> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kombify.io/llms.txt
> Use this file to discover all available pages before exploring further.

# stackkit module

> Author and validate local CUE modules

Author and validate local CUE modules.

Render module facts into CUE contracts and validate their deployment configuration.

```bash theme={null}
stackkit module [flags]
```

Subcommands: [`stackkit module lint`](#stackkit-module-lint), [`stackkit module scaffold`](#stackkit-module-scaffold)

## stackkit module lint

Lint module CUE for pin/health/security/access/placement hygiene (ADR-0027 G1/G3).

Run the deterministic module-hygiene gate over one module (`--module`) or the whole tree (`--all`). Checks: image tags pinned (no :latest), daemon healthCheck present (bounded automation jobs use restart=no plus process exit status), security block (noNewPrivileges + capDrop ALL), accessPolicy for routed services, no plaintext secrets, draft modules claim no scenarios, and docker-socket modules are not managed-serverless-eligible.

Single-module runs exit non-zero on any error. `--all` is advisory (exit 0) unless `--strict` is passed.

```bash theme={null}
stackkit module lint [flags]
```

| Flag            | Type   | Default   | Description                                                        |
| --------------- | ------ | --------- | ------------------------------------------------------------------ |
| `--all`         | bool   | —         | Lint every module under `--modules-dir`                            |
| `--json`        | bool   | —         | Emit findings as JSON                                              |
| `--module`      | string | —         | Path to a single module directory (containing module.cue)          |
| `--modules-dir` | string | `modules` | Root modules directory (used with `--all`)                         |
| `--strict`      | bool   | —         | Exit non-zero on any error finding (implied for single `--module`) |

## stackkit module scaffold

Render module artifacts deterministically from module\_facts.json (ADR-0027).

Render modules/\<slug>/module.cue, tests/reference-compose.yml and the thin tests/integration\_test.sh from a schema-validated module\_facts.json. Output is deterministic (gate G0): the same facts always render byte-identical files.

```bash theme={null}
stackkit module scaffold [flags]
```

| Flag        | Type   | Default | Description                                           |
| ----------- | ------ | ------- | ----------------------------------------------------- |
| `--catalog` | string | —       | Compiled CUE catalog.json for imageSource references  |
| `--facts`   | string | —       | Path to module\_facts.json. Required.                 |
| `--force`   | bool   | —       | Overwrite existing files                              |
| `--out`     | string | —       | Output module directory (default modules/\<slug>)     |
| `--print`   | bool   | —       | Print rendered artifacts to stdout instead of writing |