token-injectable-docker-builder 1.13.4 → 2.0.0

package/isComplete/isComplete.js

@@ -6,6 +6,35 @@ const {
     CloudWatchLogsClient,
     GetLogEventsCommand,
 } = require('@aws-sdk/client-cloudwatch-logs');
+const {
+    ECRClient,
+    BatchGetImageCommand,
+} = require('@aws-sdk/client-ecr');
+
+async function checkReplicaAvailability(repositoryName, imageTag, replicaRegions) {
+    for (const region of replicaRegions) {
+        const ecr = new ECRClient({ region });
+        try {
+            const resp = await ecr.send(new BatchGetImageCommand({
+                repositoryName,
+                imageIds: [{ imageTag }],
+            }));
+            const images = resp.images || [];
+            if (images.length === 0) {
+                console.log(`Replica ${region}: repo exists but tag ${imageTag} not yet present.`);
+                return false;
+            }
+            console.log(`Replica ${region}: image present.`);
+        } catch (err) {
+            if (err.name === 'RepositoryNotFoundException') {
+                console.log(`Replica ${region}: destination repo not yet created by ECR replication.`);
+                return false;
+            }
+            throw err;
+        }
+    }
+    return true;
+}
 
 exports.handler = async (event) => {
     console.log('--- isComplete Handler Invoked ---');
@@ -86,9 +115,24 @@ exports.handler = async (event) => {
             return { IsComplete: false };
         }
 
-        // If build succeeded, return the image tag from the custom resource properties
+        // If build succeeded, optionally wait for cross-region replicas to land
+        // before signalling complete. ECR replication is async (most images
+        // <30 min, rare cases longer) — without this, a consumer stack in
+        // another region may try to pull the image before it's been
+        // replicated and fail with "Source image does not exist".
         if (buildStatus === 'SUCCEEDED') {
             const imageTag = event.ResourceProperties?.ImageTag || process.env.IMAGE_TAG;
+            const repositoryName = event.ResourceProperties?.RepositoryName;
+            const replicaRegions = JSON.parse(event.ResourceProperties?.ReplicaRegions || '[]');
+
+            if (replicaRegions.length > 0 && repositoryName) {
+                const ready = await checkReplicaAvailability(repositoryName, imageTag, replicaRegions);
+                if (!ready) {
+                    console.log('Build succeeded; waiting for replicas to catch up.');
+                    return { IsComplete: false };
+                }
+            }
+
             return {
                 IsComplete: true,
                 Data: {

package/lib/build-spec.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Parse a .dockerignore file at `sourcePath` (if present) and combine it with
+ * a user-supplied exclude list. The Dockerfile itself is never excluded —
+ * `.dockerignore` patterns matching `dockerFile` are filtered out so the
+ * S3 asset always contains the Dockerfile.
+ */
+export declare function resolveExcludes(sourcePath: string, dockerFile: string, exclude: string[] | undefined): string[] | undefined;
+export interface BuildSpecOptions {
+    readonly imageTag: string;
+    readonly dockerFile?: string;
+    readonly buildArgs?: {
+        [key: string]: string;
+    };
+    readonly dockerLoginSecretArn?: string;
+    readonly installCommands?: string[];
+    readonly preBuildCommands?: string[];
+    readonly cacheDisabled: boolean;
+    readonly platform: 'linux/amd64' | 'linux/arm64';
+}
+/**
+ * Assemble the plain buildspec object that the construct passes to
+ * `BuildSpec.fromObject`. Pure function — easy to unit test.
+ */
+export declare function buildBuildSpec(opts: BuildSpecOptions): Record<string, unknown>;

package/lib/build-spec.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveExcludes = resolveExcludes;
+exports.buildBuildSpec = buildBuildSpec;
+const fs = require("fs");
+const path = require("path");
+/**
+ * Parse a .dockerignore file at `sourcePath` (if present) and combine it with
+ * a user-supplied exclude list. The Dockerfile itself is never excluded —
+ * `.dockerignore` patterns matching `dockerFile` are filtered out so the
+ * S3 asset always contains the Dockerfile.
+ */
+function resolveExcludes(sourcePath, dockerFile, exclude) {
+    let effective = exclude;
+    if (!effective) {
+        const dockerignorePath = path.join(sourcePath, '.dockerignore');
+        if (fs.existsSync(dockerignorePath)) {
+            const fileContent = fs.readFileSync(dockerignorePath, 'utf8');
+            effective = fileContent
+                .split('\n')
+                .map((line) => line.trim())
+                .filter((line) => line.length > 0 && !line.startsWith('#'));
+        }
+    }
+    if (!effective)
+        return undefined;
+    return effective.filter((pattern) => {
+        const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+        const regex = new RegExp(`^${escaped.replace(/\*/g, '.*').replace(/\?/g, '.')}$`, 'i');
+        return !regex.test(dockerFile);
+    });
+}
+/**
+ * Assemble the plain buildspec object that the construct passes to
+ * `BuildSpec.fromObject`. Pure function — easy to unit test.
+ */
+function buildBuildSpec(opts) {
+    const { imageTag, dockerFile, buildArgs, dockerLoginSecretArn, installCommands, preBuildCommands, cacheDisabled, platform, } = opts;
+    const buildArgsString = buildArgs
+        ? Object.entries(buildArgs)
+            .map(([k, v]) => `--build-arg ${k}=${v}`)
+            .join(' ')
+        : '';
+    const dockerFileFlag = dockerFile ? `-f $CODEBUILD_SRC_DIR/${dockerFile}` : '';
+    const dockerLoginCommands = dockerLoginSecretArn
+        ? [
+            'echo "Retrieving Docker credentials..."',
+            'apt-get update -y && apt-get install -y jq',
+            `DOCKER_USERNAME=$(aws secretsmanager get-secret-value --secret-id ${dockerLoginSecretArn} --query SecretString --output text | jq -r .username)`,
+            `DOCKER_PASSWORD=$(aws secretsmanager get-secret-value --secret-id ${dockerLoginSecretArn} --query SecretString --output text | jq -r .password)`,
+            'echo "Logging in to Docker Hub..."',
+            'echo $DOCKER_PASSWORD | docker login --username $DOCKER_USERNAME --password-stdin',
+        ]
+        : ['echo "No Docker credentials. Skipping Docker Hub login."'];
+    const buildxInstallCommands = cacheDisabled
+        ? []
+        : [
+            'echo "Setting up Docker buildx for ECR layer cache..."',
+            'docker buildx create --driver docker-container --name ecr-cache-builder --use 2>/dev/null || docker buildx use ecr-cache-builder',
+        ];
+    const platformFlag = `--platform ${platform}`;
+    // --provenance=false --sbom=false: Docker Buildx v0.10+ adds attestations by default,
+    // producing OCI image indexes that AWS Lambda does not support.
+    const buildCommand = cacheDisabled
+        ? `docker build ${platformFlag} ${dockerFileFlag} ${buildArgsString} -t $ECR_REPO_URI:${imageTag} $CODEBUILD_SRC_DIR`
+        : `docker buildx build --push ${platformFlag} --provenance=false --sbom=false --cache-from type=registry,ref=$ECR_REPO_URI:cache --cache-to type=registry,ref=$ECR_REPO_URI:cache,mode=max,image-manifest=true ${dockerFileFlag} ${buildArgsString} -t $ECR_REPO_URI:${imageTag} $CODEBUILD_SRC_DIR`;
+    return {
+        version: '0.2',
+        phases: {
+            install: {
+                commands: [
+                    'echo "Beginning install phase..."',
+                    ...(installCommands ?? []),
+                    ...buildxInstallCommands,
+                ],
+            },
+            pre_build: {
+                commands: [
+                    ...(preBuildCommands ?? []),
+                    ...dockerLoginCommands,
+                    'echo "Retrieving AWS Account ID..."',
+                    'export ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)',
+                    'echo "Logging into Amazon ECR..."',
+                    'aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com',
+                ],
+            },
+            build: {
+                commands: [
+                    `echo "Building Docker image with tag ${imageTag}..."`,
+                    buildCommand,
+                ],
+            },
+            ...(cacheDisabled && {
+                post_build: {
+                    commands: [
+                        `echo "Pushing Docker image with tag ${imageTag}..."`,
+                        `docker push $ECR_REPO_URI:${imageTag}`,
+                    ],
+                },
+            }),
+        },
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVpbGQtc3BlYy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9idWlsZC1zcGVjLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBU0EsMENBd0JDO0FBaUJELHdDQWtGQztBQXBJRCx5QkFBeUI7QUFDekIsNkJBQTZCO0FBRTdCOzs7OztHQUtHO0FBQ0gsU0FBZ0IsZUFBZSxDQUM3QixVQUFrQixFQUNsQixVQUFrQixFQUNsQixPQUE2QjtJQUU3QixJQUFJLFNBQVMsR0FBRyxPQUFPLENBQUM7SUFDeEIsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ2YsTUFBTSxnQkFBZ0IsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxlQUFlLENBQUMsQ0FBQztRQUNoRSxJQUFJLEVBQUUsQ0FBQyxVQUFVLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxDQUFDO1lBQ3BDLE1BQU0sV0FBVyxHQUFHLEVBQUUsQ0FBQyxZQUFZLENBQUMsZ0JBQWdCLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDOUQsU0FBUyxHQUFHLFdBQVc7aUJBQ3BCLEtBQUssQ0FBQyxJQUFJLENBQUM7aUJBQ1gsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7aUJBQzFCLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDaEUsQ0FBQztJQUNILENBQUM7SUFFRCxJQUFJLENBQUMsU0FBUztRQUFFLE9BQU8sU0FBUyxDQUFDO0lBRWpDLE9BQU8sU0FBUyxDQUFDLE1BQU0sQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFO1FBQ2xDLE1BQU0sT0FBTyxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsbUJBQW1CLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDN0QsTUFBTSxLQUFLLEdBQUcsSUFBSSxNQUFNLENBQUMsSUFBSSxPQUFPLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxHQUFHLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDdkYsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDakMsQ0FBQyxDQUFDLENBQUM7QUFDTCxDQUFDO0FBYUQ7OztHQUdHO0FBQ0gsU0FBZ0IsY0FBYyxDQUFDLElBQXNCO0lBQ25ELE1BQU0sRUFDSixRQUFRLEVBQ1IsVUFBVSxFQUNWLFNBQVMsRUFDVCxvQkFBb0IsRUFDcEIsZUFBZSxFQUNmLGdCQUFnQixFQUNoQixhQUFhLEVBQ2IsUUFBUSxHQUNULEdBQUcsSUFBSSxDQUFDO0lBRVQsTUFBTSxlQUFlLEdBQUcsU0FBUztRQUMvQixDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUM7YUFDeEIsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO2FBQ3hDLElBQUksQ0FBQyxHQUFHLENBQUM7UUFDWixDQUFDLENBQUMsRUFBRSxDQUFDO0lBRVAsTUFBTSxjQUFjLEdBQUcsVUFBVSxDQUFDLENBQUMsQ0FBQyx5QkFBeUIsVUFBVSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUUvRSxNQUFNLG1CQUFtQixHQUFHLG9CQUFvQjtRQUM5QyxDQUFDLENBQUM7WUFDQSx5Q0FBeUM7WUFDekMsNENBQTRDO1lBQzVDLHFFQUFxRSxvQkFBb0Isd0RBQXdEO1lBQ2pKLHFFQUFxRSxvQkFBb0Isd0RBQXdEO1lBQ2pKLG9DQUFvQztZQUNwQyxtRkFBbUY7U0FDcEY7UUFDRCxDQUFDLENBQUMsQ0FBQywwREFBMEQsQ0FBQyxDQUFDO0lBRWpFLE1BQU0scUJBQXFCLEdBQUcsYUFBYTtRQUN6QyxDQUFDLENBQUMsRUFBRTtRQUNKLENBQUMsQ0FBQztZQUNBLHdEQUF3RDtZQUN4RCxrSUFBa0k7U0FDbkksQ0FBQztJQUVKLE1BQU0sWUFBWSxHQUFHLGNBQWMsUUFBUSxFQUFFLENBQUM7SUFFOUMsc0ZBQXNGO0lBQ3RGLGdFQUFnRTtJQUNoRSxNQUFNLFlBQVksR0FBRyxhQUFhO1FBQ2hDLENBQUMsQ0FBQyxnQkFBZ0IsWUFBWSxJQUFJLGNBQWMsSUFBSSxlQUFlLHFCQUFxQixRQUFRLHFCQUFxQjtRQUNySCxDQUFDLENBQUMsOEJBQThCLFlBQVkscUtBQXFLLGNBQWMsSUFBSSxlQUFlLHFCQUFxQixRQUFRLHFCQUFxQixDQUFDO0lBRXZTLE9BQU87UUFDTCxPQUFPLEVBQUUsS0FBSztRQUNkLE1BQU0sRUFBRTtZQUNOLE9BQU8sRUFBRTtnQkFDUCxRQUFRLEVBQUU7b0JBQ1IsbUNBQW1DO29CQUNuQyxHQUFHLENBQUMsZUFBZSxJQUFJLEVBQUUsQ0FBQztvQkFDMUIsR0FBRyxxQkFBcUI7aUJBQ3pCO2FBQ0Y7WUFDRCxTQUFTLEVBQUU7Z0JBQ1QsUUFBUSxFQUFFO29CQUNSLEdBQUcsQ0FBQyxnQkFBZ0IsSUFBSSxFQUFFLENBQUM7b0JBQzNCLEdBQUcsbUJBQW1CO29CQUN0QixxQ0FBcUM7b0JBQ3JDLGdGQUFnRjtvQkFDaEYsbUNBQW1DO29CQUNuQyw4SkFBOEo7aUJBQy9KO2FBQ0Y7WUFDRCxLQUFLLEVBQUU7Z0JBQ0wsUUFBUSxFQUFFO29CQUNSLHdDQUF3QyxRQUFRLE1BQU07b0JBQ3RELFlBQVk7aUJBQ2I7YUFDRjtZQUNELEdBQUcsQ0FBQyxhQUFhLElBQUk7Z0JBQ25CLFVBQVUsRUFBRTtvQkFDVixRQUFRLEVBQUU7d0JBQ1IsdUNBQXVDLFFBQVEsTUFBTTt3QkFDckQsNkJBQTZCLFFBQVEsRUFBRTtxQkFDeEM7aUJBQ0Y7YUFDRixDQUFDO1NBQ0g7S0FDRixDQUFDO0FBQ0osQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCAqIGFzIGZzIGZyb20gJ2ZzJztcbmltcG9ydCAqIGFzIHBhdGggZnJvbSAncGF0aCc7XG5cbi8qKlxuICogUGFyc2UgYSAuZG9ja2VyaWdub3JlIGZpbGUgYXQgYHNvdXJjZVBhdGhgIChpZiBwcmVzZW50KSBhbmQgY29tYmluZSBpdCB3aXRoXG4gKiBhIHVzZXItc3VwcGxpZWQgZXhjbHVkZSBsaXN0LiBUaGUgRG9ja2VyZmlsZSBpdHNlbGYgaXMgbmV2ZXIgZXhjbHVkZWQg4oCUXG4gKiBgLmRvY2tlcmlnbm9yZWAgcGF0dGVybnMgbWF0Y2hpbmcgYGRvY2tlckZpbGVgIGFyZSBmaWx0ZXJlZCBvdXQgc28gdGhlXG4gKiBTMyBhc3NldCBhbHdheXMgY29udGFpbnMgdGhlIERvY2tlcmZpbGUuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXNvbHZlRXhjbHVkZXMoXG4gIHNvdXJjZVBhdGg6IHN0cmluZyxcbiAgZG9ja2VyRmlsZTogc3RyaW5nLFxuICBleGNsdWRlOiBzdHJpbmdbXSB8IHVuZGVmaW5lZCxcbik6IHN0cmluZ1tdIHwgdW5kZWZpbmVkIHtcbiAgbGV0IGVmZmVjdGl2ZSA9IGV4Y2x1ZGU7XG4gIGlmICghZWZmZWN0aXZlKSB7XG4gICAgY29uc3QgZG9ja2VyaWdub3JlUGF0aCA9IHBhdGguam9pbihzb3VyY2VQYXRoLCAnLmRvY2tlcmlnbm9yZScpO1xuICAgIGlmIChmcy5leGlzdHNTeW5jKGRvY2tlcmlnbm9yZVBhdGgpKSB7XG4gICAgICBjb25zdCBmaWxlQ29udGVudCA9IGZzLnJlYWRGaWxlU3luYyhkb2NrZXJpZ25vcmVQYXRoLCAndXRmOCcpO1xuICAgICAgZWZmZWN0aXZlID0gZmlsZUNvbnRlbnRcbiAgICAgICAgLnNwbGl0KCdcXG4nKVxuICAgICAgICAubWFwKChsaW5lKSA9PiBsaW5lLnRyaW0oKSlcbiAgICAgICAgLmZpbHRlcigobGluZSkgPT4gbGluZS5sZW5ndGggPiAwICYmICFsaW5lLnN0YXJ0c1dpdGgoJyMnKSk7XG4gICAgfVxuICB9XG5cbiAgaWYgKCFlZmZlY3RpdmUpIHJldHVybiB1bmRlZmluZWQ7XG5cbiAgcmV0dXJuIGVmZmVjdGl2ZS5maWx0ZXIoKHBhdHRlcm4pID0+IHtcbiAgICBjb25zdCBlc2NhcGVkID0gcGF0dGVybi5yZXBsYWNlKC9bLiteJHt9KCl8W1xcXVxcXFxdL2csICdcXFxcJCYnKTtcbiAgICBjb25zdCByZWdleCA9IG5ldyBSZWdFeHAoYF4ke2VzY2FwZWQucmVwbGFjZSgvXFwqL2csICcuKicpLnJlcGxhY2UoL1xcPy9nLCAnLicpfSRgLCAnaScpO1xuICAgIHJldHVybiAhcmVnZXgudGVzdChkb2NrZXJGaWxlKTtcbiAgfSk7XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgQnVpbGRTcGVjT3B0aW9ucyB7XG4gIHJlYWRvbmx5IGltYWdlVGFnOiBzdHJpbmc7XG4gIHJlYWRvbmx5IGRvY2tlckZpbGU/OiBzdHJpbmc7XG4gIHJlYWRvbmx5IGJ1aWxkQXJncz86IHsgW2tleTogc3RyaW5nXTogc3RyaW5nIH07XG4gIHJlYWRvbmx5IGRvY2tlckxvZ2luU2VjcmV0QXJuPzogc3RyaW5nO1xuICByZWFkb25seSBpbnN0YWxsQ29tbWFuZHM/OiBzdHJpbmdbXTtcbiAgcmVhZG9ubHkgcHJlQnVpbGRDb21tYW5kcz86IHN0cmluZ1tdO1xuICByZWFkb25seSBjYWNoZURpc2FibGVkOiBib29sZWFuO1xuICByZWFkb25seSBwbGF0Zm9ybTogJ2xpbnV4L2FtZDY0JyB8ICdsaW51eC9hcm02NCc7XG59XG5cbi8qKlxuICogQXNzZW1ibGUgdGhlIHBsYWluIGJ1aWxkc3BlYyBvYmplY3QgdGhhdCB0aGUgY29uc3RydWN0IHBhc3NlcyB0b1xuICogYEJ1aWxkU3BlYy5mcm9tT2JqZWN0YC4gUHVyZSBmdW5jdGlvbiDigJQgZWFzeSB0byB1bml0IHRlc3QuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBidWlsZEJ1aWxkU3BlYyhvcHRzOiBCdWlsZFNwZWNPcHRpb25zKTogUmVjb3JkPHN0cmluZywgdW5rbm93bj4ge1xuICBjb25zdCB7XG4gICAgaW1hZ2VUYWcsXG4gICAgZG9ja2VyRmlsZSxcbiAgICBidWlsZEFyZ3MsXG4gICAgZG9ja2VyTG9naW5TZWNyZXRBcm4sXG4gICAgaW5zdGFsbENvbW1hbmRzLFxuICAgIHByZUJ1aWxkQ29tbWFuZHMsXG4gICAgY2FjaGVEaXNhYmxlZCxcbiAgICBwbGF0Zm9ybSxcbiAgfSA9IG9wdHM7XG5cbiAgY29uc3QgYnVpbGRBcmdzU3RyaW5nID0gYnVpbGRBcmdzXG4gICAgPyBPYmplY3QuZW50cmllcyhidWlsZEFyZ3MpXG4gICAgICAubWFwKChbaywgdl0pID0+IGAtLWJ1aWxkLWFyZyAke2t9PSR7dn1gKVxuICAgICAgLmpvaW4oJyAnKVxuICAgIDogJyc7XG5cbiAgY29uc3QgZG9ja2VyRmlsZUZsYWcgPSBkb2NrZXJGaWxlID8gYC1mICRDT0RFQlVJTERfU1JDX0RJUi8ke2RvY2tlckZpbGV9YCA6ICcnO1xuXG4gIGNvbnN0IGRvY2tlckxvZ2luQ29tbWFuZHMgPSBkb2NrZXJMb2dpblNlY3JldEFyblxuICAgID8gW1xuICAgICAgJ2VjaG8gXCJSZXRyaWV2aW5nIERvY2tlciBjcmVkZW50aWFscy4uLlwiJyxcbiAgICAgICdhcHQtZ2V0IHVwZGF0ZSAteSAmJiBhcHQtZ2V0IGluc3RhbGwgLXkganEnLFxuICAgICAgYERPQ0tFUl9VU0VSTkFNRT0kKGF3cyBzZWNyZXRzbWFuYWdlciBnZXQtc2VjcmV0LXZhbHVlIC0tc2VjcmV0LWlkICR7ZG9ja2VyTG9naW5TZWNyZXRBcm59IC0tcXVlcnkgU2VjcmV0U3RyaW5nIC0tb3V0cHV0IHRleHQgfCBqcSAtciAudXNlcm5hbWUpYCxcbiAgICAgIGBET0NLRVJfUEFTU1dPUkQ9JChhd3Mgc2VjcmV0c21hbmFnZXIgZ2V0LXNlY3JldC12YWx1ZSAtLXNlY3JldC1pZCAke2RvY2tlckxvZ2luU2VjcmV0QXJufSAtLXF1ZXJ5IFNlY3JldFN0cmluZyAtLW91dHB1dCB0ZXh0IHwganEgLXIgLnBhc3N3b3JkKWAsXG4gICAgICAnZWNobyBcIkxvZ2dpbmcgaW4gdG8gRG9ja2VyIEh1Yi4uLlwiJyxcbiAgICAgICdlY2hvICRET0NLRVJfUEFTU1dPUkQgfCBkb2NrZXIgbG9naW4gLS11c2VybmFtZSAkRE9DS0VSX1VTRVJOQU1FIC0tcGFzc3dvcmQtc3RkaW4nLFxuICAgIF1cbiAgICA6IFsnZWNobyBcIk5vIERvY2tlciBjcmVkZW50aWFscy4gU2tpcHBpbmcgRG9ja2VyIEh1YiBsb2dpbi5cIiddO1xuXG4gIGNvbnN0IGJ1aWxkeEluc3RhbGxDb21tYW5kcyA9IGNhY2hlRGlzYWJsZWRcbiAgICA/IFtdXG4gICAgOiBbXG4gICAgICAnZWNobyBcIlNldHRpbmcgdXAgRG9ja2VyIGJ1aWxkeCBmb3IgRUNSIGxheWVyIGNhY2hlLi4uXCInLFxuICAgICAgJ2RvY2tlciBidWlsZHggY3JlYXRlIC0tZHJpdmVyIGRvY2tlci1jb250YWluZXIgLS1uYW1lIGVjci1jYWNoZS1idWlsZGVyIC0tdXNlIDI+L2Rldi9udWxsIHx8IGRvY2tlciBidWlsZHggdXNlIGVjci1jYWNoZS1idWlsZGVyJyxcbiAgICBdO1xuXG4gIGNvbnN0IHBsYXRmb3JtRmxhZyA9IGAtLXBsYXRmb3JtICR7cGxhdGZvcm19YDtcblxuICAvLyAtLXByb3ZlbmFuY2U9ZmFsc2UgLS1zYm9tPWZhbHNlOiBEb2NrZXIgQnVpbGR4IHYwLjEwKyBhZGRzIGF0dGVzdGF0aW9ucyBieSBkZWZhdWx0LFxuICAvLyBwcm9kdWNpbmcgT0NJIGltYWdlIGluZGV4ZXMgdGhhdCBBV1MgTGFtYmRhIGRvZXMgbm90IHN1cHBvcnQuXG4gIGNvbnN0IGJ1aWxkQ29tbWFuZCA9IGNhY2hlRGlzYWJsZWRcbiAgICA/IGBkb2NrZXIgYnVpbGQgJHtwbGF0Zm9ybUZsYWd9ICR7ZG9ja2VyRmlsZUZsYWd9ICR7YnVpbGRBcmdzU3RyaW5nfSAtdCAkRUNSX1JFUE9fVVJJOiR7aW1hZ2VUYWd9ICRDT0RFQlVJTERfU1JDX0RJUmBcbiAgICA6IGBkb2NrZXIgYnVpbGR4IGJ1aWxkIC0tcHVzaCAke3BsYXRmb3JtRmxhZ30gLS1wcm92ZW5hbmNlPWZhbHNlIC0tc2JvbT1mYWxzZSAtLWNhY2hlLWZyb20gdHlwZT1yZWdpc3RyeSxyZWY9JEVDUl9SRVBPX1VSSTpjYWNoZSAtLWNhY2hlLXRvIHR5cGU9cmVnaXN0cnkscmVmPSRFQ1JfUkVQT19VUkk6Y2FjaGUsbW9kZT1tYXgsaW1hZ2UtbWFuaWZlc3Q9dHJ1ZSAke2RvY2tlckZpbGVGbGFnfSAke2J1aWxkQXJnc1N0cmluZ30gLXQgJEVDUl9SRVBPX1VSSToke2ltYWdlVGFnfSAkQ09ERUJVSUxEX1NSQ19ESVJgO1xuXG4gIHJldHVybiB7XG4gICAgdmVyc2lvbjogJzAuMicsXG4gICAgcGhhc2VzOiB7XG4gICAgICBpbnN0YWxsOiB7XG4gICAgICAgIGNvbW1hbmRzOiBbXG4gICAgICAgICAgJ2VjaG8gXCJCZWdpbm5pbmcgaW5zdGFsbCBwaGFzZS4uLlwiJyxcbiAgICAgICAgICAuLi4oaW5zdGFsbENvbW1hbmRzID8/IFtdKSxcbiAgICAgICAgICAuLi5idWlsZHhJbnN0YWxsQ29tbWFuZHMsXG4gICAgICAgIF0sXG4gICAgICB9LFxuICAgICAgcHJlX2J1aWxkOiB7XG4gICAgICAgIGNvbW1hbmRzOiBbXG4gICAgICAgICAgLi4uKHByZUJ1aWxkQ29tbWFuZHMgPz8gW10pLFxuICAgICAgICAgIC4uLmRvY2tlckxvZ2luQ29tbWFuZHMsXG4gICAgICAgICAgJ2VjaG8gXCJSZXRyaWV2aW5nIEFXUyBBY2NvdW50IElELi4uXCInLFxuICAgICAgICAgICdleHBvcnQgQUNDT1VOVF9JRD0kKGF3cyBzdHMgZ2V0LWNhbGxlci1pZGVudGl0eSAtLXF1ZXJ5IEFjY291bnQgLS1vdXRwdXQgdGV4dCknLFxuICAgICAgICAgICdlY2hvIFwiTG9nZ2luZyBpbnRvIEFtYXpvbiBFQ1IuLi5cIicsXG4gICAgICAgICAgJ2F3cyBlY3IgZ2V0LWxvZ2luLXBhc3N3b3JkIC0tcmVnaW9uICRBV1NfREVGQVVMVF9SRUdJT04gfCBkb2NrZXIgbG9naW4gLS11c2VybmFtZSBBV1MgLS1wYXNzd29yZC1zdGRpbiAkQUNDT1VOVF9JRC5ka3IuZWNyLiRBV1NfREVGQVVMVF9SRUdJT04uYW1hem9uYXdzLmNvbScsXG4gICAgICAgIF0sXG4gICAgICB9LFxuICAgICAgYnVpbGQ6IHtcbiAgICAgICAgY29tbWFuZHM6IFtcbiAgICAgICAgICBgZWNobyBcIkJ1aWxkaW5nIERvY2tlciBpbWFnZSB3aXRoIHRhZyAke2ltYWdlVGFnfS4uLlwiYCxcbiAgICAgICAgICBidWlsZENvbW1hbmQsXG4gICAgICAgIF0sXG4gICAgICB9LFxuICAgICAgLi4uKGNhY2hlRGlzYWJsZWQgJiYge1xuICAgICAgICBwb3N0X2J1aWxkOiB7XG4gICAgICAgICAgY29tbWFuZHM6IFtcbiAgICAgICAgICAgIGBlY2hvIFwiUHVzaGluZyBEb2NrZXIgaW1hZ2Ugd2l0aCB0YWcgJHtpbWFnZVRhZ30uLi5cImAsXG4gICAgICAgICAgICBgZG9ja2VyIHB1c2ggJEVDUl9SRVBPX1VSSToke2ltYWdlVGFnfWAsXG4gICAgICAgICAgXSxcbiAgICAgICAgfSxcbiAgICAgIH0pLFxuICAgIH0sXG4gIH07XG59XG4iXX0=

package/lib/builder.d.ts

@@ -0,0 +1,206 @@
+import { IVpc, ISecurityGroup, SubnetSelection } from 'aws-cdk-lib/aws-ec2';
+import { ContainerImage } from 'aws-cdk-lib/aws-ecs';
+import { DockerImageCode } from 'aws-cdk-lib/aws-lambda';
+import { ILogGroup } from 'aws-cdk-lib/aws-logs';
+import { Construct } from 'constructs';
+import { TokenInjectableDockerBuilderProvider } from './provider';
+/**
+ * Properties for the `TokenInjectableDockerBuilder` construct.
+ */
+export interface TokenInjectableDockerBuilderProps {
+    /**
+     * The path to the directory containing the Dockerfile or source code.
+     */
+    readonly path: string;
+    /**
+     * Build arguments to pass to the Docker build process.
+     * These are transformed into `--build-arg KEY=VALUE` flags.
+     * @example
+     * {
+     *   TOKEN: 'my-secret-token',
+     *   ENV: 'production'
+     * }
+     */
+    readonly buildArgs?: {
+        [key: string]: string;
+    };
+    /**
+     * The ARN of the AWS Secrets Manager secret containing Docker login credentials.
+     * The secret must store a JSON object: `{"username":"...","password":"..."}`.
+     * Must be in the same region as the stack.
+     *
+     * @default - No Docker Hub login.
+     */
+    readonly dockerLoginSecretArn?: string;
+    /**
+     * The VPC in which the CodeBuild project will be deployed.
+     *
+     * @default - CodeBuild uses public internet.
+     */
+    readonly vpc?: IVpc;
+    /**
+     * Security groups attached to the CodeBuild project.
+     *
+     * @default - No security groups attached.
+     */
+    readonly securityGroups?: ISecurityGroup[];
+    /**
+     * Subnet selection within the VPC.
+     *
+     * @default - All subnets in the VPC.
+     */
+    readonly subnetSelection?: SubnetSelection;
+    /**
+     * Custom commands to run during the install phase of CodeBuild.
+     *
+     * @default - No additional install commands.
+     */
+    readonly installCommands?: string[];
+    /**
+     * Custom commands to run during the pre_build phase of CodeBuild.
+     *
+     * @default - No additional pre-build commands.
+     */
+    readonly preBuildCommands?: string[];
+    /**
+     * Whether to enable KMS encryption for the ECR repository.
+     *
+     * @default false
+     */
+    readonly kmsEncryption?: boolean;
+    /**
+     * File paths in the Docker directory to exclude from the build asset.
+     * Falls back to `.dockerignore` if present.
+     *
+     * @default - No file path exclusions.
+     */
+    readonly exclude?: string[];
+    /**
+     * Name of the Dockerfile (passed as `-f`).
+     *
+     * @example 'Dockerfile.production'
+     * @default 'Dockerfile'
+     */
+    readonly file?: string;
+    /**
+     * When `true`, disables Docker layer caching.
+     *
+     * @default false
+     */
+    readonly cacheDisabled?: boolean;
+    /**
+     * CloudWatch log group for CodeBuild build logs.
+     *
+     * @default - CodeBuild default logging.
+     */
+    readonly buildLogGroup?: ILogGroup;
+    /**
+     * Target platform for the Docker image.
+     *
+     * @default 'linux/amd64'
+     */
+    readonly platform?: 'linux/amd64' | 'linux/arm64';
+    /**
+     * Shared provider for the custom resource Lambdas.
+     *
+     * Pass `TokenInjectableDockerBuilderProvider.getOrCreate(this, { queryInterval })`
+     * if you need a non-default query interval. Otherwise, the construct will
+     * call `getOrCreate(this)` itself and reuse the per-stack singleton.
+     *
+     * @default - Per-stack singleton provider, created on first use.
+     */
+    readonly provider?: TokenInjectableDockerBuilderProvider;
+    /**
+     * ECR pull-through cache repository prefixes to grant pull access to.
+     *
+     * @example ['docker-hub', 'ghcr']
+     * @default - No pull-through cache access.
+     */
+    readonly ecrPullThroughCachePrefixes?: string[];
+    /**
+     * When `true`, creates a CloudWatch log group outside of CloudFormation
+     * (`/docker-builder/<projectName>`) and directs CodeBuild output there.
+     * Survives stack rollbacks for debugging. 7-day retention.
+     *
+     * @default false
+     */
+    readonly retainBuildLogs?: boolean;
+    /**
+     * Additional AWS regions to replicate the built image to via ECR's
+     * native registry replication. The image is pushed to the primary
+     * region's ECR as usual; ECR asynchronously replicates the same
+     * `repositoryName` + `imageTag` to each region listed here.
+     *
+     * Consumers in another region (a Lambda in `us-west-2` referencing an
+     * image built in `us-east-1`) can use `dockerImageCodeFor(region)` or
+     * `containerImageFor(region)` to import the replicated image.
+     *
+     * The custom resource waits for replication to complete before
+     * signalling deploy-complete, so downstream stacks can safely deploy
+     * immediately after.
+     *
+     * **Caveats:**
+     * - Cross-region replication is not supported between AWS partitions.
+     * - Replicas do **not** inherit the primary's encryption (defaults to
+     *   AES-256), lifecycle policies, or repository policies.
+     * - Replicated repositories persist on stack deletion — AWS does not
+     *   auto-delete them. Clean up manually via the ECR console / CLI if
+     *   needed.
+     * - Both the builder stack and any consumer stack in another region
+     *   must set `crossRegionReferences: true` for the image tag to flow.
+     * - Stacks must have a concrete region (`env: { account, region }`),
+     *   not the env-agnostic default.
+     *
+     * @example ['us-west-2', 'eu-west-1']
+     * @default [] - no replication
+     */
+    readonly replicaRegions?: string[];
+}
+/**
+ * A CDK construct to build and push Docker images to an ECR repository using
+ * CodeBuild and Lambda custom resources, **then** retrieve the final image tag
+ * so that ECS/Lambda references use the exact built image.
+ */
+export declare class TokenInjectableDockerBuilder extends Construct {
+    /** The ECR repository that stores the resulting Docker image. */
+    private readonly ecrRepository;
+    /** ECS-compatible container image reference (primary region). */
+    readonly containerImage: ContainerImage;
+    /** Lambda-compatible DockerImageCode reference (primary region). */
+    readonly dockerImageCode: DockerImageCode;
+    /** The ECR repository name — preserved across replica regions. */
+    readonly repositoryName: string;
+    /** The resolved image tag (CFN token; available at deploy time). */
+    readonly imageTag: string;
+    private readonly primaryRegion;
+    private readonly accountId;
+    private readonly replicaRegions;
+    constructor(scope: Construct, id: string, props: TokenInjectableDockerBuilderProps);
+    /**
+     * Format the ECR repository URI for a given region. The region must
+     * be either the primary region or one of `replicaRegions`.
+     */
+    repositoryUriFor(region: string): string;
+    /**
+     * Import the replicated repository as an ECS-compatible
+     * `ContainerImage` in a consumer scope (typically a stack in `region`).
+     *
+     * The consumer's stack must have `crossRegionReferences: true` when
+     * `region` differs from the builder's region.
+     */
+    containerImageFor(scope: Construct, region: string): ContainerImage;
+    /**
+     * Import the replicated repository as a Lambda-compatible
+     * `DockerImageCode` in a consumer scope (typically a stack in `region`).
+     *
+     * The consumer's stack must have `crossRegionReferences: true` when
+     * `region` differs from the builder's region.
+     */
+    dockerImageCodeFor(scope: Construct, region: string): DockerImageCode;
+    private importRepoFor;
+    private assertRegionIsKnown;
+    private validateReplicaRegions;
+    private grantEcrAccess;
+    private grantPullThroughCacheAccess;
+    private grantBuildLogsAccess;
+}