@intentius/chant-lexicon-docker 0.124.21 → 0.124.22

package/dist/codegen/docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA4HH,wBAAsB,YAAY,CAAC,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB9E"}
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAyIH,wBAAsB,YAAY,CAAC,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB9E"}

package/dist/codegen/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/codegen/generate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAwB/G;AA2FD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAWvF"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/codegen/generate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAwB/G;AAoJD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAWvF"}

package/dist/dockerfile-order.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The order a Dockerfile stage's per-kind fields (`run`, `copy`, `user`, ...)
+ * are written in when the stage has no `steps`. It never changes, so a
+ * Dockerfile declared with per-kind fields builds the same output it always
+ * has; `steps` is how a stage controls its own order.
+ */
+export declare const PER_KIND_ORDER: readonly ["arg", "env", "workdir", "user", "run", "copy", "add", "expose", "volume", "label", "entrypoint", "cmd", "healthcheck"];
+export type PerKindField = (typeof PER_KIND_ORDER)[number];
+/** The step keys whose array value is written in JSON exec form. */
+export declare const EXEC_FORM_STEPS: ReadonlySet<string>;
+/** Every instruction a step can name. FROM is the stage's own field. */
+export declare const STEP_INSTRUCTIONS: ReadonlySet<string>;
+//# sourceMappingURL=dockerfile-order.d.ts.map

package/dist/dockerfile-order.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dockerfile-order.d.ts","sourceRoot":"","sources":["../src/dockerfile-order.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,cAAc,YACzB,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EACrD,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,CACvD,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,oEAAoE;AACpE,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAAkD,CAAC;AAEnG,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAEhD,CAAC"}

package/dist/generated/index.d.ts

@@ -4,4 +4,125 @@ export declare const Network: new (props: Record<string, unknown>, attributes?:
 export declare const DockerConfig: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("@intentius/chant").Declarable & Record<string, string>;
 export declare const DockerSecret: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("@intentius/chant").Declarable & Record<string, string>;
 export declare const Dockerfile: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("@intentius/chant").Declarable & Record<string, string>;
+/** The Dockerfile instructions a step can name. FROM is the stage's own `from` field. */
+export type DockerfileInstructionName = "arg" | "env" | "run" | "copy" | "add" | "workdir" | "user" | "expose" | "volume" | "label" | "entrypoint" | "cmd" | "healthcheck" | "shell" | "stopsignal" | "onbuild";
+type DockerfileStepOf<K extends DockerfileInstructionName, V> = {
+    [P in K]: V;
+} & {
+    [P in Exclude<DockerfileInstructionName, K>]?: never;
+};
+/**
+ * One Dockerfile instruction, named by its single key: `{ run: "npm ci" }` is `RUN npm ci`.
+ * A string[] value (run, cmd, entrypoint, shell) is written in JSON exec form.
+ */
+export type DockerfileStep = 
+/** ARG: Build-time argument */
+DockerfileStepOf<"arg", string>
+/** ENV: Environment variable */
+ | DockerfileStepOf<"env", string>
+/** RUN: Run a command during build */
+ | DockerfileStepOf<"run", string | string[]>
+/** COPY: Copy files from build context */
+ | DockerfileStepOf<"copy", string>
+/** ADD: Add files (supports URLs and archives) */
+ | DockerfileStepOf<"add", string>
+/** WORKDIR: Set working directory */
+ | DockerfileStepOf<"workdir", string>
+/** USER: Set user for subsequent instructions */
+ | DockerfileStepOf<"user", string>
+/** EXPOSE: Document exposed ports */
+ | DockerfileStepOf<"expose", string | number>
+/** VOLUME: Create mount points */
+ | DockerfileStepOf<"volume", string>
+/** LABEL: Add metadata labels */
+ | DockerfileStepOf<"label", string>
+/** ENTRYPOINT: Set the entrypoint executable */
+ | DockerfileStepOf<"entrypoint", string | string[]>
+/** CMD: Default command arguments */
+ | DockerfileStepOf<"cmd", string | string[]>
+/** HEALTHCHECK: Health check instruction */
+ | DockerfileStepOf<"healthcheck", string>
+/** SHELL: Set the shell for shell-form commands (JSON array form) */
+ | DockerfileStepOf<"shell", string | string[]>
+/** STOPSIGNAL: Signal sent to stop the container */
+ | DockerfileStepOf<"stopsignal", string>
+/** ONBUILD: Instruction to run when the image is used as a base */
+ | DockerfileStepOf<"onbuild", string>;
+/**
+ * One build stage: FROM, then its instructions.
+ * Without `steps`, the per-kind fields are written in a fixed order: ARG, ENV, WORKDIR, USER, RUN, COPY, ADD, EXPOSE, VOLUME, LABEL, ENTRYPOINT, CMD, HEALTHCHECK.
+ */
+export interface DockerfileStage {
+    from: string;
+    as?: string;
+    /** Instructions after FROM, written exactly in this order. Can't be combined with the per-kind fields. */
+    steps?: DockerfileStep[];
+    /** ARG as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    arg?: string[];
+    /** ENV as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    env?: string[];
+    /** RUN as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    run?: string[];
+    /** COPY as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    copy?: string[];
+    /** ADD as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    add?: string[];
+    /** WORKDIR as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    workdir?: string;
+    /** USER as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    user?: string;
+    /** EXPOSE as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    expose?: string[];
+    /** VOLUME as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    volume?: string[];
+    /** LABEL as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    label?: string[];
+    /** ENTRYPOINT as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    entrypoint?: string;
+    /** CMD as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    cmd?: string;
+    /** HEALTHCHECK as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    healthcheck?: string;
+}
+/**
+ * A Dockerfile: `stages` for a multi-stage build, or `from` and the stage fields for one stage.
+ * Without `steps`, the per-kind fields are written in a fixed order: ARG, ENV, WORKDIR, USER, RUN, COPY, ADD, EXPOSE, VOLUME, LABEL, ENTRYPOINT, CMD, HEALTHCHECK.
+ */
+export interface DockerfileProps {
+    name?: string;
+    /** ARG instructions written before the first FROM, e.g. `["NODE_VERSION=20"]`. */
+    globalArgs?: string[];
+    from?: string;
+    as?: string;
+    stages?: DockerfileStage[];
+    /** Instructions after FROM, written exactly in this order. Can't be combined with the per-kind fields. */
+    steps?: DockerfileStep[];
+    /** ARG as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    arg?: string[];
+    /** ENV as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    env?: string[];
+    /** RUN as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    run?: string[];
+    /** COPY as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    copy?: string[];
+    /** ADD as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    add?: string[];
+    /** WORKDIR as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    workdir?: string;
+    /** USER as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    user?: string;
+    /** EXPOSE as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    expose?: string[];
+    /** VOLUME as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    volume?: string[];
+    /** LABEL as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    label?: string[];
+    /** ENTRYPOINT as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    entrypoint?: string;
+    /** CMD as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    cmd?: string;
+    /** HEALTHCHECK as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
+    healthcheck?: string;
+}
+export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/generated/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/generated/index.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,OAAO,8IAA2D,CAAC;AAChF,eAAO,MAAM,MAAM,8IAA0D,CAAC;AAC9E,eAAO,MAAM,OAAO,8IAA2D,CAAC;AAChF,eAAO,MAAM,YAAY,8IAA0D,CAAC;AACpF,eAAO,MAAM,YAAY,8IAA0D,CAAC;AAEpF,eAAO,MAAM,UAAU,8IAAqD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/generated/index.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,OAAO,8IAA2D,CAAC;AAChF,eAAO,MAAM,MAAM,8IAA0D,CAAC;AAC9E,eAAO,MAAM,OAAO,8IAA2D,CAAC;AAChF,eAAO,MAAM,YAAY,8IAA0D,CAAC;AACpF,eAAO,MAAM,YAAY,8IAA0D,CAAC;AAEpF,eAAO,MAAM,UAAU,8IAAqD,CAAC;AAE7E,yFAAyF;AACzF,MAAM,MAAM,yBAAyB,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,YAAY,GAAG,KAAK,GAAG,aAAa,GAAG,OAAO,GAAG,YAAY,GAAG,SAAS,CAAC;AAChN,KAAK,gBAAgB,CAAC,CAAC,SAAS,yBAAyB,EAAE,CAAC,IAAI;KAAG,CAAC,IAAI,CAAC,GAAG,CAAC;CAAE,GAAG;KAAG,CAAC,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK;CAAE,CAAC;AAC3I;;;GAGG;AACH,MAAM,MAAM,cAAc;AACxB,+BAA+B;AAC7B,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC;AACjC,gCAAgC;GAC9B,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC;AACjC,sCAAsC;GACpC,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;AAC5C,0CAA0C;GACxC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC;AAClC,kDAAkD;GAChD,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC;AACjC,qCAAqC;GACnC,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC;AACrC,iDAAiD;GAC/C,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC;AAClC,qCAAqC;GACnC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;AAC7C,kCAAkC;GAChC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC;AACpC,iCAAiC;GAC/B,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;AACnC,gDAAgD;GAC9C,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;AACnD,qCAAqC;GACnC,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;AAC5C,4CAA4C;GAC1C,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC;AACzC,qEAAqE;GACnE,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;AAC9C,oDAAoD;GAClD,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC;AACxC,mEAAmE;GACjE,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACxC;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,0GAA0G;IAC1G,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;IACzB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,6FAA6F;IAC7F,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,gGAAgG;IAChG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6FAA6F;IAC7F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,8FAA8F;IAC9F,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,mGAAmG;IACnG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AACD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;IAC3B,0GAA0G;IAC1G,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;IACzB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,6FAA6F;IAC7F,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,gGAAgG;IAChG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6FAA6F;IAC7F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,8FAA8F;IAC9F,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,mGAAmG;IACnG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/dist/import/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/import/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAc,MAAM,gCAAgC,CAAC;AAC7F,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAgD5F;;;GAGG;AACH,qBAAa,oBAAqB,YAAW,cAAc;IACzD,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAMjC;CACF;AAED;;;GAGG;AACH,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,QAAQ,CAAC,EAAE,EAAE,UAAU,GAAG,aAAa,EAAE,CAIxC;CACF"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/import/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAc,MAAM,gCAAgC,CAAC;AAC7F,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAiD5F;;;GAGG;AACH,qBAAa,oBAAqB,YAAW,cAAc;IACzD,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAWjC;CACF;AAED;;;GAGG;AACH,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,QAAQ,CAAC,EAAE,EAAE,UAAU,GAAG,aAAa,EAAE,CAIxC;CACF"}

package/dist/import/parser.d.ts

@@ -30,6 +30,11 @@ export interface SecretIR {
 export interface DockerfileStage {
     from: string;
     as?: string;
+    /**
+     * The stage's instructions after FROM, in source order. `instruction` is
+     * the upper-case keyword; `value` is the rest of the instruction as
+     * written, line continuations and heredoc bodies included.
+     */
     instructions: Array<{
         instruction: string;
         value: string;
@@ -38,6 +43,8 @@ export interface DockerfileStage {
 export interface DockerfileIR {
     kind: "dockerfile";
     name: string;
+    /** ARG values declared before the first FROM. */
+    globalArgs?: string[];
     stages: DockerfileStage[];
 }
 export type DockerIR = ServiceIR | VolumeIR | NetworkIR | ConfigIR | SecretIR | DockerfileIR;
@@ -52,10 +59,26 @@ export interface ParseResult {
 export declare class DockerParser {
     parse(content: string): ParseResult;
 }
+/** One logical Dockerfile instruction: its upper-case keyword and the rest as written. */
+export interface DockerfileInstruction {
+    instruction: string;
+    value: string;
+}
+/**
+ * Split Dockerfile content into logical instructions, in order. Comment
+ * and blank lines are dropped (also inside a continued instruction, as
+ * Docker does). A line ending in a backslash continues onto the next line,
+ * and a heredoc (`RUN <<EOF` ... `EOF`) runs to its terminator; both are
+ * kept in the value exactly as written, so writing the value back gives
+ * the same instruction.
+ */
+export declare function splitDockerfileInstructions(content: string): DockerfileInstruction[];
 /**
  * Parser for Dockerfile content.
  */
 export declare class DockerfileParser {
     parse(name: string, content: string): DockerfileIR;
 }
+/** Whether content reads as a Dockerfile: its first instruction is FROM or ARG, or it starts with a parser directive. */
+export declare function looksLikeDockerfile(content: string): boolean;
 //# sourceMappingURL=parser.d.ts.map

package/dist/import/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/import/parser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAC;AAE7F,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA0BD;;;GAGG;AACH,qBAAa,YAAY;IACvB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,CAoElC;CACF;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CA4BjD;CACF"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/import/parser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,YAAY,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAC;AAE7F,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA0BD;;;GAGG;AACH,qBAAa,YAAY;IACvB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,CAoElC;CACF;AAED,0FAA0F;AAC1F,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB,EAAE,CAuCpF;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CAuBjD;CACF;AAED,yHAAyH;AACzH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS5D"}

package/dist/integrity.json

@@ -1,19 +1,28 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "ec3263940092e78fa3bafc821e793efa8b616fd2e2e60c3fbebb40e3b34c9a9e",
-    "meta.json": "2996be8fdb14f3f935e1e1441fed8f69af7b6aeeefb14dac96301cc41eba8046",
-    "types/index.d.ts": "7b2e6f784b7dbecbbe7924fa1aec7e2520ac0547069311253a006bc2267a5646",
+    "manifest.json": "fe4bc2268e250cd125728ad9d16e6dc5d39c3c59492bf14406ca097127d6603e",
+    "meta.json": "2b751db9716bb5191ea508d4b4c02d9db4e78ebae5e8bce7d40ff0751ea368d6",
+    "types/index.d.ts": "516ed0b52a0c5c7ff828e19a1bcc19759a4a0f293a62fda763407f6970ab0e38",
     "rules/no-latest-tag.ts": "2281be0457c02e782fbafe015f65ff5fd2b008ef0f879226e9b548a3ea65399b",
+    "rules/per-kind-order.ts": "50622c849e9e76e312c4ca7abd97858f74641e0d7f673d2de47b055f7f6b6c6b",
+    "rules/add-url-checksum.ts": "b317a30103f65a9dc658cc858aeca797f96f4c34f76525c88e4618dcb4a5cd05",
     "rules/apt-no-recommends.ts": "579ea54435b1cbd59088994aaaf7b249a42064facd74b62163b302fe31e769e0",
-    "rules/docker-helpers.ts": "c76ea1294b630df086a23b24c0435c9daac8cdf21dd371a8aabf74e9984e6b13",
+    "rules/apt-update-alone.ts": "d684a6eb45642ca3968c90fef28f71795672fb600d5aecc4b9e33d48792f75e2",
+    "rules/cache-busting-copy.ts": "4552fba29caa2d8dcf78041ebdd9793b775ef585ff9499d4f2e58c412fb2be4c",
+    "rules/copy-from-stage.ts": "2c11889c75e6ccafca538e65a6df0c1eae34eed484908ddf0b8bf39a937f2f0e",
+    "rules/docker-helpers.ts": "64ab4abca082b05c9cfab669f258085ffeb3a9a523d19a639630545ae2e971db",
     "rules/no-latest-image.ts": "3e49602822e0645173a961b9c0686b669e846957486781a881693dbe04790b88",
-    "rules/no-root-user.ts": "fb47adc8523e07a8307253dcffeeccd7528e655bf737ef7e313e76a3df2c9a2d",
+    "rules/no-root-user.ts": "bf3ab4b87423652cd4c5d4f8a2d01ecda94d62a0ca8e8abddb82313a5dd16d9f",
     "rules/prefer-copy.ts": "b422a77b94023f7356d6b6326b6552c459cfbd282468f38214e19a105a59b742",
+    "rules/relative-workdir.ts": "3b81b51d3b170e2203e8ab25c15ef2ee7b37a07eaa3eda31bb5bfa3e27e98e62",
+    "rules/repeated-cmd.ts": "5a178852c55335314a95cffc4b503f65cac185188979bb6c4e581d072e737219",
+    "rules/root-after-user.ts": "5f107d899fb59a5d95d7661393e2fc94ac8d98399bf1e07af4286a748eec111b",
     "rules/ssh-port-exposed.ts": "1df86b498787cbcc5ac8995c7099956576d9d105b4da71b0c225790be585c4c9",
+    "rules/unused-global-arg.ts": "f3aefedee383194350bfb92beca75d6f88c4fc6bb35cd09b96dfa388d151032b",
     "rules/unused-volume.ts": "ffcfc731782a4443a2eb34b1c0f6230b094c18c6ad104e4b81074bb799a3ce40",
-    "skills/chant-docker.md": "3ff0708e3c76e245f202948949c768464563af2b60cc9aa2ca52f494ef8357f1",
-    "skills/chant-docker-patterns.md": "ad1b0196d8150b2df579a699ff107f604340c799c04f3460ebf65003e287b12a"
+    "skills/chant-docker.md": "1b029363668f457598f5cc2b49ebbf1e671218d93b002281c218c55ad41a57b9",
+    "skills/chant-docker-patterns.md": "c96c15412c651d97948bec946b40942fed6f2ba611ca51830e752f932bd9b10b"
   },
-  "composite": "abf5286a1bff6c66444cfb50946490688657fb162e1dce7c401773d2d7710fa6"
+  "composite": "13f5008ad8ed466fe333e26b8c5e41d923f3cd7b811a7d49ccc9c2cab18bb902"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA+B,KAAK,QAAQ,EAAgC,MAAM,gCAAgC,CAAC;AAK1H,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAOvD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA+B,KAAK,QAAQ,EAAgC,MAAM,gCAAgC,CAAC;AAK1H,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAevD,CAAC"}

package/dist/lint/audit-lineage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAwBxD,CAAC"}
+{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAsCxD,CAAC"}

package/dist/lint/post-synth/add-url-checksum.d.ts

@@ -0,0 +1,9 @@
+/**
+ * DKRD019: ADD of a remote URL without --checksum
+ *
+ * ADD fetches an http(s) URL at build time and trusts whatever comes back.
+ * `ADD --checksum=sha256:...` makes the build fail when the content changes.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const dkrd019: PostSynthCheck;
+//# sourceMappingURL=add-url-checksum.d.ts.map

package/dist/lint/post-synth/add-url-checksum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-url-checksum.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/add-url-checksum.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cA2BrB,CAAC"}

package/dist/lint/post-synth/apt-update-alone.d.ts

@@ -0,0 +1,10 @@
+/**
+ * DKRD020: apt-get update in its own RUN
+ *
+ * A RUN that only runs `apt-get update` is cached as its own layer, so a
+ * later `apt-get install` in another RUN can install from a stale package
+ * index. Update and install in the same RUN.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const dkrd020: PostSynthCheck;
+//# sourceMappingURL=apt-update-alone.d.ts.map

package/dist/lint/post-synth/apt-update-alone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apt-update-alone.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/apt-update-alone.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAM9G,eAAO,MAAM,OAAO,EAAE,cAwBrB,CAAC"}

package/dist/lint/post-synth/cache-busting-copy.d.ts

@@ -0,0 +1,11 @@
+/**
+ * DKRD013: Whole build context copied before installing dependencies
+ *
+ * `COPY . .` followed by a dependency install (npm ci, pip install -r,
+ * go mod download, ...) in the same stage invalidates the install layer on
+ * every source change. Copy the dependency manifests first, install, then
+ * copy the rest.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const dkrd013: PostSynthCheck;
+//# sourceMappingURL=cache-busting-copy.d.ts.map

package/dist/lint/post-synth/cache-busting-copy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-busting-copy.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cache-busting-copy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AA8B9G,eAAO,MAAM,OAAO,EAAE,cAwBrB,CAAC"}

package/dist/lint/post-synth/copy-from-stage.d.ts

@@ -0,0 +1,10 @@
+/**
+ * DKRD016: COPY --from names no earlier stage
+ *
+ * `COPY --from=<name>` reads from an earlier stage with that name (or
+ * index). A name that only a later stage has, or that no stage has, is
+ * pulled as an image instead, which is almost never what was meant.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const dkrd016: PostSynthCheck;
+//# sourceMappingURL=copy-from-stage.d.ts.map

package/dist/lint/post-synth/copy-from-stage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"copy-from-stage.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/copy-from-stage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAQ9G,eAAO,MAAM,OAAO,EAAE,cAqCrB,CAAC"}

package/dist/lint/post-synth/docker-helpers.d.ts

@@ -29,4 +29,39 @@ export declare function isLatestOrUntagged(image: string): boolean;
  * Get Dockerfile content from SerializerResult files map.
  */
 export declare function extractDockerfiles(output: unknown): Map<string, string>;
+export interface DockerfileInstr {
+    /** Upper-case keyword, e.g. "RUN". */
+    instruction: string;
+    /** The rest of the instruction as written. */
+    value: string;
+}
+export interface ParsedStage {
+    /** 0-based position among the stages. */
+    index: number;
+    /** The FROM image (or earlier stage) without `--platform` and `AS`. */
+    from: string;
+    as?: string;
+    instructions: DockerfileInstr[];
+}
+export interface ParsedDockerfile {
+    /** ARG instructions before the first FROM. */
+    globalArgs: DockerfileInstr[];
+    stages: ParsedStage[];
+}
+/** A Dockerfile's global ARGs and stages, each stage's instructions in order. */
+export declare function parseDockerfileStages(content: string): ParsedDockerfile;
+/** How a stage is named in a message: `stage "build"` or `stage 2`. */
+export declare function stageLabel(stage: ParsedStage): string;
+/** The first line of an instruction, for a message. */
+export declare function instrText(instr: DockerfileInstr): string;
+/** Whether a USER value is root (by name or uid 0, with or without a group). */
+export declare function isRootUser(value: string): boolean;
+/** Every generated Dockerfile in a build's outputs, parsed. */
+export declare function eachDockerfile(outputs: Map<string, unknown>): Array<{
+    fileName: string;
+    content: string;
+    parsed: ParsedDockerfile;
+}>;
+/** A RUN value with its line continuations joined, for matching commands. */
+export declare function commandText(instr: DockerfileInstr): string;
 //# sourceMappingURL=docker-helpers.d.ts.map

package/dist/lint/post-synth/docker-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/docker-helpers.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEpE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CA8CxE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAgB7D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMzD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAYvE"}
+{"version":3,"file":"docker-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/docker-helpers.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAGpE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CA8CxE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAgB7D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMzD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAYvE;AAID,MAAM,WAAW,eAAe;IAC9B,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,eAAe,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB;AAED,iFAAiF;AACjF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAmBvE;AAED,uEAAuE;AACvE,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAErD;AAED,uDAAuD;AACvD,wBAAgB,SAAS,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAGxD;AAED,gFAAgF;AAChF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAQpI;AAED,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAE1D"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAQvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAO3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAgBvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAe3C,CAAC"}

package/dist/lint/post-synth/no-root-user.d.ts

@@ -1,8 +1,9 @@
 /**
  * DKRD012: No Root User
  *
- * Warns when a Dockerfile has no USER instruction,
- * meaning the container runs as root by default.
+ * Warns when the container would run as root: the final stage has no USER
+ * instruction, or its last USER is root. USER in an earlier stage does not
+ * carry into the final image.
  */
 import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
 export declare const dkrd012: PostSynthCheck;

package/dist/lint/post-synth/no-root-user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"no-root-user.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/no-root-user.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAyBrB,CAAC"}
+{"version":3,"file":"no-root-user.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/no-root-user.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cA0BrB,CAAC"}

package/dist/lint/post-synth/relative-workdir.d.ts

@@ -0,0 +1,10 @@
+/**
+ * DKRD018: Relative WORKDIR
+ *
+ * A relative WORKDIR resolves against whatever directory the base image
+ * left, which can change with the image. Use an absolute path, at least for
+ * the first WORKDIR of a stage.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const dkrd018: PostSynthCheck;
+//# sourceMappingURL=relative-workdir.d.ts.map

package/dist/lint/post-synth/relative-workdir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relative-workdir.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/relative-workdir.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cA0BrB,CAAC"}

package/dist/lint/post-synth/repeated-cmd.d.ts

@@ -0,0 +1,9 @@
+/**
+ * DKRD015: More than one CMD or ENTRYPOINT in a stage
+ *
+ * Only the last CMD and the last ENTRYPOINT of a stage take effect; the
+ * earlier ones are silently ignored.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const dkrd015: PostSynthCheck;
+//# sourceMappingURL=repeated-cmd.d.ts.map

package/dist/lint/post-synth/repeated-cmd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repeated-cmd.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/repeated-cmd.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAwBrB,CAAC"}

package/dist/lint/post-synth/root-after-user.d.ts

@@ -0,0 +1,10 @@
+/**
+ * DKRD014: Root-only command after a non-root USER
+ *
+ * A RUN that installs packages or manages users and ownership (apt-get,
+ * apk add, useradd, chown, ...) fails or misbehaves after USER switches to
+ * an unprivileged user. Run root setup first, then switch USER.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const dkrd014: PostSynthCheck;
+//# sourceMappingURL=root-after-user.d.ts.map

package/dist/lint/post-synth/root-after-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-after-user.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/root-after-user.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,OAAO,EAAE,cA8BrB,CAAC"}

package/dist/lint/post-synth/unused-global-arg.d.ts

@@ -0,0 +1,10 @@
+/**
+ * DKRD017: ARG before FROM that nothing uses
+ *
+ * An ARG declared before the first FROM is only visible to FROM lines, and
+ * to stages that declare it again (`ARG NAME`). One that neither uses does
+ * nothing.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const dkrd017: PostSynthCheck;
+//# sourceMappingURL=unused-global-arg.d.ts.map

package/dist/lint/post-synth/unused-global-arg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unused-global-arg.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/unused-global-arg.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cA0BrB,CAAC"}

package/dist/lint/rules/index.d.ts

@@ -2,4 +2,5 @@
  * All imperative lint rules for the Docker lexicon.
  */
 export { noLatestTagRule } from "./no-latest-tag.js";
+export { perKindOrderRule } from "./per-kind-order.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/lint/rules/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/lint/rules/per-kind-order.d.ts

@@ -0,0 +1,15 @@
+/**
+ * DKRS002: Per-kind Dockerfile fields written in a different order
+ *
+ * A Dockerfile stage without `steps` writes its per-kind fields (`run`,
+ * `copy`, `user`, ...) in a fixed order: ARG, ENV, WORKDIR, USER, RUN, COPY,
+ * ADD, EXPOSE, VOLUME, LABEL, ENTRYPOINT, CMD, HEALTHCHECK. When the fields
+ * are declared in another order (`copy` before `run`, `run` before `user`)
+ * the generated Dockerfile does not run them in the order they read in.
+ *
+ * The fix rewrites the fields as `steps` in the fixed order, so the
+ * generated Dockerfile stays the same, with a comment to reorder them.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const perKindOrderRule: LintRule;
+//# sourceMappingURL=per-kind-order.d.ts.map

package/dist/lint/rules/per-kind-order.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"per-kind-order.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/per-kind-order.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAwC,MAAM,4BAA4B,CAAC;AA2GjG,eAAO,MAAM,gBAAgB,EAAE,QAS9B,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "docker",
-  "version": "0.124.21",
+  "version": "0.124.22",
   "chantVersion": ">=0.1.0",
   "namespace": "Docker",
   "intrinsics": [

package/dist/meta.json

@@ -220,6 +220,12 @@
       },
       "healthcheck": {
         "description": "Health check instruction"
+      },
+      "globalArgs": {
+        "description": "ARG instructions written before the first FROM"
+      },
+      "steps": {
+        "description": "Instructions after FROM, written in the order given; one instruction per step"
       }
     }
   }

package/dist/okf/index.md

@@ -18,5 +18,14 @@ okf_version: '0.2'
 * [DKRD003](/rules/DKRD003.md) - Service exposes SSH port (22) externally — this is a security risk
 * [DKRD010](/rules/DKRD010.md) - apt-get install without --no-install-recommends adds unnecessary packages
 * [DKRD011](/rules/DKRD011.md) - Prefer COPY over ADD when not fetching URLs or extracting archives
-* [DKRD012](/rules/DKRD012.md) - Dockerfile has no USER instruction — container runs as root
+* [DKRD012](/rules/DKRD012.md) - Dockerfile's final stage has no USER instruction, or ends on USER root — container runs as root
+* [DKRD013](/rules/DKRD013.md) - Whole build context copied before a dependency install — every source change re-runs the install
+* [DKRD014](/rules/DKRD014.md) - RUN needs root but comes after USER switched to a non-root user
+* [DKRD015](/rules/DKRD015.md) - More than one CMD or ENTRYPOINT in a stage — only the last one takes effect
+* [DKRD016](/rules/DKRD016.md) - COPY --from names a stage that is not defined before it
+* [DKRD017](/rules/DKRD017.md) - ARG before the first FROM is not used by any FROM or stage
+* [DKRD018](/rules/DKRD018.md) - Relative WORKDIR before any absolute WORKDIR in the stage
+* [DKRD019](/rules/DKRD019.md) - ADD fetches a remote URL without --checksum
+* [DKRD020](/rules/DKRD020.md) - apt-get update in a different RUN from apt-get install — the install can use a stale package index
 * [DKRS001](/rules/DKRS001.md) - No Latest Tag
+* [DKRS002](/rules/DKRS002.md) - Per-kind Dockerfile fields written in a different order

package/dist/okf/rules/DKRD012.md

@@ -1,14 +1,14 @@
 ---
 type: post-synth-check
 title: DKRD012
-description: Dockerfile has no USER instruction — container runs as root
+description: Dockerfile's final stage has no USER instruction, or ends on USER root — container runs as root
 id: DKRD012
 severity: error
 category: post-synth
 lexicon: docker
 docs: https://intentius.io/chant/lexicons/docker/rules/
 ---
-Dockerfile has no USER instruction — container runs as root
+Dockerfile's final stage has no USER instruction, or ends on USER root — container runs as root
 
 ## Applies to
 

package/dist/okf/rules/DKRD013.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DKRD013
+description: Whole build context copied before a dependency install — every source change re-runs the install
+id: DKRD013
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+Whole build context copied before a dependency install — every source change re-runs the install

package/dist/okf/rules/DKRD014.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DKRD014
+description: RUN needs root but comes after USER switched to a non-root user
+id: DKRD014
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+RUN needs root but comes after USER switched to a non-root user

package/dist/okf/rules/DKRD015.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DKRD015
+description: More than one CMD or ENTRYPOINT in a stage — only the last one takes effect
+id: DKRD015
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+More than one CMD or ENTRYPOINT in a stage — only the last one takes effect