@habitat-ai/cli 0.2.4 → 0.3.1

package/dist/nx-plugin.js

@@ -1733,6 +1733,7 @@ var HABITAT_CATALOG_PATHS = [
 var HABITAT_AUTHORITY_GLOB = `{${HABITAT_CATALOG_PATHS.join(",")}}`;
 var DEFAULT_CHECK_TARGET = "check:policy";
 var HABITAT_EXECUTABLE = "habitat";
+var PORTABLE_OWNER_PROJECT = /^[A-Za-z0-9@][A-Za-z0-9@._/+:-]*$/u;
 function createHabitatNxPlugin(binding) {
   const createNodes = [
     HABITAT_AUTHORITY_GLOB,
@@ -1778,8 +1779,7 @@ function projectCatalogTargets(matchedFiles, catalog, runtimeInputs) {
     addLeafTarget(project, compatibilityTargetName(rule), compatibilityTarget(rule, runtimeInputs));
   }
   return [...projects.entries()].sort(([left], [right]) => compareText(left, right)).map(([root, project]) => {
-    const leafTargets = Object.keys(project.targets).sort();
-    project.targets[DEFAULT_CHECK_TARGET] = ownerTarget(project.ownerProject, leafTargets, project.compatibilityManifests.size > 0);
+    project.targets[DEFAULT_CHECK_TARGET] = ownerTarget(project.ownerProject, ownerInputs(project.targets, runtimeInputs), project.compatibilityManifests.size > 0);
     return [
       projectionSource(project),
       {
@@ -1900,17 +1900,32 @@ function compatibilityTarget(rule, runtimeInputs) {
     metadata: { description: `Check Habitat compatibility rule ${rule.ruleId}` }
   };
 }
-function ownerTarget(ownerProject, leafTargets, hasCompatibility) {
+function ownerTarget(ownerProject, inputs, hasCompatibility) {
+  if (!PORTABLE_OWNER_PROJECT.test(ownerProject)) {
+    throw new Error(`Habitat Nx projection rejected owner '${ownerProject}': identity is not portable as an Nx command argument.`);
+  }
   return {
-    executor: "nx:noop",
-    cache: false,
+    command: `${HABITAT_EXECUTABLE} check --owner ${ownerProject}`,
+    cache: true,
+    inputs,
     outputs: [],
-    dependsOn: leafTargets.map((target) => ({ target })),
+    options: { cwd: "{workspaceRoot}" },
     metadata: {
       description: hasCompatibility ? `Check resolved Habitat policy owned by ${ownerProject}` : `Check resolved Habitat applications owned by ${ownerProject}`
     }
   };
 }
+function ownerInputs(targets, runtimeInputs) {
+  const runtimeStrings = new Set(runtimeInputs.filter((input) => typeof input === "string"));
+  const corpusInputs = new Set;
+  for (const target of Object.values(targets)) {
+    for (const input of target.inputs ?? []) {
+      if (typeof input === "string" && !runtimeStrings.has(input))
+        corpusInputs.add(input);
+    }
+  }
+  return [...runtimeInputs, ...[...corpusInputs].sort(compareText)];
+}
 function applicationInputs(application, runtimeInputs) {
   const files = new Set(HABITAT_CATALOG_PATHS.map(workspaceInput));
   if (application.runner.name === "grit") {
@@ -1934,15 +1949,25 @@ function compatibilityInputs(rule, runtimeInputs) {
   files.add(workspaceInput(rule.baseline.relativePath));
   for (const pattern of rule.coveragePatterns)
     files.add(workspaceInput(pattern));
-  files.add(workspaceInput(rule.runner.name === "grit" ? rule.runner.pattern.relativePath : rule.runner.structure.relativePath));
+  if (rule.runner.name === "grit") {
+    files.add(workspaceInput(rule.runner.pattern.relativePath));
+    for (const entry of rule.runner.acquisition.entries) {
+      addSubjectInputs(files, entry.path, entry.kind);
+    }
+  } else {
+    files.add(workspaceInput(rule.runner.structure.relativePath));
+  }
   return [...runtimeInputs, ...[...files].sort(compareText)];
 }
 function addSubjectInputs(target, path, kind) {
   const exact = workspaceInput(path);
-  target.add(exact);
-  if (kind === "directory") {
-    target.add(path === "." ? "{workspaceRoot}/**/*" : `${exact}/**/*`);
+  if (kind === "directory" && path === ".") {
+    target.add("{workspaceRoot}/**/*");
+    return;
   }
+  target.add(exact);
+  if (kind === "directory")
+    target.add(`${exact}/**/*`);
 }
 function workspaceInput(path) {
   const normalized = normalizeWorkspacePath(path);
@@ -44644,6 +44669,17 @@ var MAX_RULE_EVALUATION_FAILURE_DETAIL = 4096;
 var NonEmptyStringSchema = exports_typebox.String({
   minLength: 1
 });
+var RuleEvaluationProgramSchema = ReadonlyObject(exports_typebox.Object({
+  id: exports_typebox.String({
+    minLength: 1,
+    maxLength: 1024,
+    description: "Invocation-local program identity used to attribute findings"
+  }),
+  program: exports_typebox.String({
+    minLength: 1,
+    description: "Already-resolved evaluator program"
+  })
+}), { additionalProperties: false });
 var RuleEvaluationPositionSchema = ReadonlyObject(exports_typebox.Object({
   line: exports_typebox.Integer({
     minimum: 1,
@@ -44670,20 +44706,31 @@ var RuleEvaluationFindingSchema = ReadonlyObject(exports_typebox.Object({
   })
 }), { additionalProperties: false });
 var RuleEvaluationRequestSchema = ReadonlyObject(exports_typebox.Object({
-  program: exports_typebox.String({
-    minLength: 1,
-    description: "Already-resolved evaluator program"
+  programs: ReadonlyObject(exports_typebox.Array(RuleEvaluationProgramSchema), {
+    minItems: 1,
+    description: "Non-empty ordered programs evaluated against the same subjects"
   }),
   subjectPaths: ReadonlyObject(exports_typebox.Array(NonEmptyStringSchema), {
     minItems: 1,
     description: "Non-empty caller-resolved absolute subject paths"
   })
 }), { additionalProperties: false });
-var RuleEvaluationResultSchema = ReadonlyObject(exports_typebox.Object({
+var RuleEvaluationProgramResultSchema = ReadonlyObject(exports_typebox.Object({
+  programId: exports_typebox.String({
+    minLength: 1,
+    maxLength: 1024,
+    description: "Invocation-local identity of the evaluated program"
+  }),
   findings: ReadonlyObject(exports_typebox.Array(RuleEvaluationFindingSchema), {
     description: "Findings reported by the evaluator in provider-defined stable order"
   })
 }), { additionalProperties: false });
+var RuleEvaluationResultSchema = ReadonlyObject(exports_typebox.Object({
+  results: ReadonlyObject(exports_typebox.Array(RuleEvaluationProgramResultSchema), {
+    minItems: 1,
+    description: "Per-program results in request order"
+  })
+}), { additionalProperties: false });
 var RuleEvaluationFailureReasonSchema = exports_typebox.Union([
   exports_typebox.Literal("InvalidInput"),
   exports_typebox.Literal("SetupFailed"),
@@ -46194,8 +46241,9 @@ __export(exports_value, {
 });
 // ../../resources/rule-evaluation/dist/providers/grit-effect-platform-node/index.js
 var TEMP_CATALOG_PREFIX = "habitat-rule-evaluation-";
-var GRIT_PATTERN_NAME = "habitat_rule_evaluation";
-var MAX_GRIT_OUTPUT_BYTES = 256 * 1024;
+var GRIT_PATTERN_PREFIX = "habitat_rule_evaluation_";
+var MAX_GRIT_OUTPUT_BYTES_PER_PROGRAM = 256 * 1024;
+var MAX_GRIT_BATCH_OUTPUT_BYTES = 16 * 1024 * 1024;
 var GritRuleEvaluationProviderConfigSchema = ReadonlyObject(exports_typebox.Object({
   executable: exports_typebox.String({
     minLength: 1,
@@ -46213,11 +46261,12 @@ var GritPositionSchema = exports_typebox.Object({
 }, { additionalProperties: false, description: "Grit-reported source position" });
 var GritResultSchema = exports_typebox.Object({
   check_id: exports_typebox.String({
-    pattern: `^#${GRIT_PATTERN_NAME}/.+$`,
-    description: "Provider-owned Grit check identity with evaluator suffix"
+    minLength: 1,
+    description: "Grit check identity with evaluator suffix"
   }),
-  local_name: exports_typebox.Literal(GRIT_PATTERN_NAME, {
-    description: "Provider-owned local Grit pattern name"
+  local_name: exports_typebox.String({
+    minLength: 1,
+    description: "Local Grit catalog pattern name"
   }),
   path: exports_typebox.String({ minLength: 1, description: "Grit-reported subject path" }),
   start: GritPositionSchema,
@@ -46247,13 +46296,27 @@ function makeGritRuleEvaluationResource(config) {
       return yield* fail11("InvalidInput", "Grit provider configuration does not match its structural contract");
     }
     if (!requestValidator.Check(input)) {
-      return yield* fail11("InvalidInput", "Rule-evaluation request requires one resolved program and non-empty subject paths");
+      return yield* fail11("InvalidInput", "Rule-evaluation request requires resolved programs and non-empty subject paths");
     }
     const path = yield* exports_Path.Path;
     if (input.subjectPaths.some((subjectPath) => !path.isAbsolute(subjectPath))) {
       return yield* fail11("InvalidInput", "Rule-evaluation subject paths must be caller-resolved absolute paths");
     }
-    return yield* exports_Effect.scoped(withScopedGritCatalog(input.program, (catalog) => runGritCheck(config, catalog, input.subjectPaths)));
+    const [firstProgram, ...remainingPrograms] = input.programs;
+    if (firstProgram === undefined) {
+      return yield* fail11("InvalidInput", "Rule-evaluation request requires at least one program");
+    }
+    if (new Set(input.programs.map(({ id: id3 }) => id3)).size !== input.programs.length) {
+      return yield* fail11("InvalidInput", "Rule-evaluation program identities must be unique");
+    }
+    const programs = [
+      materializeProgram(firstProgram, 0),
+      ...remainingPrograms.map((program) => materializeProgram(program, 0))
+    ];
+    const evaluations = yield* exports_Effect.forEach(programs, (program) => exports_Effect.scoped(withScopedGritCatalog([program], (catalog) => runGritCheck(config, catalog, [program], input.subjectPaths))), { concurrency: 1 });
+    return Object.freeze({
+      results: Object.freeze(evaluations.flatMap(({ results }) => results))
+    });
   });
   return Object.freeze({ evaluate: evaluate6 });
 }
@@ -46263,7 +46326,7 @@ function makeNodeGritRuleEvaluationResource(config) {
     evaluate: (input) => resource.evaluate(input).pipe(exports_Effect.provide(exports_NodeServices.layer))
   });
 }
-function withScopedGritCatalog(program, use) {
+function withScopedGritCatalog(programs, use) {
   return exports_Effect.gen(function* () {
     const fs = yield* exports_FileSystem.FileSystem;
     const path = yield* exports_Path.Path;
@@ -46277,11 +46340,12 @@ function withScopedGritCatalog(program, use) {
     yield* fs.makeDirectory(catalog.gritDirectory).pipe(mapPlatform("SetupFailed", "Failed to create Grit catalog directory"));
     yield* fs.makeDirectory(catalog.userConfigDirectory).pipe(mapPlatform("SetupFailed", "Failed to create Grit user-config directory"));
     yield* fs.makeDirectory(catalog.cacheDirectory).pipe(mapPlatform("SetupFailed", "Failed to create Grit cache directory"));
-    yield* fs.writeFileString(path.join(catalog.gritDirectory, "grit.yaml"), renderGritCatalog(program)).pipe(mapPlatform("SetupFailed", "Failed to write temporary Grit catalog"));
+    yield* fs.writeFileString(path.join(catalog.gritDirectory, "grit.yaml"), renderGritCatalog(programs)).pipe(mapPlatform("SetupFailed", "Failed to write temporary Grit catalog"));
     return yield* use(catalog);
   });
 }
-function runGritCheck(config, catalog, subjectPaths) {
+function runGritCheck(config, catalog, programs, subjectPaths) {
+  const outputLimit = gritOutputLimit(programs.length);
   const observe = exports_Effect.gen(function* () {
     const command = exports_ChildProcess.make(config.executable, ["--json", "check", "--no-cache", "--grit-dir", catalog.gritDirectory, ...subjectPaths], {
       cwd: catalog.root,
@@ -46290,7 +46354,8 @@ function runGritCheck(config, catalog, subjectPaths) {
         GRIT_CACHE_DIR: catalog.cacheDirectory,
         GRIT_USER_CONFIG: catalog.userConfigDirectory,
         GRIT_TELEMETRY_DISABLED: "true",
-        NO_COLOR: undefined
+        NO_COLOR: undefined,
+        RAYON_NUM_THREADS: "2"
       },
       extendEnv: true,
       stdin: "ignore",
@@ -46299,8 +46364,8 @@ function runGritCheck(config, catalog, subjectPaths) {
     });
     const process2 = yield* command.pipe(mapPlatform("ExecutionFailed", "Failed to start Grit"));
     const output = yield* exports_Effect.all({
-      stdout: collectBoundedOutput(process2.stdout, "stdout"),
-      stderr: collectBoundedOutput(process2.stderr, "stderr"),
+      stdout: collectBoundedOutput(process2.stdout, "stdout", outputLimit),
+      stderr: collectBoundedOutput(process2.stderr, "stderr", outputLimit),
       exitCode: process2.exitCode.pipe(exports_Effect.map(Number), mapPlatform("ExecutionFailed", "Failed to observe Grit exit"))
     }, { concurrency: "unbounded" });
     return Object.freeze(output);
@@ -46316,7 +46381,7 @@ function runGritCheck(config, catalog, subjectPaths) {
     if (observation.stdout.trim().length > 0) {
       return fail11("InvalidOutput", "Grit check emitted unexpected stdout alongside its stderr JSON report");
     }
-    return decodeGritReport(observation.stderr).pipe(exports_Effect.map(resultFromGritReport));
+    return decodeGritReport(observation.stderr).pipe(exports_Effect.flatMap((report) => resultFromGritReport(report, programs)));
   }));
 }
 function decodeGritReport(stderr) {
@@ -46328,45 +46393,61 @@ function decodeGritReport(stderr) {
     catch: (error2) => failure("InvalidOutput", `Grit check emitted an invalid report: ${errorMessage(error2)}`)
   })));
 }
-function resultFromGritReport(report) {
-  const findings = report.results.map((result4) => Object.freeze({
-    path: result4.path,
-    start: Object.freeze({
-      line: result4.start.line,
-      column: result4.start.col,
-      offset: result4.start.offset
-    }),
-    end: Object.freeze({
-      line: result4.end.line,
-      column: result4.end.col,
-      offset: result4.end.offset
-    }),
-    message: result4.extra.message
-  })).sort(compareFindings);
+function resultFromGritReport(report, programs) {
+  const programsByPattern = new Map(programs.map((program) => [program.patternName, program]));
+  const findingsByProgram = new Map(programs.map(({ id: id3 }) => [id3, []]));
+  for (const result4 of report.results) {
+    const program = programsByPattern.get(result4.local_name);
+    if (program === undefined || !result4.check_id.startsWith(`#${result4.local_name}/`)) {
+      return fail11("InvalidOutput", `Grit check reported unexpected pattern identity '${result4.local_name}'`);
+    }
+    findingsByProgram.get(program.id)?.push(Object.freeze({
+      path: result4.path,
+      start: Object.freeze({
+        line: result4.start.line,
+        column: result4.start.col,
+        offset: result4.start.offset
+      }),
+      end: Object.freeze({
+        line: result4.end.line,
+        column: result4.end.col,
+        offset: result4.end.offset
+      }),
+      message: result4.extra.message
+    }));
+  }
+  return exports_Effect.succeed(Object.freeze({
+    results: Object.freeze(programs.map(({ id: id3 }) => Object.freeze({
+      programId: id3,
+      findings: Object.freeze((findingsByProgram.get(id3) ?? []).sort(compareFindings))
+    })))
+  }));
+}
+function materializeProgram(program, index4) {
   return Object.freeze({
-    findings: Object.freeze(findings)
+    id: program.id,
+    patternName: `${GRIT_PATTERN_PREFIX}${index4}`,
+    program: program.program
   });
 }
-function renderGritCatalog(program) {
+function renderGritCatalog(programs) {
   return `${JSON.stringify({
     version: "0.0.2",
-    patterns: [
-      {
-        name: GRIT_PATTERN_NAME,
-        title: GRIT_PATTERN_NAME,
-        level: "error",
-        body: program
-      }
-    ]
+    patterns: programs.map(({ id: id3, patternName, program }) => Object.freeze({
+      name: patternName,
+      title: id3,
+      level: "error",
+      body: program
+    }))
   }, undefined, 2)}
 `;
 }
-function collectBoundedOutput(stream2, channel) {
-  return exports_Stream.runFoldEffect(stream2.pipe(exports_Stream.mapError((error2) => failure("ExecutionFailed", `Failed to drain Grit ${channel}: ${error2.message}`))), () => Object.freeze({ buffer: new Uint8Array(MAX_GRIT_OUTPUT_BYTES), bytes: 0 }), (state2, chunk) => {
+function collectBoundedOutput(stream2, channel, outputLimit) {
+  return exports_Stream.runFoldEffect(stream2.pipe(exports_Stream.mapError((error2) => failure("ExecutionFailed", `Failed to drain Grit ${channel}: ${error2.message}`))), () => Object.freeze({ buffer: new Uint8Array(outputLimit), bytes: 0 }), (state2, chunk) => {
     if (chunk.byteLength === 0)
       return exports_Effect.succeed(state2);
     const bytes = state2.bytes + chunk.byteLength;
-    return bytes > MAX_GRIT_OUTPUT_BYTES ? fail11("InvalidOutput", `Grit ${channel} exceeded its ${MAX_GRIT_OUTPUT_BYTES}-byte output limit`) : exports_Effect.sync(() => {
+    return bytes > outputLimit ? fail11("InvalidOutput", `Grit ${channel} exceeded its ${outputLimit}-byte output limit`) : exports_Effect.sync(() => {
       state2.buffer.set(chunk, state2.bytes);
       return Object.freeze({ buffer: state2.buffer, bytes });
     });
@@ -46375,6 +46456,9 @@ function collectBoundedOutput(stream2, channel) {
     catch: (error2) => failure("InvalidOutput", `Grit ${channel} was not valid UTF-8: ${errorMessage(error2)}`)
   })));
 }
+function gritOutputLimit(programCount) {
+  return Math.min(MAX_GRIT_BATCH_OUTPUT_BYTES, MAX_GRIT_OUTPUT_BYTES_PER_PROGRAM * programCount);
+}
 function mapPlatform(reason, context4) {
   return (effect2) => effect2.pipe(exports_Effect.mapError((error2) => failure(reason, `${context4}: ${error2.message}`)));
 }
@@ -51941,21 +52025,22 @@ var check7 = module3.check.effect(function* ({ context: context4, input }) {
       };
     }
   }
-  const reports = [];
-  for (const prepared of preparations) {
+  const reports = new Array(preparations.length);
+  const readyGritEvaluations = [];
+  for (const [applicationIndex, prepared] of preparations.entries()) {
     if (prepared.kind === "structure") {
       if (prepared.preparation.kind === "failed") {
-        reports.push(prepared.preparation.report);
+        reports[applicationIndex] = prepared.preparation.report;
         continue;
       }
       const admitted = prepared.preparation.value;
       const application2 = admitted.application;
       if (admitted.scopes.length === 0) {
-        reports.push(evaluatedStructureApplication(application2, []));
+        reports[applicationIndex] = evaluatedStructureApplication(application2, []);
         continue;
       }
       if (inventoryPreparation.kind === "failed") {
-        reports.push(failedStructureApplication(application2, "InventoryFailed", inventoryPreparation.detail));
+        reports[applicationIndex] = failedStructureApplication(application2, "InventoryFailed", inventoryPreparation.detail);
         continue;
       }
       if (inventoryPreparation.kind === "not-required") {
@@ -51969,48 +52054,85 @@ var check7 = module3.check.effect(function* ({ context: context4, input }) {
         return yield* prepareStructureObservations(structureChildObservationPaths(plan, roots.kinds), roots.kinds);
       });
       if (observations.kind === "failed") {
-        reports.push(failedStructureApplication(application2, "StructureObservationFailed", observations.detail));
+        reports[applicationIndex] = failedStructureApplication(application2, "StructureObservationFailed", observations.detail);
         continue;
       }
-      reports.push(evaluatedStructureApplication(application2, evaluateStructurePlan(plan, observations.kinds)));
+      reports[applicationIndex] = evaluatedStructureApplication(application2, evaluateStructurePlan(plan, observations.kinds));
       continue;
     }
     const application = prepared.application;
     const patternAttempt = yield* exports_Effect.result(context4.fileSystem.readFileString(application.runner.pattern.absolutePath));
     if (patternAttempt._tag === "Failure") {
-      reports.push(failedApplication(application, "PatternReadFailed", `Unable to read pattern asset "${application.runner.pattern.relativePath}".`));
+      reports[applicationIndex] = failedApplication(application, "PatternReadFailed", `Unable to read pattern asset "${application.runner.pattern.relativePath}".`);
       continue;
     }
     const program = extractGritProgram(patternAttempt.success);
     if (!program.ok) {
-      reports.push(failedApplication(application, "PatternInvalid", program.detail));
+      reports[applicationIndex] = failedApplication(application, "PatternInvalid", program.detail);
       continue;
     }
     const subjectPreparation = yield* prepareGritSubjects(application, context4.workspaceRoot, context4.fileSystem, context4.path);
     if (subjectPreparation.kind === "failed") {
-      reports.push(failedApplication(application, "SetupFailed", subjectPreparation.detail));
+      reports[applicationIndex] = failedApplication(application, "SetupFailed", subjectPreparation.detail);
       continue;
     }
     if (subjectPreparation.kind === "not-applicable") {
       if (!isCompatibilityRule(application)) {
         return yield* exports_Effect.die(new Error("Version-three Grit applications cannot be not applicable."));
       }
-      reports.push(notApplicableApplication(application));
+      reports[applicationIndex] = notApplicableApplication(application);
       continue;
     }
     const subjects = subjectPreparation.subjects;
-    const evaluation = yield* exports_Effect.result(context4.ruleEvaluation.evaluate({
+    readyGritEvaluations.push({
+      applicationIndex,
+      application,
+      programId: `application-${applicationIndex}`,
       program: program.program,
+      subjects,
       subjectPaths: subjects.map((subject) => subject.absolutePath)
+    });
+  }
+  for (const evaluations of groupGritEvaluations(readyGritEvaluations)) {
+    const first = evaluations[0];
+    if (first === undefined) {
+      return yield* exports_Effect.die(new Error("A Grit evaluation group must not be empty."));
+    }
+    const evaluation = yield* exports_Effect.result(context4.ruleEvaluation.evaluate({
+      programs: evaluations.map(({ programId, program }) => ({ id: programId, program })),
+      subjectPaths: first.subjectPaths
     }));
     if (evaluation._tag === "Failure") {
-      reports.push(failedApplication(application, evaluation.failure.reason, evaluation.failure.detail));
+      for (const prepared of evaluations) {
+        reports[prepared.applicationIndex] = failedApplication(prepared.application, evaluation.failure.reason, evaluation.failure.detail);
+      }
       continue;
     }
-    const normalized = normalizeFindings(evaluation.success.findings, subjects, context4.workspaceRoot, context4.path);
-    reports.push(normalized.ok ? evaluatedApplication(application, normalized.findings) : failedApplication(application, "FindingPathInvalid", normalized.detail));
+    const resultMismatch = evaluationResultMismatch(evaluations, evaluation.success.results);
+    if (resultMismatch !== undefined) {
+      for (const prepared of evaluations) {
+        reports[prepared.applicationIndex] = failedApplication(prepared.application, "InvalidOutput", resultMismatch);
+      }
+      continue;
+    }
+    const results = indexEvaluationResults(evaluation.success.results);
+    for (const prepared of evaluations) {
+      const result4 = results.get(prepared.programId);
+      if (result4 === undefined) {
+        return yield* exports_Effect.die(new Error(`Validated evaluation result '${prepared.programId}' is absent.`));
+      }
+      const normalized = normalizeFindings(result4.findings, prepared.subjects, context4.workspaceRoot, context4.path);
+      reports[prepared.applicationIndex] = normalized.ok ? evaluatedApplication(prepared.application, normalized.findings) : failedApplication(prepared.application, "FindingPathInvalid", normalized.detail);
+    }
   }
-  return completedCheck(reports);
+  const completedReports = [];
+  for (const [applicationIndex, report] of reports.entries()) {
+    if (report === undefined) {
+      return yield* exports_Effect.die(new Error(`Habitat check produced no report for application ${applicationIndex}.`));
+    }
+    completedReports.push(report);
+  }
+  return completedCheck(completedReports);
 });
 var catalog2 = { resolve: resolve5, check: check7 };
 function catalogRejected(issues) {
@@ -52043,6 +52165,32 @@ function hasExactCauseCode(error2, code) {
   const cause = "cause" in error2.reason ? error2.reason.cause : undefined;
   return typeof cause === "object" && cause !== null && "code" in cause && cause.code === code;
 }
+function groupGritEvaluations(evaluations) {
+  const groups = new Map;
+  for (const evaluation of evaluations) {
+    const key = JSON.stringify(evaluation.subjectPaths);
+    const group = groups.get(key);
+    if (group === undefined)
+      groups.set(key, [evaluation]);
+    else
+      group.push(evaluation);
+  }
+  return [...groups.values()];
+}
+function evaluationResultMismatch(evaluations, results) {
+  if (results.length !== evaluations.length) {
+    return `Rule evaluator returned ${results.length} program results for ${evaluations.length} requested programs.`;
+  }
+  const uniqueIds = new Set(results.map(({ programId }) => programId));
+  if (uniqueIds.size !== results.length) {
+    return "Rule evaluator returned duplicate program result identities.";
+  }
+  const unexpected = results.find((result4, index4) => result4.programId !== evaluations[index4]?.programId);
+  return unexpected === undefined ? undefined : "Rule evaluator did not preserve requested program result order and identity.";
+}
+function indexEvaluationResults(results) {
+  return new Map(results.map((result4) => [result4.programId, result4]));
+}
 function prepareGritSubjects(application, workspaceRoot, fileSystem, path) {
   if (!isCompatibilityRule(application)) {
     return exports_Effect.succeed({

package/oclif.manifest.json

@@ -1,4 +1,4 @@
 {
   "commands": {},
-  "version": "0.2.4"
+  "version": "0.3.1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@habitat-ai/cli",
-  "version": "0.2.4",
+  "version": "0.3.1",
   "private": false,
   "repository": {
     "type": "git",
@@ -48,10 +48,10 @@
   "dependencies": {
     "@effect/platform-node": "4.0.0-beta.101",
     "@getgrit/cli": "0.1.0-alpha.1743007075",
-    "@habitat-ai/plugin-cli": "0.2.4",
-    "@habitat-ai/resource-rule-evaluation": "0.2.4",
-    "@habitat-ai/resource-source-inventory": "0.2.4",
-    "@habitat-ai/service": "0.2.4",
+    "@habitat-ai/plugin-cli": "0.3.1",
+    "@habitat-ai/resource-rule-evaluation": "0.3.1",
+    "@habitat-ai/resource-source-inventory": "0.3.1",
+    "@habitat-ai/service": "0.3.1",
     "@nx/devkit": "23.1.0",
     "@oclif/core": "^4.11.4",
     "@oclif/plugin-help": "^6.2.27",