(o):$(i,o):$(j(a)),dockerfilePath:a,target:e.docker.target,resolvedViaFallback:i!==s}}function re(e){return`${e.buildContext}|${e.dockerfilePath}|${e.target??""}`}function te(e,s){return`Dockerfile not found for service '${e}' at ${s}. Checked the synth directory and the working directory. If your Dockerfile lives at the project root with the CDK app in a subdirectory, set an absolute docker.context (the build context must share the Dockerfile's directory).`}function ne(e){return e.startsWith("cn-")?"amazonaws.com.cn":"amazonaws.com"}function oe(e,s,t){return`${e}.dkr.ecr.${s}.${ne(s)}/${I(t)}`}function ie(e,s,t){const r=new Map;for(const o of e){const a=ee(o,s,t),i=re(a),m=r.get(i);m?m.members.push(o):r.set(i,{identity:a,members:[o]})}return Array.from(r.values())}async function se(e,s,t,r,o){const a=await e.buildAndPush({appName:s.appName,appPath:s.path,region:t,accountId:r},(i,m,g,v)=>{o.onDockerProgress?.(f(i),m,g,v)});return a.success?k({imageUri:a.data.imageUri,imageTag:a.data.imageTag}):l(a.error)}async function ae(e,s,t,r,o,a,i,m,g,v,p,h){const u=e.members[0];if(!x(e.identity.dockerfilePath))return l(new Error(te(u.name,e.identity.dockerfilePath)));e.identity.resolvedViaFallback&&i.onLog?.(`Building service '${u.name}' from ${e.identity.dockerfilePath} (resolved at the project root).`,"info");const n=[...u.docker.buildSecrets??[],...h??[]],c=Q({serviceName:u.name,dockerfilePath:e.identity.dockerfilePath,buildContext:e.identity.buildContext,...e.identity.target!==void 0&&{target:e.identity.target},...u.docker.buildArgs!==void 0&&{buildArgs:u.docker.buildArgs},...n.length>0&&{buildSecrets:n},members:e.members.map(d=>({serviceName:d.name,...d.docker.buildArgs!==void 0&&{buildArgs:d.docker.buildArgs},...d.docker.buildSecrets!==void 0&&{buildSecrets:d.docker.buildSecrets}}))});if(!c.success)return l(c.error);const S=U(u.docker.buildArgs,I(t.appName));for(const d of S.warnings)i.onLog?.(f(d.message),"warn");if(S.findings.length>0)return l(new Error(f(S.findings.map(d=>d.message).join(" "))));const R=n,A=Y(u.docker.buildArgs),b={appName:t.appName,region:r,accountId:o,partition:q(r)},w=await X(m,[...R,...A],b);if(!w.success)return l(w.error);const T=w.data,N=await J({manifestBuildArgs:u.docker.buildArgs,serviceDir:e.identity.buildContext,appDir:t.path,...v!==void 0&&{stage:v},shellEnv:process.env,...p!==void 0&&{flagBuildArgs:p},resolveSourcedValue:(d,K)=>z(T,{id:d,...K},g)});if(!N.success)return l(N.error);const O=N.data.buildArgs;for(const d of N.data.inferredDotenvKeys)i.onLog?.(f(`buildArg "${d}" was auto-declared from a .env file and will be baked into the image \u2014 ${V}.`),"warn");const L=G(O,I(t.appName),H(u.docker.buildArgs));if(L.length>0)return l(new Error(f(L.map(d=>d.message).join(" "))));let D;if(R.length>0){const d=await W(T,R,g);if(!d.success)return l(d.error);D=d.data}try{const d={appName:t.appName,appPath:e.identity.buildContext,region:r,accountId:o,buildContext:e.identity.buildContext,dockerfilePath:e.identity.dockerfilePath,pushByDigest:!0,serviceName:u.name,...e.identity.target!==void 0&&{target:e.identity.target},...Object.keys(O).length>0&&{buildArgs:O},...D!==void 0&&{buildSecrets:D.resolved}};return await de(e,d,s,a,i)}finally{D!==void 0&&await D.cleanup().catch(()=>i.onLog?.("Build-secret cleanup failed.","warn"))}}async function de(e,s,t,r,o){const a=await t.buildAndPush(s,(p,h,u,n)=>{o.onDockerProgress?.(f(p),h,u,n)});if(!a.success)return l(a.error);const i=a.data.imageDigest;if(typeof i!="string"||!i.startsWith("sha256:"))return l(new Error(`Buildx push succeeded but returned an invalid digest: ${f(String(i))}`));const m={},g=[];for(const p of e.members){const h=p.docker.target,u=F(i,p.name,h);if(!u.success)return l(u.error);const n=u.data,c=p.name;m[c]=n,g.push(`${r}:${n}`)}const v=await t.tagByDigest({sourceImage:r,digest:i,tags:g});return v.success?k({contentHashTagsByService:m}):l(v.error)}async function Ee(e,s,t,r){const o=e.dockerProvider;if(!o)return k({});const a=s.awsProvider.getAccountId();if(!a)return r.onLog?.("Skipping Docker build \u2014 account ID not available","warn"),k({});const i=s.awsProvider.getRegion(),m=B(t.path,"cdk.out"),g=M(m),v=oe(a,i,t.appName);if(C.debug(P,"runDockerBuild starting",{appName:t.appName,appPath:t.path,accountId:a,region:i,cdkOutPath:m,manifestServiceCount:g.length,manifestServices:g.map(n=>({name:n.name,path:n.docker.path,context:n.docker.context,target:n.docker.target})),stepId:y.DOCKER_OPERATIONS,stepName:E}),r.onStepStart?.(y.DOCKER_OPERATIONS,E),g.length===0){r.onLog?.("Initialising ECR repository\u2026","info");const n=await o.initialiseECR({appName:t.appName,region:i,accountId:a});n.success||r.onLog?.(`ECR initialisation failed: ${f(n.error.message)}`,"warn"),r.onLog?.("Building and pushing Docker image\u2026","info");const c=await se(o,t,i,a,r);if(!c.success){C.debug(P,"Docker buildAndPush (legacy) failed",{appName:t.appName,error:f(c.error.message)}),r.onStepComplete?.(y.DOCKER_OPERATIONS,E,"error");const S=new Error(f(c.error.message));return r.onError?.(S),l(S)}return r.onStepComplete?.(y.DOCKER_OPERATIONS,E,"completed"),r.onLog?.(`Docker image pushed: ${c.data.imageUri}`,"info"),k({})}const p=await o.preflight?.();if(p!==void 0&&!p.success){r.onStepComplete?.(y.DOCKER_OPERATIONS,E,"error");const n=new Error(f(p.error.message));return r.onError?.(n),l(n)}const h=ie(g,t.path,e.workingDirectory);r.onLog?.(`Building and pushing ${g.length} service image(s) in ${h.length} group(s)\u2026`,"info");let u=!1;if(o.beginEcrSession!==void 0){const n=await o.beginEcrSession({accountId:a,region:i});if(!n.success){r.onStepComplete?.(y.DOCKER_OPERATIONS,E,"error");const c=new Error(f(n.error.message));return r.onError?.(c),l(c)}u=!0}try{const n={};for(let c=0;c<h.length;c++){const S=h[c],R=S.members.map(b=>b.name).join(", ");r.onLog?.(`Building group ${c+1}/${h.length} (${R})\u2026`,"info");const A=await ae(S,o,t,i,a,v,r,s.awsProvider,e.abortSignal,e.options?.environment,e.options?.flagBuildArgs,e.options?.flagBuildSecrets);if(!A.success){C.debug(P,"Docker buildAndPush failed",{appName:t.appName,leader:S.members[0]?.name,members:R,error:f(A.error.message)}),r.onStepComplete?.(y.DOCKER_OPERATIONS,E,"error");const b=new Error(f(A.error.message));return r.onError?.(b),l(b)}for(const[b,w]of Object.entries(A.data.contentHashTagsByService))n[b]=w}return C.debug(P,"Docker buildAndPush succeeded",{appName:t.appName,services:g.map(c=>c.name),groupCount:h.length,contentHashTags:n}),r.onStepComplete?.(y.DOCKER_OPERATIONS,E,"completed"),r.onLog?.(`Docker images pushed for ${g.length} service(s)`,"info"),k(n)}finally{u&&o.endEcrSession!==void 0&&await o.endEcrSession().catch(n=>{C.debug(P,"endEcrSession cleanup failed",{error:f(n instanceof Error?n.message:String(n))})})}}export{E as DOCKER_BUILD_STEP_NAME,Ee as runDockerBuild};

package/dist/src/orchestration/dockerInterface.d.ts

@@ -146,6 +146,23 @@ export interface DockerProvider {
      * counterpart is a release-coupled follow-up (worker repo).
      */
     preflight?(): Promise<Result<void>>;
+    /**
+     * Optional ECR session bracket. When present, the orchestrator opens ONE ECR
+     * session for the whole docker phase — `beginEcrSession` once before the group
+     * loop, `endEcrSession` once after — so every `buildAndPush` / `tagByDigest`
+     * in the phase reuses a single login instead of each op self-scoping its own
+     * (which, on macOS, re-touches the osxkeychain and can hit the -25299 stale-
+     * entry block). Absent → each op self-scopes (today's behaviour); the
+     * optional-chained call makes the addition backward-compatible while a
+     * consumer that hasn't yet implemented these ships. Providers implement both
+     * or neither. Token acquisition stays provider-side (the params carry only the
+     * account/region the provider needs to mint its own ECR authorisation).
+     */
+    beginEcrSession?(params: {
+        accountId: string;
+        region: string;
+    }): Promise<Result<void>>;
+    endEcrSession?(): Promise<void>;
     buildAndPush(params: DockerBuildParams, onProgress?: DockerProgressCallback, onBuildxEvent?: (event: BuildxProgressEvent) => void): Promise<Result<DockerBuildResult>>;
     initialiseECR(params: ECRInitParams): Promise<Result<ECRInitResult>>;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/deploy-core",
-  "version": "2.22.1",
+  "version": "2.23.1",
   "description": "Shared deployment engine for Fjall — used by CLI and webapp worker",
   "type": "module",
   "main": "dist/src/index.js",
@@ -81,8 +81,8 @@
     "@aws-sdk/client-ssm": "^3.1038.0",
     "@aws-sdk/client-sso-admin": "^3.1038.0",
     "@aws-sdk/client-sts": "^3.1038.0",
-    "@fjall/generator": "^2.22.1",
-    "@fjall/util": "^2.22.1",
+    "@fjall/generator": "^2.23.1",
+    "@fjall/util": "^2.23.1",
     "@smithy/node-http-handler": "^4.6.1",
     "aws-cdk": "^2.1128.1",
     "tsx": "^4.21.0",
@@ -93,5 +93,5 @@
     "typescript": "^6.0.3",
     "vitest": "^4.1.5"
   },
-  "gitHead": "ec04f1739f19e4b5212899df7f733ee0d1f06ec3"
+  "gitHead": "749133c6c5cfe24a09a401869f2193c7d177a324"
 }