@go-to-k/cdkd 0.260.12 → 0.260.14

package/dist/{deploy-engine-CvZzwupQ.js → deploy-engine-BiwL0VId.js}

@@ -3892,6 +3892,20 @@ function cacheOptionToFlag(option) {
 //#endregion
 //#region src/assets/docker-asset-publisher.ts
 /**
+* Registries this process has already logged in to, keyed by registry host
+* (`<accountId>.dkr.ecr.<region>.amazonaws.com`, which uniquely encodes the
+* account + region credential context). ECR authorization tokens are valid
+* for ~12h and a deploy process is short-lived, so a successful login is
+* reused for the process lifetime — mirroring `cdk-assets`, which skips
+* re-login on repeat publishes. Keyed per registry (NOT globally) so that
+* cross-account / cross-region assets each get their own login.
+*
+* Module-level (not an instance field) because the deploy pipeline may
+* construct more than one `DockerAssetPublisher` per run (e.g. one per
+* WorkGraph asset-publish node), and the login is genuinely process-wide.
+*/
+const loggedInRegistries = /* @__PURE__ */ new Set();
+/**
 * Publishes Docker image assets to ECR
 *
 * Handles:
@@ -4012,8 +4026,20 @@ var DockerAssetPublisher = class {
 	}
 	/**
 	* Authenticate with ECR via `docker login --password-stdin`.
+	*
+	* The login is cached per registry (`<accountId>.dkr.ecr.<region>`) for the
+	* process lifetime: a repeat publish to the same registry returns early
+	* without the `GetAuthorizationToken` call or the `docker login` subprocess
+	* (mirrors `cdk-assets`). ECR tokens are valid ~12h and a deploy process is
+	* short-lived, so this is safe. Keyed per registry so cross-account /
+	* cross-region assets each get their own login.
 	*/
 	async ecrLogin(client, accountId, region) {
+		const registryKey = `${accountId}.dkr.ecr.${region}.amazonaws.com`;
+		if (loggedInRegistries.has(registryKey)) {
+			this.logger.debug(`Reusing cached ECR login for ${registryKey}`);
+			return;
+		}
 		const authData = (await client.send(new GetAuthorizationTokenCommand({}))).authorizationData?.[0];
 		if (!authData?.authorizationToken) throw new AssetError("Failed to get ECR authorization token");
 		const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
@@ -4027,6 +4053,7 @@ var DockerAssetPublisher = class {
 				"--password-stdin",
 				endpoint
 			], { input: password });
+			loggedInRegistries.add(registryKey);
 		} catch (err) {
 			const e = err;
 			throw new AssetError(`ECR login failed: ${formatDockerLoginError(e.stderr || e.message || String(err), endpoint)}`);
@@ -11098,7 +11125,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BL_wheRD.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Dk8OwSXQ.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -17839,4 +17866,4 @@ var DeployEngine = class {
 
 //#endregion
 export { getBootstrapMarkerKey as $, formatError as $t, refStateLookupFromResource as A, resolveBucketRegion as At, S3StateBackend as B, LocalMigrateError as Bt, findActionableSilentDrops as C, CFN_TEMPLATE_URL_LIMIT as Ct, isTerminationProtectionPropagationError as D, expectedOwnerParam as Dt, disableInstanceApiTermination as E, uploadCfnTemplate as Et, applyRoleArnIfSet as F, AssetError as Ft, WorkGraph as G, PartialFailureError as Gt, shouldRetainResource as H, LockError as Ht, DiffCalculator as I, CdkdError as It, loadPublishableAssetManifest as J, ResourceUpdateNotSupportedError as Jt, buildAssetRedirectMap as K, ProvisioningError as Kt, DagBuilder as L, ConfigError as Lt, normalizeAwsTagsToCfn as M, getAwsClients as Mt, resolveExplicitPhysicalId as N, resetAwsClients as Nt, IntrinsicFunctionResolver as O, AssemblyReader as Ot, assertRegionMatch as P, setAwsClients as Pt, ensureAssetStorage as Q, SynthesisError as Qt, TemplateParser as R, DependencyError as Rt, ProviderRegistry as S, CFN_TEMPLATE_BODY_LIMIT as St, slowCcOperationTimeoutMs as T, findLargeInlineResources as Tt, AssetPublisher as U, MissingCdkCliError as Ut, rebuildClientForBucketRegion as V, LocalStartServiceError as Vt, stringifyValue as W, NestedStackChildDirectDestroyError as Wt, AssetModeResolver as X, StackTerminationProtectionError as Xt, rewriteTemplateAssetReferences as Y, StackHasActiveImportsError as Yt, BOOTSTRAP_MARKER_PREFIX as Z, StateError as Zt, green as _, resolveSkipPrefix as _t, withRetry as a, getDockerCmd as at, IAMRoleProvider as b, resolveUseCdkBootstrapAssets as bt, computeImplicitDeleteEdges as c, AssetManifestLoader as ct, isStatefulRecreateTargetSync as d, synthesisStatusMessage as dt, isCdkdError as en, parseBootstrapMarker as et, renderStatefulReason as f, getDefaultStateBucketName as ft, gray as g, resolveCaptureObservedState as gt, cyan as h, resolveAutoAssetStorage as ht, withResourceDeadline as i, formatDockerLoginError as it, WAFv2WebACLProvider as j, AwsClients as jt, cfnRefValueFromPhysicalId as k, clearBucketRegionCache as kt, extractDeploymentEventError as l, getDockerImageBySourceHash as lt, bold as m, resolveApp as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, withErrorHandling as nn, validateContainerRepoName as nt, isRetryableTransientError as o, runDockerForeground as ot, formatResourceLine as p, getLegacyStateBucketName as pt, createAssetRedirectResolver as q, ResourceTimeoutError as qt, DeployEngine as r, __exportAll as rn, buildDockerImage as rt, IMPLICIT_DELETE_DEPENDENCIES as s, runDockerStreaming as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, normalizeAwsError as tn, validateAssetBucketName as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, Synthesizer as ut, red as v, resolveStateBucketWithDefault as vt, CloudControlProvider as w, MIGRATE_TMP_PREFIX as wt, collectInlinePolicyNamesManagedBySiblings as x, warnDeprecatedNoPrefixCliFlag as xt, yellow as y, resolveStateBucketWithDefaultAndSource as yt, LockManager as z, LocalInvokeBuildError as zt };
-//# sourceMappingURL=deploy-engine-CvZzwupQ.js.map
+//# sourceMappingURL=deploy-engine-BiwL0VId.js.map