@go-to-k/cdkd 0.261.0 → 0.262.1

package/dist/{deploy-engine-BiwL0VId.js → deploy-engine-DbhK2y6L.js}

@@ -3906,13 +3906,22 @@ function cacheOptionToFlag(option) {
 */
 const loggedInRegistries = /* @__PURE__ */ new Set();
 /**
+* Whether a `docker push` failure looks like an ECR authentication failure
+* (missing / stale / expired credential) rather than a network / repo / other
+* error. Case-insensitive. Used by the lazy-login path to decide whether to
+* log in and retry — a NON-auth failure is surfaced unchanged, never retried.
+*/
+function isDockerAuthFailure(errText) {
+	return /no basic auth credentials|unauthorized|authentication required|denied|\b401\b|\b403\b/i.test(errText);
+}
+/**
 * Publishes Docker image assets to ECR
 *
 * Handles:
 * - Placeholder resolution
 * - Existence check (skip if already pushed)
 * - docker build with Dockerfile, build args, target
-* - ECR authentication
+* - lazy ECR authentication (push first, log in only on an auth failure)
 * - docker tag + docker push
 */
 var DockerAssetPublisher = class {
@@ -3935,10 +3944,8 @@ var DockerAssetPublisher = class {
 				}
 				const localTag = `cdkd-asset-${assetHash}`;
 				await this.buildImage(asset, cdkOutputDir, localTag);
-				await this.ecrLogin(client, accountId, destRegion);
 				const fullUri = `${accountId}.dkr.ecr.${destRegion}.amazonaws.com/${repositoryName}:${imageTag}`;
-				await this.tagImage(localTag, fullUri);
-				await this.pushImage(fullUri);
+				await this.tagAndPushWithLazyLogin(client, localTag, fullUri, accountId, destRegion);
 				this.logger.debug(`✅ Published: ${ecrUri}`);
 			} finally {
 				client.destroy();
@@ -3972,10 +3979,8 @@ var DockerAssetPublisher = class {
 					this.logger.debug(`Image already exists, skipping: ${ecrUri}`);
 					continue;
 				}
-				await this.ecrLogin(client, accountId, destRegion);
 				const fullUri = `${accountId}.dkr.ecr.${destRegion}.amazonaws.com/${repositoryName}:${imageTag}`;
-				await this.tagImage(localTag, fullUri);
-				await this.pushImage(fullUri);
+				await this.tagAndPushWithLazyLogin(client, localTag, fullUri, accountId, destRegion);
 				this.logger.debug(`✅ Published: ${ecrUri}`);
 			} finally {
 				client.destroy();
@@ -4025,6 +4030,41 @@ var DockerAssetPublisher = class {
 		}
 	}
 	/**
+	* Tag then push an image, logging in to ECR lazily — only if the push fails
+	* with an auth-failure signature.
+	*
+	* cdkd (like `cdk --hotswap`) leans on the developer's persistent docker
+	* credential store: a valid ECR credential (`~/.docker/config.json` /
+	* keychain; ECR tokens live ~12h) left by an earlier login this session lets
+	* a fresh cdkd process push with NO `GetAuthorizationToken` + `docker login`
+	* round-trip (~3.3s saved). We attempt the push FIRST and only pay the login
+	* when it is actually needed:
+	*
+	*   1. If this PROCESS already logged into the registry (issue #1184 cache),
+	*      push directly — still self-healing: a mid-process token expiry falls
+	*      into the same auth-failure retry below.
+	*   2. Otherwise push optimistically. On a NON-auth failure (network,
+	*      repo-not-found, etc.) surface the error unchanged. On an auth failure
+	*      (no pre-existing cred, OR a stale/expired cred), run a forced ECR
+	*      login and retry the push ONCE.
+	*
+	* A stale cred and a missing cred take the SAME branch, so cdkd never
+	* fail-hard on an expired credential — it re-logs in and retries.
+	*/
+	async tagAndPushWithLazyLogin(client, localTag, fullUri, accountId, region) {
+		await this.tagImage(localTag, fullUri);
+		try {
+			await this.pushImage(fullUri);
+			return;
+		} catch (err) {
+			const e = err;
+			if (!isDockerAuthFailure(e.stderr || e.message || String(err))) throw err;
+			this.logger.debug(`Docker push to ${fullUri} failed with an auth error; logging in to ECR and retrying`);
+		}
+		await this.ecrLogin(client, accountId, region, { force: true });
+		await this.pushImage(fullUri);
+	}
+	/**
 	* Authenticate with ECR via `docker login --password-stdin`.
 	*
 	* The login is cached per registry (`<accountId>.dkr.ecr.<region>`) for the
@@ -4033,10 +4073,14 @@ var DockerAssetPublisher = class {
 	* (mirrors `cdk-assets`). ECR tokens are valid ~12h and a deploy process is
 	* short-lived, so this is safe. Keyed per registry so cross-account /
 	* cross-region assets each get their own login.
+	*
+	* `force: true` bypasses the per-process cache short-circuit — used by the
+	* lazy-login retry after a push fails auth, where the cached entry may hold a
+	* token that AWS has already expired.
 	*/
-	async ecrLogin(client, accountId, region) {
+	async ecrLogin(client, accountId, region, options = {}) {
 		const registryKey = `${accountId}.dkr.ecr.${region}.amazonaws.com`;
-		if (loggedInRegistries.has(registryKey)) {
+		if (!options.force && loggedInRegistries.has(registryKey)) {
 			this.logger.debug(`Reusing cached ECR login for ${registryKey}`);
 			return;
 		}
@@ -11125,7 +11169,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Dk8OwSXQ.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-D85MbFl6.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -17866,4 +17910,4 @@ var DeployEngine = class {
 
 //#endregion
 export { getBootstrapMarkerKey as $, formatError as $t, refStateLookupFromResource as A, resolveBucketRegion as At, S3StateBackend as B, LocalMigrateError as Bt, findActionableSilentDrops as C, CFN_TEMPLATE_URL_LIMIT as Ct, isTerminationProtectionPropagationError as D, expectedOwnerParam as Dt, disableInstanceApiTermination as E, uploadCfnTemplate as Et, applyRoleArnIfSet as F, AssetError as Ft, WorkGraph as G, PartialFailureError as Gt, shouldRetainResource as H, LockError as Ht, DiffCalculator as I, CdkdError as It, loadPublishableAssetManifest as J, ResourceUpdateNotSupportedError as Jt, buildAssetRedirectMap as K, ProvisioningError as Kt, DagBuilder as L, ConfigError as Lt, normalizeAwsTagsToCfn as M, getAwsClients as Mt, resolveExplicitPhysicalId as N, resetAwsClients as Nt, IntrinsicFunctionResolver as O, AssemblyReader as Ot, assertRegionMatch as P, setAwsClients as Pt, ensureAssetStorage as Q, SynthesisError as Qt, TemplateParser as R, DependencyError as Rt, ProviderRegistry as S, CFN_TEMPLATE_BODY_LIMIT as St, slowCcOperationTimeoutMs as T, findLargeInlineResources as Tt, AssetPublisher as U, MissingCdkCliError as Ut, rebuildClientForBucketRegion as V, LocalStartServiceError as Vt, stringifyValue as W, NestedStackChildDirectDestroyError as Wt, AssetModeResolver as X, StackTerminationProtectionError as Xt, rewriteTemplateAssetReferences as Y, StackHasActiveImportsError as Yt, BOOTSTRAP_MARKER_PREFIX as Z, StateError as Zt, green as _, resolveSkipPrefix as _t, withRetry as a, getDockerCmd as at, IAMRoleProvider as b, resolveUseCdkBootstrapAssets as bt, computeImplicitDeleteEdges as c, AssetManifestLoader as ct, isStatefulRecreateTargetSync as d, synthesisStatusMessage as dt, isCdkdError as en, parseBootstrapMarker as et, renderStatefulReason as f, getDefaultStateBucketName as ft, gray as g, resolveCaptureObservedState as gt, cyan as h, resolveAutoAssetStorage as ht, withResourceDeadline as i, formatDockerLoginError as it, WAFv2WebACLProvider as j, AwsClients as jt, cfnRefValueFromPhysicalId as k, clearBucketRegionCache as kt, extractDeploymentEventError as l, getDockerImageBySourceHash as lt, bold as m, resolveApp as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, withErrorHandling as nn, validateContainerRepoName as nt, isRetryableTransientError as o, runDockerForeground as ot, formatResourceLine as p, getLegacyStateBucketName as pt, createAssetRedirectResolver as q, ResourceTimeoutError as qt, DeployEngine as r, __exportAll as rn, buildDockerImage as rt, IMPLICIT_DELETE_DEPENDENCIES as s, runDockerStreaming as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, normalizeAwsError as tn, validateAssetBucketName as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, Synthesizer as ut, red as v, resolveStateBucketWithDefault as vt, CloudControlProvider as w, MIGRATE_TMP_PREFIX as wt, collectInlinePolicyNamesManagedBySiblings as x, warnDeprecatedNoPrefixCliFlag as xt, yellow as y, resolveStateBucketWithDefaultAndSource as yt, LockManager as z, LocalInvokeBuildError as zt };
-//# sourceMappingURL=deploy-engine-BiwL0VId.js.map
+//# sourceMappingURL=deploy-engine-DbhK2y6L.js.map