@docker-doctor/cli 0.5.0 → 0.5.1

package/dist/{src-CpGd43y0.mjs → src-NqSwkGiS.mjs}

@@ -4,7 +4,7 @@ import path from "node:path";
 import { LineCounter, isAlias, isMap, isScalar, isSeq, parse, parseDocument } from "yaml";
 
 //#region package.json
-var version = "0.5.0";
+var version = "0.5.1";
 
 //#endregion
 //#region ../core/src/project-info/ignore.ts
@@ -600,7 +600,9 @@ const requireResourceLimits = {
 		const diagnostics = [];
 		for (const [name, config] of composeServices(composeContent)) {
 			const limits = (config.deploy?.resources)?.limits;
-			if (!limits || !limits.cpus && !limits.memory) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help, context?.locate?.(["services", name])));
+			const hasDeployLimits = Boolean(limits?.cpus || limits?.memory);
+			const hasServiceLevelLimits = Boolean(config.mem_limit || config.cpus || config.cpu_quota);
+			if (!(hasDeployLimits || hasServiceLevelLimits)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help, context?.locate?.(["services", name])));
 		}
 		return diagnostics;
 	},
@@ -717,24 +719,52 @@ const undefinedModelReference = {
 	key: "docker-doctor/undefined-model-reference",
 	message: "Service model references must be declared in top-level models"
 };
+const collectModelBindings = (composeContent) => {
+	const bindings = [];
+	for (const [name, config] of Object.entries(topLevelModels(composeContent))) {
+		if (!config || typeof config !== "object") continue;
+		const { model } = config;
+		if (typeof model === "string") bindings.push({
+			model,
+			path: [
+				"models",
+				name,
+				"model"
+			],
+			subject: `Model '${name}' artifact`
+		});
+	}
+	for (const [name, config] of composeServices(composeContent)) {
+		const { provider } = config;
+		if (!provider || typeof provider !== "object") continue;
+		const { type, options } = provider;
+		if (type !== "model" || !options || typeof options !== "object") continue;
+		const { model } = options;
+		if (typeof model === "string") bindings.push({
+			model,
+			path: [
+				"services",
+				name,
+				"provider",
+				"options",
+				"model"
+			],
+			subject: `Service '${name}' model provider`
+		});
+	}
+	return bindings;
+};
 const pinModelVersion = {
 	category: "Compose",
 	check(composeContent, file, context) {
 		const diagnostics = [];
-		for (const [name, config] of Object.entries(topLevelModels(composeContent))) {
-			if (!config || typeof config !== "object") continue;
-			const { model } = config;
-			if (typeof model !== "string") continue;
+		for (const { subject, model, path } of collectModelBindings(composeContent)) {
 			const ref = parseImageRef(model);
 			if (ref.isVariable) continue;
 			const issue = mutableRefIssue(ref);
 			if (!issue) continue;
-			const detail = issue === "untagged" ? `Model '${name}' artifact '${model}' does not specify a tag.` : `Model '${name}' artifact '${model}' uses the mutable 'latest' tag.`;
-			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${detail} Every pull may fetch different weights.`, this.help, context?.locate?.([
-				"models",
-				name,
-				"model"
-			])));
+			const detail = issue === "untagged" ? `${subject} '${model}' does not specify a tag.` : `${subject} '${model}' uses the mutable 'latest' tag.`;
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${detail} Every pull may fetch different weights.`, this.help, context?.locate?.(path)));
 		}
 		return diagnostics;
 	},
@@ -748,18 +778,21 @@ const composeModelRules = [undefinedModelReference, pinModelVersion];
 //#endregion
 //#region ../core/src/rules/secret-keywords.ts
 const SECRET_KEY_PATTERNS = [
-	/(?:^|[_-])password(?:[_-]|$)/iu,
+	/password(?:[_-]|$)/iu,
 	/(?:^|[_-])secret(?:[_-]|$)/iu,
 	/(?:^|[_-])token(?:[_-]|$)/iu,
 	/(?:^|[_-])api_key(?:[_-]|$)/iu,
+	/(?:^|[_-])apikey(?:[_-]|$)/iu,
 	/(?:^|[_-])private_key(?:[_-]|$)/iu,
-	/(?:^|[_-])auth(?:[_-]|$)/iu
+	/(?:^|[_-])auth(?:[_-]|$)/iu,
+	/(?:^|[_-])pat(?:[_-]|$)/iu
 ];
 const isSecretKey = (key) => SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
+const CREDENTIAL_FREE_URL = /^[a-z][a-z0-9+.-]*:\/\/[^@/\s]*(?:\/|$)/iu;
+const isLiteralSecretValue = (value) => value.length > 0 && !value.startsWith("$") && !CREDENTIAL_FREE_URL.test(value);
 
 //#endregion
 //#region ../core/src/rules/compose-security.ts
-const DOCKER_SOCKET = "/var/run/docker.sock";
 const noPrivilegedService = {
 	category: "Compose",
 	check(composeContent, file, context) {
@@ -776,10 +809,54 @@ const noPrivilegedService = {
 	key: "docker-doctor/no-privileged-service",
 	message: "Do not run services in privileged mode"
 };
+const DOCKER_SOCKET_TARGET = "/var/run/docker.sock";
+const INTERPOLATION_WITH_DEFAULT = /\$\{[^}:?-]+:?-(?<fallback>[^}]*)\}/gu;
+const INTERPOLATION_WITHOUT_DEFAULT = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/gu;
+const resolveInterpolationDefaults = (value) => value.replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
+const PATH_SHAPED = /^(?:[/.~]|[A-Za-z]:)/u;
+const isDockerSocketPath = (rawPath) => {
+	const normalized = rawPath.replaceAll("\\", "/");
+	return PATH_SHAPED.test(normalized) && (normalized.endsWith("/docker.sock") || normalized.endsWith("/pipe/docker_engine"));
+};
+const splitShortSyntax = (spec) => {
+	const parts = [];
+	let depth = 0;
+	let current = "";
+	for (const char of spec) {
+		if (char === "{") depth += 1;
+		else if (char === "}") depth = Math.max(0, depth - 1);
+		if (char === ":" && depth === 0) {
+			parts.push(current);
+			current = "";
+			continue;
+		}
+		current += char;
+	}
+	parts.push(current);
+	return parts;
+};
+const volumeMount = (volume) => {
+	if (typeof volume === "string") {
+		const [source, target] = splitShortSyntax(volume);
+		return target === void 0 ? void 0 : {
+			source,
+			target
+		};
+	}
+	if (volume && typeof volume === "object") {
+		const { source, target } = volume;
+		return {
+			source: typeof source === "string" ? source : void 0,
+			target: typeof target === "string" ? target : void 0
+		};
+	}
+};
 const mountsDockerSocket = (volume) => {
-	if (typeof volume === "string") return volume.split(":")[0] === DOCKER_SOCKET;
-	if (volume && typeof volume === "object") return volume.source === DOCKER_SOCKET;
-	return false;
+	const mount = volumeMount(volume);
+	if (!mount?.source) return false;
+	const resolvedSource = resolveInterpolationDefaults(mount.source);
+	if (resolvedSource !== "") return isDockerSocketPath(resolvedSource);
+	return resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
 };
 const noDockerSocketMount = {
 	category: "Compose",
@@ -802,7 +879,6 @@ const noDockerSocketMount = {
 	key: "docker-doctor/no-docker-socket-mount",
 	message: "Do not bind-mount the Docker socket into services"
 };
-const isLiteralSecretValue = (value) => typeof value === "string" && value.length > 0 && !value.startsWith("$");
 const noPlaintextSecrets = {
 	category: "Compose",
 	check(composeContent, file, context) {
@@ -818,7 +894,7 @@ const noPlaintextSecrets = {
 				if (eqIndex <= 0) continue;
 				const key = entry.slice(0, eqIndex);
 				const value = entry.slice(eqIndex + 1);
-				if (isSecretKey(key) && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+				if (isSecretKey(key) && typeof value === "string" && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
 					"services",
 					name,
 					"environment",
@@ -826,7 +902,7 @@ const noPlaintextSecrets = {
 				]));
 			}
 			else if (environment && typeof environment === "object") {
-				for (const [key, value] of Object.entries(environment)) if (isSecretKey(key) && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+				for (const [key, value] of Object.entries(environment)) if (isSecretKey(key) && typeof value === "string" && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
 					"services",
 					name,
 					"environment",
@@ -1074,7 +1150,7 @@ const noSecretsInEnv = {
 				const match = args.match(/^(?<key>[^\s]+)\s+(?<value>.*)$/u);
 				if (match?.groups) {
 					const { key, value } = match.groups;
-					if (isSecretKey(key) && value && !value.startsWith("$") && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
+					if (isSecretKey(key) && isLiteralSecretValue(value) && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
 				}
 			} else {
 				const parts = args.split(/\s+/u);
@@ -1086,7 +1162,7 @@ const noSecretsInEnv = {
 						key = part.slice(0, eqIndex);
 						value = part.slice(eqIndex + 1);
 					} else key = part;
-					if (isSecretKey(key) && value && !value.startsWith("$") && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
+					if (isSecretKey(key) && isLiteralSecretValue(value) && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
 				}
 			}
 		}
@@ -1416,4 +1492,4 @@ const toJsonReport = (diagnostics, score, label, project) => ({
 
 //#endregion
 export { runDockerfileRules as a, createComposeLocator as c, discoverProject as d, version as f, runComposeRules as i, parseCompose as l, calculateScore as n, allRules as o, loadConfig as r, findRule as s, toJsonReport as t, parseDockerfile as u };
-//# sourceMappingURL=src-CpGd43y0.mjs.map
+//# sourceMappingURL=src-NqSwkGiS.mjs.map

package/dist/src-NqSwkGiS.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"src-NqSwkGiS.mjs","names":["parseYaml"],"sources":["../package.json","../../core/src/project-info/ignore.ts","../../core/src/project-info/discover.ts","../../core/src/parsers/dockerfile-parser.ts","../../core/src/errors/config-error.ts","../../core/src/errors/parse-error.ts","../../core/src/parsers/compose-parser.ts","../../core/src/parsers/exec-form.ts","../../core/src/parsers/image-ref.ts","../../core/src/rules/create-diagnostic.ts","../../core/src/rules/best-practices.ts","../../core/src/rules/compose-services.ts","../../core/src/rules/compose.ts","../../core/src/rules/compose-models.ts","../../core/src/rules/secret-keywords.ts","../../core/src/rules/compose-security.ts","../../core/src/rules/image-size.ts","../../core/src/rules/performance.ts","../../core/src/rules/security.ts","../../core/src/rules/index.ts","../../core/src/runners/resolve-severity.ts","../../core/src/runners/dockerfile-runner.ts","../../core/src/runners/compose-runner.ts","../../core/src/schemas/config.ts","../../core/src/config/unknown-keys.ts","../../core/src/config/loader.ts","../../core/src/scoring.ts","../../core/src/report.ts"],"sourcesContent":["","const GLOB_SPECIALS_RE = /[.+^${}()|[\\]\\\\]/gu;\n\n/**\n * Compiles one glob pattern from `ignore.files` to a RegExp over\n * POSIX-style relative paths. Supported syntax is the subset the docs\n * promise: `**` crosses directory separators (`**` followed by `/` matches\n * zero or more whole segments), `*` and `?` stay within one segment.\n * Brace expansion and character classes are not supported.\n */\nconst globToRegExp = (pattern: string): RegExp => {\n  let source = \"^\";\n  let index = 0;\n  while (index < pattern.length) {\n    const char = pattern[index];\n    if (char === \"*\") {\n      if (pattern[index + 1] === \"*\") {\n        if (pattern[index + 2] === \"/\") {\n          source += \"(?:[^/]*/)*\";\n          index += 3;\n        } else {\n          source += \".*\";\n          index += 2;\n        }\n      } else {\n        source += \"[^/]*\";\n        index += 1;\n      }\n    } else if (char === \"?\") {\n      source += \"[^/]\";\n      index += 1;\n    } else {\n      source += char.replace(GLOB_SPECIALS_RE, String.raw`\\$&`);\n      index += 1;\n    }\n  }\n  return new RegExp(`${source}$`, \"u\");\n};\n\n/**\n * Builds a predicate over root-relative paths from `ignore.files`\n * patterns. Windows separators in the tested path are normalized to `/`\n * before matching, so patterns are always written POSIX-style.\n */\nexport const createIgnoreMatcher = (\n  patterns?: readonly string[]\n): ((relativePath: string) => boolean) => {\n  if (!patterns || patterns.length === 0) {\n    return () => false;\n  }\n  const regexps = patterns.map(globToRegExp);\n  return (relativePath) => {\n    const normalized = relativePath.replaceAll(\"\\\\\", \"/\");\n    return regexps.some((regexp) => regexp.test(normalized));\n  };\n};\n","import fs from \"node:fs/promises\";\nimport path from \"node:path\";\n\nimport type { ProjectInfo } from \"../types/index\";\nimport { createIgnoreMatcher } from \"./ignore\";\n\nconst walk = async (\n  dir: string,\n  fileList: string[] = []\n): Promise<string[]> => {\n  const files = await fs.readdir(dir, { withFileTypes: true });\n  await Promise.all(\n    files.map(async (file) => {\n      const filePath = path.join(dir, file.name);\n      if (file.isDirectory()) {\n        if (\n          file.name === \"node_modules\" ||\n          file.name === \".git\" ||\n          file.name === \".next\" ||\n          file.name === \"dist\" ||\n          file.name === \".turbo\"\n        ) {\n          return;\n        }\n        await walk(filePath, fileList);\n      } else {\n        fileList.push(filePath);\n      }\n    })\n  );\n  return fileList;\n};\n\nexport const discoverProject = async (\n  rootDir: string,\n  options?: { ignoreFiles?: readonly string[] }\n): Promise<ProjectInfo> => {\n  const allFiles = await walk(rootDir);\n  const dockerfiles: string[] = [];\n  const composeFiles: string[] = [];\n  const dockerignores: string[] = [];\n  const isIgnored = createIgnoreMatcher(options?.ignoreFiles);\n\n  for (const file of allFiles) {\n    const relative = path.relative(rootDir, file);\n    if (isIgnored(relative)) {\n      continue;\n    }\n    const base = path.basename(file).toLowerCase();\n\n    if (base === \".dockerignore\") {\n      dockerignores.push(relative);\n    }\n\n    // Match Dockerfile, Dockerfile.*, *.dockerfile\n    if (\n      base === \"dockerfile\" ||\n      base.startsWith(\"dockerfile.\") ||\n      base.endsWith(\".dockerfile\")\n    ) {\n      dockerfiles.push(relative);\n    }\n\n    // Match docker-compose.yml, docker-compose.*.yml, compose.yml, compose.*.yml, and yaml extensions\n    if (\n      base === \"docker-compose.yml\" ||\n      base === \"docker-compose.yaml\" ||\n      base === \"compose.yml\" ||\n      base === \"compose.yaml\" ||\n      ((base.startsWith(\"docker-compose.\") || base.startsWith(\"compose.\")) &&\n        (base.endsWith(\".yml\") || base.endsWith(\".yaml\")))\n    ) {\n      composeFiles.push(relative);\n    }\n  }\n\n  // The traversal is concurrent, so results arrive in I/O-completion order.\n  // Sort at the boundary so identical scans produce byte-identical JSON\n  // reports and stable PR-comment row ordering. The default comparator is\n  // deliberate: localeCompare would make the order machine-dependent, which\n  // is the class of bug this sorting exists to fix.\n  return {\n    composeFiles: composeFiles.toSorted(),\n    dockerfiles: dockerfiles.toSorted(),\n    dockerignores: dockerignores.toSorted(),\n  };\n};\n","import type { DockerfileInstruction } from \"../types/index\";\n\nconst DOCKERFILE_KEYWORDS = new Set([\n  \"ADD\",\n  \"ARG\",\n  \"CMD\",\n  \"COPY\",\n  \"ENTRYPOINT\",\n  \"ENV\",\n  \"EXPOSE\",\n  \"FROM\",\n  \"HEALTHCHECK\",\n  \"LABEL\",\n  \"MAINTAINER\",\n  \"ONBUILD\",\n  \"RUN\",\n  \"SHELL\",\n  \"STOPSIGNAL\",\n  \"USER\",\n  \"VOLUME\",\n  \"WORKDIR\",\n]);\n\n// The only instructions BuildKit supports heredocs on.\nconst HEREDOC_INSTRUCTIONS = new Set([\"ADD\", \"COPY\", \"RUN\"]);\n\nconst INSTRUCTION_LINE_RE = /^(?<inst>[A-Za-z]+)\\s+(?<args>.*)$/u;\n\n// Matches a BuildKit heredoc opener like <<EOF, <<-EOF, <<'EOF', <<\"EOF\".\n// Three constraints keep this from matching shell constructs that aren't\n// Dockerfile heredocs: (1) `<<` must be preceded by start-of-line or\n// whitespace, so `1<<3` (shell arithmetic) doesn't match and every\n// character-shifted alignment inside `<<<` (here-strings) fails too; (2) the\n// delimiter must be attached directly to `<<` with no whitespace, so\n// `$((1 << 3))` and shell `cat << EOF` (both redirection, not a Dockerfile\n// heredoc) don't match; (3) callers only invoke this for RUN/COPY/ADD, the\n// only instructions BuildKit supports heredocs on. Known accepted\n// limitation: `RUN echo \"text <<EOF more\"` still matches inside a quoted\n// string — correctly rejecting that needs a shell lexer, out of scope here.\n// Global so a single line (e.g. `COPY <<FILE1 <<FILE2 /dest/`) can open more\n// than one.\nconst HEREDOC_OPENER_RE =\n  /(?<=^|\\s)<<-?(?<quote>['\"]?)(?<delim>\\w+)\\k<quote>/gu;\n\ninterface ParserState {\n  instructions: DockerfileInstruction[];\n  currentInstruction: string;\n  currentArgs: string;\n  startLine: number;\n  rawAccumulator: string[];\n  // FIFO of heredoc delimiters still open for the current instruction, in\n  // the order they were opened (closed in the same order).\n  heredocQueue: string[];\n}\n\nconst createParserState = (): ParserState => ({\n  currentArgs: \"\",\n  currentInstruction: \"\",\n  heredocQueue: [],\n  instructions: [],\n  rawAccumulator: [],\n  startLine: 0,\n});\n\nconst closeInstruction = (state: ParserState): void => {\n  if (state.currentInstruction) {\n    state.instructions.push({\n      args: state.currentArgs,\n      instruction: state.currentInstruction,\n      line: state.startLine,\n      raw: state.rawAccumulator.join(\"\\n\"),\n    });\n  }\n  state.currentInstruction = \"\";\n  state.currentArgs = \"\";\n  state.rawAccumulator = [];\n};\n\nconst matchInstructionKeyword = (\n  lineContent: string\n): { instruction: string; args: string } | null => {\n  const match = lineContent.match(INSTRUCTION_LINE_RE);\n  const matchedWord = match?.groups?.inst.toUpperCase();\n  if (matchedWord && DOCKERFILE_KEYWORDS.has(matchedWord)) {\n    return { args: match?.groups?.args ?? \"\", instruction: matchedWord };\n  }\n\n  const word = lineContent.trim().toUpperCase();\n  if (DOCKERFILE_KEYWORDS.has(word)) {\n    return { args: \"\", instruction: word };\n  }\n\n  return null;\n};\n\nconst findHeredocDelimiters = (lineContent: string): string[] =>\n  [...lineContent.matchAll(HEREDOC_OPENER_RE)].map(\n    (m) => m.groups?.delim ?? \"\"\n  );\n\n// Heredoc body lines are never treated as instructions (not even comment\n// lines, which are shell-comment content here) — they are folded verbatim\n// into the owning instruction's args until the delimiter line closes the\n// (possibly multiple) open heredoc(s), in the order they were opened.\nconst processHeredocLine = (state: ParserState, trimmed: string): void => {\n  if (trimmed === state.heredocQueue[0]) {\n    state.heredocQueue.shift();\n  } else {\n    state.currentArgs += (state.currentArgs ? \" \" : \"\") + trimmed;\n  }\n\n  if (state.heredocQueue.length === 0) {\n    // Last open heredoc just closed: the instruction ends here.\n    closeInstruction(state);\n  }\n};\n\nconst processInstructionLine = (\n  state: ParserState,\n  trimmed: string,\n  lineNum: number\n): void => {\n  let lineContent = trimmed;\n\n  const hasContinuation = lineContent.endsWith(\"\\\\\");\n  if (hasContinuation) {\n    lineContent = lineContent.slice(0, -1).trim();\n  }\n\n  if (state.currentInstruction) {\n    state.currentArgs += (state.currentArgs ? \" \" : \"\") + lineContent;\n  } else {\n    state.startLine = lineNum;\n    // Match the first instruction word (e.g. FROM, RUN, COPY)\n    const matched = matchInstructionKeyword(lineContent);\n    if (matched) {\n      state.currentInstruction = matched.instruction;\n      state.currentArgs = matched.args;\n    }\n  }\n\n  if (HEREDOC_INSTRUCTIONS.has(state.currentInstruction)) {\n    state.heredocQueue.push(...findHeredocDelimiters(lineContent));\n  }\n\n  if (state.heredocQueue.length > 0) {\n    // A heredoc opener implies continuation even without a trailing\n    // backslash — keep accumulating until every opened delimiter closes.\n    return;\n  }\n\n  if (!hasContinuation) {\n    closeInstruction(state);\n  }\n};\n\nexport const parseDockerfile = (content: string): DockerfileInstruction[] => {\n  const state = createParserState();\n  const lines = content.split(/\\r?\\n/u);\n\n  for (const [i, rawLine] of lines.entries()) {\n    const trimmed = rawLine.trim();\n    const lineNum = i + 1;\n    const insideHeredoc = state.heredocQueue.length > 0;\n\n    // Comment lines are dropped by Docker's parser even mid-continuation, so\n    // keep them out of args AND `raw` — raw-based rules must not see them.\n    // Heredoc bodies are exempt: a leading `#` there is shell content.\n    if (!insideHeredoc && trimmed.startsWith(\"#\")) {\n      continue;\n    }\n\n    // Skip empty lines if not in a multi-line block\n    if (!state.currentInstruction && !insideHeredoc && trimmed === \"\") {\n      continue;\n    }\n\n    state.rawAccumulator.push(rawLine);\n\n    if (insideHeredoc) {\n      processHeredocLine(state, trimmed);\n    } else {\n      processInstructionLine(state, trimmed, lineNum);\n    }\n  }\n\n  // EOF: an unterminated heredoc (or a trailing backslash continuation)\n  // still emits whatever was accumulated so far, rather than dropping it.\n  closeInstruction(state);\n\n  return state.instructions;\n};\n","export class ConfigError extends Error {\n  readonly _tag = \"ConfigError\" as const;\n\n  constructor(options: { readonly message: string }) {\n    super(options.message);\n    this.name = \"ConfigError\";\n  }\n}\n","export class ParseError extends Error {\n  readonly _tag = \"ParseError\" as const;\n  readonly file: string;\n\n  constructor(options: { readonly file: string; readonly message: string }) {\n    super(options.message);\n    this.name = \"ParseError\";\n    this.file = options.file;\n  }\n}\n","import {\n  isAlias,\n  isMap,\n  isScalar,\n  isSeq,\n  LineCounter,\n  parse,\n  parseDocument,\n} from \"yaml\";\n\nimport { ParseError } from \"../errors\";\nimport type { ComposeLocator } from \"../types/index\";\n\nexport const parseCompose = (content: string, filepath: string): unknown => {\n  try {\n    // Compose files rely on YAML 1.1 merge keys (`<<: *anchor`); yaml's\n    // default 1.2 schema leaves `<<` as a literal key without this option.\n    return parse(content, { merge: true });\n  } catch (error: unknown) {\n    throw new ParseError({\n      file: filepath,\n      message: error instanceof Error ? error.message : String(error),\n    });\n  }\n};\n\n/**\n * Builds a {@link ComposeLocator} over the same source text a compose object\n * was parsed from, so rules can attach line numbers to their diagnostics.\n *\n * Keys pulled in via YAML merge keys (`<<: *anchor`) have no concrete node\n * at the merge site, so paths through them resolve to `undefined` — callers\n * fall back to an unnumbered diagnostic, which matches the old behavior.\n */\nexport const createComposeLocator = (content: string): ComposeLocator => {\n  const lineCounter = new LineCounter();\n  const doc = parseDocument(content, { lineCounter, merge: true });\n\n  return (path) => {\n    let node: unknown = doc.contents;\n    let offset: number | undefined;\n\n    for (const segment of path) {\n      if (isAlias(node)) {\n        node = node.resolve(doc);\n      }\n      if (isMap(node)) {\n        const pair = node.items.find(\n          (item) =>\n            isScalar(item.key) && String(item.key.value) === String(segment)\n        );\n        if (!pair || !isScalar(pair.key)) {\n          return;\n        }\n        offset = pair.key.range?.[0];\n        node = pair.value;\n      } else if (isSeq(node) && typeof segment === \"number\") {\n        const item = node.items[segment];\n        if (item === undefined || item === null) {\n          return;\n        }\n        offset = (item as { range?: [number, number, number] | null })\n          .range?.[0];\n        node = item;\n      } else {\n        return;\n      }\n    }\n\n    return offset === undefined ? undefined : lineCounter.linePos(offset).line;\n  };\n};\n","// Exec form is a JSON array of strings: CMD [\"node\", \"index.js\"]. Docker only\n// treats bracket-wrapped args as exec form when they parse as one — anything\n// else (e.g. CMD [node, index.js], whose tokens are unquoted) falls back to\n// shell form under `/bin/sh -c`.\n//\n// An array holding a non-string element (CMD [1, 2]) is null here too. Docker\n// rejects that outright rather than falling back, so the Dockerfile is broken\n// either way and a shell-form diagnostic still points at the offending line.\nexport const parseExecForm = (args: string): string[] | null => {\n  const trimmed = args.trim();\n  // Cheap reject first: most instructions are shell form, and reaching them\n  // through a thrown JSON.parse would be far more expensive.\n  if (!trimmed.startsWith(\"[\")) {\n    return null;\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(trimmed);\n  } catch {\n    return null;\n  }\n\n  if (!Array.isArray(parsed)) {\n    return null;\n  }\n  if (!parsed.every((el): el is string => typeof el === \"string\")) {\n    return null;\n  }\n\n  return parsed;\n};\n","import type { DockerfileInstruction } from \"../types/index\";\n\nexport interface ImageRef {\n  registry?: string;\n  name: string;\n  tag?: string;\n  digest?: string;\n  isVariable: boolean;\n}\n\nexport const parseImageRef = (ref: string): ImageRef => {\n  if (ref.includes(\"${\") || ref.startsWith(\"$\")) {\n    return { isVariable: true, name: ref };\n  }\n\n  let remainder = ref;\n  let digest: string | undefined;\n\n  const atIndex = remainder.indexOf(\"@\");\n  if (atIndex !== -1) {\n    digest = remainder.slice(atIndex + 1);\n    remainder = remainder.slice(0, atIndex);\n  }\n\n  let tag: string | undefined;\n  const lastColonIndex = remainder.lastIndexOf(\":\");\n  const lastSlashIndex = remainder.lastIndexOf(\"/\");\n\n  if (lastColonIndex !== -1 && lastColonIndex > lastSlashIndex) {\n    tag = remainder.slice(lastColonIndex + 1);\n    remainder = remainder.slice(0, lastColonIndex);\n  }\n\n  let registry: string | undefined;\n  const firstSlashIndex = remainder.indexOf(\"/\");\n  if (firstSlashIndex !== -1) {\n    const firstSegment = remainder.slice(0, firstSlashIndex);\n    if (\n      firstSegment.includes(\".\") ||\n      firstSegment.includes(\":\") ||\n      firstSegment === \"localhost\"\n    ) {\n      registry = firstSegment;\n      remainder = remainder.slice(firstSlashIndex + 1);\n    }\n  }\n\n  return {\n    digest,\n    isVariable: false,\n    name: remainder,\n    registry,\n    tag,\n  };\n};\n\n/**\n * Docker Hardened Images (free catalog since Dec 2025) are pulled from the\n * dhi.io registry. Enterprise mirrors live under a plain Docker Hub org\n * namespace and cannot be recognized from the ref alone, so they keep the\n * default rule behavior.\n */\nexport const isHardenedImage = (imagePart: string): boolean =>\n  imagePart.toLowerCase().startsWith(\"dhi.io/\");\n\n/**\n * DHI runtime variants ship no shell or package manager and run as a\n * nonroot user by default. The `-dev` variants keep a shell for build\n * stages and are not assumed to be nonroot.\n */\nexport const isHardenedRuntimeImage = (imagePart: string): boolean => {\n  if (!isHardenedImage(imagePart)) {\n    return false;\n  }\n  const { tag } = parseImageRef(imagePart);\n  return !(tag === \"dev\" || tag?.endsWith(\"-dev\"));\n};\n\n/**\n * Why a reference would resolve differently over time: no tag at all, or\n * the mutable `latest` tag without a digest. `undefined` means the ref is\n * pinned. Shared by every pinning rule (base images, service images,\n * models) so they agree on what counts as pinned.\n */\nexport const mutableRefIssue = (\n  ref: ImageRef\n): \"untagged\" | \"latest\" | undefined => {\n  if (!(ref.tag || ref.digest)) {\n    return \"untagged\";\n  }\n  if (ref.tag === \"latest\" && !ref.digest) {\n    return \"latest\";\n  }\n  return undefined;\n};\n\nexport interface FromArgs {\n  base: string | null;\n  stage: string | null;\n}\n\n// FROM [--flags] <image|stage> [AS <stage>], flags in any position.\nexport const parseFromArgs = (args: string): FromArgs => {\n  const parts = args.split(/\\s+/u).filter(Boolean);\n  const asIndex = parts.findIndex((p) => p.toLowerCase() === \"as\");\n  const imageParts = asIndex === -1 ? parts : parts.slice(0, asIndex);\n  return {\n    base: imageParts.find((p) => !p.startsWith(\"--\")) ?? null,\n    stage: asIndex === -1 ? null : (parts[asIndex + 1] ?? null),\n  };\n};\n\n// The reserved empty base, not a real image: nothing to pin a tag on, no\n// distribution to slim down, and no image config to inherit. One definition\n// so the rules cannot disagree about a given FROM line.\nexport const isScratch = (base: string | null): boolean =>\n  base?.toLowerCase() === \"scratch\";\n\nexport const collectStageAliases = (\n  instructions: DockerfileInstruction[]\n): Set<string> => {\n  const aliases = new Set<string>();\n\n  for (const inst of instructions) {\n    if (inst.instruction !== \"FROM\") {\n      continue;\n    }\n\n    const { stage } = parseFromArgs(inst.args);\n    if (stage) {\n      aliases.add(stage.toLowerCase());\n    }\n  }\n\n  return aliases;\n};\n","import type { Diagnostic, DiagnosticSeverity } from \"../types/index\";\n\nexport const createDiagnostic = (\n  file: string,\n  ruleKey: string,\n  severity: DiagnosticSeverity,\n  message: string,\n  help: string,\n  line?: number\n): Diagnostic => ({ file, help, line, message, rule: ruleKey, severity });\n","import { parseExecForm } from \"../parsers/exec-form\";\nimport { isScratch, parseFromArgs } from \"../parsers/image-ref\";\nimport type { Diagnostic, DockerfileRule } from \"../types/index\";\nimport { createDiagnostic } from \"./create-diagnostic\";\n\nexport const requireHealthcheck: DockerfileRule = {\n  category: \"Best Practices\",\n  check(instructions, file) {\n    const hasHealthcheck = instructions.some(\n      (inst) => inst.instruction === \"HEALTHCHECK\"\n    );\n\n    // Only suggest healthcheck if it has exposed ports or command lines indicating it runs an app\n    const hasExposedPortsOrEntry = instructions.some(\n      (inst) =>\n        inst.instruction === \"EXPOSE\" ||\n        inst.instruction === \"CMD\" ||\n        inst.instruction === \"ENTRYPOINT\"\n    );\n\n    if (!hasHealthcheck && hasExposedPortsOrEntry) {\n      return [\n        createDiagnostic(\n          file,\n          this.key,\n          this.defaultSeverity,\n          \"No HEALTHCHECK instruction found. Containers running services should expose healthchecks to enable auto-healing.\",\n          this.help,\n          1\n        ),\n      ];\n    }\n    return [];\n  },\n  defaultSeverity: \"info\",\n  help: \"Use HEALTHCHECK (e.g., `HEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost/ || exit 1`) so Docker can monitor the container's live status.\",\n  key: \"docker-doctor/require-healthcheck\",\n  message: \"Add a HEALTHCHECK instruction\",\n};\n\nexport const preferCopyOverAdd: DockerfileRule = {\n  category: \"Best Practices\",\n  check(instructions, file) {\n    const diagnostics: Diagnostic[] = [];\n\n    for (const inst of instructions) {\n      if (inst.instruction === \"ADD\") {\n        const parts = inst.args.split(/\\s+/u);\n        const src = parts.find((p) => !p.startsWith(\"--\"));\n\n        if (!src) {\n          continue;\n        }\n\n        // If it's not a remote url (handled by security/no-add-remote) and not a compressed file\n        const isRemote =\n          src.startsWith(\"http://\") || src.startsWith(\"https://\");\n        const isArchive =\n          src.endsWith(\".tar\") ||\n          src.endsWith(\".tar.gz\") ||\n          src.endsWith(\".tgz\") ||\n          src.endsWith(\".zip\");\n\n        if (!isRemote && !isArchive) {\n          diagnostics.push(\n            createDiagnostic(\n              file,\n              this.key,\n              this.defaultSeverity,\n              `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`,\n              this.help,\n              inst.line\n            )\n          );\n        }\n      }\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"warning\",\n  help: \"Use COPY instead of ADD unless you explicitly need auto-extraction of local compressed archives (tar, zip, etc.).\",\n  key: \"docker-doctor/prefer-copy-over-add\",\n  message: \"Prefer COPY over ADD\",\n};\n\nexport const useExecForm: DockerfileRule = {\n  category: \"Best Practices\",\n  check(instructions, file) {\n    const diagnostics: Diagnostic[] = [];\n\n    for (const inst of instructions) {\n      const takesExecForm =\n        inst.instruction === \"CMD\" || inst.instruction === \"ENTRYPOINT\";\n      // Bracket-wrapped args that are not a JSON string array still run under\n      // /bin/sh -c, so they count as shell form.\n      if (takesExecForm && parseExecForm(inst.args) === null) {\n        diagnostics.push(\n          createDiagnostic(\n            file,\n            this.key,\n            this.defaultSeverity,\n            `${inst.instruction} instruction uses shell form instead of exec form. In shell form, the command runs under '/bin/sh -c', which does not pass signals to child processes.`,\n            this.help,\n            inst.line\n          )\n        );\n      }\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"warning\",\n  help: 'Write CMD/ENTRYPOINT instructions as JSON arrays (e.g. `ENTRYPOINT [\"node\", \"index.js\"]`) so OS signals (like SIGTERM) are forwarded correctly.',\n  key: \"docker-doctor/use-exec-form\",\n  message: \"Use exec form for CMD and ENTRYPOINT\",\n};\n\nexport const requireLabels: DockerfileRule = {\n  category: \"Best Practices\",\n  check(instructions, file) {\n    const hasLabel = instructions.some((inst) => inst.instruction === \"LABEL\");\n    if (!hasLabel) {\n      return [\n        createDiagnostic(\n          file,\n          this.key,\n          this.defaultSeverity,\n          \"No LABEL metadata was found in this Dockerfile. Adding labels helps identify build information, maintainers, and descriptions.\",\n          this.help,\n          1\n        ),\n      ];\n    }\n    return [];\n  },\n  defaultSeverity: \"info\",\n  help: 'Use LABEL instructions (e.g. `LABEL org.opencontainers.image.authors=\"...\"`) to document ownership, license, version, and build info.',\n  key: \"docker-doctor/require-labels\",\n  message: \"Add LABEL metadata to images\",\n};\n\nexport const combineAptUpdateInstall: DockerfileRule = {\n  category: \"Best Practices\",\n  check(instructions, file) {\n    const diagnostics: Diagnostic[] = [];\n    for (const inst of instructions) {\n      if (inst.instruction === \"RUN\") {\n        const hasUpdate = inst.args.includes(\"apt-get update\");\n        const hasInstall = inst.args.includes(\"apt-get install\");\n\n        if (hasUpdate && !hasInstall) {\n          diagnostics.push(\n            createDiagnostic(\n              file,\n              this.key,\n              this.defaultSeverity,\n              \"RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.\",\n              this.help,\n              inst.line\n            )\n          );\n        } else if (hasInstall && !hasUpdate) {\n          diagnostics.push(\n            createDiagnostic(\n              file,\n              this.key,\n              this.defaultSeverity,\n              \"RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.\",\n              this.help,\n              inst.line\n            )\n          );\n        }\n      }\n    }\n    return diagnostics;\n  },\n  defaultSeverity: \"warning\",\n  help: \"Combine `apt-get update` and `apt-get install` in the same RUN instruction (e.g. `RUN apt-get update && apt-get install -y --no-install-recommends <package> && rm -rf /var/lib/apt/lists/*`).\",\n  key: \"docker-doctor/combine-apt-update-install\",\n  message: \"Combine apt-get update and apt-get install\",\n};\n\n// An actual pipefail setting: the option must appear adjacent to its flag\n// (`-o pipefail`, `-euo pipefail`, repeated `-o errexit -o pipefail`, or a\n// shell invoked with `-o pipefail`). Matching the flag directly (rather than\n// a shell name) also works inside joined exec-form argv, and cannot backtrack\n// pathologically. Known limitation: the word inside quotes (e.g.\n// `echo \"set -o pipefail\" >> .bashrc`) still matches — same class as the\n// existing test.todo for quoted pipes.\nexport const PIPEFAIL_SETTING_RE = /(?:^|\\s)-[A-Za-z]*o\\s+pipefail\\b/u;\n\n// A RUN line uses a pipe: a single `|` not part of `||`.\nconst HAS_PIPE_RE = /(?<!\\|)\\|(?!\\|)/u;\n\n// SHELL takes exec form; joined, its argv is the prefix every shell-form RUN\n// is wrapped in (e.g. /bin/bash -o pipefail -c). Any other spelling is\n// rejected by Docker, so it cannot be enabling pipefail.\nconst shellDirectiveEnablesPipefail = (args: string): boolean => {\n  const argv = parseExecForm(args);\n  return argv !== null && PIPEFAIL_SETTING_RE.test(argv.join(\" \"));\n};\n\nexport const usePipefail: DockerfileRule = {\n  category: \"Best Practices\",\n  check(instructions, file) {\n    const diagnostics: Diagnostic[] = [];\n    // FROM <previous stage> inherits that stage's image config — SHELL\n    // included (verified against BuildKit); FROM a fresh base image, or the\n    // reserved empty stage `scratch`, resets it to the Docker default. A\n    // SHELL instruction replaces it for the rest of the current stage.\n    // NOTE: FROM ${VAR} (variable base) misses the map lookup and silently\n    // resets — fails safe (extra warning, never a missed one).\n    const stagePipefail = new Map<string, boolean>();\n    let shellHasPipefail = false;\n    let currentStage: string | null = null;\n    for (const inst of instructions) {\n      if (inst.instruction === \"FROM\") {\n        const { base, stage } = parseFromArgs(inst.args);\n        // Only a reference to an earlier stage carries state forward; a real\n        // base image, scratch, or a variable we cannot resolve resets it.\n        const parentStage = isScratch(base)\n          ? null\n          : (base?.toLowerCase() ?? null);\n        shellHasPipefail =\n          parentStage !== null && stagePipefail.get(parentStage) === true;\n        currentStage = stage?.toLowerCase() ?? null;\n        if (currentStage) {\n          stagePipefail.set(currentStage, shellHasPipefail);\n        }\n        continue;\n      }\n      if (inst.instruction === \"SHELL\") {\n        shellHasPipefail = shellDirectiveEnablesPipefail(inst.args);\n        if (currentStage) {\n          stagePipefail.set(currentStage, shellHasPipefail);\n        }\n        continue;\n      }\n      if (inst.instruction !== \"RUN\") {\n        continue;\n      }\n      const { args } = inst;\n      if (!HAS_PIPE_RE.test(args)) {\n        continue;\n      }\n      // SHELL only applies to shell-form RUN; exec-form RUN runs its own\n      // argv directly, so check the argv for pipefail instead.\n      const execArgv = parseExecForm(args);\n      const pipefailConfigured =\n        execArgv === null\n          ? shellHasPipefail || PIPEFAIL_SETTING_RE.test(args)\n          : PIPEFAIL_SETTING_RE.test(execArgv.join(\" \"));\n      if (!pipefailConfigured) {\n        diagnostics.push(\n          createDiagnostic(\n            file,\n            this.key,\n            this.defaultSeverity,\n            \"RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.\",\n            this.help,\n            inst.line\n          )\n        );\n      }\n    }\n    return diagnostics;\n  },\n  defaultSeverity: \"warning\",\n  help: 'Prepend `set -o pipefail &&` to pipe commands, use exec form with a shell that supports it (e.g., `RUN [\"/bin/bash\", \"-c\", \"set -o pipefail && ...\"]`), or set `SHELL [\"/bin/bash\", \"-o\", \"pipefail\", \"-c\"]` at the top of the stage.',\n  key: \"docker-doctor/use-pipefail\",\n  message: \"Use pipefail to catch pipeline command failures\",\n};\n\nexport const absoluteWorkdir: DockerfileRule = {\n  category: \"Best Practices\",\n  check(instructions, file) {\n    const diagnostics: Diagnostic[] = [];\n    for (const inst of instructions) {\n      if (inst.instruction === \"WORKDIR\") {\n        const path = inst.args.trim();\n        const isAbsolute = /^(?:\\/|\\\\|\\$|[a-zA-Z]:)/u.test(path);\n\n        if (!isAbsolute) {\n          diagnostics.push(\n            createDiagnostic(\n              file,\n              this.key,\n              this.defaultSeverity,\n              `WORKDIR specifies a relative path '${path}'. For clarity and reliability, always use absolute paths.`,\n              this.help,\n              inst.line\n            )\n          );\n        }\n      }\n    }\n    return diagnostics;\n  },\n  defaultSeverity: \"warning\",\n  help: \"Always specify absolute paths for WORKDIR instructions (e.g. `WORKDIR /app`).\",\n  key: \"docker-doctor/absolute-workdir\",\n  message: \"Use absolute paths for WORKDIR\",\n};\n\nexport const avoidRunCd: DockerfileRule = {\n  category: \"Best Practices\",\n  check(instructions, file) {\n    const diagnostics: Diagnostic[] = [];\n    for (const inst of instructions) {\n      if (inst.instruction === \"RUN\" && /\\bcd\\b/u.test(inst.args)) {\n        diagnostics.push(\n          createDiagnostic(\n            file,\n            this.key,\n            this.defaultSeverity,\n            \"Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.\",\n            this.help,\n            inst.line\n          )\n        );\n      }\n    }\n    return diagnostics;\n  },\n  defaultSeverity: \"info\",\n  help: \"Use the WORKDIR instruction instead of `cd` inside RUN to establish directory context.\",\n  key: \"docker-doctor/avoid-run-cd\",\n  message: \"Avoid changing directories with cd in RUN\",\n};\n\nexport const sortMultilineArgs: DockerfileRule = {\n  category: \"Best Practices\",\n  check(instructions, file) {\n    const diagnostics: Diagnostic[] = [];\n    for (const inst of instructions) {\n      if (inst.instruction === \"RUN\") {\n        const { raw } = inst;\n        const isPackageInstall =\n          raw.includes(\"apt-get install\") ||\n          raw.includes(\"apk add\") ||\n          raw.includes(\"yum install\") ||\n          raw.includes(\"dnf install\");\n\n        const hasContinuation = raw.includes(\"\\\\\\n\") || raw.includes(\"\\\\\\r\\n\");\n\n        if (isPackageInstall && hasContinuation) {\n          const lines = raw.split(/\\r?\\n/u);\n          const packages = lines\n            .slice(1)\n            .map((line) => line.trim())\n            .filter(\n              (line) =>\n                line !== \"\" &&\n                !line.startsWith(\"&&\") &&\n                !line.startsWith(\"-\") &&\n                !line.includes(\"rm -rf\")\n            )\n            .map((line) =>\n              line.endsWith(\"\\\\\") ? line.slice(0, -1).trim() : line\n            )\n            .filter(Boolean);\n\n          if (packages.length > 1) {\n            const sorted = packages.toSorted((a, b) => a.localeCompare(b));\n            const isSorted = packages.every((val, idx) => val === sorted[idx]);\n            if (!isSorted) {\n              diagnostics.push(\n                createDiagnostic(\n                  file,\n                  this.key,\n                  this.defaultSeverity,\n                  \"Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.\",\n                  this.help,\n                  inst.line\n                )\n              );\n            }\n          }\n        }\n      }\n    }\n    return diagnostics;\n  },\n  defaultSeverity: \"info\",\n  help: \"Sort multi-line package installation lists (e.g. apk/apt package lists) alphabetically.\",\n  key: \"docker-doctor/sort-multiline-args\",\n  message: \"Sort multi-line arguments alphanumerically\",\n};\n\nexport const useraddNoLogInit: DockerfileRule = {\n  category: \"Best Practices\",\n  check(instructions, file) {\n    const diagnostics: Diagnostic[] = [];\n    for (const inst of instructions) {\n      if (\n        inst.instruction === \"RUN\" &&\n        /\\buseradd\\b/u.test(inst.args) &&\n        !inst.args.includes(\"--no-log-init\")\n      ) {\n        diagnostics.push(\n          createDiagnostic(\n            file,\n            this.key,\n            this.defaultSeverity,\n            \"RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.\",\n            this.help,\n            inst.line\n          )\n        );\n      }\n    }\n    return diagnostics;\n  },\n  defaultSeverity: \"warning\",\n  help: \"Pass `--no-log-init` flag to useradd (e.g., `RUN useradd --no-log-init -r -g mygroup myuser`).\",\n  key: \"docker-doctor/useradd-no-log-init\",\n  message: \"Use --no-log-init with useradd\",\n};\n\nexport const bestPracticesRules = [\n  requireHealthcheck,\n  preferCopyOverAdd,\n  useExecForm,\n  requireLabels,\n  combineAptUpdateInstall,\n  usePipefail,\n  absoluteWorkdir,\n  avoidRunCd,\n  sortMultilineArgs,\n  useraddNoLogInit,\n];\n","/**\n * Narrows an unknown compose document to its service entries. A service\n * with a null body (`web:` with nothing under it) is returned as an empty\n * config so rules still check it: it is the least-configured service in\n * the file, not a service to skip. Scalar and array bodies are invalid\n * compose and are dropped.\n */\nexport const composeServices = (\n  composeContent: unknown\n): [string, Record<string, unknown>][] => {\n  if (\n    !composeContent ||\n    typeof composeContent !== \"object\" ||\n    !(\"services\" in composeContent)\n  ) {\n    return [];\n  }\n  const { services } = composeContent as { services?: unknown };\n  if (!services || typeof services !== \"object\") {\n    return [];\n  }\n\n  const entries: [string, Record<string, unknown>][] = [];\n  for (const [name, config] of Object.entries(services)) {\n    if (config === null || config === undefined) {\n      entries.push([name, {}]);\n    } else if (typeof config === \"object\" && !Array.isArray(config)) {\n      entries.push([name, config as Record<string, unknown>]);\n    }\n  }\n  return entries;\n};\n","import { mutableRefIssue, parseImageRef } from \"../parsers/image-ref\";\nimport type { ComposeRule, Diagnostic } from \"../types/index\";\nimport { composeServices } from \"./compose-services\";\nimport { createDiagnostic } from \"./create-diagnostic\";\n\nexport const noVersionKey: ComposeRule = {\n  category: \"Compose\",\n  check(composeContent, file, context) {\n    if (\n      composeContent &&\n      typeof composeContent === \"object\" &&\n      \"version\" in composeContent\n    ) {\n      return [\n        createDiagnostic(\n          file,\n          this.key,\n          this.defaultSeverity,\n          \"The 'version' property is deprecated. Remove it to use standard Compose spec behavior.\",\n          this.help,\n          context?.locate?.([\"version\"])\n        ),\n      ];\n    }\n    return [];\n  },\n  defaultSeverity: \"warning\",\n  help: \"The `version` key is obsolete in the Compose specification. Omitting it defaults to the latest specification.\",\n  key: \"docker-doctor/no-version-key\",\n  message: \"Remove the `version` key from the Compose file\",\n};\n\nexport const requireResourceLimits: ComposeRule = {\n  category: \"Compose\",\n  check(composeContent, file, context) {\n    const diagnostics: Diagnostic[] = [];\n\n    for (const [name, config] of composeServices(composeContent)) {\n      const deploy = config.deploy as Record<string, unknown> | undefined;\n      const resources = deploy?.resources as\n        | Record<string, unknown>\n        | undefined;\n      const limits = resources?.limits as Record<string, unknown> | undefined;\n      const hasDeployLimits = Boolean(limits?.cpus || limits?.memory);\n      // Pre-`deploy` spelling of the same limits, still in the spec.\n      const hasServiceLevelLimits = Boolean(\n        config.mem_limit || config.cpus || config.cpu_quota\n      );\n\n      if (!(hasDeployLimits || hasServiceLevelLimits)) {\n        diagnostics.push(\n          createDiagnostic(\n            file,\n            this.key,\n            this.defaultSeverity,\n            `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`,\n            this.help,\n            context?.locate?.([\"services\", name])\n          )\n        );\n      }\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"warning\",\n  help: \"Add resource limits (e.g. `deploy.resources.limits`) to prevent a single service from starving host resources in production.\",\n  key: \"docker-doctor/require-resource-limits\",\n  message: \"Define resource limits for services\",\n};\n\nexport const requireRestartPolicy: ComposeRule = {\n  category: \"Compose\",\n  check(composeContent, file, context) {\n    const diagnostics: Diagnostic[] = [];\n\n    for (const [name, config] of composeServices(composeContent)) {\n      const hasRestart = \"restart\" in config;\n      const deploy = config.deploy as Record<string, unknown> | undefined;\n      const hasDeployRestart = deploy?.restart_policy !== undefined;\n\n      if (!hasRestart && !hasDeployRestart) {\n        diagnostics.push(\n          createDiagnostic(\n            file,\n            this.key,\n            this.defaultSeverity,\n            `Service '${name}' has no restart policy configured. It will not restart if it crashes or if the host reboots.`,\n            this.help,\n            context?.locate?.([\"services\", name])\n          )\n        );\n      }\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"warning\",\n  help: \"Define `restart: always` or `restart: unless-stopped` (or `deploy.restart_policy`) so services restart on crashes or host reboot.\",\n  key: \"docker-doctor/require-restart-policy\",\n  message: \"Set restart policy for services\",\n};\n\nexport const useDependsOnCondition: ComposeRule = {\n  category: \"Compose\",\n  check(composeContent, file, context) {\n    const diagnostics: Diagnostic[] = [];\n\n    for (const [name, config] of composeServices(composeContent)) {\n      const dependsOn = config.depends_on;\n      if (dependsOn && Array.isArray(dependsOn)) {\n        diagnostics.push(\n          createDiagnostic(\n            file,\n            this.key,\n            this.defaultSeverity,\n            `Service '${name}' uses shorthand depends_on list. This only checks if containers are started, not if they are ready/healthy.`,\n            this.help,\n            context?.locate?.([\"services\", name, \"depends_on\"]) ??\n              context?.locate?.([\"services\", name])\n          )\n        );\n      }\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"info\",\n  help: \"Instead of a simple service list, use `depends_on: { dependency: { condition: service_healthy } }` to ensure dependencies are fully ready before starting.\",\n  key: \"docker-doctor/use-depends-on-condition\",\n  message: \"Use long-form depends_on with healthcheck conditions\",\n};\n\nexport const pinServiceImage: ComposeRule = {\n  category: \"Compose\",\n  check(composeContent, file, context) {\n    const diagnostics: Diagnostic[] = [];\n\n    for (const [name, config] of composeServices(composeContent)) {\n      const { image } = config;\n      // With `build:` present, `image` only names the locally built\n      // artifact — there is nothing to pin.\n      if (typeof image !== \"string\" || \"build\" in config) {\n        continue;\n      }\n\n      const ref = parseImageRef(image);\n      if (ref.isVariable) {\n        continue;\n      }\n\n      const issue = mutableRefIssue(ref);\n      if (!issue) {\n        continue;\n      }\n      const detail =\n        issue === \"untagged\"\n          ? `Service '${name}' image '${image}' does not specify a tag.`\n          : `Service '${name}' image '${image}' uses the mutable 'latest' tag.`;\n      diagnostics.push(\n        createDiagnostic(\n          file,\n          this.key,\n          this.defaultSeverity,\n          `${detail} Every pull may fetch a different image.`,\n          this.help,\n          context?.locate?.([\"services\", name, \"image\"])\n        )\n      );\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"warning\",\n  help: \"Pin the image to a specific tag or digest (e.g. `nginx:1.27-alpine`) so deploys are reproducible and a rollback actually rolls back.\",\n  key: \"docker-doctor/pin-service-image\",\n  message: \"Pin service images to a specific tag or digest\",\n};\n\nexport const composeRules = [\n  noVersionKey,\n  requireResourceLimits,\n  requireRestartPolicy,\n  useDependsOnCondition,\n  pinServiceImage,\n];\n","import { mutableRefIssue, parseImageRef } from \"../parsers/image-ref\";\nimport type { ComposeRule, Diagnostic } from \"../types/index\";\nimport { composeServices } from \"./compose-services\";\nimport { createDiagnostic } from \"./create-diagnostic\";\n\n/**\n * Narrows an unknown compose document to its top-level `models:` entries\n * (Docker Model Runner, Compose ≥ 2.35).\n */\nconst topLevelModels = (composeContent: unknown): Record<string, unknown> => {\n  if (\n    !composeContent ||\n    typeof composeContent !== \"object\" ||\n    !(\"models\" in composeContent)\n  ) {\n    return {};\n  }\n  const { models } = composeContent as { models?: unknown };\n  if (!models || typeof models !== \"object\" || Array.isArray(models)) {\n    return {};\n  }\n  return models as Record<string, unknown>;\n};\n\nexport const undefinedModelReference: ComposeRule = {\n  category: \"Compose\",\n  check(composeContent, file, context) {\n    const diagnostics: Diagnostic[] = [];\n    const defined = new Set(Object.keys(topLevelModels(composeContent)));\n\n    const flag = (\n      serviceName: string,\n      modelName: string,\n      pathTail: string | number\n    ) => {\n      diagnostics.push(\n        createDiagnostic(\n          file,\n          this.key,\n          this.defaultSeverity,\n          `Service '${serviceName}' references model '${modelName}', which is not declared in the top-level models section. Compose cannot resolve it.`,\n          this.help,\n          context?.locate?.([\"services\", serviceName, \"models\", pathTail])\n        )\n      );\n    };\n\n    for (const [name, config] of composeServices(composeContent)) {\n      const { models } = config;\n      if (Array.isArray(models)) {\n        // Short syntax: a list of model names.\n        for (const [index, entry] of models.entries()) {\n          if (typeof entry === \"string\" && !defined.has(entry)) {\n            flag(name, entry, index);\n          }\n        }\n      } else if (models && typeof models === \"object\") {\n        // Long syntax: a map of model name → binding config.\n        for (const modelName of Object.keys(models)) {\n          if (!defined.has(modelName)) {\n            flag(name, modelName, modelName);\n          }\n        }\n      }\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"error\",\n  help: \"Every name under a service's `models:` must match an entry in the top-level `models:` element. Declare the model there (with its `model:` OCI artifact) or fix the reference.\",\n  key: \"docker-doctor/undefined-model-reference\",\n  message: \"Service model references must be declared in top-level models\",\n};\n\ninterface ModelBinding {\n  subject: string;\n  model: string;\n  path: (string | number)[];\n}\n\n// Top-level `models:` (Compose ≥ 2.38) plus the older service-level\n// `provider: { type: model }` form (Compose ≥ 2.35).\nconst collectModelBindings = (composeContent: unknown): ModelBinding[] => {\n  const bindings: ModelBinding[] = [];\n\n  for (const [name, config] of Object.entries(topLevelModels(composeContent))) {\n    if (!config || typeof config !== \"object\") {\n      continue;\n    }\n    const { model } = config as Record<string, unknown>;\n    if (typeof model === \"string\") {\n      bindings.push({\n        model,\n        path: [\"models\", name, \"model\"],\n        subject: `Model '${name}' artifact`,\n      });\n    }\n  }\n\n  for (const [name, config] of composeServices(composeContent)) {\n    const { provider } = config;\n    if (!provider || typeof provider !== \"object\") {\n      continue;\n    }\n    const { type, options } = provider as Record<string, unknown>;\n    if (type !== \"model\" || !options || typeof options !== \"object\") {\n      continue;\n    }\n    const { model } = options as Record<string, unknown>;\n    if (typeof model === \"string\") {\n      bindings.push({\n        model,\n        path: [\"services\", name, \"provider\", \"options\", \"model\"],\n        subject: `Service '${name}' model provider`,\n      });\n    }\n  }\n\n  return bindings;\n};\n\nexport const pinModelVersion: ComposeRule = {\n  category: \"Compose\",\n  check(composeContent, file, context) {\n    const diagnostics: Diagnostic[] = [];\n\n    for (const { subject, model, path } of collectModelBindings(\n      composeContent\n    )) {\n      const ref = parseImageRef(model);\n      if (ref.isVariable) {\n        continue;\n      }\n\n      const issue = mutableRefIssue(ref);\n      if (!issue) {\n        continue;\n      }\n      const detail =\n        issue === \"untagged\"\n          ? `${subject} '${model}' does not specify a tag.`\n          : `${subject} '${model}' uses the mutable 'latest' tag.`;\n      diagnostics.push(\n        createDiagnostic(\n          file,\n          this.key,\n          this.defaultSeverity,\n          `${detail} Every pull may fetch different weights.`,\n          this.help,\n          context?.locate?.(path)\n        )\n      );\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"warning\",\n  help: \"Pin the model to a specific tag (e.g. `ai/gemma3:4B-Q4_0`) so every environment runs the same weights. Model behavior differences are far harder to debug than software version drift.\",\n  key: \"docker-doctor/pin-model-version\",\n  message: \"Pin models to a specific tag or digest\",\n};\n\nexport const composeModelRules = [undefinedModelReference, pinModelVersion];\n","// Shared between the Dockerfile ENV/ARG rule (no-secrets-in-env) and the\n// Compose environment rule (no-plaintext-secrets) so both flag the same\n// key shapes and the same value shapes.\nconst SECRET_KEY_PATTERNS: readonly RegExp[] = [\n  // No leading separator, for PGPASSWORD.\n  /password(?:[_-]|$)/iu,\n  /(?:^|[_-])secret(?:[_-]|$)/iu,\n  /(?:^|[_-])token(?:[_-]|$)/iu,\n  /(?:^|[_-])api_key(?:[_-]|$)/iu,\n  /(?:^|[_-])apikey(?:[_-]|$)/iu,\n  /(?:^|[_-])private_key(?:[_-]|$)/iu,\n  /(?:^|[_-])auth(?:[_-]|$)/iu,\n  // GITHUB_PAT; the trailing separator keeps PATH and PATTERN out.\n  /(?:^|[_-])pat(?:[_-]|$)/iu,\n];\n\nexport const isSecretKey = (key: string): boolean =>\n  SECRET_KEY_PATTERNS.some((regex) => regex.test(key));\n\n// A URL with no userinfo in its authority. `user:pw@host` does not match.\nconst CREDENTIAL_FREE_URL = /^[a-z][a-z0-9+.-]*:\\/\\/[^@/\\s]*(?:\\/|$)/iu;\n\nexport const isLiteralSecretValue = (value: string): boolean =>\n  value.length > 0 &&\n  !value.startsWith(\"$\") &&\n  !CREDENTIAL_FREE_URL.test(value);\n","import type { ComposeRule, Diagnostic } from \"../types/index\";\nimport { composeServices } from \"./compose-services\";\nimport { createDiagnostic } from \"./create-diagnostic\";\nimport { isLiteralSecretValue, isSecretKey } from \"./secret-keywords\";\n\nexport const noPrivilegedService: ComposeRule = {\n  category: \"Compose\",\n  check(composeContent, file, context) {\n    const diagnostics: Diagnostic[] = [];\n\n    for (const [name, config] of composeServices(composeContent)) {\n      if (config.privileged === true) {\n        diagnostics.push(\n          createDiagnostic(\n            file,\n            this.key,\n            this.defaultSeverity,\n            `Service '${name}' runs in privileged mode. A privileged container has full access to the host's devices and kernel, so compromising this service compromises the host.`,\n            this.help,\n            context?.locate?.([\"services\", name, \"privileged\"])\n          )\n        );\n      }\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"error\",\n  help: \"Remove `privileged: true` and grant only what the service needs: specific capabilities via `cap_add`, or individual device access via `devices`.\",\n  key: \"docker-doctor/no-privileged-service\",\n  message: \"Do not run services in privileged mode\",\n};\n\nconst DOCKER_SOCKET_TARGET = \"/var/run/docker.sock\";\n\n// `${VAR:-default}` resolves to its default; `${VAR}`, `$VAR` and the\n// `?error` forms resolve to nothing.\nconst INTERPOLATION_WITH_DEFAULT = /\\$\\{[^}:?-]+:?-(?<fallback>[^}]*)\\}/gu;\nconst INTERPOLATION_WITHOUT_DEFAULT = /\\$\\{[^}]*\\}|\\$[A-Za-z_][A-Za-z0-9_]*/gu;\n\nconst resolveInterpolationDefaults = (value: string): string =>\n  value\n    .replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback: string) => fallback)\n    .replace(INTERPOLATION_WITHOUT_DEFAULT, \"\");\n\n// Named volumes cannot start with a path prefix, so only path-shaped\n// sources are bind mounts.\nconst PATH_SHAPED = /^(?:[/.~]|[A-Za-z]:)/u;\n\nconst isDockerSocketPath = (rawPath: string): boolean => {\n  const normalized = rawPath.replaceAll(\"\\\\\", \"/\");\n  return (\n    PATH_SHAPED.test(normalized) &&\n    (normalized.endsWith(\"/docker.sock\") ||\n      normalized.endsWith(\"/pipe/docker_engine\"))\n  );\n};\n\n// `[SOURCE:]TARGET[:MODE]`, where a `${VAR:-default}` source has its own colon.\nconst splitShortSyntax = (spec: string): string[] => {\n  const parts: string[] = [];\n  let depth = 0;\n  let current = \"\";\n  for (const char of spec) {\n    if (char === \"{\") {\n      depth += 1;\n    } else if (char === \"}\") {\n      depth = Math.max(0, depth - 1);\n    }\n    if (char === \":\" && depth === 0) {\n      parts.push(current);\n      current = \"\";\n      continue;\n    }\n    current += char;\n  }\n  parts.push(current);\n  return parts;\n};\n\ninterface VolumeMount {\n  source: string | undefined;\n  target: string | undefined;\n}\n\nconst volumeMount = (volume: unknown): VolumeMount | undefined => {\n  if (typeof volume === \"string\") {\n    const [source, target] = splitShortSyntax(volume);\n    // A lone path is an anonymous volume at that target, not a bind mount.\n    return target === undefined ? undefined : { source, target };\n  }\n  if (volume && typeof volume === \"object\") {\n    const { source, target } = volume as Record<string, unknown>;\n    return {\n      source: typeof source === \"string\" ? source : undefined,\n      target: typeof target === \"string\" ? target : undefined,\n    };\n  }\n  return undefined;\n};\n\nconst mountsDockerSocket = (volume: unknown): boolean => {\n  const mount = volumeMount(volume);\n  if (!mount?.source) {\n    return false;\n  }\n  const resolvedSource = resolveInterpolationDefaults(mount.source);\n  if (resolvedSource !== \"\") {\n    return isDockerSocketPath(resolvedSource);\n  }\n  // A bare `${VAR}` source names no host path; the target still can.\n  return (\n    resolveInterpolationDefaults(mount.target ?? \"\") === DOCKER_SOCKET_TARGET\n  );\n};\n\nexport const noDockerSocketMount: ComposeRule = {\n  category: \"Compose\",\n  check(composeContent, file, context) {\n    const diagnostics: Diagnostic[] = [];\n\n    for (const [name, config] of composeServices(composeContent)) {\n      const { volumes } = config;\n      if (!Array.isArray(volumes)) {\n        continue;\n      }\n      for (const [index, volume] of volumes.entries()) {\n        if (mountsDockerSocket(volume)) {\n          diagnostics.push(\n            createDiagnostic(\n              file,\n              this.key,\n              this.defaultSeverity,\n              `Service '${name}' bind-mounts the Docker socket. Anything running in this container can control the Docker daemon: start privileged containers, read every volume, and escape to the host.`,\n              this.help,\n              context?.locate?.([\"services\", name, \"volumes\", index])\n            )\n          );\n        }\n      }\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"error\",\n  help: \"If the service genuinely needs the Docker API (agent tooling like MCP gateways often does), prefer `use_api_socket: true` or a filtering socket proxy over a raw bind mount of `/var/run/docker.sock`.\",\n  key: \"docker-doctor/no-docker-socket-mount\",\n  message: \"Do not bind-mount the Docker socket into services\",\n};\n\nexport const noPlaintextSecrets: ComposeRule = {\n  category: \"Compose\",\n  check(composeContent, file, context) {\n    const diagnostics: Diagnostic[] = [];\n\n    const flag = (name: string, key: string, line: number | undefined) => {\n      diagnostics.push(\n        createDiagnostic(\n          file,\n          this.key,\n          this.defaultSeverity,\n          `Potential secret in service '${name}' environment: '${key}'. A literal value here lives in version control in plain text.`,\n          this.help,\n          line\n        )\n      );\n    };\n\n    for (const [name, config] of composeServices(composeContent)) {\n      const { environment } = config;\n\n      if (Array.isArray(environment)) {\n        // List syntax: \"KEY=value\" entries; a bare \"KEY\" passes the host\n        // value through and holds no literal.\n        for (const [index, entry] of environment.entries()) {\n          if (typeof entry !== \"string\") {\n            continue;\n          }\n          const eqIndex = entry.indexOf(\"=\");\n          if (eqIndex <= 0) {\n            continue;\n          }\n          const key = entry.slice(0, eqIndex);\n          const value = entry.slice(eqIndex + 1);\n          if (\n            isSecretKey(key) &&\n            typeof value === \"string\" &&\n            isLiteralSecretValue(value)\n          ) {\n            flag(\n              name,\n              key,\n              context?.locate?.([\"services\", name, \"environment\", index])\n            );\n          }\n        }\n      } else if (environment && typeof environment === \"object\") {\n        for (const [key, value] of Object.entries(environment)) {\n          if (\n            isSecretKey(key) &&\n            typeof value === \"string\" &&\n            isLiteralSecretValue(value)\n          ) {\n            flag(\n              name,\n              key,\n              context?.locate?.([\"services\", name, \"environment\", key])\n            );\n          }\n        }\n      }\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"warning\",\n  // oxlint-disable-next-line no-template-curly-in-string -- Compose interpolation syntax, shown literally\n  help: \"Move the value to an `env_file` kept out of version control, interpolate it from the host environment (`${VAR}`), or use Compose `secrets:`.\",\n  key: \"docker-doctor/no-plaintext-secrets\",\n  message: \"Avoid literal secret values in Compose environment\",\n};\n\nexport const composeSecurityRules = [\n  noPrivilegedService,\n  noDockerSocketMount,\n  noPlaintextSecrets,\n];\n","import {\n  collectStageAliases,\n  isHardenedImage,\n  isScratch,\n  parseFromArgs,\n  parseImageRef,\n} from \"../parsers/image-ref\";\nimport type {\n  Diagnostic,\n  DockerfileInstruction,\n  DockerfileRule,\n} from \"../types/index\";\nimport { createDiagnostic } from \"./create-diagnostic\";\n\nexport const preferSlimBase: DockerfileRule = {\n  category: \"Image Size\",\n  check(instructions, file) {\n    const diagnostics: Diagnostic[] = [];\n    const stageAliases = collectStageAliases(instructions);\n\n    for (const inst of instructions) {\n      if (inst.instruction === \"FROM\") {\n        const imagePart = parseFromArgs(inst.args).base;\n        if (!imagePart || isScratch(imagePart)) {\n          continue;\n        }\n\n        const ref = parseImageRef(imagePart);\n\n        if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) {\n          continue;\n        }\n\n        // Docker Hardened Images are minimal by construction (dev variants\n        // included), whatever their name and tag say.\n        if (isHardenedImage(imagePart)) {\n          continue;\n        }\n\n        // Digest pins are already fully deterministic; not our concern here.\n        if (ref.digest) {\n          continue;\n        }\n\n        // No tag: pin-image-version owns the untagged case, don't double-report.\n        if (!ref.tag) {\n          continue;\n        }\n\n        // Minimal bases identify themselves either in the name (alpine,\n        // busybox, gcr.io/distroless/*) or in the tag (node:22-slim,\n        // python:3.13-alpine). Judging by tag alone flagged `alpine:3.19`.\n        const haystack = `${ref.name} ${ref.tag}`.toLowerCase();\n        const isSlim =\n          haystack.includes(\"alpine\") ||\n          haystack.includes(\"slim\") ||\n          haystack.includes(\"distroless\") ||\n          haystack.includes(\"busybox\");\n\n        if (!isSlim) {\n          diagnostics.push(\n            createDiagnostic(\n              file,\n              this.key,\n              this.defaultSeverity,\n              `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`,\n              this.help,\n              inst.line\n            )\n          );\n        }\n      }\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"info\",\n  help: \"Prefer tags with `-slim`, `-alpine`, or use distroless base images to minimize the default operating system footprint.\",\n  key: \"docker-doctor/prefer-slim-base\",\n  message: \"Prefer slim, alpine, or distroless base images\",\n};\n\nconst BUILDKIT_MOUNT_FLAG_RE = /--mount=(?<spec>\\S+)/gu;\n\n// BuildKit accepts `target`, `dst` and `destination` as synonyms.\nconst CACHE_TARGET_KEY_RE = /^(?:target|dst|destination)=/u;\n\n// A `RUN --mount=type=cache,target=<dir>` keeps <dir> in the cache mount, not\n// in the image layer — cleanup commands for that dir are unnecessary (and the\n// Docker-documented apt pattern deliberately omits them).\nconst cacheMountTargets = (args: string): string[] =>\n  [...args.matchAll(BUILDKIT_MOUNT_FLAG_RE)]\n    .map((match) => (match.groups?.spec ?? \"\").split(\",\"))\n    .filter((options) => options.includes(\"type=cache\"))\n    .flatMap((options) =>\n      options\n        .filter((option) => CACHE_TARGET_KEY_RE.test(option))\n        .map((option) => option.slice(option.indexOf(\"=\") + 1))\n    );\n\nconst APT_CACHE_DIRS = [\"/var/lib/apt\", \"/var/cache/apt\"];\nconst APK_CACHE_DIRS = [\"/var/cache/apk\", \"/etc/apk/cache\"];\n\nconst hasCacheMountFor = (args: string, cacheDirs: string[]): boolean =>\n  cacheMountTargets(args).some((target) =>\n    cacheDirs.some((dir) => target === dir || target.startsWith(`${dir}/`))\n  );\n\nexport const cleanPackageCache: DockerfileRule = {\n  category: \"Image Size\",\n  check(instructions, file) {\n    const diagnostics: Diagnostic[] = [];\n\n    for (const inst of instructions) {\n      if (inst.instruction === \"RUN\") {\n        const { args } = inst;\n\n        // check apt-get install without cleanup\n        if (\n          args.includes(\"apt-get install\") &&\n          !args.includes(\"rm -rf /var/lib/apt/lists\") &&\n          !hasCacheMountFor(args, APT_CACHE_DIRS)\n        ) {\n          diagnostics.push(\n            createDiagnostic(\n              file,\n              this.key,\n              this.defaultSeverity,\n              `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`,\n              this.help,\n              inst.line\n            )\n          );\n        }\n\n        // check apk add without --no-cache\n        if (\n          args.includes(\"apk add\") &&\n          !args.includes(\"--no-cache\") &&\n          !args.includes(\"rm -rf /var/cache/apk\") &&\n          !hasCacheMountFor(args, APK_CACHE_DIRS)\n        ) {\n          diagnostics.push(\n            createDiagnostic(\n              file,\n              this.key,\n              this.defaultSeverity,\n              `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`,\n              this.help,\n              inst.line\n            )\n          );\n        }\n      }\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"warning\",\n  help: \"For apt-get, append `&& rm -rf /var/lib/apt/lists/*`. For apk, use `apk add --no-cache`. For dnf/yum, run `yum clean all`.\",\n  key: \"docker-doctor/clean-package-cache\",\n  message: \"Clean up package manager cache in the same RUN layer\",\n};\n\nconst installsDevDependencies = (args: string): boolean =>\n  (args.includes(\"npm install\") ||\n    args.includes(\"npm ci\") ||\n    args.includes(\"yarn install\")) &&\n  !args.includes(\"--production\") &&\n  !args.includes(\"--omit=dev\") &&\n  !args.includes(\"prune\");\n\nexport const avoidDevDependencies: DockerfileRule = {\n  category: \"Image Size\",\n  check(instructions, file) {\n    const diagnostics: Diagnostic[] = [];\n\n    const stages: {\n      name: string | null;\n      base: string;\n      runs: DockerfileInstruction[];\n    }[] = [];\n    for (const inst of instructions) {\n      if (inst.instruction === \"FROM\") {\n        const { base, stage } = parseFromArgs(inst.args);\n        stages.push({\n          base: base?.toLowerCase() ?? \"\",\n          name: stage?.toLowerCase() ?? null,\n          runs: [],\n        });\n      } else if (inst.instruction === \"RUN\" && stages.length > 0) {\n        stages.at(-1)?.runs.push(inst);\n      }\n    }\n    if (stages.length === 0) {\n      return diagnostics;\n    }\n\n    // The default build target is the last stage, and its image contains\n    // every layer of the local stages it builds FROM — so a dev install in\n    // an inherited stage ships just like one in the final stage itself.\n    const auditedIndices: number[] = [];\n    let index = stages.length - 1;\n    while (index >= 0) {\n      auditedIndices.push(index);\n      const { base } = stages[index];\n      index = stages\n        .slice(0, index)\n        .findIndex((s) => s.name !== null && s.name === base);\n    }\n\n    const finalIndex = stages.length - 1;\n    for (const stageIndex of auditedIndices.toReversed()) {\n      const stage = stages[stageIndex];\n      for (const inst of stage.runs) {\n        if (!installsDevDependencies(inst.args)) {\n          continue;\n        }\n        const where =\n          stageIndex === finalIndex\n            ? \"in the final stage\"\n            : `in stage '${stage.name}', whose layers the final stage inherits,`;\n        diagnostics.push(\n          createDiagnostic(\n            file,\n            this.key,\n            this.defaultSeverity,\n            `Running package install '${inst.args}' ${where} without omitting devDependencies.`,\n            this.help,\n            inst.line\n          )\n        );\n      }\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"warning\",\n  help: \"For Node.js, run `npm prune --production` or install only production dependencies (`npm ci --omit=dev`) in the runtime stage.\",\n  key: \"docker-doctor/avoid-dev-dependencies\",\n  message: \"Avoid installing dev dependencies in the final stage\",\n};\n\nexport const imageSizeRules = [\n  preferSlimBase,\n  cleanPackageCache,\n  avoidDevDependencies,\n];\n","import type { Diagnostic, DockerfileRule } from \"../types/index\";\nimport { createDiagnostic } from \"./create-diagnostic\";\n\nexport const useMultiStage: DockerfileRule = {\n  category: \"Performance\",\n  check(instructions, file) {\n    const fromCount = instructions.filter(\n      (inst) => inst.instruction === \"FROM\"\n    ).length;\n    if (fromCount === 1) {\n      // Check if it's not a trivial/short Dockerfile (e.g., has some build steps)\n      const hasBuildSteps = instructions.some(\n        (inst) =>\n          inst.instruction === \"RUN\" &&\n          (inst.args.includes(\"npm run build\") ||\n            inst.args.includes(\"yarn build\") ||\n            inst.args.includes(\"bun run build\") ||\n            inst.args.includes(\"cargo build\") ||\n            inst.args.includes(\"make\"))\n      );\n\n      if (hasBuildSteps) {\n        return [\n          createDiagnostic(\n            file,\n            this.key,\n            this.defaultSeverity,\n            \"Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.\",\n            this.help,\n            instructions.find((inst) => inst.instruction === \"FROM\")?.line || 1\n          ),\n        ];\n      }\n    }\n    return [];\n  },\n  defaultSeverity: \"info\",\n  help: \"Use multi-stage builds (multiple FROM statements) to separate build dependencies from the runtime image and reduce size.\",\n  key: \"docker-doctor/use-multi-stage\",\n  message: \"Use multi-stage builds\",\n};\n\nexport const orderLayers: DockerfileRule = {\n  category: \"Performance\",\n  check(instructions, file) {\n    const diagnostics: Diagnostic[] = [];\n    let copyAllLine = -1;\n\n    for (const inst of instructions) {\n      if (inst.instruction === \"FROM\") {\n        copyAllLine = -1;\n      }\n\n      if (inst.instruction === \"COPY\" || inst.instruction === \"ADD\") {\n        const parts = inst.args.split(/\\s+/u);\n        const src = parts.find((p) => !p.startsWith(\"--\"));\n\n        if (!src) {\n          continue;\n        }\n\n        const normalized = src.replace(/^\\.\\//u, \"\");\n        const isCopyAll =\n          normalized === \".\" ||\n          normalized === \"\" ||\n          normalized === \"*\" ||\n          normalized === \"src\" ||\n          normalized.startsWith(\"src/\");\n\n        if (isCopyAll && copyAllLine === -1) {\n          copyAllLine = inst.line;\n        }\n      }\n\n      if (inst.instruction === \"RUN\" && copyAllLine !== -1) {\n        const args = inst.args.toLowerCase();\n        if (\n          args.includes(\"npm install\") ||\n          args.includes(\"npm ci\") ||\n          args.includes(\"yarn install\") ||\n          args.includes(\"bun install\") ||\n          args.includes(\"pip install\") ||\n          args.includes(\"cargo fetch\")\n        ) {\n          diagnostics.push(\n            createDiagnostic(\n              file,\n              this.key,\n              this.defaultSeverity,\n              `Running package installation command '${inst.args}' after copying application files (at line ${copyAllLine}). This invalidates the cache on any code changes.`,\n              this.help,\n              inst.line\n            )\n          );\n        }\n      }\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"warning\",\n  help: \"Copy dependency definition files (like package.json, lockfiles) and run install commands BEFORE copying the rest of the application source code.\",\n  key: \"docker-doctor/order-layers\",\n  message: \"Order layers to maximize build cache utility\",\n};\n\nexport const minimizeLayers: DockerfileRule = {\n  category: \"Performance\",\n  check(instructions, file) {\n    const diagnostics: Diagnostic[] = [];\n    let consecutiveRunCount = 0;\n    let firstRunLine = -1;\n\n    for (const inst of instructions) {\n      if (inst.instruction === \"RUN\") {\n        if (consecutiveRunCount === 0) {\n          firstRunLine = inst.line;\n        }\n        consecutiveRunCount += 1;\n      } else {\n        if (consecutiveRunCount > 2) {\n          diagnostics.push(\n            createDiagnostic(\n              file,\n              this.key,\n              this.defaultSeverity,\n              `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`,\n              this.help,\n              firstRunLine\n            )\n          );\n        }\n        consecutiveRunCount = 0;\n      }\n    }\n\n    if (consecutiveRunCount > 2) {\n      diagnostics.push(\n        createDiagnostic(\n          file,\n          this.key,\n          this.defaultSeverity,\n          `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`,\n          this.help,\n          firstRunLine\n        )\n      );\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"info\",\n  help: \"Combine consecutive RUN instructions using `&&` and `\\\\` to reduce the total layer count and image size.\",\n  key: \"docker-doctor/minimize-layers\",\n  message: \"Minimize the number of image layers\",\n};\n\n// Docker reads .dockerignore from the build-context root, which we cannot know\n// statically. Accept the two locations that cover real usage: next to the\n// Dockerfile, or at the scan root (the common monorepo-root build context).\n// Paths here are scan-root-relative and always \"/\"-separated.\nconst hasDockerignoreFor = (\n  dockerfilePath: string,\n  projectFiles: string[]\n): boolean => {\n  const lastSlash = dockerfilePath.lastIndexOf(\"/\");\n  const dir = lastSlash === -1 ? \"\" : dockerfilePath.slice(0, lastSlash);\n  const adjacent = dir === \"\" ? \".dockerignore\" : `${dir}/.dockerignore`;\n  return projectFiles.some((f) => f === adjacent || f === \".dockerignore\");\n};\n\nexport const useDockerignore: DockerfileRule = {\n  category: \"Performance\",\n  check(instructions, file, context) {\n    // If copying everything, we definitely need .dockerignore\n    const hasCopyAll = instructions.some((inst) => {\n      if (inst.instruction === \"COPY\" || inst.instruction === \"ADD\") {\n        // COPY --from=<stage> reads from a previous build stage, not the\n        // build context, so .dockerignore is irrelevant to it.\n        const isStageCopy = /(?:^|\\s)--from=/u.test(inst.args);\n        if (isStageCopy) {\n          return false;\n        }\n\n        const parts = inst.args.split(/\\s+/u);\n        const src = parts.find((p) => !p.startsWith(\"--\"));\n        if (!src) {\n          return false;\n        }\n        return src === \".\" || src === \"./\" || src === \"*\";\n      }\n      return false;\n    });\n\n    if (\n      hasCopyAll &&\n      context?.projectFiles &&\n      !hasDockerignoreFor(file, context.projectFiles)\n    ) {\n      return [\n        createDiagnostic(\n          file,\n          this.key,\n          this.defaultSeverity,\n          \"Using COPY/ADD with a wildcard or directory, but no .dockerignore file was found next to the Dockerfile or at the project root. This can copy local build folders and secrets.\",\n          this.help,\n          1\n        ),\n      ];\n    }\n    return [];\n  },\n  defaultSeverity: \"warning\",\n  help: \"Create a .dockerignore file in the same directory as the Dockerfile to prevent copying unnecessary files (like node_modules, logs, build artifacts).\",\n  key: \"docker-doctor/use-dockerignore\",\n  message: \"Add a .dockerignore file\",\n};\n\nexport const performanceRules = [\n  useMultiStage,\n  orderLayers,\n  minimizeLayers,\n  useDockerignore,\n];\n","import {\n  collectStageAliases,\n  isHardenedRuntimeImage,\n  isScratch,\n  mutableRefIssue,\n  parseFromArgs,\n  parseImageRef,\n} from \"../parsers/image-ref\";\nimport type { Diagnostic, DockerfileRule } from \"../types/index\";\nimport { createDiagnostic } from \"./create-diagnostic\";\nimport { isLiteralSecretValue, isSecretKey } from \"./secret-keywords\";\n\n// USER accepts \"user\", \"uid\", \"user:group\" and \"uid:gid\". Only the user half\n// decides whether the container runs as root; the group half is irrelevant.\nconst isRootUser = (value: string): boolean => {\n  const [user] = value.split(\":\");\n  return user === \"root\" || user === \"0\";\n};\n\nexport const noRootUser: DockerfileRule = {\n  category: \"Security\",\n  check(instructions, file) {\n    // A stage built FROM a previous stage inherits that stage's image\n    // config, USER included; a fresh base image resets it to root.\n    const stageUser = new Map<string, string>();\n    let currentStage: string | null = null;\n    let lastUser = \"root\";\n    let lastUserLine = 1;\n\n    for (const inst of instructions) {\n      if (inst.instruction === \"FROM\") {\n        const { base, stage } = parseFromArgs(inst.args);\n        // DHI runtime bases default to a nonroot user; \"nonroot\" is a\n        // sentinel that isRootUser treats as safe until a USER overrides it.\n        const baseDefaultUser =\n          base && isHardenedRuntimeImage(base) ? \"nonroot\" : \"root\";\n        lastUser = stageUser.get(base?.toLowerCase() ?? \"\") ?? baseDefaultUser;\n        lastUserLine = inst.line;\n        currentStage = stage?.toLowerCase() ?? null;\n        if (currentStage) {\n          stageUser.set(currentStage, lastUser);\n        }\n      } else if (inst.instruction === \"USER\") {\n        lastUser = inst.args.trim().toLowerCase();\n        lastUserLine = inst.line;\n        if (currentStage) {\n          stageUser.set(currentStage, lastUser);\n        }\n      }\n    }\n\n    if (isRootUser(lastUser)) {\n      return [\n        createDiagnostic(\n          file,\n          this.key,\n          this.defaultSeverity,\n          \"The container runs as root. Running as root allows potential container breakout vulnerabilities.\",\n          this.help,\n          lastUserLine\n        ),\n      ];\n    }\n\n    return [];\n  },\n  defaultSeverity: \"warning\",\n  help: \"Add a non-root user (e.g., `USER node` or `USER 1000`) to improve security.\",\n  key: \"docker-doctor/no-root-user\",\n  message: \"Run the container as a non-root user\",\n};\n\nexport const noSecretsInEnv: DockerfileRule = {\n  category: \"Security\",\n  check(instructions, file) {\n    const diagnostics: Diagnostic[] = [];\n\n    for (const inst of instructions) {\n      if (inst.instruction === \"ENV\" || inst.instruction === \"ARG\") {\n        const args = inst.args.trim();\n        if (inst.instruction === \"ENV\" && !args.includes(\"=\")) {\n          // KEY VALUE format\n          const match = args.match(/^(?<key>[^\\s]+)\\s+(?<value>.*)$/u);\n          if (match?.groups) {\n            const { key, value } = match.groups;\n            const keyIsSecret = isSecretKey(key);\n            if (\n              keyIsSecret &&\n              isLiteralSecretValue(value) &&\n              !value.startsWith(\"{\")\n            ) {\n              diagnostics.push(\n                createDiagnostic(\n                  file,\n                  this.key,\n                  this.defaultSeverity,\n                  `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`,\n                  this.help,\n                  inst.line\n                )\n              );\n            }\n          }\n        } else {\n          // Existing KEY=VALUE logic\n          const parts = args.split(/\\s+/u);\n          for (const part of parts) {\n            const eqIndex = part.indexOf(\"=\");\n            let key = \"\";\n            let value = \"\";\n\n            if (eqIndex > 0) {\n              key = part.slice(0, eqIndex);\n              value = part.slice(eqIndex + 1);\n            } else {\n              key = part;\n            }\n\n            const keyIsSecret = isSecretKey(key);\n            if (\n              keyIsSecret &&\n              isLiteralSecretValue(value) &&\n              !value.startsWith(\"{\")\n            ) {\n              diagnostics.push(\n                createDiagnostic(\n                  file,\n                  this.key,\n                  this.defaultSeverity,\n                  `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`,\n                  this.help,\n                  inst.line\n                )\n              );\n            }\n          }\n        }\n      }\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"error\",\n  help: \"Use Docker Secrets, build arguments passed at runtime, or environment variables at runtime instead of baking them into the image.\",\n  key: \"docker-doctor/no-secrets-in-env\",\n  message: \"Avoid storing secrets in ENV or ARG instructions\",\n};\n\nexport const pinImageVersion: DockerfileRule = {\n  category: \"Security\",\n  check(instructions, file) {\n    const diagnostics: Diagnostic[] = [];\n    const stageAliases = collectStageAliases(instructions);\n\n    for (const inst of instructions) {\n      if (inst.instruction === \"FROM\") {\n        // FROM image or FROM image:tag or FROM image@sha256:hash\n        // Also respect multi-stage builds (AS stageName)\n        const imagePart = parseFromArgs(inst.args).base;\n\n        if (!imagePart || isScratch(imagePart)) {\n          continue;\n        }\n\n        const ref = parseImageRef(imagePart);\n\n        if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) {\n          continue;\n        }\n\n        const issue = mutableRefIssue(ref);\n        if (issue) {\n          const detail =\n            issue === \"untagged\"\n              ? `Base image '${imagePart}' does not specify a tag.`\n              : `Base image '${imagePart}' uses the mutable 'latest' tag.`;\n          diagnostics.push(\n            createDiagnostic(\n              file,\n              this.key,\n              this.defaultSeverity,\n              `${detail} This makes builds non-deterministic.`,\n              this.help,\n              inst.line\n            )\n          );\n        }\n      }\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"warning\",\n  help: \"Specify a concrete tag instead of `latest` or no tag (e.g., `node:22.2.0-alpine` instead of `node`).\",\n  key: \"docker-doctor/pin-image-version\",\n  message: \"Pin base images to a specific tag or digest\",\n};\n\nexport const noAddRemote: DockerfileRule = {\n  category: \"Security\",\n  check(instructions, file) {\n    const diagnostics: Diagnostic[] = [];\n\n    for (const inst of instructions) {\n      if (inst.instruction === \"ADD\") {\n        const parts = inst.args.split(/\\s+/u);\n        const src = parts.find((p) => !p.startsWith(\"--\"));\n\n        if (!src) {\n          continue;\n        }\n\n        if (src.startsWith(\"http://\") || src.startsWith(\"https://\")) {\n          diagnostics.push(\n            createDiagnostic(\n              file,\n              this.key,\n              this.defaultSeverity,\n              `ADD instruction uses a remote URL '${src}'. Remote files added via ADD cannot be cleaned up in later layers, increasing image size.`,\n              this.help,\n              inst.line\n            )\n          );\n        }\n      }\n    }\n\n    return diagnostics;\n  },\n  defaultSeverity: \"warning\",\n  help: \"Use `RUN curl` or `RUN wget` instead of ADD for remote URLs, and delete the downloaded archive in the same layer to minimize size.\",\n  key: \"docker-doctor/no-add-remote\",\n  message: \"Avoid using ADD with remote URLs\",\n};\n\nexport const securityRules = [\n  noRootUser,\n  noSecretsInEnv,\n  pinImageVersion,\n  noAddRemote,\n];\n","import type {\n  DockerfileRule,\n  ComposeRule,\n  RuleDefinition,\n} from \"../types/index\";\nimport { bestPracticesRules } from \"./best-practices\";\nimport { composeRules } from \"./compose\";\nimport { composeModelRules } from \"./compose-models\";\nimport { composeSecurityRules } from \"./compose-security\";\nimport { imageSizeRules } from \"./image-size\";\nimport { performanceRules } from \"./performance\";\nimport { securityRules } from \"./security\";\n\nexport const allDockerfileRules: DockerfileRule[] = [\n  ...securityRules,\n  ...performanceRules,\n  ...bestPracticesRules,\n  ...imageSizeRules,\n];\n\nexport const allComposeRules: ComposeRule[] = [\n  ...composeRules,\n  ...composeSecurityRules,\n  ...composeModelRules,\n];\n\nexport const allRules: RuleDefinition[] = [\n  ...allDockerfileRules,\n  ...allComposeRules,\n];\n\nexport const findRule = (key: string): RuleDefinition | undefined =>\n  allRules.find((rule) => rule.key === key);\n","import type { RuleDefinition, RuleSeverity } from \"../types/index\";\n\n// Precedence: per-rule config > category config > the rule's default.\nexport const resolveSeverity = (\n  rule: RuleDefinition,\n  rulesConfig?: Record<string, RuleSeverity>,\n  categoriesConfig?: Record<string, RuleSeverity>\n): RuleSeverity =>\n  rulesConfig?.[rule.key] ??\n  categoriesConfig?.[rule.category] ??\n  rule.defaultSeverity;\n","import { allDockerfileRules } from \"../rules/index\";\nimport type {\n  DockerfileInstruction,\n  Diagnostic,\n  RuleSeverity,\n} from \"../types/index\";\nimport { resolveSeverity } from \"./resolve-severity\";\n\nexport const runDockerfileRules = (\n  instructions: DockerfileInstruction[],\n  file: string,\n  projectFiles: string[],\n  rulesConfig?: Record<string, RuleSeverity>,\n  categoriesConfig?: Record<string, RuleSeverity>\n): Diagnostic[] => {\n  const diagnostics: Diagnostic[] = [];\n\n  for (const rule of allDockerfileRules) {\n    const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);\n    if (severity === \"off\") {\n      continue;\n    }\n\n    const ruleDiagnostics = rule.check(instructions, file, { projectFiles });\n\n    // Override severity if config resolved to something other than default\n    if (severity !== rule.defaultSeverity) {\n      for (const diag of ruleDiagnostics) {\n        diag.severity = severity;\n      }\n    }\n\n    diagnostics.push(...ruleDiagnostics);\n  }\n\n  return diagnostics;\n};\n","import { allComposeRules } from \"../rules/index\";\nimport type { ComposeLocator, Diagnostic, RuleSeverity } from \"../types/index\";\nimport { resolveSeverity } from \"./resolve-severity\";\n\nexport const runComposeRules = (\n  composeContent: unknown,\n  file: string,\n  rulesConfig?: Record<string, RuleSeverity>,\n  categoriesConfig?: Record<string, RuleSeverity>,\n  locate?: ComposeLocator\n): Diagnostic[] => {\n  const diagnostics: Diagnostic[] = [];\n\n  for (const rule of allComposeRules) {\n    const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);\n    if (severity === \"off\") {\n      continue;\n    }\n\n    const ruleDiagnostics = rule.check(composeContent, file, { locate });\n\n    // Override severity if config resolved to something other than default\n    if (severity !== rule.defaultSeverity) {\n      for (const diag of ruleDiagnostics) {\n        diag.severity = severity;\n      }\n    }\n\n    diagnostics.push(...ruleDiagnostics);\n  }\n\n  return diagnostics;\n};\n","import type {\n  DockerDoctorConfig,\n  RuleCategory,\n  RuleSeverity,\n} from \"../types/index\";\n\nexport type { DockerDoctorConfig } from \"../types/index\";\n\nconst RULE_SEVERITIES: readonly RuleSeverity[] = [\n  \"error\",\n  \"warning\",\n  \"info\",\n  \"off\",\n];\n\nconst RULE_CATEGORIES: readonly RuleCategory[] = [\n  \"Best Practices\",\n  \"Compose\",\n  \"Image Size\",\n  \"Performance\",\n  \"Security\",\n];\n\nconst isPlainObject = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst isRuleSeverity = (value: unknown): value is RuleSeverity =>\n  typeof value === \"string\" &&\n  (RULE_SEVERITIES as readonly string[]).includes(value);\n\nconst validateRules = (value: unknown): Record<string, RuleSeverity> => {\n  if (!isPlainObject(value)) {\n    throw new Error(\n      `Invalid config: \"rules\" must be an object, got ${typeof value}`\n    );\n  }\n\n  for (const [key, severity] of Object.entries(value)) {\n    if (!isRuleSeverity(severity)) {\n      throw new Error(\n        `Invalid severity ${JSON.stringify(severity)} for rule \"${key}\"`\n      );\n    }\n  }\n\n  return value as Record<string, RuleSeverity>;\n};\n\nconst validateCategories = (\n  value: unknown\n): Partial<Record<RuleCategory, RuleSeverity>> => {\n  if (!isPlainObject(value)) {\n    throw new Error(\n      `Invalid config: \"categories\" must be an object, got ${typeof value}`\n    );\n  }\n\n  const result: Partial<Record<RuleCategory, RuleSeverity>> = {};\n  for (const [key, severity] of Object.entries(value)) {\n    if (!(RULE_CATEGORIES as readonly string[]).includes(key)) {\n      // Unknown category keys are silently dropped (matches the\n      // legacy schema's excess-property behavior).\n      continue;\n    }\n    if (!isRuleSeverity(severity)) {\n      throw new Error(\n        `Invalid severity ${JSON.stringify(severity)} for category \"${key}\"`\n      );\n    }\n    result[key as RuleCategory] = severity;\n  }\n\n  return result;\n};\n\nconst validateIgnore = (value: unknown): { files?: string[] } => {\n  if (!isPlainObject(value)) {\n    throw new Error(\n      `Invalid config: \"ignore\" must be an object, got ${typeof value}`\n    );\n  }\n\n  const result: { files?: string[] } = {};\n  if (\"files\" in value && value.files !== undefined) {\n    if (\n      !Array.isArray(value.files) ||\n      !value.files.every((item) => typeof item === \"string\")\n    ) {\n      throw new Error(\n        'Invalid config: \"ignore.files\" must be an array of strings'\n      );\n    }\n    result.files = value.files;\n  }\n\n  return result;\n};\n\nconst describeInvalidTopLevel = (input: unknown): string => {\n  if (input === null) {\n    return \"null\";\n  }\n  if (Array.isArray(input)) {\n    return \"array\";\n  }\n  return typeof input;\n};\n\n/**\n * Validates and normalizes a raw config object, throwing on invalid input.\n *\n * Mirrors the legacy schema's behavior exactly, including silently\n * dropping unknown top-level (and nested) keys rather than throwing\n * or preserving them.\n */\nexport const validateConfig = (input: unknown): DockerDoctorConfig => {\n  if (!isPlainObject(input)) {\n    throw new Error(\n      `Invalid config: expected an object, got ${describeInvalidTopLevel(input)}`\n    );\n  }\n\n  const result: DockerDoctorConfig = {};\n\n  if (\"rules\" in input && input.rules !== undefined) {\n    result.rules = validateRules(input.rules);\n  }\n\n  if (\"categories\" in input && input.categories !== undefined) {\n    result.categories = validateCategories(input.categories);\n  }\n\n  if (\"ignore\" in input && input.ignore !== undefined) {\n    result.ignore = validateIgnore(input.ignore);\n  }\n\n  return result;\n};\n","import { allRules } from \"../rules/index\";\nimport type { RuleCategory } from \"../types/index\";\n\nconst KNOWN_CATEGORIES: readonly RuleCategory[] = [\n  \"Best Practices\",\n  \"Compose\",\n  \"Image Size\",\n  \"Performance\",\n  \"Security\",\n];\n\nexport interface UnknownConfigKeys {\n  categories: string[];\n  rules: string[];\n}\n\nconst keysOf = (value: unknown): string[] =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value)\n    ? Object.keys(value)\n    : [];\n\n// Config keys are matched exactly, so a typo'd rule key -- or a category\n// written as \"security\" instead of \"Security\" -- passes validation and then\n// matches no rule: a suppression the user believes is active silently does\n// nothing. Reported so the caller can warn, deliberately not an error,\n// because a config naming a rule that a later release removed should still\n// scan. Takes the raw config because validation drops unknown category keys\n// before they reach the typed result.\nexport const collectUnknownConfigKeys = (raw: unknown): UnknownConfigKeys => {\n  if (typeof raw !== \"object\" || raw === null) {\n    return { categories: [], rules: [] };\n  }\n\n  const knownRuleKeys = new Set(allRules.map((rule) => rule.key));\n  const knownCategories = new Set<string>(KNOWN_CATEGORIES);\n  const { categories, rules } = raw as {\n    categories?: unknown;\n    rules?: unknown;\n  };\n\n  return {\n    categories: keysOf(categories).filter((key) => !knownCategories.has(key)),\n    rules: keysOf(rules).filter((key) => !knownRuleKeys.has(key)),\n  };\n};\n","import fs from \"node:fs/promises\";\nimport path from \"node:path\";\n\nimport { parse as parseYaml } from \"yaml\";\n\nimport { ConfigError } from \"../errors\";\nimport type { DockerDoctorConfig } from \"../schemas/config\";\nimport { validateConfig } from \"../schemas/config\";\nimport { collectUnknownConfigKeys } from \"./unknown-keys\";\n\nconst fileExists = async (filePath: string): Promise<boolean> => {\n  try {\n    await fs.access(filePath);\n    return true;\n  } catch {\n    return false;\n  }\n};\n\nconst parseConfigFile = async (\n  filePath: string,\n  format: \"JSON\" | \"YAML\",\n  parse: (content: string) => unknown\n): Promise<unknown> => {\n  try {\n    const content = await fs.readFile(filePath, \"utf-8\");\n    return parse(content);\n  } catch (error: unknown) {\n    const msg = error instanceof Error ? error.message : String(error);\n    throw new ConfigError({\n      message: `Failed to parse config ${format}: ${msg}`,\n    });\n  }\n};\n\nconst importConfig = async (filePath: string): Promise<unknown> => {\n  if (filePath.endsWith(\".json\")) {\n    return parseConfigFile(filePath, \"JSON\", JSON.parse);\n  }\n\n  if (filePath.endsWith(\".yaml\") || filePath.endsWith(\".yml\")) {\n    return parseConfigFile(filePath, \"YAML\", parseYaml);\n  }\n\n  try {\n    const configModule = await import(filePath);\n    return configModule.default || configModule;\n  } catch (error: unknown) {\n    const msg = error instanceof Error ? error.message : String(error);\n    throw new ConfigError({\n      message: `Failed to load config file ${filePath}: ${msg}`,\n    });\n  }\n};\n\nconst warnUnknownKeys = (\n  raw: unknown,\n  onWarning: (message: string) => void\n): void => {\n  const unknown = collectUnknownConfigKeys(raw);\n  for (const key of unknown.rules) {\n    onWarning(\n      `Unknown rule \"${key}\" in config — it matches no rule and has no effect.`\n    );\n  }\n  for (const key of unknown.categories) {\n    onWarning(\n      `Unknown category \"${key}\" in config — categories are case-sensitive (e.g. \"Best Practices\", \"Security\").`\n    );\n  }\n};\n\nexport const loadConfig = async (\n  rootDir: string,\n  customPath?: string,\n  // Called once per unrecognized config key. Optional so existing callers are\n  // unaffected; without it, unknown keys stay silent as before.\n  onWarning?: (message: string) => void\n): Promise<DockerDoctorConfig> => {\n  let configObject: unknown = null;\n\n  if (customPath) {\n    const fullPath = path.resolve(rootDir, customPath);\n    if (!(await fileExists(fullPath))) {\n      throw new ConfigError({\n        message: `Specified config file not found at ${fullPath}`,\n      });\n    }\n    configObject = await importConfig(fullPath);\n  } else {\n    const candidates = [\n      \"docker-doctor.config.ts\",\n      \"docker-doctor.config.js\",\n      \"docker-doctor.config.mjs\",\n      \"docker-doctor.config.cjs\",\n      \"docker-doctor.config.json\",\n      \"docker-doctor.config.yaml\",\n      \"docker-doctor.config.yml\",\n    ];\n\n    /* eslint-disable no-await-in-loop */\n    for (const cand of candidates) {\n      const fullPath = path.join(rootDir, cand);\n      if (await fileExists(fullPath)) {\n        configObject = await importConfig(fullPath);\n        break;\n      }\n    }\n    /* eslint-enable no-await-in-loop */\n\n    if (!configObject) {\n      const pkgPath = path.join(rootDir, \"package.json\");\n      if (await fileExists(pkgPath)) {\n        try {\n          const pkgContent = await fs.readFile(pkgPath, \"utf-8\");\n          const pkgJson = JSON.parse(pkgContent);\n          if (pkgJson.dockerDoctor) {\n            configObject = pkgJson.dockerDoctor;\n          }\n        } catch {\n          // ignore package.json read/parse failures\n        }\n      }\n    }\n  }\n\n  if (!configObject) {\n    return {};\n  }\n\n  try {\n    const config = validateConfig(configObject);\n    if (onWarning) {\n      warnUnknownKeys(configObject, onWarning);\n    }\n    return config;\n  } catch (error: unknown) {\n    const msg = error instanceof Error ? error.message : String(error);\n    throw new ConfigError({\n      message: `Invalid configuration format: ${msg}`,\n    });\n  }\n};\n","import type { Diagnostic } from \"./types/index\";\n\nexport const SCORE_BUCKETS = [\n  { emoji: \"🏆\", label: \"Excellent\", min: 90 },\n  { emoji: \"✅\", label: \"Good\", min: 75 },\n  { emoji: \"⚠️\", label: \"Needs Work\", min: 50 },\n  { emoji: \"🚨\", label: \"Critical\", min: 0 },\n] as const;\n\nexport const getScoreBucket = (\n  score: number\n): (typeof SCORE_BUCKETS)[number] => {\n  for (const bucket of SCORE_BUCKETS) {\n    if (score >= bucket.min) {\n      return bucket;\n    }\n  }\n  return SCORE_BUCKETS.at(-1) as (typeof SCORE_BUCKETS)[number];\n};\n\nexport const calculateScore = (\n  diagnostics: Diagnostic[]\n): {\n  score: number;\n  label: string;\n} => {\n  let penalty = 0;\n\n  for (const diag of diagnostics) {\n    if (diag.severity === \"error\") {\n      penalty += 10;\n    } else if (diag.severity === \"warning\") {\n      penalty += 4;\n    } else if (diag.severity === \"info\") {\n      penalty += 1;\n    }\n  }\n\n  // Asymptotic decay curve: score = round(100 * e^(-penalty / K)).\n  //\n  // The old `max(0, 100 - penalty)` formula saturates at 0 once penalty\n  // reaches 100 (e.g. ~10 errors), so a messy project and a catastrophic\n  // one are indistinguishable and the score can never register a fix.\n  // This curve approaches (but never reaches) 0, so it stays monotonic\n  // and responsive across the whole range instead of going inert.\n  //\n  // K=70 was chosen so a single warning (penalty 4) still scores ~94,\n  // comfortably inside the \"Excellent\" (>=90) bucket, while errors and\n  // repeated warnings still meaningfully erode the score. K=40 (the\n  // naive \"half-life at penalty ~28\" choice) was tried first and pushed\n  // a single warning down to ~90 - right on the Excellent/Good boundary,\n  // which is too harsh a penalty for one warning.\n  const K = 70;\n  const score = Math.round(100 * Math.exp(-penalty / K));\n  const bucket = getScoreBucket(score);\n  const label = `${bucket.label} ${bucket.emoji}`;\n\n  return { label, score };\n};\n","import type { Diagnostic, ProjectInfo } from \"./types/index\";\n\n// Bump whenever the JSON report shape or the score formula/weights change.\n// The unversioned shape shipped before this field existed is implicitly 1.\nexport const REPORT_SCHEMA_VERSION = 2;\n\nexport interface JsonReport {\n  diagnostics: {\n    column?: number;\n    file: string;\n    help: string;\n    line?: number;\n    message: string;\n    rule: string;\n    severity: \"error\" | \"warning\" | \"info\";\n  }[];\n  label: string;\n  project: ProjectInfo;\n  schemaVersion: number;\n  score: number;\n  timestamp: string;\n}\n\nexport const toJsonReport = (\n  diagnostics: Diagnostic[],\n  score: number,\n  label: string,\n  project: ProjectInfo\n): JsonReport => ({\n  diagnostics: diagnostics.map((d) => ({\n    column: d.column,\n    file: d.file,\n    help: d.help,\n    line: d.line,\n    message: d.message,\n    rule: d.rule,\n    severity: d.severity,\n  })),\n  label,\n  project,\n  schemaVersion: REPORT_SCHEMA_VERSION,\n  score,\n  timestamp: new Date().toISOString(),\n});\n"],"mappings":";;;;;;;;;;ACAA,MAAM,mBAAmB;;;;;;;;AASzB,MAAM,gBAAgB,YAA4B;CAChD,IAAI,SAAS;CACb,IAAI,QAAQ;CACZ,OAAO,QAAQ,QAAQ,QAAQ;EAC7B,MAAM,OAAO,QAAQ;EACrB,IAAI,SAAS,KAAK;GAChB,IAAI,QAAQ,QAAQ,OAAO,KAAK;IAC9B,IAAI,QAAQ,QAAQ,OAAO,KAAK;KAC9B,UAAU;KACV,SAAS;IACX,OAAO;KACL,UAAU;KACV,SAAS;IACX;GACF,OAAO;IACL,UAAU;IACV,SAAS;GACX;EACF,OAAO,IAAI,SAAS,KAAK;GACvB,UAAU;GACV,SAAS;EACX,OAAO;GACL,UAAU,KAAK,QAAQ,kBAAkB,OAAO,GAAG,KAAK;GACxD,SAAS;EACX;CACF;CACA,OAAO,IAAI,OAAO,GAAG,OAAO,IAAI,GAAG;AACrC;;;;;;AAOA,MAAa,uBACX,aACwC;CACxC,IAAI,CAAC,YAAY,SAAS,WAAW,GACnC,aAAa;CAEf,MAAM,UAAU,SAAS,IAAI,YAAY;CACzC,QAAQ,iBAAiB;EACvB,MAAM,aAAa,aAAa,WAAW,MAAM,GAAG;EACpD,OAAO,QAAQ,MAAM,WAAW,OAAO,KAAK,UAAU,CAAC;CACzD;AACF;;;;AChDA,MAAM,OAAO,OACX,KACA,WAAqB,CAAC,MACA;CACtB,MAAM,QAAQ,MAAM,GAAG,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;CAC3D,MAAM,QAAQ,IACZ,MAAM,IAAI,OAAO,SAAS;EACxB,MAAM,WAAW,KAAK,KAAK,KAAK,KAAK,IAAI;EACzC,IAAI,KAAK,YAAY,GAAG;GACtB,IACE,KAAK,SAAS,kBACd,KAAK,SAAS,UACd,KAAK,SAAS,WACd,KAAK,SAAS,UACd,KAAK,SAAS,UAEd;GAEF,MAAM,KAAK,UAAU,QAAQ;EAC/B,OACE,SAAS,KAAK,QAAQ;CAE1B,CAAC,CACH;CACA,OAAO;AACT;AAEA,MAAa,kBAAkB,OAC7B,SACA,YACyB;CACzB,MAAM,WAAW,MAAM,KAAK,OAAO;CACnC,MAAM,cAAwB,CAAC;CAC/B,MAAM,eAAyB,CAAC;CAChC,MAAM,gBAA0B,CAAC;CACjC,MAAM,YAAY,oBAAoB,SAAS,WAAW;CAE1D,KAAK,MAAM,QAAQ,UAAU;EAC3B,MAAM,WAAW,KAAK,SAAS,SAAS,IAAI;EAC5C,IAAI,UAAU,QAAQ,GACpB;EAEF,MAAM,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY;EAE7C,IAAI,SAAS,iBACX,cAAc,KAAK,QAAQ;EAI7B,IACE,SAAS,gBACT,KAAK,WAAW,aAAa,KAC7B,KAAK,SAAS,aAAa,GAE3B,YAAY,KAAK,QAAQ;EAI3B,IACE,SAAS,wBACT,SAAS,yBACT,SAAS,iBACT,SAAS,mBACP,KAAK,WAAW,iBAAiB,KAAK,KAAK,WAAW,UAAU,OAC/D,KAAK,SAAS,MAAM,KAAK,KAAK,SAAS,OAAO,IAEjD,aAAa,KAAK,QAAQ;CAE9B;CAOA,OAAO;EACL,cAAc,aAAa,SAAS;EACpC,aAAa,YAAY,SAAS;EAClC,eAAe,cAAc,SAAS;CACxC;AACF;;;;ACpFA,MAAM,sCAAsB,IAAI,IAAI;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAGD,MAAM,uCAAuB,IAAI,IAAI;CAAC;CAAO;CAAQ;AAAK,CAAC;AAE3D,MAAM,sBAAsB;AAe5B,MAAM,oBACJ;AAaF,MAAM,2BAAwC;CAC5C,aAAa;CACb,oBAAoB;CACpB,cAAc,CAAC;CACf,cAAc,CAAC;CACf,gBAAgB,CAAC;CACjB,WAAW;AACb;AAEA,MAAM,oBAAoB,UAA6B;CACrD,IAAI,MAAM,oBACR,MAAM,aAAa,KAAK;EACtB,MAAM,MAAM;EACZ,aAAa,MAAM;EACnB,MAAM,MAAM;EACZ,KAAK,MAAM,eAAe,KAAK,IAAI;CACrC,CAAC;CAEH,MAAM,qBAAqB;CAC3B,MAAM,cAAc;CACpB,MAAM,iBAAiB,CAAC;AAC1B;AAEA,MAAM,2BACJ,gBACiD;CACjD,MAAM,QAAQ,YAAY,MAAM,mBAAmB;CACnD,MAAM,cAAc,OAAO,QAAQ,KAAK,YAAY;CACpD,IAAI,eAAe,oBAAoB,IAAI,WAAW,GACpD,OAAO;EAAE,MAAM,OAAO,QAAQ,QAAQ;EAAI,aAAa;CAAY;CAGrE,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC,YAAY;CAC5C,IAAI,oBAAoB,IAAI,IAAI,GAC9B,OAAO;EAAE,MAAM;EAAI,aAAa;CAAK;CAGvC,OAAO;AACT;AAEA,MAAM,yBAAyB,gBAC7B,CAAC,GAAG,YAAY,SAAS,iBAAiB,CAAC,CAAC,CAAC,KAC1C,MAAM,EAAE,QAAQ,SAAS,EAC5B;AAMF,MAAM,sBAAsB,OAAoB,YAA0B;CACxE,IAAI,YAAY,MAAM,aAAa,IACjC,MAAM,aAAa,MAAM;MAEzB,MAAM,gBAAgB,MAAM,cAAc,MAAM,MAAM;CAGxD,IAAI,MAAM,aAAa,WAAW,GAEhC,iBAAiB,KAAK;AAE1B;AAEA,MAAM,0BACJ,OACA,SACA,YACS;CACT,IAAI,cAAc;CAElB,MAAM,kBAAkB,YAAY,SAAS,IAAI;CACjD,IAAI,iBACF,cAAc,YAAY,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK;CAG9C,IAAI,MAAM,oBACR,MAAM,gBAAgB,MAAM,cAAc,MAAM,MAAM;MACjD;EACL,MAAM,YAAY;EAElB,MAAM,UAAU,wBAAwB,WAAW;EACnD,IAAI,SAAS;GACX,MAAM,qBAAqB,QAAQ;GACnC,MAAM,cAAc,QAAQ;EAC9B;CACF;CAEA,IAAI,qBAAqB,IAAI,MAAM,kBAAkB,GACnD,MAAM,aAAa,KAAK,GAAG,sBAAsB,WAAW,CAAC;CAG/D,IAAI,MAAM,aAAa,SAAS,GAG9B;CAGF,IAAI,CAAC,iBACH,iBAAiB,KAAK;AAE1B;AAEA,MAAa,mBAAmB,YAA6C;CAC3E,MAAM,QAAQ,kBAAkB;CAChC,MAAM,QAAQ,QAAQ,MAAM,QAAQ;CAEpC,KAAK,MAAM,CAAC,GAAG,YAAY,MAAM,QAAQ,GAAG;EAC1C,MAAM,UAAU,QAAQ,KAAK;EAC7B,MAAM,UAAU,IAAI;EACpB,MAAM,gBAAgB,MAAM,aAAa,SAAS;EAKlD,IAAI,CAAC,iBAAiB,QAAQ,WAAW,GAAG,GAC1C;EAIF,IAAI,CAAC,MAAM,sBAAsB,CAAC,iBAAiB,YAAY,IAC7D;EAGF,MAAM,eAAe,KAAK,OAAO;EAEjC,IAAI,eACF,mBAAmB,OAAO,OAAO;OAEjC,uBAAuB,OAAO,SAAS,OAAO;CAElD;CAIA,iBAAiB,KAAK;CAEtB,OAAO,MAAM;AACf;;;;AC/LA,IAAa,cAAb,cAAiC,MAAM;CACrC,AAAS,OAAO;CAEhB,YAAY,SAAuC;EACjD,MAAM,QAAQ,OAAO;EACrB,KAAK,OAAO;CACd;AACF;;;;ACPA,IAAa,aAAb,cAAgC,MAAM;CACpC,AAAS,OAAO;CAChB,AAAS;CAET,YAAY,SAA8D;EACxE,MAAM,QAAQ,OAAO;EACrB,KAAK,OAAO;EACZ,KAAK,OAAO,QAAQ;CACtB;AACF;;;;ACIA,MAAa,gBAAgB,SAAiB,aAA8B;CAC1E,IAAI;EAGF,OAAO,MAAM,SAAS,EAAE,OAAO,KAAK,CAAC;CACvC,SAAS,OAAgB;EACvB,MAAM,IAAI,WAAW;GACnB,MAAM;GACN,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAChE,CAAC;CACH;AACF;;;;;;;;;AAUA,MAAa,wBAAwB,YAAoC;CACvE,MAAM,cAAc,IAAI,YAAY;CACpC,MAAM,MAAM,cAAc,SAAS;EAAE;EAAa,OAAO;CAAK,CAAC;CAE/D,QAAQ,SAAS;EACf,IAAI,OAAgB,IAAI;EACxB,IAAI;EAEJ,KAAK,MAAM,WAAW,MAAM;GAC1B,IAAI,QAAQ,IAAI,GACd,OAAO,KAAK,QAAQ,GAAG;GAEzB,IAAI,MAAM,IAAI,GAAG;IACf,MAAM,OAAO,KAAK,MAAM,MACrB,SACC,SAAS,KAAK,GAAG,KAAK,OAAO,KAAK,IAAI,KAAK,MAAM,OAAO,OAAO,CACnE;IACA,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,GAAG,GAC7B;IAEF,SAAS,KAAK,IAAI,QAAQ;IAC1B,OAAO,KAAK;GACd,OAAO,IAAI,MAAM,IAAI,KAAK,OAAO,YAAY,UAAU;IACrD,MAAM,OAAO,KAAK,MAAM;IACxB,IAAI,SAAS,UAAa,SAAS,MACjC;IAEF,SAAU,KACP,QAAQ;IACX,OAAO;GACT,OACE;EAEJ;EAEA,OAAO,WAAW,SAAY,SAAY,YAAY,QAAQ,MAAM,CAAC,CAAC;CACxE;AACF;;;;AC/DA,MAAa,iBAAiB,SAAkC;CAC9D,MAAM,UAAU,KAAK,KAAK;CAG1B,IAAI,CAAC,QAAQ,WAAW,GAAG,GACzB,OAAO;CAGT,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,OAAO;CAC7B,QAAQ;EACN,OAAO;CACT;CAEA,IAAI,CAAC,MAAM,QAAQ,MAAM,GACvB,OAAO;CAET,IAAI,CAAC,OAAO,OAAO,OAAqB,OAAO,OAAO,QAAQ,GAC5D,OAAO;CAGT,OAAO;AACT;;;;ACrBA,MAAa,iBAAiB,QAA0B;CACtD,IAAI,IAAI,SAAS,IAAI,KAAK,IAAI,WAAW,GAAG,GAC1C,OAAO;EAAE,YAAY;EAAM,MAAM;CAAI;CAGvC,IAAI,YAAY;CAChB,IAAI;CAEJ,MAAM,UAAU,UAAU,QAAQ,GAAG;CACrC,IAAI,YAAY,IAAI;EAClB,SAAS,UAAU,MAAM,UAAU,CAAC;EACpC,YAAY,UAAU,MAAM,GAAG,OAAO;CACxC;CAEA,IAAI;CACJ,MAAM,iBAAiB,UAAU,YAAY,GAAG;CAChD,MAAM,iBAAiB,UAAU,YAAY,GAAG;CAEhD,IAAI,mBAAmB,MAAM,iBAAiB,gBAAgB;EAC5D,MAAM,UAAU,MAAM,iBAAiB,CAAC;EACxC,YAAY,UAAU,MAAM,GAAG,cAAc;CAC/C;CAEA,IAAI;CACJ,MAAM,kBAAkB,UAAU,QAAQ,GAAG;CAC7C,IAAI,oBAAoB,IAAI;EAC1B,MAAM,eAAe,UAAU,MAAM,GAAG,eAAe;EACvD,IACE,aAAa,SAAS,GAAG,KACzB,aAAa,SAAS,GAAG,KACzB,iBAAiB,aACjB;GACA,WAAW;GACX,YAAY,UAAU,MAAM,kBAAkB,CAAC;EACjD;CACF;CAEA,OAAO;EACL;EACA,YAAY;EACZ,MAAM;EACN;EACA;CACF;AACF;;;;;;;AAQA,MAAa,mBAAmB,cAC9B,UAAU,YAAY,CAAC,CAAC,WAAW,SAAS;;;;;;AAO9C,MAAa,0BAA0B,cAA+B;CACpE,IAAI,CAAC,gBAAgB,SAAS,GAC5B,OAAO;CAET,MAAM,EAAE,QAAQ,cAAc,SAAS;CACvC,OAAO,EAAE,QAAQ,SAAS,KAAK,SAAS,MAAM;AAChD;;;;;;;AAQA,MAAa,mBACX,QACsC;CACtC,IAAI,EAAE,IAAI,OAAO,IAAI,SACnB,OAAO;CAET,IAAI,IAAI,QAAQ,YAAY,CAAC,IAAI,QAC/B,OAAO;AAGX;AAQA,MAAa,iBAAiB,SAA2B;CACvD,MAAM,QAAQ,KAAK,MAAM,MAAM,CAAC,CAAC,OAAO,OAAO;CAC/C,MAAM,UAAU,MAAM,WAAW,MAAM,EAAE,YAAY,MAAM,IAAI;CAE/D,OAAO;EACL,OAFiB,YAAY,KAAK,QAAQ,MAAM,MAAM,GAAG,OAAO,EAEhD,CAAC,MAAM,MAAM,CAAC,EAAE,WAAW,IAAI,CAAC,KAAK;EACrD,OAAO,YAAY,KAAK,OAAQ,MAAM,UAAU,MAAM;CACxD;AACF;AAKA,MAAa,aAAa,SACxB,MAAM,YAAY,MAAM;AAE1B,MAAa,uBACX,iBACgB;CAChB,MAAM,0BAAU,IAAI,IAAY;CAEhC,KAAK,MAAM,QAAQ,cAAc;EAC/B,IAAI,KAAK,gBAAgB,QACvB;EAGF,MAAM,EAAE,UAAU,cAAc,KAAK,IAAI;EACzC,IAAI,OACF,QAAQ,IAAI,MAAM,YAAY,CAAC;CAEnC;CAEA,OAAO;AACT;;;;ACrIA,MAAa,oBACX,MACA,SACA,UACA,SACA,MACA,UACgB;CAAE;CAAM;CAAM;CAAM;CAAS,MAAM;CAAS;AAAS;;;;ACJvE,MAAa,qBAAqC;CAChD,UAAU;CACV,MAAM,cAAc,MAAM;EACxB,MAAM,iBAAiB,aAAa,MACjC,SAAS,KAAK,gBAAgB,aACjC;EAGA,MAAM,yBAAyB,aAAa,MACzC,SACC,KAAK,gBAAgB,YACrB,KAAK,gBAAgB,SACrB,KAAK,gBAAgB,YACzB;EAEA,IAAI,CAAC,kBAAkB,wBACrB,OAAO,CACL,iBACE,MACA,KAAK,KACL,KAAK,iBACL,oHACA,KAAK,MACL,CACF,CACF;EAEF,OAAO,CAAC;CACV;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,oBAAoC;CAC/C,UAAU;CACV,MAAM,cAAc,MAAM;EACxB,MAAM,cAA4B,CAAC;EAEnC,KAAK,MAAM,QAAQ,cACjB,IAAI,KAAK,gBAAgB,OAAO;GAE9B,MAAM,MADQ,KAAK,KAAK,MAAM,MACd,CAAC,CAAC,MAAM,MAAM,CAAC,EAAE,WAAW,IAAI,CAAC;GAEjD,IAAI,CAAC,KACH;GAIF,MAAM,WACJ,IAAI,WAAW,SAAS,KAAK,IAAI,WAAW,UAAU;GACxD,MAAM,YACJ,IAAI,SAAS,MAAM,KACnB,IAAI,SAAS,SAAS,KACtB,IAAI,SAAS,MAAM,KACnB,IAAI,SAAS,MAAM;GAErB,IAAI,CAAC,YAAY,CAAC,WAChB,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,4CAA4C,KAAK,KAAK,2DACtD,KAAK,MACL,KAAK,IACP,CACF;EAEJ;EAGF,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,cAA8B;CACzC,UAAU;CACV,MAAM,cAAc,MAAM;EACxB,MAAM,cAA4B,CAAC;EAEnC,KAAK,MAAM,QAAQ,cAKjB,KAHE,KAAK,gBAAgB,SAAS,KAAK,gBAAgB,iBAGhC,cAAc,KAAK,IAAI,MAAM,MAChD,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,GAAG,KAAK,YAAY,yJACpB,KAAK,MACL,KAAK,IACP,CACF;EAIJ,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,gBAAgC;CAC3C,UAAU;CACV,MAAM,cAAc,MAAM;EAExB,IAAI,CADa,aAAa,MAAM,SAAS,KAAK,gBAAgB,OACtD,GACV,OAAO,CACL,iBACE,MACA,KAAK,KACL,KAAK,iBACL,kIACA,KAAK,MACL,CACF,CACF;EAEF,OAAO,CAAC;CACV;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,0BAA0C;CACrD,UAAU;CACV,MAAM,cAAc,MAAM;EACxB,MAAM,cAA4B,CAAC;EACnC,KAAK,MAAM,QAAQ,cACjB,IAAI,KAAK,gBAAgB,OAAO;GAC9B,MAAM,YAAY,KAAK,KAAK,SAAS,gBAAgB;GACrD,MAAM,aAAa,KAAK,KAAK,SAAS,iBAAiB;GAEvD,IAAI,aAAa,CAAC,YAChB,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,8HACA,KAAK,MACL,KAAK,IACP,CACF;QACK,IAAI,cAAc,CAAC,WACxB,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,2IACA,KAAK,MACL,KAAK,IACP,CACF;EAEJ;EAEF,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AASA,MAAa,sBAAsB;AAGnC,MAAM,cAAc;AAKpB,MAAM,iCAAiC,SAA0B;CAC/D,MAAM,OAAO,cAAc,IAAI;CAC/B,OAAO,SAAS,QAAQ,oBAAoB,KAAK,KAAK,KAAK,GAAG,CAAC;AACjE;AAEA,MAAa,cAA8B;CACzC,UAAU;CACV,MAAM,cAAc,MAAM;EACxB,MAAM,cAA4B,CAAC;EAOnC,MAAM,gCAAgB,IAAI,IAAqB;EAC/C,IAAI,mBAAmB;EACvB,IAAI,eAA8B;EAClC,KAAK,MAAM,QAAQ,cAAc;GAC/B,IAAI,KAAK,gBAAgB,QAAQ;IAC/B,MAAM,EAAE,MAAM,UAAU,cAAc,KAAK,IAAI;IAG/C,MAAM,cAAc,UAAU,IAAI,IAC9B,OACC,MAAM,YAAY,KAAK;IAC5B,mBACE,gBAAgB,QAAQ,cAAc,IAAI,WAAW,MAAM;IAC7D,eAAe,OAAO,YAAY,KAAK;IACvC,IAAI,cACF,cAAc,IAAI,cAAc,gBAAgB;IAElD;GACF;GACA,IAAI,KAAK,gBAAgB,SAAS;IAChC,mBAAmB,8BAA8B,KAAK,IAAI;IAC1D,IAAI,cACF,cAAc,IAAI,cAAc,gBAAgB;IAElD;GACF;GACA,IAAI,KAAK,gBAAgB,OACvB;GAEF,MAAM,EAAE,SAAS;GACjB,IAAI,CAAC,YAAY,KAAK,IAAI,GACxB;GAIF,MAAM,WAAW,cAAc,IAAI;GAKnC,IAAI,EAHF,aAAa,OACT,oBAAoB,oBAAoB,KAAK,IAAI,IACjD,oBAAoB,KAAK,SAAS,KAAK,GAAG,CAAC,IAE/C,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,2IACA,KAAK,MACL,KAAK,IACP,CACF;EAEJ;EACA,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,kBAAkC;CAC7C,UAAU;CACV,MAAM,cAAc,MAAM;EACxB,MAAM,cAA4B,CAAC;EACnC,KAAK,MAAM,QAAQ,cACjB,IAAI,KAAK,gBAAgB,WAAW;GAClC,MAAM,OAAO,KAAK,KAAK,KAAK;GAG5B,IAAI,CAFe,2BAA2B,KAAK,IAErC,GACZ,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,sCAAsC,KAAK,6DAC3C,KAAK,MACL,KAAK,IACP,CACF;EAEJ;EAEF,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,aAA6B;CACxC,UAAU;CACV,MAAM,cAAc,MAAM;EACxB,MAAM,cAA4B,CAAC;EACnC,KAAK,MAAM,QAAQ,cACjB,IAAI,KAAK,gBAAgB,SAAS,UAAU,KAAK,KAAK,IAAI,GACxD,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,mHACA,KAAK,MACL,KAAK,IACP,CACF;EAGJ,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,oBAAoC;CAC/C,UAAU;CACV,MAAM,cAAc,MAAM;EACxB,MAAM,cAA4B,CAAC;EACnC,KAAK,MAAM,QAAQ,cACjB,IAAI,KAAK,gBAAgB,OAAO;GAC9B,MAAM,EAAE,QAAQ;GAChB,MAAM,mBACJ,IAAI,SAAS,iBAAiB,KAC9B,IAAI,SAAS,SAAS,KACtB,IAAI,SAAS,aAAa,KAC1B,IAAI,SAAS,aAAa;GAE5B,MAAM,kBAAkB,IAAI,SAAS,MAAM,KAAK,IAAI,SAAS,QAAQ;GAErE,IAAI,oBAAoB,iBAAiB;IAEvC,MAAM,WADQ,IAAI,MAAM,QACH,CAAC,CACnB,MAAM,CAAC,CAAC,CACR,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,CAC1B,QACE,SACC,SAAS,MACT,CAAC,KAAK,WAAW,IAAI,KACrB,CAAC,KAAK,WAAW,GAAG,KACpB,CAAC,KAAK,SAAS,QAAQ,CAC3B,CAAC,CACA,KAAK,SACJ,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,IACnD,CAAC,CACA,OAAO,OAAO;IAEjB,IAAI,SAAS,SAAS,GAAG;KACvB,MAAM,SAAS,SAAS,UAAU,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;KAE7D,IAAI,CADa,SAAS,OAAO,KAAK,QAAQ,QAAQ,OAAO,IACjD,GACV,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,uIACA,KAAK,MACL,KAAK,IACP,CACF;IAEJ;GACF;EACF;EAEF,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,mBAAmC;CAC9C,UAAU;CACV,MAAM,cAAc,MAAM;EACxB,MAAM,cAA4B,CAAC;EACnC,KAAK,MAAM,QAAQ,cACjB,IACE,KAAK,gBAAgB,SACrB,eAAe,KAAK,KAAK,IAAI,KAC7B,CAAC,KAAK,KAAK,SAAS,eAAe,GAEnC,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,8KACA,KAAK,MACL,KAAK,IACP,CACF;EAGJ,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,qBAAqB;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;;;;;ACzaA,MAAa,mBACX,mBACwC;CACxC,IACE,CAAC,kBACD,OAAO,mBAAmB,YAC1B,EAAE,cAAc,iBAEhB,OAAO,CAAC;CAEV,MAAM,EAAE,aAAa;CACrB,IAAI,CAAC,YAAY,OAAO,aAAa,UACnC,OAAO,CAAC;CAGV,MAAM,UAA+C,CAAC;CACtD,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,QAAQ,GAClD,IAAI,WAAW,QAAQ,WAAW,QAChC,QAAQ,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;MAClB,IAAI,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAC5D,QAAQ,KAAK,CAAC,MAAM,MAAiC,CAAC;CAG1D,OAAO;AACT;;;;AC1BA,MAAa,eAA4B;CACvC,UAAU;CACV,MAAM,gBAAgB,MAAM,SAAS;EACnC,IACE,kBACA,OAAO,mBAAmB,YAC1B,aAAa,gBAEb,OAAO,CACL,iBACE,MACA,KAAK,KACL,KAAK,iBACL,0FACA,KAAK,MACL,SAAS,SAAS,CAAC,SAAS,CAAC,CAC/B,CACF;EAEF,OAAO,CAAC;CACV;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,wBAAqC;CAChD,UAAU;CACV,MAAM,gBAAgB,MAAM,SAAS;EACnC,MAAM,cAA4B,CAAC;EAEnC,KAAK,MAAM,CAAC,MAAM,WAAW,gBAAgB,cAAc,GAAG;GAK5D,MAAM,UAJS,OAAO,QACI,UAGF,EAAE;GAC1B,MAAM,kBAAkB,QAAQ,QAAQ,QAAQ,QAAQ,MAAM;GAE9D,MAAM,wBAAwB,QAC5B,OAAO,aAAa,OAAO,QAAQ,OAAO,SAC5C;GAEA,IAAI,EAAE,mBAAmB,wBACvB,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,YAAY,KAAK,sGACjB,KAAK,MACL,SAAS,SAAS,CAAC,YAAY,IAAI,CAAC,CACtC,CACF;EAEJ;EAEA,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,uBAAoC;CAC/C,UAAU;CACV,MAAM,gBAAgB,MAAM,SAAS;EACnC,MAAM,cAA4B,CAAC;EAEnC,KAAK,MAAM,CAAC,MAAM,WAAW,gBAAgB,cAAc,GAAG;GAC5D,MAAM,aAAa,aAAa;GAEhC,MAAM,mBADS,OAAO,QACW,mBAAmB;GAEpD,IAAI,CAAC,cAAc,CAAC,kBAClB,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,YAAY,KAAK,gGACjB,KAAK,MACL,SAAS,SAAS,CAAC,YAAY,IAAI,CAAC,CACtC,CACF;EAEJ;EAEA,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,wBAAqC;CAChD,UAAU;CACV,MAAM,gBAAgB,MAAM,SAAS;EACnC,MAAM,cAA4B,CAAC;EAEnC,KAAK,MAAM,CAAC,MAAM,WAAW,gBAAgB,cAAc,GAAG;GAC5D,MAAM,YAAY,OAAO;GACzB,IAAI,aAAa,MAAM,QAAQ,SAAS,GACtC,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,YAAY,KAAK,+GACjB,KAAK,MACL,SAAS,SAAS;IAAC;IAAY;IAAM;GAAY,CAAC,KAChD,SAAS,SAAS,CAAC,YAAY,IAAI,CAAC,CACxC,CACF;EAEJ;EAEA,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,kBAA+B;CAC1C,UAAU;CACV,MAAM,gBAAgB,MAAM,SAAS;EACnC,MAAM,cAA4B,CAAC;EAEnC,KAAK,MAAM,CAAC,MAAM,WAAW,gBAAgB,cAAc,GAAG;GAC5D,MAAM,EAAE,UAAU;GAGlB,IAAI,OAAO,UAAU,YAAY,WAAW,QAC1C;GAGF,MAAM,MAAM,cAAc,KAAK;GAC/B,IAAI,IAAI,YACN;GAGF,MAAM,QAAQ,gBAAgB,GAAG;GACjC,IAAI,CAAC,OACH;GAEF,MAAM,SACJ,UAAU,aACN,YAAY,KAAK,WAAW,MAAM,6BAClC,YAAY,KAAK,WAAW,MAAM;GACxC,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,GAAG,OAAO,2CACV,KAAK,MACL,SAAS,SAAS;IAAC;IAAY;IAAM;GAAO,CAAC,CAC/C,CACF;EACF;EAEA,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,eAAe;CAC1B;CACA;CACA;CACA;CACA;AACF;;;;;;;;AChLA,MAAM,kBAAkB,mBAAqD;CAC3E,IACE,CAAC,kBACD,OAAO,mBAAmB,YAC1B,EAAE,YAAY,iBAEd,OAAO,CAAC;CAEV,MAAM,EAAE,WAAW;CACnB,IAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAC/D,OAAO,CAAC;CAEV,OAAO;AACT;AAEA,MAAa,0BAAuC;CAClD,UAAU;CACV,MAAM,gBAAgB,MAAM,SAAS;EACnC,MAAM,cAA4B,CAAC;EACnC,MAAM,UAAU,IAAI,IAAI,OAAO,KAAK,eAAe,cAAc,CAAC,CAAC;EAEnE,MAAM,QACJ,aACA,WACA,aACG;GACH,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,YAAY,YAAY,sBAAsB,UAAU,uFACxD,KAAK,MACL,SAAS,SAAS;IAAC;IAAY;IAAa;IAAU;GAAQ,CAAC,CACjE,CACF;EACF;EAEA,KAAK,MAAM,CAAC,MAAM,WAAW,gBAAgB,cAAc,GAAG;GAC5D,MAAM,EAAE,WAAW;GACnB,IAAI,MAAM,QAAQ,MAAM,GAEtB;SAAK,MAAM,CAAC,OAAO,UAAU,OAAO,QAAQ,GAC1C,IAAI,OAAO,UAAU,YAAY,CAAC,QAAQ,IAAI,KAAK,GACjD,KAAK,MAAM,OAAO,KAAK;GAE3B,OACK,IAAI,UAAU,OAAO,WAAW,UAErC;SAAK,MAAM,aAAa,OAAO,KAAK,MAAM,GACxC,IAAI,CAAC,QAAQ,IAAI,SAAS,GACxB,KAAK,MAAM,WAAW,SAAS;GAEnC;EAEJ;EAEA,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAUA,MAAM,wBAAwB,mBAA4C;CACxE,MAAM,WAA2B,CAAC;CAElC,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,eAAe,cAAc,CAAC,GAAG;EAC3E,IAAI,CAAC,UAAU,OAAO,WAAW,UAC/B;EAEF,MAAM,EAAE,UAAU;EAClB,IAAI,OAAO,UAAU,UACnB,SAAS,KAAK;GACZ;GACA,MAAM;IAAC;IAAU;IAAM;GAAO;GAC9B,SAAS,UAAU,KAAK;EAC1B,CAAC;CAEL;CAEA,KAAK,MAAM,CAAC,MAAM,WAAW,gBAAgB,cAAc,GAAG;EAC5D,MAAM,EAAE,aAAa;EACrB,IAAI,CAAC,YAAY,OAAO,aAAa,UACnC;EAEF,MAAM,EAAE,MAAM,YAAY;EAC1B,IAAI,SAAS,WAAW,CAAC,WAAW,OAAO,YAAY,UACrD;EAEF,MAAM,EAAE,UAAU;EAClB,IAAI,OAAO,UAAU,UACnB,SAAS,KAAK;GACZ;GACA,MAAM;IAAC;IAAY;IAAM;IAAY;IAAW;GAAO;GACvD,SAAS,YAAY,KAAK;EAC5B,CAAC;CAEL;CAEA,OAAO;AACT;AAEA,MAAa,kBAA+B;CAC1C,UAAU;CACV,MAAM,gBAAgB,MAAM,SAAS;EACnC,MAAM,cAA4B,CAAC;EAEnC,KAAK,MAAM,EAAE,SAAS,OAAO,UAAU,qBACrC,cACF,GAAG;GACD,MAAM,MAAM,cAAc,KAAK;GAC/B,IAAI,IAAI,YACN;GAGF,MAAM,QAAQ,gBAAgB,GAAG;GACjC,IAAI,CAAC,OACH;GAEF,MAAM,SACJ,UAAU,aACN,GAAG,QAAQ,IAAI,MAAM,6BACrB,GAAG,QAAQ,IAAI,MAAM;GAC3B,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,GAAG,OAAO,2CACV,KAAK,MACL,SAAS,SAAS,IAAI,CACxB,CACF;EACF;EAEA,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,oBAAoB,CAAC,yBAAyB,eAAe;;;;AC/J1E,MAAM,sBAAyC;CAE7C;CACA;CACA;CACA;CACA;CACA;CACA;CAEA;AACF;AAEA,MAAa,eAAe,QAC1B,oBAAoB,MAAM,UAAU,MAAM,KAAK,GAAG,CAAC;AAGrD,MAAM,sBAAsB;AAE5B,MAAa,wBAAwB,UACnC,MAAM,SAAS,KACf,CAAC,MAAM,WAAW,GAAG,KACrB,CAAC,oBAAoB,KAAK,KAAK;;;;ACpBjC,MAAa,sBAAmC;CAC9C,UAAU;CACV,MAAM,gBAAgB,MAAM,SAAS;EACnC,MAAM,cAA4B,CAAC;EAEnC,KAAK,MAAM,CAAC,MAAM,WAAW,gBAAgB,cAAc,GACzD,IAAI,OAAO,eAAe,MACxB,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,YAAY,KAAK,yJACjB,KAAK,MACL,SAAS,SAAS;GAAC;GAAY;GAAM;EAAY,CAAC,CACpD,CACF;EAIJ,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAM,uBAAuB;AAI7B,MAAM,6BAA6B;AACnC,MAAM,gCAAgC;AAEtC,MAAM,gCAAgC,UACpC,MACG,QAAQ,6BAA6B,QAAQ,aAAqB,QAAQ,CAAC,CAC3E,QAAQ,+BAA+B,EAAE;AAI9C,MAAM,cAAc;AAEpB,MAAM,sBAAsB,YAA6B;CACvD,MAAM,aAAa,QAAQ,WAAW,MAAM,GAAG;CAC/C,OACE,YAAY,KAAK,UAAU,MAC1B,WAAW,SAAS,cAAc,KACjC,WAAW,SAAS,qBAAqB;AAE/C;AAGA,MAAM,oBAAoB,SAA2B;CACnD,MAAM,QAAkB,CAAC;CACzB,IAAI,QAAQ;CACZ,IAAI,UAAU;CACd,KAAK,MAAM,QAAQ,MAAM;EACvB,IAAI,SAAS,KACX,SAAS;OACJ,IAAI,SAAS,KAClB,QAAQ,KAAK,IAAI,GAAG,QAAQ,CAAC;EAE/B,IAAI,SAAS,OAAO,UAAU,GAAG;GAC/B,MAAM,KAAK,OAAO;GAClB,UAAU;GACV;EACF;EACA,WAAW;CACb;CACA,MAAM,KAAK,OAAO;CAClB,OAAO;AACT;AAOA,MAAM,eAAe,WAA6C;CAChE,IAAI,OAAO,WAAW,UAAU;EAC9B,MAAM,CAAC,QAAQ,UAAU,iBAAiB,MAAM;EAEhD,OAAO,WAAW,SAAY,SAAY;GAAE;GAAQ;EAAO;CAC7D;CACA,IAAI,UAAU,OAAO,WAAW,UAAU;EACxC,MAAM,EAAE,QAAQ,WAAW;EAC3B,OAAO;GACL,QAAQ,OAAO,WAAW,WAAW,SAAS;GAC9C,QAAQ,OAAO,WAAW,WAAW,SAAS;EAChD;CACF;AAEF;AAEA,MAAM,sBAAsB,WAA6B;CACvD,MAAM,QAAQ,YAAY,MAAM;CAChC,IAAI,CAAC,OAAO,QACV,OAAO;CAET,MAAM,iBAAiB,6BAA6B,MAAM,MAAM;CAChE,IAAI,mBAAmB,IACrB,OAAO,mBAAmB,cAAc;CAG1C,OACE,6BAA6B,MAAM,UAAU,EAAE,MAAM;AAEzD;AAEA,MAAa,sBAAmC;CAC9C,UAAU;CACV,MAAM,gBAAgB,MAAM,SAAS;EACnC,MAAM,cAA4B,CAAC;EAEnC,KAAK,MAAM,CAAC,MAAM,WAAW,gBAAgB,cAAc,GAAG;GAC5D,MAAM,EAAE,YAAY;GACpB,IAAI,CAAC,MAAM,QAAQ,OAAO,GACxB;GAEF,KAAK,MAAM,CAAC,OAAO,WAAW,QAAQ,QAAQ,GAC5C,IAAI,mBAAmB,MAAM,GAC3B,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,YAAY,KAAK,6KACjB,KAAK,MACL,SAAS,SAAS;IAAC;IAAY;IAAM;IAAW;GAAK,CAAC,CACxD,CACF;EAGN;EAEA,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,qBAAkC;CAC7C,UAAU;CACV,MAAM,gBAAgB,MAAM,SAAS;EACnC,MAAM,cAA4B,CAAC;EAEnC,MAAM,QAAQ,MAAc,KAAa,SAA6B;GACpE,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,gCAAgC,KAAK,kBAAkB,IAAI,kEAC3D,KAAK,MACL,IACF,CACF;EACF;EAEA,KAAK,MAAM,CAAC,MAAM,WAAW,gBAAgB,cAAc,GAAG;GAC5D,MAAM,EAAE,gBAAgB;GAExB,IAAI,MAAM,QAAQ,WAAW,GAG3B,KAAK,MAAM,CAAC,OAAO,UAAU,YAAY,QAAQ,GAAG;IAClD,IAAI,OAAO,UAAU,UACnB;IAEF,MAAM,UAAU,MAAM,QAAQ,GAAG;IACjC,IAAI,WAAW,GACb;IAEF,MAAM,MAAM,MAAM,MAAM,GAAG,OAAO;IAClC,MAAM,QAAQ,MAAM,MAAM,UAAU,CAAC;IACrC,IACE,YAAY,GAAG,KACf,OAAO,UAAU,YACjB,qBAAqB,KAAK,GAE1B,KACE,MACA,KACA,SAAS,SAAS;KAAC;KAAY;KAAM;KAAe;IAAK,CAAC,CAC5D;GAEJ;QACK,IAAI,eAAe,OAAO,gBAAgB,UAC/C;SAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,WAAW,GACnD,IACE,YAAY,GAAG,KACf,OAAO,UAAU,YACjB,qBAAqB,KAAK,GAE1B,KACE,MACA,KACA,SAAS,SAAS;KAAC;KAAY;KAAM;KAAe;IAAG,CAAC,CAC1D;GAEJ;EAEJ;EAEA,OAAO;CACT;CACA,iBAAiB;CAEjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,uBAAuB;CAClC;CACA;CACA;AACF;;;;ACpNA,MAAa,iBAAiC;CAC5C,UAAU;CACV,MAAM,cAAc,MAAM;EACxB,MAAM,cAA4B,CAAC;EACnC,MAAM,eAAe,oBAAoB,YAAY;EAErD,KAAK,MAAM,QAAQ,cACjB,IAAI,KAAK,gBAAgB,QAAQ;GAC/B,MAAM,YAAY,cAAc,KAAK,IAAI,CAAC,CAAC;GAC3C,IAAI,CAAC,aAAa,UAAU,SAAS,GACnC;GAGF,MAAM,MAAM,cAAc,SAAS;GAEnC,IAAI,IAAI,cAAc,aAAa,IAAI,UAAU,YAAY,CAAC,GAC5D;GAKF,IAAI,gBAAgB,SAAS,GAC3B;GAIF,IAAI,IAAI,QACN;GAIF,IAAI,CAAC,IAAI,KACP;GAMF,MAAM,WAAW,GAAG,IAAI,KAAK,GAAG,IAAI,MAAM,YAAY;GAOtD,IAAI,EALF,SAAS,SAAS,QAAQ,KAC1B,SAAS,SAAS,MAAM,KACxB,SAAS,SAAS,YAAY,KAC9B,SAAS,SAAS,SAAS,IAG3B,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,eAAe,UAAU,gFACzB,KAAK,MACL,KAAK,IACP,CACF;EAEJ;EAGF,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAM,yBAAyB;AAG/B,MAAM,sBAAsB;AAK5B,MAAM,qBAAqB,SACzB,CAAC,GAAG,KAAK,SAAS,sBAAsB,CAAC,CAAC,CACvC,KAAK,WAAW,MAAM,QAAQ,QAAQ,GAAE,CAAE,MAAM,GAAG,CAAC,CAAC,CACrD,QAAQ,YAAY,QAAQ,SAAS,YAAY,CAAC,CAAC,CACnD,SAAS,YACR,QACG,QAAQ,WAAW,oBAAoB,KAAK,MAAM,CAAC,CAAC,CACpD,KAAK,WAAW,OAAO,MAAM,OAAO,QAAQ,GAAG,IAAI,CAAC,CAAC,CAC1D;AAEJ,MAAM,iBAAiB,CAAC,gBAAgB,gBAAgB;AACxD,MAAM,iBAAiB,CAAC,kBAAkB,gBAAgB;AAE1D,MAAM,oBAAoB,MAAc,cACtC,kBAAkB,IAAI,CAAC,CAAC,MAAM,WAC5B,UAAU,MAAM,QAAQ,WAAW,OAAO,OAAO,WAAW,GAAG,IAAI,EAAE,CAAC,CACxE;AAEF,MAAa,oBAAoC;CAC/C,UAAU;CACV,MAAM,cAAc,MAAM;EACxB,MAAM,cAA4B,CAAC;EAEnC,KAAK,MAAM,QAAQ,cACjB,IAAI,KAAK,gBAAgB,OAAO;GAC9B,MAAM,EAAE,SAAS;GAGjB,IACE,KAAK,SAAS,iBAAiB,KAC/B,CAAC,KAAK,SAAS,2BAA2B,KAC1C,CAAC,iBAAiB,MAAM,cAAc,GAEtC,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,2HACA,KAAK,MACL,KAAK,IACP,CACF;GAIF,IACE,KAAK,SAAS,SAAS,KACvB,CAAC,KAAK,SAAS,YAAY,KAC3B,CAAC,KAAK,SAAS,uBAAuB,KACtC,CAAC,iBAAiB,MAAM,cAAc,GAEtC,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,gGACA,KAAK,MACL,KAAK,IACP,CACF;EAEJ;EAGF,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAM,2BAA2B,UAC9B,KAAK,SAAS,aAAa,KAC1B,KAAK,SAAS,QAAQ,KACtB,KAAK,SAAS,cAAc,MAC9B,CAAC,KAAK,SAAS,cAAc,KAC7B,CAAC,KAAK,SAAS,YAAY,KAC3B,CAAC,KAAK,SAAS,OAAO;AAExB,MAAa,uBAAuC;CAClD,UAAU;CACV,MAAM,cAAc,MAAM;EACxB,MAAM,cAA4B,CAAC;EAEnC,MAAM,SAIA,CAAC;EACP,KAAK,MAAM,QAAQ,cACjB,IAAI,KAAK,gBAAgB,QAAQ;GAC/B,MAAM,EAAE,MAAM,UAAU,cAAc,KAAK,IAAI;GAC/C,OAAO,KAAK;IACV,MAAM,MAAM,YAAY,KAAK;IAC7B,MAAM,OAAO,YAAY,KAAK;IAC9B,MAAM,CAAC;GACT,CAAC;EACH,OAAO,IAAI,KAAK,gBAAgB,SAAS,OAAO,SAAS,GACvD,OAAO,GAAG,EAAE,CAAC,EAAE,KAAK,KAAK,IAAI;EAGjC,IAAI,OAAO,WAAW,GACpB,OAAO;EAMT,MAAM,iBAA2B,CAAC;EAClC,IAAI,QAAQ,OAAO,SAAS;EAC5B,OAAO,SAAS,GAAG;GACjB,eAAe,KAAK,KAAK;GACzB,MAAM,EAAE,SAAS,OAAO;GACxB,QAAQ,OACL,MAAM,GAAG,KAAK,CAAC,CACf,WAAW,MAAM,EAAE,SAAS,QAAQ,EAAE,SAAS,IAAI;EACxD;EAEA,MAAM,aAAa,OAAO,SAAS;EACnC,KAAK,MAAM,cAAc,eAAe,WAAW,GAAG;GACpD,MAAM,QAAQ,OAAO;GACrB,KAAK,MAAM,QAAQ,MAAM,MAAM;IAC7B,IAAI,CAAC,wBAAwB,KAAK,IAAI,GACpC;IAEF,MAAM,QACJ,eAAe,aACX,uBACA,aAAa,MAAM,KAAK;IAC9B,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,4BAA4B,KAAK,KAAK,IAAI,MAAM,qCAChD,KAAK,MACL,KAAK,IACP,CACF;GACF;EACF;EAEA,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,iBAAiB;CAC5B;CACA;CACA;AACF;;;;ACpPA,MAAa,gBAAgC;CAC3C,UAAU;CACV,MAAM,cAAc,MAAM;EAIxB,IAHkB,aAAa,QAC5B,SAAS,KAAK,gBAAgB,MACjC,CAAC,CAAC,WACgB,GAYhB;OAVsB,aAAa,MAChC,SACC,KAAK,gBAAgB,UACpB,KAAK,KAAK,SAAS,eAAe,KACjC,KAAK,KAAK,SAAS,YAAY,KAC/B,KAAK,KAAK,SAAS,eAAe,KAClC,KAAK,KAAK,SAAS,aAAa,KAChC,KAAK,KAAK,SAAS,MAAM,EAGf,GACd,OAAO,CACL,iBACE,MACA,KAAK,KACL,KAAK,iBACL,8IACA,KAAK,MACL,aAAa,MAAM,SAAS,KAAK,gBAAgB,MAAM,CAAC,EAAE,QAAQ,CACpE,CACF;EACF;EAEF,OAAO,CAAC;CACV;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,cAA8B;CACzC,UAAU;CACV,MAAM,cAAc,MAAM;EACxB,MAAM,cAA4B,CAAC;EACnC,IAAI,cAAc;EAElB,KAAK,MAAM,QAAQ,cAAc;GAC/B,IAAI,KAAK,gBAAgB,QACvB,cAAc;GAGhB,IAAI,KAAK,gBAAgB,UAAU,KAAK,gBAAgB,OAAO;IAE7D,MAAM,MADQ,KAAK,KAAK,MAAM,MACd,CAAC,CAAC,MAAM,MAAM,CAAC,EAAE,WAAW,IAAI,CAAC;IAEjD,IAAI,CAAC,KACH;IAGF,MAAM,aAAa,IAAI,QAAQ,UAAU,EAAE;IAQ3C,KANE,eAAe,OACf,eAAe,MACf,eAAe,OACf,eAAe,SACf,WAAW,WAAW,MAAM,MAEb,gBAAgB,IAC/B,cAAc,KAAK;GAEvB;GAEA,IAAI,KAAK,gBAAgB,SAAS,gBAAgB,IAAI;IACpD,MAAM,OAAO,KAAK,KAAK,YAAY;IACnC,IACE,KAAK,SAAS,aAAa,KAC3B,KAAK,SAAS,QAAQ,KACtB,KAAK,SAAS,cAAc,KAC5B,KAAK,SAAS,aAAa,KAC3B,KAAK,SAAS,aAAa,KAC3B,KAAK,SAAS,aAAa,GAE3B,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,yCAAyC,KAAK,KAAK,6CAA6C,YAAY,qDAC5G,KAAK,MACL,KAAK,IACP,CACF;GAEJ;EACF;EAEA,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,iBAAiC;CAC5C,UAAU;CACV,MAAM,cAAc,MAAM;EACxB,MAAM,cAA4B,CAAC;EACnC,IAAI,sBAAsB;EAC1B,IAAI,eAAe;EAEnB,KAAK,MAAM,QAAQ,cACjB,IAAI,KAAK,gBAAgB,OAAO;GAC9B,IAAI,wBAAwB,GAC1B,eAAe,KAAK;GAEtB,uBAAuB;EACzB,OAAO;GACL,IAAI,sBAAsB,GACxB,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,SAAS,oBAAoB,iDAAiD,aAAa,qDAC3F,KAAK,MACL,YACF,CACF;GAEF,sBAAsB;EACxB;EAGF,IAAI,sBAAsB,GACxB,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,SAAS,oBAAoB,iDAAiD,aAAa,qDAC3F,KAAK,MACL,YACF,CACF;EAGF,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAMA,MAAM,sBACJ,gBACA,iBACY;CACZ,MAAM,YAAY,eAAe,YAAY,GAAG;CAChD,MAAM,MAAM,cAAc,KAAK,KAAK,eAAe,MAAM,GAAG,SAAS;CACrE,MAAM,WAAW,QAAQ,KAAK,kBAAkB,GAAG,IAAI;CACvD,OAAO,aAAa,MAAM,MAAM,MAAM,YAAY,MAAM,eAAe;AACzE;AAEA,MAAa,kBAAkC;CAC7C,UAAU;CACV,MAAM,cAAc,MAAM,SAAS;EAqBjC,IAnBmB,aAAa,MAAM,SAAS;GAC7C,IAAI,KAAK,gBAAgB,UAAU,KAAK,gBAAgB,OAAO;IAI7D,IADoB,mBAAmB,KAAK,KAAK,IACnC,GACZ,OAAO;IAIT,MAAM,MADQ,KAAK,KAAK,MAAM,MACd,CAAC,CAAC,MAAM,MAAM,CAAC,EAAE,WAAW,IAAI,CAAC;IACjD,IAAI,CAAC,KACH,OAAO;IAET,OAAO,QAAQ,OAAO,QAAQ,QAAQ,QAAQ;GAChD;GACA,OAAO;EACT,CAGW,KACT,SAAS,gBACT,CAAC,mBAAmB,MAAM,QAAQ,YAAY,GAE9C,OAAO,CACL,iBACE,MACA,KAAK,KACL,KAAK,iBACL,kLACA,KAAK,MACL,CACF,CACF;EAEF,OAAO,CAAC;CACV;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,mBAAmB;CAC9B;CACA;CACA;CACA;AACF;;;;ACjNA,MAAM,cAAc,UAA2B;CAC7C,MAAM,CAAC,QAAQ,MAAM,MAAM,GAAG;CAC9B,OAAO,SAAS,UAAU,SAAS;AACrC;AAEA,MAAa,aAA6B;CACxC,UAAU;CACV,MAAM,cAAc,MAAM;EAGxB,MAAM,4BAAY,IAAI,IAAoB;EAC1C,IAAI,eAA8B;EAClC,IAAI,WAAW;EACf,IAAI,eAAe;EAEnB,KAAK,MAAM,QAAQ,cACjB,IAAI,KAAK,gBAAgB,QAAQ;GAC/B,MAAM,EAAE,MAAM,UAAU,cAAc,KAAK,IAAI;GAG/C,MAAM,kBACJ,QAAQ,uBAAuB,IAAI,IAAI,YAAY;GACrD,WAAW,UAAU,IAAI,MAAM,YAAY,KAAK,EAAE,KAAK;GACvD,eAAe,KAAK;GACpB,eAAe,OAAO,YAAY,KAAK;GACvC,IAAI,cACF,UAAU,IAAI,cAAc,QAAQ;EAExC,OAAO,IAAI,KAAK,gBAAgB,QAAQ;GACtC,WAAW,KAAK,KAAK,KAAK,CAAC,CAAC,YAAY;GACxC,eAAe,KAAK;GACpB,IAAI,cACF,UAAU,IAAI,cAAc,QAAQ;EAExC;EAGF,IAAI,WAAW,QAAQ,GACrB,OAAO,CACL,iBACE,MACA,KAAK,KACL,KAAK,iBACL,oGACA,KAAK,MACL,YACF,CACF;EAGF,OAAO,CAAC;CACV;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,iBAAiC;CAC5C,UAAU;CACV,MAAM,cAAc,MAAM;EACxB,MAAM,cAA4B,CAAC;EAEnC,KAAK,MAAM,QAAQ,cACjB,IAAI,KAAK,gBAAgB,SAAS,KAAK,gBAAgB,OAAO;GAC5D,MAAM,OAAO,KAAK,KAAK,KAAK;GAC5B,IAAI,KAAK,gBAAgB,SAAS,CAAC,KAAK,SAAS,GAAG,GAAG;IAErD,MAAM,QAAQ,KAAK,MAAM,kCAAkC;IAC3D,IAAI,OAAO,QAAQ;KACjB,MAAM,EAAE,KAAK,UAAU,MAAM;KAE7B,IADoB,YAAY,GAEpB,KACV,qBAAqB,KAAK,KAC1B,CAAC,MAAM,WAAW,GAAG,GAErB,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,6BAA6B,KAAK,YAAY,KAAK,IAAI,oFACvD,KAAK,MACL,KAAK,IACP,CACF;IAEJ;GACF,OAAO;IAEL,MAAM,QAAQ,KAAK,MAAM,MAAM;IAC/B,KAAK,MAAM,QAAQ,OAAO;KACxB,MAAM,UAAU,KAAK,QAAQ,GAAG;KAChC,IAAI,MAAM;KACV,IAAI,QAAQ;KAEZ,IAAI,UAAU,GAAG;MACf,MAAM,KAAK,MAAM,GAAG,OAAO;MAC3B,QAAQ,KAAK,MAAM,UAAU,CAAC;KAChC,OACE,MAAM;KAIR,IADoB,YAAY,GAEpB,KACV,qBAAqB,KAAK,KAC1B,CAAC,MAAM,WAAW,GAAG,GAErB,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,6BAA6B,KAAK,YAAY,KAAK,IAAI,oFACvD,KAAK,MACL,KAAK,IACP,CACF;IAEJ;GACF;EACF;EAGF,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,kBAAkC;CAC7C,UAAU;CACV,MAAM,cAAc,MAAM;EACxB,MAAM,cAA4B,CAAC;EACnC,MAAM,eAAe,oBAAoB,YAAY;EAErD,KAAK,MAAM,QAAQ,cACjB,IAAI,KAAK,gBAAgB,QAAQ;GAG/B,MAAM,YAAY,cAAc,KAAK,IAAI,CAAC,CAAC;GAE3C,IAAI,CAAC,aAAa,UAAU,SAAS,GACnC;GAGF,MAAM,MAAM,cAAc,SAAS;GAEnC,IAAI,IAAI,cAAc,aAAa,IAAI,UAAU,YAAY,CAAC,GAC5D;GAGF,MAAM,QAAQ,gBAAgB,GAAG;GACjC,IAAI,OAAO;IACT,MAAM,SACJ,UAAU,aACN,eAAe,UAAU,6BACzB,eAAe,UAAU;IAC/B,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,GAAG,OAAO,wCACV,KAAK,MACL,KAAK,IACP,CACF;GACF;EACF;EAGF,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,cAA8B;CACzC,UAAU;CACV,MAAM,cAAc,MAAM;EACxB,MAAM,cAA4B,CAAC;EAEnC,KAAK,MAAM,QAAQ,cACjB,IAAI,KAAK,gBAAgB,OAAO;GAE9B,MAAM,MADQ,KAAK,KAAK,MAAM,MACd,CAAC,CAAC,MAAM,MAAM,CAAC,EAAE,WAAW,IAAI,CAAC;GAEjD,IAAI,CAAC,KACH;GAGF,IAAI,IAAI,WAAW,SAAS,KAAK,IAAI,WAAW,UAAU,GACxD,YAAY,KACV,iBACE,MACA,KAAK,KACL,KAAK,iBACL,sCAAsC,IAAI,6FAC1C,KAAK,MACL,KAAK,IACP,CACF;EAEJ;EAGF,OAAO;CACT;CACA,iBAAiB;CACjB,MAAM;CACN,KAAK;CACL,SAAS;AACX;AAEA,MAAa,gBAAgB;CAC3B;CACA;CACA;CACA;AACF;;;;ACnOA,MAAa,qBAAuC;CAClD,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;AACL;AAEA,MAAa,kBAAiC;CAC5C,GAAG;CACH,GAAG;CACH,GAAG;AACL;AAEA,MAAa,WAA6B,CACxC,GAAG,oBACH,GAAG,eACL;AAEA,MAAa,YAAY,QACvB,SAAS,MAAM,SAAS,KAAK,QAAQ,GAAG;;;;AC7B1C,MAAa,mBACX,MACA,aACA,qBAEA,cAAc,KAAK,QACnB,mBAAmB,KAAK,aACxB,KAAK;;;;ACFP,MAAa,sBACX,cACA,MACA,cACA,aACA,qBACiB;CACjB,MAAM,cAA4B,CAAC;CAEnC,KAAK,MAAM,QAAQ,oBAAoB;EACrC,MAAM,WAAW,gBAAgB,MAAM,aAAa,gBAAgB;EACpE,IAAI,aAAa,OACf;EAGF,MAAM,kBAAkB,KAAK,MAAM,cAAc,MAAM,EAAE,aAAa,CAAC;EAGvE,IAAI,aAAa,KAAK,iBACpB,KAAK,MAAM,QAAQ,iBACjB,KAAK,WAAW;EAIpB,YAAY,KAAK,GAAG,eAAe;CACrC;CAEA,OAAO;AACT;;;;AChCA,MAAa,mBACX,gBACA,MACA,aACA,kBACA,WACiB;CACjB,MAAM,cAA4B,CAAC;CAEnC,KAAK,MAAM,QAAQ,iBAAiB;EAClC,MAAM,WAAW,gBAAgB,MAAM,aAAa,gBAAgB;EACpE,IAAI,aAAa,OACf;EAGF,MAAM,kBAAkB,KAAK,MAAM,gBAAgB,MAAM,EAAE,OAAO,CAAC;EAGnE,IAAI,aAAa,KAAK,iBACpB,KAAK,MAAM,QAAQ,iBACjB,KAAK,WAAW;EAIpB,YAAY,KAAK,GAAG,eAAe;CACrC;CAEA,OAAO;AACT;;;;ACxBA,MAAM,kBAA2C;CAC/C;CACA;CACA;CACA;AACF;AAEA,MAAM,kBAA2C;CAC/C;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,iBAAiB,UACrB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,MAAM,kBAAkB,UACtB,OAAO,UAAU,YAChB,gBAAsC,SAAS,KAAK;AAEvD,MAAM,iBAAiB,UAAiD;CACtE,IAAI,CAAC,cAAc,KAAK,GACtB,MAAM,IAAI,MACR,kDAAkD,OAAO,OAC3D;CAGF,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,KAAK,GAChD,IAAI,CAAC,eAAe,QAAQ,GAC1B,MAAM,IAAI,MACR,oBAAoB,KAAK,UAAU,QAAQ,EAAE,aAAa,IAAI,EAChE;CAIJ,OAAO;AACT;AAEA,MAAM,sBACJ,UACgD;CAChD,IAAI,CAAC,cAAc,KAAK,GACtB,MAAM,IAAI,MACR,uDAAuD,OAAO,OAChE;CAGF,MAAM,SAAsD,CAAC;CAC7D,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,KAAK,GAAG;EACnD,IAAI,CAAE,gBAAsC,SAAS,GAAG,GAGtD;EAEF,IAAI,CAAC,eAAe,QAAQ,GAC1B,MAAM,IAAI,MACR,oBAAoB,KAAK,UAAU,QAAQ,EAAE,iBAAiB,IAAI,EACpE;EAEF,OAAO,OAAuB;CAChC;CAEA,OAAO;AACT;AAEA,MAAM,kBAAkB,UAAyC;CAC/D,IAAI,CAAC,cAAc,KAAK,GACtB,MAAM,IAAI,MACR,mDAAmD,OAAO,OAC5D;CAGF,MAAM,SAA+B,CAAC;CACtC,IAAI,WAAW,SAAS,MAAM,UAAU,QAAW;EACjD,IACE,CAAC,MAAM,QAAQ,MAAM,KAAK,KAC1B,CAAC,MAAM,MAAM,OAAO,SAAS,OAAO,SAAS,QAAQ,GAErD,MAAM,IAAI,MACR,8DACF;EAEF,OAAO,QAAQ,MAAM;CACvB;CAEA,OAAO;AACT;AAEA,MAAM,2BAA2B,UAA2B;CAC1D,IAAI,UAAU,MACZ,OAAO;CAET,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO;CAET,OAAO,OAAO;AAChB;;;;;;;;AASA,MAAa,kBAAkB,UAAuC;CACpE,IAAI,CAAC,cAAc,KAAK,GACtB,MAAM,IAAI,MACR,2CAA2C,wBAAwB,KAAK,GAC1E;CAGF,MAAM,SAA6B,CAAC;CAEpC,IAAI,WAAW,SAAS,MAAM,UAAU,QACtC,OAAO,QAAQ,cAAc,MAAM,KAAK;CAG1C,IAAI,gBAAgB,SAAS,MAAM,eAAe,QAChD,OAAO,aAAa,mBAAmB,MAAM,UAAU;CAGzD,IAAI,YAAY,SAAS,MAAM,WAAW,QACxC,OAAO,SAAS,eAAe,MAAM,MAAM;CAG7C,OAAO;AACT;;;;ACtIA,MAAM,mBAA4C;CAChD;CACA;CACA;CACA;CACA;AACF;AAOA,MAAM,UAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAC/D,OAAO,KAAK,KAAK,IACjB,CAAC;AASP,MAAa,4BAA4B,QAAoC;CAC3E,IAAI,OAAO,QAAQ,YAAY,QAAQ,MACrC,OAAO;EAAE,YAAY,CAAC;EAAG,OAAO,CAAC;CAAE;CAGrC,MAAM,gBAAgB,IAAI,IAAI,SAAS,KAAK,SAAS,KAAK,GAAG,CAAC;CAC9D,MAAM,kBAAkB,IAAI,IAAY,gBAAgB;CACxD,MAAM,EAAE,YAAY,UAAU;CAK9B,OAAO;EACL,YAAY,OAAO,UAAU,CAAC,CAAC,QAAQ,QAAQ,CAAC,gBAAgB,IAAI,GAAG,CAAC;EACxE,OAAO,OAAO,KAAK,CAAC,CAAC,QAAQ,QAAQ,CAAC,cAAc,IAAI,GAAG,CAAC;CAC9D;AACF;;;;AClCA,MAAM,aAAa,OAAO,aAAuC;CAC/D,IAAI;EACF,MAAM,GAAG,OAAO,QAAQ;EACxB,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAM,kBAAkB,OACtB,UACA,QACA,UACqB;CACrB,IAAI;EAEF,OAAO,MAAM,MADS,GAAG,SAAS,UAAU,OAAO,CAC/B;CACtB,SAAS,OAAgB;EACvB,MAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACjE,MAAM,IAAI,YAAY,EACpB,SAAS,0BAA0B,OAAO,IAAI,MAChD,CAAC;CACH;AACF;AAEA,MAAM,eAAe,OAAO,aAAuC;CACjE,IAAI,SAAS,SAAS,OAAO,GAC3B,OAAO,gBAAgB,UAAU,QAAQ,KAAK,KAAK;CAGrD,IAAI,SAAS,SAAS,OAAO,KAAK,SAAS,SAAS,MAAM,GACxD,OAAO,gBAAgB,UAAU,QAAQA,KAAS;CAGpD,IAAI;EACF,MAAM,eAAe,MAAM,OAAO;EAClC,OAAO,aAAa,WAAW;CACjC,SAAS,OAAgB;EACvB,MAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACjE,MAAM,IAAI,YAAY,EACpB,SAAS,8BAA8B,SAAS,IAAI,MACtD,CAAC;CACH;AACF;AAEA,MAAM,mBACJ,KACA,cACS;CACT,MAAM,UAAU,yBAAyB,GAAG;CAC5C,KAAK,MAAM,OAAO,QAAQ,OACxB,UACE,iBAAiB,IAAI,oDACvB;CAEF,KAAK,MAAM,OAAO,QAAQ,YACxB,UACE,qBAAqB,IAAI,iFAC3B;AAEJ;AAEA,MAAa,aAAa,OACxB,SACA,YAGA,cACgC;CAChC,IAAI,eAAwB;CAE5B,IAAI,YAAY;EACd,MAAM,WAAW,KAAK,QAAQ,SAAS,UAAU;EACjD,IAAI,CAAE,MAAM,WAAW,QAAQ,GAC7B,MAAM,IAAI,YAAY,EACpB,SAAS,sCAAsC,WACjD,CAAC;EAEH,eAAe,MAAM,aAAa,QAAQ;CAC5C,OAAO;EAYL,KAAK,MAAM,QAAQ;GAVjB;GACA;GACA;GACA;GACA;GACA;GACA;EAI0B,GAAG;GAC7B,MAAM,WAAW,KAAK,KAAK,SAAS,IAAI;GACxC,IAAI,MAAM,WAAW,QAAQ,GAAG;IAC9B,eAAe,MAAM,aAAa,QAAQ;IAC1C;GACF;EACF;EAGA,IAAI,CAAC,cAAc;GACjB,MAAM,UAAU,KAAK,KAAK,SAAS,cAAc;GACjD,IAAI,MAAM,WAAW,OAAO,GAC1B,IAAI;IACF,MAAM,aAAa,MAAM,GAAG,SAAS,SAAS,OAAO;IACrD,MAAM,UAAU,KAAK,MAAM,UAAU;IACrC,IAAI,QAAQ,cACV,eAAe,QAAQ;GAE3B,QAAQ,CAER;EAEJ;CACF;CAEA,IAAI,CAAC,cACH,OAAO,CAAC;CAGV,IAAI;EACF,MAAM,SAAS,eAAe,YAAY;EAC1C,IAAI,WACF,gBAAgB,cAAc,SAAS;EAEzC,OAAO;CACT,SAAS,OAAgB;EACvB,MAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACjE,MAAM,IAAI,YAAY,EACpB,SAAS,iCAAiC,MAC5C,CAAC;CACH;AACF;;;;AC5IA,MAAa,gBAAgB;CAC3B;EAAE,OAAO;EAAM,OAAO;EAAa,KAAK;CAAG;CAC3C;EAAE,OAAO;EAAK,OAAO;EAAQ,KAAK;CAAG;CACrC;EAAE,OAAO;EAAM,OAAO;EAAc,KAAK;CAAG;CAC5C;EAAE,OAAO;EAAM,OAAO;EAAY,KAAK;CAAE;AAC3C;AAEA,MAAa,kBACX,UACmC;CACnC,KAAK,MAAM,UAAU,eACnB,IAAI,SAAS,OAAO,KAClB,OAAO;CAGX,OAAO,cAAc,GAAG,EAAE;AAC5B;AAEA,MAAa,kBACX,gBAIG;CACH,IAAI,UAAU;CAEd,KAAK,MAAM,QAAQ,aACjB,IAAI,KAAK,aAAa,SACpB,WAAW;MACN,IAAI,KAAK,aAAa,WAC3B,WAAW;MACN,IAAI,KAAK,aAAa,QAC3B,WAAW;CAmBf,MAAM,QAAQ,KAAK,MAAM,MAAM,KAAK,IAAI,CAAC,UAAU,EAAC,CAAC;CACrD,MAAM,SAAS,eAAe,KAAK;CAGnC,OAAO;EAAE,UAFQ,OAAO,MAAM,GAAG,OAAO;EAExB;CAAM;AACxB;;;;ACtDA,MAAa,wBAAwB;AAmBrC,MAAa,gBACX,aACA,OACA,OACA,aACgB;CAChB,aAAa,YAAY,KAAK,OAAO;EACnC,QAAQ,EAAE;EACV,MAAM,EAAE;EACR,MAAM,EAAE;EACR,MAAM,EAAE;EACR,SAAS,EAAE;EACX,MAAM,EAAE;EACR,UAAU,EAAE;CACd,EAAE;CACF;CACA;CACA;CACA;CACA,4BAAW,IAAI,KAAK,EAAC,CAAC,YAAY;AACpC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@docker-doctor/cli",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Static analysis for Dockerfile and Docker Compose files",
   "keywords": [
     "best-practices",