@intentius/chant-lexicon-docker 0.124.21 → 0.124.22

package/dist/rules/root-after-user.ts

@@ -0,0 +1,44 @@
+/**
+ * DKRD014: Root-only command after a non-root USER
+ *
+ * A RUN that installs packages or manages users and ownership (apt-get,
+ * apk add, useradd, chown, ...) fails or misbehaves after USER switches to
+ * an unprivileged user. Run root setup first, then switch USER.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { commandText, eachDockerfile, instrText, isRootUser, stageLabel } from "./docker-helpers";
+
+const ROOT_ONLY = /(^|[\s;&|(])(apt-get\s+(install|update|upgrade|dist-upgrade|remove|purge)|apt\s+(install|update|upgrade)|apk\s+(add|update|upgrade|del)|yum\s+(install|update)|dnf\s+(install|update|upgrade)|microdnf\s+install|zypper\s+(install|in|refresh)|useradd|adduser|groupadd|addgroup|usermod|chown)\b/;
+
+export const dkrd014: PostSynthCheck = {
+  id: "DKRD014",
+  description: "RUN needs root but comes after USER switched to a non-root user",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+      for (const stage of parsed.stages) {
+        let user: string | undefined;
+        for (const instr of stage.instructions) {
+          if (instr.instruction === "USER") {
+            user = instr.value.trim();
+            continue;
+          }
+          if (instr.instruction !== "RUN" || user === undefined || isRootUser(user)) continue;
+          const cmd = commandText(instr);
+          if (/\bsudo\b/.test(cmd) || !ROOT_ONLY.test(cmd)) continue;
+          diagnostics.push({
+            checkId: "DKRD014",
+            severity: "warning",
+            message: `${fileName} ${stageLabel(stage)}: ${instrText(instr)} needs root but runs as USER ${user}. Move it before the USER step, or switch to USER root for it.`,
+            lexicon: "docker",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/unused-global-arg.ts

@@ -0,0 +1,38 @@
+/**
+ * DKRD017: ARG before FROM that nothing uses
+ *
+ * An ARG declared before the first FROM is only visible to FROM lines, and
+ * to stages that declare it again (`ARG NAME`). One that neither uses does
+ * nothing.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { eachDockerfile } from "./docker-helpers";
+
+export const dkrd017: PostSynthCheck = {
+  id: "DKRD017",
+  description: "ARG before the first FROM is not used by any FROM or stage",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const { fileName, content, parsed } of eachDockerfile(ctx.outputs)) {
+      const fromLines = content.split("\n").filter((l) => /^\s*FROM\s/i.test(l)).join("\n");
+      for (const arg of parsed.globalArgs) {
+        const name = arg.value.trim().split("=")[0]!.trim();
+        if (!name) continue;
+        const used = new RegExp(`\\$\\{?${name}\\b`).test(fromLines);
+        const redeclared = parsed.stages.some((s) => s.instructions.some((i) => i.instruction === "ARG" && i.value.trim().split("=")[0]!.trim() === name));
+        if (used || redeclared) continue;
+        diagnostics.push({
+          checkId: "DKRD017",
+          severity: "warning",
+          message: `${fileName}: ARG ${name} is declared before FROM but no FROM uses it and no stage declares it again with ARG ${name}. Use it, declare it in the stage that needs it, or remove it.`,
+          lexicon: "docker",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAoB,UAAU,EAAoB,MAAM,6BAA6B,CAAC;AA6SlG,eAAO,MAAM,gBAAgB,EAAE,UAqE9B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAoB,UAAU,EAAoB,MAAM,6BAA6B,CAAC;AA4VlG,eAAO,MAAM,gBAAgB,EAAE,UAqE9B,CAAC"}

package/dist/skills/chant-docker-patterns.md

@@ -53,55 +53,124 @@ export const nginx = new Service({
 
 ## Multi-stage Node.js Dockerfile
 
+Manifests before source so the install layer is cached; the runtime stage takes only what it needs and runs as `node`.
+
 ```typescript
 export const nodeApp = new Dockerfile({
   stages: [
     {
       from: "node:20-alpine",
       as: "deps",
-      workdir: "/app",
-      copy: ["package*.json ./"],
-      run: ["npm ci --only=production"],
+      steps: [
+        { workdir: "/app" },
+        { copy: "package.json package-lock.json ./" },
+        { run: "npm ci --omit=dev" },
+      ],
     },
     {
       from: "node:20-alpine",
       as: "build",
-      workdir: "/app",
-      copy: ["--from=deps /app/node_modules ./node_modules", ". ."],
-      run: ["npm run build"],
+      steps: [
+        { workdir: "/app" },
+        { copy: "package.json package-lock.json ./" },
+        { run: "npm ci" },
+        { copy: ". ." },
+        { run: "npm run build" },
+      ],
     },
     {
       from: "node:20-alpine",
-      workdir: "/app",
-      copy: [
-        "--from=deps /app/node_modules ./node_modules",
-        "--from=build /app/dist ./dist",
+      steps: [
+        { workdir: "/app" },
+        { copy: "--from=deps /app/node_modules ./node_modules" },
+        { copy: "--from=build /app/dist ./dist" },
+        { user: "node" },
+        { expose: 3000 },
+        { cmd: ["node", "dist/index.js"] },
       ],
-      user: "node",
-      expose: ["3000"],
-      cmd: `["node", "dist/index.js"]`,
     },
   ],
 });
 ```
 
-## Python service with virtualenv
+## Python service
 
 ```typescript
 export const pythonApp = new Dockerfile({
   from: "python:3.12-slim",
-  workdir: "/app",
-  env: ["PYTHONUNBUFFERED=1", "PYTHONDONTWRITEBYTECODE=1"],
-  copy: ["requirements.txt ."],
-  run: [
-    "pip install --no-cache-dir --no-deps -r requirements.txt",
+  steps: [
+    { workdir: "/app" },
+    { env: "PYTHONUNBUFFERED=1" },
+    { env: "PYTHONDONTWRITEBYTECODE=1" },
+    { copy: "requirements.txt ." },
+    { run: "pip install --no-cache-dir -r requirements.txt" },
+    { copy: ". ." },
+    { user: "1000:1000" },
+    { cmd: ["python", "-m", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"] },
   ],
-  copy: [". ."],
-  user: "1000:1000",
-  cmd: `["python", "-m", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]`,
 });
 ```
 
+## Root setup, then USER
+
+```typescript
+export const tool = new Dockerfile({
+  from: "debian:12-slim",
+  steps: [
+    { run: "apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*" },
+    { run: "useradd --system --create-home app" },
+    { workdir: "/home/app" },
+    { copy: "--chown=app:app bin/ ./bin/" },
+    { user: "app" },
+    { entrypoint: ["./bin/tool"] },
+  ],
+});
+```
+
+## Sharing stages and steps across modules
+
+Export `const` stages and step lists from one module and import them into each Dockerfile. This is the chant answer to `INCLUDE`.
+
+```typescript
+// src/shared/node.ts
+import type { DockerfileStage, DockerfileStep } from "@intentius/chant-lexicon-docker";
+
+export const nodeBuild: DockerfileStage = {
+  from: "node:20-alpine",
+  as: "build",
+  steps: [
+    { workdir: "/app" },
+    { copy: "package.json package-lock.json ./" },
+    { run: "npm ci" },
+    { copy: ". ." },
+    { run: "npm run build" },
+    { run: "npm prune --omit=dev" },
+  ],
+};
+
+export const nodeRuntime: DockerfileStep[] = [
+  { workdir: "/app" },
+  { copy: "--from=build /app/node_modules ./node_modules" },
+  { copy: "--from=build /app/dist ./dist" },
+  { user: "node" },
+];
+```
+
+```typescript
+// src/web.ts
+import { Dockerfile, type DockerfileStage } from "@intentius/chant-lexicon-docker";
+import { nodeBuild, nodeRuntime } from "./shared/node";
+
+const runtime: DockerfileStage = {
+  from: "node:20-alpine",
+  steps: [...nodeRuntime, { expose: 3000 }, { cmd: ["node", "dist/server.js"] }],
+};
+
+export const web = new Dockerfile({ stages: [nodeBuild, runtime] });
+```
+
+For a shared Dockerfile that takes parameters, write a `Composite((props) => ({ image: new Dockerfile({...}) }))`; spreads are allowed inside it. The `dockerfile-sharing` example in the lexicon has all three patterns.
+
 ## Network isolation
 
 ```typescript

package/dist/skills/chant-docker.md

@@ -39,15 +39,21 @@ export const nfsdata = new Volume({ driver: "local", driver_opts: { type: "nfs",
 
 ## Dockerfile — generates Dockerfile.{name}:
 
+Each stage is `from` plus `steps`. A step is an object with one key naming one instruction. Steps are written exactly in the order listed.
+
 ```typescript
-// Single-stage:
-export const builder = new Dockerfile({
+// Single stage. Manifests before source, so the install layer is cached; root setup before USER.
+export const server = new Dockerfile({
   from: "node:20-alpine",
-  workdir: "/app",
-  copy: ["package*.json ./"],
-  run: ["npm ci --only=production"],
-  user: "node",
-  cmd: `["node", "dist/index.js"]`,
+  steps: [
+    { workdir: "/app" },
+    { copy: "package.json package-lock.json ./" },
+    { run: "npm ci --omit=dev" },
+    { copy: "src/ ./src/" },
+    { user: "node" },
+    { expose: 3000 },
+    { cmd: ["node", "src/index.js"] },  // a list is written in JSON exec form
+  ],
 });
 
 // Multi-stage build:
@@ -56,21 +62,36 @@ export const app = new Dockerfile({
     {
       from: "node:20-alpine",
       as: "build",
-      workdir: "/app",
-      copy: ["package*.json ./"],
-      run: ["npm ci", "npm run build"],
+      steps: [
+        { workdir: "/app" },
+        { copy: "package.json package-lock.json ./" },
+        { run: "npm ci" },
+        { copy: ". ." },
+        { run: "npm run build" },
+        { run: "npm prune --omit=dev" },
+      ],
     },
     {
       from: "node:20-alpine",
-      workdir: "/app",
-      copy: ["--from=build /app/dist ./dist", "--from=build /app/node_modules ./node_modules"],
-      user: "node",
-      cmd: `["node", "dist/index.js"]`,
+      steps: [
+        { workdir: "/app" },
+        { copy: "--from=build /app/node_modules ./node_modules" },
+        { copy: "--from=build /app/dist ./dist" },
+        { user: "node" },
+        { cmd: ["node", "dist/index.js"] },
+      ],
     },
   ],
 });
 ```
 
+Step keys: `arg`, `env`, `workdir`, `user`, `run`, `copy`, `add`, `expose`, `volume`, `label`, `entrypoint`, `cmd`, `healthcheck`, `shell`, `stopsignal`, `onbuild`. `from` and `as` are stage fields, and `globalArgs: ["NAME=value"]` writes `ARG` lines before the first `FROM`. `run`, `cmd`, `entrypoint` and `shell` take a string or a list (exec form); `expose` takes a number too.
+
+Rules:
+- Use `steps`. The older per-kind fields (`run: [...]`, `copy: [...]`, `user`) are written in a fixed order (ARG, ENV, WORKDIR, USER, RUN, COPY, ADD, EXPOSE, VOLUME, LABEL, ENTRYPOINT, CMD, HEALTHCHECK), not the order written, so every RUN lands before every COPY. Lint rule DKRS002 flags this, and `chant lint --fix` rewrites them as steps.
+- A stage can't have both `steps` and per-kind fields, and a step can't name two instructions. Both are build errors.
+- To share stages or steps between Dockerfiles in different modules, export a `const` stage (`DockerfileStage`) or step list (`DockerfileStep[]`) and import it. List the stage in `stages`, or spread the steps: `steps: [...nodeRuntime, { cmd: ["node", "dist/server.js"] }]`. This is chant's equivalent of an INCLUDE. Spreading a function call's result is a lint error (EVL004); put parameterized Dockerfiles in a `Composite`.
+
 ## Variable interpolation with env():
 
 ```typescript
@@ -112,7 +133,10 @@ export const api = new Service({
   },
   ports: ["8080:8080"],
 });
-export const builder = new Dockerfile({ from: "node:20-alpine", ... });
+export const builder = new Dockerfile({
+  from: "node:20-alpine",
+  steps: [{ workdir: "/app" }, { copy: ". ." }, { run: "npm ci" }, { user: "node" }, { cmd: ["node", "index.js"] }],
+});
 ```
 
 ## Output structure
@@ -126,4 +150,6 @@ export const builder = new Dockerfile({ from: "node:20-alpine", ... });
 - `DKRD001`: Post-synth: no `:latest` images in generated YAML
 - `DKRD002`: Post-synth: no unused named volumes
 - `DKRD003`: Post-synth: SSH port 22 not exposed externally
-- `DKRD010–012`: Dockerfile best practices (apt recommends, COPY vs ADD, USER)
+- `DKRS002`: Dockerfile per-kind fields declared in an order the fixed order changes; use `steps`
+- `DKRD010–012`: Dockerfile best practices (apt recommends, COPY vs ADD, final stage USER)
+- `DKRD013–020`: order-aware Dockerfile checks: COPY . before a dependency install, root-only RUN after USER, repeated CMD/ENTRYPOINT, COPY --from an undefined stage, unused ARG before FROM, relative WORKDIR, ADD of a URL without --checksum, apt-get update in its own RUN

package/dist/spec/parse-engine.d.ts

@@ -14,6 +14,15 @@ export interface DockerfileInstruction {
     name: string;
     description?: string;
     multi?: boolean;
+    /**
+     * Only available as a step (`{ shell: ... }` in `steps`), not as a per-kind
+     * field. The per-kind fields keep the set and fixed order they always had.
+     */
+    stepOnly?: boolean;
+    /** As a step, the value may be a JSON exec-form array as well as a string. */
+    execForm?: boolean;
+    /** As a step, the value may be a number as well as a string. */
+    numeric?: boolean;
 }
 /**
  * Parse the Docker Engine API YAML buffer for Dockerfile instruction types.

package/dist/spec/parse-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-engine.d.ts","sourceRoot":"","sources":["../../src/spec/parse-engine.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,qBAAqB,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,CAsBnE"}
+{"version":3,"file":"parse-engine.d.ts","sourceRoot":"","sources":["../../src/spec/parse-engine.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,qBAAqB,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gEAAgE;IAChE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,CAyBnE"}

package/dist/types/index.d.ts

@@ -56,39 +56,120 @@ export interface DockerSecretProps {
 }
 export declare const DockerSecret: new (props?: DockerSecretProps) => Declarable;
 
+/** The Dockerfile instructions a step can name. FROM is the stage's own `from` field. */
+export type DockerfileInstructionName = "arg" | "env" | "run" | "copy" | "add" | "workdir" | "user" | "expose" | "volume" | "label" | "entrypoint" | "cmd" | "healthcheck" | "shell" | "stopsignal" | "onbuild";
+type DockerfileStepOf<K extends DockerfileInstructionName, V> = { [P in K]: V } & { [P in Exclude<DockerfileInstructionName, K>]?: never };
+/**
+ * One Dockerfile instruction, named by its single key: `{ run: "npm ci" }` is `RUN npm ci`.
+ * A string[] value (run, cmd, entrypoint, shell) is written in JSON exec form.
+ */
+export type DockerfileStep =
+  /** ARG: Build-time argument */
+  | DockerfileStepOf<"arg", string>
+  /** ENV: Environment variable */
+  | DockerfileStepOf<"env", string>
+  /** RUN: Run a command during build */
+  | DockerfileStepOf<"run", string | string[]>
+  /** COPY: Copy files from build context */
+  | DockerfileStepOf<"copy", string>
+  /** ADD: Add files (supports URLs and archives) */
+  | DockerfileStepOf<"add", string>
+  /** WORKDIR: Set working directory */
+  | DockerfileStepOf<"workdir", string>
+  /** USER: Set user for subsequent instructions */
+  | DockerfileStepOf<"user", string>
+  /** EXPOSE: Document exposed ports */
+  | DockerfileStepOf<"expose", string | number>
+  /** VOLUME: Create mount points */
+  | DockerfileStepOf<"volume", string>
+  /** LABEL: Add metadata labels */
+  | DockerfileStepOf<"label", string>
+  /** ENTRYPOINT: Set the entrypoint executable */
+  | DockerfileStepOf<"entrypoint", string | string[]>
+  /** CMD: Default command arguments */
+  | DockerfileStepOf<"cmd", string | string[]>
+  /** HEALTHCHECK: Health check instruction */
+  | DockerfileStepOf<"healthcheck", string>
+  /** SHELL: Set the shell for shell-form commands (JSON array form) */
+  | DockerfileStepOf<"shell", string | string[]>
+  /** STOPSIGNAL: Signal sent to stop the container */
+  | DockerfileStepOf<"stopsignal", string>
+  /** ONBUILD: Instruction to run when the image is used as a base */
+  | DockerfileStepOf<"onbuild", string>;
+/**
+ * One build stage: FROM, then its instructions.
+ * Without `steps`, the per-kind fields are written in a fixed order: ARG, ENV, WORKDIR, USER, RUN, COPY, ADD, EXPOSE, VOLUME, LABEL, ENTRYPOINT, CMD, HEALTHCHECK.
+ */
 export interface DockerfileStage {
   from: string;
   as?: string;
+  /** Instructions after FROM, written exactly in this order. Can't be combined with the per-kind fields. */
+  steps?: DockerfileStep[];
+  /** ARG as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   arg?: string[];
+  /** ENV as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   env?: string[];
+  /** RUN as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   run?: string[];
+  /** COPY as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   copy?: string[];
+  /** ADD as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   add?: string[];
+  /** WORKDIR as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   workdir?: string;
+  /** USER as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   user?: string;
+  /** EXPOSE as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   expose?: string[];
+  /** VOLUME as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   volume?: string[];
+  /** LABEL as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   label?: string[];
+  /** ENTRYPOINT as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   entrypoint?: string;
+  /** CMD as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   cmd?: string;
+  /** HEALTHCHECK as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   healthcheck?: string;
 }
+/**
+ * A Dockerfile: `stages` for a multi-stage build, or `from` and the stage fields for one stage.
+ * Without `steps`, the per-kind fields are written in a fixed order: ARG, ENV, WORKDIR, USER, RUN, COPY, ADD, EXPOSE, VOLUME, LABEL, ENTRYPOINT, CMD, HEALTHCHECK.
+ */
 export interface DockerfileProps {
   name?: string;
+  /** ARG instructions written before the first FROM, e.g. `["NODE_VERSION=20"]`. */
+  globalArgs?: string[];
   from?: string;
+  as?: string;
   stages?: DockerfileStage[];
+  /** Instructions after FROM, written exactly in this order. Can't be combined with the per-kind fields. */
+  steps?: DockerfileStep[];
+  /** ARG as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   arg?: string[];
+  /** ENV as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   env?: string[];
+  /** RUN as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   run?: string[];
+  /** COPY as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   copy?: string[];
+  /** ADD as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   add?: string[];
+  /** WORKDIR as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   workdir?: string;
+  /** USER as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   user?: string;
+  /** EXPOSE as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   expose?: string[];
+  /** VOLUME as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   volume?: string[];
+  /** LABEL as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   label?: string[];
+  /** ENTRYPOINT as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   entrypoint?: string;
+  /** CMD as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   cmd?: string;
+  /** HEALTHCHECK as a per-kind field, written in the fixed order. Use `steps` to choose the order. */
   healthcheck?: string;
 }
 export declare const Dockerfile: new (props?: DockerfileProps) => Declarable;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-docker",
-  "version": "0.124.21",
+  "version": "0.124.22",
   "description": "Docker lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -63,13 +63,13 @@
     "build": "../../scripts/tsc7.sh -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
   },
   "dependencies": {
-    "@intentius/chant-lexicon-otel": "^0.124.21"
+    "@intentius/chant-lexicon-otel": "^0.124.22"
   },
   "devDependencies": {
     "@intentius/chant": "*",
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.21"
+    "@intentius/chant": "^0.124.22"
   }
 }