@rakay-technology/kraft 0.7.4 → 0.7.6

package/dist/index.js

@@ -4,29 +4,41 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   CACHE_DIR,
-  RELEASES,
   RELEASES_DIR,
   assetUrl,
+  checkRepoReleases,
+  clearGithubToken,
+  dockerAvailable,
+  dockerHasAuthFor,
+  dockerLogin,
   downloadToFile,
   ensureDashboard,
   expectedSha256,
   fetchSidecar,
   formatBytes,
+  githubRepo,
+  githubToken,
+  githubTokenSource,
   hashFile,
   headlessProvision,
+  maskToken,
   normalizeUrl,
   parseSha256,
   readCliInstall,
+  readStoredGithubToken,
   releaseDir,
+  releasesPage,
   resolveLatestTag,
   restart,
   selfInvocation,
   serviceStatus,
   startService,
   stop,
+  storeGithubToken,
   upCommand,
+  validateGithubToken,
   writeCliInstall
-} from "./chunk-PNNXWA2A.js";
+} from "./chunk-OZUFHE2T.js";
 import {
   bootstrapAdmin,
   detectPublicIp,
@@ -36,7 +48,7 @@ import {
   internalTokenRejectedProblem,
   waitDashboard,
   waitHealthy
-} from "./chunk-RFOBMHQ7.js";
+} from "./chunk-JK7KKBXI.js";
 import {
   completeHostEdge,
   confirmEdgeAction,
@@ -46,7 +58,7 @@ import {
   renderEdgeConflict,
   repairEdgeConflict,
   rollbackHostEdge
-} from "./chunk-PZVKPCKE.js";
+} from "./chunk-4UITBYUK.js";
 import {
   composeDown,
   composeInternalToken,
@@ -80,10 +92,10 @@ import {
   sourceBuildDir,
   storedApiPort,
   storedDashboardPort
-} from "./chunk-JSCZT76F.js";
+} from "./chunk-GABTH5TU.js";
 import {
   startUnitHint
-} from "./chunk-EW4PHKB2.js";
+} from "./chunk-2UQFOUSZ.js";
 import {
   DATA_DIR,
   LOG_DIR,
@@ -97,36 +109,37 @@ import "./chunk-42WQABXM.js";
 import "./chunk-DRK3MEDS.js";
 import "./chunk-3NQQXMDR.js";
 import "./chunk-RHLNVZMS.js";
-import "./chunk-TAML5WMA.js";
-import "./chunk-I2TOOF2A.js";
+import "./chunk-MC4X55BW.js";
+import "./chunk-CO6FAYLO.js";
 import {
   detectInstalledProxy,
   scanImportableSites
-} from "./chunk-THTEUDBC.js";
-import "./chunk-Y7PVJUXJ.js";
+} from "./chunk-TVURAFJ5.js";
+import "./chunk-VFPLICBX.js";
 import "./chunk-I3DPMTSF.js";
-import "./chunk-YZUKHG3S.js";
+import "./chunk-PCOTSRS4.js";
 import "./chunk-ONKEYSMY.js";
 import "./chunk-ZWLDLTJP.js";
-import "./chunk-PNRPKRJU.js";
-import "./chunk-DM3PKWDC.js";
-import "./chunk-AJ4QZLZ2.js";
-import "./chunk-MOLPYPVH.js";
+import "./chunk-ZNVAHQRY.js";
+import "./chunk-7UKBMDUF.js";
+import "./chunk-DFVWR6JM.js";
+import "./chunk-SPKRI7MF.js";
 import "./chunk-ZVFS4LUA.js";
-import "./chunk-XGCG4MD5.js";
-import "./chunk-HMJUFZK7.js";
+import "./chunk-K24SBFI2.js";
+import "./chunk-DJNKEVZ7.js";
 import {
   LocalExecutor
-} from "./chunk-XVKUFMIB.js";
-import "./chunk-S3QBGGVP.js";
-import "./chunk-BQMFIXHI.js";
-import "./chunk-WYNM7L22.js";
-import "./chunk-N4OALTFK.js";
-import "./chunk-YRSZPVMB.js";
-import "./chunk-OFXBNFNL.js";
+} from "./chunk-HFOE2IXZ.js";
+import "./chunk-DI54Y66N.js";
+import "./chunk-XBGSR22I.js";
+import "./chunk-2Y62WP2D.js";
+import "./chunk-3RCXJZJD.js";
+import "./chunk-ZQJU5CTZ.js";
+import "./chunk-YY5DEAZI.js";
 import "./chunk-3CJLKL6E.js";
-import "./chunk-MNV2QFHW.js";
+import "./chunk-BN23UUSF.js";
 import {
+  DEFAULT_IMAGE_REGISTRY,
   HOST_CHANNEL_AUTH_REJECTED_SHORT,
   HOST_CHANNEL_PROVISION_COMMAND,
   LOCAL_API_URL,
@@ -146,11 +159,11 @@ import {
   summarizeHostChannelCause,
   validateReleaseRepository,
   validateReleaseVersionUrl
-} from "./chunk-PVOWHIND.js";
+} from "./chunk-ND23EK7Y.js";
 import "./chunk-PXKCZB2I.js";
 
 // src/index.ts
-import { Command as Command28 } from "commander";
+import { Command as Command29 } from "commander";
 
 // src/lib/output.ts
 import chalk from "chalk";
@@ -317,7 +330,7 @@ function getDashboardUrl(name) {
 }
 
 // src/lib/api-client.ts
-var USER_AGENT = `kraft-cli/${true ? "0.7.4" : "dev"}`;
+var USER_AGENT = `kraft-cli/${true ? "0.7.6" : "dev"}`;
 function getApiUrl2() {
   return `${getApiUrl()}/api`;
 }
@@ -842,8 +855,8 @@ var initCmd = new Command7("init").description("Scaffold an kraft.json in the cu
   }
   const hints = detectHints(dir);
   const scaffold = { $schema: SCHEMA_URL, ...hints };
-  const text3 = JSON.stringify(scaffold, null, 2) + "\n";
-  writeFileSync3(path2, text3);
+  const text4 = JSON.stringify(scaffold, null, 2) + "\n";
+  writeFileSync3(path2, text4);
   if (isJsonMode()) {
     printJson({ path: path2, config: scaffold });
     return;
@@ -1216,7 +1229,7 @@ function looksCorrupted() {
   const err2 = lastServiceError();
   return !!err2 && CORRUPTION_RE.test(err2);
 }
-function dockerAvailable() {
+function dockerAvailable2() {
   const r = spawnSync(
     "docker",
     ["version", "--format", "{{.Server.Version}}"],
@@ -1234,7 +1247,7 @@ function mapState(dockerState) {
   return "stopped";
 }
 function dockerServices() {
-  if (!dockerAvailable()) return [];
+  if (!dockerAvailable2()) return [];
   const fmt = '{{.Names}}	{{.State}}	{{.Label "kraft.project"}}';
   const r = spawnSync(
     "docker",
@@ -1253,7 +1266,7 @@ function dockerServices() {
   });
 }
 function dockerNameRunning(nameFilter) {
-  if (!dockerAvailable()) return null;
+  if (!dockerAvailable2()) return null;
   const r = spawnSync(
     "docker",
     ["ps", "--filter", `name=${nameFilter}`, "--format", "{{.Names}}"],
@@ -1263,7 +1276,7 @@ function dockerNameRunning(nameFilter) {
   return r.stdout.trim().length > 0;
 }
 async function hostControlCheck(api) {
-  const { checkHostChannel } = await import("./host-channel-preflight-Z6HYSPKO.js");
+  const { checkHostChannel } = await import("./host-channel-preflight-Z4QG7Q44.js");
   return hostControlRow(await checkHostChannel().catch(() => null), api);
 }
 var NEVER_PROVISIONED_DETAIL = `never provisioned \u2014 run \`${HOST_CHANNEL_PROVISION_COMMAND}\``;
@@ -1822,7 +1835,7 @@ async function interactiveDoctor() {
       continue;
     }
     if (action2 === "host-control") {
-      const { verifyHostChannel } = await import("./host-channel-preflight-Z6HYSPKO.js");
+      const { verifyHostChannel } = await import("./host-channel-preflight-Z4QG7Q44.js");
       const report3 = await verifyHostChannel().catch(() => null);
       if (report3?.status === "fixed")
         log2.success("Host control is reachable now.");
@@ -3853,8 +3866,8 @@ serviceCommand.addCommand(execCmd);
 import { Command as Command16 } from "commander";
 import chalk12 from "chalk";
 import ora2 from "ora";
-function spin(text3) {
-  return isJsonMode() ? null : ora2(text3).start();
+function spin(text4) {
+  return isJsonMode() ? null : ora2(text4).start();
 }
 function fail2(e) {
   if (e instanceof ApiError) {
@@ -4106,8 +4119,8 @@ import {
   confirm as confirm5,
   log as log3
 } from "@clack/prompts";
-function spin2(text3) {
-  return isJsonMode() ? null : ora3(text3).start();
+function spin2(text4) {
+  return isJsonMode() ? null : ora3(text4).start();
 }
 function fail3(e) {
   if (e instanceof ApiError) {
@@ -4214,7 +4227,7 @@ async function runRepair2(mode) {
     mode === "migrate" ? "Migrating the existing proxy's sites into the edge\u2026" : "Taking over :80/:443\u2026"
   );
   try {
-    const { repairEdgeConflict: repairEdgeConflict2 } = await import("./edge-preflight-QUJ757C6.js");
+    const { repairEdgeConflict: repairEdgeConflict2 } = await import("./edge-preflight-TT2777R5.js");
     sp?.stop();
     const res = await repairEdgeConflict2(mode, apiPort(), onLog);
     reportRepair(res);
@@ -4377,7 +4390,7 @@ async function panelRepair(mode) {
     mode === "migrate" ? "Migrating the existing proxy's sites\u2026" : "Taking over :80/:443\u2026"
   );
   try {
-    const { repairEdgeConflict: repairEdgeConflict2 } = await import("./edge-preflight-QUJ757C6.js");
+    const { repairEdgeConflict: repairEdgeConflict2 } = await import("./edge-preflight-TT2777R5.js");
     sp?.stop();
     const res = await repairEdgeConflict2(mode, apiPort(), onLog);
     renderRepair(res);
@@ -5482,7 +5495,7 @@ function printMonitoringNextSteps() {
   info("    kraft edge analytics -p <project>            per-domain analytics");
 }
 async function runMonitoringInstall(opts) {
-  const up = await import("./up-P5DMQ5YO.js");
+  const up = await import("./up-IADNO7AY.js");
   let adminName = opts.adminName;
   let adminEmail = opts.adminEmail;
   let adminPassword = opts.adminPassword;
@@ -6022,8 +6035,8 @@ function report2(obj, human) {
   if (isJsonMode()) printJson(obj);
   else human();
 }
-function spinner3(text3) {
-  return isJsonMode() ? null : ora5(text3).start();
+function spinner3(text4) {
+  return isJsonMode() ? null : ora5(text4).start();
 }
 async function confirm6(message, yes) {
   if (yes) return true;
@@ -6145,20 +6158,20 @@ var upgradeToAuthCommand = new Command19("upgrade-to-auth").description("Promote
   await guarded(async () => {
     const name = opts.name;
     const email = opts.email;
-    let password3 = opts.password;
-    if (!password3) {
+    let password4 = opts.password;
+    if (!password4) {
       if (!process.stdin.isTTY || isJsonMode()) {
         err("\n  --password is required in non-interactive mode.\n");
         process.exit(1);
       }
-      password3 = await promptHidden("  New password: ");
+      password4 = await promptHidden("  New password: ");
     }
     const res = await apiRequest("/system/upgrade-to-auth", {
       method: "POST",
       body: JSON.stringify({
         name,
         email,
-        password: password3,
+        password: password4,
         useOwnMailServer: opts.useOwnMailServer === true
       })
     });
@@ -6427,8 +6440,8 @@ function guard2(fn) {
     }
   };
 }
-function spin3(text3) {
-  return isJsonMode() ? null : ora6(text3).start();
+function spin3(text4) {
+  return isJsonMode() ? null : ora6(text4).start();
 }
 function safeParse4(data) {
   try {
@@ -6758,17 +6771,17 @@ postmasterCmd.addCommand(
     "New password (min 12 chars); prompted if omitted"
   ).action(
     guard2(async (serverId, opts) => {
-      let password3 = opts.password;
-      if (!password3) {
+      let password4 = opts.password;
+      if (!password4) {
         if (isJsonMode()) {
           err("  --password is required in JSON mode.");
           process.exit(1);
         }
         const rl = createInterface7({ input: input6, output: output6 });
-        password3 = (await rl.question("  New postmaster password (min 12 chars): ")).trim();
+        password4 = (await rl.question("  New postmaster password (min 12 chars): ")).trim();
         rl.close();
       }
-      if (!password3 || password3.length < 12) {
+      if (!password4 || password4.length < 12) {
         err("  Password must be at least 12 characters.");
         process.exit(1);
       }
@@ -6777,7 +6790,7 @@ postmasterCmd.addCommand(
         "/mail/credentials/postmaster",
         {
           method: "POST",
-          body: JSON.stringify({ serverId, password: password3 })
+          body: JSON.stringify({ serverId, password: password4 })
         }
       );
       sp?.succeed("Postmaster password updated.");
@@ -7293,8 +7306,8 @@ import chalk17 from "chalk";
 // src/lib/cmd-helpers.ts
 import chalk16 from "chalk";
 import ora8 from "ora";
-function spin4(text3) {
-  return isJsonMode() ? null : ora8(text3).start();
+function spin4(text4) {
+  return isJsonMode() ? null : ora8(text4).start();
 }
 function fail4(e) {
   if (e instanceof ApiError) {
@@ -7449,10 +7462,10 @@ var apiCommand = new Command23("api").description(
   if (opts.data) init.body = opts.data;
   try {
     const res = await apiRaw(url, init);
-    const text3 = await res.text();
-    let body = text3;
+    const text4 = await res.text();
+    let body = text4;
     try {
-      body = JSON.parse(text3);
+      body = JSON.parse(text4);
     } catch {
     }
     if (typeof body === "string") {
@@ -7667,7 +7680,7 @@ var installCommand = new Command25("install").description("Download and install
     err(e.message);
     process.exit(1);
   }
-  const spin5 = (text3) => isJsonMode() ? null : ora9(text3).start();
+  const spin5 = (text4) => isJsonMode() ? null : ora9(text4).start();
   let tag;
   try {
     if (opts.version) {
@@ -7684,7 +7697,7 @@ var installCommand = new Command25("install").description("Download and install
   const dir = releaseDir(tag);
   const assetPath = join9(dir, asset.name);
   const sidecarPath = `${assetPath}.sha256`;
-  const assetUrl2 = `${RELEASES}/download/${tag}/${asset.name}`;
+  const assetUrl2 = `${releasesPage()}/download/${tag}/${asset.name}`;
   const sidecarUrl = `${assetUrl2}.sha256`;
   let downloaded = false;
   let sha;
@@ -8056,7 +8069,7 @@ function applyOnlyArgv(selfArgs, json) {
 // src/commands/update.ts
 async function verifyHostChannelAfterUpdate() {
   if (isJsonMode()) return;
-  const { verifyHostChannel } = await import("./host-channel-preflight-Z6HYSPKO.js");
+  const { verifyHostChannel } = await import("./host-channel-preflight-Z4QG7Q44.js");
   await verifyHostChannel().catch(() => {
   });
 }
@@ -8156,7 +8169,7 @@ async function runSourceUpdate(source, opts) {
 }
 var REINSTALL_HINT = "curl -fsSL https://get.kraft.io | sh";
 async function runTarballUpdate(install, opts) {
-  const current = "0.7.4";
+  const current = "0.7.6";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -8277,7 +8290,7 @@ var updateCommand = new Command26("update").description("Update the Kraft CLI +
   const cliInstall = readCliInstall();
   if (cliInstall?.method === "tarball")
     return runTarballUpdate(cliInstall, opts);
-  const current = "0.7.4";
+  const current = "0.7.6";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -8474,6 +8487,222 @@ var cacheCommand = new Command27("cache").description("Manage the local download
   process.exit(1);
 }).addCommand(pathCmd).addCommand(listCmd6).addCommand(verifyCmd2).addCommand(cleanCmd);
 
+// src/commands/gh.ts
+import { Command as Command28 } from "commander";
+import { spawnSync as spawnSync8 } from "child_process";
+import { password as password2, select as select4, text as text2 } from "@clack/prompts";
+function registryHost() {
+  const raw = process.env.KRAFT_IMAGE_REGISTRY?.trim() || DEFAULT_IMAGE_REGISTRY;
+  return raw.split("/")[0] || "ghcr.io";
+}
+function cancelled(v) {
+  return typeof v === "symbol";
+}
+async function askToken() {
+  const v = await password2({
+    message: "GitHub token (fine-grained PAT: Contents:read + Packages:read)",
+    mask: "\u2022",
+    validate: (s) => s.trim() ? void 0 : "Paste a token first."
+  });
+  if (cancelled(v)) return null;
+  return v.trim();
+}
+async function runAuth(opts) {
+  const repo = opts.repo?.trim() || githubRepo();
+  const host = registryHost();
+  let token = opts.token?.trim();
+  let tokenReused = false;
+  if (!token) {
+    const stored = readStoredGithubToken();
+    if (stored) {
+      const prev = await validateGithubToken(stored);
+      if (prev.valid) {
+        token = stored;
+        tokenReused = true;
+        if (!isJsonMode())
+          info(`  Reusing stored token (${maskToken(stored)}).`);
+      } else if (!process.stdin.isTTY) {
+        err(
+          "\n  Stored token is no longer valid and there's no TTY to ask for a new one \u2014 re-run with `kraft gh auth --token <tok>`.\n"
+        );
+        process.exit(1);
+      } else {
+        info("  Stored token is no longer valid \u2014 let's replace it.\n");
+      }
+    }
+  }
+  if (!token) {
+    if (!process.stdin.isTTY) {
+      err(
+        "\n  No --token and no TTY \u2014 re-run with `kraft gh auth --token <tok>`.\n"
+      );
+      process.exit(1);
+    }
+    info(`  Releases repo: ${repo}`);
+    info(
+      "  Create a token at https://github.com/settings/personal-access-tokens/new"
+    );
+    info("  (fine-grained, this repo only: Contents:read + Packages:read).\n");
+    const asked = await askToken();
+    if (asked === null) {
+      err("\n  Cancelled \u2014 nothing was stored.\n");
+      process.exit(1);
+    }
+    token = asked;
+  }
+  if (!token) {
+    err("\n  No token provided.\n");
+    process.exit(1);
+  }
+  const check = await validateGithubToken(token);
+  if (!check.valid) {
+    err(
+      check.status === 0 ? "\n  Couldn't reach api.github.com \u2014 check your network and re-run.\n" : `
+  Token rejected by GitHub (HTTP ${check.status}). Check it isn't expired or revoked.
+`
+    );
+    process.exit(1);
+  }
+  const releases = await checkRepoReleases(token, repo);
+  if (!releases.reachable && !isJsonMode()) {
+    info(
+      `  Note: ${repo}/releases/latest is not reachable with this token (HTTP ${releases.status}) \u2014 either no release is published yet or the token lacks Contents:read on that repo. Storing anyway; the install will report the definitive error.
+`
+    );
+  }
+  storeGithubToken(token);
+  if (!isJsonMode()) {
+    ok(
+      tokenReused ? `  GitHub token still valid (${maskToken(token)}).` : `  GitHub token stored (~/.kraft/.github-token, 0600).`
+    );
+    if (releases.tag) info(`  Latest release on ${repo}: ${releases.tag}`);
+  }
+  let docker = { loggedIn: false };
+  if (opts.docker === false) {
+    docker = { loggedIn: false, skipped: "opt-out (--no-docker)" };
+  } else if (!dockerAvailable()) {
+    docker = { loggedIn: false, skipped: "no docker on PATH" };
+    if (!isJsonMode()) info("  No docker on PATH \u2014 skipping registry login.");
+  } else {
+    let username = opts.dockerUser?.trim();
+    if (!username && !process.stdin.isTTY) {
+      docker = { loggedIn: false, skipped: "no --docker-user and no TTY" };
+    } else {
+      if (!username) {
+        const asked = await text2({
+          message: `GitHub username for the registry login (${host})`,
+          placeholder: process.env.USER || "username",
+          validate: (s) => s.trim() ? void 0 : "A username is required."
+        });
+        if (cancelled(asked)) {
+          err("\n  Cancelled \u2014 token is stored, registry login skipped.\n");
+          if (isJsonMode()) printJson({ authenticated: true, repo });
+          else ok("  Next: run `kraft`.");
+          return;
+        }
+        username = asked.trim();
+      }
+      const res = dockerLogin(host, username, token);
+      docker = { loggedIn: res.ok };
+      if (res.ok) {
+        if (!isJsonMode()) ok(`  Registry login OK (${host} as ${username}).`);
+      } else {
+        err(
+          `
+  Registry login failed (${host}): ${res.detail || "unknown error"}`
+        );
+        info("  Token is stored \u2014 fix the login with:");
+        info(
+          `    echo $CR_PAT | docker login ${host} -u ${username} --password-stdin
+`
+        );
+      }
+    }
+  }
+  if (isJsonMode()) {
+    printJson({
+      authenticated: true,
+      repo,
+      latestRelease: releases.tag,
+      registry: host,
+      docker
+    });
+  } else {
+    ok("  Next: run `kraft`.");
+  }
+}
+function runStatus2() {
+  const token = githubToken();
+  const source = githubTokenSource();
+  const host = registryHost();
+  const status = {
+    repo: githubRepo(),
+    token: token ? maskToken(token) : null,
+    tokenSource: source,
+    registry: host,
+    registryLogin: dockerHasAuthFor(host)
+  };
+  if (isJsonMode()) {
+    printJson(status);
+    return;
+  }
+  if (!token) {
+    info("  No GitHub token on this box. Run `kraft gh auth` to add one.");
+    info(`  Releases repo: ${status.repo} | registry: ${host}`);
+    return;
+  }
+  ok(`  GitHub token: ${status.token} (from ${source})`);
+  info(`  Releases repo: ${status.repo}`);
+  info(
+    status.registryLogin ? `  Registry login: present for ${host}` : `  Registry login: MISSING for ${host} \u2014 re-run \`kraft gh auth\` (or docker login).`
+  );
+}
+async function runLogout(opts) {
+  const host = registryHost();
+  if (!opts.yes && process.stdin.isTTY && !isJsonMode()) {
+    const v = await select4({
+      message: "Forget the stored GitHub token (and registry login)?",
+      options: [
+        { value: "yes", label: "Yes, log out" },
+        { value: "no", label: "Cancel" }
+      ]
+    });
+    if (cancelled(v) || v !== "yes") {
+      info("  Cancelled \u2014 token kept.");
+      return;
+    }
+  }
+  const removed = clearGithubToken();
+  let dockerOut = "";
+  try {
+    const r = spawnSync8("docker", ["logout", host], { encoding: "utf8" });
+    dockerOut = `${r.stdout ?? ""}${r.stderr ?? ""}`.trim();
+  } catch {
+  }
+  if (isJsonMode()) {
+    printJson({ loggedOut: true, tokenRemoved: removed, registry: host });
+    return;
+  }
+  ok(
+    removed ? "  GitHub token forgotten." : "  No stored token (env-provided tokens are untouched)."
+  );
+  if (dockerOut) info(`  docker: ${dockerOut}`);
+}
+var ghCommand = new Command28("gh").description(
+  "GitHub auth for private releases + registries (one-time setup)"
+);
+ghCommand.command("auth").description(
+  "Save a GitHub token (prompted, masked) and log the registry in \u2014 then plain `kraft` works"
+).option(
+  "--token <token>",
+  "Token for non-interactive use (env GITHUB_TOKEN also works)"
+).option(
+  "--repo <owner/repo>",
+  "Releases repo (default: KRAFT_GITHUB_REPO or rakay-technology/kraft)"
+).option("--docker-user <user>", "GitHub username for the registry login").option("--no-docker", "Skip the registry login, store the token only").action(runAuth);
+ghCommand.command("status").description("Show what GitHub / registry auth this box has").action(runStatus2);
+ghCommand.command("logout").description("Forget the stored token (and registry login)").option("--yes", "Skip the confirmation prompt").action(runLogout);
+
 // src/commands/wizard.ts
 import chalk19 from "chalk";
 import open2 from "open";
@@ -8482,9 +8711,9 @@ import { join as join13 } from "path";
 import {
   intro as intro4,
   outro as outro4,
-  text as text2,
-  password as password2,
-  select as select4,
+  text as text3,
+  password as password3,
+  select as select5,
   spinner as spinner4,
   note as note3,
   log as log5,
@@ -8500,13 +8729,13 @@ function ensure2(value) {
 }
 async function promptLocalAdmin() {
   const name = ensure2(
-    await text2({
+    await text3({
       message: "Your name",
       validate: (v) => v?.trim() ? void 0 : "Required"
     })
   ).trim();
   const email = ensure2(
-    await text2({
+    await text3({
       message: "Email",
       placeholder: "you@example.com",
       // Same rule the headless path enforces (isValidEmail) — an `@`-only check
@@ -8515,13 +8744,13 @@ async function promptLocalAdmin() {
     })
   ).trim().toLowerCase();
   const pw = ensure2(
-    await password2({
+    await password3({
       message: "Password",
       validate: (v) => v && v.length >= 8 ? void 0 : "At least 8 characters"
     })
   );
   ensure2(
-    await password2({
+    await password3({
       message: "Confirm password",
       validate: (v) => v === pw ? void 0 : "Passwords don't match"
     })
@@ -8712,7 +8941,7 @@ async function runWizard() {
     }
     sp.stop("Couldn't detect the public IP automatically.", 1);
     publicHost = ensure2(
-      await text2({
+      await text3({
         message: "This server's public IP or hostname",
         placeholder: "203.0.113.10",
         validate: (v) => v?.trim() ? void 0 : "Required \u2014 the edge proxy routes traffic to this address"
@@ -8729,7 +8958,7 @@ async function runWizard() {
   planning: while (true) {
     if (stage === "reach") {
       const reach = ensure2(
-        await select4({
+        await select5({
           message: "How should this instance be reachable?",
           // Default to public — most people setting up on a server/VPS want a
           // domain + HTTPS; localhost-only is the deliberate opt-out.
@@ -8760,7 +8989,7 @@ async function runWizard() {
     }
     if (stage === "type") {
       const domainType = ensure2(
-        await select4({
+        await select5({
           message: "How do you want a domain + HTTPS?",
           initialValue: canManage ? "custom" : "byo",
           options: [
@@ -8789,7 +9018,7 @@ async function runWizard() {
     }
     if (stage === "custom") {
       const raw2 = ensure2(
-        await text2({
+        await text3({
           message: "Your domain",
           placeholder: "ops.example.com",
           initialValue: customDomainInput || void 0,
@@ -8816,7 +9045,7 @@ async function runWizard() {
         "DNS"
       );
       const go2 = ensure2(
-        await select4({
+        await select5({
           message: "A record added?",
           options: [
             {
@@ -8839,7 +9068,7 @@ async function runWizard() {
       break planning;
     }
     const raw = ensure2(
-      await text2({
+      await text3({
         message: "Your domain (served behind your proxy)",
         placeholder: "ops.example.com",
         initialValue: byoDomainInput || void 0,
@@ -8863,7 +9092,7 @@ async function runWizard() {
       "Confirm"
     );
     const go = ensure2(
-      await select4({
+      await select5({
         message: "Continue?",
         options: [
           { value: "go", label: "Continue" },
@@ -8908,7 +9137,7 @@ async function runWizard() {
       }
     }
   }
-  const uiTag = `v${"0.7.4"}`;
+  const uiTag = `v${"0.7.6"}`;
   if (method === "bare") {
     const dl = spinner4();
     dl.start("Pulling the Kraft dist from GitHub");
@@ -8928,6 +9157,9 @@ async function runWizard() {
       log5.info(
         "Check your network / that this release published its dashboard asset, then re-run `kraft`."
       );
+      log5.info(
+        "Private repo? Run `kraft gh auth` once (stores a token + registry login), then re-run `kraft`."
+      );
       process.exit(1);
     }
   }
@@ -8942,7 +9174,7 @@ async function runWizard() {
   let allowHostControl = true;
   if (method === "compose") {
     allowHostControl = ensure2(
-      await select4({
+      await select5({
         message: "Let Kraft operate this machine's OS?",
         initialValue: "allow",
         options: [
@@ -8973,7 +9205,7 @@ async function runWizard() {
     const dashboardPort = String(ports.dashboard);
     const moved = portMoveNotice(ports, composeTrustedOriginUrls());
     if (moved.length) log5.info(moved.join("\n"));
-    if (!pinnedImagesReady({ version: "0.7.4" })) {
+    if (!pinnedImagesReady({ version: "0.7.6" })) {
       cancel4(
         "The pinned Kraft image tag isn't in the registry yet \u2014 nothing on this box was changed."
       );
@@ -8995,6 +9227,27 @@ async function runWizard() {
       );
       process.exit(1);
     }
+    const regHost = registryHost();
+    if (!dockerHasAuthFor(regHost)) {
+      const regToken = githubToken();
+      if (regToken) {
+        const username = ensure2(
+          await text3({
+            message: `GitHub username for the registry login (${regHost})`,
+            placeholder: process.env.USER || "username",
+            validate: (v) => v?.trim() ? void 0 : "A username is required."
+          })
+        );
+        const logged = dockerLogin(regHost, username.trim(), regToken);
+        if (logged.ok) {
+          log5.info(`Registry login OK (${regHost} as ${username.trim()}).`);
+        } else {
+          log5.warn(
+            `Registry login failed (${regHost}): ${logged.detail || "unknown error"} \u2014 the pull below will report it. Fix with \`kraft gh auth\`.`
+          );
+        }
+      }
+    }
     log5.step(
       sourceBuildDir() ? "Building the Kraft images before touching :80/:443 (first run takes a few minutes)\u2026" : "Pulling images before touching :80/:443\u2026"
     );
@@ -9003,7 +9256,7 @@ async function runWizard() {
       dashboardPort,
       publicUrl,
       trustProxy: behindProxy,
-      version: "0.7.4",
+      version: "0.7.6",
       noHostControl: !allowHostControl
     });
     if (!fetched.ok) {
@@ -9034,7 +9287,7 @@ async function runWizard() {
       dashboardPort,
       publicUrl,
       trustProxy: behindProxy,
-      version: "0.7.4",
+      version: "0.7.6",
       noHostControl: !allowHostControl
     });
     if (!up.ok) {
@@ -9126,7 +9379,7 @@ async function runWizard() {
     if (!result.domainRegistered)
       liveUrl2 = `http://localhost:${started.dashPort}`;
     for (const w of result.warnings) log5.warn(w);
-    const { verifyHostChannel } = await import("./host-channel-preflight-Z6HYSPKO.js");
+    const { verifyHostChannel } = await import("./host-channel-preflight-Z4QG7Q44.js");
     await verifyHostChannel().catch(() => {
     });
     finishSetup({
@@ -9274,7 +9527,7 @@ ${chalk19.dim("Dashboard".padEnd(11))}${dashUrl}
     );
   }
   const action2 = ensure2(
-    await select4({
+    await select5({
       message: "What would you like to do?",
       options: [
         ...corrupted ? [
@@ -9397,7 +9650,7 @@ ${chalk19.dim("Dashboard".padEnd(11))}${dashUrl}
     }
     case "reset": {
       const pw = ensure2(
-        await password2({
+        await password3({
           message: "New admin password",
           validate: (v) => v && v.length >= 8 ? void 0 : "At least 8 characters"
         })
@@ -9429,8 +9682,8 @@ function attachCompletion(program2) {
 }
 
 // src/index.ts
-var program = new Command28();
-program.name("kraft").description("Kraft CLI \u2014 install, run, and manage Kraft from your terminal").version("0.7.4").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
+var program = new Command29();
+program.name("kraft").description("Kraft CLI \u2014 install, run, and manage Kraft from your terminal").version("0.7.6").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
   if (thisCommand.opts().json) setJsonMode(true);
 }).action(async () => {
   const installed = serviceStatus().installed || readInstallMethod() === "compose";
@@ -9443,6 +9696,7 @@ program.addCommand(uninstallCommand);
 program.addCommand(installCommand);
 program.addCommand(updateCommand);
 program.addCommand(openCommand);
+program.addCommand(ghCommand);
 program.addCommand(loginCommand);
 program.addCommand(logoutCommand);
 program.addCommand(initCommand);