@git.zone/cli 3.0.1 → 3.1.0

package/dist_ts/plugins.d.ts

@@ -3,6 +3,7 @@ import * as smartlogDestinationLocal from '@push.rocks/smartlog-destination-loca
 import * as smartconfig from '@push.rocks/smartconfig';
 import * as path from 'path';
 import * as fs from 'node:fs/promises';
+import * as crypto from 'node:crypto';
 import * as projectinfo from '@push.rocks/projectinfo';
 import * as smartcli from '@push.rocks/smartcli';
 import * as smartpath from '@push.rocks/smartpath';
@@ -15,4 +16,4 @@ import { SmartFs } from '@push.rocks/smartfs';
 import * as smartinteract from '@push.rocks/smartinteract';
 import * as smartdelay from '@push.rocks/smartdelay';
 export declare const smartfs: SmartFs;
-export { smartlog, smartlogDestinationLocal, smartconfig, path, fs, projectinfo, smartcli, smartpath, smartpromise, smartupdate, smartshell, smartnetwork, smartfile, smartinteract, smartdelay, };
+export { smartlog, smartlogDestinationLocal, smartconfig, path, fs, crypto, projectinfo, smartcli, smartpath, smartpromise, smartupdate, smartshell, smartnetwork, smartfile, smartinteract, smartdelay, };

package/dist_ts/plugins.js

@@ -3,6 +3,7 @@ import * as smartlogDestinationLocal from '@push.rocks/smartlog-destination-loca
 import * as smartconfig from '@push.rocks/smartconfig';
 import * as path from 'path';
 import * as fs from 'node:fs/promises';
+import * as crypto from 'node:crypto';
 import * as projectinfo from '@push.rocks/projectinfo';
 import * as smartcli from '@push.rocks/smartcli';
 import * as smartpath from '@push.rocks/smartpath';
@@ -16,5 +17,5 @@ import * as smartinteract from '@push.rocks/smartinteract';
 import * as smartdelay from '@push.rocks/smartdelay';
 // Create smartfs instance for filesystem operations
 export const smartfs = new SmartFs(new SmartFsProviderNode());
-export { smartlog, smartlogDestinationLocal, smartconfig, path, fs, projectinfo, smartcli, smartpath, smartpromise, smartupdate, smartshell, smartnetwork, smartfile, smartinteract, smartdelay, };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUNqRCxPQUFPLEtBQUssd0JBQXdCLE1BQU0sd0NBQXdDLENBQUM7QUFDbkYsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssSUFBSSxNQUFNLE1BQU0sQ0FBQztBQUM3QixPQUFPLEtBQUssRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBQ3ZDLE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUNqRCxPQUFPLEtBQUssU0FBUyxNQUFNLHVCQUF1QixDQUFDO0FBQ25ELE9BQU8sS0FBSyxZQUFZLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssVUFBVSxNQUFNLHdCQUF3QixDQUFDO0FBQ3JELE9BQU8sS0FBSyxZQUFZLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUNuRCxPQUFPLEVBQUUsT0FBTyxFQUFFLG1CQUFtQixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDbkUsT0FBTyxLQUFLLGFBQWEsTUFBTSwyQkFBMkIsQ0FBQztBQUMzRCxPQUFPLEtBQUssVUFBVSxNQUFNLHdCQUF3QixDQUFDO0FBRXJELG9EQUFvRDtBQUNwRCxNQUFNLENBQUMsTUFBTSxPQUFPLEdBQUcsSUFBSSxPQUFPLENBQUMsSUFBSSxtQkFBbUIsRUFBRSxDQUFDLENBQUM7QUFFOUQsT0FBTyxFQUNMLFFBQVEsRUFDUix3QkFBd0IsRUFDeEIsV0FBVyxFQUNYLElBQUksRUFDSixFQUFFLEVBQ0YsV0FBVyxFQUNYLFFBQVEsRUFDUixTQUFTLEVBQ1QsWUFBWSxFQUNaLFdBQVcsRUFDWCxVQUFVLEVBQ1YsWUFBWSxFQUNaLFNBQVMsRUFDVCxhQUFhLEVBQ2IsVUFBVSxHQUNYLENBQUMifQ==
+export { smartlog, smartlogDestinationLocal, smartconfig, path, fs, crypto, projectinfo, smartcli, smartpath, smartpromise, smartupdate, smartshell, smartnetwork, smartfile, smartinteract, smartdelay, };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUNqRCxPQUFPLEtBQUssd0JBQXdCLE1BQU0sd0NBQXdDLENBQUM7QUFDbkYsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssSUFBSSxNQUFNLE1BQU0sQ0FBQztBQUM3QixPQUFPLEtBQUssRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBQ3ZDLE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFDO0FBQ3RDLE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUNqRCxPQUFPLEtBQUssU0FBUyxNQUFNLHVCQUF1QixDQUFDO0FBQ25ELE9BQU8sS0FBSyxZQUFZLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssVUFBVSxNQUFNLHdCQUF3QixDQUFDO0FBQ3JELE9BQU8sS0FBSyxZQUFZLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUNuRCxPQUFPLEVBQUUsT0FBTyxFQUFFLG1CQUFtQixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDbkUsT0FBTyxLQUFLLGFBQWEsTUFBTSwyQkFBMkIsQ0FBQztBQUMzRCxPQUFPLEtBQUssVUFBVSxNQUFNLHdCQUF3QixDQUFDO0FBRXJELG9EQUFvRDtBQUNwRCxNQUFNLENBQUMsTUFBTSxPQUFPLEdBQUcsSUFBSSxPQUFPLENBQUMsSUFBSSxtQkFBbUIsRUFBRSxDQUFDLENBQUM7QUFFOUQsT0FBTyxFQUNMLFFBQVEsRUFDUix3QkFBd0IsRUFDeEIsV0FBVyxFQUNYLElBQUksRUFDSixFQUFFLEVBQ0YsTUFBTSxFQUNOLFdBQVcsRUFDWCxRQUFRLEVBQ1IsU0FBUyxFQUNULFlBQVksRUFDWixXQUFXLEVBQ1gsVUFBVSxFQUNWLFlBQVksRUFDWixTQUFTLEVBQ1QsYUFBYSxFQUNiLFVBQVUsR0FDWCxDQUFDIn0=

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@git.zone/cli",
   "private": false,
-  "version": "3.0.1",
+  "version": "3.1.0",
   "description": "A comprehensive CLI tool for enhancing and managing local development workflows with gitzone utilities, focusing on project setup, version control, code formatting, and template management.",
   "main": "dist_ts/index.js",
   "typings": "dist_ts/index.d.ts",
@@ -40,9 +40,9 @@
   "homepage": "https://code.foss.global/git.zone/cli#README",
   "devDependencies": {
     "@git.zone/tsbuild": "^4.4.2",
-    "@git.zone/tsrun": "^2.0.5",
-    "@git.zone/tstest": "^3.6.6",
-    "@types/node": "^25.9.3"
+    "@git.zone/tsrun": "^2.0.6",
+    "@git.zone/tstest": "^3.6.7",
+    "@types/node": "^26.1.1"
   },
   "dependencies": {
     "@git.zone/tsdoc": "^2.1.1",
@@ -69,7 +69,7 @@
     "@push.rocks/smartpath": "^6.0.0",
     "@push.rocks/smartpromise": "^4.2.3",
     "@push.rocks/smartscaf": "^4.0.22",
-    "@push.rocks/smartshell": "^3.5.0",
+    "@push.rocks/smartshell": "^4.0.0",
     "@push.rocks/smartunique": "^3.0.9",
     "@push.rocks/smartupdate": "^2.0.7",
     "prettier": "^3.8.1"

package/readme.md

@@ -243,6 +243,8 @@ CLI workflow config lives under `@git.zone/cli` in `.smartconfig.json`. Docker b
         "docker": {
           "enabled": true,
           "engine": "tsdocker",
+          "registry": "registry.gitlab.com",
+          "buildRegistries": ["registry.gitlab.com"],
           "patterns": [],
           "cached": true,
           "parallel": true
@@ -266,12 +268,28 @@ NPM registries belong only here:
 @git.zone/cli.release.targets.npm.registries
 ```
 
-Docker registries belong only here and should be registry hosts without `http://` or `https://`:
+Canonical Docker destinations and repository mappings belong here. Registry
+values should be hosts without `http://` or `https://`:
 
 ```text
 @git.zone/tsdocker.registries
 ```
 
+The Docker release target runs the project's pinned `@git.zone/tsdocker` through
+`pnpm exec`; install it in each Docker-producing project:
+
+```bash
+pnpm add --save-dev @git.zone/tsdocker
+```
+
+Set `release.targets.docker.registry` to select one destination already declared
+by the tSDocker config when a release must not publish to every configured
+registry.
+Set `release.targets.docker.buildRegistries` when the build should authenticate
+only the configured registries used by private base images; an empty list keeps
+the compatibility default of authenticating every configured registry. Bounded
+build authentication requires project-local `@git.zone/tsdocker` 3.3.0 or newer.
+
 Useful config commands:
 
 ```bash
@@ -458,6 +476,20 @@ gitzone services logs mongo 50
 
 Service config is stored in `.nogit/env.json`. Data is stored below `.nogit/`, so it stays out of Git.
 
+GitZone derives new MinIO bucket names from the project name using S3 naming
+rules. When loading older configuration it repairs only the exact generated
+`<project>-documents` value if that value is invalid; custom bucket names are
+never rewritten. `services start minio` validates custom names, recreates a
+container whose configured credentials or ports drifted, authenticates the
+configured alias, creates the bucket idempotently, and verifies it before
+reporting success. Before GitZone starts, recreates, or executes inside an
+existing MinIO container, current-project ownership must be proven by exact
+GitZone labels or one unambiguous legacy registry claim. Every lifecycle
+operation after discovery uses the container's immutable id. If startup fails,
+GitZone stops only containers that this invocation started; it never stops a
+container that was already running. Invalid custom names do not block read-only
+or recovery commands such as `status`, `logs`, `stop`, `remove`, and `clean`.
+
 ### Consuming a service programmatically
 
 `gitzone services status --json` emits only JSON on stdout, so a test suite or

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@git.zone/cli',
-  version: '3.0.1',
+  version: '3.1.0',
   description: 'A comprehensive CLI tool for enhancing and managing local development workflows with gitzone utilities, focusing on project setup, version control, code formatting, and template management.'
 }

package/ts/helpers.tsdocker.ts

@@ -0,0 +1,30 @@
+import * as plugins from './plugins.js';
+
+export type TTsdockerBinaryAccess = (binaryPathArg: string) => Promise<void>;
+
+export const getProjectTsdockerBinPath = (
+  projectRootArg: string,
+  platformArg: NodeJS.Platform = process.platform,
+): string => {
+  return plugins.path.join(
+    projectRootArg,
+    'node_modules',
+    '.bin',
+    platformArg === 'win32' ? 'tsdocker.CMD' : 'tsdocker',
+  );
+};
+
+export const hasInstalledProjectTsdockerBinary = async (
+  projectRootArg: string,
+  platformArg: NodeJS.Platform = process.platform,
+  accessArg: TTsdockerBinaryAccess = async (binaryPathArg) => {
+    await plugins.fs.access(binaryPathArg);
+  },
+): Promise<boolean> => {
+  try {
+    await accessArg(getProjectTsdockerBinPath(projectRootArg, platformArg));
+    return true;
+  } catch {
+    return false;
+  }
+};

package/ts/helpers.workflow.ts

@@ -53,6 +53,8 @@ export interface IReleaseNpmTargetConfig {
 export interface IReleaseDockerTargetConfig {
   enabled?: boolean;
   engine?: "tsdocker";
+  registry?: string;
+  buildRegistries?: string[];
   patterns?: string[];
   cached?: boolean;
   parallel?: boolean | number;
@@ -116,6 +118,8 @@ export interface IResolvedReleaseWorkflow {
   npmAlreadyPublished: "success" | "error";
   dockerEnabled: boolean;
   dockerEngine: "tsdocker";
+  dockerRegistry?: string;
+  dockerBuildRegistries: string[];
   dockerPatterns: string[];
   dockerCached: boolean;
   dockerParallel: boolean | number;
@@ -145,6 +149,39 @@ const unique = <T>(items: T[]): T[] => {
   return result;
 };
 
+export const supportsBoundedBuildRegistryAuthentication = (
+  versionOutputArg: string,
+): boolean => {
+  const match = versionOutputArg.match(/(\d+)\.(\d+)\.(\d+)/);
+  if (!match) {
+    return false;
+  }
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  return major > 3 || (major === 3 && minor >= 3);
+};
+
+const isStringRecord = (valueArg: unknown): valueArg is Record<string, unknown> => {
+  return typeof valueArg === "object" && valueArg !== null && !Array.isArray(valueArg);
+};
+
+export const getDeclaredTsdockerRange = (packageJsonArg: unknown): string | undefined => {
+  if (!isStringRecord(packageJsonArg)) {
+    return undefined;
+  }
+  for (const dependencyField of ["devDependencies", "dependencies"] as const) {
+    const dependencies = packageJsonArg[dependencyField];
+    if (!isStringRecord(dependencies)) {
+      continue;
+    }
+    const versionRange = dependencies["@git.zone/tsdocker"];
+    if (typeof versionRange === "string" && versionRange.trim()) {
+      return versionRange.trim();
+    }
+  }
+  return undefined;
+};
+
 const normalizeConfirmation = (
   value: unknown,
   fallback: TConfirmationMode,
@@ -395,6 +432,15 @@ export const resolveReleaseWorkflow = async (argvArg: any): Promise<IResolvedRel
     npmAlreadyPublished: npmConfig.alreadyPublished || "success",
     dockerEnabled,
     dockerEngine: "tsdocker",
+    dockerRegistry: typeof dockerConfig.registry === "string" && dockerConfig.registry.trim()
+      ? dockerConfig.registry.trim()
+      : undefined,
+    dockerBuildRegistries: Array.isArray(dockerConfig.buildRegistries)
+      ? dockerConfig.buildRegistries
+          .filter((registryArg): registryArg is string => typeof registryArg === "string")
+          .map((registryArg) => registryArg.trim())
+          .filter(Boolean)
+      : [],
     dockerPatterns: Array.isArray(dockerConfig.patterns) ? dockerConfig.patterns : [],
     dockerCached: dockerConfig.cached ?? false,
     dockerParallel: dockerConfig.parallel ?? false,

package/ts/mod_config/index.ts

@@ -19,6 +19,11 @@ import {
   CURRENT_GITZONE_CLI_SCHEMA_VERSION,
   migrateSmartconfigData,
 } from "../helpers.smartconfigmigrations.js";
+import {
+  getDeclaredTsdockerRange,
+  supportsBoundedBuildRegistryAuthentication,
+} from "../helpers.workflow.js";
+import { hasInstalledProjectTsdockerBinary } from "../helpers.tsdocker.js";
 
 export { ReleaseConfig, CommitConfig };
 
@@ -871,6 +876,20 @@ async function handleRelease(mode: ICliMode): Promise<void> {
   }
 
   if (enabledTargets.includes("docker")) {
+    const registry = await askValue<string>(interactInstance, {
+      type: "input",
+      name: "dockerRegistry",
+      message: "Single tsdocker registry target (empty means all configured registries):",
+      default: currentTargets.docker?.registry || "",
+    });
+    const buildRegistries = await askValue<string>(interactInstance, {
+      type: "input",
+      name: "dockerBuildRegistries",
+      message: "Registries to authenticate before Docker builds (comma-separated, empty means all):",
+      default: Array.isArray(currentTargets.docker?.buildRegistries)
+        ? currentTargets.docker.buildRegistries.join(", ")
+        : "",
+    });
     const patterns = await askValue<string>(interactInstance, {
       type: "input",
       name: "dockerPatterns",
@@ -906,6 +925,8 @@ async function handleRelease(mode: ICliMode): Promise<void> {
     releaseTargets.docker = {
       enabled: true,
       engine: "tsdocker",
+      registry: registry.trim() || undefined,
+      buildRegistries: parseCsv(buildRegistries),
       patterns: parseCsv(patterns),
       cached,
       parallel: parseDockerParallel(parallel),
@@ -1296,6 +1317,7 @@ function parseConfigValue(rawValue: string): any {
   ) {
     return JSON.parse(trimmedValue);
   }
+
   return rawValue;
 }
 
@@ -1963,6 +1985,36 @@ async function validateDockerTarget(
     });
   }
 
+  if (
+    dockerTarget.registry !== undefined
+    && (typeof dockerTarget.registry !== "string"
+      || !dockerTarget.registry.trim()
+      || /^https?:\/\//.test(dockerTarget.registry))
+  ) {
+    findings.push({
+      level: "error",
+      message: `Invalid tsdocker release registry: ${formatValue(dockerTarget.registry)}`,
+      fix: "Use one configured registry host without a protocol, or remove release.targets.docker.registry.",
+    });
+  }
+
+  if (
+    dockerTarget.buildRegistries !== undefined
+    && (!Array.isArray(dockerTarget.buildRegistries)
+      || dockerTarget.buildRegistries.some((registryArg: unknown) =>
+        typeof registryArg !== "string"
+        || !registryArg.trim()
+        || /^https?:\/\//.test(registryArg)
+      )
+      || new Set(dockerTarget.buildRegistries).size !== dockerTarget.buildRegistries.length)
+  ) {
+    findings.push({
+      level: "error",
+      message: "Invalid tsdocker build registry authentication list",
+      fix: "Use unique configured registry hosts without protocols, or remove release.targets.docker.buildRegistries.",
+    });
+  }
+
   if (!isValidDockerParallel(dockerTarget.parallel)) {
     findings.push({
       level: "error",
@@ -1982,7 +2034,7 @@ async function validateDockerTarget(
     validateTsdockerProjectConfig(tsdockerConfig, findings);
   }
 
-  await validateTsdockerCommand(findings);
+  await validateTsdockerCommand(findings, dockerTarget.buildRegistries);
 
   findings.push({
     level: "ok",
@@ -2064,30 +2116,66 @@ function validateTsdockerProjectConfig(
   });
 }
 
-async function validateTsdockerCommand(findings: IDoctorFinding[]): Promise<void> {
+async function validateTsdockerCommand(
+  findings: IDoctorFinding[],
+  buildRegistriesArg: unknown,
+): Promise<void> {
+  let packageJson: unknown;
+  try {
+    packageJson = JSON.parse(
+      await plugins.fs.readFile(plugins.path.join(process.cwd(), "package.json"), "utf8"),
+    );
+  } catch {
+    packageJson = undefined;
+  }
+  if (!getDeclaredTsdockerRange(packageJson)) {
+    findings.push({
+      level: "error",
+      message: "Docker release target requires project-local @git.zone/tsdocker",
+      fix: "Run pnpm add --save-dev @git.zone/tsdocker.",
+    });
+  }
+  if (!(await hasInstalledProjectTsdockerBinary(process.cwd()))) {
+    findings.push({
+      level: "error",
+      message: "Project-local tSDocker binary is not installed",
+      fix: "Run pnpm install after declaring @git.zone/tsdocker.",
+    });
+  }
   const smartshellInstance = new plugins.smartshell.Smartshell({
     executor: "bash",
     sourceFilePaths: [],
   });
   try {
     const result = await smartshellInstance.execSpawn(
-      "tsdocker",
-      ["--version"],
+      "pnpm",
+      ["exec", "tsdocker", "--version"],
       { silent: true, timeout: 8000 },
     );
     if (result.exitCode === 0) {
       findings.push({ level: "ok", message: "tsdocker command is available" });
+      if (
+        Array.isArray(buildRegistriesArg)
+        && buildRegistriesArg.length > 0
+        && !supportsBoundedBuildRegistryAuthentication(result.combinedOutput)
+      ) {
+        findings.push({
+          level: "error",
+          message: "Bounded Docker build authentication requires @git.zone/tsdocker >= 3.3.0",
+          fix: "Upgrade the project's @git.zone/tsdocker dev dependency to at least 3.3.0.",
+        });
+      }
     } else {
       findings.push({
         level: "error",
-        message: "tsdocker command is not available",
-        fix: "Install @git.zone/tsdocker globally or make it available on PATH.",
+        message: "Project-local tsdocker command is not available",
+        fix: "Install @git.zone/tsdocker as a project dev dependency.",
       });
     }
   } catch (error) {
     findings.push({
       level: "error",
-      message: "Could not execute tsdocker",
+      message: "Could not execute project-local tsdocker",
       fix: error instanceof Error ? error.message : String(error),
     });
   }

package/ts/mod_docker/classes.dockerpruner.ts

@@ -71,15 +71,14 @@ const dockerCommand = `timeout ${dockerTimeoutSeconds}s docker`;
 export class DockerPruner {
   private smartshell = new plugins.smartshell.Smartshell({ executor: 'bash' });
 
-  private async run(commandArg: string): Promise<{ exitCode: number; stdout: string }> {
-    const result = await this.smartshell.execSilent(commandArg);
-    return { exitCode: result.exitCode, stdout: result.stdout || '' };
+  private async run(commandArg: string): Promise<plugins.smartshell.IExecResult> {
+    return this.smartshell.execSilent(commandArg);
   }
 
   private async listLines(commandArg: string): Promise<string[]> {
     const result = await this.run(commandArg);
     if (result.exitCode !== 0) {
-      throw new Error(result.stdout || `docker command failed: ${commandArg}`);
+      throw new Error(result.combinedOutput);
     }
     if (!result.stdout.trim()) {
       return [];
@@ -99,7 +98,7 @@ export class DockerPruner {
       `${dockerCommand} inspect ${idsArg.map((id) => shellQuote(id)).join(' ')}`,
     );
     if (result.exitCode !== 0) {
-      throw new Error(result.stdout || 'docker inspect failed');
+      throw new Error(result.combinedOutput);
     }
     try {
       const parsed = JSON.parse(result.stdout);
@@ -287,7 +286,7 @@ export class DockerPruner {
         }
         const result = await this.run(`${dockerCommand} rm ${shellQuote(planned.id)}`);
         if (result.exitCode !== 0) {
-          throw new Error(`Failed to remove container ${planned.name}: ${result.stdout}`);
+          throw new Error(`Failed to remove container ${planned.name}: ${result.combinedOutput}`);
         }
         removedContainers.push(planned.name);
         logger.log('ok', `Removed container ${planned.name}`);
@@ -322,7 +321,7 @@ export class DockerPruner {
         }
         const result = await this.run(`${dockerCommand} volume rm ${shellQuote(planned.name)}`);
         if (result.exitCode !== 0) {
-          throw new Error(`Failed to remove volume ${planned.name}: ${result.stdout}`);
+          throw new Error(`Failed to remove volume ${planned.name}: ${result.combinedOutput}`);
         }
         removedVolumes.push(planned.name);
         logger.log('ok', `Removed volume ${planned.name}`);

package/ts/mod_release/index.ts

@@ -9,10 +9,13 @@ import {
   readPendingChangelog,
 } from "../helpers.changelog.js";
 import {
+  getDeclaredTsdockerRange,
   resolveReleaseWorkflow,
+  supportsBoundedBuildRegistryAuthentication,
   type IResolvedReleaseWorkflow,
 } from "../helpers.workflow.js";
 import * as commitHelpers from "../mod_commit/mod.helpers.js";
+import { hasInstalledProjectTsdockerBinary } from "../helpers.tsdocker.js";
 
 type TTargetStatus = "success" | "already-published" | "skipped" | "failed";
 
@@ -247,7 +250,7 @@ async function runNpmTarget(
   for (const registry of workflow.npmRegistries) {
     const command = `pnpm publish --registry=${registry} --access=${workflow.npmAccessLevel}`;
     const result = await smartshellInstance.exec(command);
-    const output = `${result.stdout || ""}\n${(result as any).stderr || ""}\n${(result as any).combinedOutput || ""}`;
+    const output = result.combinedOutput;
     if (result.exitCode === 0) {
       results.push({ target: registry, status: "success" });
     } else if (isAlreadyPublishedOutput(output) && workflow.npmAlreadyPublished === "success") {
@@ -267,9 +270,46 @@ async function runDockerTarget(
     return [{ target: "docker", status: "skipped", message: "disabled" }];
   }
 
+  let packageJson: unknown;
+  try {
+    packageJson = JSON.parse(
+      await plugins.fs.readFile(plugins.path.join(paths.cwd, "package.json"), "utf8"),
+    );
+  } catch {
+    packageJson = undefined;
+  }
+  if (!getDeclaredTsdockerRange(packageJson)) {
+    return [{
+      target: "tsdocker",
+      status: "failed",
+      message: "Docker releases require @git.zone/tsdocker as a project dependency",
+    }];
+  }
+  if (!(await hasInstalledProjectTsdockerBinary(paths.cwd))) {
+    return [{
+      target: "tsdocker",
+      status: "failed",
+      message: "Docker releases require the installed project-local tSDocker binary",
+    }];
+  }
+
+  if (workflow.dockerBuildRegistries.length > 0) {
+    const versionResult = await smartshellInstance.exec("pnpm exec tsdocker --version");
+    if (
+      versionResult.exitCode !== 0
+      || !supportsBoundedBuildRegistryAuthentication(versionResult.combinedOutput)
+    ) {
+      return [{
+        target: "tsdocker",
+        status: "failed",
+        message: "release.targets.docker.buildRegistries requires project-local @git.zone/tsdocker >= 3.3.0",
+      }];
+    }
+  }
+
   const command = buildTsdockerPushCommand(workflow);
   const result = await smartshellInstance.exec(command);
-  const output = `${result.stdout || ""}\n${(result as any).stderr || ""}\n${(result as any).combinedOutput || ""}`;
+  const output = result.combinedOutput;
   return [{
     target: workflow.dockerPatterns.length > 0
       ? `tsdocker:${workflow.dockerPatterns.join(",")}`
@@ -279,8 +319,25 @@ async function runDockerTarget(
   }];
 }
 
-function buildTsdockerPushCommand(workflow: IResolvedReleaseWorkflow): string {
-  const commandParts = ["tsdocker", "push"];
+type TDockerCommandWorkflow = Pick<
+  IResolvedReleaseWorkflow,
+  | "dockerRegistry"
+  | "dockerBuildRegistries"
+  | "dockerNoBuild"
+  | "dockerCached"
+  | "dockerParallel"
+  | "dockerContext"
+  | "dockerPatterns"
+>;
+
+export function buildTsdockerPushCommand(workflow: TDockerCommandWorkflow): string {
+  const commandParts = ["pnpm", "exec", "tsdocker", "push"];
+  if (workflow.dockerRegistry) {
+    commandParts.push(`--registry=${shellQuote(workflow.dockerRegistry)}`);
+  }
+  if (workflow.dockerBuildRegistries.length > 0) {
+    commandParts.push(`--build-registries=${shellQuote(workflow.dockerBuildRegistries.join(","))}`);
+  }
   if (workflow.dockerNoBuild) {
     commandParts.push("--no-build");
   }
@@ -328,6 +385,8 @@ function printReleasePlan(workflow: IResolvedReleaseWorkflow): void {
   }
   if (workflow.targets.includes("docker")) {
     console.log(`docker engine: ${workflow.dockerEngine}`);
+    console.log(`docker registry: ${workflow.dockerRegistry || "all configured registries"}`);
+    console.log(`docker build authentication: ${workflow.dockerBuildRegistries.length > 0 ? workflow.dockerBuildRegistries.join(", ") : "all configured registries"}`);
     console.log(`docker patterns: ${workflow.dockerPatterns.length > 0 ? workflow.dockerPatterns.join(", ") : "all Dockerfiles"}`);
     console.log(`docker options: ${formatDockerOptions(workflow)}`);
   }
@@ -336,6 +395,10 @@ function printReleasePlan(workflow: IResolvedReleaseWorkflow): void {
 
 function formatDockerOptions(workflow: IResolvedReleaseWorkflow): string {
   const options: string[] = [];
+  if (workflow.dockerRegistry) options.push(`registry=${workflow.dockerRegistry}`);
+  if (workflow.dockerBuildRegistries.length > 0) {
+    options.push(`buildRegistries=${workflow.dockerBuildRegistries.join(",")}`);
+  }
   if (workflow.dockerCached) options.push("cached");
   if (workflow.dockerParallel) options.push(`parallel=${workflow.dockerParallel === true ? "true" : workflow.dockerParallel}`);
   if (workflow.dockerNoBuild) options.push("no-build");