alchemy 0.93.0 → 0.93.1

package/lib/docker/image.js.map

@@ -1 +1 @@
-{"version":3,"file":"image.js","sourceRoot":"","sources":["../../src/docker/image.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,OAAO,CAAC;AAEzB,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAsJrC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,QAAQ,CAC3B,eAAe,EACf,KAAK,WAEH,EAAU,EACV,KAAiB;IAEjB,kEAAkE;IAClE,MAAM,GAAG,GAAG,IAAI,SAAS,EAAE,CAAC;IAE5B,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5B,4EAA4E;QAC5E,wEAAwE;QACxE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,QAAQ,CAAC;IAClC,MAAM,IAAI,GACR,KAAK,CAAC,IAAI;QACV,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAC9B,CAAC,CAAC,KAAK,CAAC,KAAK;YACb,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CACpB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;IAClC,IAAI,OAA2B,CAAC;IAChC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GACT,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;QAEvE,MAAM,IAAI,GACR,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;YAC7D,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,QAAQ,CAAC;QACf,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACpC,uDAAuD;IACzD,CAAC;SAAM,CAAC;QACN,IAAI,OAAe,CAAC;QACpB,IAAI,UAAkB,CAAC;QACvB,IAAI,KAAK,CAAC,KAAK,EAAE,UAAU,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;YACpD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5C,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7D,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;YACnC,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YACxB,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7D,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;YAChC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5C,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YACxB,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAE5B,wBAAwB;QACxB,MAAM,YAAY,GAA2B,KAAK,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;QAErE,4BAA4B;QAC5B,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE5C,IAAI,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;YAC1B,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QAED,0BAA0B;QAC1B,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YACxB,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;QAED,iCAAiC;QACjC,IAAI,KAAK,CAAC,KAAK,EAAE,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;gBAChD,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3D,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC9C,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACxD,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,iCAAiC;QACjC,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3D,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QAED,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAEjC,mBAAmB;QACnB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAExB,wBAAwB;QACxB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE7C,kDAAkD;QAClD,MAAM,YAAY,GAAG,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnE,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,0BAA0B;IAC1B,IAAI,UAA8B,CAAC;IACnC,IAAI,aAAa,GAAG,QAAQ,CAAC;IAC7B,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;QAEtD,0DAA0D;QAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAE/C,yFAAyF;QACzF,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,iBAAiB,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAErD,yDAAyD;QACzD,MAAM,WAAW,GAAG,iBAAiB;YACnC,CAAC,CAAC,QAAQ,CAAC,0BAA0B;YACrC,CAAC,CAAC,GAAG,YAAY,IAAI,QAAQ,EAAE,CAAC;QAElC,IAAI,CAAC;YACH,0EAA0E;YAC1E,uEAAuE;YACvE,sEAAsE;YACtE,gDAAgD;YAChD,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,OAAO,CACpC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CACzC,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;YAExD,+DAA+D;YAC/D,MAAM,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;YAE9D,yDAAyD;YACzD,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;YACjD,CAAC;YAED,iBAAiB;YACjB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;YAElE,sDAAsD;YACtD,MAAM,WAAW,GAAG,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvE,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBAClC,oEAAoE;gBACpE,MAAM,CAAC,cAAc,CAAC,GACpB,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;oBAC/B,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,sBAAsB;oBACtC,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC/D,UAAU,GAAG,GAAG,cAAc,IAAI,UAAU,EAAE,CAAC;YACjD,CAAC;YAED,gEAAgE;YAChE,aAAa,GAAG,WAAW,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACT,gDAAgD;YAChD,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,GAAG,KAAK;QACR,GAAG;QACH,IAAI;QACJ,QAAQ,EAAE,aAAa;QACvB,OAAO;QACP,UAAU;QACV,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;QACnB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC,CACF,CAAC"}
+{"version":3,"file":"image.js","sourceRoot":"","sources":["../../src/docker/image.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,OAAO,CAAC;AAEzB,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAsJpD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,QAAQ,CAC3B,eAAe,EACf,KAAK,WAEH,EAAU,EACV,KAAiB;IAEjB,kEAAkE;IAClE,MAAM,GAAG,GAAG,IAAI,SAAS,EAAE,CAAC;IAE5B,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5B,4EAA4E;QAC5E,wEAAwE;QACxE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,QAAQ,CAAC;IAClC,MAAM,IAAI,GACR,KAAK,CAAC,IAAI;QACV,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAC9B,CAAC,CAAC,KAAK,CAAC,KAAK;YACb,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CACpB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;IAClC,IAAI,OAA2B,CAAC;IAChC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GACT,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;QAEvE,MAAM,IAAI,GACR,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;YAC7D,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,QAAQ,CAAC;QACf,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACpC,uDAAuD;IACzD,CAAC;SAAM,CAAC;QACN,IAAI,OAAe,CAAC;QACpB,IAAI,UAAkB,CAAC;QACvB,IAAI,KAAK,CAAC,KAAK,EAAE,UAAU,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;YACpD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5C,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7D,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;YACnC,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YACxB,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7D,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;YAChC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5C,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YACxB,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAE5B,wBAAwB;QACxB,MAAM,YAAY,GAA2B,KAAK,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;QAErE,4BAA4B;QAC5B,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE5C,IAAI,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;YAC1B,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QAED,0BAA0B;QAC1B,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YACxB,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;QAED,iCAAiC;QACjC,IAAI,KAAK,CAAC,KAAK,EAAE,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;gBAChD,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3D,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC9C,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACxD,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,iCAAiC;QACjC,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3D,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QAED,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAEjC,mBAAmB;QACnB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAExB,wBAAwB;QACxB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE7C,kDAAkD;QAClD,MAAM,YAAY,GAAG,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnE,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,0BAA0B;IAC1B,IAAI,UAA8B,CAAC;IACnC,IAAI,aAAa,GAAG,QAAQ,CAAC;IAC7B,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxE,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC;QACrC,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;IACtC,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,GAAG;QACH,IAAI;QACJ,QAAQ,EAAE,aAAa;QACvB,OAAO;QACP,UAAU;QACV,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;QACnB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC,CACF,CAAC"}

package/lib/docker/registry.d.ts

@@ -0,0 +1,11 @@
+import { type Secret as SecretValue } from "../secret.ts";
+export interface RegistryPushCredentials {
+    server: string;
+    username: string;
+    password: string | SecretValue;
+}
+export declare function pushImageToRegistry(imageRef: string, registry: RegistryPushCredentials): Promise<{
+    imageRef: string;
+    repoDigest?: string;
+}>;
+//# sourceMappingURL=registry.d.ts.map

package/lib/docker/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/docker/registry.ts"],"names":[],"mappings":"AAGA,OAAO,EAAU,KAAK,MAAM,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC;AAGlE,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,WAAW,CAAC;CAChC;AAED,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,uBAAuB,GAChC,OAAO,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,CA2CD"}

package/lib/docker/registry.js

@@ -0,0 +1,41 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "pathe";
+import { Secret } from "../secret.js";
+import { DockerApi } from "./api.js";
+export async function pushImageToRegistry(imageRef, registry) {
+    const registryHost = registry.server.replace(/\/$/, "");
+    const password = Secret.unwrap(registry.password);
+    const firstSegment = imageRef.split("/")[0];
+    const hasRegistryPrefix = firstSegment.includes(".");
+    const targetImage = hasRegistryPrefix
+        ? imageRef
+        : `${registryHost}/${imageRef}`;
+    let repoDigest;
+    let api;
+    try {
+        const tempConfigDir = await fs.mkdtemp(path.join(os.tmpdir(), "docker-config-"));
+        api = new DockerApi({ configDir: tempConfigDir });
+        await api.login(registryHost, registry.username, password);
+        if (targetImage !== imageRef) {
+            await api.exec(["tag", imageRef, targetImage]);
+        }
+        const { stdout } = await api.exec(["push", targetImage]);
+        const digestMatch = /digest:\s+([a-z0-9]+:[a-f0-9]{64})/.exec(stdout);
+        if (digestMatch) {
+            const digestHash = digestMatch[1];
+            const [repoWithoutTag] = targetImage.split(":").length > 2
+                ? [targetImage]
+                : [targetImage.substring(0, targetImage.lastIndexOf(":"))];
+            repoDigest = `${repoWithoutTag}@${digestHash}`;
+        }
+        return {
+            imageRef: targetImage,
+            repoDigest,
+        };
+    }
+    finally {
+        await api?.logout(registryHost);
+    }
+}
+//# sourceMappingURL=registry.js.map

package/lib/docker/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/docker/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,OAAO,CAAC;AACzB,OAAO,EAAE,MAAM,EAA8B,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAQrC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,QAAiC;IAKjC,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAElD,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,iBAAiB,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,iBAAiB;QACnC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,GAAG,YAAY,IAAI,QAAQ,EAAE,CAAC;IAElC,IAAI,UAA8B,CAAC;IACnC,IAAI,GAA0B,CAAC;IAE/B,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,OAAO,CACpC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CACzC,CAAC;QACF,GAAG,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;QAElD,MAAM,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAE3D,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtE,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,cAAc,CAAC,GACpB,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;gBAC/B,CAAC,CAAC,CAAC,WAAW,CAAC;gBACf,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/D,UAAU,GAAG,GAAG,cAAc,IAAI,UAAU,EAAE,CAAC;QACjD,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,WAAW;YACrB,UAAU;SACX,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alchemy",
-  "version": "0.93.0",
+  "version": "0.93.1",
   "license": "Apache-2.0",
   "author": "Sam Goodwin <sam@alchemy.run>",
   "homepage": "https://alchemy.run",
@@ -195,7 +195,7 @@
     "glob": "^10.0.0",
     "jszip": "^3.0.0",
     "libsodium-wrappers": "^0.8.0",
-    "miniflare": "4.20260310.0",
+    "miniflare": "4.20260329.0",
     "neverthrow": "^8.2.0",
     "open": "^10.1.2",
     "openapi-types": "^12.1.3",

package/src/cloudflare/ai-search-namespace.ts

@@ -194,17 +194,13 @@ export const AiSearchNamespace = Resource(
       );
     }
 
-    if (this.scope.local) {
-      // Local development mode — return mock output
-      return {
-        type: "ai_search_namespace",
-        id: namespace,
-        namespace,
-        description: props.description ?? null,
-        createdAt: new Date().toISOString(),
-      };
-    }
-
+    // NOTE: AI Search is an always-remote binding (no Miniflare-native
+    // implementation). `alchemy dev` wires the worker binding via
+    // `remote-binding-proxy`, which requires the namespace to actually exist
+    // on Cloudflare at preview-token creation time — a locally mocked
+    // resource would cause the Worker deploy to fail with error 10359
+    // ("namespace … does not exist"). Follow the same pattern as Vectorize
+    // and skip the `scope.local` mock branch entirely.
     const api = await createCloudflareApi(props);
 
     if (this.phase === "delete") {

package/src/cloudflare/ai-search.ts

@@ -373,32 +373,13 @@ export const AiSearch = Resource(
     // Resolve namespace: AiSearchNamespace resource → string, default to "default"
     const namespace = resolveNamespace(props.namespace);
 
-    if (this.scope.local) {
-      // Local development mode — return a mock shape so `alchemy dev` does
-      // not hit the real Cloudflare API. Matches the AiSearchNamespace
-      // local-mode pattern and satisfies AGENTS.md requirements.
-      const name =
-        props.name ??
-        this.output?.name ??
-        this.scope.createPhysicalName(id, "-", 32);
-      const now = new Date().toISOString();
-      // `AiSearch` is `SnakeToCamel<ApiResponse>` intersected with extras —
-      // all non-required fields are optional, so we only populate what's
-      // needed. No `as unknown as` escape hatch required.
-      const mock: AiSearch = {
-        id: name,
-        name,
-        namespace,
-        accountId: "local",
-        accountTag: "local",
-        createdAt: now,
-        internalId: name,
-        modifiedAt: now,
-        vectorizeName: "",
-      };
-      return mock;
-    }
-
+    // NOTE: AI Search is an always-remote binding (no Miniflare-native
+    // implementation). `alchemy dev` wires the worker binding via
+    // `remote-binding-proxy`, which requires the instance to actually exist
+    // on Cloudflare at preview-token creation time — a locally mocked
+    // resource would cause the Worker deploy to fail with error 10360
+    // ("instance … not found"). Follow the same pattern as Vectorize and
+    // skip the `scope.local` mock branch entirely.
     const api = await createCloudflareApi(props);
 
     const validateBucketSource = async (

package/src/cloudflare/container.ts

@@ -5,10 +5,10 @@ import {
   type DockerBuildOptions,
   type ImageProps,
 } from "../docker/image.ts";
+import { pushImageToRegistry } from "../docker/registry.ts";
 import type { RemoteImage } from "../docker/remote-image.ts";
 import { Resource } from "../resource.ts";
 import { Scope } from "../scope.ts";
-import { secret } from "../secret.ts";
 import {
   createCloudflareApi,
   type CloudflareApi,
@@ -467,7 +467,6 @@ export async function Container<T>(
   }
 
   const api = await createCloudflareApi(props);
-  const credentials = await getContainerCredentials(api);
 
   const image = await Image(id, {
     name: `${api.accountId}/${name}`,
@@ -482,16 +481,24 @@ export async function Container<T>(
           platform: "linux/amd64",
           context: process.cwd(),
         },
-    registry: {
-      server: "registry.cloudflare.com",
-      username: credentials.username || credentials.user!,
-      password: secret(credentials.password),
-    },
+    image: props.image,
+    skipPush: true,
   } as ImageProps);
 
+  const credentials = await getContainerCredentials(api);
+  const pushedImage = await pushImageToRegistry(image.imageRef, {
+    server: "registry.cloudflare.com",
+    username: credentials.username || credentials.user!,
+    password: credentials.password,
+  });
+
   return {
     ...output,
-    image,
+    image: {
+      ...image,
+      imageRef: pushedImage.imageRef,
+      repoDigest: pushedImage.repoDigest,
+    },
   };
 }
 

package/src/cloudflare/custom-domain.ts

@@ -44,6 +44,21 @@ export interface CustomDomainProps extends CloudflareApiOptions {
    */
   adopt?: boolean;
 
+  /**
+   * If true, forcibly transfer the hostname when it is currently bound to a
+   * different Worker service. Without this flag, Cloudflare rejects the
+   * upsert with HTTP 409 / error code 100116 "Hostname '<host>' already in
+   * use by other custom domain".
+   *
+   * This is destructive to the previously bound Worker (its traffic on this
+   * hostname stops immediately), so it is opt-in. Only relevant when the
+   * existing binding points at a different `workerName` or `environment`.
+   *
+   * @see https://developers.cloudflare.com/api/resources/workers/subresources/domains/methods/update/
+   * @default false
+   */
+  overrideExistingOrigin?: boolean;
+
   /**
    * Whether to delete the custom domain when removed from Alchemy.
    * If set to false, the custom domain will remain but the resource will be removed from state.
@@ -269,12 +284,21 @@ async function ensureCustomDomain(
   if (!bindingExists || needsUpdate) {
     operationPerformed = bindingExists ? "update" : "create";
 
-    const putPayload = {
+    const putPayload: {
+      zone_id: string;
+      hostname: string;
+      service: string;
+      environment: string;
+      override_existing_origin?: boolean;
+    } = {
       zone_id: props.zoneId,
       hostname: domainHostname,
       service: props.workerName,
       environment: environment,
     };
+    if (props.overrideExistingOrigin !== undefined) {
+      putPayload.override_existing_origin = props.overrideExistingOrigin;
+    }
 
     const putResponse = await api.put(
       `/accounts/${api.accountId}/workers/domains`,

package/src/cloudflare/miniflare/build-worker-options.ts

@@ -40,8 +40,6 @@ type RemoteBinding =
       {
         type:
           | "ai"
-          | "ai_search"
-          | "ai_search_namespace"
           | "browser"
           | "dispatch_namespace"
           | "mtls_certificate"
@@ -57,7 +55,13 @@ type RemoteBinding =
   | Extract<
       WorkerBindingSpec,
       { type: "send_email" | "service" | "vpc_service" }
-    >;
+    >
+  // AI Search bindings reject the `raw` flag at the Cloudflare API
+  // validation layer (10333). Wrangler's upload form deliberately omits
+  // `raw` for these two binding types in
+  // packages/wrangler/src/deployment-bundle/create-worker-upload-form.ts,
+  // so we mirror that here for the remote-binding-proxy upload.
+  | Extract<WorkerBindingSpec, { type: "ai_search" | "ai_search_namespace" }>;
 
 type BaseWorkerOptions = {
   [K in keyof miniflare.WorkerOptions]: K extends
@@ -96,24 +100,30 @@ export const buildWorkerOptions = async (
     }
     if (isAiSearch(binding)) {
       // AI Search instance bindings are not supported natively by Miniflare;
-      // proxy them to the deployed instance (same mechanism used by `ai`,
-      // `vectorize`, etc.). Instance bindings are always scoped to the
-      // default namespace on the CF side, so the namespace need not be
-      // surfaced in the remote-proxy metadata.
+      // proxy them to the deployed instance via the `remote-binding-proxy`
+      // worker (same mechanism used by `ai`, `vectorize`, etc.). Instance
+      // bindings are always scoped to the default namespace on the CF side,
+      // so the namespace need not be surfaced in the remote-proxy metadata.
+      //
+      // Note: unlike `ai`/`browser`/`vectorize`, AI Search bindings must NOT
+      // carry `raw: true` — CF's API rejects that field on `ai_search` and
+      // `ai_search_namespace` bindings (error 10333). This mirrors wrangler's
+      // create-worker-upload-form.ts which also omits `raw` for these two
+      // binding types.
       remoteBindings.push({
         type: "ai_search",
         name: key,
         instance_name: binding.name,
-        raw: true,
       });
       continue;
     }
     if (isAiSearchNamespace(binding)) {
+      // See comment above on `ai_search`: `raw: true` is rejected by CF for
+      // this binding type, so we push without it.
       remoteBindings.push({
         type: "ai_search_namespace",
         name: key,
         namespace: binding.namespace,
-        raw: true,
       });
       continue;
     }

package/src/cloudflare/miniflare/remote-binding-proxy.ts

@@ -39,7 +39,12 @@ export async function createRemoteProxyWorker(input: {
   bindings: WorkerBindingSpec[];
 }): Promise<RemoteBindingProxy> {
   const script = await getInternalWorkerBundle("remote-binding-proxy");
-  const [token, { host, accessToken }] = await Promise.all([
+  // We must create the preview token BEFORE probing for Cloudflare Access:
+  // a preview worker URL only returns the Access 302 when the request carries
+  // the preview token (otherwise CF responds with 404 regardless of Access
+  // configuration). Probing without the token would incorrectly report
+  // "no Access" for accounts that do gate workers.dev behind Access.
+  const [token, subdomain] = await Promise.all([
     createWorkersPreviewToken(input.api, {
       name: input.name,
       metadata: {
@@ -54,14 +59,10 @@ export async function createRemoteProxyWorker(input: {
         minimal_mode: true,
       },
     }),
-    getAccountSubdomain(input.api).then(async (subdomain) => {
-      const host = `${input.name}.${subdomain}.workers.dev`;
-      return {
-        host,
-        accessToken: await getAccessToken(host),
-      };
-    }),
+    getAccountSubdomain(input.api),
   ]);
+  const host = `${input.name}.${subdomain}.workers.dev`;
+  const accessToken = await getAccessToken(host, token);
 
   const baseHeaders: Record<string, string> = {
     "cf-workers-preview-token": token,
@@ -158,7 +159,13 @@ async function createWorkersPreviewToken(
 
 async function prewarm(url: string, previewToken: string) {
   try {
-    const accessToken = await getAccessToken(new URL(url).hostname);
+    // Pass the preview token to the Access probe — prewarm targets a preview
+    // worker URL, which only surfaces an Access 302 when the request carries
+    // the preview token.
+    const accessToken = await getAccessToken(
+      new URL(url).hostname,
+      previewToken,
+    );
     await fetch(url, {
       method: "POST",
       headers: {
@@ -197,42 +204,59 @@ async function createWorkersPreviewSession(api: CloudflareApi) {
 /**
  * If the given domain uses Cloudflare Access, fetches the access token for the domain.
  * Otherwise, returns undefined.
+ *
+ * For workers.dev preview URLs, pass the `cf-workers-preview-token` alongside
+ * the HEAD probe: the preview worker only surfaces its Access 302 when the
+ * request carries the preview token (a bare HEAD returns 404 regardless of
+ * Access configuration).
+ *
  * @see https://github.com/cloudflare/workers-sdk/blob/a5eb5134f73d3983655d325a4de71c6370c57faa/packages/wrangler/src/user/access.ts#L10
  */
-const getAccessToken = memoize(async (hostname: string) => {
-  if (!(await domainUsesAccess(hostname))) {
-    return undefined;
-  }
-  const result = await Scope.current
-    .exec(`access-${hostname}`, `cloudflared access login ${hostname}`)
-    .catch(() => {
-      throw new Error(
-        [
-          `The \`cloudflared\` CLI is not installed, but is required to access the domain "${hostname}".`,
-          `Please install it from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation and run \`cloudflare access login ${hostname}\`.`,
-        ].join("\n"),
-      );
-    });
-  const matches = result.stdout.match(/fetched your token:\n\n(.*)/m);
-  if (matches?.[1]) {
-    return matches[1];
-  }
-  const error = new Error(
-    `Failed to get access token for domain "${hostname}".`,
-  );
-  Object.assign(error, result);
-  throw error;
-});
+const getAccessToken = memoize(
+  async (hostname: string, previewToken?: string) => {
+    if (!(await domainUsesAccess(hostname, previewToken))) {
+      return undefined;
+    }
+    const result = await Scope.current
+      .exec(`access-${hostname}`, `cloudflared access login ${hostname}`)
+      .catch(() => {
+        throw new Error(
+          [
+            `The \`cloudflared\` CLI is not installed, but is required to access the domain "${hostname}".`,
+            `Please install it from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation and run \`cloudflare access login ${hostname}\`.`,
+          ].join("\n"),
+        );
+      });
+    const matches = result.stdout.match(/fetched your token:\n\n(.*)/m);
+    if (matches?.[1]) {
+      return matches[1];
+    }
+    const error = new Error(
+      `Failed to get access token for domain "${hostname}".`,
+    );
+    Object.assign(error, result);
+    throw error;
+  },
+  (hostname) => hostname,
+);
 
 /**
  * Returns true if the domain uses Cloudflare Access.
+ *
+ * @param hostname  the workers.dev preview host
+ * @param previewToken  optional preview token; required when probing a
+ *   preview-worker URL because CF only serves the Access 302 to requests
+ *   that carry the token.
  */
-async function domainUsesAccess(hostname: string) {
+async function domainUsesAccess(hostname: string, previewToken?: string) {
   try {
     const response = await fetch(`https://${hostname}`, {
       method: "HEAD",
       redirect: "manual",
       signal: AbortSignal.timeout(1000),
+      headers: previewToken
+        ? { "cf-workers-preview-token": previewToken }
+        : undefined,
     });
     return !!(
       response.status === 302 &&

package/src/cloudflare/website.ts

@@ -10,6 +10,7 @@ import { Assets } from "./assets.ts";
 import type { Bindings } from "./bindings.ts";
 import { DEFAULT_COMPATIBILITY_DATE } from "./compatibility-date.ts";
 import { unionCompatibilityFlags } from "./compatibility-presets.ts";
+import { quickTunnel } from "./quick-tunnel.ts";
 import {
   extractStringAndSecretBindings,
   unencryptSecrets,
@@ -78,6 +79,10 @@ export interface WebsiteProps<
          * The local domain to use for the dev server
          */
         domain?: string;
+        /**
+         * Whether to use a Cloudflare Tunnel for the dev server
+         */
+        tunnel?: boolean;
         /**
          * Additional environment variables to set when running the dev command
          */
@@ -363,6 +368,10 @@ export async function Website<
         ALCHEMY_ROOT: Scope.current.rootDir,
       },
     });
+    if (url && ((typeof dev === "object" && dev.tunnel) || scope.tunnel)) {
+      const { tunnelUrl } = await quickTunnel(scope, url);
+      url = tunnelUrl;
+    }
   }
 
   return (await Worker(id, {
@@ -377,7 +386,16 @@ export async function Website<
           }
         : {}),
     },
-    dev: url ? { url } : undefined,
+    dev: worker.dev
+      ? {
+          url: url as never,
+          port: worker.dev.port,
+          remote: worker.dev.remote,
+          tunnel: worker.dev.tunnel,
+        }
+      : url
+        ? { url }
+        : undefined,
   })) as Website<B, RPC>;
 }
 

package/src/cloudflare/worker.ts

@@ -329,6 +329,12 @@ export interface BaseWorkerProps<
          * @default false
          */
         adopt?: boolean;
+        /**
+         * Forcibly transfer the hostname when it is currently bound to a
+         * different Worker service. See {@link CustomDomainProps.overrideExistingOrigin}.
+         * @default false
+         */
+        overrideExistingOrigin?: boolean;
       }
   )[];
 
@@ -1497,6 +1503,7 @@ async function provisionResources<B extends Bindings>(
           name: domain,
           zoneId: undefined,
           adopt: props.adopt,
+          overrideExistingOrigin: undefined,
         };
       }
       if (domain.domainName === "") {
@@ -1506,6 +1513,7 @@ async function provisionResources<B extends Bindings>(
         name: domain.domainName,
         zoneId: domain.zoneId,
         adopt: domain.adopt ?? props.adopt,
+        overrideExistingOrigin: domain.overrideExistingOrigin,
       };
     }),
     eventSources: props.eventSources?.map((eventSource) => {
@@ -1578,6 +1586,7 @@ async function provisionResources<B extends Bindings>(
               name: domain.name,
               zoneId: domain.zoneId,
               adopt: domain.adopt,
+              overrideExistingOrigin: domain.overrideExistingOrigin,
               delete: props.delete,
               workerName: options.name,
               dev: options.local,

package/src/docker/image.ts

@@ -1,10 +1,10 @@
 import fs from "node:fs/promises";
-import os from "node:os";
 import path from "pathe";
 import type { Context } from "../context.ts";
 import { Resource } from "../resource.ts";
 import type { Secret } from "../secret.ts";
 import { DockerApi } from "./api.ts";
+import { pushImageToRegistry } from "./registry.ts";
 import type { RemoteImage } from "./remote-image.ts";
 
 /**
@@ -66,9 +66,9 @@ export interface DockerBuildOptions {
 }
 
 export interface ImageRegistry {
+  server: string;
   username: string;
   password: Secret;
-  server: string;
 }
 
 /**
@@ -285,63 +285,12 @@ export const Image = Resource(
     let repoDigest: string | undefined;
     let finalImageRef = imageRef;
     if (props.registry && !props.skipPush) {
-      const { server, username, password } = props.registry;
-
-      // Ensure the registry server does not have trailing slash
-      const registryHost = server.replace(/\/$/, "");
-
-      // Determine if the built image already includes a registry host (e.g. ghcr.io/user/repo)
-      const firstSegment = imageRef.split("/")[0];
-      const hasRegistryPrefix = firstSegment.includes(".");
-
-      // Compose the target image reference that will be pushed
-      const targetImage = hasRegistryPrefix
-        ? imageRef // already fully-qualified
-        : `${registryHost}/${imageRef}`;
-
-      try {
-        // Create a temporary directory that will act as an isolated Docker config
-        // (credentials) directory. This prevents race-conditions when multiple
-        // concurrent tests perform `docker login` / `logout` by ensuring each
-        // Image operation has its own credential store.
-        const tempConfigDir = await fs.mkdtemp(
-          path.join(os.tmpdir(), "docker-config-"),
-        );
-        const api = new DockerApi({ configDir: tempConfigDir });
-
-        // Authenticate to registry using the isolated config directory
-        await api.login(registryHost, username, password.unencrypted);
-
-        // Tag local image with fully qualified name if necessary
-        if (targetImage !== imageRef) {
-          await api.exec(["tag", imageRef, targetImage]);
-        }
-
-        // Push the image
-        const { stdout: pushOut } = await api.exec(["push", targetImage]);
-
-        // Attempt to extract the repo digest from push output
-        const digestMatch = /digest:\s+([a-z0-9]+:[a-f0-9]{64})/.exec(pushOut);
-        if (digestMatch) {
-          const digestHash = digestMatch[1];
-          // Strip tag (anything after last :) to build image@digest reference
-          const [repoWithoutTag] =
-            targetImage.split(":").length > 2
-              ? [targetImage] // unlikely but safety
-              : [targetImage.substring(0, targetImage.lastIndexOf(":"))];
-          repoDigest = `${repoWithoutTag}@${digestHash}`;
-        }
-
-        // Update the final image reference to point at the pushed image
-        finalImageRef = targetImage;
-      } finally {
-        // Clean up credentials from the isolated config
-        await api.logout(registryHost);
-      }
+      const pushedImage = await pushImageToRegistry(imageRef, props.registry);
+      finalImageRef = pushedImage.imageRef;
+      repoDigest = pushedImage.repoDigest;
     }
     return {
       kind: "Image",
-      ...props,
       tag,
       name,
       imageRef: finalImageRef,