@docker-doctor/cli 0.4.2 → 0.4.4

package/dist/{src-909bBBPN.cjs → src-DwuAaQcq.cjs}

@@ -33,7 +33,7 @@ node_path = __toESM(node_path, 1);
 let yaml = require("yaml");
 
 //#region package.json
-var version = "0.4.2";
+var version = "0.4.4";
 
 //#endregion
 //#region ../core/src/project-info/discover.ts
@@ -136,7 +136,6 @@ const processHeredocLine = (state, trimmed) => {
 };
 const processInstructionLine = (state, trimmed, lineNum) => {
 	let lineContent = trimmed;
-	if (lineContent.startsWith("#")) return;
 	const hasContinuation = lineContent.endsWith("\\");
 	if (hasContinuation) lineContent = lineContent.slice(0, -1).trim();
 	if (state.currentInstruction) state.currentArgs += (state.currentArgs ? " " : "") + lineContent;
@@ -159,7 +158,8 @@ const parseDockerfile = (content) => {
 		const trimmed = rawLine.trim();
 		const lineNum = i + 1;
 		const insideHeredoc = state.heredocQueue.length > 0;
-		if (!state.currentInstruction && !insideHeredoc && (trimmed === "" || trimmed.startsWith("#"))) continue;
+		if (!insideHeredoc && trimmed.startsWith("#")) continue;
+		if (!state.currentInstruction && !insideHeredoc && trimmed === "") continue;
 		state.rawAccumulator.push(rawLine);
 		if (insideHeredoc) processHeredocLine(state, trimmed);
 		else processInstructionLine(state, trimmed, lineNum);
@@ -202,10 +202,117 @@ const parseCompose = (content, filepath) => {
 		});
 	}
 };
+/**
+* Builds a {@link ComposeLocator} over the same source text a compose object
+* was parsed from, so rules can attach line numbers to their diagnostics.
+*
+* Keys pulled in via YAML merge keys (`<<: *anchor`) have no concrete node
+* at the merge site, so paths through them resolve to `undefined` — callers
+* fall back to an unnumbered diagnostic, which matches the old behavior.
+*/
+const createComposeLocator = (content) => {
+	const lineCounter = new yaml.LineCounter();
+	const doc = (0, yaml.parseDocument)(content, {
+		lineCounter,
+		merge: true
+	});
+	return (path) => {
+		let node = doc.contents;
+		let offset;
+		for (const segment of path) {
+			if ((0, yaml.isAlias)(node)) node = node.resolve(doc);
+			if ((0, yaml.isMap)(node)) {
+				const pair = node.items.find((item) => (0, yaml.isScalar)(item.key) && String(item.key.value) === String(segment));
+				if (!pair || !(0, yaml.isScalar)(pair.key)) return;
+				offset = pair.key.range?.[0];
+				node = pair.value;
+			} else if ((0, yaml.isSeq)(node) && typeof segment === "number") {
+				const item = node.items[segment];
+				if (item === void 0 || item === null) return;
+				offset = item.range?.[0];
+				node = item;
+			} else return;
+		}
+		return offset === void 0 ? void 0 : lineCounter.linePos(offset).line;
+	};
+};
 
 //#endregion
-//#region ../core/src/rules/best-practices.ts
-const createDiagnostic$4 = (file, ruleKey, severity, message, help, line) => ({
+//#region ../core/src/parsers/exec-form.ts
+const parseExecForm = (args) => {
+	const trimmed = args.trim();
+	if (!trimmed.startsWith("[")) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(trimmed);
+	} catch {
+		return null;
+	}
+	if (!Array.isArray(parsed)) return null;
+	if (!parsed.every((el) => typeof el === "string")) return null;
+	return parsed;
+};
+
+//#endregion
+//#region ../core/src/parsers/image-ref.ts
+const parseImageRef = (ref) => {
+	if (ref.includes("${") || ref.startsWith("$")) return {
+		isVariable: true,
+		name: ref
+	};
+	let remainder = ref;
+	let digest;
+	const atIndex = remainder.indexOf("@");
+	if (atIndex !== -1) {
+		digest = remainder.slice(atIndex + 1);
+		remainder = remainder.slice(0, atIndex);
+	}
+	let tag;
+	const lastColonIndex = remainder.lastIndexOf(":");
+	const lastSlashIndex = remainder.lastIndexOf("/");
+	if (lastColonIndex !== -1 && lastColonIndex > lastSlashIndex) {
+		tag = remainder.slice(lastColonIndex + 1);
+		remainder = remainder.slice(0, lastColonIndex);
+	}
+	let registry;
+	const firstSlashIndex = remainder.indexOf("/");
+	if (firstSlashIndex !== -1) {
+		const firstSegment = remainder.slice(0, firstSlashIndex);
+		if (firstSegment.includes(".") || firstSegment.includes(":") || firstSegment === "localhost") {
+			registry = firstSegment;
+			remainder = remainder.slice(firstSlashIndex + 1);
+		}
+	}
+	return {
+		digest,
+		isVariable: false,
+		name: remainder,
+		registry,
+		tag
+	};
+};
+const parseFromArgs = (args) => {
+	const parts = args.split(/\s+/u).filter(Boolean);
+	const asIndex = parts.findIndex((p) => p.toLowerCase() === "as");
+	return {
+		base: (asIndex === -1 ? parts : parts.slice(0, asIndex)).find((p) => !p.startsWith("--")) ?? null,
+		stage: asIndex === -1 ? null : parts[asIndex + 1] ?? null
+	};
+};
+const isScratch = (base) => base?.toLowerCase() === "scratch";
+const collectStageAliases = (instructions) => {
+	const aliases = /* @__PURE__ */ new Set();
+	for (const inst of instructions) {
+		if (inst.instruction !== "FROM") continue;
+		const { stage } = parseFromArgs(inst.args);
+		if (stage) aliases.add(stage.toLowerCase());
+	}
+	return aliases;
+};
+
+//#endregion
+//#region ../core/src/rules/create-diagnostic.ts
+const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
 	file,
 	help,
 	line,
@@ -213,16 +320,19 @@ const createDiagnostic$4 = (file, ruleKey, severity, message, help, line) => ({
 	rule: ruleKey,
 	severity
 });
+
+//#endregion
+//#region ../core/src/rules/best-practices.ts
 const requireHealthcheck = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const hasHealthcheck = instructions.some((inst) => inst.instruction === "HEALTHCHECK");
 		const hasExposedPortsOrEntry = instructions.some((inst) => inst.instruction === "EXPOSE" || inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT");
-		if (!hasHealthcheck && hasExposedPortsOrEntry) return [createDiagnostic$4(file, this.key, this.defaultSeverity, "No HEALTHCHECK instruction found. Containers running services should expose healthchecks to enable auto-healing.", this.help, 1)];
+		if (!hasHealthcheck && hasExposedPortsOrEntry) return [createDiagnostic(file, this.key, this.defaultSeverity, "No HEALTHCHECK instruction found. Containers running services should expose healthchecks to enable auto-healing.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "info",
-	help: "Use HEALTHCHECK (e.g., 'HEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost/ || exit 1') so Docker can monitor the container's live status.",
+	help: "Use HEALTHCHECK (e.g., `HEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost/ || exit 1`) so Docker can monitor the container's live status.",
 	key: "docker-doctor/require-healthcheck",
 	message: "Add a HEALTHCHECK instruction"
 };
@@ -235,7 +345,7 @@ const preferCopyOverAdd = {
 			if (!src) continue;
 			const isRemote = src.startsWith("http://") || src.startsWith("https://");
 			const isArchive = src.endsWith(".tar") || src.endsWith(".tar.gz") || src.endsWith(".tgz") || src.endsWith(".zip");
-			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
+			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -248,25 +358,22 @@ const useExecForm = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT") {
-			const args = inst.args.trim();
-			if (!args.startsWith("[") || !args.endsWith("]")) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `${inst.instruction} instruction uses shell form instead of exec form. In shell form, the command runs under '/bin/sh -c', which does not pass signals to child processes.`, this.help, inst.line));
-		}
+		for (const inst of instructions) if ((inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT") && parseExecForm(inst.args) === null) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${inst.instruction} instruction uses shell form instead of exec form. In shell form, the command runs under '/bin/sh -c', which does not pass signals to child processes.`, this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Write CMD/ENTRYPOINT instructions as JSON arrays (e.g. ENTRYPOINT [\"node\", \"index.js\"]) so OS signals (like SIGTERM) are forwarded correctly.",
+	help: "Write CMD/ENTRYPOINT instructions as JSON arrays (e.g. `ENTRYPOINT [\"node\", \"index.js\"]`) so OS signals (like SIGTERM) are forwarded correctly.",
 	key: "docker-doctor/use-exec-form",
 	message: "Use exec form for CMD and ENTRYPOINT"
 };
 const requireLabels = {
 	category: "Best Practices",
 	check(instructions, file) {
-		if (!instructions.some((inst) => inst.instruction === "LABEL")) return [createDiagnostic$4(file, this.key, this.defaultSeverity, "No LABEL metadata was found in this Dockerfile. Adding labels helps identify build information, maintainers, and descriptions.", this.help, 1)];
+		if (!instructions.some((inst) => inst.instruction === "LABEL")) return [createDiagnostic(file, this.key, this.defaultSeverity, "No LABEL metadata was found in this Dockerfile. Adding labels helps identify build information, maintainers, and descriptions.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "info",
-	help: "Use LABEL instructions (e.g. LABEL org.opencontainers.image.authors=\"...\") to document ownership, license, version, and build info.",
+	help: "Use LABEL instructions (e.g. `LABEL org.opencontainers.image.authors=\"...\"`) to document ownership, license, version, and build info.",
 	key: "docker-doctor/require-labels",
 	message: "Add LABEL metadata to images"
 };
@@ -277,28 +384,53 @@ const combineAptUpdateInstall = {
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const hasUpdate = inst.args.includes("apt-get update");
 			const hasInstall = inst.args.includes("apt-get install");
-			if (hasUpdate && !hasInstall) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.", this.help, inst.line));
-			else if (hasInstall && !hasUpdate) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.", this.help, inst.line));
+			if (hasUpdate && !hasInstall) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.", this.help, inst.line));
+			else if (hasInstall && !hasUpdate) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.", this.help, inst.line));
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Combine 'apt-get update' and 'apt-get install' in the same RUN instruction (e.g. 'RUN apt-get update && apt-get install -y --no-install-recommends <package> && rm -rf /var/lib/apt/lists/*').",
+	help: "Combine `apt-get update` and `apt-get install` in the same RUN instruction (e.g. `RUN apt-get update && apt-get install -y --no-install-recommends <package> && rm -rf /var/lib/apt/lists/*`).",
 	key: "docker-doctor/combine-apt-update-install",
 	message: "Combine apt-get update and apt-get install"
 };
+const PIPEFAIL_SETTING_RE = /(?:^|\s)-[A-Za-z]*o\s+pipefail\b/u;
+const HAS_PIPE_RE = /(?<!\|)\|(?!\|)/u;
+const shellDirectiveEnablesPipefail = (args) => {
+	const argv = parseExecForm(args);
+	return argv !== null && PIPEFAIL_SETTING_RE.test(argv.join(" "));
+};
 const usePipefail = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN") {
-			const { raw } = inst;
-			if (/(?<!\|)\|(?!\|)/u.test(raw) && !raw.includes("pipefail")) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
+		const stagePipefail = /* @__PURE__ */ new Map();
+		let shellHasPipefail = false;
+		let currentStage = null;
+		for (const inst of instructions) {
+			if (inst.instruction === "FROM") {
+				const { base, stage } = parseFromArgs(inst.args);
+				const parentStage = isScratch(base) ? null : base?.toLowerCase() ?? null;
+				shellHasPipefail = parentStage !== null && stagePipefail.get(parentStage) === true;
+				currentStage = stage?.toLowerCase() ?? null;
+				if (currentStage) stagePipefail.set(currentStage, shellHasPipefail);
+				continue;
+			}
+			if (inst.instruction === "SHELL") {
+				shellHasPipefail = shellDirectiveEnablesPipefail(inst.args);
+				if (currentStage) stagePipefail.set(currentStage, shellHasPipefail);
+				continue;
+			}
+			if (inst.instruction !== "RUN") continue;
+			const { args } = inst;
+			if (!HAS_PIPE_RE.test(args)) continue;
+			const execArgv = parseExecForm(args);
+			if (!(execArgv === null ? shellHasPipefail || PIPEFAIL_SETTING_RE.test(args) : PIPEFAIL_SETTING_RE.test(execArgv.join(" ")))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Prepend 'set -o pipefail &&' to pipe commands, or use exec form with a shell that supports it (e.g., RUN ['/bin/bash', '-c', 'set -o pipefail && ...']).",
+	help: "Prepend `set -o pipefail &&` to pipe commands, use exec form with a shell that supports it (e.g., `RUN [\"/bin/bash\", \"-c\", \"set -o pipefail && ...\"]`), or set `SHELL [\"/bin/bash\", \"-o\", \"pipefail\", \"-c\"]` at the top of the stage.",
 	key: "docker-doctor/use-pipefail",
 	message: "Use pipefail to catch pipeline command failures"
 };
@@ -308,12 +440,12 @@ const absoluteWorkdir = {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "WORKDIR") {
 			const path = inst.args.trim();
-			if (!/^(?:\/|\\|\$|[a-zA-Z]:)/u.test(path)) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `WORKDIR specifies a relative path '${path}'. For clarity and reliability, always use absolute paths.`, this.help, inst.line));
+			if (!/^(?:\/|\\|\$|[a-zA-Z]:)/u.test(path)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `WORKDIR specifies a relative path '${path}'. For clarity and reliability, always use absolute paths.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Always specify absolute paths for WORKDIR instructions (e.g. WORKDIR /app).",
+	help: "Always specify absolute paths for WORKDIR instructions (e.g. `WORKDIR /app`).",
 	key: "docker-doctor/absolute-workdir",
 	message: "Use absolute paths for WORKDIR"
 };
@@ -321,11 +453,11 @@ const avoidRunCd = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\bcd\b/u.test(inst.args)) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && /\bcd\b/u.test(inst.args)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
-	help: "Use the WORKDIR instruction instead of 'cd' inside RUN to establish directory context.",
+	help: "Use the WORKDIR instruction instead of `cd` inside RUN to establish directory context.",
 	key: "docker-doctor/avoid-run-cd",
 	message: "Avoid changing directories with cd in RUN"
 };
@@ -341,7 +473,7 @@ const sortMultilineArgs = {
 				const packages = raw.split(/\r?\n/u).slice(1).map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("&&") && !line.startsWith("-") && !line.includes("rm -rf")).map((line) => line.endsWith("\\") ? line.slice(0, -1).trim() : line).filter(Boolean);
 				if (packages.length > 1) {
 					const sorted = packages.toSorted((a, b) => a.localeCompare(b));
-					if (!packages.every((val, idx) => val === sorted[idx])) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.", this.help, inst.line));
+					if (!packages.every((val, idx) => val === sorted[idx])) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.", this.help, inst.line));
 				}
 			}
 		}
@@ -356,11 +488,11 @@ const useraddNoLogInit = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\buseradd\b/u.test(inst.args) && !inst.args.includes("--no-log-init")) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && /\buseradd\b/u.test(inst.args) && !inst.args.includes("--no-log-init")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Pass '--no-log-init' flag to useradd (e.g., 'RUN useradd --no-log-init -r -g mygroup myuser').",
+	help: "Pass `--no-log-init` flag to useradd (e.g., `RUN useradd --no-log-init -r -g mygroup myuser`).",
 	key: "docker-doctor/useradd-no-log-init",
 	message: "Use --no-log-init with useradd"
 };
@@ -379,47 +511,40 @@ const bestPracticesRules = [
 
 //#endregion
 //#region ../core/src/rules/compose.ts
-const createDiagnostic$3 = (file, ruleKey, severity, message, help) => ({
-	file,
-	help,
-	message,
-	rule: ruleKey,
-	severity
-});
 const noVersionKey = {
 	category: "Compose",
-	check(composeContent, file) {
-		if (composeContent && typeof composeContent === "object" && "version" in composeContent) return [createDiagnostic$3(file, this.key, this.defaultSeverity, "The 'version' property is deprecated. Remove it to use standard Compose spec behavior.", this.help)];
+	check(composeContent, file, context) {
+		if (composeContent && typeof composeContent === "object" && "version" in composeContent) return [createDiagnostic(file, this.key, this.defaultSeverity, "The 'version' property is deprecated. Remove it to use standard Compose spec behavior.", this.help, context?.locate?.(["version"]))];
 		return [];
 	},
 	defaultSeverity: "warning",
-	help: "The 'version' key is deprecated by the Compose specification. Omitting it defaults to the latest specification.",
+	help: "The `version` key is obsolete in the Compose specification. Omitting it defaults to the latest specification.",
 	key: "docker-doctor/no-version-key",
-	message: "Remove the 'version' key from Compose file"
+	message: "Remove the `version` key from the Compose file"
 };
 const requireResourceLimits = {
 	category: "Compose",
-	check(composeContent, file) {
+	check(composeContent, file, context) {
 		const diagnostics = [];
 		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
 			const { services } = composeContent;
 			if (services && typeof services === "object") {
 				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
 					const limits = (config.deploy?.resources)?.limits;
-					if (!limits || !limits.cpus && !limits.memory) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help));
+					if (!limits || !limits.cpus && !limits.memory) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help, context?.locate?.(["services", name])));
 				}
 			}
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Add resource limits (e.g. deploy.resources.limits) to prevent a single service from starving host resources in production.",
+	help: "Add resource limits (e.g. `deploy.resources.limits`) to prevent a single service from starving host resources in production.",
 	key: "docker-doctor/require-resource-limits",
 	message: "Define resource limits for services"
 };
 const requireRestartPolicy = {
 	category: "Compose",
-	check(composeContent, file) {
+	check(composeContent, file, context) {
 		const diagnostics = [];
 		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
 			const { services } = composeContent;
@@ -427,34 +552,38 @@ const requireRestartPolicy = {
 				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
 					const hasRestart = "restart" in config;
 					const hasDeployRestart = config.deploy?.restart_policy !== void 0;
-					if (!hasRestart && !hasDeployRestart) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' has no restart policy configured. It will not restart if it crashes or if the host reboots.`, this.help));
+					if (!hasRestart && !hasDeployRestart) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' has no restart policy configured. It will not restart if it crashes or if the host reboots.`, this.help, context?.locate?.(["services", name])));
 				}
 			}
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Define 'restart: always' or 'restart: unless-stopped' (or deploy.restart_policy) so services restart on crashes or host reboot.",
+	help: "Define `restart: always` or `restart: unless-stopped` (or `deploy.restart_policy`) so services restart on crashes or host reboot.",
 	key: "docker-doctor/require-restart-policy",
 	message: "Set restart policy for services"
 };
 const useDependsOnCondition = {
 	category: "Compose",
-	check(composeContent, file) {
+	check(composeContent, file, context) {
 		const diagnostics = [];
 		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
 			const { services } = composeContent;
 			if (services && typeof services === "object") {
 				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
 					const dependsOn = config.depends_on;
-					if (dependsOn && Array.isArray(dependsOn)) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' uses shorthand depends_on list. This only checks if containers are started, not if they are ready/healthy.`, this.help));
+					if (dependsOn && Array.isArray(dependsOn)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' uses shorthand depends_on list. This only checks if containers are started, not if they are ready/healthy.`, this.help, context?.locate?.([
+						"services",
+						name,
+						"depends_on"
+					]) ?? context?.locate?.(["services", name])));
 				}
 			}
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "info",
-	help: "Instead of a simple service list, use 'depends_on: { dependency: { condition: service_healthy } }' to ensure dependencies are fully ready before starting.",
+	help: "Instead of a simple service list, use `depends_on: { dependency: { condition: service_healthy } }` to ensure dependencies are fully ready before starting.",
 	key: "docker-doctor/use-depends-on-condition",
 	message: "Use long-form depends_on with healthcheck conditions"
 };
@@ -465,126 +594,89 @@ const composeRules = [
 	useDependsOnCondition
 ];
 
-//#endregion
-//#region ../core/src/parsers/image-ref.ts
-const parseImageRef = (ref) => {
-	if (ref.includes("${") || ref.startsWith("$")) return {
-		isVariable: true,
-		name: ref
-	};
-	let remainder = ref;
-	let digest;
-	const atIndex = remainder.indexOf("@");
-	if (atIndex !== -1) {
-		digest = remainder.slice(atIndex + 1);
-		remainder = remainder.slice(0, atIndex);
-	}
-	let tag;
-	const lastColonIndex = remainder.lastIndexOf(":");
-	const lastSlashIndex = remainder.lastIndexOf("/");
-	if (lastColonIndex !== -1 && lastColonIndex > lastSlashIndex) {
-		tag = remainder.slice(lastColonIndex + 1);
-		remainder = remainder.slice(0, lastColonIndex);
-	}
-	let registry;
-	const firstSlashIndex = remainder.indexOf("/");
-	if (firstSlashIndex !== -1) {
-		const firstSegment = remainder.slice(0, firstSlashIndex);
-		if (firstSegment.includes(".") || firstSegment.includes(":") || firstSegment === "localhost") {
-			registry = firstSegment;
-			remainder = remainder.slice(firstSlashIndex + 1);
-		}
-	}
-	return {
-		digest,
-		isVariable: false,
-		name: remainder,
-		registry,
-		tag
-	};
-};
-const collectStageAliases = (instructions) => {
-	const aliases = /* @__PURE__ */ new Set();
-	for (const inst of instructions) {
-		if (inst.instruction !== "FROM") continue;
-		const match = /\sas\s+(?<alias>\S+)/iu.exec(inst.args);
-		if (match?.groups?.alias) aliases.add(match.groups.alias.toLowerCase());
-	}
-	return aliases;
-};
-
 //#endregion
 //#region ../core/src/rules/image-size.ts
-const createDiagnostic$2 = (file, ruleKey, severity, message, help, line) => ({
-	file,
-	help,
-	line,
-	message,
-	rule: ruleKey,
-	severity
-});
 const preferSlimBase = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
 		const stageAliases = collectStageAliases(instructions);
 		for (const inst of instructions) if (inst.instruction === "FROM") {
-			const imagePart = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
-			if (!imagePart || imagePart === "scratch") continue;
+			const imagePart = parseFromArgs(inst.args).base;
+			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
 			if (ref.digest) continue;
 			if (!ref.tag) continue;
 			const haystack = `${ref.name} ${ref.tag}`.toLowerCase();
-			if (!(haystack.includes("alpine") || haystack.includes("slim") || haystack.includes("distroless") || haystack.includes("busybox"))) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
+			if (!(haystack.includes("alpine") || haystack.includes("slim") || haystack.includes("distroless") || haystack.includes("busybox"))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "info",
-	help: "Prefer tags with '-slim', '-alpine', or use distroless base images to minimize the default operating system footprint.",
+	help: "Prefer tags with `-slim`, `-alpine`, or use distroless base images to minimize the default operating system footprint.",
 	key: "docker-doctor/prefer-slim-base",
-	message: "Use slim, alpine, or distroless base images"
+	message: "Prefer slim, alpine, or distroless base images"
 };
+const BUILDKIT_MOUNT_FLAG_RE = /--mount=(?<spec>\S+)/gu;
+const CACHE_TARGET_KEY_RE = /^(?:target|dst|destination)=/u;
+const cacheMountTargets = (args) => [...args.matchAll(BUILDKIT_MOUNT_FLAG_RE)].map((match) => (match.groups?.spec ?? "").split(",")).filter((options) => options.includes("type=cache")).flatMap((options) => options.filter((option) => CACHE_TARGET_KEY_RE.test(option)).map((option) => option.slice(option.indexOf("=") + 1)));
+const APT_CACHE_DIRS = ["/var/lib/apt", "/var/cache/apt"];
+const APK_CACHE_DIRS = ["/var/cache/apk", "/etc/apk/cache"];
+const hasCacheMountFor = (args, cacheDirs) => cacheMountTargets(args).some((target) => cacheDirs.some((dir) => target === dir || target.startsWith(`${dir}/`)));
 const cleanPackageCache = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const { args } = inst;
-			if (args.includes("apt-get install") && !args.includes("rm -rf /var/lib/apt/lists")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
-			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
+			if (args.includes("apt-get install") && !args.includes("rm -rf /var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
+			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk") && !hasCacheMountFor(args, APK_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "For apt-get, append '&& rm -rf /var/lib/apt/lists/*'. For apk, use 'apk add --no-cache'. For dnf/yum, run 'yum clean all'.",
+	help: "For apt-get, append `&& rm -rf /var/lib/apt/lists/*`. For apk, use `apk add --no-cache`. For dnf/yum, run `yum clean all`.",
 	key: "docker-doctor/clean-package-cache",
 	message: "Clean up package manager cache in the same RUN layer"
 };
+const installsDevDependencies = (args) => (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install")) && !args.includes("--production") && !args.includes("--omit=dev") && !args.includes("prune");
 const avoidDevDependencies = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
-		let isLastStage = false;
-		let fromCount = 0;
-		for (const inst of instructions) if (inst.instruction === "FROM") fromCount += 1;
-		let currentStage = 0;
-		for (const inst of instructions) {
-			if (inst.instruction === "FROM") {
-				currentStage += 1;
-				isLastStage = currentStage === fromCount;
-			}
-			if (isLastStage && inst.instruction === "RUN") {
-				const { args } = inst;
-				if ((args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install")) && !args.includes("--production") && !args.includes("--omit=dev") && !args.includes("prune")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' in the final stage without omitting devDependencies.`, this.help, inst.line));
+		const stages = [];
+		for (const inst of instructions) if (inst.instruction === "FROM") {
+			const { base, stage } = parseFromArgs(inst.args);
+			stages.push({
+				base: base?.toLowerCase() ?? "",
+				name: stage?.toLowerCase() ?? null,
+				runs: []
+			});
+		} else if (inst.instruction === "RUN" && stages.length > 0) stages.at(-1)?.runs.push(inst);
+		if (stages.length === 0) return diagnostics;
+		const auditedIndices = [];
+		let index = stages.length - 1;
+		while (index >= 0) {
+			auditedIndices.push(index);
+			const { base } = stages[index];
+			index = stages.slice(0, index).findIndex((s) => s.name !== null && s.name === base);
+		}
+		const finalIndex = stages.length - 1;
+		for (const stageIndex of auditedIndices.toReversed()) {
+			const stage = stages[stageIndex];
+			for (const inst of stage.runs) {
+				if (!installsDevDependencies(inst.args)) continue;
+				const where = stageIndex === finalIndex ? "in the final stage" : `in stage '${stage.name}', whose layers the final stage inherits,`;
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
 			}
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "For Node.js, run 'npm prune --production' or install only production dependencies ('npm ci --omit=dev') in the runtime stage.",
+	help: "For Node.js, run `npm prune --production` or install only production dependencies (`npm ci --omit=dev`) in the runtime stage.",
 	key: "docker-doctor/avoid-dev-dependencies",
-	message: "Avoid installing development dependencies in final production stage"
+	message: "Avoid installing dev dependencies in the final stage"
 };
 const imageSizeRules = [
 	preferSlimBase,
@@ -594,26 +686,18 @@ const imageSizeRules = [
 
 //#endregion
 //#region ../core/src/rules/performance.ts
-const createDiagnostic$1 = (file, ruleKey, severity, message, help, line) => ({
-	file,
-	help,
-	line,
-	message,
-	rule: ruleKey,
-	severity
-});
 const useMultiStage = {
 	category: "Performance",
 	check(instructions, file) {
 		if (instructions.filter((inst) => inst.instruction === "FROM").length === 1) {
-			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || inst.args.includes("make")))) return [createDiagnostic$1(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
+			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || inst.args.includes("make")))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
 		}
 		return [];
 	},
 	defaultSeverity: "info",
 	help: "Use multi-stage builds (multiple FROM statements) to separate build dependencies from the runtime image and reduce size.",
 	key: "docker-doctor/use-multi-stage",
-	message: "Consider using multi-stage builds"
+	message: "Use multi-stage builds"
 };
 const orderLayers = {
 	category: "Performance",
@@ -630,7 +714,7 @@ const orderLayers = {
 			}
 			if (inst.instruction === "RUN" && copyAllLine !== -1) {
 				const args = inst.args.toLowerCase();
-				if (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install") || args.includes("bun install") || args.includes("pip install") || args.includes("cargo fetch")) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Running package installation command '${inst.args}' after copying application files (at line ${copyAllLine}). This invalidates the cache on any code changes.`, this.help, inst.line));
+				if (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install") || args.includes("bun install") || args.includes("pip install") || args.includes("cargo fetch")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package installation command '${inst.args}' after copying application files (at line ${copyAllLine}). This invalidates the cache on any code changes.`, this.help, inst.line));
 			}
 		}
 		return diagnostics;
@@ -650,14 +734,14 @@ const minimizeLayers = {
 			if (consecutiveRunCount === 0) firstRunLine = inst.line;
 			consecutiveRunCount += 1;
 		} else {
-			if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
+			if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
 			consecutiveRunCount = 0;
 		}
-		if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
+		if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
-	help: "Combine consecutive RUN instructions using '&&' and '\\' to reduce the total layer count and image size.",
+	help: "Combine consecutive RUN instructions using `&&` and `\\` to reduce the total layer count and image size.",
 	key: "docker-doctor/minimize-layers",
 	message: "Minimize the number of image layers"
 };
@@ -678,13 +762,13 @@ const useDockerignore = {
 				return src === "." || src === "./" || src === "*";
 			}
 			return false;
-		}) && context?.projectFiles && !hasDockerignoreFor(file, context.projectFiles)) return [createDiagnostic$1(file, this.key, this.defaultSeverity, "Using COPY/ADD with a wildcard or directory, but no .dockerignore file was found next to the Dockerfile or at the project root. This can copy local build folders and secrets.", this.help, 1)];
+		}) && context?.projectFiles && !hasDockerignoreFor(file, context.projectFiles)) return [createDiagnostic(file, this.key, this.defaultSeverity, "Using COPY/ADD with a wildcard or directory, but no .dockerignore file was found next to the Dockerfile or at the project root. This can copy local build folders and secrets.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "warning",
 	help: "Create a .dockerignore file in the same directory as the Dockerfile to prevent copying unnecessary files (like node_modules, logs, build artifacts).",
 	key: "docker-doctor/use-dockerignore",
-	message: "Ensure .dockerignore is used"
+	message: "Add a .dockerignore file"
 };
 const performanceRules = [
 	useMultiStage,
@@ -695,14 +779,6 @@ const performanceRules = [
 
 //#endregion
 //#region ../core/src/rules/security.ts
-const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
-	file,
-	help,
-	line,
-	message,
-	rule: ruleKey,
-	severity
-});
 const isRootUser = (value) => {
 	const [user] = value.split(":");
 	return user === "root" || user === "0";
@@ -710,22 +786,28 @@ const isRootUser = (value) => {
 const noRootUser = {
 	category: "Security",
 	check(instructions, file) {
+		const stageUser = /* @__PURE__ */ new Map();
+		let currentStage = null;
 		let lastUser = "root";
 		let lastUserLine = 1;
 		for (const inst of instructions) if (inst.instruction === "FROM") {
-			lastUser = "root";
+			const { base, stage } = parseFromArgs(inst.args);
+			lastUser = stageUser.get(base?.toLowerCase() ?? "") ?? "root";
 			lastUserLine = inst.line;
+			currentStage = stage?.toLowerCase() ?? null;
+			if (currentStage) stageUser.set(currentStage, lastUser);
 		} else if (inst.instruction === "USER") {
 			lastUser = inst.args.trim().toLowerCase();
 			lastUserLine = inst.line;
+			if (currentStage) stageUser.set(currentStage, lastUser);
 		}
 		if (isRootUser(lastUser)) return [createDiagnostic(file, this.key, this.defaultSeverity, "The container runs as root. Running as root allows potential container breakout vulnerabilities.", this.help, lastUserLine)];
 		return [];
 	},
 	defaultSeverity: "warning",
-	help: "Add a non-root user (e.g., 'USER node' or 'USER 1000') to improve security.",
+	help: "Add a non-root user (e.g., `USER node` or `USER 1000`) to improve security.",
 	key: "docker-doctor/no-root-user",
-	message: "Container should not run as root user"
+	message: "Run the container as a non-root user"
 };
 const noSecretsInEnv = {
 	category: "Security",
@@ -766,7 +848,7 @@ const noSecretsInEnv = {
 	defaultSeverity: "error",
 	help: "Use Docker Secrets, build arguments passed at runtime, or environment variables at runtime instead of baking them into the image.",
 	key: "docker-doctor/no-secrets-in-env",
-	message: "Do not store secrets in ENV or ARG instructions"
+	message: "Avoid storing secrets in ENV or ARG instructions"
 };
 const pinImageVersion = {
 	category: "Security",
@@ -774,8 +856,8 @@ const pinImageVersion = {
 		const diagnostics = [];
 		const stageAliases = collectStageAliases(instructions);
 		for (const inst of instructions) if (inst.instruction === "FROM") {
-			const imagePart = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
-			if (!imagePart || imagePart === "scratch") continue;
+			const imagePart = parseFromArgs(inst.args).base;
+			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
 			if (!(ref.tag || ref.digest)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' does not specify a tag. This makes builds non-deterministic.`, this.help, inst.line));
@@ -784,9 +866,9 @@ const pinImageVersion = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Specify a concrete tag instead of 'latest' or no tag (e.g., 'node:22.2.0-alpine' instead of 'node').",
+	help: "Specify a concrete tag instead of `latest` or no tag (e.g., `node:22.2.0-alpine` instead of `node`).",
 	key: "docker-doctor/pin-image-version",
-	message: "Always pin base image versions to specific tags"
+	message: "Pin base images to a specific tag or digest"
 };
 const noAddRemote = {
 	category: "Security",
@@ -800,7 +882,7 @@ const noAddRemote = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Use 'RUN curl' or 'RUN wget' instead of ADD for remote URLs, and delete the downloaded archive in the same layer to minimize size.",
+	help: "Use `RUN curl` or `RUN wget` instead of ADD for remote URLs, and delete the downloaded archive in the same layer to minimize size.",
 	key: "docker-doctor/no-add-remote",
 	message: "Avoid using ADD with remote URLs"
 };
@@ -843,12 +925,12 @@ const runDockerfileRules = (instructions, file, projectFiles, rulesConfig, categ
 
 //#endregion
 //#region ../core/src/runners/compose-runner.ts
-const runComposeRules = (composeContent, file, rulesConfig, categoriesConfig) => {
+const runComposeRules = (composeContent, file, rulesConfig, categoriesConfig, locate) => {
 	const diagnostics = [];
 	for (const rule of allComposeRules) {
 		const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);
 		if (severity === "off") continue;
-		const ruleDiagnostics = rule.check(composeContent, file);
+		const ruleDiagnostics = rule.check(composeContent, file, { locate });
 		if (severity !== rule.defaultSeverity) for (const diag of ruleDiagnostics) diag.severity = severity;
 		diagnostics.push(...ruleDiagnostics);
 	}
@@ -917,6 +999,30 @@ const validateConfig = (input) => {
 	return result;
 };
 
+//#endregion
+//#region ../core/src/config/unknown-keys.ts
+const KNOWN_CATEGORIES = [
+	"Best Practices",
+	"Compose",
+	"Image Size",
+	"Performance",
+	"Security"
+];
+const keysOf = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? Object.keys(value) : [];
+const collectUnknownConfigKeys = (raw) => {
+	if (typeof raw !== "object" || raw === null) return {
+		categories: [],
+		rules: []
+	};
+	const knownRuleKeys = new Set(allRules.map((rule) => rule.key));
+	const knownCategories = new Set(KNOWN_CATEGORIES);
+	const { categories, rules } = raw;
+	return {
+		categories: keysOf(categories).filter((key) => !knownCategories.has(key)),
+		rules: keysOf(rules).filter((key) => !knownRuleKeys.has(key))
+	};
+};
+
 //#endregion
 //#region ../core/src/config/loader.ts
 const fileExists = async (filePath) => {
@@ -946,7 +1052,12 @@ const importConfig = async (filePath) => {
 		throw new ConfigError({ message: `Failed to load config file ${filePath}: ${msg}` });
 	}
 };
-const loadConfig = async (rootDir, customPath) => {
+const warnUnknownKeys = (raw, onWarning) => {
+	const unknown = collectUnknownConfigKeys(raw);
+	for (const key of unknown.rules) onWarning(`Unknown rule "${key}" in config — it matches no rule and has no effect.`);
+	for (const key of unknown.categories) onWarning(`Unknown category "${key}" in config — categories are case-sensitive (e.g. "Best Practices", "Security").`);
+};
+const loadConfig = async (rootDir, customPath, onWarning) => {
 	let configObject = null;
 	if (customPath) {
 		const fullPath = node_path.default.resolve(rootDir, customPath);
@@ -979,7 +1090,9 @@ const loadConfig = async (rootDir, customPath) => {
 	}
 	if (!configObject) return {};
 	try {
-		return validateConfig(configObject);
+		const config = validateConfig(configObject);
+		if (onWarning) warnUnknownKeys(configObject, onWarning);
+		return config;
 	} catch (error) {
 		const msg = error instanceof Error ? error.message : String(error);
 		throw new ConfigError({ message: `Invalid configuration format: ${msg}` });
@@ -1066,6 +1179,12 @@ Object.defineProperty(exports, 'calculateScore', {
     return calculateScore;
   }
 });
+Object.defineProperty(exports, 'createComposeLocator', {
+  enumerable: true,
+  get: function () {
+    return createComposeLocator;
+  }
+});
 Object.defineProperty(exports, 'discoverProject', {
   enumerable: true,
   get: function () {
@@ -1120,4 +1239,4 @@ Object.defineProperty(exports, 'version', {
     return version;
   }
 });
-//# sourceMappingURL=src-909bBBPN.cjs.map
+//# sourceMappingURL=src-DwuAaQcq.cjs.map