@git.zone/cli 6.0.0 → 6.1.0

package/readme.md

@@ -50,21 +50,21 @@ gitzone release
 
 ## Commands
 
-| Command | Purpose |
-| --- | --- |
-| `commit` | Analyze changes and create one semantic source commit |
-| `release` | Turn pending changelog entries into a versioned release and publish targets |
-| `format` | Plan or apply project formatting and standardization |
-| `config` | Inspect, update, and migrate `.smartconfig.json` |
-| `services` | Manage local MongoDB, ObjectStorage, and Elasticsearch containers |
-| `tools` | Manage the global `@git.zone` toolchain |
-| `template` | Scaffold projects from built-in templates |
-| `meta` | Manage multi-repository workspaces |
-| `open` | Open repository assets like CI pages |
-| `docker` | Report and reclaim Docker resources created by git.zone tooling |
-| `deprecate` | Deprecate npm packages across registries |
-| `start` | Prepare an existing project for local work |
-| `helpers` | Run small helper utilities |
+| Command     | Purpose                                                                     |
+| ----------- | --------------------------------------------------------------------------- |
+| `commit`    | Analyze changes and create one semantic source commit                       |
+| `release`   | Turn pending changelog entries into a versioned release and publish targets |
+| `format`    | Plan or apply project formatting and standardization                        |
+| `config`    | Inspect, update, and migrate `.smartconfig.json`                            |
+| `services`  | Manage local MongoDB, ObjectStorage, and Elasticsearch containers           |
+| `tools`     | Manage the global `@git.zone` toolchain                                     |
+| `template`  | Scaffold projects from built-in templates                                   |
+| `meta`      | Manage multi-repository workspaces                                          |
+| `open`      | Open repository assets like CI pages                                        |
+| `docker`    | Report and reclaim Docker resources created by git.zone tooling             |
+| `deprecate` | Deprecate npm packages across registries                                    |
+| `start`     | Prepare an existing project for local work                                  |
+| `helpers`   | Run small helper utilities                                                  |
 
 Global flags include `--help`, `--json`, `--plain`, `--agent`, `--no-interactive`, and `--no-check-updates`.
 
@@ -119,15 +119,15 @@ The commit flow:
 
 Commit flags:
 
-| Flag | Meaning |
-| --- | --- |
-| `-y`, `--yes` | Auto-accept safe recommendations |
+| Flag               | Meaning                                                        |
+| ------------------ | -------------------------------------------------------------- |
+| `-y`, `--yes`      | Auto-accept safe recommendations                               |
 | `--allow-breaking` | Allow `-y`/`--yes` to accept `BREAKING CHANGE` recommendations |
-| `-t`, `--test` | Add test step |
-| `-b`, `--build` | Add build step |
-| `-p`, `--push` | Push after the source commit |
-| `-f`, `--format` | Run `gitzone format --write` before commit |
-| `--plan` | Show resolved workflow only |
+| `-t`, `--test`     | Add test step                                                  |
+| `-b`, `--build`    | Add build step                                                 |
+| `-p`, `--push`     | Push after the source commit                                   |
+| `-f`, `--format`   | Run `gitzone format --write` before commit                     |
+| `--plan`           | Show resolved workflow only                                    |
 
 `-r` is intentionally not part of commit anymore. Use `gitzone release`.
 
@@ -137,7 +137,9 @@ Commit flags:
 
 `--merge` is intentionally strict: the source and existing `main` worktree must be clean, the source must be linearly rebased onto current remote `main`, and the Git target must push both the branch and tag. GitZone pins the single configured push URL, compare-and-swap fast-forwards local `main`, updates its verified worktree, and lease-pushes that exact source commit before creating release metadata. It rejects diverged or merged history, local replacement refs or grafts, stale worktrees, incomplete shallow history, changed destinations, and remote races. If the pre-release push fails, GitZone restores local `main` only when doing so cannot overwrite concurrent work. This plumbing-level integration intentionally does not run merge hooks or write `ORIG_HEAD`.
 
-`gitzone release` performs the release core once, then publishes to configured targets. An active Git target must succeed and be verified before npm publication can start.
+`gitzone release` performs the release core once, then publishes to configured targets. When Docker is active, its immutable candidate must qualify before any Git, npm, or OCI destination publication. An active Git target must then succeed and be verified before npm or OCI publication can start.
+
+Before interactive confirmation or source mutation, a Docker release verifies the project-local tSDocker capabilities and validates the deterministic request against the source commit. After the release commit and configured build, GitZone validates the final request against the release commit immediately before atomically installing the schema-2 journal.
 
 The release core is not configurable plumbing. It always follows the same professional release transaction:
 
@@ -149,15 +151,18 @@ The release core is not configurable plumbing. It always follows the same profes
 6. Move pending changelog entries into the new version section.
 7. Create the local release commit and tag on `main`.
 8. Run the configured release build, require a clean tree, and revalidate the release checkout.
-9. When npm is selected, pack it once into an exact tarball. Atomically install a durable journal for Git-only and npm releases before final Git release-ref or npm publication.
+9. When npm is selected, pack it once into an exact tarball.
+10. Atomically install a durable journal before final publication. Non-Docker releases use journal schema 1; Docker releases use schema 2 in the same storage tree.
+11. For schema 2, run the project-local tSDocker qualification build and configured image tests, then durably record the candidate digest graph and complete ordered promotion set.
+12. Publish and verify Git, then each npm registry, then each Docker destination. Remove only the exact qualified candidate after every destination is verified, or after a terminal qualification destination conflict before Git/npm publication.
 
 Targets decide what happens after that:
 
-| Target | What it does |
-| --- | --- |
-| `git` | Atomically pushes the exact `main` release commit and new tag, often triggering remote CI release builds |
-| `npm` | Publishes the same journaled tarball to every configured registry and verifies its bytes anonymously |
-| `docker` | Fails closed in journal schema v1 until tSDocker provides structured digest-qualified publication results |
+| Target   | What it does                                                                                                                                                                                                                                        |
+| -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `git`    | Atomically pushes the exact `main` release commit and new tag, often triggering remote CI release builds                                                                                                                                            |
+| `npm`    | Publishes the same journaled tarball to every configured registry and verifies its bytes anonymously                                                                                                                                                |
+| `docker` | Qualifies immutable OCI digest graphs with project-local tSDocker, promotes each journaled destination under single-writer alias fencing, verifies exact digests, then cleans the candidate; a terminal qualification conflict permits cleanup only |
 
 ```bash
 # Preview the resolved release plan
@@ -181,38 +186,38 @@ gitzone release --minor
 
 Release flags:
 
-| Flag | Meaning |
-| --- | --- |
-| `-y`, `--yes` | Run without interactive confirmation |
-| `-t`, `--test` | Enable preflight tests |
-| `-b`, `--build` | Enable the release build after local release metadata is created |
-| `-p`, `--push` | Explicitly select the `git` target; combine with other target flags as needed |
-| `--target <csv>` | Replace configured targets with a non-empty comma-separated subset of `git`, `npm`, and `docker`; empty or unknown elements fail |
-| `--npm` | Explicitly select the `npm` target; combine with other target flags as needed |
-| `--docker` | Explicitly select `docker`; planning is supported, but a mutating schema v1 release fails before integration or release metadata |
-| `--no-publish` | Remove npm and Docker from the resolved target set without implicitly enabling Git |
-| `--no-build` | Disable the post-metadata release build for this run |
-| `--merge` | Fast-forward and lease-push a cleanly rebased feature branch into `main`, then release from `main` |
-| `--major`, `--minor`, `--patch` | Override inferred semver level |
-| `--plan` | Show the resolved workflow without fetching or mutating refs, files, the index, or worktrees |
-| `inspect [version]` | Read one or all durable release journals; add `--json` for machine-readable output |
-| `resume <version>` | Resume only journaled Git/npm publication; fresh-release overrides, including negated forms, are rejected, and `--json` remains inspect-only |
-| `--recover-attempt <id>` | Recover the exact 32-character lowercase hexadecimal `attempt.id` shown by `inspect --json`, after independently proving its publisher stopped |
-
-### Exact npm artifacts and release journals
-
-Journal schema v1 supports Git and public npm publication. Fresh and resumed npm publication requires the resolved `pnpm` binary to be exactly the version pinned by this package (`11.21.0`). Registries must be unique canonical credential-free HTTP(S) URLs, and `release.targets.npm.accessLevel` must be `public` so verification does not depend on publisher credentials.
+| Flag                            | Meaning                                                                                                                                        |
+| ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
+| `-y`, `--yes`                   | Run without interactive confirmation                                                                                                           |
+| `-t`, `--test`                  | Enable preflight tests                                                                                                                         |
+| `-b`, `--build`                 | Enable the release build after local release metadata is created                                                                               |
+| `-p`, `--push`                  | Explicitly select the `git` target; combine with other target flags as needed                                                                  |
+| `--target <csv>`                | Replace configured targets with a non-empty comma-separated subset of `git`, `npm`, and `docker`; empty or unknown elements fail               |
+| `--npm`                         | Explicitly select the `npm` target; combine with other target flags as needed                                                                  |
+| `--docker`                      | Explicitly select digest-qualified Docker publication; requires project-local `@git.zone/tsdocker >= 3.5.1` with protocol v1                   |
+| `--no-publish`                  | Remove npm and Docker from the resolved target set without implicitly enabling Git                                                             |
+| `--no-build`                    | Disable the separate post-metadata project build; Docker qualification still performs its required image build                                 |
+| `--merge`                       | Fast-forward and lease-push a cleanly rebased feature branch into `main`, then release from `main`; incompatible with an active Docker target  |
+| `--major`, `--minor`, `--patch` | Override inferred semver level                                                                                                                 |
+| `--plan`                        | Show the resolved workflow without fetching or mutating refs, files, the index, or worktrees                                                   |
+| `inspect [version]`             | Read one or all durable release journals; add `--json` for machine-readable output                                                             |
+| `resume <version>`              | Resume journaled Git, npm, qualification, promotion, or cleanup work; fresh-release overrides are rejected, and `--json` remains inspect-only  |
+| `--recover-attempt <id>`        | Recover the exact 32-character lowercase hexadecimal `attempt.id` shown by `inspect --json`, after independently proving its publisher stopped |
+
+### Exact artifacts and release journals
+
+Journal schema 1 supports Git and public npm publication. Schema 2 adds Docker qualification, promotion, and cleanup evidence without changing the storage path or schema-1 parsing and resume behavior. Fresh and resumed npm publication requires the resolved `pnpm` binary to be exactly the version pinned by this package (`11.21.0`). Registries must be unique canonical credential-free HTTP(S) URLs, and `release.targets.npm.accessLevel` must be `public` so verification does not depend on publisher credentials.
 
 A selected Git target requires a canonical remote name and exactly one resolved push URL. Before any remote contact, including during `--plan`, GitZone rejects HTTP(S) usernames or passwords, embedded passwords, query strings, fragments, and unsupported protocols. Canonical local paths and SSH destinations may retain their required SSH username.
 
-Every release that reaches final Git/npm publication stores `journal.json` under the repository's Git common directory. npm releases additionally run `pnpm pack` once and store the resulting `package.tgz` beside it:
+Every release that reaches final publication stores `journal.json` under the repository's Git common directory. npm releases additionally run `pnpm pack` once and store the resulting `package.tgz` beside it. The `v1` path names the storage format and intentionally contains both journal schemas:
 
 ```text
 <git-common-dir>/gitzone/releases/v1/v<version>/package.tgz
 <git-common-dir>/gitzone/releases/v1/v<version>/journal.json
 ```
 
-The canonical journal binds the release commit, annotated tag object, hashed Git destination, npm registries, per-target attempt states, and, when npm is selected, the package identity, tarball size, SHA-1, SHA-256, and SHA-512 integrity. Journal updates use revision compare-and-swap under an interprocess lock. Release identity and destinations cannot change after journal creation. Inspect and resume reject malformed, future, noncanonical, duplicate-key, or merely reformatted journal JSON rather than repairing or normalizing it.
+The canonical journal binds the release commit, annotated tag object, hashed Git destination, npm registries, per-target attempt states, and, when npm is selected, the package identity, tarball size, SHA-1, SHA-256, and SHA-512 integrity. Schema 2 also binds the exact tSDocker request, candidate identity, qualification result, ordered destination promotions, probe or promotion evidence, and terminal cleanup result. Journal updates use revision compare-and-swap under an interprocess lock. Release identity and destinations cannot change after journal creation. Qualification and promotion evidence is append-only, destination conflicts are terminal, and completed Docker state cannot regress. Inspect and resume reject malformed, future, noncanonical, duplicate-key, or merely reformatted journal JSON rather than repairing or normalizing it.
 
 Packing must leave the release tree clean. Each registry receives that exact stored tarball through `pnpm publish <tarball> --ignore-scripts`, so publish lifecycle scripts do not run. Success is recorded only after anonymous no-redirect probes verify version metadata, SHA-1 and integrity fields, the downloaded tarball bytes, and the `latest` dist-tag. A matching pre-existing version follows `release.targets.npm.alreadyPublished`; conflicting bytes always stop the release, while transient responses and dist-tag propagation remain retryable.
 
@@ -232,11 +237,11 @@ gitzone release resume 6.0.0 -y
 gitzone release resume 6.0.0 -y --recover-attempt="$ATTEMPT_ID"
 ```
 
-Resume requires the local `main` commit, annotated release tag, and each journaled destination setting to remain exact. The Git remote must still match when Git is journaled; npm registry, access, and already-published settings must still match when npm is journaled. Non-journaled target configuration is ignored, so releases created with a target subset remain resumable. Fresh-release overrides such as targets, integration, build, test, and version flags are rejected even in negated forms such as `--no-git`, `--no-publish`, and `--no-build`; JSON output is available only through `inspect --json`. Resume probes remote state before acting. Exact remote state is accepted without republishing; positive byte, metadata, or ref conflicts fail closed, while absent, pending, inconclusive, and dist-tag propagation results do not overwrite a previously verified state. A target left in `publishing` state is never reclaimed from an absent remote result unless the exact recorded 32-character lowercase hexadecimal `attempt.id` from `git.attempt` or an npm registry attempt is supplied.
+Resume requires the local `main` commit, annotated release tag, and each journaled destination setting to remain exact. The Git remote must still match when Git is journaled; npm registry, access, and already-published settings must still match when npm is journaled. Before any recovery or publication work, a nonterminal schema-2 resume canonical-compares the current Docker request with the journal, verifies every required project-local tSDocker protocol capability, and validates the journaled request; additive future capabilities are accepted. A completed schema-2 journal trusts its terminal cleanup evidence and does not require candidate state or current Docker configuration. Non-journaled target configuration is ignored, so releases created with a target subset remain resumable. Fresh-release overrides such as targets, integration, build, test, and version flags are rejected even in negated forms such as `--no-git`, `--no-publish`, and `--no-build`; JSON output is available only through `inspect --json`.
 
-Schema v1 resumes only final Git release-ref and npm publication after the journal is atomically installed. It does not recover local version, changelog, commit, tag, build, or pack failures that occur before installation, nor the pre-release `--merge` integration push. Those failures stop before the final release commit/tag or npm artifact is published and require explicit operator reconciliation.
+Resume probes remotely observable targets before acting. Exact state is accepted without republishing; positive byte, metadata, ref, or digest conflicts fail closed, while inconclusive results do not overwrite a previously verified state. A Git, npm, Docker qualification, promotion, or cleanup target left in `publishing` state retains authority until the exact recorded 32-character lowercase hexadecimal `attempt.id` is supplied after independently proving its publisher stopped. An interrupted tSDocker `preparing` record has no qualification evidence and cannot be promoted; when tSDocker reports `RECOVERY_REQUIRED`, the exact recovered qualification owner removes only that incomplete deterministic preparation before claiming a fresh qualification attempt. Promotion recovery first reclaims the retired owner's request files and probes the journaled destination; an exact qualified digest is accepted, pending state retires the old attempt and claims a fresh owner before retry, an inconclusive probe retains the old journal owner, and conflicts halt permanently. Final cleanup of a qualified candidate starts only after every promotion is verified and is itself idempotently recoverable. A terminal qualification destination conflict has no promotions, blocks Git/npm, and permits only exact qualified-candidate cleanup.
 
-Docker target configuration remains available for planning and future journal schemas, but a mutating v6 release with an active Docker target stops before release integration or metadata changes. This restriction remains until tSDocker owns structured immutable digest qualification and promotion.
+Schema 1 resumes final Git release-ref and npm publication after the journal is atomically installed. Schema 2 additionally resumes Docker qualification, ordered promotion, and cleanup. Neither schema recovers local version, changelog, commit, tag, build, or pack failures that occur before installation. `--merge` remains available only for non-Docker releases because its pre-release Git push would violate qualification-before-publication ordering. Pre-installation failures require explicit operator reconciliation.
 
 ## Standard Changelog
 
@@ -258,7 +263,7 @@ The standard buckets are `Breaking Changes`, `Features`, `Fixes`, `Documentation
 
 ## Configuration
 
-CLI workflow config lives under `@git.zone/cli` in `.smartconfig.json`. Dormant Docker build and registry settings remain under `@git.zone/tsdocker` for the later journal schema that will restore Docker publication.
+CLI workflow config lives under `@git.zone/cli` in `.smartconfig.json`. Docker release selection lives under `@git.zone/cli.release.targets.docker`; canonical registries, repository mappings, and platforms remain owned by `@git.zone/tsdocker`.
 
 ```json
 {
@@ -324,18 +329,21 @@ values should be hosts without `http://` or `https://`:
 @git.zone/tsdocker.registries
 ```
 
-Docker release configuration uses the project's pinned `@git.zone/tsdocker`
-through `pnpm exec`. Install it in each Docker-producing project, but keep the
-target disabled while release journal schema v1 is active:
+Docker release configuration uses the project's absolute project-local
+`node_modules/.bin/tsdocker`. Install tSDocker `3.5.1` or newer in each
+Docker-producing project; fresh release and nonterminal resume verify matching
+package and binary versions plus the required protocol-v1 capabilities before
+use. Additional future protocol capabilities are accepted:
 
 ```bash
-pnpm add --save-dev @git.zone/tsdocker
+pnpm add --save-dev @git.zone/tsdocker@3.5.1
 ```
 
-The dormant `release.targets.docker.registry`, `buildRegistries`, and `test`
-settings describe the intended tSDocker destination, bounded base-image
-authentication, and pre-publication image tests. They do not execute while
-journal schema v1 is active.
+`release.targets.docker.registry`, `buildRegistries`, `test`, `patterns`,
+`cached`, `parallel`, and `context` become part of the immutable qualification
+request. `noBuild` must remain false or absent because digest qualification
+always builds. The separate release `--no-build` flag only disables the normal
+project build step and does not bypass Docker qualification.
 
 Useful config commands:
 
@@ -495,11 +503,11 @@ Formatters include cleanup, smartconfig normalization, dependency license checks
 
 Supported services:
 
-| Service | Lifecycle/log aliases |
-| --- | --- |
-| MongoDB | `mongo`, `mongodb` |
+| Service                       | Lifecycle/log aliases |
+| ----------------------------- | --------------------- |
+| MongoDB                       | `mongo`, `mongodb`    |
 | ObjectStorage (S3-compatible) | `objectstorage`, `s3` |
-| Elasticsearch | `elasticsearch`, `es` |
+| Elasticsearch                 | `elasticsearch`, `es` |
 
 Service-selection commands such as `set`, `enable`, and `disable` also accept
 `elastic`; lifecycle and log commands do not.
@@ -620,12 +628,12 @@ than interpreting legacy evidence as an active service.
 
 Cleanup is tiered, from fully resumable to irreversible:
 
-| Command | Containers | Data | Notes |
-| --- | --- | --- | --- |
-| `gitzone services stop` | kept (stopped) | kept | fully resumable |
-| `gitzone services remove` | removed | kept | resumable; `--yes` to skip the prompt |
-| `gitzone services clean` | removed | **removed** | irreversible; needs a typed `yes` or `--yes` |
-| `gitzone services prune` | see below | see below | machine-wide; dry run unless `--apply` |
+| Command                   | Containers     | Data        | Notes                                        |
+| ------------------------- | -------------- | ----------- | -------------------------------------------- |
+| `gitzone services stop`   | kept (stopped) | kept        | fully resumable                              |
+| `gitzone services remove` | removed        | kept        | resumable; `--yes` to skip the prompt        |
+| `gitzone services clean`  | removed        | **removed** | irreversible; needs a typed `yes` or `--yes` |
+| `gitzone services prune`  | see below      | see below   | machine-wide; dry run unless `--apply`       |
 
 `clean` and `prune` first persist an exact deletion intent, then atomically rename
 the canonical directory to a tokenized sibling quarantine before deleting any

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@git.zone/cli',
-  version: '6.0.0',
+  version: '6.1.0',
   description: 'A comprehensive CLI tool for enhancing and managing local development workflows with gitzone utilities, focusing on project setup, version control, code formatting, and template management.'
 }

package/ts/helpers.workflow.ts

@@ -3,13 +3,7 @@ import { getCliConfigValue } from "./helpers.smartconfig.js";
 export type TConfirmationMode = "prompt" | "auto" | "plan";
 
 export type TCommitStep =
-  | "format"
-  | "analyze"
-  | "test"
-  | "build"
-  | "changelog"
-  | "commit"
-  | "push";
+  "format" | "analyze" | "test" | "build" | "changelog" | "commit" | "push";
 
 export type TReleaseTarget = "git" | "npm" | "docker";
 
@@ -134,6 +128,18 @@ export interface IResolvedReleaseResumeConfiguration {
   npmAlreadyPublished: "success" | "error";
 }
 
+export type TResolvedReleaseDockerConfiguration = Pick<
+  IResolvedReleaseWorkflow,
+  | "dockerRegistry"
+  | "dockerBuildRegistries"
+  | "dockerTest"
+  | "dockerPatterns"
+  | "dockerCached"
+  | "dockerParallel"
+  | "dockerContext"
+  | "dockerNoBuild"
+>;
+
 interface ICliWorkflowConfig {
   commit?: ICommitWorkflowConfig;
   release?: IReleaseWorkflowConfig;
@@ -179,9 +185,9 @@ export const supportsTsdockerMinimumVersion = (
   versionOutputArg: string,
   minimumVersionArg: TTsdockerMinimumVersion,
 ): boolean => {
-  const match = versionOutputArg.trim().match(
-    /(?:^|\s)(\d+)\.(\d+)\.(\d+)(?:\s|$)/,
-  );
+  const match = versionOutputArg
+    .trim()
+    .match(/(?:^|\s)(\d+)\.(\d+)\.(\d+)(?:\s|$)/);
   if (!match) {
     return false;
   }
@@ -207,6 +213,94 @@ export const resolveDockerTestSetting = (valueArg: unknown): boolean => {
   return valueArg;
 };
 
+const resolveDockerConfiguration = (
+  dockerConfigArg: IReleaseDockerTargetConfig,
+): TResolvedReleaseDockerConfiguration => {
+  if (
+    dockerConfigArg.engine !== undefined &&
+    dockerConfigArg.engine !== "tsdocker"
+  ) {
+    throw new Error("release.targets.docker.engine must be tsdocker");
+  }
+  if (
+    dockerConfigArg.registry !== undefined &&
+    (typeof dockerConfigArg.registry !== "string" ||
+      !dockerConfigArg.registry.trim())
+  ) {
+    throw new Error(
+      "release.targets.docker.registry must be a non-empty string",
+    );
+  }
+  const normalizeStringList = (
+    valueArg: unknown,
+    settingArg: "buildRegistries" | "patterns",
+  ): string[] => {
+    if (valueArg === undefined) return [];
+    if (
+      !Array.isArray(valueArg) ||
+      valueArg.some(
+        (entryArg) => typeof entryArg !== "string" || !entryArg.trim(),
+      )
+    ) {
+      throw new Error(
+        `release.targets.docker.${settingArg} must be an array of non-empty strings`,
+      );
+    }
+    const normalized = valueArg.map((entryArg) => entryArg.trim());
+    if (new Set(normalized).size !== normalized.length) {
+      throw new Error(
+        `release.targets.docker.${settingArg} must contain unique values`,
+      );
+    }
+    return normalized;
+  };
+  if (
+    dockerConfigArg.cached !== undefined &&
+    typeof dockerConfigArg.cached !== "boolean"
+  ) {
+    throw new Error("release.targets.docker.cached must be true or false");
+  }
+  if (
+    dockerConfigArg.parallel !== undefined &&
+    dockerConfigArg.parallel !== false &&
+    dockerConfigArg.parallel !== true &&
+    (!Number.isSafeInteger(dockerConfigArg.parallel) ||
+      (dockerConfigArg.parallel as number) <= 0)
+  ) {
+    throw new Error(
+      "release.targets.docker.parallel must be false, true, or a positive integer",
+    );
+  }
+  if (
+    dockerConfigArg.context !== undefined &&
+    (typeof dockerConfigArg.context !== "string" ||
+      !dockerConfigArg.context.trim())
+  ) {
+    throw new Error(
+      "release.targets.docker.context must be a non-empty string",
+    );
+  }
+  if (
+    dockerConfigArg.noBuild !== undefined &&
+    typeof dockerConfigArg.noBuild !== "boolean"
+  ) {
+    throw new Error("release.targets.docker.noBuild must be true or false");
+  }
+  return {
+    dockerRegistry: dockerConfigArg.registry?.trim() || undefined,
+    dockerBuildRegistries: normalizeStringList(
+      dockerConfigArg.buildRegistries,
+      "buildRegistries",
+    ),
+    dockerTest: resolveDockerTestSetting(dockerConfigArg.test),
+    dockerPatterns: normalizeStringList(dockerConfigArg.patterns, "patterns"),
+    dockerCached: dockerConfigArg.cached ?? false,
+    dockerParallel: dockerConfigArg.parallel ?? false,
+    dockerContext: dockerConfigArg.context?.trim() || undefined,
+    dockerNoBuild: dockerConfigArg.noBuild ?? false,
+  };
+};
+
 const resolveGitPushSetting = (
   valueArg: unknown,
   settingArg: "pushBranch" | "pushTags",
@@ -223,11 +317,19 @@ const resolveGitPushSetting = (
   return true;
 };
 
-const isStringRecord = (valueArg: unknown): valueArg is Record<string, unknown> => {
-  return typeof valueArg === "object" && valueArg !== null && !Array.isArray(valueArg);
+const isStringRecord = (
+  valueArg: unknown,
+): valueArg is Record<string, unknown> => {
+  return (
+    typeof valueArg === "object" &&
+    valueArg !== null &&
+    !Array.isArray(valueArg)
+  );
 };
 
-export const getDeclaredTsdockerRange = (packageJsonArg: unknown): string | undefined => {
+export const getDeclaredTsdockerRange = (
+  packageJsonArg: unknown,
+): string | undefined => {
   if (!isStringRecord(packageJsonArg)) {
     return undefined;
   }
@@ -256,14 +358,24 @@ const normalizeConfirmation = (
 
 const normalizeRegistryUrl = (url: string): string => {
   let normalizedUrl = url.trim();
-  if (!normalizedUrl.startsWith("http://") && !normalizedUrl.startsWith("https://")) {
+  if (
+    !normalizedUrl.startsWith("http://") &&
+    !normalizedUrl.startsWith("https://")
+  ) {
     normalizedUrl = `https://${normalizedUrl}`;
   }
-  return normalizedUrl.endsWith("/") ? normalizedUrl.slice(0, -1) : normalizedUrl;
+  return normalizedUrl.endsWith("/")
+    ? normalizedUrl.slice(0, -1)
+    : normalizedUrl;
 };
 
 const isDisabled = (argvArg: any, ...keys: string[]): boolean => {
-  return keys.some((key) => argvArg[key] === false || argvArg[`no-${key}`] || argvArg[`no${key[0].toUpperCase()}${key.slice(1)}`]);
+  return keys.some(
+    (key) =>
+      argvArg[key] === false ||
+      argvArg[`no-${key}`] ||
+      argvArg[`no${key[0].toUpperCase()}${key.slice(1)}`],
+  );
 };
 
 const readCliWorkflowConfig = async (): Promise<ICliWorkflowConfig> => {
@@ -298,13 +410,13 @@ const getOrderedShortFlags = (commandName: string): string[] => {
 const hasExplicitCommitWorkflowFlags = (argvArg: any): boolean => {
   return Boolean(
     argvArg.f ||
-      argvArg.format ||
-      argvArg.t ||
-      argvArg.test ||
-      argvArg.b ||
-      argvArg.build ||
-      argvArg.p ||
-      argvArg.push,
+    argvArg.format ||
+    argvArg.t ||
+    argvArg.test ||
+    argvArg.b ||
+    argvArg.build ||
+    argvArg.p ||
+    argvArg.push,
   );
 };
 
@@ -397,13 +509,23 @@ const buildReleasePlan = (options: {
   if (options.runBuild) plan.push("core.build");
   if (options.targets.includes("npm")) plan.push("core.packNpmArtifact");
   plan.push("core.writeReleaseJournal");
+  if (options.targets.includes("docker")) {
+    plan.push("target.docker.qualify");
+  }
   for (const target of options.targets) {
-    plan.push(`target.${target}`);
+    plan.push(
+      target === "docker" ? "target.docker.promote" : `target.${target}`,
+    );
+  }
+  if (options.targets.includes("docker")) {
+    plan.push("target.docker.cleanup");
   }
   return plan;
 };
 
-export const resolveCommitWorkflow = async (argvArg: any): Promise<IResolvedCommitWorkflow> => {
+export const resolveCommitWorkflow = async (
+  argvArg: any,
+): Promise<IResolvedCommitWorkflow> => {
   const cliConfig = await readCliWorkflowConfig();
   const commitConfig = cliConfig.commit || {};
   const releaseFlagRequested = Boolean(argvArg.r || argvArg.release);
@@ -431,7 +553,10 @@ export const resolveCommitWorkflow = async (argvArg: any): Promise<IResolvedComm
     if (argvArg.push && !rawSteps.includes("push")) rawSteps.push("push");
     rawSteps.push("changelog");
     rawSteps.push("commit");
-  } else if (Array.isArray(commitConfig.steps) && commitConfig.steps.length > 0) {
+  } else if (
+    Array.isArray(commitConfig.steps) &&
+    commitConfig.steps.length > 0
+  ) {
     rawSteps = commitConfig.steps;
   } else {
     rawSteps = ["analyze"];
@@ -456,7 +581,9 @@ export const resolveCommitWorkflow = async (argvArg: any): Promise<IResolvedComm
   };
 };
 
-export const resolveReleaseWorkflow = async (argvArg: any): Promise<IResolvedReleaseWorkflow> => {
+export const resolveReleaseWorkflow = async (
+  argvArg: any,
+): Promise<IResolvedReleaseWorkflow> => {
   const cliConfig = await readCliWorkflowConfig();
   const releaseConfig = cliConfig.release || {};
   const targetConfig = releaseConfig.targets || {};
@@ -481,7 +608,10 @@ export const resolveReleaseWorkflow = async (argvArg: any): Promise<IResolvedRel
     gitEnabled,
   );
 
-  let confirmation = normalizeConfirmation(releaseConfig.confirmation, "prompt");
+  let confirmation = normalizeConfirmation(
+    releaseConfig.confirmation,
+    "prompt",
+  );
   if (argvArg.plan) {
     confirmation = "plan";
   } else if (argvArg.y || argvArg.yes) {
@@ -517,7 +647,9 @@ export const resolveReleaseWorkflow = async (argvArg: any): Promise<IResolvedRel
       (!Array.isArray(rawNpmRegistries) ||
         rawNpmRegistries.some((registryArg) => typeof registryArg !== "string"))
     ) {
-      throw new Error("release.targets.npm.registries must be an array of strings");
+      throw new Error(
+        "release.targets.npm.registries must be an array of strings",
+      );
     }
     npmRegistries = (rawNpmRegistries || []).map(normalizeRegistryUrl);
     if (new Set(npmRegistries).size !== npmRegistries.length) {
@@ -527,6 +659,19 @@ export const resolveReleaseWorkflow = async (argvArg: any): Promise<IResolvedRel
     }
   }
   const mergeRequested = argvArg.merge === true;
+  const dockerConfiguration: TResolvedReleaseDockerConfiguration =
+    targets.includes("docker")
+      ? resolveDockerConfiguration(dockerConfig)
+      : {
+          dockerRegistry: undefined,
+          dockerBuildRegistries: [],
+          dockerTest: false,
+          dockerPatterns: [],
+          dockerCached: false,
+          dockerParallel: false,
+          dockerContext: undefined,
+          dockerNoBuild: false,
+        };
 
   return {
     confirmation,
@@ -549,23 +694,7 @@ export const resolveReleaseWorkflow = async (argvArg: any): Promise<IResolvedRel
     npmAlreadyPublished: npmConfig.alreadyPublished || "success",
     dockerEnabled,
     dockerEngine: "tsdocker",
-    dockerRegistry: typeof dockerConfig.registry === "string" && dockerConfig.registry.trim()
-      ? dockerConfig.registry.trim()
-      : undefined,
-    dockerBuildRegistries: Array.isArray(dockerConfig.buildRegistries)
-      ? dockerConfig.buildRegistries
-          .filter((registryArg): registryArg is string => typeof registryArg === "string")
-          .map((registryArg) => registryArg.trim())
-          .filter(Boolean)
-      : [],
-    dockerTest: resolveDockerTestSetting(dockerConfig.test),
-    dockerPatterns: Array.isArray(dockerConfig.patterns) ? dockerConfig.patterns : [],
-    dockerCached: dockerConfig.cached ?? false,
-    dockerParallel: dockerConfig.parallel ?? false,
-    dockerContext: typeof dockerConfig.context === "string" && dockerConfig.context.trim()
-      ? dockerConfig.context.trim()
-      : undefined,
-    dockerNoBuild: dockerConfig.noBuild ?? false,
+    ...dockerConfiguration,
   };
 };
 
@@ -591,9 +720,13 @@ export const resolveReleaseResumeConfiguration = async (optionsArg: {
     if (
       npmConfig.registries !== undefined &&
       (!Array.isArray(npmConfig.registries) ||
-        npmConfig.registries.some((registryArg) => typeof registryArg !== "string"))
+        npmConfig.registries.some(
+          (registryArg) => typeof registryArg !== "string",
+        ))
     ) {
-      throw new Error("release.targets.npm.registries must be an array of strings");
+      throw new Error(
+        "release.targets.npm.registries must be an array of strings",
+      );
     }
     npmRegistries = (npmConfig.registries || []).map(normalizeRegistryUrl);
     if (new Set(npmRegistries).size !== npmRegistries.length) {
@@ -606,7 +739,9 @@ export const resolveReleaseResumeConfiguration = async (optionsArg: {
       npmConfig.accessLevel !== "public" &&
       npmConfig.accessLevel !== "private"
     ) {
-      throw new Error("release.targets.npm.accessLevel must be public or private");
+      throw new Error(
+        "release.targets.npm.accessLevel must be public or private",
+      );
     }
     if (
       npmConfig.alreadyPublished !== undefined &&
@@ -628,3 +763,10 @@ export const resolveReleaseResumeConfiguration = async (optionsArg: {
     npmAlreadyPublished,
   };
 };
+
+export const resolveReleaseDockerConfiguration =
+  async (): Promise<TResolvedReleaseDockerConfiguration> => {
+    const cliConfig = await readCliWorkflowConfig();
+    const dockerConfig = cliConfig.release?.targets?.docker || {};
+    return resolveDockerConfiguration(dockerConfig);
+  };