sst 2.23.15 → 2.24.1

package/cdk-assets/private/docker.js

@@ -1,237 +0,0 @@
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import { cdkCredentialsConfig, obtainEcrCredentials, } from "cdk-assets/lib/private/docker-credentials.js";
-import { shell, } from "cdk-assets/lib/private/shell.js";
-import { createCriticalSection } from "cdk-assets/lib/private/util.js";
-var InspectImageErrorCode;
-(function (InspectImageErrorCode) {
-    InspectImageErrorCode[InspectImageErrorCode["Docker"] = 1] = "Docker";
-    InspectImageErrorCode[InspectImageErrorCode["Podman"] = 125] = "Podman";
-})(InspectImageErrorCode || (InspectImageErrorCode = {}));
-export class Docker {
-    logger;
-    configDir = undefined;
-    constructor(logger) {
-        this.logger = logger;
-    }
-    /**
-     * Whether an image with the given tag exists
-     */
-    async exists(tag) {
-        try {
-            await this.execute(["inspect", tag], { quiet: true });
-            return true;
-        }
-        catch (e) {
-            const error = e;
-            /**
-             * The only error we expect to be thrown will have this property and value.
-             * If it doesn't, it's unrecognized so re-throw it.
-             */
-            if (error.code !== "PROCESS_FAILED") {
-                throw error;
-            }
-            /**
-             * If we know the shell command above returned an error, check to see
-             * if the exit code is one we know to actually mean that the image doesn't
-             * exist.
-             */
-            switch (error.exitCode) {
-                case InspectImageErrorCode.Docker:
-                case InspectImageErrorCode.Podman:
-                    // Docker and Podman will return this exit code when an image doesn't exist, return false
-                    // context: https://github.com/aws/aws-cdk/issues/16209
-                    return false;
-                default:
-                    // This is an error but it's not an exit code we recognize, throw.
-                    throw error;
-            }
-        }
-    }
-    async build(options) {
-        const buildCommand = [
-            "build",
-            ...flatten(Object.entries(options.buildArgs || {}).map(([k, v]) => [
-                "--build-arg",
-                `${k}=${v}`,
-            ])),
-            ...flatten(Object.entries(options.buildSecrets || {}).map(([k, v]) => [
-                "--secret",
-                `id=${k},${v}`,
-            ])),
-            "--tag",
-            options.tag,
-            ...(options.target ? ["--target", options.target] : []),
-            ...(options.file ? ["--file", options.file] : []),
-            ...(options.networkMode ? ["--network", options.networkMode] : []),
-            ...(options.platform ? ["--platform", options.platform] : []),
-            ...(options.outputs
-                ? options.outputs.map((output) => [`--output=${output}`])
-                : []),
-            ...(options.cacheFrom
-                ? [
-                    ...options.cacheFrom
-                        .map((cacheFrom) => [
-                        "--cache-from",
-                        this.cacheOptionToFlag(cacheFrom),
-                    ])
-                        .flat(),
-                ]
-                : []),
-            ...(options.cacheTo
-                ? ["--cache-to", this.cacheOptionToFlag(options.cacheTo)]
-                : []),
-            ".",
-        ];
-        await this.execute(buildCommand, {
-            cwd: options.directory,
-            // TODO: remove after PR is merged
-            quiet: options.quiet,
-        });
-    }
-    /**
-     * Get credentials from ECR and run docker login
-     */
-    async login(ecr) {
-        const credentials = await obtainEcrCredentials(ecr);
-        // Use --password-stdin otherwise docker will complain. Loudly.
-        await this.execute([
-            "login",
-            "--username",
-            credentials.username,
-            "--password-stdin",
-            credentials.endpoint,
-        ], {
-            input: credentials.password,
-            // Need to quiet otherwise Docker will complain
-            // 'WARNING! Your password will be stored unencrypted'
-            // doesn't really matter since it's a token.
-            quiet: true,
-        });
-    }
-    async tag(sourceTag, targetTag) {
-        await this.execute(["tag", sourceTag, targetTag]);
-    }
-    // TODO: remove after PR is merged
-    async push(options) {
-        await this.execute(["push", options.tag], { quiet: options.quiet });
-    }
-    /**
-     * If a CDK Docker Credentials file exists, creates a new Docker config directory.
-     * Sets up `docker-credential-cdk-assets` to be the credential helper for each domain in the CDK config.
-     * All future commands (e.g., `build`, `push`) will use this config.
-     *
-     * See https://docs.docker.com/engine/reference/commandline/login/#credential-helpers for more details on cred helpers.
-     *
-     * @returns true if CDK config was found and configured, false otherwise
-     */
-    configureCdkCredentials() {
-        const config = cdkCredentialsConfig();
-        if (!config) {
-            return false;
-        }
-        this.configDir = fs.mkdtempSync(path.join(os.tmpdir(), "cdkDockerConfig"));
-        const domains = Object.keys(config.domainCredentials);
-        const credHelpers = domains.reduce((map, domain) => {
-            map[domain] = "cdk-assets"; // Use docker-credential-cdk-assets for this domain
-            return map;
-        }, {});
-        fs.writeFileSync(path.join(this.configDir, "config.json"), JSON.stringify({ credHelpers }), { encoding: "utf-8" });
-        return true;
-    }
-    /**
-     * Removes any configured Docker config directory.
-     * All future commands (e.g., `build`, `push`) will use the default config.
-     *
-     * This is useful after calling `configureCdkCredentials` to reset to default credentials.
-     */
-    resetAuthPlugins() {
-        this.configDir = undefined;
-    }
-    async execute(args, options = {}) {
-        const configArgs = this.configDir ? ["--config", this.configDir] : [];
-        // TODO: remove after PR is merged
-        //const pathToCdkAssets = path.resolve(__dirname, "..", "..", "bin");
-        const pathToCdkAssets = "";
-        try {
-            await shell([getDockerCmd(), ...configArgs, ...args], {
-                logger: this.logger,
-                ...options,
-                env: {
-                    ...process.env,
-                    ...options.env,
-                    PATH: `${pathToCdkAssets}${path.delimiter}${options.env?.PATH ?? process.env.PATH}`,
-                },
-            });
-        }
-        catch (e) {
-            if (e.code === "ENOENT") {
-                throw new Error("Unable to execute 'docker' in order to build a container asset. Please install 'docker' and try again.");
-            }
-            throw e;
-        }
-    }
-    cacheOptionToFlag(option) {
-        let flag = `type=${option.type}`;
-        if (option.params) {
-            flag +=
-                "," +
-                    Object.entries(option.params)
-                        .map(([k, v]) => `${k}=${v}`)
-                        .join(",");
-        }
-        return flag;
-    }
-}
-/**
- * Helps get appropriately configured Docker instances during the container
- * image publishing process.
- */
-export class DockerFactory {
-    enterLoggedInDestinationsCriticalSection = createCriticalSection();
-    loggedInDestinations = new Set();
-    /**
-     * Gets a Docker instance for building images.
-     */
-    async forBuild(options) {
-        const docker = new Docker(options.logger);
-        // Default behavior is to login before build so that the Dockerfile can reference images in the ECR repo
-        // However, if we're in a pipelines environment (for example),
-        // we may have alternative credentials to the default ones to use for the build itself.
-        // If the special config file is present, delay the login to the default credentials until the push.
-        // If the config file is present, we will configure and use those credentials for the build.
-        let cdkDockerCredentialsConfigured = docker.configureCdkCredentials();
-        if (!cdkDockerCredentialsConfigured) {
-            await this.loginOncePerDestination(docker, options);
-        }
-        return docker;
-    }
-    /**
-     * Gets a Docker instance for pushing images to ECR.
-     */
-    async forEcrPush(options) {
-        const docker = new Docker(options.logger);
-        await this.loginOncePerDestination(docker, options);
-        return docker;
-    }
-    async loginOncePerDestination(docker, options) {
-        // Changes: 012345678910.dkr.ecr.us-west-2.amazonaws.com/tagging-test
-        // To this: 012345678910.dkr.ecr.us-west-2.amazonaws.com
-        const repositoryDomain = options.repoUri.split("/")[0];
-        // Ensure one-at-a-time access to loggedInDestinations.
-        await this.enterLoggedInDestinationsCriticalSection(async () => {
-            if (this.loggedInDestinations.has(repositoryDomain)) {
-                return;
-            }
-            await docker.login(options.ecr);
-            this.loggedInDestinations.add(repositoryDomain);
-        });
-    }
-}
-function getDockerCmd() {
-    return process.env.CDK_DOCKER ?? "docker";
-}
-function flatten(x) {
-    return Array.prototype.concat([], ...x);
-}

package/cdk-assets/private/handlers/container-images.d.ts

@@ -1,22 +0,0 @@
-import { DockerImageManifestEntry } from "cdk-assets/lib/asset-manifest.js";
-import { IAssetHandler, IHandlerHost, IHandlerOptions } from "../asset-handler.js";
-export declare class ContainerImageAssetHandler implements IAssetHandler {
-    private readonly workDir;
-    private readonly asset;
-    private readonly host;
-    private readonly options;
-    private init?;
-    constructor(workDir: string, asset: DockerImageManifestEntry, host: IHandlerHost, options: IHandlerOptions);
-    build(): Promise<void>;
-    isPublished(): Promise<boolean>;
-    publish(): Promise<void>;
-    private initOnce;
-    /**
-     * Check whether the image already exists in the ECR repo
-     *
-     * Use the fields from the destination to do the actual check. The imageUri
-     * should correspond to that, but is only used to print Docker image location
-     * for user benefit (the format is slightly different).
-     */
-    private destinationAlreadyExists;
-}

package/cdk-assets/private/handlers/container-images.js

@@ -1,231 +0,0 @@
-import * as path from "path";
-import { EventType } from "cdk-assets/lib/progress.js";
-import { replaceAwsPlaceholders } from "cdk-assets/lib/private/placeholders.js";
-import { shell } from "cdk-assets/lib/private/shell.js";
-export class ContainerImageAssetHandler {
-    workDir;
-    asset;
-    host;
-    options;
-    init;
-    constructor(workDir, asset, host, 
-    // TODO: remove after PR is merged
-    options) {
-        this.workDir = workDir;
-        this.asset = asset;
-        this.host = host;
-        this.options = options;
-    }
-    async build() {
-        const initOnce = await this.initOnce();
-        if (initOnce.destinationAlreadyExists) {
-            return;
-        }
-        if (this.host.aborted) {
-            return;
-        }
-        const dockerForBuilding = await this.host.dockerFactory.forBuild({
-            repoUri: initOnce.repoUri,
-            logger: (m) => this.host.emitMessage(EventType.DEBUG, m),
-            ecr: initOnce.ecr,
-        });
-        const builder = new ContainerImageBuilder(dockerForBuilding, this.workDir, this.asset, this.host, 
-        // TODO: remove after PR is merged
-        {
-            quiet: this.options.quiet,
-        });
-        const localTagName = await builder.build();
-        if (localTagName === undefined || this.host.aborted) {
-            return;
-        }
-        if (this.host.aborted) {
-            return;
-        }
-        await dockerForBuilding.tag(localTagName, initOnce.imageUri);
-    }
-    async isPublished() {
-        try {
-            const initOnce = await this.initOnce({ quiet: true });
-            return initOnce.destinationAlreadyExists;
-        }
-        catch (e) {
-            this.host.emitMessage(EventType.DEBUG, `${e.message}`);
-        }
-        return false;
-    }
-    async publish() {
-        const initOnce = await this.initOnce();
-        if (initOnce.destinationAlreadyExists) {
-            return;
-        }
-        if (this.host.aborted) {
-            return;
-        }
-        const dockerForPushing = await this.host.dockerFactory.forEcrPush({
-            repoUri: initOnce.repoUri,
-            logger: (m) => this.host.emitMessage(EventType.DEBUG, m),
-            ecr: initOnce.ecr,
-        });
-        if (this.host.aborted) {
-            return;
-        }
-        this.host.emitMessage(EventType.UPLOAD, `Push ${initOnce.imageUri}`);
-        // TODO: remove after PR is merged
-        await dockerForPushing.push({
-            tag: initOnce.imageUri,
-            quiet: this.options.quiet,
-        });
-    }
-    async initOnce(options = {}) {
-        if (this.init) {
-            return this.init;
-        }
-        const destination = await replaceAwsPlaceholders(this.asset.destination, this.host.aws);
-        const ecr = await this.host.aws.ecrClient({
-            ...destination,
-            quiet: options.quiet,
-        });
-        const account = async () => (await this.host.aws.discoverCurrentAccount())?.accountId;
-        const repoUri = await repositoryUri(ecr, destination.repositoryName);
-        if (!repoUri) {
-            throw new Error(`No ECR repository named '${destination.repositoryName}' in account ${await account()}. Is this account bootstrapped?`);
-        }
-        const imageUri = `${repoUri}:${destination.imageTag}`;
-        this.init = {
-            imageUri,
-            ecr,
-            repoUri,
-            destinationAlreadyExists: await this.destinationAlreadyExists(ecr, destination, imageUri),
-        };
-        return this.init;
-    }
-    /**
-     * Check whether the image already exists in the ECR repo
-     *
-     * Use the fields from the destination to do the actual check. The imageUri
-     * should correspond to that, but is only used to print Docker image location
-     * for user benefit (the format is slightly different).
-     */
-    async destinationAlreadyExists(ecr, destination, imageUri) {
-        this.host.emitMessage(EventType.CHECK, `Check ${imageUri}`);
-        if (await imageExists(ecr, destination.repositoryName, destination.imageTag)) {
-            this.host.emitMessage(EventType.FOUND, `Found ${imageUri}`);
-            return true;
-        }
-        return false;
-    }
-}
-class ContainerImageBuilder {
-    docker;
-    workDir;
-    asset;
-    host;
-    options;
-    constructor(docker, workDir, asset, host, 
-    // TODO: remove after PR is merged
-    options) {
-        this.docker = docker;
-        this.workDir = workDir;
-        this.asset = asset;
-        this.host = host;
-        this.options = options;
-    }
-    async build() {
-        return this.asset.source.executable
-            ? this.buildExternalAsset(this.asset.source.executable)
-            : this.buildDirectoryAsset();
-    }
-    /**
-     * Build a (local) Docker asset from a directory with a Dockerfile
-     *
-     * Tags under a deterministic, unique, local identifier wich will skip
-     * the build if it already exists.
-     */
-    async buildDirectoryAsset() {
-        const localTagName = `cdkasset-${this.asset.id.assetId.toLowerCase()}`;
-        if (!(await this.isImageCached(localTagName))) {
-            if (this.host.aborted) {
-                return undefined;
-            }
-            await this.buildImage(localTagName);
-        }
-        return localTagName;
-    }
-    /**
-     * Build a (local) Docker asset by running an external command
-     *
-     * External command is responsible for deduplicating the build if possible,
-     * and is expected to return the generated image identifier on stdout.
-     */
-    async buildExternalAsset(executable, cwd) {
-        const assetPath = cwd ?? this.workDir;
-        this.host.emitMessage(EventType.BUILD, `Building Docker image using command '${executable}'`);
-        if (this.host.aborted) {
-            return undefined;
-        }
-        return (await shell(executable, { cwd: assetPath, quiet: true })).trim();
-    }
-    async buildImage(localTagName) {
-        const source = this.asset.source;
-        if (!source.directory) {
-            throw new Error(`'directory' is expected in the DockerImage asset source, got: ${JSON.stringify(source)}`);
-        }
-        const fullPath = path.resolve(this.workDir, source.directory);
-        this.host.emitMessage(EventType.BUILD, `Building Docker image at ${fullPath}`);
-        await this.docker.build({
-            directory: fullPath,
-            tag: localTagName,
-            buildArgs: source.dockerBuildArgs,
-            buildSecrets: source.dockerBuildSecrets,
-            target: source.dockerBuildTarget,
-            file: source.dockerFile,
-            networkMode: source.networkMode,
-            platform: source.platform,
-            outputs: source.dockerOutputs,
-            cacheFrom: source.cacheFrom,
-            cacheTo: source.cacheTo,
-            // TODO: remove after PR is merged
-            quiet: this.options.quiet,
-        });
-    }
-    async isImageCached(localTagName) {
-        if (await this.docker.exists(localTagName)) {
-            this.host.emitMessage(EventType.CACHED, `Cached ${localTagName}`);
-            return true;
-        }
-        return false;
-    }
-}
-async function imageExists(ecr, repositoryName, imageTag) {
-    try {
-        await ecr
-            .describeImages({ repositoryName, imageIds: [{ imageTag }] })
-            .promise();
-        return true;
-    }
-    catch (e) {
-        if (e.code !== "ImageNotFoundException") {
-            throw e;
-        }
-        return false;
-    }
-}
-/**
- * Return the URI for the repository with the given name
- *
- * Returns undefined if the repository does not exist.
- */
-async function repositoryUri(ecr, repositoryName) {
-    try {
-        const response = await ecr
-            .describeRepositories({ repositoryNames: [repositoryName] })
-            .promise();
-        return (response.repositories || [])[0]?.repositoryUri;
-    }
-    catch (e) {
-        if (e.code !== "RepositoryNotFoundException") {
-            throw e;
-        }
-        return undefined;
-    }
-}

package/cdk-assets/private/handlers/index.d.ts

@@ -1,3 +0,0 @@
-import { AssetManifest, IManifestEntry } from "cdk-assets/lib/asset-manifest.js";
-import { IAssetHandler, IHandlerHost, IHandlerOptions } from "../asset-handler.js";
-export declare function makeAssetHandler(manifest: AssetManifest, asset: IManifestEntry, host: IHandlerHost, options: IHandlerOptions): IAssetHandler;

package/cdk-assets/private/handlers/index.js

@@ -1,18 +0,0 @@
-import { ContainerImageAssetHandler } from "./container-images.js";
-import { FileAssetHandler } from "cdk-assets/lib/private/handlers/files.js";
-import { DockerImageManifestEntry, FileManifestEntry, } from "cdk-assets/lib/asset-manifest.js";
-export function makeAssetHandler(manifest, asset, host, 
-// TODO: remove after PR is merged
-options) {
-    if (asset instanceof FileManifestEntry) {
-        // TODO: remove after PR is merged
-        // @ts-ignore
-        return new FileAssetHandler(manifest.directory, asset, host);
-    }
-    if (asset instanceof DockerImageManifestEntry) {
-        return new ContainerImageAssetHandler(manifest.directory, asset, host, 
-        // TODO: remove after PR is merged
-        options);
-    }
-    throw new Error(`Unrecognized asset type: '${asset}'`);
-}

package/cdk-assets/publishing.d.ts

@@ -1,113 +0,0 @@
-import { AssetManifest, IManifestEntry } from "cdk-assets/lib/asset-manifest.js";
-import { IAws } from "cdk-assets/lib/aws.js";
-import { IPublishProgress, IPublishProgressListener } from "cdk-assets/lib/progress.js";
-export interface AssetPublishingOptions {
-    /**
-     * Entry point for AWS client
-     */
-    readonly aws: IAws;
-    /**
-     * Listener for progress events
-     *
-     * @default No listener
-     */
-    readonly progressListener?: IPublishProgressListener;
-    /**
-     * Whether to throw at the end if there were errors
-     *
-     * @default true
-     */
-    readonly throwOnError?: boolean;
-    /**
-     * Whether to publish in parallel, when 'publish()' is called
-     *
-     * @default false
-     */
-    readonly publishInParallel?: boolean;
-    /**
-     * Whether to build assets, when 'publish()' is called
-     *
-     * @default true
-     */
-    readonly buildAssets?: boolean;
-    /**
-     * Whether to publish assets, when 'publish()' is called
-     *
-     * @default true
-     */
-    readonly publishAssets?: boolean;
-    /**
-     * Whether to print publishing logs
-     *
-     * @default true
-     */
-    readonly quiet?: boolean;
-}
-/**
- * A failure to publish an asset
- */
-export interface FailedAsset {
-    /**
-     * The asset that failed to publish
-     */
-    readonly asset: IManifestEntry;
-    /**
-     * The failure that occurred
-     */
-    readonly error: Error;
-}
-export declare class AssetPublishing implements IPublishProgress {
-    private readonly manifest;
-    private readonly options;
-    /**
-     * The message for the IPublishProgress interface
-     */
-    message: string;
-    /**
-     * The current asset for the IPublishProgress interface
-     */
-    currentAsset?: IManifestEntry;
-    readonly failures: FailedAsset[];
-    private readonly assets;
-    private readonly totalOperations;
-    private completedOperations;
-    private aborted;
-    private readonly handlerHost;
-    private readonly publishInParallel;
-    private readonly buildAssets;
-    private readonly publishAssets;
-    private readonly handlerCache;
-    constructor(manifest: AssetManifest, options: AssetPublishingOptions);
-    /**
-     * Publish all assets from the manifest
-     */
-    publish(): Promise<void>;
-    /**
-     * Build a single asset from the manifest
-     */
-    buildEntry(asset: IManifestEntry): Promise<boolean>;
-    /**
-     * Publish a single asset from the manifest
-     */
-    publishEntry(asset: IManifestEntry): Promise<boolean>;
-    /**
-     * Return whether a single asset is published
-     */
-    isEntryPublished(asset: IManifestEntry): Promise<boolean>;
-    /**
-     * publish an asset (used by 'publish()')
-     * @param asset The asset to publish
-     * @returns false when publishing should stop
-     */
-    private publishAsset;
-    get percentComplete(): number;
-    abort(): void;
-    get hasFailures(): boolean;
-    /**
-     * Publish a progress event to the listener, if present.
-     *
-     * Returns whether an abort is requested. Helper to get rid of repetitive code in publish().
-     */
-    private progressEvent;
-    private assetHandler;
-}