@docker-doctor/cli 0.4.2 → 0.4.4

package/dist/{src-BuUGk4ND.mjs → src-CvOv-hL3.mjs}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import fs from "node:fs/promises";
 import path from "node:path";
-import { parse } from "yaml";
+import { LineCounter, isAlias, isMap, isScalar, isSeq, parse, parseDocument } from "yaml";
 
 //#region package.json
-var version = "0.4.2";
+var version = "0.4.4";
 
 //#endregion
 //#region ../core/src/project-info/discover.ts
@@ -107,7 +107,6 @@ const processHeredocLine = (state, trimmed) => {
 };
 const processInstructionLine = (state, trimmed, lineNum) => {
 	let lineContent = trimmed;
-	if (lineContent.startsWith("#")) return;
 	const hasContinuation = lineContent.endsWith("\\");
 	if (hasContinuation) lineContent = lineContent.slice(0, -1).trim();
 	if (state.currentInstruction) state.currentArgs += (state.currentArgs ? " " : "") + lineContent;
@@ -130,7 +129,8 @@ const parseDockerfile = (content) => {
 		const trimmed = rawLine.trim();
 		const lineNum = i + 1;
 		const insideHeredoc = state.heredocQueue.length > 0;
-		if (!state.currentInstruction && !insideHeredoc && (trimmed === "" || trimmed.startsWith("#"))) continue;
+		if (!insideHeredoc && trimmed.startsWith("#")) continue;
+		if (!state.currentInstruction && !insideHeredoc && trimmed === "") continue;
 		state.rawAccumulator.push(rawLine);
 		if (insideHeredoc) processHeredocLine(state, trimmed);
 		else processInstructionLine(state, trimmed, lineNum);
@@ -173,10 +173,117 @@ const parseCompose = (content, filepath) => {
 		});
 	}
 };
+/**
+* Builds a {@link ComposeLocator} over the same source text a compose object
+* was parsed from, so rules can attach line numbers to their diagnostics.
+*
+* Keys pulled in via YAML merge keys (`<<: *anchor`) have no concrete node
+* at the merge site, so paths through them resolve to `undefined` — callers
+* fall back to an unnumbered diagnostic, which matches the old behavior.
+*/
+const createComposeLocator = (content) => {
+	const lineCounter = new LineCounter();
+	const doc = parseDocument(content, {
+		lineCounter,
+		merge: true
+	});
+	return (path) => {
+		let node = doc.contents;
+		let offset;
+		for (const segment of path) {
+			if (isAlias(node)) node = node.resolve(doc);
+			if (isMap(node)) {
+				const pair = node.items.find((item) => isScalar(item.key) && String(item.key.value) === String(segment));
+				if (!pair || !isScalar(pair.key)) return;
+				offset = pair.key.range?.[0];
+				node = pair.value;
+			} else if (isSeq(node) && typeof segment === "number") {
+				const item = node.items[segment];
+				if (item === void 0 || item === null) return;
+				offset = item.range?.[0];
+				node = item;
+			} else return;
+		}
+		return offset === void 0 ? void 0 : lineCounter.linePos(offset).line;
+	};
+};
 
 //#endregion
-//#region ../core/src/rules/best-practices.ts
-const createDiagnostic$4 = (file, ruleKey, severity, message, help, line) => ({
+//#region ../core/src/parsers/exec-form.ts
+const parseExecForm = (args) => {
+	const trimmed = args.trim();
+	if (!trimmed.startsWith("[")) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(trimmed);
+	} catch {
+		return null;
+	}
+	if (!Array.isArray(parsed)) return null;
+	if (!parsed.every((el) => typeof el === "string")) return null;
+	return parsed;
+};
+
+//#endregion
+//#region ../core/src/parsers/image-ref.ts
+const parseImageRef = (ref) => {
+	if (ref.includes("${") || ref.startsWith("$")) return {
+		isVariable: true,
+		name: ref
+	};
+	let remainder = ref;
+	let digest;
+	const atIndex = remainder.indexOf("@");
+	if (atIndex !== -1) {
+		digest = remainder.slice(atIndex + 1);
+		remainder = remainder.slice(0, atIndex);
+	}
+	let tag;
+	const lastColonIndex = remainder.lastIndexOf(":");
+	const lastSlashIndex = remainder.lastIndexOf("/");
+	if (lastColonIndex !== -1 && lastColonIndex > lastSlashIndex) {
+		tag = remainder.slice(lastColonIndex + 1);
+		remainder = remainder.slice(0, lastColonIndex);
+	}
+	let registry;
+	const firstSlashIndex = remainder.indexOf("/");
+	if (firstSlashIndex !== -1) {
+		const firstSegment = remainder.slice(0, firstSlashIndex);
+		if (firstSegment.includes(".") || firstSegment.includes(":") || firstSegment === "localhost") {
+			registry = firstSegment;
+			remainder = remainder.slice(firstSlashIndex + 1);
+		}
+	}
+	return {
+		digest,
+		isVariable: false,
+		name: remainder,
+		registry,
+		tag
+	};
+};
+const parseFromArgs = (args) => {
+	const parts = args.split(/\s+/u).filter(Boolean);
+	const asIndex = parts.findIndex((p) => p.toLowerCase() === "as");
+	return {
+		base: (asIndex === -1 ? parts : parts.slice(0, asIndex)).find((p) => !p.startsWith("--")) ?? null,
+		stage: asIndex === -1 ? null : parts[asIndex + 1] ?? null
+	};
+};
+const isScratch = (base) => base?.toLowerCase() === "scratch";
+const collectStageAliases = (instructions) => {
+	const aliases = /* @__PURE__ */ new Set();
+	for (const inst of instructions) {
+		if (inst.instruction !== "FROM") continue;
+		const { stage } = parseFromArgs(inst.args);
+		if (stage) aliases.add(stage.toLowerCase());
+	}
+	return aliases;
+};
+
+//#endregion
+//#region ../core/src/rules/create-diagnostic.ts
+const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
 	file,
 	help,
 	line,
@@ -184,16 +291,19 @@ const createDiagnostic$4 = (file, ruleKey, severity, message, help, line) => ({
 	rule: ruleKey,
 	severity
 });
+
+//#endregion
+//#region ../core/src/rules/best-practices.ts
 const requireHealthcheck = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const hasHealthcheck = instructions.some((inst) => inst.instruction === "HEALTHCHECK");
 		const hasExposedPortsOrEntry = instructions.some((inst) => inst.instruction === "EXPOSE" || inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT");
-		if (!hasHealthcheck && hasExposedPortsOrEntry) return [createDiagnostic$4(file, this.key, this.defaultSeverity, "No HEALTHCHECK instruction found. Containers running services should expose healthchecks to enable auto-healing.", this.help, 1)];
+		if (!hasHealthcheck && hasExposedPortsOrEntry) return [createDiagnostic(file, this.key, this.defaultSeverity, "No HEALTHCHECK instruction found. Containers running services should expose healthchecks to enable auto-healing.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "info",
-	help: "Use HEALTHCHECK (e.g., 'HEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost/ || exit 1') so Docker can monitor the container's live status.",
+	help: "Use HEALTHCHECK (e.g., `HEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost/ || exit 1`) so Docker can monitor the container's live status.",
 	key: "docker-doctor/require-healthcheck",
 	message: "Add a HEALTHCHECK instruction"
 };
@@ -206,7 +316,7 @@ const preferCopyOverAdd = {
 			if (!src) continue;
 			const isRemote = src.startsWith("http://") || src.startsWith("https://");
 			const isArchive = src.endsWith(".tar") || src.endsWith(".tar.gz") || src.endsWith(".tgz") || src.endsWith(".zip");
-			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
+			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -219,25 +329,22 @@ const useExecForm = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT") {
-			const args = inst.args.trim();
-			if (!args.startsWith("[") || !args.endsWith("]")) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `${inst.instruction} instruction uses shell form instead of exec form. In shell form, the command runs under '/bin/sh -c', which does not pass signals to child processes.`, this.help, inst.line));
-		}
+		for (const inst of instructions) if ((inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT") && parseExecForm(inst.args) === null) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${inst.instruction} instruction uses shell form instead of exec form. In shell form, the command runs under '/bin/sh -c', which does not pass signals to child processes.`, this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Write CMD/ENTRYPOINT instructions as JSON arrays (e.g. ENTRYPOINT [\"node\", \"index.js\"]) so OS signals (like SIGTERM) are forwarded correctly.",
+	help: "Write CMD/ENTRYPOINT instructions as JSON arrays (e.g. `ENTRYPOINT [\"node\", \"index.js\"]`) so OS signals (like SIGTERM) are forwarded correctly.",
 	key: "docker-doctor/use-exec-form",
 	message: "Use exec form for CMD and ENTRYPOINT"
 };
 const requireLabels = {
 	category: "Best Practices",
 	check(instructions, file) {
-		if (!instructions.some((inst) => inst.instruction === "LABEL")) return [createDiagnostic$4(file, this.key, this.defaultSeverity, "No LABEL metadata was found in this Dockerfile. Adding labels helps identify build information, maintainers, and descriptions.", this.help, 1)];
+		if (!instructions.some((inst) => inst.instruction === "LABEL")) return [createDiagnostic(file, this.key, this.defaultSeverity, "No LABEL metadata was found in this Dockerfile. Adding labels helps identify build information, maintainers, and descriptions.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "info",
-	help: "Use LABEL instructions (e.g. LABEL org.opencontainers.image.authors=\"...\") to document ownership, license, version, and build info.",
+	help: "Use LABEL instructions (e.g. `LABEL org.opencontainers.image.authors=\"...\"`) to document ownership, license, version, and build info.",
 	key: "docker-doctor/require-labels",
 	message: "Add LABEL metadata to images"
 };
@@ -248,28 +355,53 @@ const combineAptUpdateInstall = {
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const hasUpdate = inst.args.includes("apt-get update");
 			const hasInstall = inst.args.includes("apt-get install");
-			if (hasUpdate && !hasInstall) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.", this.help, inst.line));
-			else if (hasInstall && !hasUpdate) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.", this.help, inst.line));
+			if (hasUpdate && !hasInstall) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.", this.help, inst.line));
+			else if (hasInstall && !hasUpdate) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.", this.help, inst.line));
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Combine 'apt-get update' and 'apt-get install' in the same RUN instruction (e.g. 'RUN apt-get update && apt-get install -y --no-install-recommends <package> && rm -rf /var/lib/apt/lists/*').",
+	help: "Combine `apt-get update` and `apt-get install` in the same RUN instruction (e.g. `RUN apt-get update && apt-get install -y --no-install-recommends <package> && rm -rf /var/lib/apt/lists/*`).",
 	key: "docker-doctor/combine-apt-update-install",
 	message: "Combine apt-get update and apt-get install"
 };
+const PIPEFAIL_SETTING_RE = /(?:^|\s)-[A-Za-z]*o\s+pipefail\b/u;
+const HAS_PIPE_RE = /(?<!\|)\|(?!\|)/u;
+const shellDirectiveEnablesPipefail = (args) => {
+	const argv = parseExecForm(args);
+	return argv !== null && PIPEFAIL_SETTING_RE.test(argv.join(" "));
+};
 const usePipefail = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN") {
-			const { raw } = inst;
-			if (/(?<!\|)\|(?!\|)/u.test(raw) && !raw.includes("pipefail")) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
+		const stagePipefail = /* @__PURE__ */ new Map();
+		let shellHasPipefail = false;
+		let currentStage = null;
+		for (const inst of instructions) {
+			if (inst.instruction === "FROM") {
+				const { base, stage } = parseFromArgs(inst.args);
+				const parentStage = isScratch(base) ? null : base?.toLowerCase() ?? null;
+				shellHasPipefail = parentStage !== null && stagePipefail.get(parentStage) === true;
+				currentStage = stage?.toLowerCase() ?? null;
+				if (currentStage) stagePipefail.set(currentStage, shellHasPipefail);
+				continue;
+			}
+			if (inst.instruction === "SHELL") {
+				shellHasPipefail = shellDirectiveEnablesPipefail(inst.args);
+				if (currentStage) stagePipefail.set(currentStage, shellHasPipefail);
+				continue;
+			}
+			if (inst.instruction !== "RUN") continue;
+			const { args } = inst;
+			if (!HAS_PIPE_RE.test(args)) continue;
+			const execArgv = parseExecForm(args);
+			if (!(execArgv === null ? shellHasPipefail || PIPEFAIL_SETTING_RE.test(args) : PIPEFAIL_SETTING_RE.test(execArgv.join(" ")))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Prepend 'set -o pipefail &&' to pipe commands, or use exec form with a shell that supports it (e.g., RUN ['/bin/bash', '-c', 'set -o pipefail && ...']).",
+	help: "Prepend `set -o pipefail &&` to pipe commands, use exec form with a shell that supports it (e.g., `RUN [\"/bin/bash\", \"-c\", \"set -o pipefail && ...\"]`), or set `SHELL [\"/bin/bash\", \"-o\", \"pipefail\", \"-c\"]` at the top of the stage.",
 	key: "docker-doctor/use-pipefail",
 	message: "Use pipefail to catch pipeline command failures"
 };
@@ -279,12 +411,12 @@ const absoluteWorkdir = {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "WORKDIR") {
 			const path = inst.args.trim();
-			if (!/^(?:\/|\\|\$|[a-zA-Z]:)/u.test(path)) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `WORKDIR specifies a relative path '${path}'. For clarity and reliability, always use absolute paths.`, this.help, inst.line));
+			if (!/^(?:\/|\\|\$|[a-zA-Z]:)/u.test(path)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `WORKDIR specifies a relative path '${path}'. For clarity and reliability, always use absolute paths.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Always specify absolute paths for WORKDIR instructions (e.g. WORKDIR /app).",
+	help: "Always specify absolute paths for WORKDIR instructions (e.g. `WORKDIR /app`).",
 	key: "docker-doctor/absolute-workdir",
 	message: "Use absolute paths for WORKDIR"
 };
@@ -292,11 +424,11 @@ const avoidRunCd = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\bcd\b/u.test(inst.args)) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && /\bcd\b/u.test(inst.args)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
-	help: "Use the WORKDIR instruction instead of 'cd' inside RUN to establish directory context.",
+	help: "Use the WORKDIR instruction instead of `cd` inside RUN to establish directory context.",
 	key: "docker-doctor/avoid-run-cd",
 	message: "Avoid changing directories with cd in RUN"
 };
@@ -312,7 +444,7 @@ const sortMultilineArgs = {
 				const packages = raw.split(/\r?\n/u).slice(1).map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("&&") && !line.startsWith("-") && !line.includes("rm -rf")).map((line) => line.endsWith("\\") ? line.slice(0, -1).trim() : line).filter(Boolean);
 				if (packages.length > 1) {
 					const sorted = packages.toSorted((a, b) => a.localeCompare(b));
-					if (!packages.every((val, idx) => val === sorted[idx])) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.", this.help, inst.line));
+					if (!packages.every((val, idx) => val === sorted[idx])) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.", this.help, inst.line));
 				}
 			}
 		}
@@ -327,11 +459,11 @@ const useraddNoLogInit = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\buseradd\b/u.test(inst.args) && !inst.args.includes("--no-log-init")) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && /\buseradd\b/u.test(inst.args) && !inst.args.includes("--no-log-init")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Pass '--no-log-init' flag to useradd (e.g., 'RUN useradd --no-log-init -r -g mygroup myuser').",
+	help: "Pass `--no-log-init` flag to useradd (e.g., `RUN useradd --no-log-init -r -g mygroup myuser`).",
 	key: "docker-doctor/useradd-no-log-init",
 	message: "Use --no-log-init with useradd"
 };
@@ -350,47 +482,40 @@ const bestPracticesRules = [
 
 //#endregion
 //#region ../core/src/rules/compose.ts
-const createDiagnostic$3 = (file, ruleKey, severity, message, help) => ({
-	file,
-	help,
-	message,
-	rule: ruleKey,
-	severity
-});
 const noVersionKey = {
 	category: "Compose",
-	check(composeContent, file) {
-		if (composeContent && typeof composeContent === "object" && "version" in composeContent) return [createDiagnostic$3(file, this.key, this.defaultSeverity, "The 'version' property is deprecated. Remove it to use standard Compose spec behavior.", this.help)];
+	check(composeContent, file, context) {
+		if (composeContent && typeof composeContent === "object" && "version" in composeContent) return [createDiagnostic(file, this.key, this.defaultSeverity, "The 'version' property is deprecated. Remove it to use standard Compose spec behavior.", this.help, context?.locate?.(["version"]))];
 		return [];
 	},
 	defaultSeverity: "warning",
-	help: "The 'version' key is deprecated by the Compose specification. Omitting it defaults to the latest specification.",
+	help: "The `version` key is obsolete in the Compose specification. Omitting it defaults to the latest specification.",
 	key: "docker-doctor/no-version-key",
-	message: "Remove the 'version' key from Compose file"
+	message: "Remove the `version` key from the Compose file"
 };
 const requireResourceLimits = {
 	category: "Compose",
-	check(composeContent, file) {
+	check(composeContent, file, context) {
 		const diagnostics = [];
 		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
 			const { services } = composeContent;
 			if (services && typeof services === "object") {
 				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
 					const limits = (config.deploy?.resources)?.limits;
-					if (!limits || !limits.cpus && !limits.memory) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help));
+					if (!limits || !limits.cpus && !limits.memory) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help, context?.locate?.(["services", name])));
 				}
 			}
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Add resource limits (e.g. deploy.resources.limits) to prevent a single service from starving host resources in production.",
+	help: "Add resource limits (e.g. `deploy.resources.limits`) to prevent a single service from starving host resources in production.",
 	key: "docker-doctor/require-resource-limits",
 	message: "Define resource limits for services"
 };
 const requireRestartPolicy = {
 	category: "Compose",
-	check(composeContent, file) {
+	check(composeContent, file, context) {
 		const diagnostics = [];
 		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
 			const { services } = composeContent;
@@ -398,34 +523,38 @@ const requireRestartPolicy = {
 				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
 					const hasRestart = "restart" in config;
 					const hasDeployRestart = config.deploy?.restart_policy !== void 0;
-					if (!hasRestart && !hasDeployRestart) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' has no restart policy configured. It will not restart if it crashes or if the host reboots.`, this.help));
+					if (!hasRestart && !hasDeployRestart) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' has no restart policy configured. It will not restart if it crashes or if the host reboots.`, this.help, context?.locate?.(["services", name])));
 				}
 			}
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Define 'restart: always' or 'restart: unless-stopped' (or deploy.restart_policy) so services restart on crashes or host reboot.",
+	help: "Define `restart: always` or `restart: unless-stopped` (or `deploy.restart_policy`) so services restart on crashes or host reboot.",
 	key: "docker-doctor/require-restart-policy",
 	message: "Set restart policy for services"
 };
 const useDependsOnCondition = {
 	category: "Compose",
-	check(composeContent, file) {
+	check(composeContent, file, context) {
 		const diagnostics = [];
 		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
 			const { services } = composeContent;
 			if (services && typeof services === "object") {
 				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
 					const dependsOn = config.depends_on;
-					if (dependsOn && Array.isArray(dependsOn)) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' uses shorthand depends_on list. This only checks if containers are started, not if they are ready/healthy.`, this.help));
+					if (dependsOn && Array.isArray(dependsOn)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' uses shorthand depends_on list. This only checks if containers are started, not if they are ready/healthy.`, this.help, context?.locate?.([
+						"services",
+						name,
+						"depends_on"
+					]) ?? context?.locate?.(["services", name])));
 				}
 			}
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "info",
-	help: "Instead of a simple service list, use 'depends_on: { dependency: { condition: service_healthy } }' to ensure dependencies are fully ready before starting.",
+	help: "Instead of a simple service list, use `depends_on: { dependency: { condition: service_healthy } }` to ensure dependencies are fully ready before starting.",
 	key: "docker-doctor/use-depends-on-condition",
 	message: "Use long-form depends_on with healthcheck conditions"
 };
@@ -436,126 +565,89 @@ const composeRules = [
 	useDependsOnCondition
 ];
 
-//#endregion
-//#region ../core/src/parsers/image-ref.ts
-const parseImageRef = (ref) => {
-	if (ref.includes("${") || ref.startsWith("$")) return {
-		isVariable: true,
-		name: ref
-	};
-	let remainder = ref;
-	let digest;
-	const atIndex = remainder.indexOf("@");
-	if (atIndex !== -1) {
-		digest = remainder.slice(atIndex + 1);
-		remainder = remainder.slice(0, atIndex);
-	}
-	let tag;
-	const lastColonIndex = remainder.lastIndexOf(":");
-	const lastSlashIndex = remainder.lastIndexOf("/");
-	if (lastColonIndex !== -1 && lastColonIndex > lastSlashIndex) {
-		tag = remainder.slice(lastColonIndex + 1);
-		remainder = remainder.slice(0, lastColonIndex);
-	}
-	let registry;
-	const firstSlashIndex = remainder.indexOf("/");
-	if (firstSlashIndex !== -1) {
-		const firstSegment = remainder.slice(0, firstSlashIndex);
-		if (firstSegment.includes(".") || firstSegment.includes(":") || firstSegment === "localhost") {
-			registry = firstSegment;
-			remainder = remainder.slice(firstSlashIndex + 1);
-		}
-	}
-	return {
-		digest,
-		isVariable: false,
-		name: remainder,
-		registry,
-		tag
-	};
-};
-const collectStageAliases = (instructions) => {
-	const aliases = /* @__PURE__ */ new Set();
-	for (const inst of instructions) {
-		if (inst.instruction !== "FROM") continue;
-		const match = /\sas\s+(?<alias>\S+)/iu.exec(inst.args);
-		if (match?.groups?.alias) aliases.add(match.groups.alias.toLowerCase());
-	}
-	return aliases;
-};
-
 //#endregion
 //#region ../core/src/rules/image-size.ts
-const createDiagnostic$2 = (file, ruleKey, severity, message, help, line) => ({
-	file,
-	help,
-	line,
-	message,
-	rule: ruleKey,
-	severity
-});
 const preferSlimBase = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
 		const stageAliases = collectStageAliases(instructions);
 		for (const inst of instructions) if (inst.instruction === "FROM") {
-			const imagePart = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
-			if (!imagePart || imagePart === "scratch") continue;
+			const imagePart = parseFromArgs(inst.args).base;
+			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
 			if (ref.digest) continue;
 			if (!ref.tag) continue;
 			const haystack = `${ref.name} ${ref.tag}`.toLowerCase();
-			if (!(haystack.includes("alpine") || haystack.includes("slim") || haystack.includes("distroless") || haystack.includes("busybox"))) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
+			if (!(haystack.includes("alpine") || haystack.includes("slim") || haystack.includes("distroless") || haystack.includes("busybox"))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "info",
-	help: "Prefer tags with '-slim', '-alpine', or use distroless base images to minimize the default operating system footprint.",
+	help: "Prefer tags with `-slim`, `-alpine`, or use distroless base images to minimize the default operating system footprint.",
 	key: "docker-doctor/prefer-slim-base",
-	message: "Use slim, alpine, or distroless base images"
+	message: "Prefer slim, alpine, or distroless base images"
 };
+const BUILDKIT_MOUNT_FLAG_RE = /--mount=(?<spec>\S+)/gu;
+const CACHE_TARGET_KEY_RE = /^(?:target|dst|destination)=/u;
+const cacheMountTargets = (args) => [...args.matchAll(BUILDKIT_MOUNT_FLAG_RE)].map((match) => (match.groups?.spec ?? "").split(",")).filter((options) => options.includes("type=cache")).flatMap((options) => options.filter((option) => CACHE_TARGET_KEY_RE.test(option)).map((option) => option.slice(option.indexOf("=") + 1)));
+const APT_CACHE_DIRS = ["/var/lib/apt", "/var/cache/apt"];
+const APK_CACHE_DIRS = ["/var/cache/apk", "/etc/apk/cache"];
+const hasCacheMountFor = (args, cacheDirs) => cacheMountTargets(args).some((target) => cacheDirs.some((dir) => target === dir || target.startsWith(`${dir}/`)));
 const cleanPackageCache = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const { args } = inst;
-			if (args.includes("apt-get install") && !args.includes("rm -rf /var/lib/apt/lists")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
-			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
+			if (args.includes("apt-get install") && !args.includes("rm -rf /var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
+			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk") && !hasCacheMountFor(args, APK_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "For apt-get, append '&& rm -rf /var/lib/apt/lists/*'. For apk, use 'apk add --no-cache'. For dnf/yum, run 'yum clean all'.",
+	help: "For apt-get, append `&& rm -rf /var/lib/apt/lists/*`. For apk, use `apk add --no-cache`. For dnf/yum, run `yum clean all`.",
 	key: "docker-doctor/clean-package-cache",
 	message: "Clean up package manager cache in the same RUN layer"
 };
+const installsDevDependencies = (args) => (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install")) && !args.includes("--production") && !args.includes("--omit=dev") && !args.includes("prune");
 const avoidDevDependencies = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
-		let isLastStage = false;
-		let fromCount = 0;
-		for (const inst of instructions) if (inst.instruction === "FROM") fromCount += 1;
-		let currentStage = 0;
-		for (const inst of instructions) {
-			if (inst.instruction === "FROM") {
-				currentStage += 1;
-				isLastStage = currentStage === fromCount;
-			}
-			if (isLastStage && inst.instruction === "RUN") {
-				const { args } = inst;
-				if ((args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install")) && !args.includes("--production") && !args.includes("--omit=dev") && !args.includes("prune")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' in the final stage without omitting devDependencies.`, this.help, inst.line));
+		const stages = [];
+		for (const inst of instructions) if (inst.instruction === "FROM") {
+			const { base, stage } = parseFromArgs(inst.args);
+			stages.push({
+				base: base?.toLowerCase() ?? "",
+				name: stage?.toLowerCase() ?? null,
+				runs: []
+			});
+		} else if (inst.instruction === "RUN" && stages.length > 0) stages.at(-1)?.runs.push(inst);
+		if (stages.length === 0) return diagnostics;
+		const auditedIndices = [];
+		let index = stages.length - 1;
+		while (index >= 0) {
+			auditedIndices.push(index);
+			const { base } = stages[index];
+			index = stages.slice(0, index).findIndex((s) => s.name !== null && s.name === base);
+		}
+		const finalIndex = stages.length - 1;
+		for (const stageIndex of auditedIndices.toReversed()) {
+			const stage = stages[stageIndex];
+			for (const inst of stage.runs) {
+				if (!installsDevDependencies(inst.args)) continue;
+				const where = stageIndex === finalIndex ? "in the final stage" : `in stage '${stage.name}', whose layers the final stage inherits,`;
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
 			}
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "For Node.js, run 'npm prune --production' or install only production dependencies ('npm ci --omit=dev') in the runtime stage.",
+	help: "For Node.js, run `npm prune --production` or install only production dependencies (`npm ci --omit=dev`) in the runtime stage.",
 	key: "docker-doctor/avoid-dev-dependencies",
-	message: "Avoid installing development dependencies in final production stage"
+	message: "Avoid installing dev dependencies in the final stage"
 };
 const imageSizeRules = [
 	preferSlimBase,
@@ -565,26 +657,18 @@ const imageSizeRules = [
 
 //#endregion
 //#region ../core/src/rules/performance.ts
-const createDiagnostic$1 = (file, ruleKey, severity, message, help, line) => ({
-	file,
-	help,
-	line,
-	message,
-	rule: ruleKey,
-	severity
-});
 const useMultiStage = {
 	category: "Performance",
 	check(instructions, file) {
 		if (instructions.filter((inst) => inst.instruction === "FROM").length === 1) {
-			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || inst.args.includes("make")))) return [createDiagnostic$1(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
+			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || inst.args.includes("make")))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
 		}
 		return [];
 	},
 	defaultSeverity: "info",
 	help: "Use multi-stage builds (multiple FROM statements) to separate build dependencies from the runtime image and reduce size.",
 	key: "docker-doctor/use-multi-stage",
-	message: "Consider using multi-stage builds"
+	message: "Use multi-stage builds"
 };
 const orderLayers = {
 	category: "Performance",
@@ -601,7 +685,7 @@ const orderLayers = {
 			}
 			if (inst.instruction === "RUN" && copyAllLine !== -1) {
 				const args = inst.args.toLowerCase();
-				if (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install") || args.includes("bun install") || args.includes("pip install") || args.includes("cargo fetch")) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Running package installation command '${inst.args}' after copying application files (at line ${copyAllLine}). This invalidates the cache on any code changes.`, this.help, inst.line));
+				if (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install") || args.includes("bun install") || args.includes("pip install") || args.includes("cargo fetch")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package installation command '${inst.args}' after copying application files (at line ${copyAllLine}). This invalidates the cache on any code changes.`, this.help, inst.line));
 			}
 		}
 		return diagnostics;
@@ -621,14 +705,14 @@ const minimizeLayers = {
 			if (consecutiveRunCount === 0) firstRunLine = inst.line;
 			consecutiveRunCount += 1;
 		} else {
-			if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
+			if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
 			consecutiveRunCount = 0;
 		}
-		if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
+		if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
-	help: "Combine consecutive RUN instructions using '&&' and '\\' to reduce the total layer count and image size.",
+	help: "Combine consecutive RUN instructions using `&&` and `\\` to reduce the total layer count and image size.",
 	key: "docker-doctor/minimize-layers",
 	message: "Minimize the number of image layers"
 };
@@ -649,13 +733,13 @@ const useDockerignore = {
 				return src === "." || src === "./" || src === "*";
 			}
 			return false;
-		}) && context?.projectFiles && !hasDockerignoreFor(file, context.projectFiles)) return [createDiagnostic$1(file, this.key, this.defaultSeverity, "Using COPY/ADD with a wildcard or directory, but no .dockerignore file was found next to the Dockerfile or at the project root. This can copy local build folders and secrets.", this.help, 1)];
+		}) && context?.projectFiles && !hasDockerignoreFor(file, context.projectFiles)) return [createDiagnostic(file, this.key, this.defaultSeverity, "Using COPY/ADD with a wildcard or directory, but no .dockerignore file was found next to the Dockerfile or at the project root. This can copy local build folders and secrets.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "warning",
 	help: "Create a .dockerignore file in the same directory as the Dockerfile to prevent copying unnecessary files (like node_modules, logs, build artifacts).",
 	key: "docker-doctor/use-dockerignore",
-	message: "Ensure .dockerignore is used"
+	message: "Add a .dockerignore file"
 };
 const performanceRules = [
 	useMultiStage,
@@ -666,14 +750,6 @@ const performanceRules = [
 
 //#endregion
 //#region ../core/src/rules/security.ts
-const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
-	file,
-	help,
-	line,
-	message,
-	rule: ruleKey,
-	severity
-});
 const isRootUser = (value) => {
 	const [user] = value.split(":");
 	return user === "root" || user === "0";
@@ -681,22 +757,28 @@ const isRootUser = (value) => {
 const noRootUser = {
 	category: "Security",
 	check(instructions, file) {
+		const stageUser = /* @__PURE__ */ new Map();
+		let currentStage = null;
 		let lastUser = "root";
 		let lastUserLine = 1;
 		for (const inst of instructions) if (inst.instruction === "FROM") {
-			lastUser = "root";
+			const { base, stage } = parseFromArgs(inst.args);
+			lastUser = stageUser.get(base?.toLowerCase() ?? "") ?? "root";
 			lastUserLine = inst.line;
+			currentStage = stage?.toLowerCase() ?? null;
+			if (currentStage) stageUser.set(currentStage, lastUser);
 		} else if (inst.instruction === "USER") {
 			lastUser = inst.args.trim().toLowerCase();
 			lastUserLine = inst.line;
+			if (currentStage) stageUser.set(currentStage, lastUser);
 		}
 		if (isRootUser(lastUser)) return [createDiagnostic(file, this.key, this.defaultSeverity, "The container runs as root. Running as root allows potential container breakout vulnerabilities.", this.help, lastUserLine)];
 		return [];
 	},
 	defaultSeverity: "warning",
-	help: "Add a non-root user (e.g., 'USER node' or 'USER 1000') to improve security.",
+	help: "Add a non-root user (e.g., `USER node` or `USER 1000`) to improve security.",
 	key: "docker-doctor/no-root-user",
-	message: "Container should not run as root user"
+	message: "Run the container as a non-root user"
 };
 const noSecretsInEnv = {
 	category: "Security",
@@ -737,7 +819,7 @@ const noSecretsInEnv = {
 	defaultSeverity: "error",
 	help: "Use Docker Secrets, build arguments passed at runtime, or environment variables at runtime instead of baking them into the image.",
 	key: "docker-doctor/no-secrets-in-env",
-	message: "Do not store secrets in ENV or ARG instructions"
+	message: "Avoid storing secrets in ENV or ARG instructions"
 };
 const pinImageVersion = {
 	category: "Security",
@@ -745,8 +827,8 @@ const pinImageVersion = {
 		const diagnostics = [];
 		const stageAliases = collectStageAliases(instructions);
 		for (const inst of instructions) if (inst.instruction === "FROM") {
-			const imagePart = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
-			if (!imagePart || imagePart === "scratch") continue;
+			const imagePart = parseFromArgs(inst.args).base;
+			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
 			if (!(ref.tag || ref.digest)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' does not specify a tag. This makes builds non-deterministic.`, this.help, inst.line));
@@ -755,9 +837,9 @@ const pinImageVersion = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Specify a concrete tag instead of 'latest' or no tag (e.g., 'node:22.2.0-alpine' instead of 'node').",
+	help: "Specify a concrete tag instead of `latest` or no tag (e.g., `node:22.2.0-alpine` instead of `node`).",
 	key: "docker-doctor/pin-image-version",
-	message: "Always pin base image versions to specific tags"
+	message: "Pin base images to a specific tag or digest"
 };
 const noAddRemote = {
 	category: "Security",
@@ -771,7 +853,7 @@ const noAddRemote = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Use 'RUN curl' or 'RUN wget' instead of ADD for remote URLs, and delete the downloaded archive in the same layer to minimize size.",
+	help: "Use `RUN curl` or `RUN wget` instead of ADD for remote URLs, and delete the downloaded archive in the same layer to minimize size.",
 	key: "docker-doctor/no-add-remote",
 	message: "Avoid using ADD with remote URLs"
 };
@@ -814,12 +896,12 @@ const runDockerfileRules = (instructions, file, projectFiles, rulesConfig, categ
 
 //#endregion
 //#region ../core/src/runners/compose-runner.ts
-const runComposeRules = (composeContent, file, rulesConfig, categoriesConfig) => {
+const runComposeRules = (composeContent, file, rulesConfig, categoriesConfig, locate) => {
 	const diagnostics = [];
 	for (const rule of allComposeRules) {
 		const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);
 		if (severity === "off") continue;
-		const ruleDiagnostics = rule.check(composeContent, file);
+		const ruleDiagnostics = rule.check(composeContent, file, { locate });
 		if (severity !== rule.defaultSeverity) for (const diag of ruleDiagnostics) diag.severity = severity;
 		diagnostics.push(...ruleDiagnostics);
 	}
@@ -888,6 +970,30 @@ const validateConfig = (input) => {
 	return result;
 };
 
+//#endregion
+//#region ../core/src/config/unknown-keys.ts
+const KNOWN_CATEGORIES = [
+	"Best Practices",
+	"Compose",
+	"Image Size",
+	"Performance",
+	"Security"
+];
+const keysOf = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? Object.keys(value) : [];
+const collectUnknownConfigKeys = (raw) => {
+	if (typeof raw !== "object" || raw === null) return {
+		categories: [],
+		rules: []
+	};
+	const knownRuleKeys = new Set(allRules.map((rule) => rule.key));
+	const knownCategories = new Set(KNOWN_CATEGORIES);
+	const { categories, rules } = raw;
+	return {
+		categories: keysOf(categories).filter((key) => !knownCategories.has(key)),
+		rules: keysOf(rules).filter((key) => !knownRuleKeys.has(key))
+	};
+};
+
 //#endregion
 //#region ../core/src/config/loader.ts
 const fileExists = async (filePath) => {
@@ -917,7 +1023,12 @@ const importConfig = async (filePath) => {
 		throw new ConfigError({ message: `Failed to load config file ${filePath}: ${msg}` });
 	}
 };
-const loadConfig = async (rootDir, customPath) => {
+const warnUnknownKeys = (raw, onWarning) => {
+	const unknown = collectUnknownConfigKeys(raw);
+	for (const key of unknown.rules) onWarning(`Unknown rule "${key}" in config — it matches no rule and has no effect.`);
+	for (const key of unknown.categories) onWarning(`Unknown category "${key}" in config — categories are case-sensitive (e.g. "Best Practices", "Security").`);
+};
+const loadConfig = async (rootDir, customPath, onWarning) => {
 	let configObject = null;
 	if (customPath) {
 		const fullPath = path.resolve(rootDir, customPath);
@@ -950,7 +1061,9 @@ const loadConfig = async (rootDir, customPath) => {
 	}
 	if (!configObject) return {};
 	try {
-		return validateConfig(configObject);
+		const config = validateConfig(configObject);
+		if (onWarning) warnUnknownKeys(configObject, onWarning);
+		return config;
 	} catch (error) {
 		const msg = error instanceof Error ? error.message : String(error);
 		throw new ConfigError({ message: `Invalid configuration format: ${msg}` });
@@ -1019,5 +1132,5 @@ const toJsonReport = (diagnostics, score, label, project) => ({
 });
 
 //#endregion
-export { runDockerfileRules as a, parseCompose as c, version as d, runComposeRules as i, parseDockerfile as l, calculateScore as n, allRules as o, loadConfig as r, findRule as s, toJsonReport as t, discoverProject as u };
-//# sourceMappingURL=src-BuUGk4ND.mjs.map
+export { runDockerfileRules as a, createComposeLocator as c, discoverProject as d, version as f, runComposeRules as i, parseCompose as l, calculateScore as n, allRules as o, loadConfig as r, findRule as s, toJsonReport as t, parseDockerfile as u };
+//# sourceMappingURL=src-CvOv-hL3.mjs.map