feat(aws-lambda): push a prebuilt image to ECR without Docker (#6063)

* feat(aws-lambda): push a prebuilt image to ECR without Docker

Adds pushImageToEcr and ensureEcrRepository to the SDK subpath. The push
reads a single-platform OCI image layout, verifies every blob against its
descriptor before any ECR call, uploads only the blobs ECR lacks through
the layer-upload API, and puts the manifest under a tag, returning the
digest-pinned image URI.

* fix(aws-lambda): keep the ECR client out of the SDK bundle

Like the other AWS SDK clients, @aws-sdk/client-ecr is a dependency the consumer
resolves. Bundled into the ESM SDK it hits a dynamic require of node:https and
the packed package fails to import.

* feat(aws-lambda): build the ECR client from a region like the other SDK calls

* build(aws-lambda): add only the ECR client to the lockfile

* fix(aws-lambda): adopt an existing ECR repository only when it carries the caller's tags

* chore(aws-lambda): raise the size budget for pushing an image to ECR

pushImageToEcr ships in dist (unminified chunk plus its .d.ts); no source maps, tests or release-only files are involved. Built dist, npm pack --dry-run, main versus main plus this branch: +2486 B packed, +8846 B unpacked. The merge-group run measured 73369 packed and 266805 unpacked, which are the new budgets (were 70874 and 258166).

Author: miguel-heygen

bun.lock

@@ -32,6 +32,7 @@ const sharedOpts = {
   format: "esm",
   minify: false,
   external: [
+    "@aws-sdk/client-ecr",
     "@aws-sdk/client-lambda",
     "@aws-sdk/client-s3",
     "@aws-sdk/client-sfn",

packages/aws-lambda/build.mjs

@@ -72,6 +72,7 @@
     "verify:zip-size": "tsx scripts/verify-zip-size.ts"
   },
   "dependencies": {
+    "@aws-sdk/client-ecr": "^3.1146.0",
     "@aws-sdk/client-lambda": "^3.1146.0",
     "@aws-sdk/client-s3": "^3.1146.0",
     "@aws-sdk/client-sfn": "^3.1146.0",

packages/aws-lambda/package.json

@@ -45,5 +45,12 @@ export {
   prebuiltVideoImage,
   type ReleaseAssetManifest,
 } from "./prebuiltHandler.js";
+export {
+  ensureEcrRepository,
+  type EnsureEcrRepositoryOptions,
+  type PushedImage,
+  pushImageToEcr,
+  type PushImageToEcrOptions,
+} from "./pushImageToEcr.js";
 export type { SerializableDistributedRenderConfig } from "../events.js";
 export type { DistributedFormat } from "../formatExtension.js";