@intentius/chant-lexicon-docker 0.124.31 → 0.124.32

package/dist/lint/post-synth/unused-volume.js

@@ -0,0 +1,41 @@
+/**
+ * DKRD002: Unused Named Volume
+ *
+ * Detects top-level named volumes that are not mounted by any service.
+ */
+import { getPrimaryOutput, extractServices, extractNamedVolumes } from "./docker-helpers.js";
+export const dkrd002 = {
+    id: "DKRD002",
+    description: "Named volume is declared but not mounted by any service",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_outputName, output] of ctx.outputs) {
+            const yaml = getPrimaryOutput(output);
+            if (!yaml)
+                continue;
+            const namedVolumes = extractNamedVolumes(yaml);
+            if (namedVolumes.size === 0)
+                continue;
+            const services = extractServices(yaml);
+            const mountedVolumes = new Set();
+            for (const svc of services.values()) {
+                for (const vol of svc.volumes ?? []) {
+                    // Volume mount format: "volname:/container/path" or just "volname"
+                    const volumeName = vol.split(":")[0].trim();
+                    mountedVolumes.add(volumeName);
+                }
+            }
+            for (const volName of namedVolumes) {
+                if (!mountedVolumes.has(volName)) {
+                    diagnostics.push({
+                        checkId: "DKRD002",
+                        severity: "warning",
+                        message: `Named volume "${volName}" is declared but not mounted by any service.`,
+                        lexicon: "docker",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/rules/data/deprecated-images.js

@@ -0,0 +1,26 @@
+/**
+ * Known deprecated or EOL Docker base images.
+ */
+export const DEPRECATED_IMAGES = [
+    {
+        image: "centos:8",
+        reason: "CentOS 8 reached EOL on December 31, 2021",
+        replacement: "rockylinux:8 or almalinux:8",
+    },
+    {
+        image: "centos:latest",
+        reason: "CentOS Stream is a rolling release; use a specific version",
+        replacement: "rockylinux:9 or almalinux:9",
+    },
+    {
+        image: "node:lts",
+        reason: "Use a specific LTS version tag for reproducible builds",
+        replacement: "node:20-alpine or node:22-alpine",
+    },
+];
+/**
+ * Check if an image reference matches a deprecated entry.
+ */
+export function findDeprecatedImage(imageRef) {
+    return DEPRECATED_IMAGES.find((d) => imageRef === d.image || imageRef.startsWith(d.image + "@"));
+}

package/dist/lint/rules/data/known-base-images.js

@@ -0,0 +1,18 @@
+/**
+ * Well-known Docker base images for rule validation.
+ */
+export const KNOWN_BASE_IMAGES = new Set([
+    "alpine", "ubuntu", "debian", "centos", "fedora", "amazonlinux",
+    "node", "python", "ruby", "golang", "rust", "java", "openjdk",
+    "nginx", "httpd", "caddy", "traefik",
+    "postgres", "mysql", "mariadb", "mongodb", "redis", "memcached",
+    "rabbitmq", "kafka", "zookeeper",
+    "elasticsearch", "kibana", "logstash",
+    "busybox", "scratch",
+]);
+/**
+ * Images that are safe to use without a tag (they have meaningful `latest`).
+ */
+export const IMAGES_SAFE_LATEST = new Set([
+    "scratch",
+]);

package/dist/lint/rules/index.js

@@ -0,0 +1,5 @@
+/**
+ * All imperative lint rules for the Docker lexicon.
+ */
+export { noLatestTagRule } from "./no-latest-tag.js";
+export { perKindOrderRule } from "./per-kind-order.js";

package/dist/lint/rules/no-latest-tag.js

@@ -0,0 +1,57 @@
+/**
+ * DKRS001: No Latest Tag
+ *
+ * Warns when a Service's image prop is set to a literal string
+ * ending with `:latest` or has no tag (implies latest).
+ * Using `:latest` prevents reproducible builds.
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+function isLatestImage(imageValue) {
+    const trimmed = imageValue.trim();
+    if (!trimmed || trimmed.startsWith("${"))
+        return false;
+    // Has :latest tag
+    if (trimmed.endsWith(":latest"))
+        return true;
+    // No tag at all (no colon after image name, no @sha256)
+    const parts = trimmed.split("/");
+    const lastPart = parts[parts.length - 1];
+    if (!lastPart.includes(":") && !lastPart.includes("@"))
+        return true;
+    return false;
+}
+export const noLatestTagRule = {
+    id: "DKRS001",
+    severity: "warning",
+    category: "correctness",
+    description: "Avoid :latest or untagged image references — use explicit version tags for reproducible builds",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            // Look for `image: "..."` in object literals (properties named "image")
+            if (ts.isPropertyAssignment(node) &&
+                ts.isIdentifier(node.name) &&
+                node.name.text === "image") {
+                const init = node.initializer;
+                if (ts.isStringLiteral(init) || ts.isNoSubstitutionTemplateLiteral(init)) {
+                    const text = init.text;
+                    if (isLatestImage(text)) {
+                        const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                        diagnostics.push({
+                            file: sourceFile.fileName,
+                            line: line + 1,
+                            column: character + 1,
+                            ruleId: "DKRS001",
+                            severity: "warning",
+                            message: `Image "${text}" uses :latest or has no tag. Use an explicit version tag (e.g., "nginx:1.25-alpine") for reproducible builds.`,
+                        });
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/per-kind-order.js

@@ -0,0 +1,129 @@
+/**
+ * DKRS002: Per-kind Dockerfile fields written in a different order
+ *
+ * A Dockerfile stage without `steps` writes its per-kind fields (`run`,
+ * `copy`, `user`, ...) in a fixed order: ARG, ENV, WORKDIR, USER, RUN, COPY,
+ * ADD, EXPOSE, VOLUME, LABEL, ENTRYPOINT, CMD, HEALTHCHECK. When the fields
+ * are declared in another order (`copy` before `run`, `run` before `user`)
+ * the generated Dockerfile does not run them in the order they read in.
+ *
+ * The fix rewrites the fields as `steps` in the fixed order, so the
+ * generated Dockerfile stays the same, with a comment to reorder them.
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+import { PER_KIND_ORDER } from "../../dockerfile-order.js";
+const PER_KIND = new Set(PER_KIND_ORDER);
+/** Per-kind fields that take one string; the rest take a list. */
+const SINGLE = new Set(["workdir", "user", "entrypoint", "cmd", "healthcheck"]);
+const FIX_NOTE = "// Written by the DKRS002 fix in the fixed order the per-kind fields used, so the output is unchanged. Reorder the steps as the build needs.";
+function propName(p) {
+    if (!(ts.isPropertyAssignment(p) || ts.isShorthandPropertyAssignment(p)))
+        return undefined;
+    const n = p.name;
+    if (ts.isIdentifier(n) || ts.isStringLiteral(n))
+        return n.text;
+    return undefined;
+}
+function isDockerfileNew(node) {
+    if (!ts.isNewExpression(node))
+        return false;
+    const e = node.expression;
+    return (ts.isIdentifier(e) && e.text === "Dockerfile") || (ts.isPropertyAccessExpression(e) && e.name.text === "Dockerfile");
+}
+/** The stage-shaped object literals of one `new Dockerfile({...})`. */
+function stageLiterals(arg) {
+    const stagesProp = arg.properties.find((p) => propName(p) === "stages");
+    if (!stagesProp)
+        return [arg];
+    // With stages, the top-level per-kind fields are not written at all.
+    if (!ts.isPropertyAssignment(stagesProp) || !ts.isArrayLiteralExpression(stagesProp.initializer))
+        return [];
+    return stagesProp.initializer.elements.filter(ts.isObjectLiteralExpression);
+}
+/** The `{ key: value }` step texts for one per-kind field, or undefined when its value can't be split. */
+function stepTexts(sf, key, p) {
+    if (!ts.isPropertyAssignment(p))
+        return undefined;
+    const init = p.initializer;
+    if (SINGLE.has(key))
+        return [`{ ${key}: ${init.getText(sf)} }`];
+    if (!ts.isArrayLiteralExpression(init))
+        return undefined;
+    const out = [];
+    for (const el of init.elements) {
+        if (ts.isSpreadElement(el) || ts.isOmittedExpression(el))
+            return undefined;
+        out.push(`{ ${key}: ${el.getText(sf)} }`);
+    }
+    return out;
+}
+function buildFix(sf, obj, perKind) {
+    const byKey = new Map();
+    for (const p of perKind)
+        byKey.set(propName(p), p);
+    const steps = [];
+    for (const key of PER_KIND_ORDER) {
+        const p = byKey.get(key);
+        if (!p)
+            continue;
+        const texts = stepTexts(sf, key, p);
+        if (!texts)
+            return undefined;
+        steps.push(...texts);
+    }
+    const first = perKind[0];
+    const last = perKind[perKind.length - 1];
+    const start = first.getStart(sf);
+    const end = last.getEnd();
+    const lineStart = sf.text.lastIndexOf("\n", start - 1) + 1;
+    const indent = /^[ \t]*/.exec(sf.text.slice(lineStart, start))[0];
+    // Other props between the first and last per-kind field (rare) are kept, ahead of steps.
+    const kept = obj.properties.filter((p) => p.getStart(sf) > start && p.getEnd() < end && !perKind.includes(p)).map((p) => p.getText(sf));
+    const stepsText = `${FIX_NOTE}\n${indent}steps: [\n${steps.map((s) => `${indent}  ${s},`).join("\n")}\n${indent}]`;
+    return { range: [start, end], replacement: [...kept, stepsText].join(`,\n${indent}`), kind: "replace" };
+}
+function check(context) {
+    const { sourceFile: sf } = context;
+    const diagnostics = [];
+    const visit = (node) => {
+        if (isDockerfileNew(node)) {
+            const arg = node.arguments?.[0];
+            if (arg && ts.isObjectLiteralExpression(arg)) {
+                for (const obj of stageLiterals(arg)) {
+                    if (obj.properties.some((p) => propName(p) === "steps"))
+                        continue;
+                    const perKind = obj.properties.filter((p) => PER_KIND.has(propName(p) ?? ""));
+                    const declared = perKind.map((p) => propName(p));
+                    const fixed = [...declared].sort((a, b) => PER_KIND_ORDER.indexOf(a) - PER_KIND_ORDER.indexOf(b));
+                    if (declared.join() === fixed.join())
+                        continue;
+                    const { line, character } = sf.getLineAndCharacterOfPosition(perKind[0].getStart(sf));
+                    const fix = buildFix(sf, obj, perKind);
+                    diagnostics.push({
+                        file: sf.fileName,
+                        line: line + 1,
+                        column: character + 1,
+                        ruleId: "DKRS002",
+                        severity: "warning",
+                        message: `Dockerfile fields declared as ${declared.join(", ")} are written in the fixed order ${fixed.join(", ")}. ` +
+                            `Use steps to write the instructions in the order the build needs${fix ? " (chant lint --fix rewrites them as steps)" : ""}.`,
+                        ...(fix ? { fix } : {}),
+                    });
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sf);
+    return diagnostics;
+}
+export const perKindOrderRule = {
+    id: "DKRS002",
+    severity: "warning",
+    category: "correctness",
+    description: "Dockerfile per-kind fields are written in a fixed order that differs from the declared order — use steps",
+    check,
+    fix(context) {
+        return check(context).flatMap((d) => (d.fix ? [d.fix] : []));
+    },
+};

package/dist/list-artifacts.js

@@ -0,0 +1,133 @@
+/**
+ * Live introspection of a Docker host via three independent CLI queries.
+ *
+ * The Docker lexicon's chant entities describe Compose / Dockerfile
+ * authoring primitives. The runtime concept (running containers, local
+ * images, networks) is created by `docker compose up` / `docker run` /
+ * `docker network create` outside chant's entity model.
+ *
+ *   docker ps         --format '{{json .}}'  → running containers
+ *   docker image ls   --format '{{json .}}'  → local images
+ *   docker network ls --format '{{json .}}'  → networks
+ *
+ * Output is one JSON object per line (NDJSON), not a JSON array. Daemon
+ * unreachable on any query → that query returns nothing; other queries
+ * still proceed.
+ */
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+const execAsync = promisify(exec);
+function parseNdjson(stdout) {
+    const out = [];
+    for (const line of stdout.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        try {
+            out.push(JSON.parse(trimmed));
+        }
+        catch {
+            // skip malformed lines
+        }
+    }
+    return out;
+}
+function pruneUndefined(obj) {
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+        if (v !== undefined && v !== "")
+            out[k] = v;
+    }
+    return out;
+}
+async function listContainers() {
+    const result = {};
+    try {
+        const { stdout } = await execAsync("docker ps --format '{{json .}}'");
+        const containers = parseNdjson(stdout);
+        for (const c of containers) {
+            const name = c.Names;
+            if (!name)
+                continue;
+            result[`container/${name}`] = {
+                type: "Docker::Container",
+                physicalId: c.ID,
+                status: c.State ?? c.Status ?? "PRESENT",
+                attributes: pruneUndefined({
+                    image: c.Image,
+                    command: c.Command,
+                    ports: c.Ports,
+                    mounts: c.Mounts,
+                    fullStatus: c.Status,
+                }),
+            };
+        }
+    }
+    catch {
+        // Docker daemon unreachable — return empty, don't fail the lexicon
+    }
+    return result;
+}
+async function listImages() {
+    const result = {};
+    try {
+        const { stdout } = await execAsync("docker image ls --format '{{json .}}'");
+        const images = parseNdjson(stdout);
+        for (const img of images) {
+            if (!img.Repository || img.Repository === "<none>")
+                continue;
+            const tag = img.Tag && img.Tag !== "<none>" ? img.Tag : "latest";
+            const key = `image/${img.Repository}:${tag}`;
+            result[key] = {
+                type: "Docker::Image",
+                physicalId: img.ID,
+                status: "PRESENT",
+                lastUpdated: img.CreatedAt,
+                attributes: pruneUndefined({
+                    repository: img.Repository,
+                    tag,
+                    size: img.Size,
+                }),
+            };
+        }
+    }
+    catch {
+        // Docker daemon unreachable
+    }
+    return result;
+}
+async function listNetworks() {
+    const result = {};
+    try {
+        const { stdout } = await execAsync("docker network ls --format '{{json .}}'");
+        const networks = parseNdjson(stdout);
+        for (const net of networks) {
+            const name = net.Name;
+            if (!name)
+                continue;
+            result[`network/${name}`] = {
+                type: "Docker::Network",
+                physicalId: net.ID,
+                status: "PRESENT",
+                lastUpdated: net.CreatedAt,
+                attributes: pruneUndefined({
+                    driver: net.Driver,
+                    scope: net.Scope,
+                }),
+            };
+        }
+    }
+    catch {
+        // Docker daemon unreachable
+    }
+    return result;
+}
+export async function listArtifacts(_options) {
+    // Three independent queries — failure of one doesn't block the others.
+    const [containers, images, networks] = await Promise.all([
+        listContainers(),
+        listImages(),
+        listNetworks(),
+    ]);
+    return { ...containers, ...images, ...networks };
+}

package/dist/lsp/completions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAapF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAE1E"}
+{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAapF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAE1E"}

package/dist/lsp/completions.js

@@ -0,0 +1,18 @@
+import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
+import { LexiconIndex, lexiconCompletions } from "@intentius/chant/lsp/lexicon-providers";
+const require = createRequire(moduleSourceUrl(import.meta.url));
+let cachedIndex = null;
+function getIndex() {
+    if (cachedIndex)
+        return cachedIndex;
+    const data = require("../generated/lexicon-docker.json");
+    cachedIndex = new LexiconIndex(data);
+    return cachedIndex;
+}
+/**
+ * Provide Docker entity completions based on context.
+ */
+export function dockerCompletions(ctx) {
+    return lexiconCompletions(ctx, getIndex(), "Docker entity");
+}

package/dist/lsp/hover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAa1E;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAEpE"}
+{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAa1E;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAEpE"}

package/dist/lsp/hover.js

@@ -0,0 +1,33 @@
+import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
+import { LexiconIndex, lexiconHover } from "@intentius/chant/lsp/lexicon-providers";
+const require = createRequire(moduleSourceUrl(import.meta.url));
+let cachedIndex = null;
+function getIndex() {
+    if (cachedIndex)
+        return cachedIndex;
+    const data = require("../generated/lexicon-docker.json");
+    cachedIndex = new LexiconIndex(data);
+    return cachedIndex;
+}
+/**
+ * Provide hover information for Docker entity types.
+ */
+export function dockerHover(ctx) {
+    return lexiconHover(ctx, getIndex(), resourceHover);
+}
+function resourceHover(className, entry) {
+    const lines = [];
+    lines.push(`**${className}**`);
+    lines.push("");
+    lines.push(`Docker type: \`${entry.resourceType}\``);
+    if (entry.resourceType.startsWith("Docker::Compose::")) {
+        lines.push("");
+        lines.push("*Compose resource — serialized into docker-compose.yml*");
+    }
+    else if (entry.resourceType === "Docker::Dockerfile") {
+        lines.push("");
+        lines.push("*Dockerfile resource — serialized as Dockerfile.{name}*");
+    }
+    return { contents: lines.join("\n") };
+}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "docker",
-  "version": "0.124.31",
+  "version": "0.124.32",
   "chantVersion": ">=0.1.0",
   "namespace": "Docker",
   "intrinsics": [

package/dist/package-cli.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env tsx
+/**
+ * Thin entry point for `npm run bundle` in lexicon-docker.
+ */
+import { generate, writeGeneratedFiles } from "./codegen/generate.js";
+import { packageLexicon } from "./codegen/package.js";
+import { writeBundleSpec } from "@intentius/chant/codegen/package";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+const pkgDir = dirname(dirname(fileURLToPath(import.meta.url)));
+// 1. Generate src/generated/ files
+const genResult = await generate({ verbose: true });
+writeGeneratedFiles(genResult, pkgDir);
+console.error(`Generated ${genResult.resources} entities, ${genResult.properties} property types, ${genResult.enums} enums`);
+// 2. Run package pipeline and write dist/
+const { spec, stats } = await packageLexicon({ verbose: true });
+const distDir = join(pkgDir, "dist");
+writeBundleSpec(spec, distDir);
+console.error(`Packaged ${stats.resources} entities, ${stats.ruleCount} rules, ${stats.skillCount} skills`);
+console.error(`dist/ written to ${distDir}`);