@bensandee/tooling 0.12.0 → 0.14.0

package/CHANGELOG.md

@@ -0,0 +1,215 @@
+# @bensandee/tooling
+
+## 0.14.0
+
+### Minor Changes
+
+- e95d449: Add `--fail-fast` / `--no-fail-fast` flag to `checks:run` to control whether execution stops on the first failure. Defaults to fail-fast in dev and continue-on-error in CI.
+- 715a4ea: Add `@bensandee/tooling/docker-verify` subpath export: a TypeScript framework for Docker image verification with compose lifecycle management, HTTP health polling, container health monitoring, and signal-safe cleanup. Consumers import building blocks and compose them with custom validators instead of writing boilerplate.
+- 27c3480: Add `release:simple` command and rename CLI subcommands
+
+  **Breaking changes:**
+
+  - `release:create-forgejo-release` renamed to `forgejo:create-release`
+  - `release:merge` renamed to `changesets:merge`
+  - `releaseStrategy: "commit-and-tag-version"` renamed to `"simple"` in `.tooling.json` config
+  - Generated CI workflow for commit-and-tag-version now uses `pnpm exec tooling release:simple` instead of inline shell commands
+
+  **New feature:**
+
+  `release:simple` — a CLI command that handles the full release lifecycle for projects using commit-and-tag-version:
+
+  - Runs `commit-and-tag-version` to bump version, update CHANGELOG, and create a git tag
+  - Pushes to origin with `--follow-tags`
+  - Creates sliding version tags (vX, vX.Y) for flexible deployment pinning
+  - Creates Forgejo or GitHub releases automatically
+
+### Patch Changes
+
+- 715a4ea: Add README files to all published packages for npm registry documentation
+- 27c3480: Pre-populate `repo:init` prompts from saved `.tooling.json` config
+
+  When re-running `repo:init` on a project with an existing `.tooling.json`, each prompt now defaults to the previously saved choice instead of the detection-based default. Press Enter to keep existing settings or change only what you need.
+
+- d448ec6: Update node tsconfig base to use `nodenext` module resolution with `allowImportingTsExtensions`, enabling `.ts` extensions in imports for projects running TypeScript natively on Node 24+. Migrate all tooling-cli imports to use `.ts` extensions and switch `#src` subpath mapping to `#src/*.ts`. Use extensionless imports for library packages.
+- c49593f: Add `commit-and-tag-version` and `@changesets/cli` as optional dependencies
+
+  These tools are only needed when using their respective release strategies, so they're optional rather than required. Target projects already install them as devDependencies via the package-json generator.
+
+- Updated dependencies [715a4ea]
+- Updated dependencies [d448ec6]
+  - @bensandee/common@0.1.1
+
+## 0.13.0
+
+### Minor Changes
+
+- bbe3634: Add `checks:run` command (renamed from `repo:run-checks`). Add `ci:check`, `tooling:check`, and `tooling:update` as generated package.json scripts. CI workflows now run `pnpm ci:check`. Managed scripts are updated on `repo:update`/`repo:check` if they don't reference the expected command.
+
+### Patch Changes
+
+- f20b25d: `checks:run` now reads package.json to detect which scripts are defined. Undefined scripts show "(not defined)" instead of silently passing. Commands use `pnpm run` instead of `pnpm run --if-present`.
+
+## 0.12.0
+
+### Minor Changes
+
+- 5de6090: Add `repo:run-checks` command that runs all standard checks (build, typecheck, lint, test, format, knip, tooling:check, image:check) without short-circuiting, reporting a summary of failures at the end. Supports `--skip` to skip specific checks and `--add` to append custom checks. Generated CI workflows now use `pnpm check`, and the package.json generator produces `check` and `tooling:check` scripts pointing to this command. Managed scripts (`check`, `tooling:check`) are updated on `repo:update`/`repo:check` if they don't already reference the expected command.
+
+## 0.11.0
+
+### Minor Changes
+
+- 493ae65: Add `repo:run-checks` command that runs all standard checks (build, typecheck, lint, test, format, knip, repo:check) without short-circuiting, reporting a summary of failures at the end. Generated CI workflows and package.json `check` scripts now use this command. Skip `trigger-release` script for changesets release strategy.
+
+### Patch Changes
+
+- ae18571: Add .pnpm-store to gitignore file
+- 916c1ee: Ensure `yaml-language-server` schema comment is added to existing Forgejo workflow files during update/merge
+
+## 0.10.1
+
+### Patch Changes
+
+- f131a3d: Add `pnpm why` to the allowed Bash commands in generated Claude settings
+- 1cb2ce8: Add yaml-language-server schema comments to generated Forgejo workflow files and update schema glob to match both .yml and .yaml extensions
+
+## 0.10.0
+
+### Minor Changes
+
+- 34a0e1e: feat: merge missing config into existing lefthook and CI workflow files instead of skipping
+
+  Generators for `lefthook.yml`, CI check workflows, and release workflows now merge required
+  entries into existing files rather than silently skipping them. This means `repo:update` can
+  add new steps (e.g. a newly required CI check) to repos that were initialized before the step
+  existed.
+
+  Add `# @bensandee/tooling:ignore` in the first 10 lines of any YAML file to opt out of
+  automatic merging.
+
+### Patch Changes
+
+- 330cc2c: fix: use semantic JSON comparison in repo:check and repo:update to ignore formatting-only differences
+
+## 0.9.0
+
+### Minor Changes
+
+- 88f2a93: Require `.tooling.json` for `repo:update` and `repo:check` commands. Previously these commands would warn and continue with detected defaults when `.tooling.json` was missing, which could cause unexpected overwrites without proper archiving. Now they exit with an error directing the user to run `tooling repo:init` first.
+
+  Write Forgejo workflow schema mapping to `.code-workspace` file when present, falling back to `.vscode/settings.json`. The `yaml.schemas` setting in `.vscode/settings.json` doesn't apply in VS Code multi-root workspaces.
+
+  Improve post-init guidance: suggest a Claude Code prompt ("Execute the steps in .tooling-migrate.md") instead of "paste contents".
+
+## 0.8.1
+
+### Patch Changes
+
+- efcfdcc: Fix findOpenPr to filter PRs client-side by head.ref instead of relying on Forgejo's inconsistent head query parameter, which could match the wrong PR
+- 88aac23: Add forgejo workflow schema additions
+- e4c41d6: Fix wrong agent name in settings.json for claude
+- 43509b8: Pin @bensandee/\* package versions in generated package.json instead of using "latest". Versions are read from sibling package.json files at build time via tsdown's define feature, so they auto-update with each release.
+- 5e65e50: enhance ciWorkflow to support Forgejo email notifications
+- 60a5502: refactor generateClaudeSettings to handle monorepo structure and update tests for plugin integration
+
+## 0.8.0
+
+### Minor Changes
+
+- 375f7fd: Add claude skills to settings.json
+
+### Patch Changes
+
+- 375098b: Add more safety restrictions to settings.json
+- b330adf: Fix bad update to tsconfig when not needed
+
+## 0.7.3
+
+### Patch Changes
+
+- 3257e04: Fix no-unsafe-json-parse rule and fix new lint errors
+- ca61fa7: Don't overwrite existing oxfmt config
+- 1bdf858: More intelligent addition of src folder to tsconfig
+- 8de49b9: Add line about adding packages when necessary to resolve errors
+
+## 0.7.2
+
+### Patch Changes
+
+- e48bc27: Fix bug where tsconfigs in packages would be force-updated even if solutions-style
+
+## 0.7.1
+
+### Patch Changes
+
+- 6ef4ea9: Fix tsconfig build/update issues
+- 3608a1a: Run pnpm update after repo:update
+
+## 0.7.0
+
+### Minor Changes
+
+- 912013d: Add repo:check command
+- 2545262: Add common package + error subclasses
+
+### Patch Changes
+
+- Updated dependencies [2545262]
+  - @bensandee/common@0.1.0
+
+## 0.6.2
+
+### Patch Changes
+
+- caa1270: Fix hang migrating repo:init
+
+## 0.6.1
+
+### Patch Changes
+
+- 2182ab3: fix bug where renovate.json5 wasn't cleaned up to use our preset
+- d811a96: Lefthook doesn't need an install step in package.json prepare
+
+## 0.6.0
+
+### Minor Changes
+
+- 94cd161: Updated default oxlint config to include more default rules.
+
+## 0.5.1
+
+### Patch Changes
+
+- e0bc32e: Improve migration for tsconfig and husky/lint-staged
+- 02c1a1b: Include version when running tooling cli
+
+## 0.5.0
+
+### Minor Changes
+
+- 58fc8a3: Add lefthook support in place of husky, lint-staged
+
+## 0.4.0
+
+### Minor Changes
+
+- e02953a: Bug fixing, move renovate config to standard location
+- 451908d: Restructure package names and exports.
+
+## 0.3.0
+
+### Minor Changes
+
+- 5e9719f: Many bug fixes
+
+## 0.2.0
+
+### Minor Changes
+
+- c376981: Initial release
+
+### Patch Changes
+
+- 3fc9fe3: Support multiple release architectures (release-it, commit-and-tag-version and changsets)
+- 4004530: Add release-forgejo command to perform final steps of release creation in forgejo.

package/README.md

@@ -0,0 +1,121 @@
+# @bensandee/tooling
+
+CLI to bootstrap and maintain standardized TypeScript project tooling.
+
+## Installation
+
+```bash
+pnpm add -D @bensandee/tooling
+
+# Or run directly
+pnpm dlx @bensandee/tooling repo:init
+```
+
+## CLI commands
+
+### Project management
+
+| Command                     | Description                                                                                                             |
+| --------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
+| `tooling repo:init [dir]`   | Interactive setup wizard. Flags: `--yes` (accept defaults), `--no-ci`, `--no-prompt`. Saves choices to `.tooling.json`. |
+| `tooling repo:update [dir]` | Add missing config files (never overwrites existing files).                                                             |
+| `tooling repo:check [dir]`  | Dry-run drift detection. Exits 1 if files would change. CI-friendly.                                                    |
+| `tooling checks:run`        | Run project checks (build, typecheck, lint, knip, test). Flag: `--fail-fast`.                                           |
+
+### Release management
+
+| Command                          | Description                                                                                                                     |
+| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
+| `tooling release:changesets`     | Changesets version/publish for Forgejo CI. Flag: `--dry-run`. Env: `FORGEJO_SERVER_URL`, `FORGEJO_REPOSITORY`, `FORGEJO_TOKEN`. |
+| `tooling release:simple`         | Streamlined release using commit-and-tag-version.                                                                               |
+| `tooling release:trigger`        | Trigger a release workflow.                                                                                                     |
+| `tooling forgejo:create-release` | Create a Forgejo release from a tag.                                                                                            |
+| `tooling changesets:merge`       | Merge a changesets version PR.                                                                                                  |
+
+## Config file
+
+`repo:init` persists choices to `.tooling.json` at the project root. `repo:check` and `repo:update` read this file to reproduce the same config without re-prompting.
+
+## Library API
+
+The `"."` export provides type-only exports for programmatic use:
+
+```ts
+import type {
+  ProjectConfig,
+  GeneratorResult,
+  GeneratorContext,
+  Generator,
+  DetectedProjectState,
+  LegacyConfig,
+} from "@bensandee/tooling";
+```
+
+| Type                   | Description                                                                                     |
+| ---------------------- | ----------------------------------------------------------------------------------------------- |
+| `ProjectConfig`        | User config shape (persisted in `.tooling.json`)                                                |
+| `GeneratorContext`     | Context passed to generator functions (`exists`, `read`, `write`, `remove`, `confirmOverwrite`) |
+| `GeneratorResult`      | Result from a generator (created/updated/skipped files)                                         |
+| `Generator`            | Generator function signature: `(ctx: GeneratorContext) => Promise<GeneratorResult>`             |
+| `DetectedProjectState` | Detected existing project state (package manager, CI, etc.)                                     |
+| `LegacyConfig`         | Legacy config detection for migration                                                           |
+
+## Docker verification
+
+The `@bensandee/tooling/docker-verify` export provides utilities for verifying Docker Compose stacks via health checks.
+
+### Quick start
+
+```ts
+import { createRealExecutor, runVerification } from "@bensandee/tooling/docker-verify";
+import type { VerifyConfig } from "@bensandee/tooling/docker-verify";
+
+const config: VerifyConfig = {
+  compose: {
+    cwd: "./deploy",
+    composeFiles: ["docker-compose.yaml"],
+    services: ["api", "db"],
+  },
+  buildCommand: "pnpm image:build",
+  healthChecks: [
+    {
+      name: "API",
+      url: "http://localhost:3000/health",
+      validate: async (res) => res.ok,
+    },
+  ],
+  timeoutMs: 120_000,
+  pollIntervalMs: 5_000,
+};
+
+const result = await runVerification(createRealExecutor(), config);
+if (!result.success) {
+  console.error(result.reason, result.message);
+}
+```
+
+### Exports
+
+| Export                                 | Description                                                       |
+| -------------------------------------- | ----------------------------------------------------------------- |
+| `runVerification(executor, config)`    | Full lifecycle: build, compose up, health check polling, teardown |
+| `createRealExecutor()`                 | Production executor (real shell, fetch, timers)                   |
+| `composeUp(executor, config)`          | Start compose services                                            |
+| `composeDown(executor, config)`        | Stop and remove compose services                                  |
+| `composeLogs(executor, config)`        | Stream compose logs                                               |
+| `composePs(executor, config)`          | List running containers                                           |
+| `checkHttpHealth(executor, check)`     | Run a single HTTP health check                                    |
+| `getContainerHealth(executor, config)` | Check container-level health status                               |
+
+### Types
+
+| Type                   | Description                                                                                |
+| ---------------------- | ------------------------------------------------------------------------------------------ |
+| `VerifyConfig`         | Full verification config (compose settings, build command, health checks, timeouts)        |
+| `ComposeConfig`        | Docker Compose settings (cwd, compose files, env file, services)                           |
+| `HttpHealthCheck`      | Health check definition (name, URL, validate function)                                     |
+| `VerifyResult`         | Result: `{ success: true, elapsedMs }` or `{ success: false, reason, message, elapsedMs }` |
+| `DockerVerifyExecutor` | Side-effect abstraction (exec, fetch, timers) for testability                              |
+| `ContainerInfo`        | Container status info from `composePs`                                                     |
+
+## [Changelog](./CHANGELOG.md)

package/dist/bin.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { t as isExecSyncError } from "./exec-CC49vrkM.mjs";
 import { defineCommand, runMain } from "citty";
 import * as p from "@clack/prompts";
 import { execSync } from "node:child_process";
@@ -106,7 +107,7 @@ function detectProject(targetDir) {
 		hasKnipConfig: exists("knip.json") || exists("knip.jsonc") || exists("knip.ts") || exists("knip.mts") || exists("knip.config.ts") || exists("knip.config.mts"),
 		hasRenovateConfig: exists("renovate.json") || exists("renovate.json5") || exists(".renovaterc") || exists(".renovaterc.json") || exists(".github/renovate.json") || exists(".github/renovate.json5"),
 		hasReleaseItConfig: exists(".release-it.json") || exists(".release-it.yaml") || exists(".release-it.toml"),
-		hasCommitAndTagVersionConfig: exists(".versionrc") || exists(".versionrc.json") || exists(".versionrc.js"),
+		hasSimpleReleaseConfig: exists(".versionrc") || exists(".versionrc.json") || exists(".versionrc.js"),
 		hasChangesetsConfig: exists(".changeset/config.json"),
 		legacyConfigs: detectLegacyConfigs(targetDir)
 	};
@@ -208,7 +209,7 @@ function getMonorepoPackages(targetDir) {
 function isCancelled(value) {
 	return p.isCancel(value);
 }
-async function runInitPrompts(targetDir) {
+async function runInitPrompts(targetDir, saved) {
 	p.intro("@bensandee/tooling repo:init");
 	const existingPkg = readPackageJson(targetDir);
 	const detected = detectProject(targetDir);
@@ -217,7 +218,7 @@ async function runInitPrompts(targetDir) {
 	const detectedMonorepo = detectMonorepo(targetDir);
 	const structure = await p.select({
 		message: "Project structure",
-		initialValue: detectedMonorepo ? "monorepo" : "single",
+		initialValue: saved?.structure ?? (detectedMonorepo ? "monorepo" : "single"),
 		options: [{
 			value: "single",
 			label: "Single repo"
@@ -232,7 +233,7 @@ async function runInitPrompts(targetDir) {
 	}
 	const useEslintPlugin = await p.confirm({
 		message: "Include @bensandee/eslint-plugin?",
-		initialValue: true
+		initialValue: saved?.useEslintPlugin ?? true
 	});
 	if (isCancelled(useEslintPlugin)) {
 		p.cancel("Cancelled.");
@@ -241,7 +242,7 @@ async function runInitPrompts(targetDir) {
 	const hasExistingPrettier = detected.legacyConfigs.some((l) => l.tool === "prettier");
 	const formatter = await p.select({
 		message: "Formatter",
-		initialValue: hasExistingPrettier ? "prettier" : "oxfmt",
+		initialValue: saved?.formatter ?? (hasExistingPrettier ? "prettier" : "oxfmt"),
 		options: [{
 			value: "oxfmt",
 			label: "oxfmt",
@@ -257,7 +258,7 @@ async function runInitPrompts(targetDir) {
 	}
 	const setupVitest = await p.confirm({
 		message: "Set up vitest with a starter test?",
-		initialValue: !isExisting
+		initialValue: saved?.setupVitest ?? !isExisting
 	});
 	if (isCancelled(setupVitest)) {
 		p.cancel("Cancelled.");
@@ -265,6 +266,7 @@ async function runInitPrompts(targetDir) {
 	}
 	const ci = await p.select({
 		message: "CI workflow",
+		initialValue: saved?.ci,
 		options: [
 			{
 				value: "forgejo",
@@ -288,7 +290,7 @@ async function runInitPrompts(targetDir) {
 	if (ci === "github") {
 		const renovateAnswer = await p.confirm({
 			message: "Set up Renovate for automated dependency updates?",
-			initialValue: true
+			initialValue: saved?.setupRenovate ?? true
 		});
 		if (isCancelled(renovateAnswer)) {
 			p.cancel("Cancelled.");
@@ -298,7 +300,7 @@ async function runInitPrompts(targetDir) {
 	}
 	const releaseStrategy = await p.select({
 		message: "Release management",
-		initialValue: "none",
+		initialValue: saved?.releaseStrategy ?? "none",
 		options: [
 			{
 				value: "none",
@@ -315,9 +317,9 @@ async function runInitPrompts(targetDir) {
 				hint: "PR-based versioning"
 			},
 			{
-				value: "commit-and-tag-version",
-				label: "commit-and-tag-version",
-				hint: "conventional commits, automatic CHANGELOG"
+				value: "simple",
+				label: "Simple",
+				hint: "uses commit-and-tag-version internally"
 			}
 		]
 	});
@@ -337,7 +339,7 @@ async function runInitPrompts(targetDir) {
 			p.note(detections.join("\n"), "Detected package types");
 			const applyDetected = await p.confirm({
 				message: "Apply detected tsconfig bases to packages?",
-				initialValue: true
+				initialValue: saved?.detectPackageTypes ?? true
 			});
 			if (isCancelled(applyDetected)) {
 				p.cancel("Cancelled.");
@@ -348,7 +350,7 @@ async function runInitPrompts(targetDir) {
 	} else {
 		const projectTypeAnswer = await p.select({
 			message: "Project type",
-			initialValue: "default",
+			initialValue: saved?.projectType ?? "default",
 			options: [
 				{
 					value: "default",
@@ -407,7 +409,7 @@ function buildDefaultConfig(targetDir, flags) {
 		setupVitest: !detected.hasVitestConfig,
 		ci: flags.noCi ? "none" : DEFAULT_CI,
 		setupRenovate: true,
-		releaseStrategy: detected.hasReleaseItConfig ? "release-it" : detected.hasCommitAndTagVersionConfig ? "commit-and-tag-version" : detected.hasChangesetsConfig ? "changesets" : "none",
+		releaseStrategy: detected.hasReleaseItConfig ? "release-it" : detected.hasSimpleReleaseConfig ? "simple" : detected.hasChangesetsConfig ? "changesets" : "none",
 		projectType: "default",
 		detectPackageTypes: true,
 		targetDir
@@ -516,8 +518,10 @@ const STANDARD_SCRIPTS_SINGLE = {
 	test: "vitest run",
 	lint: "oxlint",
 	knip: "knip",
-	check: "pnpm exec tooling repo:run-checks",
-	"tooling:check": "pnpm exec tooling repo:check"
+	check: "pnpm exec tooling checks:run",
+	"ci:check": "pnpm check",
+	"tooling:check": "pnpm exec tooling repo:check",
+	"tooling:update": "pnpm exec tooling repo:update"
 };
 const STANDARD_SCRIPTS_MONOREPO = {
 	build: "pnpm -r build",
@@ -525,13 +529,17 @@ const STANDARD_SCRIPTS_MONOREPO = {
 	typecheck: "pnpm -r --parallel run typecheck",
 	lint: "oxlint",
 	knip: "knip",
-	check: "pnpm exec tooling repo:run-checks",
-	"tooling:check": "pnpm exec tooling repo:check"
+	check: "pnpm exec tooling checks:run",
+	"ci:check": "pnpm check",
+	"tooling:check": "pnpm exec tooling repo:check",
+	"tooling:update": "pnpm exec tooling repo:update"
 };
 /** Scripts that tooling owns — map from script name to keyword that must appear in the value. */
 const MANAGED_SCRIPTS = {
-	check: "repo:run-checks",
-	"tooling:check": "repo:check"
+	check: "checks:run",
+	"ci:check": "pnpm check",
+	"tooling:check": "repo:check",
+	"tooling:update": "repo:update"
 };
 /** DevDeps that belong in every project (single repo) or per-package (monorepo). */
 const PER_PACKAGE_DEV_DEPS = {
@@ -575,7 +583,7 @@ function addReleaseDeps(deps, config) {
 			deps["release-it"] = "18.1.2";
 			if (config.structure === "monorepo") deps["@release-it/bumper"] = "7.0.2";
 			break;
-		case "commit-and-tag-version":
+		case "simple":
 			deps["commit-and-tag-version"] = "12.5.0";
 			break;
 		case "changesets":
@@ -587,8 +595,8 @@ function addReleaseDeps(deps, config) {
 function getAddedDevDepNames(config) {
 	const deps = { ...ROOT_DEV_DEPS };
 	if (config.structure !== "monorepo") Object.assign(deps, PER_PACKAGE_DEV_DEPS);
-	deps["@bensandee/config"] = "0.7.1";
-	deps["@bensandee/tooling"] = "0.12.0";
+	deps["@bensandee/config"] = "0.8.0";
+	deps["@bensandee/tooling"] = "0.14.0";
 	if (config.formatter === "oxfmt") deps["oxfmt"] = "0.35.0";
 	if (config.formatter === "prettier") deps["prettier"] = "3.8.1";
 	addReleaseDeps(deps, config);
@@ -608,9 +616,9 @@ async function generatePackageJson(ctx) {
 	if (ctx.config.releaseStrategy !== "none" && ctx.config.releaseStrategy !== "changesets") allScripts["trigger-release"] = "pnpm exec tooling release:trigger";
 	const devDeps = { ...ROOT_DEV_DEPS };
 	if (!isMonorepo) Object.assign(devDeps, PER_PACKAGE_DEV_DEPS);
-	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.7.1";
-	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.12.0";
-	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.9.0";
+	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.8.0";
+	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.14.0";
+	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.9.1";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = "0.35.0";
 	if (ctx.config.formatter === "prettier") devDeps["prettier"] = "3.8.1";
 	addReleaseDeps(devDeps, ctx.config);
@@ -1386,7 +1394,7 @@ jobs:
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - name: Run all checks
-        run: pnpm check
+        run: pnpm ci:check
 `;
 }
 function requiredCheckSteps(nodeVersionYaml) {
@@ -1417,7 +1425,7 @@ function requiredCheckSteps(nodeVersionYaml) {
 			match: { run: "check" },
 			step: {
 				name: "Run all checks",
-				run: "pnpm check"
+				run: "pnpm ci:check"
 			}
 		}
 	];
@@ -1958,25 +1966,13 @@ permissions:
       - name: Release
         env:
           GITHUB_TOKEN: \${{ github.token }}
-          NODE_AUTH_TOKEN: \${{ secrets.NPM_TOKEN }}
-        run: |
-          pnpm exec commit-and-tag-version
-          git push --follow-tags
-          TAG=$(git describe --tags --abbrev=0)
-          pnpm publish --no-git-checks
-          gh release create "$TAG" --generate-notes` : `
+        run: pnpm exec tooling release:simple` : `
       - name: Release
         env:
           FORGEJO_SERVER_URL: \${{ github.server_url }}
           FORGEJO_REPOSITORY: \${{ github.repository }}
           FORGEJO_TOKEN: \${{ secrets.FORGEJO_TOKEN }}
-          NODE_AUTH_TOKEN: \${{ secrets.NPM_TOKEN }}
-        run: |
-          pnpm exec commit-and-tag-version
-          git push --follow-tags
-          TAG=$(git describe --tags --abbrev=0)
-          pnpm publish --no-git-checks
-          pnpm exec tooling release:create-forgejo-release --tag "$TAG"`;
+        run: pnpm exec tooling release:simple`;
 	return `${workflowSchemaComment(ci)}name: Release
 on:
   workflow_dispatch:
@@ -2077,10 +2073,10 @@ function requiredReleaseSteps(strategy, nodeVersionYaml) {
 				step: { run: "pnpm release-it --ci" }
 			});
 			break;
-		case "commit-and-tag-version":
+		case "simple":
 			steps.push({
-				match: { run: "commit-and-tag-version" },
-				step: { run: "pnpm exec commit-and-tag-version" }
+				match: { run: "release:simple" },
+				step: { run: "pnpm exec tooling release:simple" }
 			});
 			break;
 		case "changesets":
@@ -2095,7 +2091,7 @@ function requiredReleaseSteps(strategy, nodeVersionYaml) {
 function buildWorkflow(strategy, ci, nodeVersionYaml) {
 	switch (strategy) {
 		case "release-it": return releaseItWorkflow(ci, nodeVersionYaml);
-		case "commit-and-tag-version": return commitAndTagVersionWorkflow(ci, nodeVersionYaml);
+		case "simple": return commitAndTagVersionWorkflow(ci, nodeVersionYaml);
 		case "changesets": return changesetsWorkflow(ci, nodeVersionYaml);
 		default: return null;
 	}
@@ -2438,7 +2434,7 @@ const ToolingConfigSchema = z.object({
 	setupRenovate: z.boolean().optional(),
 	releaseStrategy: z.enum([
 		"release-it",
-		"commit-and-tag-version",
+		"simple",
 		"changesets",
 		"none"
 	]).optional(),
@@ -2539,14 +2535,14 @@ const initCommand = defineCommand({
 	},
 	async run({ args }) {
 		const targetDir = path.resolve(args.dir ?? ".");
+		const saved = loadToolingConfig(targetDir);
 		await runInit(args.yes ? (() => {
-			const saved = loadToolingConfig(targetDir);
 			const detected = buildDefaultConfig(targetDir, {
 				eslintPlugin: args["eslint-plugin"] === true ? true : void 0,
 				noCi: args["no-ci"] === true ? true : void 0
 			});
 			return saved ? mergeWithSavedConfig(detected, saved) : detected;
-		})() : await runInitPrompts(targetDir), args["no-prompt"] === true ? { noPrompt: true } : {});
+		})() : await runInitPrompts(targetDir, saved), args["no-prompt"] === true ? { noPrompt: true } : {});
 	}
 });
 async function runInit(config, options = {}) {
@@ -2726,12 +2722,6 @@ function lineDiff(oldText, newText) {
 	return lines;
 }
 //#endregion
-//#region src/utils/exec.ts
-/** Type guard for `execSync` errors that carry stdout/stderr/status. */
-function isExecSyncError(err) {
-	return err instanceof Error && "stdout" in err && typeof err.stdout === "string" && "stderr" in err && typeof err.stderr === "string" && "status" in err && typeof err.status === "number";
-}
-//#endregion
 //#region src/release/executor.ts
 /** Create an executor that runs real commands, fetches, and reads the filesystem. */
 function createRealExecutor() {
@@ -3341,10 +3331,10 @@ function triggerGitHub(ref) {
 	p.log.info(`Triggered release workflow on GitHub (ref: ${ref})`);
 }
 //#endregion
-//#region src/commands/release-create-forgejo-release.ts
+//#region src/commands/forgejo-create-release.ts
 const createForgejoReleaseCommand = defineCommand({
 	meta: {
-		name: "release:create-forgejo-release",
+		name: "forgejo:create-release",
 		description: "Create a Forgejo release for a given tag"
 	},
 	args: { tag: {
@@ -3354,7 +3344,7 @@ const createForgejoReleaseCommand = defineCommand({
 	} },
 	async run({ args }) {
 		const resolved = resolveConnection(process.cwd());
-		if (resolved.type !== "forgejo") throw new FatalError("release:create-forgejo-release requires a Forgejo repository");
+		if (resolved.type !== "forgejo") throw new FatalError("forgejo:create-release requires a Forgejo repository");
 		const executor = createRealExecutor();
 		const conn = resolved.conn;
 		if (await findRelease(executor, conn, args.tag)) {
@@ -3366,11 +3356,11 @@ const createForgejoReleaseCommand = defineCommand({
 	}
 });
 //#endregion
-//#region src/commands/release-merge.ts
+//#region src/commands/changesets-merge.ts
 const HEAD_BRANCH = "changeset-release/main";
 const releaseMergeCommand = defineCommand({
 	meta: {
-		name: "release:merge",
+		name: "changesets:merge",
 		description: "Merge the open changesets version PR"
 	},
 	args: { "dry-run": {
@@ -3410,41 +3400,201 @@ function mergeGitHub(dryRun) {
 	p.log.info(`Merged changesets PR and deleted branch ${HEAD_BRANCH}`);
 }
 //#endregion
-//#region src/commands/repo-run-checks.ts
-const CHECKS = [
-	{
-		name: "build",
-		cmd: "pnpm run --if-present build"
-	},
-	{
-		name: "typecheck",
-		cmd: "pnpm run --if-present typecheck"
-	},
-	{
-		name: "lint",
-		cmd: "pnpm run --if-present lint"
+//#region src/release/simple.ts
+/**
+* Compute sliding version tags from a semver version string.
+* For "1.2.3" returns ["v1", "v1.2"]. Strips prerelease suffixes.
+*/
+function computeSlidingTags(version) {
+	const parts = (version.split("-")[0] ?? version).split(".");
+	if (parts.length < 2 || !parts[0] || !parts[1]) throw new FatalError(`Invalid version format "${version}". Expected semver (X.Y.Z)`);
+	return [`v${parts[0]}`, `v${parts[0]}.${parts[1]}`];
+}
+/** Build the commit-and-tag-version command with appropriate flags. */
+function buildCommand(config) {
+	const args = ["pnpm exec commit-and-tag-version"];
+	if (config.dryRun) args.push("--dry-run");
+	if (config.firstRelease) args.push("--first-release");
+	if (config.releaseAs) args.push(`--release-as ${config.releaseAs}`);
+	if (config.prerelease) args.push(`--prerelease ${config.prerelease}`);
+	return args.join(" ");
+}
+/** Read the current version from package.json. */
+function readVersion(executor, cwd) {
+	const raw = executor.readFile(path.join(cwd, "package.json"));
+	if (!raw) throw new FatalError("Could not read package.json");
+	const pkg = parsePackageJson(raw);
+	if (!pkg?.version) throw new FatalError("No version field found in package.json");
+	return pkg.version;
+}
+/** Run the full commit-and-tag-version release flow. */
+async function runSimpleRelease(executor, config) {
+	const command = buildCommand(config);
+	p.log.info(`Running: ${command}`);
+	const versionResult = executor.exec(command, { cwd: config.cwd });
+	debugExec(config, "commit-and-tag-version", versionResult);
+	if (versionResult.exitCode !== 0) throw new FatalError(`commit-and-tag-version failed (exit code ${String(versionResult.exitCode)}):\n${versionResult.stderr || versionResult.stdout}`);
+	const version = readVersion(executor, config.cwd);
+	debug(config, `New version: ${version}`);
+	const tagResult = executor.exec("git describe --tags --abbrev=0", { cwd: config.cwd });
+	debugExec(config, "git describe", tagResult);
+	const tag = tagResult.stdout.trim();
+	if (!tag) throw new FatalError("Could not determine the new tag from git describe");
+	p.log.info(`Version ${version} tagged as ${tag}`);
+	if (config.dryRun) {
+		const slidingTags = config.noSlidingTags ? [] : computeSlidingTags(version);
+		p.log.info(`[dry-run] Would push to origin with --follow-tags`);
+		if (slidingTags.length > 0) p.log.info(`[dry-run] Would create sliding tags: ${slidingTags.join(", ")}`);
+		if (!config.noRelease && config.platform) p.log.info(`[dry-run] Would create ${config.platform.type} release for ${tag}`);
+		return {
+			version,
+			tag,
+			slidingTags,
+			pushed: false,
+			releaseCreated: false
+		};
+	}
+	let pushed = false;
+	if (!config.noPush) {
+		const branch = executor.exec("git rev-parse --abbrev-ref HEAD", { cwd: config.cwd }).stdout.trim() || "main";
+		debug(config, `Pushing to origin/${branch}`);
+		const pushResult = executor.exec(`git push --follow-tags origin ${branch}`, { cwd: config.cwd });
+		debugExec(config, "git push", pushResult);
+		if (pushResult.exitCode !== 0) throw new FatalError(`git push failed (exit code ${String(pushResult.exitCode)}):\n${pushResult.stderr || pushResult.stdout}`);
+		pushed = true;
+		p.log.info("Pushed to origin");
+	}
+	let slidingTags = [];
+	if (!config.noSlidingTags && pushed) {
+		slidingTags = computeSlidingTags(version);
+		for (const slidingTag of slidingTags) executor.exec(`git tag -f ${slidingTag}`, { cwd: config.cwd });
+		const forcePushResult = executor.exec(`git push origin ${slidingTags.join(" ")} --force`, { cwd: config.cwd });
+		debugExec(config, "force-push sliding tags", forcePushResult);
+		if (forcePushResult.exitCode !== 0) p.log.warn(`Warning: Failed to push sliding tags: ${forcePushResult.stderr || forcePushResult.stdout}`);
+		else p.log.info(`Created sliding tags: ${slidingTags.join(", ")}`);
+	}
+	let releaseCreated = false;
+	if (!config.noRelease && config.platform) releaseCreated = await createPlatformRelease(executor, config, tag);
+	return {
+		version,
+		tag,
+		slidingTags,
+		pushed,
+		releaseCreated
+	};
+}
+async function createPlatformRelease(executor, config, tag) {
+	if (!config.platform) return false;
+	if (config.platform.type === "forgejo") {
+		if (await findRelease(executor, config.platform.conn, tag)) {
+			debug(config, `Release for ${tag} already exists, skipping`);
+			return false;
+		}
+		await createRelease(executor, config.platform.conn, tag);
+		p.log.info(`Created Forgejo release for ${tag}`);
+		return true;
+	}
+	const ghResult = executor.exec(`gh release create ${tag} --generate-notes`, { cwd: config.cwd });
+	debugExec(config, "gh release create", ghResult);
+	if (ghResult.exitCode !== 0) {
+		p.log.warn(`Warning: Failed to create GitHub release: ${ghResult.stderr || ghResult.stdout}`);
+		return false;
+	}
+	p.log.info(`Created GitHub release for ${tag}`);
+	return true;
+}
+//#endregion
+//#region src/commands/release-simple.ts
+const releaseSimpleCommand = defineCommand({
+	meta: {
+		name: "release:simple",
+		description: "Run commit-and-tag-version, push, create sliding tags, and create a platform release"
 	},
-	{
-		name: "test",
-		cmd: "pnpm run --if-present test"
+	args: {
+		"dry-run": {
+			type: "boolean",
+			description: "Pass --dry-run to commit-and-tag-version and skip all remote operations"
+		},
+		verbose: {
+			type: "boolean",
+			description: "Enable detailed debug logging (also enabled by RELEASE_DEBUG env var)"
+		},
+		"no-push": {
+			type: "boolean",
+			description: "Run commit-and-tag-version but skip push and remote operations"
+		},
+		"no-sliding-tags": {
+			type: "boolean",
+			description: "Skip creating sliding major/minor version tags (vX, vX.Y)"
+		},
+		"no-release": {
+			type: "boolean",
+			description: "Skip Forgejo/GitHub release creation"
+		},
+		"first-release": {
+			type: "boolean",
+			description: "Pass --first-release to commit-and-tag-version (skip version bump)"
+		},
+		"release-as": {
+			type: "string",
+			description: "Force a specific version (passed to commit-and-tag-version --release-as)"
+		},
+		prerelease: {
+			type: "string",
+			description: "Create a prerelease with the given tag (e.g., beta, alpha)"
+		}
 	},
+	async run({ args }) {
+		const cwd = process.cwd();
+		const verbose = args.verbose === true || process.env["RELEASE_DEBUG"] === "true";
+		const noRelease = args["no-release"] === true;
+		let platform;
+		if (!noRelease) {
+			const resolved = resolveConnection(cwd);
+			if (resolved.type === "forgejo") platform = {
+				type: "forgejo",
+				conn: resolved.conn
+			};
+			else platform = { type: "github" };
+		}
+		const config = {
+			cwd,
+			dryRun: args["dry-run"] === true,
+			verbose,
+			noPush: args["no-push"] === true,
+			noSlidingTags: args["no-sliding-tags"] === true,
+			noRelease,
+			firstRelease: args["first-release"] === true,
+			releaseAs: args["release-as"],
+			prerelease: args.prerelease,
+			platform
+		};
+		await runSimpleRelease(createRealExecutor(), config);
+	}
+});
+//#endregion
+//#region src/commands/repo-run-checks.ts
+const CHECKS = [
+	{ name: "build" },
+	{ name: "typecheck" },
+	{ name: "lint" },
+	{ name: "test" },
 	{
 		name: "format",
-		cmd: "pnpm run --if-present format -- --check"
+		args: "--check"
 	},
-	{
-		name: "knip",
-		cmd: "pnpm run --if-present knip"
-	},
-	{
-		name: "tooling:check",
-		cmd: "pnpm run --if-present tooling:check"
-	},
-	{
-		name: "image:check",
-		cmd: "pnpm run --if-present image:check"
-	}
+	{ name: "knip" },
+	{ name: "tooling:check" },
+	{ name: "image:check" }
 ];
+function defaultGetScripts(targetDir) {
+	try {
+		const pkg = parsePackageJson(readFileSync(path.join(targetDir, "package.json"), "utf-8"));
+		return new Set(Object.keys(pkg?.scripts ?? {}));
+	} catch {
+		return /* @__PURE__ */ new Set();
+	}
+}
 function defaultExecCommand(cmd, cwd) {
 	try {
 		execSync(cmd, {
@@ -3460,29 +3610,38 @@ function defaultExecCommand(cmd, cwd) {
 const ciLog = (msg) => console.log(msg);
 function runRunChecks(targetDir, options = {}) {
 	const exec = options.execCommand ?? defaultExecCommand;
+	const getScripts = options.getScripts ?? defaultGetScripts;
 	const skip = options.skip ?? /* @__PURE__ */ new Set();
 	const add = options.add ?? [];
 	const isCI = Boolean(process.env["CI"]);
-	const allChecks = [...CHECKS, ...add.map((name) => ({
-		name,
-		cmd: `pnpm run --if-present ${name}`
-	}))];
+	const failFast = options.failFast ?? !isCI;
+	const definedScripts = getScripts(targetDir);
+	const addedNames = new Set(add);
+	const allChecks = [...CHECKS, ...add.map((name) => ({ name }))];
 	const failures = [];
+	const notDefined = [];
 	for (const check of allChecks) {
-		if (skip.has(check.name)) {
-			p.log.info(`${check.name} (skipped)`);
+		if (skip.has(check.name)) continue;
+		if (!definedScripts.has(check.name)) {
+			if (addedNames.has(check.name)) {
+				p.log.error(`${check.name} not defined in package.json`);
+				failures.push(check.name);
+			} else notDefined.push(check.name);
 			continue;
 		}
+		const cmd = check.args ? `pnpm run ${check.name} ${check.args}` : `pnpm run ${check.name}`;
 		if (isCI) ciLog(`::group::${check.name}`);
-		const exitCode = exec(check.cmd, targetDir);
+		const exitCode = exec(cmd, targetDir);
 		if (isCI) ciLog("::endgroup::");
 		if (exitCode === 0) p.log.success(check.name);
 		else {
 			if (isCI) ciLog(`::error::${check.name} failed`);
 			p.log.error(`${check.name} failed`);
 			failures.push(check.name);
+			if (failFast) return 1;
 		}
 	}
+	if (notDefined.length > 0) p.log.info(`Skipped (not defined): ${notDefined.join(", ")}`);
 	if (failures.length > 0) {
 		p.log.error(`Failed checks: ${failures.join(", ")}`);
 		return 1;
@@ -3492,7 +3651,7 @@ function runRunChecks(targetDir, options = {}) {
 }
 const runChecksCommand = defineCommand({
 	meta: {
-		name: "repo:run-checks",
+		name: "checks:run",
 		description: "Run all standard checks (build, typecheck, lint, test, format, knip, tooling:check, image:check)"
 	},
 	args: {
@@ -3508,14 +3667,20 @@ const runChecksCommand = defineCommand({
 		},
 		add: {
 			type: "string",
-			description: "Comma-separated list of additional check names to run (uses pnpm run --if-present <name>)",
+			description: "Comma-separated list of additional check names to run (uses pnpm run <name>)",
+			required: false
+		},
+		"fail-fast": {
+			type: "boolean",
+			description: "Stop on first failure (default: true in dev, false in CI)",
 			required: false
 		}
 	},
 	run({ args }) {
 		const exitCode = runRunChecks(path.resolve(args.dir ?? "."), {
 			skip: args.skip ? new Set(args.skip.split(",").map((s) => s.trim())) : void 0,
-			add: args.add ? args.add.split(",").map((s) => s.trim()) : void 0
+			add: args.add ? args.add.split(",").map((s) => s.trim()) : void 0,
+			failFast: args["fail-fast"] === true ? true : args["fail-fast"] === false ? false : void 0
 		});
 		process.exitCode = exitCode;
 	}
@@ -3525,21 +3690,22 @@ const runChecksCommand = defineCommand({
 const main = defineCommand({
 	meta: {
 		name: "tooling",
-		version: "0.12.0",
+		version: "0.14.0",
 		description: "Bootstrap and maintain standardized TypeScript project tooling"
 	},
 	subCommands: {
 		"repo:init": initCommand,
 		"repo:update": updateCommand,
 		"repo:check": checkCommand,
-		"repo:run-checks": runChecksCommand,
+		"checks:run": runChecksCommand,
 		"release:changesets": releaseForgejoCommand,
 		"release:trigger": releaseTriggerCommand,
-		"release:create-forgejo-release": createForgejoReleaseCommand,
-		"release:merge": releaseMergeCommand
+		"forgejo:create-release": createForgejoReleaseCommand,
+		"changesets:merge": releaseMergeCommand,
+		"release:simple": releaseSimpleCommand
 	}
 });
-console.log(`@bensandee/tooling v0.12.0`);
+console.log(`@bensandee/tooling v0.14.0`);
 runMain(main);
 //#endregion
 export {};

package/dist/docker-verify/index.mjs

@@ -0,0 +1,218 @@
+import { t as isExecSyncError } from "../exec-CC49vrkM.mjs";
+import { execSync } from "node:child_process";
+import { z } from "zod";
+//#region src/docker-verify/executor.ts
+/** Create an executor that runs real commands, fetches, and manages process signals. */
+function createRealExecutor() {
+	return {
+		exec(command, options) {
+			try {
+				return {
+					stdout: execSync(command, {
+						cwd: options?.cwd,
+						env: options?.env ? {
+							...process.env,
+							...options.env
+						} : void 0,
+						encoding: "utf-8",
+						stdio: [
+							"pipe",
+							"pipe",
+							"pipe"
+						]
+					}),
+					stderr: "",
+					exitCode: 0
+				};
+			} catch (err) {
+				if (isExecSyncError(err)) return {
+					stdout: err.stdout,
+					stderr: err.stderr,
+					exitCode: err.status
+				};
+				return {
+					stdout: "",
+					stderr: "",
+					exitCode: 1
+				};
+			}
+		},
+		execInherit(command, options) {
+			execSync(command, {
+				cwd: options?.cwd,
+				env: options?.env ? {
+					...process.env,
+					...options.env
+				} : void 0,
+				stdio: "inherit"
+			});
+		},
+		fetch: globalThis.fetch,
+		now: () => Date.now(),
+		sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+		onSignal(signal, handler) {
+			process.on(signal, handler);
+			return () => {
+				process.removeListener(signal, handler);
+			};
+		},
+		log: (msg) => console.log(msg),
+		logError: (msg) => console.error(msg)
+	};
+}
+//#endregion
+//#region src/docker-verify/compose.ts
+/** Zod schema for a single container entry from `docker compose ps --format json`. */
+const ContainerInfoSchema = z.object({
+	Service: z.string(),
+	Health: z.string()
+});
+/** Build the `docker compose` base command string from config. */
+function composeCommand(config) {
+	return `docker compose ${config.composeFiles.map((f) => `-f ${f}`).join(" ")}${config.envFile ? ` --env-file ${config.envFile}` : ""}`;
+}
+/** Run the build command if configured. */
+function buildImages(executor, config) {
+	if (!config.buildCommand) return;
+	executor.execInherit(config.buildCommand, { cwd: config.buildCwd ?? config.compose.cwd });
+}
+/** Start the compose stack in detached mode. */
+function composeUp(executor, config) {
+	executor.execInherit(`${composeCommand(config)} up -d`, { cwd: config.cwd });
+}
+/** Tear down the compose stack, removing volumes and orphans. Swallows errors. */
+function composeDown(executor, config) {
+	try {
+		executor.execInherit(`${composeCommand(config)} down -v --remove-orphans`, { cwd: config.cwd });
+	} catch (_error) {}
+}
+/** Show logs for a specific service (or all services if not specified). Swallows errors. */
+function composeLogs(executor, config, service) {
+	try {
+		const suffix = service ? ` ${service}` : "";
+		executor.execInherit(`${composeCommand(config)} logs${suffix}`, { cwd: config.cwd });
+	} catch (_error) {}
+}
+/**
+* Query container status via `docker compose ps --format json`.
+* Handles both JSON array and newline-delimited JSON (varies by docker compose version).
+*/
+function composePs(executor, config) {
+	const output = executor.exec(`${composeCommand(config)} ps --format json`, { cwd: config.cwd }).stdout.trim();
+	if (!output) return [];
+	const ArraySchema = z.array(ContainerInfoSchema);
+	try {
+		const direct = ArraySchema.safeParse(JSON.parse(output));
+		if (direct.success) return direct.data;
+		const single = ContainerInfoSchema.safeParse(JSON.parse(output));
+		if (single.success) return [single.data];
+	} catch (_error) {}
+	try {
+		const joined = `[${output.split("\n").join(",")}]`;
+		const delimited = ArraySchema.safeParse(JSON.parse(joined));
+		return delimited.success ? delimited.data : [];
+	} catch (_error) {
+		return [];
+	}
+}
+//#endregion
+//#region src/docker-verify/health.ts
+/** Look up the health status of a specific service from container info. */
+function getContainerHealth(containers, serviceName) {
+	return containers.find((c) => c.Service === serviceName)?.Health ?? "unknown";
+}
+/** Run a single HTTP health check, returning true if the validator passes. */
+async function checkHttpHealth(executor, check) {
+	try {
+		const response = await executor.fetch(check.url);
+		return await check.validate(response);
+	} catch (_error) {
+		return false;
+	}
+}
+//#endregion
+//#region src/docker-verify/verify.ts
+const DEFAULT_TIMEOUT_MS = 12e4;
+const DEFAULT_POLL_INTERVAL_MS = 5e3;
+/** Run the full Docker image verification lifecycle. */
+async function runVerification(executor, config) {
+	const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+	const pollIntervalMs = config.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+	const { compose } = config;
+	const cleanup = () => composeDown(executor, compose);
+	const disposeInt = executor.onSignal("SIGINT", () => {
+		cleanup();
+		process.exit(1);
+	});
+	const disposeTerm = executor.onSignal("SIGTERM", () => {
+		cleanup();
+		process.exit(1);
+	});
+	try {
+		if (config.buildCommand) {
+			executor.log("Building images...");
+			buildImages(executor, config);
+		}
+		executor.log("Starting compose stack...");
+		composeUp(executor, compose);
+		executor.log(`Waiting for stack to be healthy (max ${timeoutMs / 1e3}s)...`);
+		const startTime = executor.now();
+		const healthStatus = new Map(config.healthChecks.map((c) => [c.name, false]));
+		while (executor.now() - startTime < timeoutMs) {
+			const containers = composePs(executor, compose);
+			for (const service of compose.services) if (getContainerHealth(containers, service) === "unhealthy") {
+				executor.logError(`Container ${service} is unhealthy`);
+				composeLogs(executor, compose, service);
+				cleanup();
+				return {
+					success: false,
+					reason: "unhealthy-container",
+					message: service,
+					elapsedMs: executor.now() - startTime
+				};
+			}
+			for (const check of config.healthChecks) if (!healthStatus.get(check.name)) {
+				if (await checkHttpHealth(executor, check)) {
+					healthStatus.set(check.name, true);
+					executor.log(`${check.name} is healthy!`);
+				}
+			}
+			if ([...healthStatus.values()].every(Boolean)) {
+				executor.log("Verification successful! All systems operational.");
+				cleanup();
+				return {
+					success: true,
+					elapsedMs: executor.now() - startTime
+				};
+			}
+			const elapsed = Math.floor((executor.now() - startTime) / 1e3);
+			if (elapsed > 0 && elapsed % 5 === 0) {
+				const statuses = [...healthStatus.entries()].map(([name, ok]) => `${name}=${ok ? "OK" : "Pending"}`).join(", ");
+				executor.log(`Waiting... (${elapsed}s elapsed). ${statuses}`);
+			}
+			await executor.sleep(pollIntervalMs);
+		}
+		executor.logError("Timeout waiting for stack to become healthy");
+		for (const service of compose.services) composeLogs(executor, compose, service);
+		cleanup();
+		return {
+			success: false,
+			reason: "timeout",
+			message: "Exceeded timeout",
+			elapsedMs: executor.now() - startTime
+		};
+	} catch (error) {
+		cleanup();
+		return {
+			success: false,
+			reason: "error",
+			message: error instanceof Error ? error.message : String(error),
+			elapsedMs: 0
+		};
+	} finally {
+		disposeInt();
+		disposeTerm();
+	}
+}
+//#endregion
+export { checkHttpHealth, composeCommand, composeDown, composeLogs, composePs, composeUp, createRealExecutor, getContainerHealth, runVerification };

package/dist/exec-CC49vrkM.mjs

@@ -0,0 +1,7 @@
+//#region src/utils/exec.ts
+/** Type guard for `execSync` errors that carry stdout/stderr/status. */
+function isExecSyncError(err) {
+	return err instanceof Error && "stdout" in err && typeof err.stdout === "string" && "stderr" in err && typeof err.stderr === "string" && "status" in err && typeof err.status === "number";
+}
+//#endregion
+export { isExecSyncError as t };

package/package.json

@@ -1,20 +1,22 @@
 {
   "name": "@bensandee/tooling",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "CLI tool to bootstrap and maintain standardized TypeScript project tooling",
   "bin": {
     "tooling": "./dist/bin.mjs"
   },
   "files": [
-    "dist"
+    "dist",
+    "CHANGELOG.md"
   ],
   "type": "module",
   "imports": {
-    "#src/*": "./src/*.ts"
+    "#src/*.ts": "./src/*.ts"
   },
   "exports": {
     ".": "./dist/index.mjs",
     "./bin": "./dist/bin.mjs",
+    "./docker-verify": "./dist/docker-verify/index.mjs",
     "./package.json": "./package.json"
   },
   "publishConfig": {
@@ -27,14 +29,18 @@
     "jsonc-parser": "^3.3.1",
     "yaml": "^2.8.2",
     "zod": "^4.3.6",
-    "@bensandee/common": "0.1.0"
+    "@bensandee/common": "0.1.1"
   },
   "devDependencies": {
     "@types/node": "24.12.0",
     "tsdown": "0.21.0",
     "typescript": "5.9.3",
     "vitest": "4.0.18",
-    "@bensandee/config": "0.7.1"
+    "@bensandee/config": "0.8.0"
+  },
+  "optionalDependencies": {
+    "@changesets/cli": "^2.29.4",
+    "commit-and-tag-version": "^12.5.0"
   },
   "scripts": {
     "build": "tsdown",