typekro 0.27.1 → 0.28.1

package/dist/core/containers/registries/docker-session.d.ts

@@ -0,0 +1,14 @@
+import type { OciRegistryCredentialProvider, OciRegistryTlsConfig, RegistrySession } from './types.js';
+export interface DockerRegistrySessionOptions {
+    readonly registryHost: string;
+    readonly credentialProvider?: OciRegistryCredentialProvider;
+    readonly dockerConfigPath?: string;
+    readonly tls?: OciRegistryTlsConfig;
+    readonly timeout: number;
+    readonly signal?: AbortSignal;
+}
+/** Open an isolated Docker authentication and BuildKit trust session. */
+export declare function createDockerRegistrySession(options: DockerRegistrySessionOptions): Promise<RegistrySession>;
+/** Read an isolated Docker config for tests without exposing it through public build results. */
+export declare function readDockerSessionConfig(session: RegistrySession): Promise<string | undefined>;
+//# sourceMappingURL=docker-session.d.ts.map

package/dist/core/containers/registries/docker-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-session.d.ts","sourceRoot":"","sources":["../../../../src/core/containers/registries/docker-session.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EACV,6BAA6B,EAC7B,oBAAoB,EACpB,eAAe,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,6BAA6B,CAAC;IAC5D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAuHD,yEAAyE;AACzE,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,eAAe,CAAC,CAwE1B;AAED,iGAAiG;AACjG,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAI7B"}

package/dist/core/containers/registries/docker-session.js

@@ -0,0 +1,164 @@
+import { Buffer } from 'node:buffer';
+import { chmod, copyFile, cp, lstat, mkdir, mkdtemp, readFile, rm, writeFile, } from 'node:fs/promises';
+import { homedir, tmpdir } from 'node:os';
+import { basename, dirname, join, resolve } from 'node:path';
+import { ContainerBuildError } from '../errors.js';
+import { execDocker } from '../exec.js';
+function defaultDockerConfigPath() {
+    const configuredDirectory = process.env.DOCKER_CONFIG;
+    return configuredDirectory
+        ? join(configuredDirectory, 'config.json')
+        : join(homedir(), '.docker', 'config.json');
+}
+async function copyDockerConfiguration(source, target) {
+    try {
+        await copyFile(source, target);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== 'ENOENT')
+            throw error;
+        await writeFile(target, '{}\n', { encoding: 'utf8', mode: 0o600 });
+    }
+    await chmod(target, 0o600);
+    // config.json can select a named context. Docker resolves that context through
+    // sibling contexts/meta and contexts/tls state, so copying only config.json
+    // makes otherwise valid configurations (including OrbStack) unusable.
+    try {
+        await cp(join(dirname(source), 'contexts'), join(dirname(target), 'contexts'), {
+            recursive: true,
+        });
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    // DOCKER_CONFIG also controls per-user CLI plugin discovery. Keep Buildx
+    // available without copying unrelated plugins or sharing mutable state.
+    const sourceBuildx = join(dirname(source), 'cli-plugins', 'docker-buildx');
+    const targetBuildx = join(dirname(target), 'cli-plugins', 'docker-buildx');
+    try {
+        await mkdir(dirname(targetBuildx), { recursive: true });
+        await cp(sourceBuildx, targetBuildx);
+        if (!(await lstat(targetBuildx)).isSymbolicLink())
+            await chmod(targetBuildx, 0o700);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+}
+function tomlString(value) {
+    return JSON.stringify(value);
+}
+async function writeDockerCredential(configPath, registryHost, credential) {
+    const parsed = JSON.parse(await readFile(configPath, 'utf8'));
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('Docker config.json must contain an object.');
+    }
+    const config = parsed;
+    const currentAuths = config.auths && typeof config.auths === 'object' && !Array.isArray(config.auths)
+        ? config.auths
+        : {};
+    const currentHelpers = config.credHelpers &&
+        typeof config.credHelpers === 'object' &&
+        !Array.isArray(config.credHelpers)
+        ? config.credHelpers
+        : {};
+    const { [registryHost]: _targetHelper, ...otherHelpers } = currentHelpers;
+    const { credsStore: _globalCredentialStore, credHelpers: _credHelpers, ...sessionConfig } = config;
+    const auth = Buffer.from(`${credential.username}:${credential.password}`, 'utf8').toString('base64');
+    await writeFile(configPath, `${JSON.stringify({
+        ...sessionConfig,
+        ...(Object.keys(otherHelpers).length > 0 ? { credHelpers: otherHelpers } : {}),
+        auths: {
+            ...currentAuths,
+            [registryHost]: { username: credential.username, password: credential.password, auth },
+        },
+    })}\n`, { encoding: 'utf8', mode: 0o600 });
+    await chmod(configPath, 0o600);
+}
+async function prepareBuildkitTrust(directory, registryHost, tls) {
+    if (!tls?.caCertificate && !tls?.caFile && !tls?.insecure && !tls?.plainHttp)
+        return undefined;
+    let caPath;
+    if (tls.caCertificate) {
+        caPath = join(directory, 'registry-ca.pem');
+        await writeFile(caPath, tls.caCertificate, { encoding: 'utf8', mode: 0o600 });
+    }
+    else if (tls.caFile) {
+        caPath = join(directory, basename(tls.caFile));
+        await copyFile(resolve(tls.caFile), caPath);
+        await chmod(caPath, 0o600);
+    }
+    const lines = [
+        `[registry.${tomlString(registryHost)}]`,
+        ...(caPath ? [`  ca = [${tomlString(caPath)}]`] : []),
+        ...(tls.plainHttp ? ['  http = true'] : []),
+        ...(tls.insecure ? ['  insecure = true'] : []),
+    ];
+    const configPath = join(directory, 'buildkitd.toml');
+    await writeFile(configPath, `${lines.join('\n')}\n`, { encoding: 'utf8', mode: 0o600 });
+    return configPath;
+}
+/** Open an isolated Docker authentication and BuildKit trust session. */
+export async function createDockerRegistrySession(options) {
+    const directory = await mkdtemp(join(tmpdir(), 'typekro-registry-'));
+    await chmod(directory, 0o700);
+    try {
+        const configPath = join(directory, 'config.json');
+        await mkdir(dirname(configPath), { recursive: true });
+        await copyDockerConfiguration(options.dockerConfigPath ?? defaultDockerConfigPath(), configPath);
+        const environment = { DOCKER_CONFIG: directory };
+        if (options.credentialProvider) {
+            const credential = await options.credentialProvider(options.signal);
+            if (!credential.username || !credential.password) {
+                throw new ContainerBuildError('OCI credential provider returned an empty username or password.', 'REGISTRY_CREDENTIAL_INVALID', ['Return both username and password from the credential provider.']);
+            }
+            if (options.tls?.plainHttp ||
+                options.tls?.insecure ||
+                options.tls?.caCertificate ||
+                options.tls?.caFile) {
+                // docker login has no per-command transport or CA override. For every
+                // custom transport, write the standard short-lived auth entry directly
+                // into the isolated config and let the dedicated BuildKit configuration
+                // carry HTTP, CA, or insecure-TLS trust. This avoids depending on the
+                // developer machine's global Docker daemon trust store.
+                await writeDockerCredential(configPath, options.registryHost, credential);
+            }
+            else {
+                await execDocker(['login', '--username', credential.username, '--password-stdin', options.registryHost], {
+                    stdin: credential.password,
+                    quiet: true,
+                    timeout: options.timeout,
+                    environment,
+                    ...(options.signal ? { signal: options.signal } : {}),
+                    sensitiveValues: [credential.username, credential.password],
+                });
+            }
+        }
+        const buildkitConfigPath = await prepareBuildkitTrust(directory, options.registryHost, options.tls);
+        return {
+            remote: true,
+            environment,
+            ...(buildkitConfigPath ? { buildkitConfigPath } : {}),
+            async cleanup() {
+                await rm(directory, { recursive: true, force: true });
+            },
+        };
+    }
+    catch (error) {
+        await rm(directory, { recursive: true, force: true });
+        if (error instanceof ContainerBuildError)
+            throw error;
+        throw new ContainerBuildError(`Failed to prepare isolated registry credentials: ${error instanceof Error ? error.message : String(error)}`, 'REGISTRY_SESSION_FAILED', ['Verify the Docker config, credential provider, and registry TLS configuration.'], error instanceof Error ? error : undefined);
+    }
+}
+/** Read an isolated Docker config for tests without exposing it through public build results. */
+export async function readDockerSessionConfig(session) {
+    const directory = session.environment?.DOCKER_CONFIG;
+    if (!directory)
+        return undefined;
+    return readFile(join(directory, 'config.json'), 'utf8');
+}
+//# sourceMappingURL=docker-session.js.map

package/dist/core/containers/registries/docker-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-session.js","sourceRoot":"","sources":["../../../../src/core/containers/registries/docker-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EACL,KAAK,EACL,QAAQ,EACR,EAAE,EACF,KAAK,EACL,KAAK,EACL,OAAO,EACP,QAAQ,EACR,EAAE,EACF,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAgBxC,SAAS,uBAAuB;IAC9B,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACtD,OAAO,mBAAmB;QACxB,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC;QAC1C,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,MAAc,EAAE,MAAc;IACnE,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QACnC,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAE3B,+EAA+E;IAC/E,4EAA4E;IAC5E,sEAAsE;IACtE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE;YAC7E,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACtE,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;IAC3E,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,UAAkB,EAClB,YAAoB,EACpB,UAAkD;IAElD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,YAAY,GAChB,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9E,CAAC,CAAE,MAAM,CAAC,KAAiC;QAC3C,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,cAAc,GAClB,MAAM,CAAC,WAAW;QAClB,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;QAChC,CAAC,CAAE,MAAM,CAAC,WAAuC;QACjD,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,GAAG,YAAY,EAAE,GAAG,cAAc,CAAC;IAC1E,MAAM,EACJ,UAAU,EAAE,sBAAsB,EAClC,WAAW,EAAE,YAAY,EACzB,GAAG,aAAa,EACjB,GAAG,MAAM,CAAC;IACX,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,CACxF,QAAQ,CACT,CAAC;IACF,MAAM,SAAS,CACb,UAAU,EACV,GAAG,IAAI,CAAC,SAAS,CAAC;QAChB,GAAG,aAAa;QAChB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,KAAK,EAAE;YACL,GAAG,YAAY;YACf,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE;SACvF;KACF,CAAC,IAAI,EACN,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAClC,CAAC;IACF,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,SAAiB,EACjB,YAAoB,EACpB,GAAqC;IAErC,IAAI,CAAC,GAAG,EAAE,aAAa,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,GAAG,EAAE,SAAS;QAAE,OAAO,SAAS,CAAC;IAE/F,IAAI,MAA0B,CAAC;IAC/B,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QACtB,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAC5C,MAAM,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,CAAC;SAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,aAAa,UAAU,CAAC,YAAY,CAAC,GAAG;QACxC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACrD,MAAM,SAAS,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAqC;IAErC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACrE,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAE9B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAClD,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,uBAAuB,CAC3B,OAAO,CAAC,gBAAgB,IAAI,uBAAuB,EAAE,EACrD,UAAU,CACX,CAAC;QACF,MAAM,WAAW,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;QAEjD,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpE,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACjD,MAAM,IAAI,mBAAmB,CAC3B,iEAAiE,EACjE,6BAA6B,EAC7B,CAAC,iEAAiE,CAAC,CACpE,CAAC;YACJ,CAAC;YACD,IACE,OAAO,CAAC,GAAG,EAAE,SAAS;gBACtB,OAAO,CAAC,GAAG,EAAE,QAAQ;gBACrB,OAAO,CAAC,GAAG,EAAE,aAAa;gBAC1B,OAAO,CAAC,GAAG,EAAE,MAAM,EACnB,CAAC;gBACD,sEAAsE;gBACtE,uEAAuE;gBACvE,wEAAwE;gBACxE,sEAAsE;gBACtE,wDAAwD;gBACxD,MAAM,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,CACd,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,CAAC,YAAY,CAAC,EACtF;oBACE,KAAK,EAAE,UAAU,CAAC,QAAQ;oBAC1B,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,WAAW;oBACX,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,eAAe,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC;iBAC5D,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,kBAAkB,GAAG,MAAM,oBAAoB,CACnD,SAAS,EACT,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,GAAG,CACZ,CAAC;QACF,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,WAAW;YACX,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,KAAK,CAAC,OAAO;gBACX,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,KAAK,YAAY,mBAAmB;YAAE,MAAM,KAAK,CAAC;QACtD,MAAM,IAAI,mBAAmB,CAC3B,oDAAoD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC5G,yBAAyB,EACzB,CAAC,gFAAgF,CAAC,EAClF,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAwB;IAExB,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC;IACrD,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC"}

package/dist/core/containers/registries/ecr.d.ts

@@ -5,7 +5,7 @@
  * Supports env vars, profiles, SSO sessions, instance roles, and role
  * assumption — all through the SDK's standard mechanisms.
  */
-import type { EcrRegistryConfig, RegistryHandler } from './types.js';
+import type { EcrRegistryConfig, RegistryHandler, RegistrySession } from './types.js';
 export declare class EcrRegistryHandler implements RegistryHandler {
     private readonly config;
     private resolvedAccountId;
@@ -14,8 +14,7 @@ export declare class EcrRegistryHandler implements RegistryHandler {
     private ecrClient;
     constructor(config: EcrRegistryConfig);
     resolveImageUri(imageName: string, tag: string): Promise<string>;
-    authenticate(): Promise<void>;
-    push(imageUri: string, imageName: string): Promise<boolean>;
+    prepare(imageName: string, timeout: number, signal?: AbortSignal): Promise<RegistrySession>;
     private getAccountId;
     private ensureRepositoryExists;
 }

package/dist/core/containers/registries/ecr.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ecr.d.ts","sourceRoot":"","sources":["../../../../src/core/containers/registries/ecr.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAcH,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIrE,qBAAa,kBAAmB,YAAW,eAAe;IAM5C,OAAO,CAAC,QAAQ,CAAC,MAAM;IALnC,OAAO,CAAC,iBAAiB,CAAqB;IAC9C,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,kBAAkB,CAAgC;IAC1D,OAAO,CAAC,SAAS,CAAY;gBAEA,MAAM,EAAE,iBAAiB;IAYhD,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKhE,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAgC7B,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YAiBnD,YAAY;YAuBZ,sBAAsB;CAoBrC"}
+{"version":3,"file":"ecr.d.ts","sourceRoot":"","sources":["../../../../src/core/containers/registries/ecr.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAcH,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAItF,qBAAa,kBAAmB,YAAW,eAAe;IAM5C,OAAO,CAAC,QAAQ,CAAC,MAAM;IALnC,OAAO,CAAC,iBAAiB,CAAqB;IAC9C,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,kBAAkB,CAAgC;IAC1D,OAAO,CAAC,SAAS,CAAY;gBAEA,MAAM,EAAE,iBAAiB;IAUhD,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKhE,OAAO,CACX,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,eAAe,CAAC;YAmCb,YAAY;YAuBZ,sBAAsB;CAoBrC"}

package/dist/core/containers/registries/ecr.js

@@ -10,7 +10,7 @@ import { GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';
 import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
 import { getComponentLogger } from '../../logging/index.js';
 import { ContainerBuildError } from '../errors.js';
-import { execDocker } from '../exec.js';
+import { createDockerRegistrySession } from './docker-session.js';
 const logger = getComponentLogger('container-registry-ecr');
 export class EcrRegistryHandler {
     config;
@@ -20,10 +20,8 @@ export class EcrRegistryHandler {
     ecrClient;
     constructor(config) {
         this.config = config;
-        this.resolvedRegion = config.region
-            ?? process.env.AWS_REGION
-            ?? process.env.AWS_DEFAULT_REGION
-            ?? 'us-east-1';
+        this.resolvedRegion =
+            config.region ?? process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? 'us-east-1';
         this.credentialProvider = fromNodeProviderChain(config.credentials ?? {});
         this.ecrClient = new ECRClient({
             region: this.resolvedRegion,
@@ -34,7 +32,9 @@ export class EcrRegistryHandler {
         const accountId = await this.getAccountId();
         return `${accountId}.dkr.ecr.${this.resolvedRegion}.amazonaws.com/${imageName}:${tag}`;
     }
-    async authenticate() {
+    async prepare(imageName, timeout, signal) {
+        if (this.config.createRepository !== false)
+            await this.ensureRepositoryExists(imageName);
         try {
             const authResponse = await this.ecrClient.send(new GetAuthorizationTokenCommand({}));
             const authData = authResponse.authorizationData?.[0];
@@ -46,9 +46,12 @@ export class EcrRegistryHandler {
             if (colonIndex === -1)
                 throw new Error('Failed to decode ECR authorization token');
             const password = decoded.slice(colonIndex + 1);
-            await execDocker(['login', '--username', 'AWS', '--password-stdin', authData.proxyEndpoint], {
-                stdin: password,
-                quiet: true,
+            const host = new URL(authData.proxyEndpoint).host;
+            const session = await createDockerRegistrySession({
+                registryHost: host,
+                credentialProvider: async () => ({ username: 'AWS', password }),
+                timeout,
+                ...(signal ? { signal } : {}),
             });
             logger.info('Authenticated with ECR', { endpoint: authData.proxyEndpoint });
             if (!this.resolvedAccountId) {
@@ -56,6 +59,7 @@ export class EcrRegistryHandler {
                 if (match?.[1])
                     this.resolvedAccountId = match[1];
             }
+            return session;
         }
         catch (error) {
             if (error instanceof ContainerBuildError)
@@ -63,19 +67,6 @@ export class EcrRegistryHandler {
             throw ContainerBuildError.ecrAuthFailed(error instanceof Error ? error : new Error(String(error)));
         }
     }
-    async push(imageUri, imageName) {
-        if (this.config.createRepository !== false) {
-            await this.ensureRepositoryExists(imageName);
-        }
-        try {
-            await execDocker(['push', imageUri]);
-            logger.info('Image pushed to ECR', { imageUri });
-            return true;
-        }
-        catch (error) {
-            throw ContainerBuildError.pushFailed(imageUri, error instanceof Error ? error : new Error(String(error)));
-        }
-    }
     async getAccountId() {
         if (this.config.accountId)
             return this.config.accountId;

package/dist/core/containers/registries/ecr.js.map

@@ -1 +1 @@
-{"version":3,"file":"ecr.js","sourceRoot":"","sources":["../../../../src/core/containers/registries/ecr.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,SAAS,EACT,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAGxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;AAE5D,MAAM,OAAO,kBAAkB;IAMA;IALrB,iBAAiB,CAAqB;IACtC,cAAc,CAAS;IACvB,kBAAkB,CAAgC;IAClD,SAAS,CAAY;IAE7B,YAA6B,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;QACpD,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,MAAM;eAC9B,OAAO,CAAC,GAAG,CAAC,UAAU;eACtB,OAAO,CAAC,GAAG,CAAC,kBAAkB;eAC9B,WAAW,CAAC;QACjB,IAAI,CAAC,kBAAkB,GAAG,qBAAqB,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC;YAC7B,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,WAAW,EAAE,IAAI,CAAC,kBAAkB;SACrC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,GAAW;QAClD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,OAAO,GAAG,SAAS,YAAY,IAAI,CAAC,cAAc,kBAAkB,SAAS,IAAI,GAAG,EAAE,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,4BAA4B,CAAC,EAAE,CAAC,CAAC,CAAC;YACrF,MAAM,QAAQ,GAAG,YAAY,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,CAAC;YACrD,IAAI,CAAC,QAAQ,EAAE,kBAAkB,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC9E,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,UAAU,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;YAE/C,MAAM,UAAU,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC,aAAa,CAAC,EAAE;gBAC3F,KAAK,EAAE,QAAQ;gBACf,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;YAE5E,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBACzE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;oBAAE,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mBAAmB;gBAAE,MAAM,KAAK,CAAC;YACtD,MAAM,mBAAmB,CAAC,aAAa,CACrC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,SAAiB;QAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,KAAK,KAAK,EAAE,CAAC;YAC3C,MAAM,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,mBAAmB,CAAC,UAAU,CAClC,QAAQ,EACR,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACxD,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAE1D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;gBACxB,MAAM,EAAE,IAAI,CAAC,cAAc;gBAC3B,WAAW,EAAE,IAAI,CAAC,kBAAkB;aACrC,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,QAAQ,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACrE,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,OAAO,CAAC;YAC1C,OAAO,QAAQ,CAAC,OAAO,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,mBAAmB,CAAC,aAAa,CACrC,IAAI,KAAK,CACP,kGAAkG;gBAClG,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,QAAgB;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,2BAA2B,CAAC,EAAE,eAAe,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9F,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAK,KAA2B,CAAC,IAAI,KAAK,6BAA6B,EAAE,CAAC;gBACxE,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACrD,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,mBAAmB,CAC3B,oCAAoC,QAAQ,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC1G,sBAAsB,EACtB;oBACE,wFAAwF;oBACxF,oEAAoE;iBACrE,EACD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"ecr.js","sourceRoot":"","sources":["../../../../src/core/containers/registries/ecr.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,SAAS,EACT,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAGlE,MAAM,MAAM,GAAG,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;AAE5D,MAAM,OAAO,kBAAkB;IAMA;IALrB,iBAAiB,CAAqB;IACtC,cAAc,CAAS;IACvB,kBAAkB,CAAgC;IAClD,SAAS,CAAY;IAE7B,YAA6B,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;QACpD,IAAI,CAAC,cAAc;YACjB,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,WAAW,CAAC;QAC3F,IAAI,CAAC,kBAAkB,GAAG,qBAAqB,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC;YAC7B,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,WAAW,EAAE,IAAI,CAAC,kBAAkB;SACrC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,GAAW;QAClD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,OAAO,GAAG,SAAS,YAAY,IAAI,CAAC,cAAc,kBAAkB,SAAS,IAAI,GAAG,EAAE,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,OAAO,CACX,SAAiB,EACjB,OAAe,EACf,MAAoB;QAEpB,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,KAAK,KAAK;YAAE,MAAM,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QACzF,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,4BAA4B,CAAC,EAAE,CAAC,CAAC,CAAC;YACrF,MAAM,QAAQ,GAAG,YAAY,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,CAAC;YACrD,IAAI,CAAC,QAAQ,EAAE,kBAAkB,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC9E,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,UAAU,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC;YAClD,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;gBAChD,YAAY,EAAE,IAAI;gBAClB,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;gBAC/D,OAAO;gBACP,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9B,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;YAE5E,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBACzE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;oBAAE,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACpD,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mBAAmB;gBAAE,MAAM,KAAK,CAAC;YACtD,MAAM,mBAAmB,CAAC,aAAa,CACrC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACxD,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAE1D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;gBACxB,MAAM,EAAE,IAAI,CAAC,cAAc;gBAC3B,WAAW,EAAE,IAAI,CAAC,kBAAkB;aACrC,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,QAAQ,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACrE,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,OAAO,CAAC;YAC1C,OAAO,QAAQ,CAAC,OAAO,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,mBAAmB,CAAC,aAAa,CACrC,IAAI,KAAK,CACP,kGAAkG;gBAChG,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACrE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,QAAgB;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,2BAA2B,CAAC,EAAE,eAAe,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9F,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAK,KAA2B,CAAC,IAAI,KAAK,6BAA6B,EAAE,CAAC;gBACxE,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACrD,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,mBAAmB,CAC3B,oCAAoC,QAAQ,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC1G,sBAAsB,EACtB;oBACE,wFAAwF;oBACxF,oEAAoE;iBACrE,EACD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/core/containers/registries/harbor.d.ts

@@ -0,0 +1,7 @@
+import type { HarborRegistryConfig, OciRegistryConfig } from './types.js';
+/**
+ * Configure Harbor as an OCI transport. Harbor API lifecycle (projects and robot accounts) remains
+ * in the Harbor integration rather than leaking into this generic registry boundary.
+ */
+export declare function harbor(config: HarborRegistryConfig): OciRegistryConfig;
+//# sourceMappingURL=harbor.d.ts.map

package/dist/core/containers/registries/harbor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harbor.d.ts","sourceRoot":"","sources":["../../../../src/core/containers/registries/harbor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE1E;;;GAGG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,oBAAoB,GAAG,iBAAiB,CAGtE"}

package/dist/core/containers/registries/harbor.js

@@ -0,0 +1,9 @@
+/**
+ * Configure Harbor as an OCI transport. Harbor API lifecycle (projects and robot accounts) remains
+ * in the Harbor integration rather than leaking into this generic registry boundary.
+ */
+export function harbor(config) {
+    const { project, ...registry } = config;
+    return { type: 'oci', ...registry, repositoryPrefix: project };
+}
+//# sourceMappingURL=harbor.js.map

package/dist/core/containers/registries/harbor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harbor.js","sourceRoot":"","sources":["../../../../src/core/containers/registries/harbor.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,MAA4B;IACjD,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;IACxC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;AACjE,CAAC"}

package/dist/core/containers/registries/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/containers/registries/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElE,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,eAAe,CAavE;AAED,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/containers/registries/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElE,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,eAAe,CAiBvE;AAED,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}

package/dist/core/containers/registries/index.js

@@ -5,6 +5,7 @@
  */
 import { ContainerBuildError } from '../errors.js';
 import { EcrRegistryHandler } from './ecr.js';
+import { OciRegistryHandler } from './oci.js';
 import { OrbstackRegistryHandler } from './orbstack.js';
 export function resolveRegistry(config) {
     switch (config.type) {
@@ -12,6 +13,10 @@ export function resolveRegistry(config) {
             return new OrbstackRegistryHandler();
         case 'ecr':
             return new EcrRegistryHandler(config);
+        case 'oci':
+            return new OciRegistryHandler(config);
+        case 'custom':
+            return config.handler;
         case 'gcr':
             throw ContainerBuildError.registryNotSupported('gcr');
         case 'acr':

package/dist/core/containers/registries/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/containers/registries/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAGxD,MAAM,UAAU,eAAe,CAAC,MAAsB;IACpD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,IAAI,uBAAuB,EAAE,CAAC;QACvC,KAAK,KAAK;YACR,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACxC,KAAK,KAAK;YACR,MAAM,mBAAmB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACxD,KAAK,KAAK;YACR,MAAM,mBAAmB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACxD;YACE,MAAM,mBAAmB,CAAC,oBAAoB,CAAC,MAAM,CAAE,MAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/containers/registries/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAGxD,MAAM,UAAU,eAAe,CAAC,MAAsB;IACpD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,IAAI,uBAAuB,EAAE,CAAC;QACvC,KAAK,KAAK;YACR,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACxC,KAAK,KAAK;YACR,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACxC,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,KAAK,KAAK;YACR,MAAM,mBAAmB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACxD,KAAK,KAAK;YACR,MAAM,mBAAmB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACxD;YACE,MAAM,mBAAmB,CAAC,oBAAoB,CAAC,MAAM,CAAE,MAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC"}

package/dist/core/containers/registries/oci.d.ts

@@ -0,0 +1,13 @@
+import type { OciRegistryConfig, RegistryHandler, RegistrySession } from './types.js';
+export declare function normalizeRegistryHost(value: string): string;
+export declare class OciRegistryHandler implements RegistryHandler {
+    private readonly config;
+    readonly registryHost: string;
+    readonly repositoryPrefix: string | undefined;
+    constructor(config: OciRegistryConfig);
+    resolveImageUri(imageName: string, tag: string): Promise<string>;
+    prepare(_imageName: string, timeout: number, signal?: AbortSignal): Promise<RegistrySession>;
+}
+/** Create a generic OCI registry config with inferred discriminant. */
+export declare function ociRegistry(config: Omit<OciRegistryConfig, 'type'>): OciRegistryConfig;
+//# sourceMappingURL=oci.d.ts.map

package/dist/core/containers/registries/oci.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci.d.ts","sourceRoot":"","sources":["../../../../src/core/containers/registries/oci.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEtF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAc3D;AAcD,qBAAa,kBAAmB,YAAW,eAAe;IAI5C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;gBAEjB,MAAM,EAAE,iBAAiB;IA8BhD,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKhE,OAAO,CACX,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,eAAe,CAAC;CAY5B;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,GAAG,iBAAiB,CAEtF"}

package/dist/core/containers/registries/oci.js

@@ -0,0 +1,68 @@
+import { ContainerBuildError } from '../errors.js';
+import { createDockerRegistrySession } from './docker-session.js';
+export function normalizeRegistryHost(value) {
+    const parsed = new URL(value.includes('://') ? value : `https://${value}`);
+    if (parsed.pathname !== '/' ||
+        parsed.search ||
+        parsed.hash ||
+        parsed.username ||
+        parsed.password) {
+        throw new ContainerBuildError(`Invalid OCI registry origin: "${value}".`, 'INVALID_REGISTRY', [
+            'Provide only a registry origin or host. Put the project in repositoryPrefix.',
+        ]);
+    }
+    return parsed.host;
+}
+function normalizeRepositoryPrefix(value) {
+    if (!value)
+        return undefined;
+    const normalized = value.replace(/^\/+|\/+$/g, '').toLowerCase();
+    if (!/^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$/.test(normalized)) {
+        throw new ContainerBuildError(`Invalid OCI repository prefix: "${value}".`, 'INVALID_REGISTRY_PREFIX');
+    }
+    return normalized;
+}
+export class OciRegistryHandler {
+    config;
+    registryHost;
+    repositoryPrefix;
+    constructor(config) {
+        this.config = config;
+        this.registryHost = normalizeRegistryHost(config.registry);
+        this.repositoryPrefix = normalizeRepositoryPrefix(config.repositoryPrefix);
+        const explicitProtocol = config.registry
+            .match(/^([a-z][a-z0-9+.-]*):\/\//i)?.[1]
+            ?.toLowerCase();
+        if (config.tls?.plainHttp && explicitProtocol === 'https') {
+            throw new ContainerBuildError('OCI registry cannot use plainHttp with an https:// registry origin.', 'INVALID_REGISTRY_TLS');
+        }
+        if (explicitProtocol === 'http' && !config.tls?.plainHttp) {
+            throw new ContainerBuildError('OCI registry with an http:// origin must explicitly enable tls.plainHttp.', 'INVALID_REGISTRY_TLS', ['Use HTTPS, or acknowledge a development-only HTTP registry with tls.plainHttp.']);
+        }
+        if (config.tls?.plainHttp &&
+            (config.tls.caCertificate || config.tls.caFile || config.tls.insecure)) {
+            throw new ContainerBuildError('OCI plainHttp cannot be combined with HTTPS CA or insecure-TLS options.', 'INVALID_REGISTRY_TLS');
+        }
+    }
+    async resolveImageUri(imageName, tag) {
+        const path = this.repositoryPrefix ? `${this.repositoryPrefix}/${imageName}` : imageName;
+        return `${this.registryHost}/${path}:${tag}`;
+    }
+    async prepare(_imageName, timeout, signal) {
+        return createDockerRegistrySession({
+            registryHost: this.registryHost,
+            timeout,
+            ...(this.config.credentialProvider
+                ? { credentialProvider: this.config.credentialProvider }
+                : {}),
+            ...(this.config.dockerConfigPath ? { dockerConfigPath: this.config.dockerConfigPath } : {}),
+            ...(this.config.tls ? { tls: this.config.tls } : {}),
+            ...(signal ? { signal } : {}),
+        });
+    }
+}
+/** Create a generic OCI registry config with inferred discriminant. */
+export function ociRegistry(config) {
+    return { type: 'oci', ...config };
+}
+//# sourceMappingURL=oci.js.map

package/dist/core/containers/registries/oci.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci.js","sourceRoot":"","sources":["../../../../src/core/containers/registries/oci.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAGlE,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;IAC3E,IACE,MAAM,CAAC,QAAQ,KAAK,GAAG;QACvB,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,QAAQ,EACf,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,KAAK,IAAI,EAAE,kBAAkB,EAAE;YAC5F,8EAA8E;SAC/E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAyB;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjE,IAAI,CAAC,mEAAmE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,mBAAmB,CAC3B,mCAAmC,KAAK,IAAI,EAC5C,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,OAAO,kBAAkB;IAIA;IAHpB,YAAY,CAAS;IACrB,gBAAgB,CAAqB;IAE9C,YAA6B,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;QACpD,IAAI,CAAC,YAAY,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,gBAAgB,GAAG,yBAAyB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC3E,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ;aACrC,KAAK,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC,CAAC;YACzC,EAAE,WAAW,EAAE,CAAC;QAClB,IAAI,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,gBAAgB,KAAK,OAAO,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,CAC3B,qEAAqE,EACrE,sBAAsB,CACvB,CAAC;QACJ,CAAC;QACD,IAAI,gBAAgB,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,CAC3B,2EAA2E,EAC3E,sBAAsB,EACtB,CAAC,gFAAgF,CAAC,CACnF,CAAC;QACJ,CAAC;QACD,IACE,MAAM,CAAC,GAAG,EAAE,SAAS;YACrB,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EACtE,CAAC;YACD,MAAM,IAAI,mBAAmB,CAC3B,yEAAyE,EACzE,sBAAsB,CACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,GAAW;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,gBAAgB,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,OAAO,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,OAAO,CACX,UAAkB,EAClB,OAAe,EACf,MAAoB;QAEpB,OAAO,2BAA2B,CAAC;YACjC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,OAAO;YACP,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB;gBAChC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE;gBACxD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,MAAuC;IACjE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC;AACpC,CAAC"}

package/dist/core/containers/registries/orbstack.d.ts

@@ -5,10 +5,9 @@
  * built-in Kubernetes cluster. No push step is needed — `docker build` is
  * sufficient.
  */
-import type { RegistryHandler } from './types.js';
+import type { RegistryHandler, RegistrySession } from './types.js';
 export declare class OrbstackRegistryHandler implements RegistryHandler {
     resolveImageUri(imageName: string, tag: string): Promise<string>;
-    authenticate(): Promise<void>;
-    push(_imageUri: string, _imageName: string): Promise<boolean>;
+    prepare(_imageName: string, _timeout: number, _signal?: AbortSignal): Promise<RegistrySession>;
 }
 //# sourceMappingURL=orbstack.d.ts.map

package/dist/core/containers/registries/orbstack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orbstack.d.ts","sourceRoot":"","sources":["../../../../src/core/containers/registries/orbstack.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD,qBAAa,uBAAwB,YAAW,eAAe;IACvD,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIhE,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAK7B,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAKpE"}
+{"version":3,"file":"orbstack.d.ts","sourceRoot":"","sources":["../../../../src/core/containers/registries/orbstack.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAInE,qBAAa,uBAAwB,YAAW,eAAe;IACvD,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIhE,OAAO,CACX,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,eAAe,CAAC;CAS5B"}

package/dist/core/containers/registries/orbstack.js

@@ -11,14 +11,14 @@ export class OrbstackRegistryHandler {
     async resolveImageUri(imageName, tag) {
         return `${imageName}:${tag}`;
     }
-    async authenticate() {
-        // No authentication needed — Orbstack uses the local Docker daemon.
-        logger.debug('Orbstack registry: no authentication needed');
-    }
-    async push(_imageUri, _imageName) {
-        // No push needed — images built locally are auto-available to Orbstack K8s.
-        logger.debug('Orbstack registry: skipping push (images auto-available to local K8s)');
-        return false;
+    async prepare(_imageName, _timeout, _signal) {
+        logger.debug('Orbstack registry: using local Docker image availability');
+        return {
+            remote: false,
+            async cleanup() {
+                // Local OrbStack builds create no temporary registry session.
+            },
+        };
     }
 }
 //# sourceMappingURL=orbstack.js.map

package/dist/core/containers/registries/orbstack.js.map

@@ -1 +1 @@
-{"version":3,"file":"orbstack.js","sourceRoot":"","sources":["../../../../src/core/containers/registries/orbstack.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAG5D,MAAM,MAAM,GAAG,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;AAEjE,MAAM,OAAO,uBAAuB;IAClC,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,GAAW;QAClD,OAAO,GAAG,SAAS,IAAI,GAAG,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,oEAAoE;QACpE,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,UAAkB;QAC9C,4EAA4E;QAC5E,MAAM,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;QACtF,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}
+{"version":3,"file":"orbstack.js","sourceRoot":"","sources":["../../../../src/core/containers/registries/orbstack.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAG5D,MAAM,MAAM,GAAG,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;AAEjE,MAAM,OAAO,uBAAuB;IAClC,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,GAAW;QAClD,OAAO,GAAG,SAAS,IAAI,GAAG,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,OAAO,CACX,UAAkB,EAClB,QAAgB,EAChB,OAAqB;QAErB,MAAM,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;QACzE,OAAO;YACL,MAAM,EAAE,KAAK;YACb,KAAK,CAAC,OAAO;gBACX,8DAA8D;YAChE,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}