@docker-doctor/cli 0.4.3 → 0.5.0

package/dist/{src-ILbJuJmE.cjs → src-F90_EKmA.cjs}

@@ -33,7 +33,59 @@ node_path = __toESM(node_path, 1);
 let yaml = require("yaml");
 
 //#region package.json
-var version = "0.4.3";
+var version = "0.5.0";
+
+//#endregion
+//#region ../core/src/project-info/ignore.ts
+const GLOB_SPECIALS_RE = /[.+^${}()|[\]\\]/gu;
+/**
+* Compiles one glob pattern from `ignore.files` to a RegExp over
+* POSIX-style relative paths. Supported syntax is the subset the docs
+* promise: `**` crosses directory separators (`**` followed by `/` matches
+* zero or more whole segments), `*` and `?` stay within one segment.
+* Brace expansion and character classes are not supported.
+*/
+const globToRegExp = (pattern) => {
+	let source = "^";
+	let index = 0;
+	while (index < pattern.length) {
+		const char = pattern[index];
+		if (char === "*") {
+			if (pattern[index + 1] === "*") {
+				if (pattern[index + 2] === "/") {
+					source += "(?:[^/]*/)*";
+					index += 3;
+				} else {
+					source += ".*";
+					index += 2;
+				}
+			} else {
+				source += "[^/]*";
+				index += 1;
+			}
+		} else if (char === "?") {
+			source += "[^/]";
+			index += 1;
+		} else {
+			source += char.replace(GLOB_SPECIALS_RE, String.raw`\$&`);
+			index += 1;
+		}
+	}
+	return new RegExp(`${source}$`, "u");
+};
+/**
+* Builds a predicate over root-relative paths from `ignore.files`
+* patterns. Windows separators in the tested path are normalized to `/`
+* before matching, so patterns are always written POSIX-style.
+*/
+const createIgnoreMatcher = (patterns) => {
+	if (!patterns || patterns.length === 0) return () => false;
+	const regexps = patterns.map(globToRegExp);
+	return (relativePath) => {
+		const normalized = relativePath.replaceAll("\\", "/");
+		return regexps.some((regexp) => regexp.test(normalized));
+	};
+};
 
 //#endregion
 //#region ../core/src/project-info/discover.ts
@@ -48,16 +100,19 @@ const walk = async (dir, fileList = []) => {
 	}));
 	return fileList;
 };
-const discoverProject = async (rootDir) => {
+const discoverProject = async (rootDir, options) => {
 	const allFiles = await walk(rootDir);
 	const dockerfiles = [];
 	const composeFiles = [];
 	const dockerignores = [];
+	const isIgnored = createIgnoreMatcher(options?.ignoreFiles);
 	for (const file of allFiles) {
+		const relative = node_path.default.relative(rootDir, file);
+		if (isIgnored(relative)) continue;
 		const base = node_path.default.basename(file).toLowerCase();
-		if (base === ".dockerignore") dockerignores.push(node_path.default.relative(rootDir, file));
-		if (base === "dockerfile" || base.startsWith("dockerfile.") || base.endsWith(".dockerfile")) dockerfiles.push(node_path.default.relative(rootDir, file));
-		if (base === "docker-compose.yml" || base === "docker-compose.yaml" || base === "compose.yml" || base === "compose.yaml" || (base.startsWith("docker-compose.") || base.startsWith("compose.")) && (base.endsWith(".yml") || base.endsWith(".yaml"))) composeFiles.push(node_path.default.relative(rootDir, file));
+		if (base === ".dockerignore") dockerignores.push(relative);
+		if (base === "dockerfile" || base.startsWith("dockerfile.") || base.endsWith(".dockerfile")) dockerfiles.push(relative);
+		if (base === "docker-compose.yml" || base === "docker-compose.yaml" || base === "compose.yml" || base === "compose.yaml" || (base.startsWith("docker-compose.") || base.startsWith("compose.")) && (base.endsWith(".yml") || base.endsWith(".yaml"))) composeFiles.push(relative);
 	}
 	return {
 		composeFiles: composeFiles.toSorted(),
@@ -136,7 +191,6 @@ const processHeredocLine = (state, trimmed) => {
 };
 const processInstructionLine = (state, trimmed, lineNum) => {
 	let lineContent = trimmed;
-	if (lineContent.startsWith("#")) return;
 	const hasContinuation = lineContent.endsWith("\\");
 	if (hasContinuation) lineContent = lineContent.slice(0, -1).trim();
 	if (state.currentInstruction) state.currentArgs += (state.currentArgs ? " " : "") + lineContent;
@@ -159,7 +213,8 @@ const parseDockerfile = (content) => {
 		const trimmed = rawLine.trim();
 		const lineNum = i + 1;
 		const insideHeredoc = state.heredocQueue.length > 0;
-		if (!state.currentInstruction && !insideHeredoc && (trimmed === "" || trimmed.startsWith("#"))) continue;
+		if (!insideHeredoc && trimmed.startsWith("#")) continue;
+		if (!state.currentInstruction && !insideHeredoc && trimmed === "") continue;
 		state.rawAccumulator.push(rawLine);
 		if (insideHeredoc) processHeredocLine(state, trimmed);
 		else processInstructionLine(state, trimmed, lineNum);
@@ -202,6 +257,40 @@ const parseCompose = (content, filepath) => {
 		});
 	}
 };
+/**
+* Builds a {@link ComposeLocator} over the same source text a compose object
+* was parsed from, so rules can attach line numbers to their diagnostics.
+*
+* Keys pulled in via YAML merge keys (`<<: *anchor`) have no concrete node
+* at the merge site, so paths through them resolve to `undefined` — callers
+* fall back to an unnumbered diagnostic, which matches the old behavior.
+*/
+const createComposeLocator = (content) => {
+	const lineCounter = new yaml.LineCounter();
+	const doc = (0, yaml.parseDocument)(content, {
+		lineCounter,
+		merge: true
+	});
+	return (path) => {
+		let node = doc.contents;
+		let offset;
+		for (const segment of path) {
+			if ((0, yaml.isAlias)(node)) node = node.resolve(doc);
+			if ((0, yaml.isMap)(node)) {
+				const pair = node.items.find((item) => (0, yaml.isScalar)(item.key) && String(item.key.value) === String(segment));
+				if (!pair || !(0, yaml.isScalar)(pair.key)) return;
+				offset = pair.key.range?.[0];
+				node = pair.value;
+			} else if ((0, yaml.isSeq)(node) && typeof segment === "number") {
+				const item = node.items[segment];
+				if (item === void 0 || item === null) return;
+				offset = item.range?.[0];
+				node = item;
+			} else return;
+		}
+		return offset === void 0 ? void 0 : lineCounter.linePos(offset).line;
+	};
+};
 
 //#endregion
 //#region ../core/src/parsers/exec-form.ts
@@ -257,6 +346,33 @@ const parseImageRef = (ref) => {
 		tag
 	};
 };
+/**
+* Docker Hardened Images (free catalog since Dec 2025) are pulled from the
+* dhi.io registry. Enterprise mirrors live under a plain Docker Hub org
+* namespace and cannot be recognized from the ref alone, so they keep the
+* default rule behavior.
+*/
+const isHardenedImage = (imagePart) => imagePart.toLowerCase().startsWith("dhi.io/");
+/**
+* DHI runtime variants ship no shell or package manager and run as a
+* nonroot user by default. The `-dev` variants keep a shell for build
+* stages and are not assumed to be nonroot.
+*/
+const isHardenedRuntimeImage = (imagePart) => {
+	if (!isHardenedImage(imagePart)) return false;
+	const { tag } = parseImageRef(imagePart);
+	return !(tag === "dev" || tag?.endsWith("-dev"));
+};
+/**
+* Why a reference would resolve differently over time: no tag at all, or
+* the mutable `latest` tag without a digest. `undefined` means the ref is
+* pinned. Shared by every pinning rule (base images, service images,
+* models) so they agree on what counts as pinned.
+*/
+const mutableRefIssue = (ref) => {
+	if (!(ref.tag || ref.digest)) return "untagged";
+	if (ref.tag === "latest" && !ref.digest) return "latest";
+};
 const parseFromArgs = (args) => {
 	const parts = args.split(/\s+/u).filter(Boolean);
 	const asIndex = parts.findIndex((p) => p.toLowerCase() === "as");
@@ -277,8 +393,8 @@ const collectStageAliases = (instructions) => {
 };
 
 //#endregion
-//#region ../core/src/rules/best-practices.ts
-const createDiagnostic$4 = (file, ruleKey, severity, message, help, line) => ({
+//#region ../core/src/rules/create-diagnostic.ts
+const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
 	file,
 	help,
 	line,
@@ -286,12 +402,15 @@ const createDiagnostic$4 = (file, ruleKey, severity, message, help, line) => ({
 	rule: ruleKey,
 	severity
 });
+
+//#endregion
+//#region ../core/src/rules/best-practices.ts
 const requireHealthcheck = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const hasHealthcheck = instructions.some((inst) => inst.instruction === "HEALTHCHECK");
 		const hasExposedPortsOrEntry = instructions.some((inst) => inst.instruction === "EXPOSE" || inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT");
-		if (!hasHealthcheck && hasExposedPortsOrEntry) return [createDiagnostic$4(file, this.key, this.defaultSeverity, "No HEALTHCHECK instruction found. Containers running services should expose healthchecks to enable auto-healing.", this.help, 1)];
+		if (!hasHealthcheck && hasExposedPortsOrEntry) return [createDiagnostic(file, this.key, this.defaultSeverity, "No HEALTHCHECK instruction found. Containers running services should expose healthchecks to enable auto-healing.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "info",
@@ -308,7 +427,7 @@ const preferCopyOverAdd = {
 			if (!src) continue;
 			const isRemote = src.startsWith("http://") || src.startsWith("https://");
 			const isArchive = src.endsWith(".tar") || src.endsWith(".tar.gz") || src.endsWith(".tgz") || src.endsWith(".zip");
-			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
+			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -321,7 +440,7 @@ const useExecForm = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if ((inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT") && parseExecForm(inst.args) === null) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `${inst.instruction} instruction uses shell form instead of exec form. In shell form, the command runs under '/bin/sh -c', which does not pass signals to child processes.`, this.help, inst.line));
+		for (const inst of instructions) if ((inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT") && parseExecForm(inst.args) === null) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${inst.instruction} instruction uses shell form instead of exec form. In shell form, the command runs under '/bin/sh -c', which does not pass signals to child processes.`, this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
@@ -332,7 +451,7 @@ const useExecForm = {
 const requireLabels = {
 	category: "Best Practices",
 	check(instructions, file) {
-		if (!instructions.some((inst) => inst.instruction === "LABEL")) return [createDiagnostic$4(file, this.key, this.defaultSeverity, "No LABEL metadata was found in this Dockerfile. Adding labels helps identify build information, maintainers, and descriptions.", this.help, 1)];
+		if (!instructions.some((inst) => inst.instruction === "LABEL")) return [createDiagnostic(file, this.key, this.defaultSeverity, "No LABEL metadata was found in this Dockerfile. Adding labels helps identify build information, maintainers, and descriptions.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "info",
@@ -347,8 +466,8 @@ const combineAptUpdateInstall = {
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const hasUpdate = inst.args.includes("apt-get update");
 			const hasInstall = inst.args.includes("apt-get install");
-			if (hasUpdate && !hasInstall) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.", this.help, inst.line));
-			else if (hasInstall && !hasUpdate) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.", this.help, inst.line));
+			if (hasUpdate && !hasInstall) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.", this.help, inst.line));
+			else if (hasInstall && !hasUpdate) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.", this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -388,7 +507,7 @@ const usePipefail = {
 			const { args } = inst;
 			if (!HAS_PIPE_RE.test(args)) continue;
 			const execArgv = parseExecForm(args);
-			if (!(execArgv === null ? shellHasPipefail || PIPEFAIL_SETTING_RE.test(args) : PIPEFAIL_SETTING_RE.test(execArgv.join(" ")))) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
+			if (!(execArgv === null ? shellHasPipefail || PIPEFAIL_SETTING_RE.test(args) : PIPEFAIL_SETTING_RE.test(execArgv.join(" ")))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -403,7 +522,7 @@ const absoluteWorkdir = {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "WORKDIR") {
 			const path = inst.args.trim();
-			if (!/^(?:\/|\\|\$|[a-zA-Z]:)/u.test(path)) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `WORKDIR specifies a relative path '${path}'. For clarity and reliability, always use absolute paths.`, this.help, inst.line));
+			if (!/^(?:\/|\\|\$|[a-zA-Z]:)/u.test(path)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `WORKDIR specifies a relative path '${path}'. For clarity and reliability, always use absolute paths.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -416,7 +535,7 @@ const avoidRunCd = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\bcd\b/u.test(inst.args)) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && /\bcd\b/u.test(inst.args)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
@@ -436,7 +555,7 @@ const sortMultilineArgs = {
 				const packages = raw.split(/\r?\n/u).slice(1).map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("&&") && !line.startsWith("-") && !line.includes("rm -rf")).map((line) => line.endsWith("\\") ? line.slice(0, -1).trim() : line).filter(Boolean);
 				if (packages.length > 1) {
 					const sorted = packages.toSorted((a, b) => a.localeCompare(b));
-					if (!packages.every((val, idx) => val === sorted[idx])) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.", this.help, inst.line));
+					if (!packages.every((val, idx) => val === sorted[idx])) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.", this.help, inst.line));
 				}
 			}
 		}
@@ -451,7 +570,7 @@ const useraddNoLogInit = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\buseradd\b/u.test(inst.args) && !inst.args.includes("--no-log-init")) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && /\buseradd\b/u.test(inst.args) && !inst.args.includes("--no-log-init")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
@@ -472,19 +591,31 @@ const bestPracticesRules = [
 	useraddNoLogInit
 ];
 
+//#endregion
+//#region ../core/src/rules/compose-services.ts
+/**
+* Narrows an unknown compose document to its service entries. A service
+* with a null body (`web:` with nothing under it) is returned as an empty
+* config so rules still check it: it is the least-configured service in
+* the file, not a service to skip. Scalar and array bodies are invalid
+* compose and are dropped.
+*/
+const composeServices = (composeContent) => {
+	if (!composeContent || typeof composeContent !== "object" || !("services" in composeContent)) return [];
+	const { services } = composeContent;
+	if (!services || typeof services !== "object") return [];
+	const entries = [];
+	for (const [name, config] of Object.entries(services)) if (config === null || config === void 0) entries.push([name, {}]);
+	else if (typeof config === "object" && !Array.isArray(config)) entries.push([name, config]);
+	return entries;
+};
+
 //#endregion
 //#region ../core/src/rules/compose.ts
-const createDiagnostic$3 = (file, ruleKey, severity, message, help) => ({
-	file,
-	help,
-	message,
-	rule: ruleKey,
-	severity
-});
 const noVersionKey = {
 	category: "Compose",
-	check(composeContent, file) {
-		if (composeContent && typeof composeContent === "object" && "version" in composeContent) return [createDiagnostic$3(file, this.key, this.defaultSeverity, "The 'version' property is deprecated. Remove it to use standard Compose spec behavior.", this.help)];
+	check(composeContent, file, context) {
+		if (composeContent && typeof composeContent === "object" && "version" in composeContent) return [createDiagnostic(file, this.key, this.defaultSeverity, "The 'version' property is deprecated. Remove it to use standard Compose spec behavior.", this.help, context?.locate?.(["version"]))];
 		return [];
 	},
 	defaultSeverity: "warning",
@@ -494,16 +625,11 @@ const noVersionKey = {
 };
 const requireResourceLimits = {
 	category: "Compose",
-	check(composeContent, file) {
+	check(composeContent, file, context) {
 		const diagnostics = [];
-		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
-			const { services } = composeContent;
-			if (services && typeof services === "object") {
-				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
-					const limits = (config.deploy?.resources)?.limits;
-					if (!limits || !limits.cpus && !limits.memory) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help));
-				}
-			}
+		for (const [name, config] of composeServices(composeContent)) {
+			const limits = (config.deploy?.resources)?.limits;
+			if (!limits || !limits.cpus && !limits.memory) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help, context?.locate?.(["services", name])));
 		}
 		return diagnostics;
 	},
@@ -514,17 +640,12 @@ const requireResourceLimits = {
 };
 const requireRestartPolicy = {
 	category: "Compose",
-	check(composeContent, file) {
+	check(composeContent, file, context) {
 		const diagnostics = [];
-		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
-			const { services } = composeContent;
-			if (services && typeof services === "object") {
-				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
-					const hasRestart = "restart" in config;
-					const hasDeployRestart = config.deploy?.restart_policy !== void 0;
-					if (!hasRestart && !hasDeployRestart) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' has no restart policy configured. It will not restart if it crashes or if the host reboots.`, this.help));
-				}
-			}
+		for (const [name, config] of composeServices(composeContent)) {
+			const hasRestart = "restart" in config;
+			const hasDeployRestart = config.deploy?.restart_policy !== void 0;
+			if (!hasRestart && !hasDeployRestart) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' has no restart policy configured. It will not restart if it crashes or if the host reboots.`, this.help, context?.locate?.(["services", name])));
 		}
 		return diagnostics;
 	},
@@ -535,16 +656,15 @@ const requireRestartPolicy = {
 };
 const useDependsOnCondition = {
 	category: "Compose",
-	check(composeContent, file) {
+	check(composeContent, file, context) {
 		const diagnostics = [];
-		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
-			const { services } = composeContent;
-			if (services && typeof services === "object") {
-				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
-					const dependsOn = config.depends_on;
-					if (dependsOn && Array.isArray(dependsOn)) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' uses shorthand depends_on list. This only checks if containers are started, not if they are ready/healthy.`, this.help));
-				}
-			}
+		for (const [name, config] of composeServices(composeContent)) {
+			const dependsOn = config.depends_on;
+			if (dependsOn && Array.isArray(dependsOn)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' uses shorthand depends_on list. This only checks if containers are started, not if they are ready/healthy.`, this.help, context?.locate?.([
+				"services",
+				name,
+				"depends_on"
+			]) ?? context?.locate?.(["services", name])));
 		}
 		return diagnostics;
 	},
@@ -553,23 +673,211 @@ const useDependsOnCondition = {
 	key: "docker-doctor/use-depends-on-condition",
 	message: "Use long-form depends_on with healthcheck conditions"
 };
+const pinServiceImage = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) {
+			const { image } = config;
+			if (typeof image !== "string" || "build" in config) continue;
+			const ref = parseImageRef(image);
+			if (ref.isVariable) continue;
+			const issue = mutableRefIssue(ref);
+			if (!issue) continue;
+			const detail = issue === "untagged" ? `Service '${name}' image '${image}' does not specify a tag.` : `Service '${name}' image '${image}' uses the mutable 'latest' tag.`;
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${detail} Every pull may fetch a different image.`, this.help, context?.locate?.([
+				"services",
+				name,
+				"image"
+			])));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Pin the image to a specific tag or digest (e.g. `nginx:1.27-alpine`) so deploys are reproducible and a rollback actually rolls back.",
+	key: "docker-doctor/pin-service-image",
+	message: "Pin service images to a specific tag or digest"
+};
 const composeRules = [
 	noVersionKey,
 	requireResourceLimits,
 	requireRestartPolicy,
-	useDependsOnCondition
+	useDependsOnCondition,
+	pinServiceImage
+];
+
+//#endregion
+//#region ../core/src/rules/compose-models.ts
+/**
+* Narrows an unknown compose document to its top-level `models:` entries
+* (Docker Model Runner, Compose ≥ 2.35).
+*/
+const topLevelModels = (composeContent) => {
+	if (!composeContent || typeof composeContent !== "object" || !("models" in composeContent)) return {};
+	const { models } = composeContent;
+	if (!models || typeof models !== "object" || Array.isArray(models)) return {};
+	return models;
+};
+const undefinedModelReference = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		const defined = new Set(Object.keys(topLevelModels(composeContent)));
+		const flag = (serviceName, modelName, pathTail) => {
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${serviceName}' references model '${modelName}', which is not declared in the top-level models section. Compose cannot resolve it.`, this.help, context?.locate?.([
+				"services",
+				serviceName,
+				"models",
+				pathTail
+			])));
+		};
+		for (const [name, config] of composeServices(composeContent)) {
+			const { models } = config;
+			if (Array.isArray(models)) {
+				for (const [index, entry] of models.entries()) if (typeof entry === "string" && !defined.has(entry)) flag(name, entry, index);
+			} else if (models && typeof models === "object") {
+				for (const modelName of Object.keys(models)) if (!defined.has(modelName)) flag(name, modelName, modelName);
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "error",
+	help: "Every name under a service's `models:` must match an entry in the top-level `models:` element. Declare the model there (with its `model:` OCI artifact) or fix the reference.",
+	key: "docker-doctor/undefined-model-reference",
+	message: "Service model references must be declared in top-level models"
+};
+const pinModelVersion = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of Object.entries(topLevelModels(composeContent))) {
+			if (!config || typeof config !== "object") continue;
+			const { model } = config;
+			if (typeof model !== "string") continue;
+			const ref = parseImageRef(model);
+			if (ref.isVariable) continue;
+			const issue = mutableRefIssue(ref);
+			if (!issue) continue;
+			const detail = issue === "untagged" ? `Model '${name}' artifact '${model}' does not specify a tag.` : `Model '${name}' artifact '${model}' uses the mutable 'latest' tag.`;
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${detail} Every pull may fetch different weights.`, this.help, context?.locate?.([
+				"models",
+				name,
+				"model"
+			])));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Pin the model to a specific tag (e.g. `ai/gemma3:4B-Q4_0`) so every environment runs the same weights. Model behavior differences are far harder to debug than software version drift.",
+	key: "docker-doctor/pin-model-version",
+	message: "Pin models to a specific tag or digest"
+};
+const composeModelRules = [undefinedModelReference, pinModelVersion];
+
+//#endregion
+//#region ../core/src/rules/secret-keywords.ts
+const SECRET_KEY_PATTERNS = [
+	/(?:^|[_-])password(?:[_-]|$)/iu,
+	/(?:^|[_-])secret(?:[_-]|$)/iu,
+	/(?:^|[_-])token(?:[_-]|$)/iu,
+	/(?:^|[_-])api_key(?:[_-]|$)/iu,
+	/(?:^|[_-])private_key(?:[_-]|$)/iu,
+	/(?:^|[_-])auth(?:[_-]|$)/iu
+];
+const isSecretKey = (key) => SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
+
+//#endregion
+//#region ../core/src/rules/compose-security.ts
+const DOCKER_SOCKET = "/var/run/docker.sock";
+const noPrivilegedService = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) if (config.privileged === true) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' runs in privileged mode. A privileged container has full access to the host's devices and kernel, so compromising this service compromises the host.`, this.help, context?.locate?.([
+			"services",
+			name,
+			"privileged"
+		])));
+		return diagnostics;
+	},
+	defaultSeverity: "error",
+	help: "Remove `privileged: true` and grant only what the service needs: specific capabilities via `cap_add`, or individual device access via `devices`.",
+	key: "docker-doctor/no-privileged-service",
+	message: "Do not run services in privileged mode"
+};
+const mountsDockerSocket = (volume) => {
+	if (typeof volume === "string") return volume.split(":")[0] === DOCKER_SOCKET;
+	if (volume && typeof volume === "object") return volume.source === DOCKER_SOCKET;
+	return false;
+};
+const noDockerSocketMount = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) {
+			const { volumes } = config;
+			if (!Array.isArray(volumes)) continue;
+			for (const [index, volume] of volumes.entries()) if (mountsDockerSocket(volume)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts the Docker socket. Anything running in this container can control the Docker daemon: start privileged containers, read every volume, and escape to the host.`, this.help, context?.locate?.([
+				"services",
+				name,
+				"volumes",
+				index
+			])));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "error",
+	help: "If the service genuinely needs the Docker API (agent tooling like MCP gateways often does), prefer `use_api_socket: true` or a filtering socket proxy over a raw bind mount of `/var/run/docker.sock`.",
+	key: "docker-doctor/no-docker-socket-mount",
+	message: "Do not bind-mount the Docker socket into services"
+};
+const isLiteralSecretValue = (value) => typeof value === "string" && value.length > 0 && !value.startsWith("$");
+const noPlaintextSecrets = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		const flag = (name, key, line) => {
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret in service '${name}' environment: '${key}'. A literal value here lives in version control in plain text.`, this.help, line));
+		};
+		for (const [name, config] of composeServices(composeContent)) {
+			const { environment } = config;
+			if (Array.isArray(environment)) for (const [index, entry] of environment.entries()) {
+				if (typeof entry !== "string") continue;
+				const eqIndex = entry.indexOf("=");
+				if (eqIndex <= 0) continue;
+				const key = entry.slice(0, eqIndex);
+				const value = entry.slice(eqIndex + 1);
+				if (isSecretKey(key) && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+					"services",
+					name,
+					"environment",
+					index
+				]));
+			}
+			else if (environment && typeof environment === "object") {
+				for (const [key, value] of Object.entries(environment)) if (isSecretKey(key) && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+					"services",
+					name,
+					"environment",
+					key
+				]));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Move the value to an `env_file` kept out of version control, interpolate it from the host environment (`${VAR}`), or use Compose `secrets:`.",
+	key: "docker-doctor/no-plaintext-secrets",
+	message: "Avoid literal secret values in Compose environment"
+};
+const composeSecurityRules = [
+	noPrivilegedService,
+	noDockerSocketMount,
+	noPlaintextSecrets
 ];
 
 //#endregion
 //#region ../core/src/rules/image-size.ts
-const createDiagnostic$2 = (file, ruleKey, severity, message, help, line) => ({
-	file,
-	help,
-	line,
-	message,
-	rule: ruleKey,
-	severity
-});
 const preferSlimBase = {
 	category: "Image Size",
 	check(instructions, file) {
@@ -580,10 +888,11 @@ const preferSlimBase = {
 			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
+			if (isHardenedImage(imagePart)) continue;
 			if (ref.digest) continue;
 			if (!ref.tag) continue;
 			const haystack = `${ref.name} ${ref.tag}`.toLowerCase();
-			if (!(haystack.includes("alpine") || haystack.includes("slim") || haystack.includes("distroless") || haystack.includes("busybox"))) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
+			if (!(haystack.includes("alpine") || haystack.includes("slim") || haystack.includes("distroless") || haystack.includes("busybox"))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -592,14 +901,20 @@ const preferSlimBase = {
 	key: "docker-doctor/prefer-slim-base",
 	message: "Prefer slim, alpine, or distroless base images"
 };
+const BUILDKIT_MOUNT_FLAG_RE = /--mount=(?<spec>\S+)/gu;
+const CACHE_TARGET_KEY_RE = /^(?:target|dst|destination)=/u;
+const cacheMountTargets = (args) => [...args.matchAll(BUILDKIT_MOUNT_FLAG_RE)].map((match) => (match.groups?.spec ?? "").split(",")).filter((options) => options.includes("type=cache")).flatMap((options) => options.filter((option) => CACHE_TARGET_KEY_RE.test(option)).map((option) => option.slice(option.indexOf("=") + 1)));
+const APT_CACHE_DIRS = ["/var/lib/apt", "/var/cache/apt"];
+const APK_CACHE_DIRS = ["/var/cache/apk", "/etc/apk/cache"];
+const hasCacheMountFor = (args, cacheDirs) => cacheMountTargets(args).some((target) => cacheDirs.some((dir) => target === dir || target.startsWith(`${dir}/`)));
 const cleanPackageCache = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const { args } = inst;
-			if (args.includes("apt-get install") && !args.includes("rm -rf /var/lib/apt/lists")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
-			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
+			if (args.includes("apt-get install") && !args.includes("rm -rf /var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
+			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk") && !hasCacheMountFor(args, APK_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -636,7 +951,7 @@ const avoidDevDependencies = {
 			for (const inst of stage.runs) {
 				if (!installsDevDependencies(inst.args)) continue;
 				const where = stageIndex === finalIndex ? "in the final stage" : `in stage '${stage.name}', whose layers the final stage inherits,`;
-				diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
 			}
 		}
 		return diagnostics;
@@ -654,19 +969,11 @@ const imageSizeRules = [
 
 //#endregion
 //#region ../core/src/rules/performance.ts
-const createDiagnostic$1 = (file, ruleKey, severity, message, help, line) => ({
-	file,
-	help,
-	line,
-	message,
-	rule: ruleKey,
-	severity
-});
 const useMultiStage = {
 	category: "Performance",
 	check(instructions, file) {
 		if (instructions.filter((inst) => inst.instruction === "FROM").length === 1) {
-			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || inst.args.includes("make")))) return [createDiagnostic$1(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
+			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || inst.args.includes("make")))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
 		}
 		return [];
 	},
@@ -690,7 +997,7 @@ const orderLayers = {
 			}
 			if (inst.instruction === "RUN" && copyAllLine !== -1) {
 				const args = inst.args.toLowerCase();
-				if (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install") || args.includes("bun install") || args.includes("pip install") || args.includes("cargo fetch")) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Running package installation command '${inst.args}' after copying application files (at line ${copyAllLine}). This invalidates the cache on any code changes.`, this.help, inst.line));
+				if (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install") || args.includes("bun install") || args.includes("pip install") || args.includes("cargo fetch")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package installation command '${inst.args}' after copying application files (at line ${copyAllLine}). This invalidates the cache on any code changes.`, this.help, inst.line));
 			}
 		}
 		return diagnostics;
@@ -710,10 +1017,10 @@ const minimizeLayers = {
 			if (consecutiveRunCount === 0) firstRunLine = inst.line;
 			consecutiveRunCount += 1;
 		} else {
-			if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
+			if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
 			consecutiveRunCount = 0;
 		}
-		if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
+		if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
@@ -738,7 +1045,7 @@ const useDockerignore = {
 				return src === "." || src === "./" || src === "*";
 			}
 			return false;
-		}) && context?.projectFiles && !hasDockerignoreFor(file, context.projectFiles)) return [createDiagnostic$1(file, this.key, this.defaultSeverity, "Using COPY/ADD with a wildcard or directory, but no .dockerignore file was found next to the Dockerfile or at the project root. This can copy local build folders and secrets.", this.help, 1)];
+		}) && context?.projectFiles && !hasDockerignoreFor(file, context.projectFiles)) return [createDiagnostic(file, this.key, this.defaultSeverity, "Using COPY/ADD with a wildcard or directory, but no .dockerignore file was found next to the Dockerfile or at the project root. This can copy local build folders and secrets.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "warning",
@@ -755,14 +1062,6 @@ const performanceRules = [
 
 //#endregion
 //#region ../core/src/rules/security.ts
-const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
-	file,
-	help,
-	line,
-	message,
-	rule: ruleKey,
-	severity
-});
 const isRootUser = (value) => {
 	const [user] = value.split(":");
 	return user === "root" || user === "0";
@@ -776,7 +1075,8 @@ const noRootUser = {
 		let lastUserLine = 1;
 		for (const inst of instructions) if (inst.instruction === "FROM") {
 			const { base, stage } = parseFromArgs(inst.args);
-			lastUser = stageUser.get(base?.toLowerCase() ?? "") ?? "root";
+			const baseDefaultUser = base && isHardenedRuntimeImage(base) ? "nonroot" : "root";
+			lastUser = stageUser.get(base?.toLowerCase() ?? "") ?? baseDefaultUser;
 			lastUserLine = inst.line;
 			currentStage = stage?.toLowerCase() ?? null;
 			if (currentStage) stageUser.set(currentStage, lastUser);
@@ -797,21 +1097,13 @@ const noSecretsInEnv = {
 	category: "Security",
 	check(instructions, file) {
 		const diagnostics = [];
-		const secretKeywords = [
-			/(?:^|[_-])password(?:[_-]|$)/iu,
-			/(?:^|[_-])secret(?:[_-]|$)/iu,
-			/(?:^|[_-])token(?:[_-]|$)/iu,
-			/(?:^|[_-])api_key(?:[_-]|$)/iu,
-			/(?:^|[_-])private_key(?:[_-]|$)/iu,
-			/(?:^|[_-])auth(?:[_-]|$)/iu
-		];
 		for (const inst of instructions) if (inst.instruction === "ENV" || inst.instruction === "ARG") {
 			const args = inst.args.trim();
 			if (inst.instruction === "ENV" && !args.includes("=")) {
 				const match = args.match(/^(?<key>[^\s]+)\s+(?<value>.*)$/u);
 				if (match?.groups) {
 					const { key, value } = match.groups;
-					if (secretKeywords.some((regex) => regex.test(key)) && value && !value.startsWith("$") && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
+					if (isSecretKey(key) && value && !value.startsWith("$") && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
 				}
 			} else {
 				const parts = args.split(/\s+/u);
@@ -823,7 +1115,7 @@ const noSecretsInEnv = {
 						key = part.slice(0, eqIndex);
 						value = part.slice(eqIndex + 1);
 					} else key = part;
-					if (secretKeywords.some((regex) => regex.test(key)) && value && !value.startsWith("$") && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
+					if (isSecretKey(key) && value && !value.startsWith("$") && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
 				}
 			}
 		}
@@ -844,8 +1136,11 @@ const pinImageVersion = {
 			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
-			if (!(ref.tag || ref.digest)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' does not specify a tag. This makes builds non-deterministic.`, this.help, inst.line));
-			else if (ref.tag === "latest" && !ref.digest) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' uses the mutable 'latest' tag. This makes builds non-deterministic.`, this.help, inst.line));
+			const issue = mutableRefIssue(ref);
+			if (issue) {
+				const detail = issue === "untagged" ? `Base image '${imagePart}' does not specify a tag.` : `Base image '${imagePart}' uses the mutable 'latest' tag.`;
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${detail} This makes builds non-deterministic.`, this.help, inst.line));
+			}
 		}
 		return diagnostics;
 	},
@@ -885,7 +1180,11 @@ const allDockerfileRules = [
 	...bestPracticesRules,
 	...imageSizeRules
 ];
-const allComposeRules = [...composeRules];
+const allComposeRules = [
+	...composeRules,
+	...composeSecurityRules,
+	...composeModelRules
+];
 const allRules = [...allDockerfileRules, ...allComposeRules];
 const findRule = (key) => allRules.find((rule) => rule.key === key);
 
@@ -909,12 +1208,12 @@ const runDockerfileRules = (instructions, file, projectFiles, rulesConfig, categ
 
 //#endregion
 //#region ../core/src/runners/compose-runner.ts
-const runComposeRules = (composeContent, file, rulesConfig, categoriesConfig) => {
+const runComposeRules = (composeContent, file, rulesConfig, categoriesConfig, locate) => {
 	const diagnostics = [];
 	for (const rule of allComposeRules) {
 		const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);
 		if (severity === "off") continue;
-		const ruleDiagnostics = rule.check(composeContent, file);
+		const ruleDiagnostics = rule.check(composeContent, file, { locate });
 		if (severity !== rule.defaultSeverity) for (const diag of ruleDiagnostics) diag.severity = severity;
 		diagnostics.push(...ruleDiagnostics);
 	}
@@ -1163,6 +1462,12 @@ Object.defineProperty(exports, 'calculateScore', {
     return calculateScore;
   }
 });
+Object.defineProperty(exports, 'createComposeLocator', {
+  enumerable: true,
+  get: function () {
+    return createComposeLocator;
+  }
+});
 Object.defineProperty(exports, 'discoverProject', {
   enumerable: true,
   get: function () {
@@ -1217,4 +1522,4 @@ Object.defineProperty(exports, 'version', {
     return version;
   }
 });
-//# sourceMappingURL=src-ILbJuJmE.cjs.map
+//# sourceMappingURL=src-F90_EKmA.cjs.map