@git.zone/cli 6.0.0 → 6.1.0

package/ts/mod_config/index.ts

@@ -19,13 +19,9 @@ import {
   CURRENT_GITZONE_CLI_SCHEMA_VERSION,
   migrateSmartconfigData,
 } from "../helpers.smartconfigmigrations.js";
-import {
-  formatTsdockerMinimumVersion,
-  getDeclaredTsdockerRange,
-  getTsdockerMinimumVersion,
-  supportsTsdockerMinimumVersion,
-} from "../helpers.workflow.js";
+import { getDeclaredTsdockerRange } from "../helpers.workflow.js";
 import { hasInstalledProjectTsdockerBinary } from "../helpers.tsdocker.js";
+import { TsdockerReleaseClient } from "../mod_release/helpers.tsdockerprotocol.js";
 
 export { ReleaseConfig, CommitConfig };
 
@@ -269,7 +265,12 @@ async function handleShow(mode: ICliMode): Promise<void> {
     ["projectType", formatValue(cliConfig.projectType)],
     ["repository", formatRepository(cliConfig.module)],
     ["description", formatValue(cliConfig.module?.description)],
-    ["npm package", formatValue(cliConfig.module?.npmPackagename || cliConfig.module?.npmPackageName)],
+    [
+      "npm package",
+      formatValue(
+        cliConfig.module?.npmPackagename || cliConfig.module?.npmPackageName,
+      ),
+    ],
     ["license", formatValue(cliConfig.module?.license)],
     ["keywords", formatList(cliConfig.module?.keywords)],
   ]);
@@ -309,12 +310,31 @@ async function handleShow(mode: ICliMode): Promise<void> {
   const rawAssets = cliConfig.assets || {};
   const assets = rawAssets.enabled === false ? {} : rawAssets;
   printConfigSection("Managed Assets", [
-    ["enabled", formatValue(rawAssets.enabled === false ? false : rawAssets.kind ? true : undefined)],
+    [
+      "enabled",
+      formatValue(
+        rawAssets.enabled === false ? false : rawAssets.kind ? true : undefined,
+      ),
+    ],
     ["kind", formatValue(assets.kind)],
     ["cli name", formatValue(assets.cliName)],
-    ["installer", formatValue(assets.installer?.enabled === false ? false : assets.kind ? true : undefined)],
+    [
+      "installer",
+      formatValue(
+        assets.installer?.enabled === false
+          ? false
+          : assets.kind
+            ? true
+            : undefined,
+      ),
+    ],
     ["npm wrapper", formatValue(assets.npmWrapper?.enabled)],
-    ["release workflow", formatValue(assets.releaseWorkflow?.enabled ?? assets.releaseAssets?.enabled)],
+    [
+      "release workflow",
+      formatValue(
+        assets.releaseWorkflow?.enabled ?? assets.releaseAssets?.enabled,
+      ),
+    ],
   ]);
 
   console.log("Run `gitzone config doctor` to validate this configuration.");
@@ -379,7 +399,10 @@ async function handleRemove(
   const registries = config.getRegistries();
 
   if (registries.length === 0) {
-    plugins.logger.log("warn", "No npm target registries configured to remove.");
+    plugins.logger.log(
+      "warn",
+      "No npm target registries configured to remove.",
+    );
     return;
   }
 
@@ -636,7 +659,9 @@ function showCommitHelp(): void {
 
 async function handleProject(mode: ICliMode): Promise<void> {
   if (!mode.interactive) {
-    throw new Error("Project configuration requires interactive mode. Use `gitzone config set` for automation.");
+    throw new Error(
+      "Project configuration requires interactive mode. Use `gitzone config set` for automation.",
+    );
   }
 
   const smartconfigData = await readSmartconfigFile();
@@ -680,7 +705,11 @@ async function handleProject(mode: ICliMode): Promise<void> {
     type: "input",
     name: "npmPackagename",
     message: "npm package name:",
-    default: moduleConfig.npmPackagename || moduleConfig.npmPackageName || packageJson.name || "",
+    default:
+      moduleConfig.npmPackagename ||
+      moduleConfig.npmPackageName ||
+      packageJson.name ||
+      "",
   });
   const license = await askValue<string>(interactInstance, {
     type: "input",
@@ -699,7 +728,11 @@ async function handleProject(mode: ICliMode): Promise<void> {
         : "",
   });
 
-  setCliConfigValueInData(smartconfigData, "schemaVersion", CURRENT_GITZONE_CLI_SCHEMA_VERSION);
+  setCliConfigValueInData(
+    smartconfigData,
+    "schemaVersion",
+    CURRENT_GITZONE_CLI_SCHEMA_VERSION,
+  );
   setCliConfigValueInData(smartconfigData, "projectType", projectType);
   setCliConfigValueInData(smartconfigData, "module", {
     ...moduleConfig,
@@ -718,7 +751,9 @@ async function handleProject(mode: ICliMode): Promise<void> {
 
 async function handleCli(mode: ICliMode): Promise<void> {
   if (!mode.interactive) {
-    throw new Error("CLI behavior configuration requires interactive mode. Use `gitzone config set` for automation.");
+    throw new Error(
+      "CLI behavior configuration requires interactive mode. Use `gitzone config set` for automation.",
+    );
   }
 
   const smartconfigData = await readSmartconfigFile();
@@ -745,7 +780,11 @@ async function handleCli(mode: ICliMode): Promise<void> {
     default: cliConfig.checkUpdates ?? true,
   });
 
-  setCliConfigValueInData(smartconfigData, "schemaVersion", CURRENT_GITZONE_CLI_SCHEMA_VERSION);
+  setCliConfigValueInData(
+    smartconfigData,
+    "schemaVersion",
+    CURRENT_GITZONE_CLI_SCHEMA_VERSION,
+  );
   setCliConfigValueInData(smartconfigData, "cli", {
     output,
     interactive,
@@ -758,11 +797,14 @@ async function handleCli(mode: ICliMode): Promise<void> {
 
 async function handleRelease(mode: ICliMode): Promise<void> {
   if (!mode.interactive) {
-    throw new Error("Release configuration requires interactive mode. Use `gitzone config set` for automation.");
+    throw new Error(
+      "Release configuration requires interactive mode. Use `gitzone config set` for automation.",
+    );
   }
 
   const smartconfigData = await readSmartconfigFile();
-  const currentRelease = getCliConfigValueFromData(smartconfigData, "release") || {};
+  const currentRelease =
+    getCliConfigValueFromData(smartconfigData, "release") || {};
   const currentTargets = currentRelease.targets || {};
   const interactInstance = new plugins.smartinteract.SmartInteract();
 
@@ -865,13 +907,15 @@ async function handleRelease(mode: ICliMode): Promise<void> {
     const registry = await askValue<string>(interactInstance, {
       type: "input",
       name: "dockerRegistry",
-      message: "Single tsdocker registry target (empty means all configured registries):",
+      message:
+        "Single tsdocker registry target (empty means all configured registries):",
       default: currentTargets.docker?.registry || "",
     });
     const buildRegistries = await askValue<string>(interactInstance, {
       type: "input",
       name: "dockerBuildRegistries",
-      message: "Registries to authenticate before Docker builds (comma-separated, empty means all):",
+      message:
+        "Registries to authenticate before Docker builds (comma-separated, empty means all):",
       default: Array.isArray(currentTargets.docker?.buildRegistries)
         ? currentTargets.docker.buildRegistries.join(", ")
         : "",
@@ -879,7 +923,8 @@ async function handleRelease(mode: ICliMode): Promise<void> {
     const patterns = await askValue<string>(interactInstance, {
       type: "input",
       name: "dockerPatterns",
-      message: "tsdocker Dockerfile patterns (comma-separated, empty means all):",
+      message:
+        "tsdocker Dockerfile patterns (comma-separated, empty means all):",
       default: Array.isArray(currentTargets.docker?.patterns)
         ? currentTargets.docker.patterns.join(", ")
         : "",
@@ -908,12 +953,6 @@ async function handleRelease(mode: ICliMode): Promise<void> {
       message: "Docker context for tsdocker (empty for default):",
       default: currentTargets.docker?.context || "",
     });
-    const noBuild = await askValue<boolean>(interactInstance, {
-      type: "confirm",
-      name: "dockerNoBuild",
-      message: "Skip tsdocker build and only push existing local registry images?",
-      default: currentTargets.docker?.noBuild ?? false,
-    });
     releaseTargets.docker = {
       enabled: true,
       engine: "tsdocker",
@@ -924,13 +963,16 @@ async function handleRelease(mode: ICliMode): Promise<void> {
       cached,
       parallel: parseDockerParallel(parallel),
       context: context.trim() || undefined,
-      noBuild,
     };
   } else {
     releaseTargets.docker = { enabled: false, engine: "tsdocker" };
   }
 
-  setCliConfigValueInData(smartconfigData, "schemaVersion", CURRENT_GITZONE_CLI_SCHEMA_VERSION);
+  setCliConfigValueInData(
+    smartconfigData,
+    "schemaVersion",
+    CURRENT_GITZONE_CLI_SCHEMA_VERSION,
+  );
   const currentPreflight = { ...(currentRelease.preflight || {}) };
   delete currentPreflight.requireCleanTree;
   setCliConfigValueInData(smartconfigData, "release", {
@@ -959,7 +1001,8 @@ async function handleFix(argvArg: any, mode: ICliMode): Promise<void> {
   if (mode.json) {
     printJson({
       ok: false,
-      error: "JSON output is not supported for `gitzone config fix`. Use `gitzone config doctor --json` for machine-readable diagnostics.",
+      error:
+        "JSON output is not supported for `gitzone config fix`. Use `gitzone config doctor --json` for machine-readable diagnostics.",
     });
     process.exitCode = 1;
     return;
@@ -980,12 +1023,15 @@ async function handleFix(argvArg: any, mode: ICliMode): Promise<void> {
 
   if (!mode.yes) {
     if (!mode.interactive) {
-      throw new Error("Config fix requires an interactive terminal or `-y` to run non-interactively.");
+      throw new Error(
+        "Config fix requires an interactive terminal or `-y` to run non-interactively.",
+      );
     }
-    const confirmed = await plugins.smartinteract.SmartInteract.getCliConfirmation(
-      `Run configuration fixes for .smartconfig.json? (${counts.error} error, ${counts.warn} warning)`,
-      true,
-    );
+    const confirmed =
+      await plugins.smartinteract.SmartInteract.getCliConfirmation(
+        `Run configuration fixes for .smartconfig.json? (${counts.error} error, ${counts.warn} warning)`,
+        true,
+      );
     if (!confirmed) {
       plugins.logger.log("info", "Config fix cancelled.");
       return;
@@ -996,7 +1042,12 @@ async function handleFix(argvArg: any, mode: ICliMode): Promise<void> {
   if (appliedKnownFixes) {
     findings = await collectDoctorFindings();
     counts = countDoctorFindings(findings);
-    if (counts.error === 0 && counts.warn === 0 && !extraInstructions && !force) {
+    if (
+      counts.error === 0 &&
+      counts.warn === 0 &&
+      !extraInstructions &&
+      !force
+    ) {
       printDoctorResult(findings, mode);
       return;
     }
@@ -1032,7 +1083,9 @@ async function handleFix(argvArg: any, mode: ICliMode): Promise<void> {
       stdio: "inherit",
     });
   } catch (error) {
-    throw new Error(`Failed to run opencode: ${error instanceof Error ? error.message : String(error)}`);
+    throw new Error(
+      `Failed to run opencode: ${error instanceof Error ? error.message : String(error)}`,
+    );
   }
 
   if (result.exitCode !== 0) {
@@ -1076,7 +1129,9 @@ async function applyKnownConfigFixes(mode: ICliMode): Promise<boolean> {
 async function collectDoctorFindings(): Promise<IDoctorFinding[]> {
   const findings: IDoctorFinding[] = [];
   const smartconfigPath = getSmartconfigPath();
-  const smartconfigExists = await plugins.smartfs.file(smartconfigPath).exists();
+  const smartconfigExists = await plugins.smartfs
+    .file(smartconfigPath)
+    .exists();
 
   if (!smartconfigExists) {
     findings.push({
@@ -1108,7 +1163,13 @@ async function collectDoctorFindings(): Promise<IDoctorFinding[]> {
     });
   }
 
-  for (const legacyNamespace of ["gitzone", "tsdoc", "npmdocker", "npmci", "szci"]) {
+  for (const legacyNamespace of [
+    "gitzone",
+    "tsdoc",
+    "npmdocker",
+    "npmci",
+    "szci",
+  ]) {
     if (smartconfigData[legacyNamespace]) {
       findings.push({
         level: "warn",
@@ -1119,7 +1180,10 @@ async function collectDoctorFindings(): Promise<IDoctorFinding[]> {
   }
 
   if (cliConfig.schemaVersion === CURRENT_GITZONE_CLI_SCHEMA_VERSION) {
-    findings.push({ level: "ok", message: `Schema version is current (${CURRENT_GITZONE_CLI_SCHEMA_VERSION})` });
+    findings.push({
+      level: "ok",
+      message: `Schema version is current (${CURRENT_GITZONE_CLI_SCHEMA_VERSION})`,
+    });
   } else {
     findings.push({
       level: "warn",
@@ -1129,7 +1193,10 @@ async function collectDoctorFindings(): Promise<IDoctorFinding[]> {
   }
 
   if (["npm", "service", "wcc", "website"].includes(cliConfig.projectType)) {
-    findings.push({ level: "ok", message: `Project type is ${cliConfig.projectType}` });
+    findings.push({
+      level: "ok",
+      message: `Project type is ${cliConfig.projectType}`,
+    });
   } else {
     findings.push({
       level: "warn",
@@ -1286,7 +1353,10 @@ async function handleMigrate(
       `Migrated .smartconfig.json from schema v${result.fromVersion} to v${result.toVersion}`,
     );
   } else {
-    plugins.logger.log("info", `.smartconfig.json already at schema v${result.toVersion}`);
+    plugins.logger.log(
+      "info",
+      `.smartconfig.json already at schema v${result.toVersion}`,
+    );
   }
 }
 
@@ -1389,7 +1459,8 @@ function formatTarget(enabled: unknown, targetConfig: any): string {
   if (Array.isArray(targetConfig.registries)) {
     details.push(`registries=${targetConfig.registries.length}`);
   }
-  if (targetConfig.accessLevel) details.push(`access=${targetConfig.accessLevel}`);
+  if (targetConfig.accessLevel)
+    details.push(`access=${targetConfig.accessLevel}`);
   if (targetConfig.engine) details.push(`engine=${targetConfig.engine}`);
   if (Array.isArray(targetConfig.patterns)) {
     details.push(`patterns=${targetConfig.patterns.length}`);
@@ -1397,14 +1468,10 @@ function formatTarget(enabled: unknown, targetConfig: any): string {
   if (targetConfig.cached) details.push("cached=true");
   if (targetConfig.parallel) details.push(`parallel=${targetConfig.parallel}`);
   if (targetConfig.context) details.push(`context=${targetConfig.context}`);
-  if (targetConfig.noBuild) details.push("noBuild=true");
   return details.length > 0 ? `${state} (${details.join(", ")})` : state;
 }
 
-async function askValue<T>(
-  interactInstance: any,
-  options: any,
-): Promise<T> {
+async function askValue<T>(interactInstance: any, options: any): Promise<T> {
   const response = await interactInstance.askQuestion(options);
   return response.value as T;
 }
@@ -1452,7 +1519,10 @@ function formatDockerParallel(value: unknown): string {
 
 function parseDockerParallel(value: string): boolean | number {
   const normalizedValue = value.trim().toLowerCase();
-  if (!normalizedValue || ["false", "no", "off", "0"].includes(normalizedValue)) {
+  if (
+    !normalizedValue ||
+    ["false", "no", "off", "0"].includes(normalizedValue)
+  ) {
     return false;
   }
   if (["true", "yes", "on"].includes(normalizedValue)) {
@@ -1467,19 +1537,29 @@ function parseDockerParallel(value: string): boolean | number {
 
 function normalizeRegistryUrl(url: string): string {
   let normalizedUrl = url.trim();
-  if (!normalizedUrl.startsWith("http://") && !normalizedUrl.startsWith("https://")) {
+  if (
+    !normalizedUrl.startsWith("http://") &&
+    !normalizedUrl.startsWith("https://")
+  ) {
     normalizedUrl = `https://${normalizedUrl}`;
   }
-  return normalizedUrl.endsWith("/") ? normalizedUrl.slice(0, -1) : normalizedUrl;
+  return normalizedUrl.endsWith("/")
+    ? normalizedUrl.slice(0, -1)
+    : normalizedUrl;
 }
 
-function getDefaultEnabledTargets(currentTargets: Record<string, any>): string[] {
+function getDefaultEnabledTargets(
+  currentTargets: Record<string, any>,
+): string[] {
   const enabledTargets: string[] = [];
   const npmRegistries = currentTargets.npm?.registries;
   if (currentTargets.git?.enabled ?? true) {
     enabledTargets.push("git");
   }
-  if (currentTargets.npm?.enabled ?? (Array.isArray(npmRegistries) && npmRegistries.length > 0)) {
+  if (
+    currentTargets.npm?.enabled ??
+    (Array.isArray(npmRegistries) && npmRegistries.length > 0)
+  ) {
     enabledTargets.push("npm");
   }
   if (currentTargets.docker?.enabled ?? false) {
@@ -1518,7 +1598,8 @@ function buildConfigFixPrompt(
     `- Use schemaVersion ${CURRENT_GITZONE_CLI_SCHEMA_VERSION} for ` +
       "`@git.zone/cli`.",
     "- Use target-based release config: `release.targets.git`, `release.targets.npm`, and `release.targets.docker`.",
-    "- Docker release targets must use `release.targets.docker.engine = \"tsdocker\"`; Docker registries belong under `@git.zone/tsdocker`.",
+    '- Docker release targets must use `release.targets.docker.engine = "tsdocker"`; Docker registries belong under `@git.zone/tsdocker`.',
+    "- Remove `release.targets.docker.noBuild`; journaled Docker qualification always builds.",
     "- Keep npm registries only at `@git.zone/cli.release.targets.npm.registries`.",
     "- Do not add runtime legacy compatibility code. If legacy config exists, migrate it explicitly.",
     "- Do not commit, release, install dependencies, or modify unrelated files.",
@@ -1558,7 +1639,9 @@ function printDoctorResult(findings: IDoctorFinding[], mode: ICliMode): void {
       }
     }
     console.log("");
-    console.log(`Summary: ${counts.ok} ok, ${counts.warn} warning, ${counts.error} error`);
+    console.log(
+      `Summary: ${counts.ok} ok, ${counts.warn} warning, ${counts.error} error`,
+    );
     console.log("");
   }
 
@@ -1572,8 +1655,14 @@ function validateCommitConfig(
   findings: IDoctorFinding[],
 ): void {
   const confirmation = commitConfig.confirmation;
-  if (confirmation === undefined || validConfirmationModes.includes(confirmation)) {
-    findings.push({ level: "ok", message: "Commit confirmation mode is valid" });
+  if (
+    confirmation === undefined ||
+    validConfirmationModes.includes(confirmation)
+  ) {
+    findings.push({
+      level: "ok",
+      message: "Commit confirmation mode is valid",
+    });
   } else {
     findings.push({
       level: "warn",
@@ -1584,7 +1673,10 @@ function validateCommitConfig(
 
   const steps = commitConfig.steps;
   if (steps === undefined) {
-    findings.push({ level: "ok", message: "Commit workflow uses default steps" });
+    findings.push({
+      level: "ok",
+      message: "Commit workflow uses default steps",
+    });
     return;
   }
   if (!Array.isArray(steps) || steps.length === 0) {
@@ -1660,8 +1752,14 @@ async function validateReleaseConfig(
   }
 
   const confirmation = releaseConfig.confirmation;
-  if (confirmation === undefined || validConfirmationModes.includes(confirmation)) {
-    findings.push({ level: "ok", message: "Release confirmation mode is valid" });
+  if (
+    confirmation === undefined ||
+    validConfirmationModes.includes(confirmation)
+  ) {
+    findings.push({
+      level: "ok",
+      message: "Release confirmation mode is valid",
+    });
   } else {
     findings.push({
       level: "warn",
@@ -1670,7 +1768,12 @@ async function validateReleaseConfig(
     });
   }
 
-  if (releaseConfig.registries || releaseConfig.accessLevel || releaseConfig.steps || releaseConfig.changelog) {
+  if (
+    releaseConfig.registries ||
+    releaseConfig.accessLevel ||
+    releaseConfig.steps ||
+    releaseConfig.changelog
+  ) {
     findings.push({
       level: "warn",
       message: "Legacy release keys are present outside release.targets",
@@ -1706,7 +1809,10 @@ async function validateAssetsConfig(
   findings: IDoctorFinding[],
 ): Promise<void> {
   if (rawAssetsConfig === undefined) {
-    findings.push({ level: "ok", message: "Managed assets are not configured" });
+    findings.push({
+      level: "ok",
+      message: "Managed assets are not configured",
+    });
     return;
   }
   if (!isPlainObject(rawAssetsConfig)) {
@@ -1738,15 +1844,21 @@ async function validateAssetsConfig(
       fix: "Set @git.zone/cli.assets.cliName.",
     });
   } else {
-    findings.push({ level: "ok", message: `Managed denoBinaryCli assets target ${cliName}` });
+    findings.push({
+      level: "ok",
+      message: `Managed denoBinaryCli assets target ${cliName}`,
+    });
   }
 
   const tsdenoConfig = smartconfigData["@git.zone/tsdeno"];
-  const binaryTargets = isPlainObject(rawAssetsConfig.binary) && Array.isArray(rawAssetsConfig.binary.targets)
-    ? rawAssetsConfig.binary.targets
-    : isPlainObject(tsdenoConfig) && Array.isArray(tsdenoConfig.compileTargets)
-      ? tsdenoConfig.compileTargets
-      : [];
+  const binaryTargets =
+    isPlainObject(rawAssetsConfig.binary) &&
+    Array.isArray(rawAssetsConfig.binary.targets)
+      ? rawAssetsConfig.binary.targets
+      : isPlainObject(tsdenoConfig) &&
+          Array.isArray(tsdenoConfig.compileTargets)
+        ? tsdenoConfig.compileTargets
+        : [];
   if (binaryTargets.length === 0) {
     findings.push({
       level: "error",
@@ -1754,22 +1866,37 @@ async function validateAssetsConfig(
       fix: "Add @git.zone/tsdeno.compileTargets or @git.zone/cli.assets.binary.targets.",
     });
   } else {
-    findings.push({ level: "ok", message: `Managed assets have ${binaryTargets.length} binary target(s)` });
+    findings.push({
+      level: "ok",
+      message: `Managed assets have ${binaryTargets.length} binary target(s)`,
+    });
   }
 
   const npmWrapper = rawAssetsConfig.npmWrapper;
-  if (isPlainObject(npmWrapper) && npmWrapper.enabled === true && typeof cliName === "string" && cliName.trim()) {
+  if (
+    isPlainObject(npmWrapper) &&
+    npmWrapper.enabled === true &&
+    typeof cliName === "string" &&
+    cliName.trim()
+  ) {
     const packageJson = await readPackageJson();
     const binFile = npmWrapper.binFile || `bin/${cliName}-wrapper.js`;
-    const postinstallFile = npmWrapper.postinstallFile || "scripts/install-binary.js";
-    if (!isPlainObject(packageJson.bin) || packageJson.bin[cliName] !== `./${binFile}`) {
+    const postinstallFile =
+      npmWrapper.postinstallFile || "scripts/install-binary.js";
+    if (
+      !isPlainObject(packageJson.bin) ||
+      packageJson.bin[cliName] !== `./${binFile}`
+    ) {
       findings.push({
         level: "warn",
         message: `package.json bin entry for ${cliName} is missing or outdated`,
         fix: "Run `gitzone format --only packagejson --write`.",
       });
     } else {
-      findings.push({ level: "ok", message: `package.json bin entry points to ${binFile}` });
+      findings.push({
+        level: "ok",
+        message: `package.json bin entry points to ${binFile}`,
+      });
     }
     if (packageJson.scripts?.postinstall !== `node ${postinstallFile}`) {
       findings.push({
@@ -1778,7 +1905,10 @@ async function validateAssetsConfig(
         fix: "Run `gitzone format --only packagejson --write`.",
       });
     } else {
-      findings.push({ level: "ok", message: `package.json postinstall runs ${postinstallFile}` });
+      findings.push({
+        level: "ok",
+        message: `package.json postinstall runs ${postinstallFile}`,
+      });
     }
   }
 }
@@ -1825,7 +1955,9 @@ async function validateNpmTarget(
   npmTarget: Record<string, any>,
   findings: IDoctorFinding[],
 ): Promise<void> {
-  const registries = Array.isArray(npmTarget.registries) ? npmTarget.registries : [];
+  const registries = Array.isArray(npmTarget.registries)
+    ? npmTarget.registries
+    : [];
   const enabled = npmTarget.enabled ?? registries.length > 0;
   if (!enabled) {
     findings.push({ level: "ok", message: "npm release target is disabled" });
@@ -1841,14 +1973,20 @@ async function validateNpmTarget(
     return;
   }
 
-  if (npmTarget.accessLevel && !["public", "private"].includes(npmTarget.accessLevel)) {
+  if (
+    npmTarget.accessLevel &&
+    !["public", "private"].includes(npmTarget.accessLevel)
+  ) {
     findings.push({
       level: "error",
       message: `Invalid npm access level: ${npmTarget.accessLevel}`,
       fix: "Use public or private.",
     });
   }
-  if (npmTarget.alreadyPublished && !["success", "error"].includes(npmTarget.alreadyPublished)) {
+  if (
+    npmTarget.alreadyPublished &&
+    !["success", "error"].includes(npmTarget.alreadyPublished)
+  ) {
     findings.push({
       level: "error",
       message: `Invalid npm alreadyPublished behavior: ${npmTarget.alreadyPublished}`,
@@ -1901,7 +2039,9 @@ async function validateNpmRegistry(
   }
 
   try {
-    const result = await smartNetwork.checkEndpoint(normalizedRegistry, { timeout: 5000 });
+    const result = await smartNetwork.checkEndpoint(normalizedRegistry, {
+      timeout: 5000,
+    });
     if (result.status >= 200 && result.status < 500) {
       findings.push({
         level: "ok",
@@ -1963,6 +2103,17 @@ async function validateDockerTarget(
   smartconfigData: Record<string, any>,
   findings: IDoctorFinding[],
 ): Promise<void> {
+  if (
+    dockerTarget.noBuild === true ||
+    (dockerTarget.noBuild !== undefined &&
+      typeof dockerTarget.noBuild !== "boolean")
+  ) {
+    findings.push({
+      level: "error",
+      message: "Docker release target cannot bypass qualification builds",
+      fix: "Remove release.targets.docker.noBuild or set it to false.",
+    });
+  }
   if ("images" in dockerTarget) {
     findings.push({
       level: "error",
@@ -1973,7 +2124,10 @@ async function validateDockerTarget(
 
   const enabled = dockerTarget.enabled ?? false;
   if (!enabled) {
-    findings.push({ level: "ok", message: "Docker release target is disabled" });
+    findings.push({
+      level: "ok",
+      message: "Docker release target is disabled",
+    });
     return;
   }
 
@@ -1985,7 +2139,10 @@ async function validateDockerTarget(
     });
   }
 
-  if (dockerTarget.patterns !== undefined && !Array.isArray(dockerTarget.patterns)) {
+  if (
+    dockerTarget.patterns !== undefined &&
+    !Array.isArray(dockerTarget.patterns)
+  ) {
     findings.push({
       level: "error",
       message: "Docker release target patterns must be an array",
@@ -1994,10 +2151,10 @@ async function validateDockerTarget(
   }
 
   if (
-    dockerTarget.registry !== undefined
-    && (typeof dockerTarget.registry !== "string"
-      || !dockerTarget.registry.trim()
-      || /^https?:\/\//.test(dockerTarget.registry))
+    dockerTarget.registry !== undefined &&
+    (typeof dockerTarget.registry !== "string" ||
+      !dockerTarget.registry.trim() ||
+      /^https?:\/\//.test(dockerTarget.registry))
   ) {
     findings.push({
       level: "error",
@@ -2007,14 +2164,16 @@ async function validateDockerTarget(
   }
 
   if (
-    dockerTarget.buildRegistries !== undefined
-    && (!Array.isArray(dockerTarget.buildRegistries)
-      || dockerTarget.buildRegistries.some((registryArg: unknown) =>
-        typeof registryArg !== "string"
-        || !registryArg.trim()
-        || /^https?:\/\//.test(registryArg)
-      )
-      || new Set(dockerTarget.buildRegistries).size !== dockerTarget.buildRegistries.length)
+    dockerTarget.buildRegistries !== undefined &&
+    (!Array.isArray(dockerTarget.buildRegistries) ||
+      dockerTarget.buildRegistries.some(
+        (registryArg: unknown) =>
+          typeof registryArg !== "string" ||
+          !registryArg.trim() ||
+          /^https?:\/\//.test(registryArg),
+      ) ||
+      new Set(dockerTarget.buildRegistries).size !==
+        dockerTarget.buildRegistries.length)
   ) {
     findings.push({
       level: "error",
@@ -2023,7 +2182,10 @@ async function validateDockerTarget(
     });
   }
 
-  if (dockerTarget.test !== undefined && typeof dockerTarget.test !== "boolean") {
+  if (
+    dockerTarget.test !== undefined &&
+    typeof dockerTarget.test !== "boolean"
+  ) {
     findings.push({
       level: "error",
       message: `Invalid tsdocker image test setting: ${formatValue(dockerTarget.test)}`,
@@ -2043,7 +2205,8 @@ async function validateDockerTarget(
   if (!isPlainObject(tsdockerConfig)) {
     findings.push({
       level: "error",
-      message: "Docker release target is enabled but @git.zone/tsdocker config is missing",
+      message:
+        "Docker release target is enabled but @git.zone/tsdocker config is missing",
       fix: "Add @git.zone/tsdocker.registries and optional registryRepoMap/platforms config.",
     });
   } else {
@@ -2073,10 +2236,12 @@ function isPlainObject(value: unknown): value is Record<string, any> {
 }
 
 function isValidDockerParallel(value: unknown): boolean {
-  return value === undefined ||
+  return (
+    value === undefined ||
     value === false ||
     value === true ||
-    (typeof value === "number" && Number.isFinite(value) && value > 0);
+    (typeof value === "number" && Number.isFinite(value) && value > 0)
+  );
 }
 
 function validateTsdockerProjectConfig(
@@ -2138,13 +2303,16 @@ function validateTsdockerProjectConfig(
 
 async function validateTsdockerCommand(
   findings: IDoctorFinding[],
-  buildRegistriesArg: unknown,
-  imageTestsRequestedArg: boolean,
+  _buildRegistriesArg: unknown,
+  _imageTestsRequestedArg: boolean,
 ): Promise<void> {
   let packageJson: unknown;
   try {
     packageJson = JSON.parse(
-      await plugins.fs.readFile(plugins.path.join(process.cwd(), "package.json"), "utf8"),
+      await plugins.fs.readFile(
+        plugins.path.join(process.cwd(), "package.json"),
+        "utf8",
+      ),
     );
   } catch {
     packageJson = undefined;
@@ -2152,7 +2320,8 @@ async function validateTsdockerCommand(
   if (!getDeclaredTsdockerRange(packageJson)) {
     findings.push({
       level: "error",
-      message: "Docker release target requires project-local @git.zone/tsdocker",
+      message:
+        "Docker release target requires project-local @git.zone/tsdocker",
       fix: "Run pnpm add --save-dev @git.zone/tsdocker.",
     });
   }
@@ -2168,43 +2337,22 @@ async function validateTsdockerCommand(
     sourceFilePaths: [],
   });
   try {
-    const result = await smartshellInstance.execSpawn(
-      "pnpm",
-      ["exec", "tsdocker", "--version"],
-      { silent: true, timeout: 8000 },
-    );
-    if (result.exitCode === 0) {
-      findings.push({ level: "ok", message: "tsdocker command is available" });
-      const minimumTsdockerVersion = getTsdockerMinimumVersion(
-        Array.isArray(buildRegistriesArg) && buildRegistriesArg.length > 0,
-        imageTestsRequestedArg,
-      );
-      if (
-        minimumTsdockerVersion
-        && !supportsTsdockerMinimumVersion(
-          result.combinedOutput,
-          minimumTsdockerVersion,
-        )
-      ) {
-        const minimumVersion = formatTsdockerMinimumVersion(minimumTsdockerVersion);
-        findings.push({
-          level: "error",
-          message: `Docker release options require @git.zone/tsdocker >= ${minimumVersion}`,
-          fix: `Upgrade the project's @git.zone/tsdocker dev dependency to at least ${minimumVersion}.`,
-        });
-      }
-    } else {
-      findings.push({
-        level: "error",
-        message: "Project-local tsdocker command is not available",
-        fix: "Install @git.zone/tsdocker as a project dev dependency.",
-      });
-    }
+    await new TsdockerReleaseClient(
+      smartshellInstance,
+      process.cwd(),
+    ).assertCapabilities();
+    findings.push({
+      level: "ok",
+      message: "Project-local tSDocker release protocol v1 is available",
+    });
   } catch (error) {
     findings.push({
       level: "error",
-      message: "Could not execute project-local tsdocker",
-      fix: error instanceof Error ? error.message : String(error),
+      message: "Project-local tSDocker release protocol is unavailable",
+      fix:
+        error instanceof Error
+          ? error.message
+          : "Install @git.zone/tsdocker >= 3.5.1.",
     });
   }
 }
@@ -2230,7 +2378,8 @@ async function validateDetectedProjectType(
   if (hasPackageJson && validProjectTypes.includes(cliConfig.projectType)) {
     findings.push({
       level: "ok",
-      message: "Detected project files match configured npm-compatible project type",
+      message:
+        "Detected project files match configured npm-compatible project type",
     });
     return;
   }
@@ -2238,7 +2387,8 @@ async function validateDetectedProjectType(
   if (hasDenoJson && !hasPackageJson) {
     findings.push({
       level: "warn",
-      message: "Detected a Deno-only project, but guided config supports npm-compatible project types",
+      message:
+        "Detected a Deno-only project, but guided config supports npm-compatible project types",
       fix: "Use `gitzone config set projectType npm|service|wcc|website` only for npm-compatible projects.",
     });
   }
@@ -2257,9 +2407,15 @@ export function showHelp(mode?: ICliMode): void {
           name: "show",
           description: "Display current @git.zone/cli configuration",
         },
-        { name: "project", description: "Configure project basics interactively" },
+        {
+          name: "project",
+          description: "Configure project basics interactively",
+        },
         { name: "cli", description: "Configure CLI behavior interactively" },
-        { name: "release", description: "Configure release workflow interactively" },
+        {
+          name: "release",
+          description: "Configure release workflow interactively",
+        },
         { name: "doctor", description: "Validate .smartconfig.json" },
         {
           name: "fix [instructions]",
@@ -2269,8 +2425,14 @@ export function showHelp(mode?: ICliMode): void {
         { name: "get <path>", description: "Read a single config value" },
         { name: "set <path> <value>", description: "Write a config value" },
         { name: "unset <path>", description: "Delete a config value" },
-        { name: "add [url]", description: "Add an npm release target registry" },
-        { name: "remove [url]", description: "Remove an npm release target registry" },
+        {
+          name: "add [url]",
+          description: "Add an npm release target registry",
+        },
+        {
+          name: "remove [url]",
+          description: "Remove an npm release target registry",
+        },
         { name: "clear", description: "Clear npm release target registries" },
         {
           name: "access [public|private]",
@@ -2306,11 +2468,19 @@ export function showHelp(mode?: ICliMode): void {
   console.log(
     "  show                        Display current @git.zone/cli configuration",
   );
-  console.log("  project                     Configure project basics interactively");
-  console.log("  cli                         Configure CLI behavior interactively");
-  console.log("  release                     Configure release workflow interactively");
+  console.log(
+    "  project                     Configure project basics interactively",
+  );
+  console.log(
+    "  cli                         Configure CLI behavior interactively",
+  );
+  console.log(
+    "  release                     Configure release workflow interactively",
+  );
   console.log("  doctor                      Validate .smartconfig.json");
-  console.log("  fix [instructions]          Repair .smartconfig.json via opencode");
+  console.log(
+    "  fix [instructions]          Repair .smartconfig.json via opencode",
+  );
   console.log(
     "                              with -y, opencode runs with --dangerously-skip-permissions ⚠️",
   );
@@ -2318,13 +2488,17 @@ export function showHelp(mode?: ICliMode): void {
   console.log("  set <path> <value>          Write a config value");
   console.log("  unset <path>                Delete a config value");
   console.log("  add [url]                   Add an npm target registry URL");
-  console.log("  remove [url]                Remove an npm target registry URL");
+  console.log(
+    "  remove [url]                Remove an npm target registry URL",
+  );
   console.log("  clear                       Clear npm target registries");
   console.log(
     "  access [public|private]     Set npm target access level for publishing",
   );
   console.log("  commit [setting] [value]    Configure commit options");
-  console.log("  migrate [version]           Run version-targeted smartconfig migrations");
+  console.log(
+    "  migrate [version]           Run version-targeted smartconfig migrations",
+  );
   console.log(
     "  services                    Configure which services are enabled",
   );