@docker-doctor/cli 0.4.3 → 0.5.0

package/dist/{src-TK9DRoRo.mjs → src-CpGd43y0.mjs}

@@ -1,10 +1,62 @@
 #!/usr/bin/env node
 import fs from "node:fs/promises";
 import path from "node:path";
-import { parse } from "yaml";
+import { LineCounter, isAlias, isMap, isScalar, isSeq, parse, parseDocument } from "yaml";
 
 //#region package.json
-var version = "0.4.3";
+var version = "0.5.0";
+
+//#endregion
+//#region ../core/src/project-info/ignore.ts
+const GLOB_SPECIALS_RE = /[.+^${}()|[\]\\]/gu;
+/**
+* Compiles one glob pattern from `ignore.files` to a RegExp over
+* POSIX-style relative paths. Supported syntax is the subset the docs
+* promise: `**` crosses directory separators (`**` followed by `/` matches
+* zero or more whole segments), `*` and `?` stay within one segment.
+* Brace expansion and character classes are not supported.
+*/
+const globToRegExp = (pattern) => {
+	let source = "^";
+	let index = 0;
+	while (index < pattern.length) {
+		const char = pattern[index];
+		if (char === "*") {
+			if (pattern[index + 1] === "*") {
+				if (pattern[index + 2] === "/") {
+					source += "(?:[^/]*/)*";
+					index += 3;
+				} else {
+					source += ".*";
+					index += 2;
+				}
+			} else {
+				source += "[^/]*";
+				index += 1;
+			}
+		} else if (char === "?") {
+			source += "[^/]";
+			index += 1;
+		} else {
+			source += char.replace(GLOB_SPECIALS_RE, String.raw`\$&`);
+			index += 1;
+		}
+	}
+	return new RegExp(`${source}$`, "u");
+};
+/**
+* Builds a predicate over root-relative paths from `ignore.files`
+* patterns. Windows separators in the tested path are normalized to `/`
+* before matching, so patterns are always written POSIX-style.
+*/
+const createIgnoreMatcher = (patterns) => {
+	if (!patterns || patterns.length === 0) return () => false;
+	const regexps = patterns.map(globToRegExp);
+	return (relativePath) => {
+		const normalized = relativePath.replaceAll("\\", "/");
+		return regexps.some((regexp) => regexp.test(normalized));
+	};
+};
 
 //#endregion
 //#region ../core/src/project-info/discover.ts
@@ -19,16 +71,19 @@ const walk = async (dir, fileList = []) => {
 	}));
 	return fileList;
 };
-const discoverProject = async (rootDir) => {
+const discoverProject = async (rootDir, options) => {
 	const allFiles = await walk(rootDir);
 	const dockerfiles = [];
 	const composeFiles = [];
 	const dockerignores = [];
+	const isIgnored = createIgnoreMatcher(options?.ignoreFiles);
 	for (const file of allFiles) {
+		const relative = path.relative(rootDir, file);
+		if (isIgnored(relative)) continue;
 		const base = path.basename(file).toLowerCase();
-		if (base === ".dockerignore") dockerignores.push(path.relative(rootDir, file));
-		if (base === "dockerfile" || base.startsWith("dockerfile.") || base.endsWith(".dockerfile")) dockerfiles.push(path.relative(rootDir, file));
-		if (base === "docker-compose.yml" || base === "docker-compose.yaml" || base === "compose.yml" || base === "compose.yaml" || (base.startsWith("docker-compose.") || base.startsWith("compose.")) && (base.endsWith(".yml") || base.endsWith(".yaml"))) composeFiles.push(path.relative(rootDir, file));
+		if (base === ".dockerignore") dockerignores.push(relative);
+		if (base === "dockerfile" || base.startsWith("dockerfile.") || base.endsWith(".dockerfile")) dockerfiles.push(relative);
+		if (base === "docker-compose.yml" || base === "docker-compose.yaml" || base === "compose.yml" || base === "compose.yaml" || (base.startsWith("docker-compose.") || base.startsWith("compose.")) && (base.endsWith(".yml") || base.endsWith(".yaml"))) composeFiles.push(relative);
 	}
 	return {
 		composeFiles: composeFiles.toSorted(),
@@ -107,7 +162,6 @@ const processHeredocLine = (state, trimmed) => {
 };
 const processInstructionLine = (state, trimmed, lineNum) => {
 	let lineContent = trimmed;
-	if (lineContent.startsWith("#")) return;
 	const hasContinuation = lineContent.endsWith("\\");
 	if (hasContinuation) lineContent = lineContent.slice(0, -1).trim();
 	if (state.currentInstruction) state.currentArgs += (state.currentArgs ? " " : "") + lineContent;
@@ -130,7 +184,8 @@ const parseDockerfile = (content) => {
 		const trimmed = rawLine.trim();
 		const lineNum = i + 1;
 		const insideHeredoc = state.heredocQueue.length > 0;
-		if (!state.currentInstruction && !insideHeredoc && (trimmed === "" || trimmed.startsWith("#"))) continue;
+		if (!insideHeredoc && trimmed.startsWith("#")) continue;
+		if (!state.currentInstruction && !insideHeredoc && trimmed === "") continue;
 		state.rawAccumulator.push(rawLine);
 		if (insideHeredoc) processHeredocLine(state, trimmed);
 		else processInstructionLine(state, trimmed, lineNum);
@@ -173,6 +228,40 @@ const parseCompose = (content, filepath) => {
 		});
 	}
 };
+/**
+* Builds a {@link ComposeLocator} over the same source text a compose object
+* was parsed from, so rules can attach line numbers to their diagnostics.
+*
+* Keys pulled in via YAML merge keys (`<<: *anchor`) have no concrete node
+* at the merge site, so paths through them resolve to `undefined` — callers
+* fall back to an unnumbered diagnostic, which matches the old behavior.
+*/
+const createComposeLocator = (content) => {
+	const lineCounter = new LineCounter();
+	const doc = parseDocument(content, {
+		lineCounter,
+		merge: true
+	});
+	return (path) => {
+		let node = doc.contents;
+		let offset;
+		for (const segment of path) {
+			if (isAlias(node)) node = node.resolve(doc);
+			if (isMap(node)) {
+				const pair = node.items.find((item) => isScalar(item.key) && String(item.key.value) === String(segment));
+				if (!pair || !isScalar(pair.key)) return;
+				offset = pair.key.range?.[0];
+				node = pair.value;
+			} else if (isSeq(node) && typeof segment === "number") {
+				const item = node.items[segment];
+				if (item === void 0 || item === null) return;
+				offset = item.range?.[0];
+				node = item;
+			} else return;
+		}
+		return offset === void 0 ? void 0 : lineCounter.linePos(offset).line;
+	};
+};
 
 //#endregion
 //#region ../core/src/parsers/exec-form.ts
@@ -228,6 +317,33 @@ const parseImageRef = (ref) => {
 		tag
 	};
 };
+/**
+* Docker Hardened Images (free catalog since Dec 2025) are pulled from the
+* dhi.io registry. Enterprise mirrors live under a plain Docker Hub org
+* namespace and cannot be recognized from the ref alone, so they keep the
+* default rule behavior.
+*/
+const isHardenedImage = (imagePart) => imagePart.toLowerCase().startsWith("dhi.io/");
+/**
+* DHI runtime variants ship no shell or package manager and run as a
+* nonroot user by default. The `-dev` variants keep a shell for build
+* stages and are not assumed to be nonroot.
+*/
+const isHardenedRuntimeImage = (imagePart) => {
+	if (!isHardenedImage(imagePart)) return false;
+	const { tag } = parseImageRef(imagePart);
+	return !(tag === "dev" || tag?.endsWith("-dev"));
+};
+/**
+* Why a reference would resolve differently over time: no tag at all, or
+* the mutable `latest` tag without a digest. `undefined` means the ref is
+* pinned. Shared by every pinning rule (base images, service images,
+* models) so they agree on what counts as pinned.
+*/
+const mutableRefIssue = (ref) => {
+	if (!(ref.tag || ref.digest)) return "untagged";
+	if (ref.tag === "latest" && !ref.digest) return "latest";
+};
 const parseFromArgs = (args) => {
 	const parts = args.split(/\s+/u).filter(Boolean);
 	const asIndex = parts.findIndex((p) => p.toLowerCase() === "as");
@@ -248,8 +364,8 @@ const collectStageAliases = (instructions) => {
 };
 
 //#endregion
-//#region ../core/src/rules/best-practices.ts
-const createDiagnostic$4 = (file, ruleKey, severity, message, help, line) => ({
+//#region ../core/src/rules/create-diagnostic.ts
+const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
 	file,
 	help,
 	line,
@@ -257,12 +373,15 @@ const createDiagnostic$4 = (file, ruleKey, severity, message, help, line) => ({
 	rule: ruleKey,
 	severity
 });
+
+//#endregion
+//#region ../core/src/rules/best-practices.ts
 const requireHealthcheck = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const hasHealthcheck = instructions.some((inst) => inst.instruction === "HEALTHCHECK");
 		const hasExposedPortsOrEntry = instructions.some((inst) => inst.instruction === "EXPOSE" || inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT");
-		if (!hasHealthcheck && hasExposedPortsOrEntry) return [createDiagnostic$4(file, this.key, this.defaultSeverity, "No HEALTHCHECK instruction found. Containers running services should expose healthchecks to enable auto-healing.", this.help, 1)];
+		if (!hasHealthcheck && hasExposedPortsOrEntry) return [createDiagnostic(file, this.key, this.defaultSeverity, "No HEALTHCHECK instruction found. Containers running services should expose healthchecks to enable auto-healing.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "info",
@@ -279,7 +398,7 @@ const preferCopyOverAdd = {
 			if (!src) continue;
 			const isRemote = src.startsWith("http://") || src.startsWith("https://");
 			const isArchive = src.endsWith(".tar") || src.endsWith(".tar.gz") || src.endsWith(".tgz") || src.endsWith(".zip");
-			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
+			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -292,7 +411,7 @@ const useExecForm = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if ((inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT") && parseExecForm(inst.args) === null) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `${inst.instruction} instruction uses shell form instead of exec form. In shell form, the command runs under '/bin/sh -c', which does not pass signals to child processes.`, this.help, inst.line));
+		for (const inst of instructions) if ((inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT") && parseExecForm(inst.args) === null) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${inst.instruction} instruction uses shell form instead of exec form. In shell form, the command runs under '/bin/sh -c', which does not pass signals to child processes.`, this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
@@ -303,7 +422,7 @@ const useExecForm = {
 const requireLabels = {
 	category: "Best Practices",
 	check(instructions, file) {
-		if (!instructions.some((inst) => inst.instruction === "LABEL")) return [createDiagnostic$4(file, this.key, this.defaultSeverity, "No LABEL metadata was found in this Dockerfile. Adding labels helps identify build information, maintainers, and descriptions.", this.help, 1)];
+		if (!instructions.some((inst) => inst.instruction === "LABEL")) return [createDiagnostic(file, this.key, this.defaultSeverity, "No LABEL metadata was found in this Dockerfile. Adding labels helps identify build information, maintainers, and descriptions.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "info",
@@ -318,8 +437,8 @@ const combineAptUpdateInstall = {
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const hasUpdate = inst.args.includes("apt-get update");
 			const hasInstall = inst.args.includes("apt-get install");
-			if (hasUpdate && !hasInstall) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.", this.help, inst.line));
-			else if (hasInstall && !hasUpdate) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.", this.help, inst.line));
+			if (hasUpdate && !hasInstall) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.", this.help, inst.line));
+			else if (hasInstall && !hasUpdate) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.", this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -359,7 +478,7 @@ const usePipefail = {
 			const { args } = inst;
 			if (!HAS_PIPE_RE.test(args)) continue;
 			const execArgv = parseExecForm(args);
-			if (!(execArgv === null ? shellHasPipefail || PIPEFAIL_SETTING_RE.test(args) : PIPEFAIL_SETTING_RE.test(execArgv.join(" ")))) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
+			if (!(execArgv === null ? shellHasPipefail || PIPEFAIL_SETTING_RE.test(args) : PIPEFAIL_SETTING_RE.test(execArgv.join(" ")))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -374,7 +493,7 @@ const absoluteWorkdir = {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "WORKDIR") {
 			const path = inst.args.trim();
-			if (!/^(?:\/|\\|\$|[a-zA-Z]:)/u.test(path)) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `WORKDIR specifies a relative path '${path}'. For clarity and reliability, always use absolute paths.`, this.help, inst.line));
+			if (!/^(?:\/|\\|\$|[a-zA-Z]:)/u.test(path)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `WORKDIR specifies a relative path '${path}'. For clarity and reliability, always use absolute paths.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -387,7 +506,7 @@ const avoidRunCd = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\bcd\b/u.test(inst.args)) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && /\bcd\b/u.test(inst.args)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
@@ -407,7 +526,7 @@ const sortMultilineArgs = {
 				const packages = raw.split(/\r?\n/u).slice(1).map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("&&") && !line.startsWith("-") && !line.includes("rm -rf")).map((line) => line.endsWith("\\") ? line.slice(0, -1).trim() : line).filter(Boolean);
 				if (packages.length > 1) {
 					const sorted = packages.toSorted((a, b) => a.localeCompare(b));
-					if (!packages.every((val, idx) => val === sorted[idx])) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.", this.help, inst.line));
+					if (!packages.every((val, idx) => val === sorted[idx])) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.", this.help, inst.line));
 				}
 			}
 		}
@@ -422,7 +541,7 @@ const useraddNoLogInit = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\buseradd\b/u.test(inst.args) && !inst.args.includes("--no-log-init")) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && /\buseradd\b/u.test(inst.args) && !inst.args.includes("--no-log-init")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
@@ -443,19 +562,31 @@ const bestPracticesRules = [
 	useraddNoLogInit
 ];
 
+//#endregion
+//#region ../core/src/rules/compose-services.ts
+/**
+* Narrows an unknown compose document to its service entries. A service
+* with a null body (`web:` with nothing under it) is returned as an empty
+* config so rules still check it: it is the least-configured service in
+* the file, not a service to skip. Scalar and array bodies are invalid
+* compose and are dropped.
+*/
+const composeServices = (composeContent) => {
+	if (!composeContent || typeof composeContent !== "object" || !("services" in composeContent)) return [];
+	const { services } = composeContent;
+	if (!services || typeof services !== "object") return [];
+	const entries = [];
+	for (const [name, config] of Object.entries(services)) if (config === null || config === void 0) entries.push([name, {}]);
+	else if (typeof config === "object" && !Array.isArray(config)) entries.push([name, config]);
+	return entries;
+};
+
 //#endregion
 //#region ../core/src/rules/compose.ts
-const createDiagnostic$3 = (file, ruleKey, severity, message, help) => ({
-	file,
-	help,
-	message,
-	rule: ruleKey,
-	severity
-});
 const noVersionKey = {
 	category: "Compose",
-	check(composeContent, file) {
-		if (composeContent && typeof composeContent === "object" && "version" in composeContent) return [createDiagnostic$3(file, this.key, this.defaultSeverity, "The 'version' property is deprecated. Remove it to use standard Compose spec behavior.", this.help)];
+	check(composeContent, file, context) {
+		if (composeContent && typeof composeContent === "object" && "version" in composeContent) return [createDiagnostic(file, this.key, this.defaultSeverity, "The 'version' property is deprecated. Remove it to use standard Compose spec behavior.", this.help, context?.locate?.(["version"]))];
 		return [];
 	},
 	defaultSeverity: "warning",
@@ -465,16 +596,11 @@ const noVersionKey = {
 };
 const requireResourceLimits = {
 	category: "Compose",
-	check(composeContent, file) {
+	check(composeContent, file, context) {
 		const diagnostics = [];
-		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
-			const { services } = composeContent;
-			if (services && typeof services === "object") {
-				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
-					const limits = (config.deploy?.resources)?.limits;
-					if (!limits || !limits.cpus && !limits.memory) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help));
-				}
-			}
+		for (const [name, config] of composeServices(composeContent)) {
+			const limits = (config.deploy?.resources)?.limits;
+			if (!limits || !limits.cpus && !limits.memory) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help, context?.locate?.(["services", name])));
 		}
 		return diagnostics;
 	},
@@ -485,17 +611,12 @@ const requireResourceLimits = {
 };
 const requireRestartPolicy = {
 	category: "Compose",
-	check(composeContent, file) {
+	check(composeContent, file, context) {
 		const diagnostics = [];
-		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
-			const { services } = composeContent;
-			if (services && typeof services === "object") {
-				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
-					const hasRestart = "restart" in config;
-					const hasDeployRestart = config.deploy?.restart_policy !== void 0;
-					if (!hasRestart && !hasDeployRestart) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' has no restart policy configured. It will not restart if it crashes or if the host reboots.`, this.help));
-				}
-			}
+		for (const [name, config] of composeServices(composeContent)) {
+			const hasRestart = "restart" in config;
+			const hasDeployRestart = config.deploy?.restart_policy !== void 0;
+			if (!hasRestart && !hasDeployRestart) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' has no restart policy configured. It will not restart if it crashes or if the host reboots.`, this.help, context?.locate?.(["services", name])));
 		}
 		return diagnostics;
 	},
@@ -506,16 +627,15 @@ const requireRestartPolicy = {
 };
 const useDependsOnCondition = {
 	category: "Compose",
-	check(composeContent, file) {
+	check(composeContent, file, context) {
 		const diagnostics = [];
-		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
-			const { services } = composeContent;
-			if (services && typeof services === "object") {
-				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
-					const dependsOn = config.depends_on;
-					if (dependsOn && Array.isArray(dependsOn)) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' uses shorthand depends_on list. This only checks if containers are started, not if they are ready/healthy.`, this.help));
-				}
-			}
+		for (const [name, config] of composeServices(composeContent)) {
+			const dependsOn = config.depends_on;
+			if (dependsOn && Array.isArray(dependsOn)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' uses shorthand depends_on list. This only checks if containers are started, not if they are ready/healthy.`, this.help, context?.locate?.([
+				"services",
+				name,
+				"depends_on"
+			]) ?? context?.locate?.(["services", name])));
 		}
 		return diagnostics;
 	},
@@ -524,23 +644,211 @@ const useDependsOnCondition = {
 	key: "docker-doctor/use-depends-on-condition",
 	message: "Use long-form depends_on with healthcheck conditions"
 };
+const pinServiceImage = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) {
+			const { image } = config;
+			if (typeof image !== "string" || "build" in config) continue;
+			const ref = parseImageRef(image);
+			if (ref.isVariable) continue;
+			const issue = mutableRefIssue(ref);
+			if (!issue) continue;
+			const detail = issue === "untagged" ? `Service '${name}' image '${image}' does not specify a tag.` : `Service '${name}' image '${image}' uses the mutable 'latest' tag.`;
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${detail} Every pull may fetch a different image.`, this.help, context?.locate?.([
+				"services",
+				name,
+				"image"
+			])));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Pin the image to a specific tag or digest (e.g. `nginx:1.27-alpine`) so deploys are reproducible and a rollback actually rolls back.",
+	key: "docker-doctor/pin-service-image",
+	message: "Pin service images to a specific tag or digest"
+};
 const composeRules = [
 	noVersionKey,
 	requireResourceLimits,
 	requireRestartPolicy,
-	useDependsOnCondition
+	useDependsOnCondition,
+	pinServiceImage
+];
+
+//#endregion
+//#region ../core/src/rules/compose-models.ts
+/**
+* Narrows an unknown compose document to its top-level `models:` entries
+* (Docker Model Runner, Compose ≥ 2.35).
+*/
+const topLevelModels = (composeContent) => {
+	if (!composeContent || typeof composeContent !== "object" || !("models" in composeContent)) return {};
+	const { models } = composeContent;
+	if (!models || typeof models !== "object" || Array.isArray(models)) return {};
+	return models;
+};
+const undefinedModelReference = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		const defined = new Set(Object.keys(topLevelModels(composeContent)));
+		const flag = (serviceName, modelName, pathTail) => {
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${serviceName}' references model '${modelName}', which is not declared in the top-level models section. Compose cannot resolve it.`, this.help, context?.locate?.([
+				"services",
+				serviceName,
+				"models",
+				pathTail
+			])));
+		};
+		for (const [name, config] of composeServices(composeContent)) {
+			const { models } = config;
+			if (Array.isArray(models)) {
+				for (const [index, entry] of models.entries()) if (typeof entry === "string" && !defined.has(entry)) flag(name, entry, index);
+			} else if (models && typeof models === "object") {
+				for (const modelName of Object.keys(models)) if (!defined.has(modelName)) flag(name, modelName, modelName);
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "error",
+	help: "Every name under a service's `models:` must match an entry in the top-level `models:` element. Declare the model there (with its `model:` OCI artifact) or fix the reference.",
+	key: "docker-doctor/undefined-model-reference",
+	message: "Service model references must be declared in top-level models"
+};
+const pinModelVersion = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of Object.entries(topLevelModels(composeContent))) {
+			if (!config || typeof config !== "object") continue;
+			const { model } = config;
+			if (typeof model !== "string") continue;
+			const ref = parseImageRef(model);
+			if (ref.isVariable) continue;
+			const issue = mutableRefIssue(ref);
+			if (!issue) continue;
+			const detail = issue === "untagged" ? `Model '${name}' artifact '${model}' does not specify a tag.` : `Model '${name}' artifact '${model}' uses the mutable 'latest' tag.`;
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${detail} Every pull may fetch different weights.`, this.help, context?.locate?.([
+				"models",
+				name,
+				"model"
+			])));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Pin the model to a specific tag (e.g. `ai/gemma3:4B-Q4_0`) so every environment runs the same weights. Model behavior differences are far harder to debug than software version drift.",
+	key: "docker-doctor/pin-model-version",
+	message: "Pin models to a specific tag or digest"
+};
+const composeModelRules = [undefinedModelReference, pinModelVersion];
+
+//#endregion
+//#region ../core/src/rules/secret-keywords.ts
+const SECRET_KEY_PATTERNS = [
+	/(?:^|[_-])password(?:[_-]|$)/iu,
+	/(?:^|[_-])secret(?:[_-]|$)/iu,
+	/(?:^|[_-])token(?:[_-]|$)/iu,
+	/(?:^|[_-])api_key(?:[_-]|$)/iu,
+	/(?:^|[_-])private_key(?:[_-]|$)/iu,
+	/(?:^|[_-])auth(?:[_-]|$)/iu
+];
+const isSecretKey = (key) => SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
+
+//#endregion
+//#region ../core/src/rules/compose-security.ts
+const DOCKER_SOCKET = "/var/run/docker.sock";
+const noPrivilegedService = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) if (config.privileged === true) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' runs in privileged mode. A privileged container has full access to the host's devices and kernel, so compromising this service compromises the host.`, this.help, context?.locate?.([
+			"services",
+			name,
+			"privileged"
+		])));
+		return diagnostics;
+	},
+	defaultSeverity: "error",
+	help: "Remove `privileged: true` and grant only what the service needs: specific capabilities via `cap_add`, or individual device access via `devices`.",
+	key: "docker-doctor/no-privileged-service",
+	message: "Do not run services in privileged mode"
+};
+const mountsDockerSocket = (volume) => {
+	if (typeof volume === "string") return volume.split(":")[0] === DOCKER_SOCKET;
+	if (volume && typeof volume === "object") return volume.source === DOCKER_SOCKET;
+	return false;
+};
+const noDockerSocketMount = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) {
+			const { volumes } = config;
+			if (!Array.isArray(volumes)) continue;
+			for (const [index, volume] of volumes.entries()) if (mountsDockerSocket(volume)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts the Docker socket. Anything running in this container can control the Docker daemon: start privileged containers, read every volume, and escape to the host.`, this.help, context?.locate?.([
+				"services",
+				name,
+				"volumes",
+				index
+			])));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "error",
+	help: "If the service genuinely needs the Docker API (agent tooling like MCP gateways often does), prefer `use_api_socket: true` or a filtering socket proxy over a raw bind mount of `/var/run/docker.sock`.",
+	key: "docker-doctor/no-docker-socket-mount",
+	message: "Do not bind-mount the Docker socket into services"
+};
+const isLiteralSecretValue = (value) => typeof value === "string" && value.length > 0 && !value.startsWith("$");
+const noPlaintextSecrets = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		const flag = (name, key, line) => {
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret in service '${name}' environment: '${key}'. A literal value here lives in version control in plain text.`, this.help, line));
+		};
+		for (const [name, config] of composeServices(composeContent)) {
+			const { environment } = config;
+			if (Array.isArray(environment)) for (const [index, entry] of environment.entries()) {
+				if (typeof entry !== "string") continue;
+				const eqIndex = entry.indexOf("=");
+				if (eqIndex <= 0) continue;
+				const key = entry.slice(0, eqIndex);
+				const value = entry.slice(eqIndex + 1);
+				if (isSecretKey(key) && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+					"services",
+					name,
+					"environment",
+					index
+				]));
+			}
+			else if (environment && typeof environment === "object") {
+				for (const [key, value] of Object.entries(environment)) if (isSecretKey(key) && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+					"services",
+					name,
+					"environment",
+					key
+				]));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Move the value to an `env_file` kept out of version control, interpolate it from the host environment (`${VAR}`), or use Compose `secrets:`.",
+	key: "docker-doctor/no-plaintext-secrets",
+	message: "Avoid literal secret values in Compose environment"
+};
+const composeSecurityRules = [
+	noPrivilegedService,
+	noDockerSocketMount,
+	noPlaintextSecrets
 ];
 
 //#endregion
 //#region ../core/src/rules/image-size.ts
-const createDiagnostic$2 = (file, ruleKey, severity, message, help, line) => ({
-	file,
-	help,
-	line,
-	message,
-	rule: ruleKey,
-	severity
-});
 const preferSlimBase = {
 	category: "Image Size",
 	check(instructions, file) {
@@ -551,10 +859,11 @@ const preferSlimBase = {
 			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
+			if (isHardenedImage(imagePart)) continue;
 			if (ref.digest) continue;
 			if (!ref.tag) continue;
 			const haystack = `${ref.name} ${ref.tag}`.toLowerCase();
-			if (!(haystack.includes("alpine") || haystack.includes("slim") || haystack.includes("distroless") || haystack.includes("busybox"))) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
+			if (!(haystack.includes("alpine") || haystack.includes("slim") || haystack.includes("distroless") || haystack.includes("busybox"))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -563,14 +872,20 @@ const preferSlimBase = {
 	key: "docker-doctor/prefer-slim-base",
 	message: "Prefer slim, alpine, or distroless base images"
 };
+const BUILDKIT_MOUNT_FLAG_RE = /--mount=(?<spec>\S+)/gu;
+const CACHE_TARGET_KEY_RE = /^(?:target|dst|destination)=/u;
+const cacheMountTargets = (args) => [...args.matchAll(BUILDKIT_MOUNT_FLAG_RE)].map((match) => (match.groups?.spec ?? "").split(",")).filter((options) => options.includes("type=cache")).flatMap((options) => options.filter((option) => CACHE_TARGET_KEY_RE.test(option)).map((option) => option.slice(option.indexOf("=") + 1)));
+const APT_CACHE_DIRS = ["/var/lib/apt", "/var/cache/apt"];
+const APK_CACHE_DIRS = ["/var/cache/apk", "/etc/apk/cache"];
+const hasCacheMountFor = (args, cacheDirs) => cacheMountTargets(args).some((target) => cacheDirs.some((dir) => target === dir || target.startsWith(`${dir}/`)));
 const cleanPackageCache = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const { args } = inst;
-			if (args.includes("apt-get install") && !args.includes("rm -rf /var/lib/apt/lists")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
-			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
+			if (args.includes("apt-get install") && !args.includes("rm -rf /var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
+			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk") && !hasCacheMountFor(args, APK_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -607,7 +922,7 @@ const avoidDevDependencies = {
 			for (const inst of stage.runs) {
 				if (!installsDevDependencies(inst.args)) continue;
 				const where = stageIndex === finalIndex ? "in the final stage" : `in stage '${stage.name}', whose layers the final stage inherits,`;
-				diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
 			}
 		}
 		return diagnostics;
@@ -625,19 +940,11 @@ const imageSizeRules = [
 
 //#endregion
 //#region ../core/src/rules/performance.ts
-const createDiagnostic$1 = (file, ruleKey, severity, message, help, line) => ({
-	file,
-	help,
-	line,
-	message,
-	rule: ruleKey,
-	severity
-});
 const useMultiStage = {
 	category: "Performance",
 	check(instructions, file) {
 		if (instructions.filter((inst) => inst.instruction === "FROM").length === 1) {
-			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || inst.args.includes("make")))) return [createDiagnostic$1(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
+			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || inst.args.includes("make")))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
 		}
 		return [];
 	},
@@ -661,7 +968,7 @@ const orderLayers = {
 			}
 			if (inst.instruction === "RUN" && copyAllLine !== -1) {
 				const args = inst.args.toLowerCase();
-				if (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install") || args.includes("bun install") || args.includes("pip install") || args.includes("cargo fetch")) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Running package installation command '${inst.args}' after copying application files (at line ${copyAllLine}). This invalidates the cache on any code changes.`, this.help, inst.line));
+				if (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install") || args.includes("bun install") || args.includes("pip install") || args.includes("cargo fetch")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package installation command '${inst.args}' after copying application files (at line ${copyAllLine}). This invalidates the cache on any code changes.`, this.help, inst.line));
 			}
 		}
 		return diagnostics;
@@ -681,10 +988,10 @@ const minimizeLayers = {
 			if (consecutiveRunCount === 0) firstRunLine = inst.line;
 			consecutiveRunCount += 1;
 		} else {
-			if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
+			if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
 			consecutiveRunCount = 0;
 		}
-		if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
+		if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
@@ -709,7 +1016,7 @@ const useDockerignore = {
 				return src === "." || src === "./" || src === "*";
 			}
 			return false;
-		}) && context?.projectFiles && !hasDockerignoreFor(file, context.projectFiles)) return [createDiagnostic$1(file, this.key, this.defaultSeverity, "Using COPY/ADD with a wildcard or directory, but no .dockerignore file was found next to the Dockerfile or at the project root. This can copy local build folders and secrets.", this.help, 1)];
+		}) && context?.projectFiles && !hasDockerignoreFor(file, context.projectFiles)) return [createDiagnostic(file, this.key, this.defaultSeverity, "Using COPY/ADD with a wildcard or directory, but no .dockerignore file was found next to the Dockerfile or at the project root. This can copy local build folders and secrets.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "warning",
@@ -726,14 +1033,6 @@ const performanceRules = [
 
 //#endregion
 //#region ../core/src/rules/security.ts
-const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
-	file,
-	help,
-	line,
-	message,
-	rule: ruleKey,
-	severity
-});
 const isRootUser = (value) => {
 	const [user] = value.split(":");
 	return user === "root" || user === "0";
@@ -747,7 +1046,8 @@ const noRootUser = {
 		let lastUserLine = 1;
 		for (const inst of instructions) if (inst.instruction === "FROM") {
 			const { base, stage } = parseFromArgs(inst.args);
-			lastUser = stageUser.get(base?.toLowerCase() ?? "") ?? "root";
+			const baseDefaultUser = base && isHardenedRuntimeImage(base) ? "nonroot" : "root";
+			lastUser = stageUser.get(base?.toLowerCase() ?? "") ?? baseDefaultUser;
 			lastUserLine = inst.line;
 			currentStage = stage?.toLowerCase() ?? null;
 			if (currentStage) stageUser.set(currentStage, lastUser);
@@ -768,21 +1068,13 @@ const noSecretsInEnv = {
 	category: "Security",
 	check(instructions, file) {
 		const diagnostics = [];
-		const secretKeywords = [
-			/(?:^|[_-])password(?:[_-]|$)/iu,
-			/(?:^|[_-])secret(?:[_-]|$)/iu,
-			/(?:^|[_-])token(?:[_-]|$)/iu,
-			/(?:^|[_-])api_key(?:[_-]|$)/iu,
-			/(?:^|[_-])private_key(?:[_-]|$)/iu,
-			/(?:^|[_-])auth(?:[_-]|$)/iu
-		];
 		for (const inst of instructions) if (inst.instruction === "ENV" || inst.instruction === "ARG") {
 			const args = inst.args.trim();
 			if (inst.instruction === "ENV" && !args.includes("=")) {
 				const match = args.match(/^(?<key>[^\s]+)\s+(?<value>.*)$/u);
 				if (match?.groups) {
 					const { key, value } = match.groups;
-					if (secretKeywords.some((regex) => regex.test(key)) && value && !value.startsWith("$") && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
+					if (isSecretKey(key) && value && !value.startsWith("$") && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
 				}
 			} else {
 				const parts = args.split(/\s+/u);
@@ -794,7 +1086,7 @@ const noSecretsInEnv = {
 						key = part.slice(0, eqIndex);
 						value = part.slice(eqIndex + 1);
 					} else key = part;
-					if (secretKeywords.some((regex) => regex.test(key)) && value && !value.startsWith("$") && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
+					if (isSecretKey(key) && value && !value.startsWith("$") && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
 				}
 			}
 		}
@@ -815,8 +1107,11 @@ const pinImageVersion = {
 			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
-			if (!(ref.tag || ref.digest)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' does not specify a tag. This makes builds non-deterministic.`, this.help, inst.line));
-			else if (ref.tag === "latest" && !ref.digest) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' uses the mutable 'latest' tag. This makes builds non-deterministic.`, this.help, inst.line));
+			const issue = mutableRefIssue(ref);
+			if (issue) {
+				const detail = issue === "untagged" ? `Base image '${imagePart}' does not specify a tag.` : `Base image '${imagePart}' uses the mutable 'latest' tag.`;
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${detail} This makes builds non-deterministic.`, this.help, inst.line));
+			}
 		}
 		return diagnostics;
 	},
@@ -856,7 +1151,11 @@ const allDockerfileRules = [
 	...bestPracticesRules,
 	...imageSizeRules
 ];
-const allComposeRules = [...composeRules];
+const allComposeRules = [
+	...composeRules,
+	...composeSecurityRules,
+	...composeModelRules
+];
 const allRules = [...allDockerfileRules, ...allComposeRules];
 const findRule = (key) => allRules.find((rule) => rule.key === key);
 
@@ -880,12 +1179,12 @@ const runDockerfileRules = (instructions, file, projectFiles, rulesConfig, categ
 
 //#endregion
 //#region ../core/src/runners/compose-runner.ts
-const runComposeRules = (composeContent, file, rulesConfig, categoriesConfig) => {
+const runComposeRules = (composeContent, file, rulesConfig, categoriesConfig, locate) => {
 	const diagnostics = [];
 	for (const rule of allComposeRules) {
 		const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);
 		if (severity === "off") continue;
-		const ruleDiagnostics = rule.check(composeContent, file);
+		const ruleDiagnostics = rule.check(composeContent, file, { locate });
 		if (severity !== rule.defaultSeverity) for (const diag of ruleDiagnostics) diag.severity = severity;
 		diagnostics.push(...ruleDiagnostics);
 	}
@@ -1116,5 +1415,5 @@ const toJsonReport = (diagnostics, score, label, project) => ({
 });
 
 //#endregion
-export { runDockerfileRules as a, parseCompose as c, version as d, runComposeRules as i, parseDockerfile as l, calculateScore as n, allRules as o, loadConfig as r, findRule as s, toJsonReport as t, discoverProject as u };
-//# sourceMappingURL=src-TK9DRoRo.mjs.map
+export { runDockerfileRules as a, createComposeLocator as c, discoverProject as d, version as f, runComposeRules as i, parseCompose as l, calculateScore as n, allRules as o, loadConfig as r, findRule as s, toJsonReport as t, parseDockerfile as u };
+//# sourceMappingURL=src-CpGd43y0.mjs.map