sst 2.23.15 → 2.24.0

package/cdk/deployments.d.ts

@@ -1,7 +1,7 @@
 import * as cxapi from "@aws-cdk/cx-api";
 import { AssetManifest, IManifestEntry } from "cdk-assets";
 import { Tag } from "sst-aws-cdk/lib/cdk-toolkit.js";
-import { BuildAssetsOptions, PublishAssetsOptions } from "./asset-publishing.js";
+import { BuildAssetsOptions, PublishAssetsOptions } from "sst-aws-cdk/lib/util/asset-publishing.js";
 import { Mode } from "sst-aws-cdk/lib/api/aws-auth/credentials.js";
 import { ISDK } from "sst-aws-cdk/lib/api/aws-auth/sdk.js";
 import { SdkProvider } from "sst-aws-cdk/lib/api/aws-auth/sdk-provider.js";

package/cdk/deployments.js

@@ -3,7 +3,7 @@ import * as cxapi from "@aws-cdk/cx-api";
 import * as cdk_assets from "cdk-assets";
 import { AssetManifest } from "cdk-assets";
 import { debug, warning } from "sst-aws-cdk/lib/logging.js";
-import { buildAssets, publishAssets, PublishingAws, EVENT_TO_LOGGER, } from "./asset-publishing.js";
+import { buildAssets, publishAssets, PublishingAws, EVENT_TO_LOGGER, } from "sst-aws-cdk/lib/util/asset-publishing.js";
 import { Mode } from "sst-aws-cdk/lib/api/aws-auth/credentials.js";
 import { deployStack, destroyStack, makeBodyParameterAndUpload, } from "./deploy-stack.js";
 import { loadCurrentTemplateWithNestedStacks, loadCurrentTemplate, } from "sst-aws-cdk/lib/api/nested-stack-helpers.js";

package/cli/ui/deploy.js

@@ -155,7 +155,7 @@ function getApiAccessLogPermissionsHelper(error) {
     // note: this should be handled in SST as access log group names are now
     //       hardcoded with /aws/vendedlogs/apis prefix.
     if (error.indexOf("Insufficient permissions to enable logging") > -1) {
-        return `This is a common deploy error. Check out this GitHub issue for more details - https://github.com/serverless-stack/sst/issues/125`;
+        return `This is a common deploy error. Check out this GitHub issue for more details - https://github.com/sst/sst/issues/125`;
     }
 }
 function getAppSyncMultiResolverHelper(error) {

package/constructs/App.d.ts

@@ -77,7 +77,7 @@ export declare class App extends CDKApp {
     defaultFunctionProps: (FunctionProps | ((stack: Stack) => FunctionProps))[];
     private _defaultRemovalPolicy?;
     /** @internal */
-    get defaultRemovalPolicy(): "destroy" | "retain" | "snapshot" | undefined;
+    get defaultRemovalPolicy(): "destroy" | "retain" | "snapshot" | "retain-on-update-or-delete" | undefined;
     /**
      * @internal
      */

package/constructs/Function.d.ts

@@ -268,7 +268,7 @@ export interface FunctionProps extends Omit<FunctionOptions, "functionName" | "m
      *
      * Note that, if a Layer is created in a stack (say `stackA`) and is referenced in another stack (say `stackB`), SST automatically creates an SSM parameter in `stackA` with the Layer's ARN. And in `stackB`, SST reads the ARN from the SSM parameter, and then imports the Layer.
      *
-     *  This is to get around the limitation that a Lambda Layer ARN cannot be referenced across stacks via a stack export. The Layer ARN contains a version number that is incremented everytime the Layer is modified. When you refer to a Layer's ARN across stacks, a CloudFormation export is created. However, CloudFormation does not allow an exported value to be updated. Once exported, if you try to deploy the updated layer, the CloudFormation update will fail. You can read more about this issue here - https://github.com/serverless-stack/sst/issues/549.
+     *  This is to get around the limitation that a Lambda Layer ARN cannot be referenced across stacks via a stack export. The Layer ARN contains a version number that is incremented everytime the Layer is modified. When you refer to a Layer's ARN across stacks, a CloudFormation export is created. However, CloudFormation does not allow an exported value to be updated. Once exported, if you try to deploy the updated layer, the CloudFormation update will fail. You can read more about this issue here - https://github.com/sst/sst/issues/549.
      *
      * @default no layers
      *

package/node/auth/session.js

@@ -14,7 +14,7 @@ const SessionMemo = /* @__PURE__ */ Context.memo(() => {
     if (cookie)
         token = cookie;
     // WebSocket may also set the token in the protocol header
-    // TODO: Once https://github.com/serverless-stack/sst/pull/2838 is merged,
+    // TODO: Once https://github.com/sst/sst/pull/2838 is merged,
     // then we should no longer need to check both casing for the header.
     const wsProtocol = ctxType === "ws"
         ? useHeader("sec-websocket-protocol") ||

package/node/future/auth/session.js

@@ -15,7 +15,7 @@ const SessionMemo = /* @__PURE__ */ Context.memo(() => {
     if (cookie)
         token = cookie;
     // WebSocket may also set the token in the protocol header
-    // TODO: Once https://github.com/serverless-stack/sst/pull/2838 is merged,
+    // TODO: Once https://github.com/sst/sst/pull/2838 is merged,
     // then we should no longer need to check both casing for the header.
     const wsProtocol = ctxType === "ws"
         ? useHeader("sec-websocket-protocol") ||

package/node/websocket-api/index.js

@@ -16,7 +16,7 @@ export const WebSocketApi =
 export function WebSocketApiHandler(cb) {
     return Handler("ws", async (evt, ctx) => {
         const result = await cb(evt, ctx);
-        // TODO: Once https://github.com/serverless-stack/sst/pull/2838 is merged,
+        // TODO: Once https://github.com/sst/sst/pull/2838 is merged,
         // then we should no longer need to check both casing for the header.
         const token = useHeader("Sec-WebSocket-Protocol") ||
             useHeader("sec-websocket-protocol");

package/package.json

@@ -1,7 +1,7 @@
 {
   "sideEffects": false,
   "name": "sst",
-  "version": "2.23.15",
+  "version": "2.24.0",
   "bin": {
     "sst": "cli/sst.js"
   },
@@ -10,7 +10,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/serverless-stack/sst.git",
+    "url": "git+https://github.com/sst/sst.git",
     "directory": "packages/cli"
   },
   "exports": {
@@ -25,12 +25,12 @@
   },
   "homepage": "https://sst.dev",
   "dependencies": {
-    "@aws-cdk/aws-apigatewayv2-alpha": "^2.84.0-alpha.0",
-    "@aws-cdk/aws-apigatewayv2-authorizers-alpha": "^2.84.0-alpha.0",
-    "@aws-cdk/aws-apigatewayv2-integrations-alpha": "^2.84.0-alpha.0",
-    "@aws-cdk/cloud-assembly-schema": "2.84.0",
-    "@aws-cdk/cloudformation-diff": "2.84.0",
-    "@aws-cdk/cx-api": "2.84.0",
+    "@aws-cdk/aws-apigatewayv2-alpha": "^2.91.0-alpha.0",
+    "@aws-cdk/aws-apigatewayv2-authorizers-alpha": "^2.91.0-alpha.0",
+    "@aws-cdk/aws-apigatewayv2-integrations-alpha": "^2.91.0-alpha.0",
+    "@aws-cdk/cloud-assembly-schema": "2.91.0",
+    "@aws-cdk/cloudformation-diff": "2.91.0",
+    "@aws-cdk/cx-api": "2.91.0",
     "@aws-crypto/sha256-js": "^5.0.0",
     "@aws-sdk/client-cloudformation": "^3.279.0",
     "@aws-sdk/client-ecs": "^3.279.0",
@@ -55,17 +55,17 @@
     "@smithy/signature-v4": "^2.0.1",
     "@trpc/server": "9.16.0",
     "adm-zip": "^0.5.10",
-    "aws-cdk-lib": "2.84.0",
+    "aws-cdk-lib": "2.91.0",
     "aws-iot-device-sdk": "^2.2.12",
     "aws-sdk": "^2.1326.0",
     "builtin-modules": "3.2.0",
-    "cdk-assets": "2.84.0",
+    "cdk-assets": "2.91.0",
     "chalk": "^5.2.0",
     "chokidar": "^3.5.3",
     "ci-info": "^3.7.0",
     "colorette": "^2.0.19",
     "conf": "^10.2.0",
-    "constructs": "10.1.156",
+    "constructs": "10.2.69",
     "cross-spawn": "^7.0.3",
     "dendriform-immer-patch-optimiser": "^2.1.0",
     "dotenv": "^16.0.3",
@@ -87,7 +87,7 @@
     "ora": "^6.1.2",
     "react": "18.2.0",
     "remeda": "^1.3.0",
-    "sst-aws-cdk": "2.84.0",
+    "sst-aws-cdk": "2.91.0",
     "tree-kill": "^1.2.2",
     "undici": "^5.12.0",
     "uuid": "^9.0.0",
@@ -131,7 +131,7 @@
     }
   },
   "bugs": {
-    "url": "https://github.com/serverless-stack/sst/issues"
+    "url": "https://github.com/sst/sst/issues"
   },
   "main": "index.js",
   "directories": {

package/support/java-runtime/install.sh

@@ -18,8 +18,8 @@ mv build/target/dependency/aws-lambda-java-serialization-1.0.0.jar release/
 # - AWS_LAMBDA_RUNTIME_API has to be of the format "host:port", subpath is not support (ie. "host:port/path")
 # - official JAR uses NativeClient that cannot be run on user's machine
 rm -rf aws-lambda-java-libs
-git clone https://github.com/serverless-stack/aws-lambda-java-libs.git
+git clone https://github.com/sst/aws-lambda-java-libs.git
 cd aws-lambda-java-libs/aws-lambda-java-runtime-interface-client
 mvn -Dmaven.test.skip=true install
 cd ../..
-mv aws-lambda-java-libs/aws-lambda-java-runtime-interface-client/target/aws-lambda-java-runtime-interface-client-1.1.0.jar release/
+mv aws-lambda-java-libs/aws-lambda-java-runtime-interface-client/target/aws-lambda-java-runtime-interface-client-1.1.0.jar release/

package/cdk/asset-publishing.d.ts

@@ -1,74 +0,0 @@
-import * as cxapi from "@aws-cdk/cx-api";
-import * as AWS from "aws-sdk";
-import * as cdk_assets from "cdk-assets";
-import { SdkProvider } from "sst-aws-cdk/lib/api/aws-auth/sdk-provider.js";
-export interface PublishAssetsOptions {
-    /**
-     * Print progress at 'debug' level
-     */
-    readonly quiet?: boolean;
-    /**
-     * Whether to build assets before publishing.
-     *
-     * @default true To remain backward compatible.
-     */
-    readonly buildAssets?: boolean;
-    /**
-     * Whether to build/publish assets in parallel
-     *
-     * @default true To remain backward compatible.
-     */
-    readonly parallel?: boolean;
-}
-/**
- * Use cdk-assets to publish all assets in the given manifest.
- */
-export declare function publishAssets(manifest: cdk_assets.AssetManifest, sdk: SdkProvider, targetEnv: cxapi.Environment, options?: PublishAssetsOptions): Promise<void>;
-export interface BuildAssetsOptions {
-    /**
-     * Print progress at 'debug' level
-     */
-    readonly quiet?: boolean;
-    /**
-     * Build assets in parallel
-     *
-     * @default true
-     */
-    readonly parallel?: boolean;
-}
-/**
- * Use cdk-assets to build all assets in the given manifest.
- */
-export declare function buildAssets(manifest: cdk_assets.AssetManifest, sdk: SdkProvider, targetEnv: cxapi.Environment, options?: BuildAssetsOptions): Promise<void>;
-export declare class PublishingAws implements cdk_assets.IAws {
-    /**
-     * The base SDK to work with
-     */
-    private readonly aws;
-    /**
-     * Environment where the stack we're deploying is going
-     */
-    private readonly targetEnv;
-    private sdkCache;
-    constructor(
-    /**
-     * The base SDK to work with
-     */
-    aws: SdkProvider, 
-    /**
-     * Environment where the stack we're deploying is going
-     */
-    targetEnv: cxapi.Environment);
-    discoverPartition(): Promise<string>;
-    discoverDefaultRegion(): Promise<string>;
-    discoverCurrentAccount(): Promise<cdk_assets.Account>;
-    discoverTargetAccount(options: cdk_assets.ClientOptions): Promise<cdk_assets.Account>;
-    s3Client(options: cdk_assets.ClientOptions): Promise<AWS.S3>;
-    ecrClient(options: cdk_assets.ClientOptions): Promise<AWS.ECR>;
-    secretsManagerClient(options: cdk_assets.ClientOptions): Promise<AWS.SecretsManager>;
-    /**
-     * Get an SDK appropriate for the given client options
-     */
-    private sdk;
-}
-export declare const EVENT_TO_LOGGER: Record<cdk_assets.EventType, (x: string) => void>;

package/cdk/asset-publishing.js

@@ -1,147 +0,0 @@
-import * as cxapi from "@aws-cdk/cx-api";
-import * as cdk_assets from "cdk-assets";
-// TODO: remove after PR is merged
-import { AssetPublishing } from "../cdk-assets/publishing.js";
-import { Mode } from "sst-aws-cdk/lib/api/aws-auth/credentials.js";
-import { debug, error, print } from "sst-aws-cdk/lib/logging.js";
-/**
- * Use cdk-assets to publish all assets in the given manifest.
- */
-export async function publishAssets(manifest, sdk, targetEnv, options = {}) {
-    // This shouldn't really happen (it's a programming error), but we don't have
-    // the types here to guide us. Do an runtime validation to be super super sure.
-    if (targetEnv.account === undefined ||
-        targetEnv.account === cxapi.UNKNOWN_ACCOUNT ||
-        targetEnv.region === undefined ||
-        targetEnv.account === cxapi.UNKNOWN_REGION) {
-        throw new Error(`Asset publishing requires resolved account and region, got ${JSON.stringify(targetEnv)}`);
-    }
-    const publisher = new AssetPublishing(manifest, {
-        aws: new PublishingAws(sdk, targetEnv),
-        progressListener: new PublishingProgressListener(options.quiet ?? false),
-        throwOnError: false,
-        publishInParallel: options.parallel ?? true,
-        buildAssets: options.buildAssets ?? true,
-        publishAssets: true,
-        // TODO: remove after PR is merged
-        quiet: options.quiet,
-    });
-    await publisher.publish();
-    if (publisher.hasFailures) {
-        console.log(publisher.failures);
-        throw new Error("Failed to publish one or more assets. See the error messages above for more information.");
-    }
-}
-/**
- * Use cdk-assets to build all assets in the given manifest.
- */
-export async function buildAssets(manifest, sdk, targetEnv, options = {}) {
-    // This shouldn't really happen (it's a programming error), but we don't have
-    // the types here to guide us. Do an runtime validation to be super super sure.
-    if (targetEnv.account === undefined ||
-        targetEnv.account === cxapi.UNKNOWN_ACCOUNT ||
-        targetEnv.region === undefined ||
-        targetEnv.account === cxapi.UNKNOWN_REGION) {
-        throw new Error(`Asset building requires resolved account and region, got ${JSON.stringify(targetEnv)}`);
-    }
-    const publisher = new cdk_assets.AssetPublishing(manifest, {
-        aws: new PublishingAws(sdk, targetEnv),
-        progressListener: new PublishingProgressListener(options.quiet ?? false),
-        throwOnError: false,
-        publishInParallel: options.parallel ?? true,
-        buildAssets: true,
-        publishAssets: false,
-    });
-    await publisher.publish();
-    if (publisher.hasFailures) {
-        throw new Error("Failed to build one or more assets. See the error messages above for more information.");
-    }
-}
-export class PublishingAws {
-    aws;
-    targetEnv;
-    sdkCache = new Map();
-    constructor(
-    /**
-     * The base SDK to work with
-     */
-    aws, 
-    /**
-     * Environment where the stack we're deploying is going
-     */
-    targetEnv) {
-        this.aws = aws;
-        this.targetEnv = targetEnv;
-    }
-    async discoverPartition() {
-        return ((await this.aws.baseCredentialsPartition(this.targetEnv, Mode.ForWriting)) ?? "aws");
-    }
-    async discoverDefaultRegion() {
-        return this.targetEnv.region;
-    }
-    async discoverCurrentAccount() {
-        const account = await this.aws.defaultAccount();
-        return (account ?? {
-            accountId: "<unknown account>",
-            partition: "aws",
-        });
-    }
-    async discoverTargetAccount(options) {
-        return (await this.sdk(options)).currentAccount();
-    }
-    async s3Client(options) {
-        return (await this.sdk(options)).s3();
-    }
-    async ecrClient(options) {
-        return (await this.sdk(options)).ecr();
-    }
-    async secretsManagerClient(options) {
-        return (await this.sdk(options)).secretsManager();
-    }
-    /**
-     * Get an SDK appropriate for the given client options
-     */
-    async sdk(options) {
-        const env = {
-            ...this.targetEnv,
-            region: options.region ?? this.targetEnv.region, // Default: same region as the stack
-        };
-        const cacheKey = JSON.stringify({
-            env,
-            assumeRuleArn: options.assumeRoleArn,
-            assumeRoleExternalId: options.assumeRoleExternalId,
-            quiet: options.quiet,
-        });
-        const maybeSdk = this.sdkCache.get(cacheKey);
-        if (maybeSdk) {
-            return maybeSdk;
-        }
-        const sdk = (await this.aws.forEnvironment(env, Mode.ForWriting, {
-            assumeRoleArn: options.assumeRoleArn,
-            assumeRoleExternalId: options.assumeRoleExternalId,
-        }, options.quiet)).sdk;
-        this.sdkCache.set(cacheKey, sdk);
-        return sdk;
-    }
-}
-export const EVENT_TO_LOGGER = {
-    build: debug,
-    cached: debug,
-    check: debug,
-    debug,
-    fail: error,
-    found: debug,
-    start: print,
-    success: print,
-    upload: debug,
-};
-class PublishingProgressListener {
-    quiet;
-    constructor(quiet) {
-        this.quiet = quiet;
-    }
-    onPublishEvent(type, event) {
-        const handler = this.quiet && type !== "fail" ? debug : EVENT_TO_LOGGER[type];
-        handler(`[${event.percentComplete}%] ${type}: ${event.message}`);
-    }
-}

package/cdk-assets/private/asset-handler.d.ts

@@ -1,29 +0,0 @@
-import { DockerFactory } from "./docker.js";
-import { IAws } from "cdk-assets/lib/aws.js";
-import { EventType } from "cdk-assets/lib/progress.js";
-/**
- * Handler for asset building and publishing.
- */
-export interface IAssetHandler {
-    /**
-     * Build the asset.
-     */
-    build(): Promise<void>;
-    /**
-     * Publish the asset.
-     */
-    publish(): Promise<void>;
-    /**
-     * Return whether the asset already exists
-     */
-    isPublished(): Promise<boolean>;
-}
-export interface IHandlerHost {
-    readonly aws: IAws;
-    readonly aborted: boolean;
-    readonly dockerFactory: DockerFactory;
-    emitMessage(type: EventType, m: string): void;
-}
-export interface IHandlerOptions {
-    readonly quiet?: boolean;
-}

package/cdk-assets/private/asset-handler.js

@@ -1 +0,0 @@
-export {};

package/cdk-assets/private/docker.d.ts

@@ -1,94 +0,0 @@
-import { Logger } from "cdk-assets/lib/private/shell.js";
-interface BuildOptions {
-    readonly directory: string;
-    /**
-     * Tag the image with a given repoName:tag combination
-     */
-    readonly tag: string;
-    readonly target?: string;
-    readonly file?: string;
-    readonly buildArgs?: Record<string, string>;
-    readonly buildSecrets?: Record<string, string>;
-    readonly networkMode?: string;
-    readonly platform?: string;
-    readonly outputs?: string[];
-    readonly cacheFrom?: DockerCacheOption[];
-    readonly cacheTo?: DockerCacheOption;
-    readonly quiet?: boolean;
-}
-interface PushOptions {
-    readonly tag: string;
-    readonly quiet?: boolean;
-}
-export interface DockerCredentialsConfig {
-    readonly version: string;
-    readonly domainCredentials: Record<string, DockerDomainCredentials>;
-}
-export interface DockerDomainCredentials {
-    readonly secretsManagerSecretId?: string;
-    readonly ecrRepository?: string;
-}
-export interface DockerCacheOption {
-    readonly type: string;
-    readonly params?: {
-        [key: string]: string;
-    };
-}
-export declare class Docker {
-    private readonly logger?;
-    private configDir;
-    constructor(logger?: Logger | undefined);
-    /**
-     * Whether an image with the given tag exists
-     */
-    exists(tag: string): Promise<boolean>;
-    build(options: BuildOptions): Promise<void>;
-    /**
-     * Get credentials from ECR and run docker login
-     */
-    login(ecr: AWS.ECR): Promise<void>;
-    tag(sourceTag: string, targetTag: string): Promise<void>;
-    push(options: PushOptions): Promise<void>;
-    /**
-     * If a CDK Docker Credentials file exists, creates a new Docker config directory.
-     * Sets up `docker-credential-cdk-assets` to be the credential helper for each domain in the CDK config.
-     * All future commands (e.g., `build`, `push`) will use this config.
-     *
-     * See https://docs.docker.com/engine/reference/commandline/login/#credential-helpers for more details on cred helpers.
-     *
-     * @returns true if CDK config was found and configured, false otherwise
-     */
-    configureCdkCredentials(): boolean;
-    /**
-     * Removes any configured Docker config directory.
-     * All future commands (e.g., `build`, `push`) will use the default config.
-     *
-     * This is useful after calling `configureCdkCredentials` to reset to default credentials.
-     */
-    resetAuthPlugins(): void;
-    private execute;
-    private cacheOptionToFlag;
-}
-export interface DockerFactoryOptions {
-    readonly repoUri: string;
-    readonly ecr: AWS.ECR;
-    readonly logger: (m: string) => void;
-}
-/**
- * Helps get appropriately configured Docker instances during the container
- * image publishing process.
- */
-export declare class DockerFactory {
-    private enterLoggedInDestinationsCriticalSection;
-    private loggedInDestinations;
-    /**
-     * Gets a Docker instance for building images.
-     */
-    forBuild(options: DockerFactoryOptions): Promise<Docker>;
-    /**
-     * Gets a Docker instance for pushing images to ECR.
-     */
-    forEcrPush(options: DockerFactoryOptions): Promise<Docker>;
-    private loginOncePerDestination;
-}
-export {};

package/cdk-assets/private/docker.js

@@ -1,237 +0,0 @@
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import { cdkCredentialsConfig, obtainEcrCredentials, } from "cdk-assets/lib/private/docker-credentials.js";
-import { shell, } from "cdk-assets/lib/private/shell.js";
-import { createCriticalSection } from "cdk-assets/lib/private/util.js";
-var InspectImageErrorCode;
-(function (InspectImageErrorCode) {
-    InspectImageErrorCode[InspectImageErrorCode["Docker"] = 1] = "Docker";
-    InspectImageErrorCode[InspectImageErrorCode["Podman"] = 125] = "Podman";
-})(InspectImageErrorCode || (InspectImageErrorCode = {}));
-export class Docker {
-    logger;
-    configDir = undefined;
-    constructor(logger) {
-        this.logger = logger;
-    }
-    /**
-     * Whether an image with the given tag exists
-     */
-    async exists(tag) {
-        try {
-            await this.execute(["inspect", tag], { quiet: true });
-            return true;
-        }
-        catch (e) {
-            const error = e;
-            /**
-             * The only error we expect to be thrown will have this property and value.
-             * If it doesn't, it's unrecognized so re-throw it.
-             */
-            if (error.code !== "PROCESS_FAILED") {
-                throw error;
-            }
-            /**
-             * If we know the shell command above returned an error, check to see
-             * if the exit code is one we know to actually mean that the image doesn't
-             * exist.
-             */
-            switch (error.exitCode) {
-                case InspectImageErrorCode.Docker:
-                case InspectImageErrorCode.Podman:
-                    // Docker and Podman will return this exit code when an image doesn't exist, return false
-                    // context: https://github.com/aws/aws-cdk/issues/16209
-                    return false;
-                default:
-                    // This is an error but it's not an exit code we recognize, throw.
-                    throw error;
-            }
-        }
-    }
-    async build(options) {
-        const buildCommand = [
-            "build",
-            ...flatten(Object.entries(options.buildArgs || {}).map(([k, v]) => [
-                "--build-arg",
-                `${k}=${v}`,
-            ])),
-            ...flatten(Object.entries(options.buildSecrets || {}).map(([k, v]) => [
-                "--secret",
-                `id=${k},${v}`,
-            ])),
-            "--tag",
-            options.tag,
-            ...(options.target ? ["--target", options.target] : []),
-            ...(options.file ? ["--file", options.file] : []),
-            ...(options.networkMode ? ["--network", options.networkMode] : []),
-            ...(options.platform ? ["--platform", options.platform] : []),
-            ...(options.outputs
-                ? options.outputs.map((output) => [`--output=${output}`])
-                : []),
-            ...(options.cacheFrom
-                ? [
-                    ...options.cacheFrom
-                        .map((cacheFrom) => [
-                        "--cache-from",
-                        this.cacheOptionToFlag(cacheFrom),
-                    ])
-                        .flat(),
-                ]
-                : []),
-            ...(options.cacheTo
-                ? ["--cache-to", this.cacheOptionToFlag(options.cacheTo)]
-                : []),
-            ".",
-        ];
-        await this.execute(buildCommand, {
-            cwd: options.directory,
-            // TODO: remove after PR is merged
-            quiet: options.quiet,
-        });
-    }
-    /**
-     * Get credentials from ECR and run docker login
-     */
-    async login(ecr) {
-        const credentials = await obtainEcrCredentials(ecr);
-        // Use --password-stdin otherwise docker will complain. Loudly.
-        await this.execute([
-            "login",
-            "--username",
-            credentials.username,
-            "--password-stdin",
-            credentials.endpoint,
-        ], {
-            input: credentials.password,
-            // Need to quiet otherwise Docker will complain
-            // 'WARNING! Your password will be stored unencrypted'
-            // doesn't really matter since it's a token.
-            quiet: true,
-        });
-    }
-    async tag(sourceTag, targetTag) {
-        await this.execute(["tag", sourceTag, targetTag]);
-    }
-    // TODO: remove after PR is merged
-    async push(options) {
-        await this.execute(["push", options.tag], { quiet: options.quiet });
-    }
-    /**
-     * If a CDK Docker Credentials file exists, creates a new Docker config directory.
-     * Sets up `docker-credential-cdk-assets` to be the credential helper for each domain in the CDK config.
-     * All future commands (e.g., `build`, `push`) will use this config.
-     *
-     * See https://docs.docker.com/engine/reference/commandline/login/#credential-helpers for more details on cred helpers.
-     *
-     * @returns true if CDK config was found and configured, false otherwise
-     */
-    configureCdkCredentials() {
-        const config = cdkCredentialsConfig();
-        if (!config) {
-            return false;
-        }
-        this.configDir = fs.mkdtempSync(path.join(os.tmpdir(), "cdkDockerConfig"));
-        const domains = Object.keys(config.domainCredentials);
-        const credHelpers = domains.reduce((map, domain) => {
-            map[domain] = "cdk-assets"; // Use docker-credential-cdk-assets for this domain
-            return map;
-        }, {});
-        fs.writeFileSync(path.join(this.configDir, "config.json"), JSON.stringify({ credHelpers }), { encoding: "utf-8" });
-        return true;
-    }
-    /**
-     * Removes any configured Docker config directory.
-     * All future commands (e.g., `build`, `push`) will use the default config.
-     *
-     * This is useful after calling `configureCdkCredentials` to reset to default credentials.
-     */
-    resetAuthPlugins() {
-        this.configDir = undefined;
-    }
-    async execute(args, options = {}) {
-        const configArgs = this.configDir ? ["--config", this.configDir] : [];
-        // TODO: remove after PR is merged
-        //const pathToCdkAssets = path.resolve(__dirname, "..", "..", "bin");
-        const pathToCdkAssets = "";
-        try {
-            await shell([getDockerCmd(), ...configArgs, ...args], {
-                logger: this.logger,
-                ...options,
-                env: {
-                    ...process.env,
-                    ...options.env,
-                    PATH: `${pathToCdkAssets}${path.delimiter}${options.env?.PATH ?? process.env.PATH}`,
-                },
-            });
-        }
-        catch (e) {
-            if (e.code === "ENOENT") {
-                throw new Error("Unable to execute 'docker' in order to build a container asset. Please install 'docker' and try again.");
-            }
-            throw e;
-        }
-    }
-    cacheOptionToFlag(option) {
-        let flag = `type=${option.type}`;
-        if (option.params) {
-            flag +=
-                "," +
-                    Object.entries(option.params)
-                        .map(([k, v]) => `${k}=${v}`)
-                        .join(",");
-        }
-        return flag;
-    }
-}
-/**
- * Helps get appropriately configured Docker instances during the container
- * image publishing process.
- */
-export class DockerFactory {
-    enterLoggedInDestinationsCriticalSection = createCriticalSection();
-    loggedInDestinations = new Set();
-    /**
-     * Gets a Docker instance for building images.
-     */
-    async forBuild(options) {
-        const docker = new Docker(options.logger);
-        // Default behavior is to login before build so that the Dockerfile can reference images in the ECR repo
-        // However, if we're in a pipelines environment (for example),
-        // we may have alternative credentials to the default ones to use for the build itself.
-        // If the special config file is present, delay the login to the default credentials until the push.
-        // If the config file is present, we will configure and use those credentials for the build.
-        let cdkDockerCredentialsConfigured = docker.configureCdkCredentials();
-        if (!cdkDockerCredentialsConfigured) {
-            await this.loginOncePerDestination(docker, options);
-        }
-        return docker;
-    }
-    /**
-     * Gets a Docker instance for pushing images to ECR.
-     */
-    async forEcrPush(options) {
-        const docker = new Docker(options.logger);
-        await this.loginOncePerDestination(docker, options);
-        return docker;
-    }
-    async loginOncePerDestination(docker, options) {
-        // Changes: 012345678910.dkr.ecr.us-west-2.amazonaws.com/tagging-test
-        // To this: 012345678910.dkr.ecr.us-west-2.amazonaws.com
-        const repositoryDomain = options.repoUri.split("/")[0];
-        // Ensure one-at-a-time access to loggedInDestinations.
-        await this.enterLoggedInDestinationsCriticalSection(async () => {
-            if (this.loggedInDestinations.has(repositoryDomain)) {
-                return;
-            }
-            await docker.login(options.ecr);
-            this.loggedInDestinations.add(repositoryDomain);
-        });
-    }
-}
-function getDockerCmd() {
-    return process.env.CDK_DOCKER ?? "docker";
-}
-function flatten(x) {
-    return Array.prototype.concat([], ...x);
-}

package/cdk-assets/private/handlers/container-images.d.ts

@@ -1,22 +0,0 @@
-import { DockerImageManifestEntry } from "cdk-assets/lib/asset-manifest.js";
-import { IAssetHandler, IHandlerHost, IHandlerOptions } from "../asset-handler.js";
-export declare class ContainerImageAssetHandler implements IAssetHandler {
-    private readonly workDir;
-    private readonly asset;
-    private readonly host;
-    private readonly options;
-    private init?;
-    constructor(workDir: string, asset: DockerImageManifestEntry, host: IHandlerHost, options: IHandlerOptions);
-    build(): Promise<void>;
-    isPublished(): Promise<boolean>;
-    publish(): Promise<void>;
-    private initOnce;
-    /**
-     * Check whether the image already exists in the ECR repo
-     *
-     * Use the fields from the destination to do the actual check. The imageUri
-     * should correspond to that, but is only used to print Docker image location
-     * for user benefit (the format is slightly different).
-     */
-    private destinationAlreadyExists;
-}

package/cdk-assets/private/handlers/container-images.js

@@ -1,231 +0,0 @@
-import * as path from "path";
-import { EventType } from "cdk-assets/lib/progress.js";
-import { replaceAwsPlaceholders } from "cdk-assets/lib/private/placeholders.js";
-import { shell } from "cdk-assets/lib/private/shell.js";
-export class ContainerImageAssetHandler {
-    workDir;
-    asset;
-    host;
-    options;
-    init;
-    constructor(workDir, asset, host, 
-    // TODO: remove after PR is merged
-    options) {
-        this.workDir = workDir;
-        this.asset = asset;
-        this.host = host;
-        this.options = options;
-    }
-    async build() {
-        const initOnce = await this.initOnce();
-        if (initOnce.destinationAlreadyExists) {
-            return;
-        }
-        if (this.host.aborted) {
-            return;
-        }
-        const dockerForBuilding = await this.host.dockerFactory.forBuild({
-            repoUri: initOnce.repoUri,
-            logger: (m) => this.host.emitMessage(EventType.DEBUG, m),
-            ecr: initOnce.ecr,
-        });
-        const builder = new ContainerImageBuilder(dockerForBuilding, this.workDir, this.asset, this.host, 
-        // TODO: remove after PR is merged
-        {
-            quiet: this.options.quiet,
-        });
-        const localTagName = await builder.build();
-        if (localTagName === undefined || this.host.aborted) {
-            return;
-        }
-        if (this.host.aborted) {
-            return;
-        }
-        await dockerForBuilding.tag(localTagName, initOnce.imageUri);
-    }
-    async isPublished() {
-        try {
-            const initOnce = await this.initOnce({ quiet: true });
-            return initOnce.destinationAlreadyExists;
-        }
-        catch (e) {
-            this.host.emitMessage(EventType.DEBUG, `${e.message}`);
-        }
-        return false;
-    }
-    async publish() {
-        const initOnce = await this.initOnce();
-        if (initOnce.destinationAlreadyExists) {
-            return;
-        }
-        if (this.host.aborted) {
-            return;
-        }
-        const dockerForPushing = await this.host.dockerFactory.forEcrPush({
-            repoUri: initOnce.repoUri,
-            logger: (m) => this.host.emitMessage(EventType.DEBUG, m),
-            ecr: initOnce.ecr,
-        });
-        if (this.host.aborted) {
-            return;
-        }
-        this.host.emitMessage(EventType.UPLOAD, `Push ${initOnce.imageUri}`);
-        // TODO: remove after PR is merged
-        await dockerForPushing.push({
-            tag: initOnce.imageUri,
-            quiet: this.options.quiet,
-        });
-    }
-    async initOnce(options = {}) {
-        if (this.init) {
-            return this.init;
-        }
-        const destination = await replaceAwsPlaceholders(this.asset.destination, this.host.aws);
-        const ecr = await this.host.aws.ecrClient({
-            ...destination,
-            quiet: options.quiet,
-        });
-        const account = async () => (await this.host.aws.discoverCurrentAccount())?.accountId;
-        const repoUri = await repositoryUri(ecr, destination.repositoryName);
-        if (!repoUri) {
-            throw new Error(`No ECR repository named '${destination.repositoryName}' in account ${await account()}. Is this account bootstrapped?`);
-        }
-        const imageUri = `${repoUri}:${destination.imageTag}`;
-        this.init = {
-            imageUri,
-            ecr,
-            repoUri,
-            destinationAlreadyExists: await this.destinationAlreadyExists(ecr, destination, imageUri),
-        };
-        return this.init;
-    }
-    /**
-     * Check whether the image already exists in the ECR repo
-     *
-     * Use the fields from the destination to do the actual check. The imageUri
-     * should correspond to that, but is only used to print Docker image location
-     * for user benefit (the format is slightly different).
-     */
-    async destinationAlreadyExists(ecr, destination, imageUri) {
-        this.host.emitMessage(EventType.CHECK, `Check ${imageUri}`);
-        if (await imageExists(ecr, destination.repositoryName, destination.imageTag)) {
-            this.host.emitMessage(EventType.FOUND, `Found ${imageUri}`);
-            return true;
-        }
-        return false;
-    }
-}
-class ContainerImageBuilder {
-    docker;
-    workDir;
-    asset;
-    host;
-    options;
-    constructor(docker, workDir, asset, host, 
-    // TODO: remove after PR is merged
-    options) {
-        this.docker = docker;
-        this.workDir = workDir;
-        this.asset = asset;
-        this.host = host;
-        this.options = options;
-    }
-    async build() {
-        return this.asset.source.executable
-            ? this.buildExternalAsset(this.asset.source.executable)
-            : this.buildDirectoryAsset();
-    }
-    /**
-     * Build a (local) Docker asset from a directory with a Dockerfile
-     *
-     * Tags under a deterministic, unique, local identifier wich will skip
-     * the build if it already exists.
-     */
-    async buildDirectoryAsset() {
-        const localTagName = `cdkasset-${this.asset.id.assetId.toLowerCase()}`;
-        if (!(await this.isImageCached(localTagName))) {
-            if (this.host.aborted) {
-                return undefined;
-            }
-            await this.buildImage(localTagName);
-        }
-        return localTagName;
-    }
-    /**
-     * Build a (local) Docker asset by running an external command
-     *
-     * External command is responsible for deduplicating the build if possible,
-     * and is expected to return the generated image identifier on stdout.
-     */
-    async buildExternalAsset(executable, cwd) {
-        const assetPath = cwd ?? this.workDir;
-        this.host.emitMessage(EventType.BUILD, `Building Docker image using command '${executable}'`);
-        if (this.host.aborted) {
-            return undefined;
-        }
-        return (await shell(executable, { cwd: assetPath, quiet: true })).trim();
-    }
-    async buildImage(localTagName) {
-        const source = this.asset.source;
-        if (!source.directory) {
-            throw new Error(`'directory' is expected in the DockerImage asset source, got: ${JSON.stringify(source)}`);
-        }
-        const fullPath = path.resolve(this.workDir, source.directory);
-        this.host.emitMessage(EventType.BUILD, `Building Docker image at ${fullPath}`);
-        await this.docker.build({
-            directory: fullPath,
-            tag: localTagName,
-            buildArgs: source.dockerBuildArgs,
-            buildSecrets: source.dockerBuildSecrets,
-            target: source.dockerBuildTarget,
-            file: source.dockerFile,
-            networkMode: source.networkMode,
-            platform: source.platform,
-            outputs: source.dockerOutputs,
-            cacheFrom: source.cacheFrom,
-            cacheTo: source.cacheTo,
-            // TODO: remove after PR is merged
-            quiet: this.options.quiet,
-        });
-    }
-    async isImageCached(localTagName) {
-        if (await this.docker.exists(localTagName)) {
-            this.host.emitMessage(EventType.CACHED, `Cached ${localTagName}`);
-            return true;
-        }
-        return false;
-    }
-}
-async function imageExists(ecr, repositoryName, imageTag) {
-    try {
-        await ecr
-            .describeImages({ repositoryName, imageIds: [{ imageTag }] })
-            .promise();
-        return true;
-    }
-    catch (e) {
-        if (e.code !== "ImageNotFoundException") {
-            throw e;
-        }
-        return false;
-    }
-}
-/**
- * Return the URI for the repository with the given name
- *
- * Returns undefined if the repository does not exist.
- */
-async function repositoryUri(ecr, repositoryName) {
-    try {
-        const response = await ecr
-            .describeRepositories({ repositoryNames: [repositoryName] })
-            .promise();
-        return (response.repositories || [])[0]?.repositoryUri;
-    }
-    catch (e) {
-        if (e.code !== "RepositoryNotFoundException") {
-            throw e;
-        }
-        return undefined;
-    }
-}

package/cdk-assets/private/handlers/index.d.ts

@@ -1,3 +0,0 @@
-import { AssetManifest, IManifestEntry } from "cdk-assets/lib/asset-manifest.js";
-import { IAssetHandler, IHandlerHost, IHandlerOptions } from "../asset-handler.js";
-export declare function makeAssetHandler(manifest: AssetManifest, asset: IManifestEntry, host: IHandlerHost, options: IHandlerOptions): IAssetHandler;

package/cdk-assets/private/handlers/index.js

@@ -1,18 +0,0 @@
-import { ContainerImageAssetHandler } from "./container-images.js";
-import { FileAssetHandler } from "cdk-assets/lib/private/handlers/files.js";
-import { DockerImageManifestEntry, FileManifestEntry, } from "cdk-assets/lib/asset-manifest.js";
-export function makeAssetHandler(manifest, asset, host, 
-// TODO: remove after PR is merged
-options) {
-    if (asset instanceof FileManifestEntry) {
-        // TODO: remove after PR is merged
-        // @ts-ignore
-        return new FileAssetHandler(manifest.directory, asset, host);
-    }
-    if (asset instanceof DockerImageManifestEntry) {
-        return new ContainerImageAssetHandler(manifest.directory, asset, host, 
-        // TODO: remove after PR is merged
-        options);
-    }
-    throw new Error(`Unrecognized asset type: '${asset}'`);
-}

package/cdk-assets/publishing.d.ts

@@ -1,113 +0,0 @@
-import { AssetManifest, IManifestEntry } from "cdk-assets/lib/asset-manifest.js";
-import { IAws } from "cdk-assets/lib/aws.js";
-import { IPublishProgress, IPublishProgressListener } from "cdk-assets/lib/progress.js";
-export interface AssetPublishingOptions {
-    /**
-     * Entry point for AWS client
-     */
-    readonly aws: IAws;
-    /**
-     * Listener for progress events
-     *
-     * @default No listener
-     */
-    readonly progressListener?: IPublishProgressListener;
-    /**
-     * Whether to throw at the end if there were errors
-     *
-     * @default true
-     */
-    readonly throwOnError?: boolean;
-    /**
-     * Whether to publish in parallel, when 'publish()' is called
-     *
-     * @default false
-     */
-    readonly publishInParallel?: boolean;
-    /**
-     * Whether to build assets, when 'publish()' is called
-     *
-     * @default true
-     */
-    readonly buildAssets?: boolean;
-    /**
-     * Whether to publish assets, when 'publish()' is called
-     *
-     * @default true
-     */
-    readonly publishAssets?: boolean;
-    /**
-     * Whether to print publishing logs
-     *
-     * @default true
-     */
-    readonly quiet?: boolean;
-}
-/**
- * A failure to publish an asset
- */
-export interface FailedAsset {
-    /**
-     * The asset that failed to publish
-     */
-    readonly asset: IManifestEntry;
-    /**
-     * The failure that occurred
-     */
-    readonly error: Error;
-}
-export declare class AssetPublishing implements IPublishProgress {
-    private readonly manifest;
-    private readonly options;
-    /**
-     * The message for the IPublishProgress interface
-     */
-    message: string;
-    /**
-     * The current asset for the IPublishProgress interface
-     */
-    currentAsset?: IManifestEntry;
-    readonly failures: FailedAsset[];
-    private readonly assets;
-    private readonly totalOperations;
-    private completedOperations;
-    private aborted;
-    private readonly handlerHost;
-    private readonly publishInParallel;
-    private readonly buildAssets;
-    private readonly publishAssets;
-    private readonly handlerCache;
-    constructor(manifest: AssetManifest, options: AssetPublishingOptions);
-    /**
-     * Publish all assets from the manifest
-     */
-    publish(): Promise<void>;
-    /**
-     * Build a single asset from the manifest
-     */
-    buildEntry(asset: IManifestEntry): Promise<boolean>;
-    /**
-     * Publish a single asset from the manifest
-     */
-    publishEntry(asset: IManifestEntry): Promise<boolean>;
-    /**
-     * Return whether a single asset is published
-     */
-    isEntryPublished(asset: IManifestEntry): Promise<boolean>;
-    /**
-     * publish an asset (used by 'publish()')
-     * @param asset The asset to publish
-     * @returns false when publishing should stop
-     */
-    private publishAsset;
-    get percentComplete(): number;
-    abort(): void;
-    get hasFailures(): boolean;
-    /**
-     * Publish a progress event to the listener, if present.
-     *
-     * Returns whether an abort is requested. Helper to get rid of repetitive code in publish().
-     */
-    private progressEvent;
-    private assetHandler;
-}

package/cdk-assets/publishing.js

@@ -1,194 +0,0 @@
-import { DockerFactory } from "./private/docker.js";
-import { makeAssetHandler } from "./private/handlers/index.js";
-import { EventType, } from "cdk-assets/lib/progress.js";
-export class AssetPublishing {
-    manifest;
-    options;
-    /**
-     * The message for the IPublishProgress interface
-     */
-    message = "Starting";
-    /**
-     * The current asset for the IPublishProgress interface
-     */
-    currentAsset;
-    failures = new Array();
-    assets;
-    totalOperations;
-    completedOperations = 0;
-    aborted = false;
-    handlerHost;
-    publishInParallel;
-    buildAssets;
-    publishAssets;
-    handlerCache = new Map();
-    constructor(manifest, options) {
-        this.manifest = manifest;
-        this.options = options;
-        this.assets = manifest.entries;
-        this.totalOperations = this.assets.length;
-        this.publishInParallel = options.publishInParallel ?? false;
-        this.buildAssets = options.buildAssets ?? true;
-        this.publishAssets = options.publishAssets ?? true;
-        const self = this;
-        this.handlerHost = {
-            aws: this.options.aws,
-            get aborted() {
-                return self.aborted;
-            },
-            emitMessage(t, m) {
-                self.progressEvent(t, m);
-            },
-            dockerFactory: new DockerFactory(),
-        };
-    }
-    /**
-     * Publish all assets from the manifest
-     */
-    async publish() {
-        if (this.publishInParallel) {
-            await Promise.all(this.assets.map(async (asset) => this.publishAsset(asset)));
-        }
-        else {
-            for (const asset of this.assets) {
-                if (!(await this.publishAsset(asset))) {
-                    break;
-                }
-            }
-        }
-        if ((this.options.throwOnError ?? true) && this.failures.length > 0) {
-            throw new Error(`Error publishing: ${this.failures.map((e) => e.error.message)}`);
-        }
-    }
-    /**
-     * Build a single asset from the manifest
-     */
-    async buildEntry(asset) {
-        try {
-            if (this.progressEvent(EventType.START, `Building ${asset.id}`)) {
-                return false;
-            }
-            const handler = this.assetHandler(asset);
-            await handler.build();
-            if (this.aborted) {
-                throw new Error("Aborted");
-            }
-            this.completedOperations++;
-            if (this.progressEvent(EventType.SUCCESS, `Built ${asset.id}`)) {
-                return false;
-            }
-        }
-        catch (e) {
-            this.failures.push({ asset, error: e });
-            this.completedOperations++;
-            if (this.progressEvent(EventType.FAIL, e.message)) {
-                return false;
-            }
-        }
-        return true;
-    }
-    /**
-     * Publish a single asset from the manifest
-     */
-    async publishEntry(asset) {
-        try {
-            if (this.progressEvent(EventType.START, `Publishing ${asset.id}`)) {
-                return false;
-            }
-            const handler = this.assetHandler(asset);
-            await handler.publish();
-            if (this.aborted) {
-                throw new Error("Aborted");
-            }
-            this.completedOperations++;
-            if (this.progressEvent(EventType.SUCCESS, `Published ${asset.id}`)) {
-                return false;
-            }
-        }
-        catch (e) {
-            this.failures.push({ asset, error: e });
-            this.completedOperations++;
-            if (this.progressEvent(EventType.FAIL, e.message)) {
-                return false;
-            }
-        }
-        return true;
-    }
-    /**
-     * Return whether a single asset is published
-     */
-    isEntryPublished(asset) {
-        const handler = this.assetHandler(asset);
-        return handler.isPublished();
-    }
-    /**
-     * publish an asset (used by 'publish()')
-     * @param asset The asset to publish
-     * @returns false when publishing should stop
-     */
-    async publishAsset(asset) {
-        try {
-            if (this.progressEvent(EventType.START, `Publishing ${asset.id}`)) {
-                return false;
-            }
-            const handler = this.assetHandler(asset);
-            if (this.buildAssets) {
-                await handler.build();
-            }
-            if (this.publishAssets) {
-                await handler.publish();
-            }
-            if (this.aborted) {
-                throw new Error("Aborted");
-            }
-            this.completedOperations++;
-            if (this.progressEvent(EventType.SUCCESS, `Published ${asset.id}`)) {
-                return false;
-            }
-        }
-        catch (e) {
-            this.failures.push({ asset, error: e });
-            this.completedOperations++;
-            if (this.progressEvent(EventType.FAIL, e.message)) {
-                return false;
-            }
-        }
-        return true;
-    }
-    get percentComplete() {
-        if (this.totalOperations === 0) {
-            return 100;
-        }
-        return Math.floor((this.completedOperations / this.totalOperations) * 100);
-    }
-    abort() {
-        this.aborted = true;
-    }
-    get hasFailures() {
-        return this.failures.length > 0;
-    }
-    /**
-     * Publish a progress event to the listener, if present.
-     *
-     * Returns whether an abort is requested. Helper to get rid of repetitive code in publish().
-     */
-    progressEvent(event, message) {
-        this.message = message;
-        if (this.options.progressListener) {
-            this.options.progressListener.onPublishEvent(event, this);
-        }
-        return this.aborted;
-    }
-    assetHandler(asset) {
-        const existing = this.handlerCache.get(asset);
-        if (existing) {
-            return existing;
-        }
-        const ret = makeAssetHandler(this.manifest, asset, this.handlerHost, {
-            // TODO: remove after PR is merged
-            quiet: this.options.quiet,
-        });
-        this.handlerCache.set(asset, ret);
-        return ret;
-    }
-}