[pull] main from cloudflare:main

.changeset/plenty-paws-rest.md

@@ -0,0 +1,8 @@
+---
+"@cloudflare/containers-shared": patch
+"wrangler": patch
+---
+
+add library-push flag to containers registries credentials
+
+This flag is not available for public use.

AGENTS.md

@@ -96,14 +96,14 @@ This is the **Cloudflare Workers SDK** monorepo containing tools and libraries f
 - Use `node:` prefix for Node.js imports (`import/enforce-node-protocol-usage`)
 - Prefix unused variables with `_`
 - No `.only()` in tests (`no-only-tests/no-only-tests`)
-- Format with Prettier - run `pnpm prettify` in the workspace root before committing
+- Format with oxfmt - run `pnpm prettify` in the workspace root before committing
 - All changes to published packages require a changeset (see below)
 
-**Formatting (Prettier):**
+**Formatting (oxfmt):**
 
 - Tabs (not spaces), double quotes, semicolons, trailing commas (es5)
 - Import order enforced: builtins → third-party → parent → sibling → index → types
-- `prettier-plugin-packagejson` sorts package.json keys
+- `sortPackageJson` option sorts package.json keys
 
 **Security:**
 

packages/containers-shared/src/client/models/ImageRegistryPermissions.ts

@@ -5,4 +5,5 @@
 export enum ImageRegistryPermissions {
 	PULL = "pull",
 	PUSH = "push",
+	LIBRARY_PUSH = "library_push",
 }

packages/create-cloudflare/AGENTS.md

@@ -19,7 +19,6 @@ Project scaffolding CLI for Cloudflare Workers. Single entry: `src/cli.ts` serve
 ## CONVENTIONS
 
 - `no-console: error` — use project's logging utilities
-- Own `.prettierrc` — same settings as root but without `prettier-plugin-packagejson`
 - Templates excluded from linting (except `c3.ts` files within templates)
 - Templates excluded from formatting (except hello-world templates)
 

packages/wrangler/src/__tests__/containers/registries.test.ts

@@ -894,6 +894,19 @@ describe("containers registries credentials", () => {
 		expect(std.out).toMatchInlineSnapshot(`"custom-expiry-token"`);
 	});
 
+	it("should generate credentials with --library-push", async () => {
+		setIsTTY(false);
+		mockGenerateCredentials("registry.cloudflare.com", "test-password", 15, [
+			"library_push",
+		]);
+
+		await runWrangler(
+			"containers registries credentials registry.cloudflare.com --library-push"
+		);
+
+		expect(std.out).toMatchInlineSnapshot(`"test-password"`);
+	});
+
 	it("should output valid JSON when --json flag is used", async () => {
 		setIsTTY(false);
 		mockGenerateCredentials("registry.cloudflare.com", "test-password", 15, [

packages/wrangler/src/containers/registries.ts

@@ -501,6 +501,7 @@ async function registryCredentialsCommand(credentialsArgs: {
 	expirationMinutes: number;
 	push?: boolean;
 	pull?: boolean;
+	libraryPush?: boolean;
 	json?: boolean;
 }) {
 	const cloudflareRegistry = getCloudflareContainerRegistry();
@@ -511,7 +512,11 @@ async function registryCredentialsCommand(credentialsArgs: {
 		);
 	}
 
-	if (!credentialsArgs.pull && !credentialsArgs.push) {
+	if (
+		!credentialsArgs.pull &&
+		!credentialsArgs.push &&
+		!credentialsArgs.libraryPush
+	) {
 		throw new UserError(
 			"You have to specify either --push or --pull in the command."
 		);
@@ -523,6 +528,7 @@ async function registryCredentialsCommand(credentialsArgs: {
 			permissions: [
 				...(credentialsArgs.push ? ["push"] : []),
 				...(credentialsArgs.pull ? ["pull"] : []),
+				...(credentialsArgs.libraryPush ? ["library_push"] : []),
 			] as ImageRegistryPermissions[],
 		});
 	if (credentialsArgs.json) {
@@ -623,6 +629,12 @@ export const containersRegistriesCredentialsCommand = createCommand({
 			type: "boolean",
 			description: "If you want these credentials to be able to pull",
 		},
+		"library-push": {
+			type: "boolean",
+			description:
+				"If you want these credentials to be able to push to the public library namespace",
+			hidden: true,
+		},
 		json: {
 			type: "boolean",
 			description: "Format output as JSON",