@alchemy.run/docker 0.0.0-stage → 2.0.0-beta.84

package/lib/Network.js

@@ -0,0 +1,111 @@
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import { createInternalTags, hasAlchemyTags, stripInternalTags } from "alchemy/Tags";
+import * as Effect from "effect/Effect";
+import * as Equal from "effect/Equal";
+import { Docker, dockerEngineContextName, dockerPhysicalName } from "./Docker.js";
+/**
+ * A Docker network managed through the active Docker context.
+ *
+ * Existing same-name networks are treated as foreign unless the engine is
+ * explicitly allowed to adopt them with `--adopt` or `adopt(true)`.
+ *
+ *
+ * ### Creating Networks
+ * **Example:** Basic bridge network
+ * ```typescript
+ * const network = yield* Docker.Network("app-network", {
+ *   name: "app-network",
+ * });
+ * ```
+ *
+ * ### Adoption
+ * **Example:** Adopt a pre-existing network
+ * ```typescript
+ * const network = yield* Docker.Network("app-network", {
+ *   name: "shared-app-network",
+ * }).pipe(adopt(true));
+ * ```
+ *
+ * @resource
+ * @product Network
+ */
+export const Network = Resource("Docker.Network");
+export const NetworkProvider = () => Provider.effect(Network, Effect.gen(function* () {
+    const docker = yield* Docker;
+    return Network.Provider.of({
+        list: () => Effect.succeed([]),
+        read: Effect.fn(function* ({ id, instanceId, olds, output }) {
+            const context = dockerEngineContextName(olds?.context);
+            const name = yield* dockerPhysicalName(id, olds, instanceId);
+            const info = yield* docker.network
+                .inspect(name, context)
+                .pipe(Effect.catchReason("PlatformError", "NotFound", () => Effect.undefined));
+            if (!info)
+                return undefined;
+            const attrs = toNetworkAttributes(info);
+            if (output)
+                return attrs;
+            // Without prior state, only adopt a network that carries our branding;
+            // anything else is foreign and gated behind `--adopt`.
+            const owned = yield* hasAlchemyTags(id, info.Labels ?? undefined);
+            return owned ? attrs : Unowned(attrs);
+        }),
+        diff: Effect.fn(function* ({ id, output, instanceId, news, olds }) {
+            if (!isResolved(news) || !output)
+                return undefined;
+            if (dockerEngineContextName(olds?.context) !== dockerEngineContextName(news?.context)) {
+                return { action: "replace", deleteFirst: true };
+            }
+            const args = yield* makeNetworkArgs(id, news, instanceId);
+            // Auto-generated names are engine-owned: the deployed name stays
+            // authoritative even if the generator would name this id differently
+            // today. Only an explicit user-provided name can force a replace.
+            const desiredName = news?.name ?? output.name;
+            if (output.name !== desiredName ||
+                output.driver !== args.driver ||
+                output.enableIPv6 !== args.ipv6 ||
+                // Compare only user labels; internal `alchemy::*` branding lives on
+                // the observed network but must not drive replacement.
+                !Equal.equals(stripInternalTags(output.labels), args.label ?? {})) {
+                return { action: "replace", deleteFirst: true };
+            }
+        }),
+        reconcile: Effect.fn(function* ({ output, id, instanceId, news }) {
+            const context = dockerEngineContextName(news?.context);
+            if (output) {
+                const refreshed = yield* docker.network.inspect(output.id, context).pipe(Effect.map(toNetworkAttributes), Effect.catchReason("PlatformError", "NotFound", () => Effect.undefined));
+                if (refreshed)
+                    return refreshed;
+            }
+            const args = yield* makeNetworkArgs(id, news, instanceId);
+            const internalTags = yield* createInternalTags(id);
+            const { stdout: createdId } = yield* docker.network.create({
+                ...args,
+                label: { ...internalTags, ...args.label },
+                context,
+            });
+            return toNetworkAttributes(yield* docker.network.inspect(createdId, context));
+        }),
+        delete: Effect.fn(({ olds, output }) => docker.network
+            .remove(output.id, dockerEngineContextName(olds?.context))
+            .pipe(Effect.catchReason("PlatformError", "NotFound", () => Effect.void))),
+    });
+}));
+const makeNetworkArgs = (id, props, instanceId) => dockerPhysicalName(id, props, instanceId).pipe(Effect.map((name) => ({
+    name,
+    driver: props?.driver ?? "bridge",
+    ipv6: props?.enableIPv6 ?? false,
+    label: props?.labels ?? {},
+})));
+export const toNetworkAttributes = (info) => ({
+    id: info.Id,
+    name: info.Name,
+    driver: info.Driver,
+    enableIPv6: info.EnableIPv6,
+    labels: info.Labels ?? {},
+    createdAt: Date.parse(info.Created) || Date.now(),
+});
+//# sourceMappingURL=Network.js.map

package/lib/Network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Network.js","sourceRoot":"","sources":["../src/Network.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AA8ClF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAU,gBAAgB,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,EAAE,CAClC,QAAQ,CAAC,MAAM,CACb,OAAO,EACP,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;IAE7B,OAAO,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;YACzD,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO;iBAC/B,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;iBACtB,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACjF,IAAI,CAAC,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC5B,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,MAAM;gBAAE,OAAO,KAAK,CAAC;YACzB,uEAAuE;YACvE,uDAAuD;YACvD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE;YAC/D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YACnD,IAAI,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBACtF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;YAClD,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;YAC1D,iEAAiE;YACjE,qEAAqE;YACrE,kEAAkE;YAClE,MAAM,WAAW,GAAG,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;YAC9C,IACE,MAAM,CAAC,IAAI,KAAK,WAAW;gBAC3B,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;gBAC7B,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,IAAI;gBAC/B,oEAAoE;gBACpE,uDAAuD;gBACvD,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EACjE,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;YAClD,CAAC;QACH,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;YAC9D,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACvD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI,CACtE,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAC/B,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACxE,CAAC;gBACF,IAAI,SAAS;oBAAE,OAAO,SAAS,CAAC;YAClC,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;YAC1D,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;gBACzD,GAAG,IAAI;gBACP,KAAK,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;gBACzC,OAAO;aACR,CAAC,CAAC;YACH,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAChF,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CACrC,MAAM,CAAC,OAAO;aACX,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;aACzD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAC5E;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,eAAe,GAAG,CAAC,EAAU,EAAE,KAA+B,EAAE,UAAkB,EAAE,EAAE,CAC1F,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,IAAI,CAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAyD,EAAE,CAAC,CAAC;IAC3E,IAAI;IACJ,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,QAAQ;IACjC,IAAI,EAAE,KAAK,EAAE,UAAU,IAAI,KAAK;IAChC,KAAK,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE;CAC3B,CAAC,CAAC,CACJ,CAAC;AAEJ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAoB,EAAyB,EAAE,CAAC,CAAC;IACnF,EAAE,EAAE,IAAI,CAAC,EAAE;IACX,IAAI,EAAE,IAAI,CAAC,IAAI;IACf,MAAM,EAAE,IAAI,CAAC,MAAM;IACnB,UAAU,EAAE,IAAI,CAAC,UAAU;IAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;IACzB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;CAClD,CAAC,CAAC"}

package/lib/Providers.d.ts

@@ -0,0 +1,21 @@
+import * as Provider from "alchemy/Provider";
+import * as Layer from "effect/Layer";
+import { type DockerOptions } from "./Docker.ts";
+declare const Providers_base: Provider.ProviderCollection<Providers, "Docker">;
+export declare class Providers extends Providers_base {
+}
+export type ProviderRequirements = Layer.Services<ReturnType<typeof providers>>;
+/**
+ * Registers all Docker resource providers.
+ *
+ * Docker providers use the active Docker CLI context and are intentionally
+ * separate from `Cloudflare.Container`. Pass `bin` to run a Docker-compatible
+ * CLI such as Podman; the `DOCKER_BIN` environment variable overrides it.
+ *
+ * ```typescript
+ * providers: Docker.providers({ bin: "podman" }),
+ * ```
+ */
+export declare const providers: (options?: DockerOptions) => Layer.Layer<import("./Docker.ts").Docker | Providers, never, import("alchemy/AlchemyContext").AlchemyContext | import("effect/process/ChildProcessSpawner").ChildProcessSpawner | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("alchemy/Stack").Stack | import("alchemy/Stage").Stage>;
+export {};
+//# sourceMappingURL=Providers.d.ts.map

package/lib/Providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,OAAO,EAAE,KAAK,aAAa,EAAc,MAAM,aAAa,CAAC;;AAQ7D,qBAAa,SAAU,SAAQ,cAAkD;CAAG;AAEpF,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,aAAa,aAAa,2TAkB7C,CAAC"}

package/lib/Providers.js

@@ -0,0 +1,26 @@
+import * as Provider from "alchemy/Provider";
+import * as Layer from "effect/Layer";
+import { Container, ContainerProvider } from "./Container.js";
+import { Context, ContextProvider } from "./Context.js";
+import { dockerLive } from "./Docker.js";
+import { Image, ImageProvider } from "./Image.js";
+import { Network, NetworkProvider } from "./Network.js";
+import { RemoteImage, RemoteImageProvider } from "./RemoteImage.js";
+import { Service, ServiceProvider } from "./Service.js";
+import { Swarm, SwarmProvider } from "./Swarm.js";
+import { Volume, VolumeProvider } from "./Volume.js";
+export class Providers extends Provider.ProviderCollection()("Docker") {
+}
+/**
+ * Registers all Docker resource providers.
+ *
+ * Docker providers use the active Docker CLI context and are intentionally
+ * separate from `Cloudflare.Container`. Pass `bin` to run a Docker-compatible
+ * CLI such as Podman; the `DOCKER_BIN` environment variable overrides it.
+ *
+ * ```typescript
+ * providers: Docker.providers({ bin: "podman" }),
+ * ```
+ */
+export const providers = (options = {}) => Layer.effect(Providers, Provider.collection([Container, Image, Network, RemoteImage, Volume, Context, Service, Swarm])).pipe(Layer.provide(Layer.mergeAll(ContainerProvider(), ImageProvider(), NetworkProvider(), RemoteImageProvider(), VolumeProvider(), ContextProvider(), ServiceProvider(), SwarmProvider())), Layer.provideMerge(dockerLive(options)));
+//# sourceMappingURL=Providers.js.map

package/lib/Providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Providers.js","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAsB,UAAU,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,OAAO,SAAU,SAAQ,QAAQ,CAAC,kBAAkB,EAAa,CAAC,QAAQ,CAAC;CAAG;AAIpF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAO,GAAkB,EAAE,EAAE,EAAE,CACvD,KAAK,CAAC,MAAM,CACV,SAAS,EACT,QAAQ,CAAC,UAAU,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAC/F,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,QAAQ,CACZ,iBAAiB,EAAE,EACnB,aAAa,EAAE,EACf,eAAe,EAAE,EACjB,mBAAmB,EAAE,EACrB,cAAc,EAAE,EAChB,eAAe,EAAE,EACjB,eAAe,EAAE,EACjB,aAAa,EAAE,CAChB,CACF,EACD,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CACxC,CAAC"}

package/lib/Registry.d.ts

@@ -0,0 +1,47 @@
+import type * as Redacted from "effect/Redacted";
+export interface ImageRegistry {
+    /** Registry host, e.g. `ghcr.io`. */
+    server: string;
+    /** Registry username. */
+    username: string;
+    /** Registry password. Use `Redacted.make(...)` or `Config.Redacted(...)`. */
+    password: Redacted.Redacted<string>;
+}
+/** Strips the tag and digest from an image reference, leaving the repository. */
+export declare const repositoryFromImageRef: (imageRef: string) => string;
+/**
+ * Prefixes an image reference with the registry host unless the reference
+ * already carries a registry prefix (a dotted host, a host:port, or `localhost`).
+ */
+export declare const withRegistryHost: (imageRef: string, registry: {
+    server: string;
+}) => string;
+/** Extracts the `repository@sha256:...` digest from `docker push` output. */
+export declare const parseRepoDigest: (imageRef: string, output: string) => string | undefined;
+/**
+ * Picks the `repository@digest` that inspect reports for this image.
+ *
+ * A fallback when push output has no `digest:` line. Podman pushes report the
+ * published digest through `--digestfile` instead, because Podman can list a
+ * pulled image's source digest under the pushed name here.
+ */
+export declare const repoDigestFromInspect: (imageRef: string, repoDigests: ReadonlyArray<string> | null | undefined) => string | undefined;
+/**
+ * Digest from push output when the engine prints one, otherwise the matching
+ * `RepoDigests` entry. `registryRef` is the host-qualified name when it
+ * differs from the local reference that was pushed.
+ */
+export declare const publishedRepoDigest: (imageRef: string, output: {
+    stdout: string;
+    stderr: string;
+}, repoDigests: ReadonlyArray<string> | null | undefined, registryRef?: string) => string | undefined;
+/**
+ * Parses an image's RFC 3339 `Created` timestamp into epoch milliseconds.
+ *
+ * Docker only reports `Created` when the image config carries a creation time:
+ * API >= 1.44 omits it, older APIs backfill the year-1 zero value
+ * (`0001-01-01T00:00:00Z`), and 25.0.0–25.0.3 returned an empty string. In any
+ * of those cases there is no real build time, so we fall back to the wall clock.
+ */
+export declare const parseCreatedAt: (created: string | undefined) => number;
+//# sourceMappingURL=Registry.d.ts.map

package/lib/Registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Registry.d.ts","sourceRoot":"","sources":["../src/Registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAEjD,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CACrC;AAED,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,aAAc,MAAM,KAAG,MAOzD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,aAAc,MAAM,YAAY;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,KAAG,MAOjF,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,eAAe,aAAc,MAAM,UAAU,MAAM,KAAG,MAAM,GAAG,SAI3E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,aACtB,MAAM,eACH,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,KACpD,MAAM,GAAG,SAOX,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,aACpB,MAAM,UACR;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,eAC7B,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,gBACvC,MAAM,KACnB,MAAM,GAAG,SAOX,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,YAAa,MAAM,GAAG,SAAS,KAAG,MAG5D,CAAC"}

package/lib/Registry.js

@@ -0,0 +1,67 @@
+/** Strips the tag and digest from an image reference, leaving the repository. */
+export const repositoryFromImageRef = (imageRef) => {
+    const withoutDigest = imageRef.includes("@")
+        ? imageRef.slice(0, imageRef.indexOf("@"))
+        : imageRef;
+    const tagSeparator = withoutDigest.lastIndexOf(":");
+    const pathSeparator = withoutDigest.lastIndexOf("/");
+    return tagSeparator > pathSeparator ? withoutDigest.slice(0, tagSeparator) : withoutDigest;
+};
+/**
+ * Prefixes an image reference with the registry host unless the reference
+ * already carries a registry prefix (a dotted host, a host:port, or `localhost`).
+ */
+export const withRegistryHost = (imageRef, registry) => {
+    const registryHost = registry.server.replace(/\/$/, "");
+    const firstSegment = imageRef.split("/")[0];
+    const hasRegistryPrefix = imageRef.includes("/") &&
+        (firstSegment.includes(".") || firstSegment.includes(":") || firstSegment === "localhost");
+    return hasRegistryPrefix ? imageRef : `${registryHost}/${imageRef}`;
+};
+/** Extracts the `repository@sha256:...` digest from `docker push` output. */
+export const parseRepoDigest = (imageRef, output) => {
+    const match = /digest:\s+([a-z0-9]+:[a-f0-9]{64})/i.exec(output);
+    if (!match)
+        return undefined;
+    return `${repositoryFromImageRef(imageRef)}@${match[1]}`;
+};
+/**
+ * Picks the `repository@digest` that inspect reports for this image.
+ *
+ * A fallback when push output has no `digest:` line. Podman pushes report the
+ * published digest through `--digestfile` instead, because Podman can list a
+ * pulled image's source digest under the pushed name here.
+ */
+export const repoDigestFromInspect = (imageRef, repoDigests) => {
+    const repository = repositoryFromImageRef(imageRef);
+    for (const digest of repoDigests ?? []) {
+        const at = digest.lastIndexOf("@");
+        if (at > 0 && digest.slice(0, at) === repository)
+            return digest;
+    }
+    return undefined;
+};
+/**
+ * Digest from push output when the engine prints one, otherwise the matching
+ * `RepoDigests` entry. `registryRef` is the host-qualified name when it
+ * differs from the local reference that was pushed.
+ */
+export const publishedRepoDigest = (imageRef, output, repoDigests, registryRef) => {
+    const text = `${output.stdout}\n${output.stderr}`;
+    return (parseRepoDigest(imageRef, text) ??
+        (registryRef === undefined ? undefined : repoDigestFromInspect(registryRef, repoDigests)) ??
+        repoDigestFromInspect(imageRef, repoDigests));
+};
+/**
+ * Parses an image's RFC 3339 `Created` timestamp into epoch milliseconds.
+ *
+ * Docker only reports `Created` when the image config carries a creation time:
+ * API >= 1.44 omits it, older APIs backfill the year-1 zero value
+ * (`0001-01-01T00:00:00Z`), and 25.0.0–25.0.3 returned an empty string. In any
+ * of those cases there is no real build time, so we fall back to the wall clock.
+ */
+export const parseCreatedAt = (created) => {
+    const parsed = created ? Date.parse(created) : Number.NaN;
+    return Number.isNaN(parsed) || parsed <= 0 ? Date.now() : parsed;
+};
+//# sourceMappingURL=Registry.js.map

package/lib/Registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Registry.js","sourceRoot":"","sources":["../src/Registry.ts"],"names":[],"mappings":"AAWA,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,QAAgB,EAAU,EAAE;IACjE,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC1C,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC,CAAC,QAAQ,CAAC;IACb,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;AAC7F,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,QAA4B,EAAU,EAAE;IACzF,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,iBAAiB,GACrB,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QACtB,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,YAAY,KAAK,WAAW,CAAC,CAAC;IAC7F,OAAO,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,YAAY,IAAI,QAAQ,EAAE,CAAC;AACtE,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAAgB,EAAE,MAAc,EAAsB,EAAE;IACtF,MAAM,KAAK,GAAG,qCAAqC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,QAAgB,EAChB,WAAqD,EACjC,EAAE;IACtB,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACpD,KAAK,MAAM,MAAM,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,UAAU;YAAE,OAAO,MAAM,CAAC;IAClE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,QAAgB,EAChB,MAA0C,EAC1C,WAAqD,EACrD,WAAoB,EACA,EAAE;IACtB,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IAClD,OAAO,CACL,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC;QAC/B,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACzF,qBAAqB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAC7C,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAA2B,EAAU,EAAE;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAC1D,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACnE,CAAC,CAAC"}

package/lib/RegistryError.d.ts

@@ -0,0 +1,21 @@
+import type { PlatformError } from "effect/PlatformError";
+declare const DockerRegistryBlobUnknown_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "DockerRegistryBlobUnknown";
+} & Readonly<A>;
+export declare class DockerRegistryBlobUnknown extends DockerRegistryBlobUnknown_base<{
+    readonly cause: PlatformError;
+}> {
+    get message(): string;
+}
+declare const DockerRegistryUnavailable_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "DockerRegistryUnavailable";
+} & Readonly<A>;
+export declare class DockerRegistryUnavailable extends DockerRegistryUnavailable_base<{
+    readonly cause: PlatformError;
+}> {
+    get message(): string;
+}
+export type DockerImagePublicationError = PlatformError | DockerRegistryBlobUnknown | DockerRegistryUnavailable;
+export declare const classifyDockerRegistryError: (error: PlatformError) => DockerImagePublicationError;
+export {};
+//# sourceMappingURL=RegistryError.d.ts.map

package/lib/RegistryError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RegistryError.d.ts","sourceRoot":"","sources":["../src/RegistryError.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;;;;AAE1D,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;CAC/B,CAAC;IACA,IAAa,OAAO,WAEnB;CACF;;;;AAED,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;CAC/B,CAAC;IACA,IAAa,OAAO,WAEnB;CACF;AAED,MAAM,MAAM,2BAA2B,GACnC,aAAa,GACb,yBAAyB,GACzB,yBAAyB,CAAC;AAE9B,eAAO,MAAM,2BAA2B,UAAW,aAAa,KAAG,2BAuBlE,CAAC"}

package/lib/RegistryError.js

@@ -0,0 +1,28 @@
+import * as Data from "effect/Data";
+export class DockerRegistryBlobUnknown extends Data.TaggedError("DockerRegistryBlobUnknown") {
+    get message() {
+        return this.cause.message;
+    }
+}
+export class DockerRegistryUnavailable extends Data.TaggedError("DockerRegistryUnavailable") {
+    get message() {
+        return this.cause.message;
+    }
+}
+export const classifyDockerRegistryError = (error) => {
+    // Build logs can contain arbitrary Dockerfile output before the final error.
+    const message = error.reason.description
+        ?.split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0 &&
+        !line.startsWith("View build details: docker-desktop://dashboard/build/"))
+        .at(-1) ?? "";
+    if (/(?:^|:\s*)(?:unknown:\s*)?blob unknown to registry$/i.test(message)) {
+        return new DockerRegistryBlobUnknown({ cause: error });
+    }
+    if (/(?:unexpected (?:http )?status(?:[^\n]*:\s*|\s+)5\d\d(?:\s|$)|(?:^|:\s*)(?:500 internal server error|502 bad gateway|503 service unavailable|504 gateway timeout)$)/i.test(message)) {
+        return new DockerRegistryUnavailable({ cause: error });
+    }
+    return error;
+};
+//# sourceMappingURL=RegistryError.js.map

package/lib/RegistryError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RegistryError.js","sourceRoot":"","sources":["../src/RegistryError.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAGpC,MAAM,OAAO,yBAA0B,SAAQ,IAAI,CAAC,WAAW,CAAC,2BAA2B,CAEzF;IACA,IAAa,OAAO;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,IAAI,CAAC,WAAW,CAAC,2BAA2B,CAEzF;IACA,IAAa,OAAO;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5B,CAAC;CACF;AAOD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,KAAoB,EAA+B,EAAE;IAC/F,6EAA6E;IAC7E,MAAM,OAAO,GACX,KAAK,CAAC,MAAM,CAAC,WAAW;QACtB,EAAE,KAAK,CAAC,IAAI,CAAC;SACZ,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,MAAM,GAAG,CAAC;QACf,CAAC,IAAI,CAAC,UAAU,CAAC,uDAAuD,CAAC,CAC5E;SACA,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClB,IAAI,sDAAsD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,yBAAyB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,IACE,sKAAsK,CAAC,IAAI,CACzK,OAAO,CACR,EACD,CAAC;QACD,OAAO,IAAI,yBAAyB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}

package/lib/RemoteImage.d.ts

@@ -0,0 +1,118 @@
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import { Docker } from "./Docker.ts";
+import type { Providers } from "./Providers.ts";
+import { type ImageRegistry } from "./Registry.ts";
+export interface RemoteImageProps {
+    /** Docker image name to use as the source, without tag. */
+    name: string;
+    /** Docker source image tag. @default "latest" */
+    tag?: string;
+    /** Pull for this platform when the source is not already local or alwaysPull is enabled. */
+    platform?: string;
+    /**
+     * Always pull the source image, even when that reference exists locally.
+     *
+     * @default true
+     */
+    alwaysPull?: boolean;
+    /**
+     * Re-tag the pulled image under this repository/name. When omitted the pulled
+     * `name` is kept.
+     */
+    targetName?: string;
+    /**
+     * Tag applied to the re-tagged image.
+     *
+     * @default The pulled `tag`.
+     */
+    targetTag?: string;
+    /** Registry credentials. When set, the (re-tagged) image is pushed. */
+    registry?: ImageRegistry;
+    /**
+     * Skip registry push even when `registry` is set.
+     *
+     * @default false
+     */
+    skipPush?: boolean;
+    /** Docker context name or context resource. */
+    context?: Docker.ContextRef;
+}
+export interface RemoteImage extends Resource<"Docker.RemoteImage", RemoteImageProps, {
+    /** Final image reference. Includes the registry host when pushed there. */
+    imageRef: string;
+    /** Local image id after reuse or pull. */
+    imageId: string;
+    /** Source image id used for the last reconcile, preserved across refresh. */
+    sourceImageId?: string;
+    /** Pull timestamp in milliseconds since epoch. */
+    createdAt: number;
+    /** Final image repository/name. */
+    name: string;
+    /** Final image tag. */
+    tag: string;
+    /** Registry digest after push when available. */
+    repoDigest?: string;
+}, never, Providers> {
+}
+/**
+ * Makes a source Docker image available through the active Docker context,
+ * optionally re-tagging it and pushing it to a registry.
+ *
+ * The image is available to other Docker resources by `imageRef`. Use
+ * `alwaysPull: false` reuses the source tag when it exists in the configured
+ * Docker daemon, pulling only when it is missing. Set `targetName`/`targetTag`
+ * to re-tag the source image, and `registry` to push it (mirroring it from a
+ * source registry into your own, for example).
+ *
+ *
+ * ### Pulling Images
+ * **Example:** Pull nginx
+ * ```typescript
+ * const nginx = yield* Docker.RemoteImage("nginx", {
+ *   name: "nginx",
+ *   tag: "alpine",
+ * });
+ * ```
+ *
+ * **Example:** Reuse an existing daemon tag
+ * ```typescript
+ * const postgres = yield* Docker.RemoteImage("postgres", {
+ *   name: "postgres",
+ *   tag: "18-alpine",
+ *   alwaysPull: false,
+ * });
+ * ```
+ *
+ * ### Re-tagging and Pushing
+ * **Example:** Mirror a public image into your registry
+ * ```typescript
+ * const mirrored = yield* Docker.RemoteImage("nginx-mirror", {
+ *   name: "nginx",
+ *   tag: "alpine",
+ *   targetName: "acme/nginx",
+ *   targetTag: "alpine",
+ *   registry: {
+ *     server: "ghcr.io",
+ *     username: "octocat",
+ *     password: Config.Redacted("GITHUB_TOKEN"),
+ *   },
+ * });
+ * ```
+ *
+ * ### Docker Context
+ * **Example:** Pull through a named Docker context
+ * ```typescript
+ * const nginx = yield* Docker.RemoteImage("nginx", {
+ *   name: "nginx",
+ *   tag: "alpine",
+ *   context: "remote-build",
+ * });
+ * ```
+ *
+ * @resource
+ * @product Image
+ */
+export declare const RemoteImage: import("alchemy/Resource").ResourceClass<RemoteImage>;
+export declare const RemoteImageProvider: () => import("effect/Layer").Layer<Provider.Provider<RemoteImage>, never, Docker>;
+//# sourceMappingURL=RemoteImage.d.ts.map

package/lib/RemoteImage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RemoteImage.d.ts","sourceRoot":"","sources":["../src/RemoteImage.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG5C,OAAO,EAAE,MAAM,EAAqB,MAAM,aAAa,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EACL,KAAK,aAAa,EAKnB,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAC7B;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,oBAAoB,EACpB,gBAAgB,EAChB;IACE,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,eAAO,MAAM,WAAW,uDAA8C,CAAC;AAEvE,eAAO,MAAM,mBAAmB,mFAqG7B,CAAC"}

package/lib/RemoteImage.js

@@ -0,0 +1,164 @@
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import { Docker, dockerContextName } from "./Docker.js";
+import { parseCreatedAt, publishedRepoDigest, repositoryFromImageRef, withRegistryHost, } from "./Registry.js";
+/**
+ * Makes a source Docker image available through the active Docker context,
+ * optionally re-tagging it and pushing it to a registry.
+ *
+ * The image is available to other Docker resources by `imageRef`. Use
+ * `alwaysPull: false` reuses the source tag when it exists in the configured
+ * Docker daemon, pulling only when it is missing. Set `targetName`/`targetTag`
+ * to re-tag the source image, and `registry` to push it (mirroring it from a
+ * source registry into your own, for example).
+ *
+ *
+ * ### Pulling Images
+ * **Example:** Pull nginx
+ * ```typescript
+ * const nginx = yield* Docker.RemoteImage("nginx", {
+ *   name: "nginx",
+ *   tag: "alpine",
+ * });
+ * ```
+ *
+ * **Example:** Reuse an existing daemon tag
+ * ```typescript
+ * const postgres = yield* Docker.RemoteImage("postgres", {
+ *   name: "postgres",
+ *   tag: "18-alpine",
+ *   alwaysPull: false,
+ * });
+ * ```
+ *
+ * ### Re-tagging and Pushing
+ * **Example:** Mirror a public image into your registry
+ * ```typescript
+ * const mirrored = yield* Docker.RemoteImage("nginx-mirror", {
+ *   name: "nginx",
+ *   tag: "alpine",
+ *   targetName: "acme/nginx",
+ *   targetTag: "alpine",
+ *   registry: {
+ *     server: "ghcr.io",
+ *     username: "octocat",
+ *     password: Config.Redacted("GITHUB_TOKEN"),
+ *   },
+ * });
+ * ```
+ *
+ * ### Docker Context
+ * **Example:** Pull through a named Docker context
+ * ```typescript
+ * const nginx = yield* Docker.RemoteImage("nginx", {
+ *   name: "nginx",
+ *   tag: "alpine",
+ *   context: "remote-build",
+ * });
+ * ```
+ *
+ * @resource
+ * @product Image
+ */
+export const RemoteImage = Resource("Docker.RemoteImage");
+export const RemoteImageProvider = () => Provider.effect(RemoteImage, Effect.gen(function* () {
+    const docker = yield* Docker;
+    const inspectImage = (ref, context) => docker.image
+        .inspect(ref, context)
+        .pipe(Effect.catchIf(isMissingImageError, () => Effect.succeed(undefined)));
+    return RemoteImage.Provider.of({
+        list: () => Effect.succeed([]),
+        read: Effect.fn(function* ({ olds, output }) {
+            const context = dockerContextName(olds.context);
+            const ref = output?.imageRef ?? targetImageRef(olds);
+            return yield* inspectImage(ref, context).pipe(Effect.map((image) => image
+                ? {
+                    imageRef: ref,
+                    imageId: image.Id,
+                    createdAt: output?.createdAt ?? parseCreatedAt(image.Created),
+                    sourceImageId: output?.sourceImageId ?? output?.imageId ?? image.Id,
+                    name: output?.name ?? repositoryFromImageRef(ref),
+                    tag: output?.tag ?? targetTag(olds),
+                    repoDigest: output?.repoDigest,
+                }
+                : undefined));
+        }),
+        diff: Effect.fn(function* ({ output, news, olds }) {
+            if (!isResolved(news))
+                return undefined;
+            if (dockerContextName(olds.context) !== dockerContextName(news.context) ||
+                !output ||
+                news.alwaysPull !== false ||
+                output.imageRef !== targetImageRef(news)) {
+                return { action: "update" };
+            }
+            const source = yield* inspectImage(remoteImageRef(news), dockerContextName(news.context));
+            const target = yield* inspectImage(targetImageRef(news), dockerContextName(news.context));
+            if (!source ||
+                !target ||
+                source.Id !== (output.sourceImageId ?? output.imageId) ||
+                source.Id !== target.Id) {
+                return { action: "update" };
+            }
+        }),
+        reconcile: Effect.fn(function* ({ news, session }) {
+            const context = dockerContextName(news.context);
+            const sourceRef = remoteImageRef(news);
+            let source;
+            if (news.alwaysPull === false) {
+                source = yield* inspectImage(sourceRef, context);
+                if (source) {
+                    yield* session.note(`Reusing local Docker image: ${sourceRef}`);
+                }
+            }
+            if (!source) {
+                yield* session.note(`Pulling Docker image: ${sourceRef}`);
+                yield* docker.image.pull(sourceRef, news.platform, context);
+                source = yield* docker.image.inspect(sourceRef, context);
+            }
+            const finalRef = targetImageRef(news);
+            if (finalRef !== sourceRef || (news.registry && !news.skipPush)) {
+                yield* session.note(`Tagging Docker image: ${source.Id} -> ${finalRef}`);
+                yield* docker.image.tag(source.Id, finalRef, context);
+            }
+            let pushed;
+            if (news.registry && !news.skipPush) {
+                yield* session.note(`Pushing image to registry "${news.registry.server}"`);
+                pushed = yield* docker.image.push(finalRef, news.registry, undefined, context);
+            }
+            const inspected = yield* docker.image.inspect(finalRef, context);
+            const repoDigest = pushed === undefined
+                ? undefined
+                : publishedRepoDigest(finalRef, pushed, inspected.RepoDigests);
+            return {
+                imageRef: finalRef,
+                imageId: inspected.Id,
+                sourceImageId: source.Id,
+                createdAt: parseCreatedAt(inspected.Created),
+                name: repositoryFromImageRef(finalRef),
+                tag: targetTag(news),
+                repoDigest,
+            };
+        }),
+        delete: Effect.fn(function* () {
+            // Remote images are not removed on destroy because tags may be shared by
+            // unrelated local stacks or developer workflows.
+        }),
+    });
+}));
+/** The reference the image is pulled from. */
+const remoteImageRef = (props) => `${props.name}:${props.tag ?? "latest"}`;
+const isMissingImageError = (error) => error.reason._tag === "NotFound" &&
+    /no such image|image not known|image not found/i.test(error.reason.description ?? "");
+const targetTag = (props) => props.targetTag ?? props.tag ?? "latest";
+/**
+ * The final reference after re-tagging and registry-host prefixing. Equals the
+ * pulled reference when no re-tag/registry is configured.
+ */
+const targetImageRef = (props) => {
+    const local = `${props.targetName ?? props.name}:${targetTag(props)}`;
+    return props.registry && !props.skipPush ? withRegistryHost(local, props.registry) : local;
+};
+//# sourceMappingURL=RemoteImage.js.map