Module registry_auth 

Registry-credential resolution shared by the API pull handlers and the agent’s supervisor recreate path.

This lives in zlayer-secrets (rather than zlayer-api, its historical home) because it is fundamentally a credential-store concern and both consumers — zlayer-api (the /images/pull + container-create handlers) and zlayer-agent (the supervisor’s pull_and_refresh_digest) — already depend on zlayer-secrets, whereas the agent cannot depend on zlayer-api (that edge runs the other way). zlayer-api re-exports both functions from zlayer_api::auth for source compatibility.

Functions

resolve_registry_auth_async

Resolve registry authentication asynchronously, handling zlayer_core::auth::AuthSource::SecretStore via the provided credential store.

resolve_stored_registry_auth

Resolve registry auth for an image’s host from the stored credential store, with a Docker-config fallback.