@docker-doctor/cli 0.2.0 → 0.3.0

package/dist/{src-Bt3AB-Xl.mjs → src-EqtziccA.mjs}

@@ -2,13 +2,11 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { parse } from "yaml";
-import * as Data from "effect/Data";
-import * as Schema from "effect/Schema";
 
 //#region package.json
 var package_default = {
 	name: "@docker-doctor/cli",
-	version: "0.2.0",
+	version: "0.3.0",
 	description: "Static analysis for Dockerfile and Docker Compose files",
 	keywords: [
 		"best-practices",
@@ -53,13 +51,13 @@ var package_default = {
 	scripts: {
 		"build": "NODE_OPTIONS='--max-old-space-size=4096' tsdown",
 		"dev": "NODE_OPTIONS='--max-old-space-size=4096' tsdown --watch",
+		"test": "bun test",
 		"typecheck": "tsc --noEmit",
 		"clean": "git clean -xdf .turbo node_modules dist"
 	},
 	dependencies: {
 		"chalk": "^5.4.1",
 		"commander": "^15.0.0",
-		"effect": "4.0.0-beta.70",
 		"yaml": "^2.7.0"
 	},
 	devDependencies: {
@@ -103,76 +101,122 @@ const discoverProject = async (rootDir) => {
 
 //#endregion
 //#region ../core/src/parsers/dockerfile-parser.ts
+const DOCKERFILE_KEYWORDS = /* @__PURE__ */ new Set([
+	"ADD",
+	"ARG",
+	"CMD",
+	"COPY",
+	"ENTRYPOINT",
+	"ENV",
+	"EXPOSE",
+	"FROM",
+	"HEALTHCHECK",
+	"LABEL",
+	"MAINTAINER",
+	"ONBUILD",
+	"RUN",
+	"SHELL",
+	"STOPSIGNAL",
+	"USER",
+	"VOLUME",
+	"WORKDIR"
+]);
+const INSTRUCTION_LINE_RE = /^(?<inst>[A-Za-z]+)\s+(?<args>.*)$/u;
+const HEREDOC_OPENER_RE = /<<-?\s*(?<quote>['"]?)(?<delim>\w+)\k<quote>/gu;
+const createParserState = () => ({
+	currentArgs: "",
+	currentInstruction: "",
+	heredocQueue: [],
+	instructions: [],
+	rawAccumulator: [],
+	startLine: 0
+});
+const closeInstruction = (state) => {
+	if (state.currentInstruction) state.instructions.push({
+		args: state.currentArgs,
+		instruction: state.currentInstruction,
+		line: state.startLine,
+		raw: state.rawAccumulator.join("\n")
+	});
+	state.currentInstruction = "";
+	state.currentArgs = "";
+	state.rawAccumulator = [];
+};
+const matchInstructionKeyword = (lineContent) => {
+	const match = lineContent.match(INSTRUCTION_LINE_RE);
+	const matchedWord = match?.groups?.inst.toUpperCase();
+	if (matchedWord && DOCKERFILE_KEYWORDS.has(matchedWord)) return {
+		args: match?.groups?.args ?? "",
+		instruction: matchedWord
+	};
+	const word = lineContent.trim().toUpperCase();
+	if (DOCKERFILE_KEYWORDS.has(word)) return {
+		args: "",
+		instruction: word
+	};
+	return null;
+};
+const findHeredocDelimiters = (lineContent) => [...lineContent.matchAll(HEREDOC_OPENER_RE)].map((m) => m.groups?.delim ?? "");
+const processHeredocLine = (state, trimmed) => {
+	if (trimmed === state.heredocQueue[0]) state.heredocQueue.shift();
+	else state.currentArgs += (state.currentArgs ? " " : "") + trimmed;
+	if (state.heredocQueue.length === 0) closeInstruction(state);
+};
+const processInstructionLine = (state, trimmed, lineNum) => {
+	let lineContent = trimmed;
+	if (lineContent.startsWith("#")) return;
+	const hasContinuation = lineContent.endsWith("\\");
+	if (hasContinuation) lineContent = lineContent.slice(0, -1).trim();
+	if (state.currentInstruction) state.currentArgs += (state.currentArgs ? " " : "") + lineContent;
+	else {
+		state.startLine = lineNum;
+		const matched = matchInstructionKeyword(lineContent);
+		if (matched) {
+			state.currentInstruction = matched.instruction;
+			state.currentArgs = matched.args;
+		}
+	}
+	if (state.currentInstruction) state.heredocQueue.push(...findHeredocDelimiters(lineContent));
+	if (state.heredocQueue.length > 0) return;
+	if (!hasContinuation) closeInstruction(state);
+};
 const parseDockerfile = (content) => {
-	const instructions = [];
+	const state = createParserState();
 	const lines = content.split(/\r?\n/u);
-	let currentInstruction = "";
-	let currentArgs = "";
-	let startLine = 0;
-	let rawAccumulator = [];
 	for (const [i, rawLine] of lines.entries()) {
 		const trimmed = rawLine.trim();
 		const lineNum = i + 1;
-		if (!currentInstruction && (trimmed === "" || trimmed.startsWith("#"))) continue;
-		rawAccumulator.push(rawLine);
-		let lineContent = trimmed;
-		if (lineContent.startsWith("#")) continue;
-		const hasContinuation = lineContent.endsWith("\\");
-		if (hasContinuation) lineContent = lineContent.slice(0, -1).trim();
-		if (currentInstruction) currentArgs += (currentArgs ? " " : "") + lineContent;
-		else {
-			startLine = lineNum;
-			const match = lineContent.match(/^(?<inst>[A-Z]+)\s+(?<args>.*)$/iu);
-			if (match?.groups) {
-				currentInstruction = match.groups.inst.toUpperCase();
-				currentArgs = match.groups.args;
-			} else {
-				const word = lineContent.trim().toUpperCase();
-				if ([
-					"RUN",
-					"CMD",
-					"ENTRYPOINT",
-					"EXPOSE",
-					"USER",
-					"WORKDIR"
-				].includes(word)) {
-					currentInstruction = word;
-					currentArgs = "";
-				}
-			}
-		}
-		if (!hasContinuation) {
-			if (currentInstruction) instructions.push({
-				args: currentArgs,
-				instruction: currentInstruction,
-				line: startLine,
-				raw: rawAccumulator.join("\n")
-			});
-			currentInstruction = "";
-			currentArgs = "";
-			rawAccumulator = [];
-		}
+		const insideHeredoc = state.heredocQueue.length > 0;
+		if (!state.currentInstruction && !insideHeredoc && (trimmed === "" || trimmed.startsWith("#"))) continue;
+		state.rawAccumulator.push(rawLine);
+		if (insideHeredoc) processHeredocLine(state, trimmed);
+		else processInstructionLine(state, trimmed, lineNum);
 	}
-	if (currentInstruction) instructions.push({
-		args: currentArgs,
-		instruction: currentInstruction,
-		line: startLine,
-		raw: rawAccumulator.join("\n")
-	});
-	return instructions;
+	closeInstruction(state);
+	return state.instructions;
 };
 
 //#endregion
 //#region ../core/src/errors/config-error.ts
-var ConfigError = class extends Data.TaggedError("ConfigError") {};
-
-//#endregion
-//#region ../core/src/errors/file-not-found-error.ts
-var FileNotFoundError = class extends Data.TaggedError("FileNotFoundError") {};
+var ConfigError = class extends Error {
+	_tag = "ConfigError";
+	constructor(options) {
+		super(options.message);
+		this.name = "ConfigError";
+	}
+};
 
 //#endregion
 //#region ../core/src/errors/parse-error.ts
-var ParseError = class extends Data.TaggedError("ParseError") {};
+var ParseError = class extends Error {
+	_tag = "ParseError";
+	file;
+	constructor(options) {
+		super(options.message);
+		this.name = "ParseError";
+		this.file = options.file;
+	}
+};
 
 //#endregion
 //#region ../core/src/parsers/compose-parser.ts
@@ -215,7 +259,8 @@ const preferCopyOverAdd = {
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "ADD") {
-			const [src] = inst.args.split(/\s+/u);
+			const src = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
+			if (!src) continue;
 			const isRemote = src.startsWith("http://") || src.startsWith("https://");
 			const isArchive = src.endsWith(".tar") || src.endsWith(".tar.gz") || src.endsWith(".tgz") || src.endsWith(".zip");
 			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
@@ -448,6 +493,54 @@ const composeRules = [
 	useDependsOnCondition
 ];
 
+//#endregion
+//#region ../core/src/parsers/image-ref.ts
+const parseImageRef = (ref) => {
+	if (ref.includes("${") || ref.startsWith("$")) return {
+		isVariable: true,
+		name: ref
+	};
+	let remainder = ref;
+	let digest;
+	const atIndex = remainder.indexOf("@");
+	if (atIndex !== -1) {
+		digest = remainder.slice(atIndex + 1);
+		remainder = remainder.slice(0, atIndex);
+	}
+	let tag;
+	const lastColonIndex = remainder.lastIndexOf(":");
+	const lastSlashIndex = remainder.lastIndexOf("/");
+	if (lastColonIndex !== -1 && lastColonIndex > lastSlashIndex) {
+		tag = remainder.slice(lastColonIndex + 1);
+		remainder = remainder.slice(0, lastColonIndex);
+	}
+	let registry;
+	const firstSlashIndex = remainder.indexOf("/");
+	if (firstSlashIndex !== -1) {
+		const firstSegment = remainder.slice(0, firstSlashIndex);
+		if (firstSegment.includes(".") || firstSegment.includes(":") || firstSegment === "localhost") {
+			registry = firstSegment;
+			remainder = remainder.slice(firstSlashIndex + 1);
+		}
+	}
+	return {
+		digest,
+		isVariable: false,
+		name: remainder,
+		registry,
+		tag
+	};
+};
+const collectStageAliases = (instructions) => {
+	const aliases = /* @__PURE__ */ new Set();
+	for (const inst of instructions) {
+		if (inst.instruction !== "FROM") continue;
+		const match = /\sas\s+(?<alias>\S+)/iu.exec(inst.args);
+		if (match?.groups?.alias) aliases.add(match.groups.alias.toLowerCase());
+	}
+	return aliases;
+};
+
 //#endregion
 //#region ../core/src/rules/image-size.ts
 const createDiagnostic$2 = (file, ruleKey, severity, message, help, line) => ({
@@ -462,17 +555,16 @@ const preferSlimBase = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
+		const stageAliases = collectStageAliases(instructions);
 		for (const inst of instructions) if (inst.instruction === "FROM") {
 			const imagePart = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
 			if (!imagePart || imagePart === "scratch") continue;
-			const colonIndex = imagePart.indexOf(":");
-			if (colonIndex !== -1) {
-				const tag = imagePart.slice(colonIndex + 1).toLowerCase();
-				const isSlim = tag.includes("alpine") || tag.includes("slim") || tag.includes("distroless");
-				const isSha = tag.startsWith("sha256:");
-				const isStageReference = instructions.some((other) => other.line < inst.line && other.instruction === "FROM" && other.args.toLowerCase().includes(` as ${imagePart.toLowerCase()}`));
-				if (!isSlim && !isSha && !isStageReference) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
-			}
+			const ref = parseImageRef(imagePart);
+			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
+			if (ref.digest) continue;
+			if (!ref.tag) continue;
+			const tag = ref.tag.toLowerCase();
+			if (!(tag.includes("alpine") || tag.includes("slim") || tag.includes("distroless"))) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -557,10 +649,12 @@ const orderLayers = {
 		const diagnostics = [];
 		let copyAllLine = -1;
 		for (const inst of instructions) {
+			if (inst.instruction === "FROM") copyAllLine = -1;
 			if (inst.instruction === "COPY" || inst.instruction === "ADD") {
 				const src = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
 				if (!src) continue;
-				if ((src === "." || src === "./" || src === "*" || src.includes("src")) && copyAllLine === -1) copyAllLine = inst.line;
+				const normalized = src.replace(/^\.\//u, "");
+				if ((normalized === "." || normalized === "" || normalized === "*" || normalized === "src" || normalized.startsWith("src/")) && copyAllLine === -1) copyAllLine = inst.line;
 			}
 			if (inst.instruction === "RUN" && copyAllLine !== -1) {
 				const args = inst.args.toLowerCase();
@@ -600,7 +694,9 @@ const useDockerignore = {
 	check(instructions, file, context) {
 		if (instructions.some((inst) => {
 			if (inst.instruction === "COPY" || inst.instruction === "ADD") {
-				const [src] = inst.args.split(/\s+/u);
+				if (/(?:^|\s)--from=/u.test(inst.args)) return false;
+				const src = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
+				if (!src) return false;
 				return src === "." || src === "./" || src === "*";
 			}
 			return false;
@@ -636,7 +732,10 @@ const noRootUser = {
 	check(instructions, file) {
 		let lastUser = "root";
 		let lastUserLine = 1;
-		for (const inst of instructions) if (inst.instruction === "USER") {
+		for (const inst of instructions) if (inst.instruction === "FROM") {
+			lastUser = "root";
+			lastUserLine = inst.line;
+		} else if (inst.instruction === "USER") {
 			lastUser = inst.args.trim().toLowerCase();
 			lastUserLine = inst.line;
 		}
@@ -653,12 +752,12 @@ const noSecretsInEnv = {
 	check(instructions, file) {
 		const diagnostics = [];
 		const secretKeywords = [
-			/password/iu,
-			/secret/iu,
-			/token/iu,
-			/api_key/iu,
-			/private_key/iu,
-			/auth/iu
+			/(?:^|[_-])password(?:[_-]|$)/iu,
+			/(?:^|[_-])secret(?:[_-]|$)/iu,
+			/(?:^|[_-])token(?:[_-]|$)/iu,
+			/(?:^|[_-])api_key(?:[_-]|$)/iu,
+			/(?:^|[_-])private_key(?:[_-]|$)/iu,
+			/(?:^|[_-])auth(?:[_-]|$)/iu
 		];
 		for (const inst of instructions) if (inst.instruction === "ENV" || inst.instruction === "ARG") {
 			const args = inst.args.trim();
@@ -693,15 +792,14 @@ const pinImageVersion = {
 	category: "Security",
 	check(instructions, file) {
 		const diagnostics = [];
+		const stageAliases = collectStageAliases(instructions);
 		for (const inst of instructions) if (inst.instruction === "FROM") {
 			const imagePart = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
 			if (!imagePart || imagePart === "scratch") continue;
-			const colonIndex = imagePart.indexOf(":");
-			const atIndex = imagePart.indexOf("@");
-			if (colonIndex === -1 && atIndex === -1) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' does not specify a tag. This makes builds non-deterministic.`, this.help, inst.line));
-			else if (colonIndex !== -1) {
-				if (imagePart.slice(colonIndex + 1) === "latest") diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' uses the mutable 'latest' tag. This makes builds non-deterministic.`, this.help, inst.line));
-			}
+			const ref = parseImageRef(imagePart);
+			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
+			if (!(ref.tag || ref.digest)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' does not specify a tag. This makes builds non-deterministic.`, this.help, inst.line));
+			else if (ref.tag === "latest" && !ref.digest) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' uses the mutable 'latest' tag. This makes builds non-deterministic.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -715,7 +813,8 @@ const noAddRemote = {
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "ADD") {
-			const [src] = inst.args.split(/\s+/u);
+			const src = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
+			if (!src) continue;
 			if (src.startsWith("http://") || src.startsWith("https://")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `ADD instruction uses a remote URL '${src}'. Remote files added via ADD cannot be cleaned up in later layers, increasing image size.`, this.help, inst.line));
 		}
 		return diagnostics;
@@ -774,23 +873,65 @@ const runComposeRules = (composeContent, file, rulesConfig) => {
 
 //#endregion
 //#region ../core/src/schemas/config.ts
-const RuleSeveritySchema = Schema.Union([
-	Schema.Literal("error"),
-	Schema.Literal("warning"),
-	Schema.Literal("info"),
-	Schema.Literal("off")
-]);
-const DockerDoctorConfigSchema = Schema.Struct({
-	categories: Schema.optional(Schema.Struct({
-		"Best Practices": Schema.optional(RuleSeveritySchema),
-		Compose: Schema.optional(RuleSeveritySchema),
-		"Image Size": Schema.optional(RuleSeveritySchema),
-		Performance: Schema.optional(RuleSeveritySchema),
-		Security: Schema.optional(RuleSeveritySchema)
-	})),
-	ignore: Schema.optional(Schema.Struct({ files: Schema.optional(Schema.Array(Schema.String)) })),
-	rules: Schema.optional(Schema.Record(Schema.String, RuleSeveritySchema))
-});
+const RULE_SEVERITIES = [
+	"error",
+	"warning",
+	"info",
+	"off"
+];
+const RULE_CATEGORIES = [
+	"Best Practices",
+	"Compose",
+	"Image Size",
+	"Performance",
+	"Security"
+];
+const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isRuleSeverity = (value) => typeof value === "string" && RULE_SEVERITIES.includes(value);
+const validateRules = (value) => {
+	if (!isPlainObject(value)) throw new Error(`Invalid config: "rules" must be an object, got ${typeof value}`);
+	for (const [key, severity] of Object.entries(value)) if (!isRuleSeverity(severity)) throw new Error(`Invalid severity ${JSON.stringify(severity)} for rule "${key}"`);
+	return value;
+};
+const validateCategories = (value) => {
+	if (!isPlainObject(value)) throw new Error(`Invalid config: "categories" must be an object, got ${typeof value}`);
+	const result = {};
+	for (const [key, severity] of Object.entries(value)) {
+		if (!RULE_CATEGORIES.includes(key)) continue;
+		if (!isRuleSeverity(severity)) throw new Error(`Invalid severity ${JSON.stringify(severity)} for category "${key}"`);
+		result[key] = severity;
+	}
+	return result;
+};
+const validateIgnore = (value) => {
+	if (!isPlainObject(value)) throw new Error(`Invalid config: "ignore" must be an object, got ${typeof value}`);
+	const result = {};
+	if ("files" in value && value.files !== void 0) {
+		if (!Array.isArray(value.files) || !value.files.every((item) => typeof item === "string")) throw new Error("Invalid config: \"ignore.files\" must be an array of strings");
+		result.files = value.files;
+	}
+	return result;
+};
+const describeInvalidTopLevel = (input) => {
+	if (input === null) return "null";
+	if (Array.isArray(input)) return "array";
+	return typeof input;
+};
+/**
+* Validates and normalizes a raw config object, throwing on invalid input.
+*
+* Mirrors the legacy schema's behavior exactly, including silently
+* dropping unknown top-level (and nested) keys rather than throwing
+* or preserving them.
+*/
+const validateConfig = (input) => {
+	if (!isPlainObject(input)) throw new Error(`Invalid config: expected an object, got ${describeInvalidTopLevel(input)}`);
+	const result = {};
+	if ("rules" in input && input.rules !== void 0) result.rules = validateRules(input.rules);
+	if ("categories" in input && input.categories !== void 0) result.categories = validateCategories(input.categories);
+	if ("ignore" in input && input.ignore !== void 0) result.ignore = validateIgnore(input.ignore);
+	return result;
+};
 
 //#endregion
 //#region ../core/src/config/loader.ts
@@ -847,7 +988,7 @@ const loadConfig = async (rootDir, customPath) => {
 	}
 	if (!configObject) return {};
 	try {
-		return Schema.decodeSync(DockerDoctorConfigSchema)(configObject);
+		return validateConfig(configObject);
 	} catch (error) {
 		throw new ConfigError({ message: `Invalid configuration format: ${error instanceof Error ? error.message : String(error)}` });
 	}
@@ -855,24 +996,48 @@ const loadConfig = async (rootDir, customPath) => {
 
 //#endregion
 //#region ../core/src/scoring.ts
+const SCORE_BUCKETS = [
+	{
+		emoji: "🏆",
+		label: "Excellent",
+		min: 90
+	},
+	{
+		emoji: "✅",
+		label: "Good",
+		min: 75
+	},
+	{
+		emoji: "⚠️",
+		label: "Needs Work",
+		min: 50
+	},
+	{
+		emoji: "🚨",
+		label: "Critical",
+		min: 0
+	}
+];
+const getScoreBucket = (score) => {
+	for (const bucket of SCORE_BUCKETS) if (score >= bucket.min) return bucket;
+	return SCORE_BUCKETS.at(-1);
+};
 const calculateScore = (diagnostics) => {
 	let penalty = 0;
 	for (const diag of diagnostics) if (diag.severity === "error") penalty += 10;
 	else if (diag.severity === "warning") penalty += 4;
 	else if (diag.severity === "info") penalty += 1;
-	const score = Math.max(0, 100 - penalty);
-	let label = "Critical 🚨";
-	if (score >= 90) label = "Excellent 🏆";
-	else if (score >= 75) label = "Good ✅";
-	else if (score >= 50) label = "Needs Work ⚠️";
+	const score = Math.round(100 * Math.exp(-penalty / 70));
+	const bucket = getScoreBucket(score);
 	return {
-		label,
+		label: `${bucket.label} ${bucket.emoji}`,
 		score
 	};
 };
 
 //#endregion
 //#region ../core/src/report.ts
+const REPORT_SCHEMA_VERSION = 2;
 const toJsonReport = (diagnostics, score, label, project) => ({
 	diagnostics: diagnostics.map((d) => ({
 		column: d.column,
@@ -885,10 +1050,11 @@ const toJsonReport = (diagnostics, score, label, project) => ({
 	})),
 	label,
 	project,
+	schemaVersion: 2,
 	score,
 	timestamp: (/* @__PURE__ */ new Date()).toISOString()
 });
 
 //#endregion
 export { runDockerfileRules as a, parseCompose as c, package_default as d, runComposeRules as i, parseDockerfile as l, calculateScore as n, allRules as o, loadConfig as r, findRule as s, toJsonReport as t, discoverProject as u };
-//# sourceMappingURL=src-Bt3AB-Xl.mjs.map
+//# sourceMappingURL=src-EqtziccA.mjs.map