registry

type AuthConfig struct {
	// Order is the chain; empty means DefaultAuthOrder.
	Order []AuthSource
	// ClusterSecret is "namespace/name" of the pull secret the cluster source reads.
	// Empty means the cluster source is skipped.
	ClusterSecret string
	// OpRef is the 1Password reference the op source reads. Empty means op is skipped and
	// nothing is executed.
	OpRef string
	// Cluster reads ClusterSecret; required when ClusterSecret is set.
	Cluster k8s.Cluster
	// Keychain is the keychain source; nil means go-containerregistry's DefaultKeychain
	// (Docker config and credential helpers). Tests substitute one.
	Keychain authn.Keychain
	// Transport is the HTTP transport; nil means go-containerregistry's default. Tests
	// point it at an in-memory registry.
	Transport http.RoundTripper
}

type AuthReporter interface {
	AuthSourceUsed() string
	// Consulted reports whether at least one request was attempted — whether or not it
	// succeeded. A caller that only checks AuthSourceUsed cannot tell "never asked" from
	// "asked, every source failed" apart: both report "".
	Consulted() bool
}

type AuthSource string

type Client struct {
	// contains filtered or unexported fields
}

type Fake struct {
	Digests  map[string]string
	TagLists map[string][]string
	Configs  map[string]ImageMeta
	Err      error
	Auth     string
	Calls    []string
	// contains filtered or unexported fields
}

type ImageMeta struct {
	// Digest is the top-level digest Head would also return for this ref: the image index
	// digest for a multi-arch tag, never one platform manifest's (see the package doc's note
	// on Head for why that is the digest a pod's imageID reports). This is deliberately not
	// the digest of whatever platform-specific manifest Created/Labels were actually read
	// from — see configPlatform's doc comment — so that a cache keyed by ImageMeta.Digest
	// (cache.go) is keyed by exactly the same value every other digest-keyed thing in this
	// codebase uses (Head, a pod's imageID, image.Ref.Digest).
	Digest  string
	Created time.Time
	Labels  map[string]string
}

type PerRepo interface {
	Registry
	// ForRepo returns the Registry scoped to repo, or nil when repo has no configured
	// registry at all (a repo with no registries[] entry still gets a Registry — a
	// default chain with no cluster or op link — so nil is rare, not the common case of
	// "unmatched").
	ForRepo(repo string) Registry
}

type Registry interface {
	// Head returns the digest of ref (repo:tag, or repo@digest which is returned as is
	// after the registry confirms it). See the package doc for multi-arch images.
	Head(ctx context.Context, ref image.Ref) (digest string, err error)
	// Tags lists the tags of repo, sorted; registries return them in no useful order
	// (AGENTS.md §6.1).
	Tags(ctx context.Context, repo string) ([]string, error)
	// Config returns ref's image metadata — digest, Created, Labels — read from its config
	// blob (config.go). Added for M6's tag picker: a picker column needs more than Head's
	// bare digest, and needs it per candidate tag without a second, hand-rolled client.
	Config(ctx context.Context, ref image.Ref) (ImageMeta, error)
}