@aifabrix/builder 2.56.0 → 2.58.0

package/lib/utils/config-registry-preference.js

@@ -0,0 +1,106 @@
+/**
+ * Installation-level default container registry (`registry` in the Builder config.yaml).
+ *
+ * @fileoverview Registry host validation plus get/set/clear preference helpers
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const yaml = require('js-yaml');
+const fs = require('../internal/fs-real-sync');
+const { getRuntimeConfigFile } = require('../core/config-runtime-paths');
+
+const REGISTRY_CONFIG_KEY = 'registry';
+const HOST_LABEL = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
+const REGISTRY_HOST_RE = new RegExp(`^${HOST_LABEL}(?:\\.${HOST_LABEL})*(?::\\d{1,5})?$`);
+
+/**
+ * Normalizes and validates a registry host (optionally with a port).
+ * Rejects schemes, paths, embedded credentials, query/fragment text and whitespace.
+ * @param {string} value - Raw registry value
+ * @returns {string} Lower-case host[:port]
+ * @throws {Error} When the value is empty or not a plain host
+ */
+function normalizeRegistryHost(value) {
+  const raw = typeof value === 'string' ? value.trim() : '';
+  const withoutSlash = raw.replace(/\/+$/, '');
+  if (!withoutSlash) {
+    throw new Error('Registry is required (for example myregistry.azurecr.io)');
+  }
+  if (/[\s@?#/\\]|:\/\//.test(withoutSlash)) {
+    throw new Error(`Invalid registry "${raw}": use a host name such as myregistry.azurecr.io (no scheme, path or credentials)`);
+  }
+  const host = withoutSlash.toLowerCase();
+  const port = host.includes(':') ? Number(host.split(':')[1]) : null;
+  if (!REGISTRY_HOST_RE.test(host) || (port !== null && (port < 1 || port > 65535))) {
+    throw new Error(`Invalid registry "${raw}": use a host name such as myregistry.azurecr.io`);
+  }
+  return host;
+}
+
+/**
+ * Reads the installation registry synchronously (used by the shared image resolver).
+ * An unreadable or invalid value is treated as unset so image resolution keeps working.
+ * @returns {string} Normalized host or '' when unset
+ */
+function readInstallationRegistrySync() {
+  try {
+    const file = getRuntimeConfigFile();
+    if (!fs.existsSync(file)) return '';
+    const cfg = yaml.load(fs.readFileSync(file, 'utf8')) || {};
+    const value = cfg[REGISTRY_CONFIG_KEY];
+    return typeof value === 'string' && value.trim() ? normalizeRegistryHost(value) : '';
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * @param {Function} getConfigFn - async () => config object
+ * @param {Function} saveConfigFn - async (config) => void
+ * @returns {{ getRegistry: Function, setRegistry: Function, clearRegistry: Function }}
+ */
+function createRegistryPreferenceFunctions(getConfigFn, saveConfigFn) {
+  return {
+    /**
+     * @returns {Promise<string|null>} Saved registry host or null
+     */
+    async getRegistry() {
+      const cfg = await getConfigFn();
+      const value = cfg[REGISTRY_CONFIG_KEY];
+      return typeof value === 'string' && value.trim() ? value.trim() : null;
+    },
+
+    /**
+     * @param {string} registry - Registry host
+     * @returns {Promise<string>} Normalized saved value
+     */
+    async setRegistry(registry) {
+      const host = normalizeRegistryHost(registry);
+      const cfg = await getConfigFn();
+      cfg[REGISTRY_CONFIG_KEY] = host;
+      await saveConfigFn(cfg);
+      return host;
+    },
+
+    /**
+     * Removes the saved registry (idempotent).
+     * @returns {Promise<void>}
+     */
+    async clearRegistry() {
+      const cfg = await getConfigFn();
+      if (!(REGISTRY_CONFIG_KEY in cfg)) return;
+      delete cfg[REGISTRY_CONFIG_KEY];
+      await saveConfigFn(cfg);
+    }
+  };
+}
+
+module.exports = {
+  REGISTRY_CONFIG_KEY,
+  normalizeRegistryHost,
+  readInstallationRegistrySync,
+  createRegistryPreferenceFunctions
+};

package/lib/utils/docker-build.js

@@ -252,13 +252,44 @@ async function executeBuild(imageName, dockerfilePath, contextPath, tag, options
       (options.cache === false || options.noCache === true || options['no-cache'] === true)
   );
   await executeDockerBuild(imageName, dockerfilePath, contextPath, tag, buildArgs, noCache);
+  await applyTagAliases(imageName, tag, resolveTagAliases(tag, options));
+}
 
-  // Also apply floating `latest` when building a version tag (matches dev-promote dual tags).
+/**
+ * Aliases for the built image: explicit `options.tagAliases` from the shared tag plan, else the
+ * legacy rule (a single non-floating `options.tag` also gets `latest`).
+ * @param {string} tag - Built tag
+ * @param {Object} [options] - Build options
+ * @returns {string[]}
+ */
+function resolveTagAliases(tag, options) {
+  if (options && Array.isArray(options.tagAliases)) {
+    return options.tagAliases.filter((alias) => alias !== tag);
+  }
   if (options && options.tag && options.tag !== 'latest' && options.tag !== 'main') {
-    const { execFileWithDockerEnv } = require('./docker-exec');
-    const { getDockerExecEnv } = require('./remote-docker-env');
-    const env = await getDockerExecEnv();
-    await execFileWithDockerEnv('docker', ['tag', `${imageName}:${tag}`, `${imageName}:latest`], { env });
+    return ['latest'];
+  }
+  return [];
+}
+
+/**
+ * Tag the built image with every alias (argument arrays; no shell interpolation).
+ * @param {string} imageName - Repository
+ * @param {string} tag - Built tag
+ * @param {string[]} aliases - Additional tags
+ * @returns {Promise<void>}
+ */
+async function applyTagAliases(imageName, tag, aliases) {
+  if (!aliases.length) return;
+  const { execFileWithDockerEnv } = require('./docker-exec');
+  const { getDockerExecEnv } = require('./remote-docker-env');
+  const env = await getDockerExecEnv();
+  for (const alias of aliases) {
+    try {
+      await execFileWithDockerEnv('docker', ['tag', `${imageName}:${tag}`, `${imageName}:${alias}`], { env });
+    } catch (error) {
+      throw new Error(`Failed to tag ${imageName}:${alias}: ${error.message}`);
+    }
   }
 }
 
@@ -286,26 +317,29 @@ async function executeDockerBuildWithTag(effectiveImageName, imageName, dockerfi
     return;
   }
 
-  try {
-    const { execFileWithDockerEnv } = require('./docker-exec');
-    const { getDockerExecEnv } = require('./remote-docker-env');
-    const env = await getDockerExecEnv();
-    await execFileWithDockerEnv(
-      'docker',
-      ['tag', `${effectiveImageName}:${tag}`, `${imageName}:${tag}`],
-      { env }
-    );
-    logger.log(formatSuccessLine(`Tagged image: ${imageName}:${tag}`));
-  } catch (err) {
-    logger.log(
-      formatWarningLine(`Could not create compatibility tag ${imageName}:${tag} - ${err.message}`)
-    );
+  const { execFileWithDockerEnv } = require('./docker-exec');
+  const { getDockerExecEnv } = require('./remote-docker-env');
+  const env = await getDockerExecEnv();
+  for (const compatTag of [tag, ...resolveTagAliases(tag, options)]) {
+    try {
+      await execFileWithDockerEnv(
+        'docker',
+        ['tag', `${effectiveImageName}:${compatTag}`, `${imageName}:${compatTag}`],
+        { env }
+      );
+      logger.log(formatSuccessLine(`Tagged image: ${imageName}:${compatTag}`));
+    } catch (err) {
+      logger.log(
+        formatWarningLine(`Could not create compatibility tag ${imageName}:${compatTag} - ${err.message}`)
+      );
+    }
   }
 }
 
 module.exports = {
   executeDockerBuild,
   executeBuild,
+  resolveTagAliases,
   executeDockerBuildWithTag,
   isDockerNotAvailableError
 };

package/lib/utils/env-map.js

@@ -12,6 +12,8 @@ const fs = require('fs');
 const yaml = require('js-yaml');
 const { loadEnvConfig, loadSchemaEnvConfig } = require('./env-config-loader');
 const config = require('../core/config');
+const { buildDevUsernameForFrontDoorHost } = require('./compose-traefik-ingress-base');
+const { resolveRemoteHostForFrontDoor } = require('./remote-host-for-front-door');
 
 /**
  * Load base environment variables from env-config.yaml
@@ -309,19 +311,34 @@ function applyPublicPortAdjustmentsForContext(result, context, devIdNum) {
 }
 
 /**
- * Set TLS_ENABLED / HTTP_ENABLED from ~/.aifabrix/config.yaml (tlsEnabled).
+ * Add config-derived interpolation values used by env.template.
  * @param {Object} result - Env map (mutated)
+ * @param {number} devIdNum - Normalized developer ID
  */
-async function applyTlsHttpManifestFlags(result) {
+async function applyRuntimeConfigVars(result, devIdNum) {
+  let userCfg = {};
   let tlsOn = false;
   try {
-    const userCfg = await config.getConfig();
+    userCfg = await config.getConfig();
     tlsOn = Boolean(userCfg && userCfg.tlsEnabled === true);
   } catch {
-    tlsOn = false;
+    userCfg = {};
   }
   result.TLS_ENABLED = tlsOn ? 'true' : 'false';
   result.HTTP_ENABLED = tlsOn ? 'false' : 'true';
+  const devUsername = buildDevUsernameForFrontDoorHost(devIdNum);
+  const remoteServerHost = resolveRemoteHostForFrontDoor({
+    remoteServer: userCfg && userCfg['remote-server']
+  });
+  const remoteHost = remoteServerHost ? remoteServerHost.split('.')[0] : '';
+  const devRootDomain = resolveRemoteHostForFrontDoor({
+    developerRootDomain: userCfg && userCfg['developer-root-domain']
+  });
+  if (devUsername || remoteHost) {
+    result.DEV_USERNAME = devUsername;
+    result.REMOTE_HOST = remoteHost;
+  }
+  if (devRootDomain) result.DEV_ROOT_DOMAIN = devRootDomain;
 }
 
 /**
@@ -333,6 +350,7 @@ async function applyTlsHttpManifestFlags(result) {
  * - Applies developer-id adjustment to port variables for local context
  * - Calculates *_PUBLIC_PORT for both local and docker context (basePort + developer-id * 100)
  * - Adds TLS_ENABLED and HTTP_ENABLED ("true" / "false"); HTTP_ENABLED = !TLS_ENABLED for manifest ${...} substitution
+ * - Adds DEV_USERNAME, REMOTE_HOST, and DEV_ROOT_DOMAIN from Builder configuration
  * @async
  * @function buildEnvVarMap
  * @param {'docker'|'local'} context - Environment context
@@ -358,7 +376,7 @@ async function buildEnvVarMap(context, osModule = null, developerId = null, opti
     applyLocalPortAdjustment(result, devIdNum);
   }
   applyPublicPortAdjustmentsForContext(result, context, devIdNum);
-  await applyTlsHttpManifestFlags(result);
+  await applyRuntimeConfigVars(result, devIdNum);
   return result;
 }
 
@@ -367,4 +385,3 @@ module.exports = {
   getDeveloperIdNumber,
   resolvePortInEnvValues
 };
-

package/lib/utils/image-tags.js

@@ -0,0 +1,88 @@
+/**
+ * Image tag lists for build and push: comma-separated tags, exact `{version}` expansion from the
+ * application's `app.version`, Docker tag validation, and order-preserving de-duplication.
+ * All validation happens before any Docker call.
+ *
+ * @fileoverview Shared image tag resolution
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { assertSafeTag } = require('./resolve-docker-image-ref');
+
+const DEFAULT_TAG = 'latest';
+const VERSION_PLACEHOLDER = '{version}';
+/** Tags that are floating aliases themselves (a single explicit one gets no extra `latest`). */
+const FLOATING_TAGS = Object.freeze(['latest', 'main']);
+
+/**
+ * @param {Object} [appConfig] - Application manifest (possibly wrapped in `variables`)
+ * @returns {string} Trimmed `app.version` or ''
+ */
+function readAppVersion(appConfig) {
+  const cfg = appConfig?.variables?.app ? appConfig.variables : appConfig;
+  const raw = cfg?.app?.version;
+  return raw === undefined || raw === null ? '' : String(raw).trim();
+}
+
+function expandTag(entry, version) {
+  if (entry === VERSION_PLACEHOLDER) {
+    if (!version) {
+      throw new Error('Tag {version} requires a non-empty app.version in the application manifest');
+    }
+    return version;
+  }
+  if (entry.includes('{') || entry.includes('}')) {
+    throw new Error(`Unsupported tag placeholder "${entry}"; only the exact token {version} is supported`);
+  }
+  return entry;
+}
+
+/**
+ * Resolves a tag option into a validated, de-duplicated list (first occurrence wins).
+ * @param {string|undefined} tagInput - `--tag` value (omitted means `latest`)
+ * @param {string} appVersion - Application `app.version`
+ * @returns {string[]}
+ * @throws {Error} On blank entries, unsupported placeholders, missing version or invalid tags
+ */
+function resolveImageTags(tagInput, appVersion) {
+  if (tagInput === undefined || tagInput === null || String(tagInput).trim() === '') {
+    return [DEFAULT_TAG];
+  }
+  const entries = String(tagInput).split(',').map((entry) => entry.trim());
+  if (entries.some((entry) => entry === '')) {
+    throw new Error(`Invalid tag list "${tagInput}": remove empty entries between commas`);
+  }
+  const resolved = [];
+  for (const entry of entries) {
+    const tag = assertSafeTag(expandTag(entry, String(appVersion || '').trim()));
+    if (!resolved.includes(tag)) resolved.push(tag);
+  }
+  return resolved;
+}
+
+/**
+ * Build plan: the first tag is the Docker build target; the rest are aliases of the same image.
+ * A single explicit non-floating tag keeps its compatibility `latest` alias.
+ * @param {string|undefined} tagInput - `--tag` value
+ * @param {string} appVersion - Application `app.version`
+ * @returns {{ primary: string, aliases: string[], tags: string[] }}
+ */
+function resolveBuildTagPlan(tagInput, appVersion) {
+  const tags = resolveImageTags(tagInput, appVersion);
+  const explicitSingle = tags.length === 1 && tagInput !== undefined && tagInput !== null && String(tagInput).trim() !== '';
+  if (explicitSingle && !FLOATING_TAGS.includes(tags[0])) {
+    tags.push(DEFAULT_TAG);
+  }
+  return { primary: tags[0], aliases: tags.slice(1), tags };
+}
+
+module.exports = {
+  DEFAULT_TAG,
+  VERSION_PLACEHOLDER,
+  readAppVersion,
+  resolveImageTags,
+  resolveBuildTagPlan
+};

package/lib/utils/promote-dev-docker-image.js

@@ -88,6 +88,12 @@ function resolvePromoteVersionTag(options = {}) {
  * @returns {string[]}
  */
 function resolvePromoteBaseTags(options = {}) {
+  if (options.tagPlan && Array.isArray(options.tagPlan.tags) && options.tagPlan.tags.length > 0) {
+    // Shared build tag plan (comma list / {version}); every tag becomes a base alias.
+    const tags = [...options.tagPlan.tags];
+    if (!tags.includes(PROMOTE_FLOATING_TAG)) tags.push(PROMOTE_FLOATING_TAG);
+    return tags;
+  }
   const versionTag = resolvePromoteVersionTag(options);
   const tags = [versionTag];
   if (versionTag !== PROMOTE_FLOATING_TAG) {

package/lib/utils/registry-credentials.js

@@ -0,0 +1,236 @@
+/**
+ * Host-scoped container registry credentials in the primary user secrets file.
+ *
+ * Keys are exactly `<registry>-username` and `<registry>-password` in the user's
+ * `secrets.local.yaml` (never the shared store). Values are encrypted through the existing
+ * local-secret writer and reach Docker only via `docker login --password-stdin`.
+ *
+ * @fileoverview Registry credential storage, lookup, removal, and per-command Docker login
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const yaml = require('js-yaml');
+const config = require('../core/config');
+const pathsUtil = require('./paths');
+const { loadExistingSecrets, mergeSecretsIntoFile } = require('./secrets-generator');
+const { saveLocalSecret } = require('./local-secrets');
+const { decryptSecret, isEncrypted } = require('./secrets-encryption');
+const { normalizeRegistryHost } = require('./config-registry-preference');
+
+/** Hosts already authenticated during this CLI process. */
+const authenticatedHosts = new Set();
+
+/**
+ * @param {string} registry - Registry host
+ * @returns {{ host: string, usernameKey: string, passwordKey: string }}
+ */
+function registryCredentialKeys(registry) {
+  const host = normalizeRegistryHost(registry);
+  return { host, usernameKey: `${host}-username`, passwordKey: `${host}-password` };
+}
+
+function hasValue(value) {
+  return typeof value === 'string' ? value.trim() !== '' : value !== undefined && value !== null;
+}
+
+function readRawPair(keys) {
+  const file = pathsUtil.getPrimaryUserSecretsLocalPath();
+  const raw = loadExistingSecrets(file);
+  return { file, username: raw[keys.usernameKey], password: raw[keys.passwordKey] };
+}
+
+function partialPairError(keys) {
+  return new Error(
+    `Registry credentials for ${keys.host} are incomplete: both ${keys.usernameKey} and ${keys.passwordKey} ` +
+    `must be set. Run "aifabrix dev set-registry ${keys.host} --username <username> --password-stdin" ` +
+    `or "aifabrix dev set-registry ${keys.host} --clear-credentials".`
+  );
+}
+
+/**
+ * Credential presence for a registry without decrypting anything.
+ * @param {string} registry - Registry host
+ * @returns {'complete'|'absent'|'partial'}
+ */
+function getRegistryCredentialStatus(registry) {
+  const keys = registryCredentialKeys(registry);
+  const pair = readRawPair(keys);
+  const count = [pair.username, pair.password].filter(hasValue).length;
+  if (count === 2) return 'complete';
+  return count === 0 ? 'absent' : 'partial';
+}
+
+async function decryptStoredValue(value, label) {
+  const text = String(value);
+  if (!isEncrypted(text)) return text;
+  const key = await config.getSecretsEncryptionKey();
+  if (!key) {
+    throw new Error(`Cannot decrypt the stored ${label}: the local secrets encryption key is not configured`);
+  }
+  return decryptSecret(text, key);
+}
+
+/**
+ * Loads a complete credential pair for the registry.
+ * @param {string} registry - Registry host
+ * @returns {Promise<{ username: string, password: string }|null>} null when no pair is stored
+ * @throws {Error} When only one of the two keys is stored
+ */
+async function loadRegistryCredentials(registry) {
+  const keys = registryCredentialKeys(registry);
+  const pair = readRawPair(keys);
+  const present = [pair.username, pair.password].filter(hasValue).length;
+  if (present === 0) return null;
+  if (present === 1) throw partialPairError(keys);
+  return {
+    username: await decryptStoredValue(pair.username, `${keys.host} username`),
+    password: await decryptStoredValue(pair.password, `${keys.host} password`)
+  };
+}
+
+function removeKeysFromFile(file, keyNames) {
+  if (!fs.existsSync(file)) return false;
+  const data = loadExistingSecrets(file);
+  const present = keyNames.filter((key) => Object.prototype.hasOwnProperty.call(data, key));
+  if (present.length === 0) return false;
+  for (const key of present) delete data[key];
+  const { assertWritableSecretsPathForTests } = require('./aifabrix-test-runtime-guard');
+  assertWritableSecretsPathForTests(file);
+  fs.writeFileSync(file, yaml.dump(data, { indent: 2, lineWidth: -1, noRefs: true, sortKeys: false }), { mode: 0o600 });
+  // `mode` applies only on creation; keep an existing file owner-only too.
+  fs.chmodSync(file, 0o600);
+  return true;
+}
+
+function restorePair(keys, snapshot) {
+  const restore = {};
+  const remove = [];
+  for (const [key, value] of [[keys.usernameKey, snapshot.username], [keys.passwordKey, snapshot.password]]) {
+    if (value === undefined) remove.push(key);
+    else restore[key] = value;
+  }
+  removeKeysFromFile(snapshot.file, remove);
+  mergeSecretsIntoFile(snapshot.file, restore);
+}
+
+/**
+ * Saves a complete pair. On any write failure the previous entries are restored.
+ * @param {string} registry - Registry host
+ * @param {string} username - Registry username
+ * @param {string} password - Registry password or token
+ * @returns {Promise<{ host: string, rollback: Function }>} rollback restores the prior entries
+ */
+async function saveRegistryCredentials(registry, username, password) {
+  const keys = registryCredentialKeys(registry);
+  if (!hasValue(username) || !hasValue(password)) {
+    throw new Error('Registry username and password must both be non-empty');
+  }
+  const snapshot = readRawPair(keys);
+  await config.ensureSecretsEncryptionKey();
+  try {
+    await saveLocalSecret(keys.usernameKey, String(username));
+    await saveLocalSecret(keys.passwordKey, String(password));
+  } catch (error) {
+    restorePair(keys, snapshot);
+    throw new Error(`Could not save registry credentials for ${keys.host}; previous values were restored (${error.message})`);
+  }
+  authenticatedHosts.delete(keys.host);
+  return { host: keys.host, rollback: () => restorePair(keys, snapshot) };
+}
+
+/**
+ * Removes both credential keys for the registry (idempotent).
+ * @param {string} registry - Registry host
+ * @returns {boolean} true when at least one key was removed
+ */
+function removeRegistryCredentials(registry) {
+  const keys = registryCredentialKeys(registry);
+  authenticatedHosts.delete(keys.host);
+  return removeKeysFromFile(pathsUtil.getPrimaryUserSecretsLocalPath(), [keys.usernameKey, keys.passwordKey]);
+}
+
+/**
+ * Authenticates Docker to the registry once per process: stored pair first, then the optional
+ * fallback (for example Azure CLI for ACR). The password is sent only on stdin.
+ * @param {string} registry - Registry host
+ * @param {Object} [options] - Options
+ * @param {Function} [options.fallback] - async (host) => void when no pair is stored
+ * @param {Function} [options.login] - async (host, username, password) => void (tests)
+ * @returns {Promise<'cached'|'credentials'|'fallback'|'none'>}
+ */
+async function ensureRegistryLogin(registry, options = {}) {
+  const host = normalizeRegistryHost(registry);
+  if (authenticatedHosts.has(host)) return 'cached';
+  const credentials = await loadRegistryCredentials(host);
+  if (credentials) {
+    const login = options.login || require('../deployment/push').authenticateExternalRegistry;
+    await login(host, credentials.username, credentials.password);
+    authenticatedHosts.add(host);
+    return 'credentials';
+  }
+  if (typeof options.fallback === 'function') {
+    await options.fallback(host);
+    authenticatedHosts.add(host);
+    return 'fallback';
+  }
+  return 'none';
+}
+
+/**
+ * Registry host of an image reference, or '' for Docker Hub style refs.
+ * @param {string} imageRef - Image reference (`host/repo:tag`, `repo:tag`, ...)
+ * @returns {string}
+ */
+function registryHostFromImageRef(imageRef) {
+  const ref = String(imageRef || '').trim();
+  const slash = ref.indexOf('/');
+  if (slash <= 0) return '';
+  const first = ref.slice(0, slash);
+  if (!(first.includes('.') || first.includes(':') || first === 'localhost')) return '';
+  try {
+    return normalizeRegistryHost(first);
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * Logs in once per distinct registry host of the given image refs when a stored pair exists.
+ * Hosts without stored credentials are pulled anonymously (or with the user's own Docker login).
+ * @param {string[]} imageRefs - Image references
+ * @returns {Promise<string[]>} Hosts logged in with stored credentials
+ */
+async function ensureLoginForImageRefs(imageRefs) {
+  const hosts = [...new Set((imageRefs || []).map(registryHostFromImageRef).filter(Boolean))];
+  const used = [];
+  for (const host of hosts) {
+    const outcome = await ensureRegistryLogin(host);
+    if (outcome === 'credentials') used.push(host);
+  }
+  return used;
+}
+
+/**
+ * Forgets cached logins (used before re-authentication and in tests).
+ * @param {string} [registry] - Host to forget; all when omitted
+ */
+function resetRegistryLoginCache(registry) {
+  if (registry) authenticatedHosts.delete(normalizeRegistryHost(registry));
+  else authenticatedHosts.clear();
+}
+
+module.exports = {
+  registryCredentialKeys,
+  getRegistryCredentialStatus,
+  loadRegistryCredentials,
+  saveRegistryCredentials,
+  removeRegistryCredentials,
+  ensureRegistryLogin,
+  ensureLoginForImageRefs,
+  registryHostFromImageRef,
+  resetRegistryLoginCache
+};