@intentius/chant-lexicon-docker 0.41.20 → 0.44.1

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "3490c7d650e2fad534e08ff238c104f68fdcf950f91b039d167b92fea5fc5f8b",
+    "manifest.json": "3fab13a72708c05467d97b798888be346ec236fc8b139fdc7fbe218fe6ae36cc",
     "meta.json": "ae27dc809e705d37a645ee83b9789c50051282f7891d21d6b9e6ce8d111624ff",
     "types/index.d.ts": "758f989ff86af54284d7f841a2db2259038d51ce1f3ed839a5d8e83fa20d95b8",
     "rules/no-latest-tag.ts": "efd060453d8ca3d5b85c3972906c6650b6f63eb5f67cb6cdb0f16a41cad91228",
@@ -15,5 +15,5 @@
     "skills/chant-docker.md": "3ff0708e3c76e245f202948949c768464563af2b60cc9aa2ca52f494ef8357f1",
     "skills/chant-docker-patterns.md": "ad1b0196d8150b2df579a699ff107f604340c799c04f3460ebf65003e287b12a"
   },
-  "composite": "af6f2afd7eadb5bf8493a9b6818f6e3cb3d4437a71542dd6e4b898028566dea6"
+  "composite": "4f373a45bc088499f696e74cc7e0f62ef5ebf3eecc1c6ac4a2688d8d10f76810"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "docker",
-  "version": "0.41.20",
+  "version": "0.44.1",
   "chantVersion": ">=0.1.0",
   "namespace": "Docker",
   "intrinsics": [

package/dist/okf/index.md

@@ -0,0 +1,22 @@
+---
+okf_version: '0.2'
+---
+
+# Resource types
+
+* [DockerConfig](/types/DockerConfig.md) - Docker::Compose::Config
+* [Dockerfile](/types/Dockerfile.md) - Docker::Dockerfile
+* [DockerSecret](/types/DockerSecret.md) - Docker::Compose::Secret
+* [Network](/types/Network.md) - Docker::Compose::Network
+* [Service](/types/Service.md) - Docker::Compose::Service
+* [Volume](/types/Volume.md) - Docker::Compose::Volume
+
+# Rules
+
+* [DKRD001](/rules/DKRD001.md) - Service uses :latest or untagged image — specify an explicit version tag
+* [DKRD002](/rules/DKRD002.md) - Named volume is declared but not mounted by any service
+* [DKRD003](/rules/DKRD003.md) - Service exposes SSH port (22) externally — this is a security risk
+* [DKRD010](/rules/DKRD010.md) - apt-get install without --no-install-recommends adds unnecessary packages
+* [DKRD011](/rules/DKRD011.md) - Prefer COPY over ADD when not fetching URLs or extracting archives
+* [DKRD012](/rules/DKRD012.md) - Dockerfile has no USER instruction — container runs as root
+* [DKRS001](/rules/DKRS001.md) - No Latest Tag

package/dist/okf/rules/DKRD001.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: DKRD001
+description: Service uses :latest or untagged image — specify an explicit version tag
+id: DKRD001
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+Service uses :latest or untagged image — specify an explicit version tag
+
+## Applies to
+
+- [Service](/types/Service.md)

package/dist/okf/rules/DKRD002.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: DKRD002
+description: Named volume is declared but not mounted by any service
+id: DKRD002
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+Named volume is declared but not mounted by any service
+
+## Applies to
+
+- [Volume](/types/Volume.md)

package/dist/okf/rules/DKRD003.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: DKRD003
+description: Service exposes SSH port (22) externally — this is a security risk
+id: DKRD003
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+Service exposes SSH port (22) externally — this is a security risk
+
+## Applies to
+
+- [Service](/types/Service.md)

package/dist/okf/rules/DKRD010.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DKRD010
+description: apt-get install without --no-install-recommends adds unnecessary packages
+id: DKRD010
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+apt-get install without --no-install-recommends adds unnecessary packages

package/dist/okf/rules/DKRD011.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DKRD011
+description: Prefer COPY over ADD when not fetching URLs or extracting archives
+id: DKRD011
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+Prefer COPY over ADD when not fetching URLs or extracting archives

package/dist/okf/rules/DKRD012.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: DKRD012
+description: Dockerfile has no USER instruction — container runs as root
+id: DKRD012
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+Dockerfile has no USER instruction — container runs as root
+
+## Applies to
+
+- [Dockerfile](/types/Dockerfile.md)

package/dist/okf/rules/DKRS001.md

@@ -0,0 +1,15 @@
+---
+type: lint-rule
+title: DKRS001
+description: No Latest Tag
+id: DKRS001
+severity: warning
+category: correctness
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+No Latest Tag
+
+## Applies to
+
+- [Service](/types/Service.md)

package/dist/okf/types/DockerConfig.md

@@ -0,0 +1,16 @@
+---
+type: resource-type
+title: DockerConfig
+description: A config definition in Docker Compose
+name: DockerConfig
+lexicon: docker
+resource_type: Docker::Compose::Config
+---
+A config definition in Docker Compose
+
+## Properties
+
+- `file` (`string`): Path to the config file
+- `external` (`boolean`): Whether the config is external
+- `labels` (`Record<string, string>`): Config labels
+- `name` (`string`): Custom config name

package/dist/okf/types/DockerSecret.md

@@ -0,0 +1,16 @@
+---
+type: resource-type
+title: DockerSecret
+description: A secret definition in Docker Compose
+name: DockerSecret
+lexicon: docker
+resource_type: Docker::Compose::Secret
+---
+A secret definition in Docker Compose
+
+## Properties
+
+- `file` (`string`): Path to the secret file
+- `external` (`boolean`): Whether the secret is external
+- `labels` (`Record<string, string>`): Secret labels
+- `name` (`string`): Custom secret name

package/dist/okf/types/Dockerfile.md

@@ -0,0 +1,30 @@
+---
+type: resource-type
+title: Dockerfile
+description: A Dockerfile definition with ordered build instructions
+name: Dockerfile
+lexicon: docker
+resource_type: Docker::Dockerfile
+---
+A Dockerfile definition with ordered build instructions
+
+## Properties
+
+- `from`: Base image (required first instruction)
+- `arg`: Build-time argument
+- `env`: Environment variable
+- `run`: Run a command during build
+- `copy`: Copy files from build context
+- `add`: Add files (supports URLs and archives)
+- `workdir`: Set working directory
+- `user`: Set user for subsequent instructions
+- `expose`: Document exposed ports
+- `volume`: Create mount points
+- `label`: Add metadata labels
+- `entrypoint`: Set the entrypoint executable
+- `cmd`: Default command arguments
+- `healthcheck`: Health check instruction
+
+## Governed by
+
+- [DKRD012](/rules/DKRD012.md): Dockerfile has no USER instruction — container runs as root

package/dist/okf/types/Network.md

@@ -0,0 +1,18 @@
+---
+type: resource-type
+title: Network
+description: A network definition in Docker Compose
+name: Network
+lexicon: docker
+resource_type: Docker::Compose::Network
+---
+A network definition in Docker Compose
+
+## Properties
+
+- `driver` (`string`): Network driver
+- `driver_opts` (`Record<string, string>`): Driver options
+- `external` (`boolean`): Whether the network is external
+- `labels` (`Record<string, string>`): Network labels
+- `internal` (`boolean`): Restrict external access
+- `ipam` (`object`): IP address management

package/dist/okf/types/Service.md

@@ -0,0 +1,33 @@
+---
+type: resource-type
+title: Service
+description: A containerized service definition in Docker Compose
+name: Service
+lexicon: docker
+resource_type: Docker::Compose::Service
+---
+A containerized service definition in Docker Compose
+
+## Properties
+
+- `image` (`string`): Container image to use
+- `build` (`object`): Build configuration
+- `command` (`string | string[]`): Override the default command
+- `entrypoint` (`string | string[]`): Override the default entrypoint
+- `environment` (`Record<string, string>`): Environment variables
+- `ports` (`string[]`): Published ports
+- `volumes` (`string[]`): Volume mounts
+- `networks` (`string[]`): Networks to attach
+- `depends_on` (`string[] | Record<string, { condition: "service_started" | "service_healthy" | "service_completed_successfully"; restart?: boolean; required?: boolean }>`): Service dependencies (short list-form, or long form with a wait condition)
+- `restart` (`string`): Restart policy
+- `labels` (`Record<string, string>`): Container labels
+- `healthcheck` (`object`): Health check configuration
+- `deploy` (`object`): Swarm deployment configuration
+- `secrets` (`string[]`): Secrets to expose
+- `configs` (`string[]`): Configs to expose
+
+## Governed by
+
+- [DKRD001](/rules/DKRD001.md): Service uses :latest or untagged image — specify an explicit version tag
+- [DKRD003](/rules/DKRD003.md): Service exposes SSH port (22) externally — this is a security risk
+- [DKRS001](/rules/DKRS001.md): No Latest Tag

package/dist/okf/types/Volume.md

@@ -0,0 +1,21 @@
+---
+type: resource-type
+title: Volume
+description: A named volume definition in Docker Compose
+name: Volume
+lexicon: docker
+resource_type: Docker::Compose::Volume
+---
+A named volume definition in Docker Compose
+
+## Properties
+
+- `driver` (`string`): Volume driver
+- `driver_opts` (`Record<string, string>`): Driver options
+- `external` (`boolean`): Whether the volume is external
+- `labels` (`Record<string, string>`): Volume labels
+- `name` (`string`): Custom volume name
+
+## Governed by
+
+- [DKRD002](/rules/DKRD002.md): Named volume is declared but not mounted by any service

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-docker",
-  "version": "0.41.20",
+  "version": "0.44.1",
   "description": "Docker lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,7 +67,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.41.20",
+    "@intentius/chant": "^0.44.1",
     "typescript": "^5.9.3"
   }
 }

package/src/codegen/__snapshots__/okf.test.ts.snap

@@ -0,0 +1,315 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`docker OKF bundle > packaging emits a conformant, snapshot-stable bundle 1`] = `
+[
+  {
+    "content": "---
+okf_version: '0.2'
+---
+
+# Resource types
+
+* [DockerConfig](/types/DockerConfig.md) - Docker::Compose::Config
+* [Dockerfile](/types/Dockerfile.md) - Docker::Dockerfile
+* [DockerSecret](/types/DockerSecret.md) - Docker::Compose::Secret
+* [Network](/types/Network.md) - Docker::Compose::Network
+* [Service](/types/Service.md) - Docker::Compose::Service
+* [Volume](/types/Volume.md) - Docker::Compose::Volume
+
+# Rules
+
+* [DKRD001](/rules/DKRD001.md) - Service uses :latest or untagged image — specify an explicit version tag
+* [DKRD002](/rules/DKRD002.md) - Named volume is declared but not mounted by any service
+* [DKRD003](/rules/DKRD003.md) - Service exposes SSH port (22) externally — this is a security risk
+* [DKRD010](/rules/DKRD010.md) - apt-get install without --no-install-recommends adds unnecessary packages
+* [DKRD011](/rules/DKRD011.md) - Prefer COPY over ADD when not fetching URLs or extracting archives
+* [DKRD012](/rules/DKRD012.md) - Dockerfile has no USER instruction — container runs as root
+* [DKRS001](/rules/DKRS001.md) - No Latest Tag
+",
+    "path": "index.md",
+  },
+  {
+    "content": "---
+type: post-synth-check
+title: DKRD001
+description: Service uses :latest or untagged image — specify an explicit version tag
+id: DKRD001
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+Service uses :latest or untagged image — specify an explicit version tag
+
+## Applies to
+
+- [Service](/types/Service.md)
+",
+    "path": "rules/DKRD001.md",
+  },
+  {
+    "content": "---
+type: post-synth-check
+title: DKRD002
+description: Named volume is declared but not mounted by any service
+id: DKRD002
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+Named volume is declared but not mounted by any service
+
+## Applies to
+
+- [Volume](/types/Volume.md)
+",
+    "path": "rules/DKRD002.md",
+  },
+  {
+    "content": "---
+type: post-synth-check
+title: DKRD003
+description: Service exposes SSH port (22) externally — this is a security risk
+id: DKRD003
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+Service exposes SSH port (22) externally — this is a security risk
+
+## Applies to
+
+- [Service](/types/Service.md)
+",
+    "path": "rules/DKRD003.md",
+  },
+  {
+    "content": "---
+type: post-synth-check
+title: DKRD010
+description: apt-get install without --no-install-recommends adds unnecessary packages
+id: DKRD010
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+apt-get install without --no-install-recommends adds unnecessary packages
+",
+    "path": "rules/DKRD010.md",
+  },
+  {
+    "content": "---
+type: post-synth-check
+title: DKRD011
+description: Prefer COPY over ADD when not fetching URLs or extracting archives
+id: DKRD011
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+Prefer COPY over ADD when not fetching URLs or extracting archives
+",
+    "path": "rules/DKRD011.md",
+  },
+  {
+    "content": "---
+type: post-synth-check
+title: DKRD012
+description: Dockerfile has no USER instruction — container runs as root
+id: DKRD012
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+Dockerfile has no USER instruction — container runs as root
+
+## Applies to
+
+- [Dockerfile](/types/Dockerfile.md)
+",
+    "path": "rules/DKRD012.md",
+  },
+  {
+    "content": "---
+type: lint-rule
+title: DKRS001
+description: No Latest Tag
+id: DKRS001
+severity: warning
+category: correctness
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+No Latest Tag
+
+## Applies to
+
+- [Service](/types/Service.md)
+",
+    "path": "rules/DKRS001.md",
+  },
+  {
+    "content": "---
+type: resource-type
+title: DockerConfig
+description: A config definition in Docker Compose
+name: DockerConfig
+lexicon: docker
+resource_type: Docker::Compose::Config
+---
+A config definition in Docker Compose
+
+## Properties
+
+- \`file\` (\`string\`): Path to the config file
+- \`external\` (\`boolean\`): Whether the config is external
+- \`labels\` (\`Record<string, string>\`): Config labels
+- \`name\` (\`string\`): Custom config name
+",
+    "path": "types/DockerConfig.md",
+  },
+  {
+    "content": "---
+type: resource-type
+title: Dockerfile
+description: A Dockerfile definition with ordered build instructions
+name: Dockerfile
+lexicon: docker
+resource_type: Docker::Dockerfile
+---
+A Dockerfile definition with ordered build instructions
+
+## Properties
+
+- \`from\`: Base image (required first instruction)
+- \`arg\`: Build-time argument
+- \`env\`: Environment variable
+- \`run\`: Run a command during build
+- \`copy\`: Copy files from build context
+- \`add\`: Add files (supports URLs and archives)
+- \`workdir\`: Set working directory
+- \`user\`: Set user for subsequent instructions
+- \`expose\`: Document exposed ports
+- \`volume\`: Create mount points
+- \`label\`: Add metadata labels
+- \`entrypoint\`: Set the entrypoint executable
+- \`cmd\`: Default command arguments
+- \`healthcheck\`: Health check instruction
+
+## Governed by
+
+- [DKRD012](/rules/DKRD012.md): Dockerfile has no USER instruction — container runs as root
+",
+    "path": "types/Dockerfile.md",
+  },
+  {
+    "content": "---
+type: resource-type
+title: DockerSecret
+description: A secret definition in Docker Compose
+name: DockerSecret
+lexicon: docker
+resource_type: Docker::Compose::Secret
+---
+A secret definition in Docker Compose
+
+## Properties
+
+- \`file\` (\`string\`): Path to the secret file
+- \`external\` (\`boolean\`): Whether the secret is external
+- \`labels\` (\`Record<string, string>\`): Secret labels
+- \`name\` (\`string\`): Custom secret name
+",
+    "path": "types/DockerSecret.md",
+  },
+  {
+    "content": "---
+type: resource-type
+title: Network
+description: A network definition in Docker Compose
+name: Network
+lexicon: docker
+resource_type: Docker::Compose::Network
+---
+A network definition in Docker Compose
+
+## Properties
+
+- \`driver\` (\`string\`): Network driver
+- \`driver_opts\` (\`Record<string, string>\`): Driver options
+- \`external\` (\`boolean\`): Whether the network is external
+- \`labels\` (\`Record<string, string>\`): Network labels
+- \`internal\` (\`boolean\`): Restrict external access
+- \`ipam\` (\`object\`): IP address management
+",
+    "path": "types/Network.md",
+  },
+  {
+    "content": "---
+type: resource-type
+title: Service
+description: A containerized service definition in Docker Compose
+name: Service
+lexicon: docker
+resource_type: Docker::Compose::Service
+---
+A containerized service definition in Docker Compose
+
+## Properties
+
+- \`image\` (\`string\`): Container image to use
+- \`build\` (\`object\`): Build configuration
+- \`command\` (\`string | string[]\`): Override the default command
+- \`entrypoint\` (\`string | string[]\`): Override the default entrypoint
+- \`environment\` (\`Record<string, string>\`): Environment variables
+- \`ports\` (\`string[]\`): Published ports
+- \`volumes\` (\`string[]\`): Volume mounts
+- \`networks\` (\`string[]\`): Networks to attach
+- \`depends_on\` (\`string[] | Record<string, { condition: "service_started" | "service_healthy" | "service_completed_successfully"; restart?: boolean; required?: boolean }>\`): Service dependencies (short list-form, or long form with a wait condition)
+- \`restart\` (\`string\`): Restart policy
+- \`labels\` (\`Record<string, string>\`): Container labels
+- \`healthcheck\` (\`object\`): Health check configuration
+- \`deploy\` (\`object\`): Swarm deployment configuration
+- \`secrets\` (\`string[]\`): Secrets to expose
+- \`configs\` (\`string[]\`): Configs to expose
+
+## Governed by
+
+- [DKRD001](/rules/DKRD001.md): Service uses :latest or untagged image — specify an explicit version tag
+- [DKRD003](/rules/DKRD003.md): Service exposes SSH port (22) externally — this is a security risk
+- [DKRS001](/rules/DKRS001.md): No Latest Tag
+",
+    "path": "types/Service.md",
+  },
+  {
+    "content": "---
+type: resource-type
+title: Volume
+description: A named volume definition in Docker Compose
+name: Volume
+lexicon: docker
+resource_type: Docker::Compose::Volume
+---
+A named volume definition in Docker Compose
+
+## Properties
+
+- \`driver\` (\`string\`): Volume driver
+- \`driver_opts\` (\`Record<string, string>\`): Driver options
+- \`external\` (\`boolean\`): Whether the volume is external
+- \`labels\` (\`Record<string, string>\`): Volume labels
+- \`name\` (\`string\`): Custom volume name
+
+## Governed by
+
+- [DKRD002](/rules/DKRD002.md): Named volume is declared but not mounted by any service
+",
+    "path": "types/Volume.md",
+  },
+]
+`;

package/src/codegen/okf.test.ts

@@ -0,0 +1,36 @@
+import { describe, test, expect } from "vitest";
+import { packageLexicon } from "./package";
+import { okfConformanceProblems, splitFrontmatter } from "@intentius/chant/okf";
+import { parseYAML } from "@intentius/chant/yaml";
+
+/**
+ * The lexicon OKF bundle (#1060) over docker — the hand-authored generation
+ * path, where descriptions live in the registry itself. Small enough to
+ * snapshot whole.
+ */
+describe("docker OKF bundle", () => {
+  test("packaging emits a conformant, snapshot-stable bundle", async () => {
+    const { spec } = await packageLexicon();
+    expect(spec.okf).toBeDefined();
+    expect(okfConformanceProblems(spec.okf!)).toEqual([]);
+    expect(spec.okf).toMatchSnapshot();
+  });
+
+  test("resource concepts and rules cross-link in both directions", async () => {
+    const { spec } = await packageLexicon();
+    const files = new Map(spec.okf!.map((f) => [f.path, f.content]));
+
+    const service = splitFrontmatter(files.get("types/Service.md")!)!;
+    const front = parseYAML(service.frontmatter);
+    expect(front.type).toBe("resource-type");
+    expect(front.resource_type).toBe("Docker::Compose::Service");
+    // Registry-carried property description reaches the concept body.
+    expect(service.body).toContain("- `image` (`string`): Container image to use");
+    // The no-latest-tag rule governs Service…
+    expect(service.body).toContain("[DKRS001](/rules/DKRS001.md)");
+    // …and points back at it.
+    const rule = splitFrontmatter(files.get("rules/DKRS001.md")!)!;
+    expect(parseYAML(rule.frontmatter).severity).toBe("warning");
+    expect(rule.body).toContain("- [Service](/types/Service.md)");
+  });
+});

package/src/package-cli.ts

@@ -4,7 +4,7 @@
  */
 import { generate, writeGeneratedFiles } from "./codegen/generate";
 import { packageLexicon } from "./codegen/package";
-import { writeFileSync, mkdirSync } from "fs";
+import { writeBundleSpec } from "@intentius/chant/codegen/package";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 
@@ -19,24 +19,7 @@ console.error(`Generated ${genResult.resources} entities, ${genResult.properties
 const { spec, stats } = await packageLexicon({ verbose: true });
 
 const distDir = join(pkgDir, "dist");
-mkdirSync(join(distDir, "types"), { recursive: true });
-mkdirSync(join(distDir, "rules"), { recursive: true });
-mkdirSync(join(distDir, "skills"), { recursive: true });
-
-writeFileSync(join(distDir, "manifest.json"), JSON.stringify(spec.manifest, null, 2));
-writeFileSync(join(distDir, "meta.json"), spec.registry);
-writeFileSync(join(distDir, "types", "index.d.ts"), spec.typesDTS);
-
-for (const [name, content] of spec.rules) {
-  writeFileSync(join(distDir, "rules", name), content);
-}
-for (const [name, content] of spec.skills) {
-  writeFileSync(join(distDir, "skills", name), content);
-}
-
-if (spec.integrity) {
-  writeFileSync(join(distDir, "integrity.json"), JSON.stringify(spec.integrity, null, 2));
-}
+writeBundleSpec(spec, distDir);
 
 console.error(`Packaged ${stats.resources} entities, ${stats.ruleCount} rules, ${stats.skillCount} skills`);
 console.error(`dist/ written to ${distDir}`);