@habitat-ai/resource-rule-evaluation 0.2.4 → 0.3.1

package/dist/contract.d.ts

@@ -2,6 +2,11 @@ import type { Effect } from "effect";
 import { type Static, Type } from "typebox";
 /** Maximum detail retained by one rule-evaluation failure. */
 export declare const MAX_RULE_EVALUATION_FAILURE_DETAIL = 4096;
+/** Structural schema for one caller-identified, already-resolved program. */
+export declare const RuleEvaluationProgramSchema: Type.TObject<{
+    id: Type.TReadonly<Type.TString>;
+    program: Type.TReadonly<Type.TString>;
+}>;
 /** Structural schema for one source position reported by an evaluator. */
 export declare const RuleEvaluationPositionSchema: Type.TObject<{
     line: Type.TReadonly<Type.TInteger>;
@@ -23,13 +28,17 @@ export declare const RuleEvaluationFindingSchema: Type.TObject<{
     }>>;
     message: Type.TReadonly<Type.TUnion<[Type.TString, Type.TNull]>>;
 }>;
-/** Structural schema for one already-resolved evaluation request. */
+/** Structural schema for one exact-subject evaluation batch. */
 export declare const RuleEvaluationRequestSchema: Type.TObject<{
-    program: Type.TReadonly<Type.TString>;
+    programs: Type.TReadonly<Type.TImmutable<Type.TArray<Type.TObject<{
+        id: Type.TReadonly<Type.TString>;
+        program: Type.TReadonly<Type.TString>;
+    }>>>>;
     subjectPaths: Type.TReadonly<Type.TImmutable<Type.TArray<Type.TString>>>;
 }>;
-/** Structural schema for one completed evaluation. */
-export declare const RuleEvaluationResultSchema: Type.TObject<{
+/** Structural schema for one program's attributed evaluation result. */
+export declare const RuleEvaluationProgramResultSchema: Type.TObject<{
+    programId: Type.TReadonly<Type.TString>;
     findings: Type.TReadonly<Type.TImmutable<Type.TArray<Type.TObject<{
         path: Type.TReadonly<Type.TString>;
         start: Type.TReadonly<Type.TObject<{
@@ -45,6 +54,26 @@ export declare const RuleEvaluationResultSchema: Type.TObject<{
         message: Type.TReadonly<Type.TUnion<[Type.TString, Type.TNull]>>;
     }>>>>;
 }>;
+/** Structural schema for one completed exact-subject evaluation batch. */
+export declare const RuleEvaluationResultSchema: Type.TObject<{
+    results: Type.TReadonly<Type.TImmutable<Type.TArray<Type.TObject<{
+        programId: Type.TReadonly<Type.TString>;
+        findings: Type.TReadonly<Type.TImmutable<Type.TArray<Type.TObject<{
+            path: Type.TReadonly<Type.TString>;
+            start: Type.TReadonly<Type.TObject<{
+                line: Type.TReadonly<Type.TInteger>;
+                column: Type.TReadonly<Type.TInteger>;
+                offset: Type.TReadonly<Type.TInteger>;
+            }>>;
+            end: Type.TReadonly<Type.TObject<{
+                line: Type.TReadonly<Type.TInteger>;
+                column: Type.TReadonly<Type.TInteger>;
+                offset: Type.TReadonly<Type.TInteger>;
+            }>>;
+            message: Type.TReadonly<Type.TUnion<[Type.TString, Type.TNull]>>;
+        }>>>>;
+    }>>>>;
+}>;
 /** Provider-neutral mechanical failure reasons for one evaluation attempt. */
 export declare const RuleEvaluationFailureReasonSchema: Type.TUnion<[Type.TLiteral<"InvalidInput">, Type.TLiteral<"SetupFailed">, Type.TLiteral<"ExecutionFailed">, Type.TLiteral<"TimedOut">, Type.TLiteral<"InvalidOutput">]>;
 /** Structural schema for one bounded typed evaluation failure. */
@@ -57,9 +86,13 @@ export declare const RuleEvaluationFailureSchema: Type.TObject<{
 export type RuleEvaluationPosition = Static<typeof RuleEvaluationPositionSchema>;
 /** One provider-neutral finding. */
 export type RuleEvaluationFinding = Static<typeof RuleEvaluationFindingSchema>;
-/** One already-resolved evaluation request. */
+/** One caller-identified, already-resolved evaluator program. */
+export type RuleEvaluationProgram = Static<typeof RuleEvaluationProgramSchema>;
+/** One exact-subject evaluation batch. */
 export type RuleEvaluationRequest = Static<typeof RuleEvaluationRequestSchema>;
-/** One completed evaluation result. */
+/** One completed program result within an evaluation batch. */
+export type RuleEvaluationProgramResult = Static<typeof RuleEvaluationProgramResultSchema>;
+/** One completed exact-subject evaluation batch. */
 export type RuleEvaluationResult = Static<typeof RuleEvaluationResultSchema>;
 /** One provider-neutral mechanical failure reason. */
 export type RuleEvaluationFailureReason = Static<typeof RuleEvaluationFailureReasonSchema>;
@@ -67,7 +100,7 @@ export type RuleEvaluationFailureReason = Static<typeof RuleEvaluationFailureRea
 export type RuleEvaluationFailure = Static<typeof RuleEvaluationFailureSchema>;
 /** Checks an unknown value against the complete rule-evaluation failure contract. */
 export declare function isRuleEvaluationFailure(input: unknown): input is RuleEvaluationFailure;
-/** Provider-neutral capability for evaluating one resolved program. */
+/** Provider-neutral capability for evaluating resolved programs over one exact subject set. */
 export interface RuleEvaluationResource<R = never> {
     readonly evaluate: (input: RuleEvaluationRequest) => Effect.Effect<RuleEvaluationResult, RuleEvaluationFailure, R>;
 }

package/dist/contract.js

@@ -5,6 +5,18 @@ export const MAX_RULE_EVALUATION_FAILURE_DETAIL = 4_096;
 const NonEmptyStringSchema = Type.String({
     minLength: 1,
 });
+/** Structural schema for one caller-identified, already-resolved program. */
+export const RuleEvaluationProgramSchema = ReadonlyObject(Type.Object({
+    id: Type.String({
+        minLength: 1,
+        maxLength: 1_024,
+        description: "Invocation-local program identity used to attribute findings",
+    }),
+    program: Type.String({
+        minLength: 1,
+        description: "Already-resolved evaluator program",
+    }),
+}), { additionalProperties: false });
 /** Structural schema for one source position reported by an evaluator. */
 export const RuleEvaluationPositionSchema = ReadonlyObject(Type.Object({
     line: Type.Integer({
@@ -32,23 +44,35 @@ export const RuleEvaluationFindingSchema = ReadonlyObject(Type.Object({
         description: "Evaluator-authored diagnostic message when one was produced",
     }),
 }), { additionalProperties: false });
-/** Structural schema for one already-resolved evaluation request. */
+/** Structural schema for one exact-subject evaluation batch. */
 export const RuleEvaluationRequestSchema = ReadonlyObject(Type.Object({
-    program: Type.String({
-        minLength: 1,
-        description: "Already-resolved evaluator program",
+    programs: ReadonlyObject(Type.Array(RuleEvaluationProgramSchema), {
+        minItems: 1,
+        description: "Non-empty ordered programs evaluated against the same subjects",
     }),
     subjectPaths: ReadonlyObject(Type.Array(NonEmptyStringSchema), {
         minItems: 1,
         description: "Non-empty caller-resolved absolute subject paths",
     }),
 }), { additionalProperties: false });
-/** Structural schema for one completed evaluation. */
-export const RuleEvaluationResultSchema = ReadonlyObject(Type.Object({
+/** Structural schema for one program's attributed evaluation result. */
+export const RuleEvaluationProgramResultSchema = ReadonlyObject(Type.Object({
+    programId: Type.String({
+        minLength: 1,
+        maxLength: 1_024,
+        description: "Invocation-local identity of the evaluated program",
+    }),
     findings: ReadonlyObject(Type.Array(RuleEvaluationFindingSchema), {
         description: "Findings reported by the evaluator in provider-defined stable order",
     }),
 }), { additionalProperties: false });
+/** Structural schema for one completed exact-subject evaluation batch. */
+export const RuleEvaluationResultSchema = ReadonlyObject(Type.Object({
+    results: ReadonlyObject(Type.Array(RuleEvaluationProgramResultSchema), {
+        minItems: 1,
+        description: "Per-program results in request order",
+    }),
+}), { additionalProperties: false });
 /** Provider-neutral mechanical failure reasons for one evaluation attempt. */
 export const RuleEvaluationFailureReasonSchema = Type.Union([
     Type.Literal("InvalidInput"),

package/dist/providers/grit-effect-platform-node/index.js

@@ -6,9 +6,10 @@ import { ReadonlyObject, Type } from "typebox";
 import Schema from "typebox/schema";
 import { Value } from "typebox/value";
 const TEMP_CATALOG_PREFIX = "habitat-rule-evaluation-";
-const GRIT_PATTERN_NAME = "habitat_rule_evaluation";
-/** Maximum bytes retained from either native output stream. */
-const MAX_GRIT_OUTPUT_BYTES = 256 * 1_024;
+const GRIT_PATTERN_PREFIX = "habitat_rule_evaluation_";
+/** Output retained per program, capped so an untrusted batch cannot allocate without bound. */
+const MAX_GRIT_OUTPUT_BYTES_PER_PROGRAM = 256 * 1_024;
+const MAX_GRIT_BATCH_OUTPUT_BYTES = 16 * 1_024 * 1_024;
 /** Structural schema for Grit provider construction. */
 export const GritRuleEvaluationProviderConfigSchema = ReadonlyObject(Type.Object({
     executable: Type.String({
@@ -27,11 +28,12 @@ const GritPositionSchema = Type.Object({
 }, { additionalProperties: false, description: "Grit-reported source position" });
 const GritResultSchema = Type.Object({
     check_id: Type.String({
-        pattern: `^#${GRIT_PATTERN_NAME}/.+$`,
-        description: "Provider-owned Grit check identity with evaluator suffix",
+        minLength: 1,
+        description: "Grit check identity with evaluator suffix",
     }),
-    local_name: Type.Literal(GRIT_PATTERN_NAME, {
-        description: "Provider-owned local Grit pattern name",
+    local_name: Type.String({
+        minLength: 1,
+        description: "Local Grit catalog pattern name",
     }),
     path: Type.String({ minLength: 1, description: "Grit-reported subject path" }),
     start: GritPositionSchema,
@@ -65,13 +67,27 @@ export function makeGritRuleEvaluationResource(config) {
             return yield* fail("InvalidInput", "Grit provider configuration does not match its structural contract");
         }
         if (!requestValidator.Check(input)) {
-            return yield* fail("InvalidInput", "Rule-evaluation request requires one resolved program and non-empty subject paths");
+            return yield* fail("InvalidInput", "Rule-evaluation request requires resolved programs and non-empty subject paths");
         }
         const path = yield* Path.Path;
         if (input.subjectPaths.some((subjectPath) => !path.isAbsolute(subjectPath))) {
             return yield* fail("InvalidInput", "Rule-evaluation subject paths must be caller-resolved absolute paths");
         }
-        return yield* Effect.scoped(withScopedGritCatalog(input.program, (catalog) => runGritCheck(config, catalog, input.subjectPaths)));
+        const [firstProgram, ...remainingPrograms] = input.programs;
+        if (firstProgram === undefined) {
+            return yield* fail("InvalidInput", "Rule-evaluation request requires at least one program");
+        }
+        if (new Set(input.programs.map(({ id }) => id)).size !== input.programs.length) {
+            return yield* fail("InvalidInput", "Rule-evaluation program identities must be unique");
+        }
+        const programs = [
+            materializeProgram(firstProgram, 0),
+            ...remainingPrograms.map((program) => materializeProgram(program, 0)),
+        ];
+        const evaluations = yield* Effect.forEach(programs, (program) => Effect.scoped(withScopedGritCatalog([program], (catalog) => runGritCheck(config, catalog, [program], input.subjectPaths))), { concurrency: 1 });
+        return Object.freeze({
+            results: Object.freeze(evaluations.flatMap(({ results }) => results)),
+        });
     });
     return Object.freeze({ evaluate });
 }
@@ -82,7 +98,7 @@ export function makeNodeGritRuleEvaluationResource(config) {
         evaluate: (input) => resource.evaluate(input).pipe(Effect.provide(NodeServices.layer)),
     });
 }
-function withScopedGritCatalog(program, use) {
+function withScopedGritCatalog(programs, use) {
     return Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
@@ -105,12 +121,13 @@ function withScopedGritCatalog(program, use) {
             .makeDirectory(catalog.cacheDirectory)
             .pipe(mapPlatform("SetupFailed", "Failed to create Grit cache directory"));
         yield* fs
-            .writeFileString(path.join(catalog.gritDirectory, "grit.yaml"), renderGritCatalog(program))
+            .writeFileString(path.join(catalog.gritDirectory, "grit.yaml"), renderGritCatalog(programs))
             .pipe(mapPlatform("SetupFailed", "Failed to write temporary Grit catalog"));
         return yield* use(catalog);
     });
 }
-function runGritCheck(config, catalog, subjectPaths) {
+function runGritCheck(config, catalog, programs, subjectPaths) {
+    const outputLimit = gritOutputLimit(programs.length);
     const observe = Effect.gen(function* () {
         const command = ChildProcess.make(config.executable, ["--json", "check", "--no-cache", "--grit-dir", catalog.gritDirectory, ...subjectPaths], {
             cwd: catalog.root,
@@ -120,6 +137,7 @@ function runGritCheck(config, catalog, subjectPaths) {
                 GRIT_USER_CONFIG: catalog.userConfigDirectory,
                 GRIT_TELEMETRY_DISABLED: "true",
                 NO_COLOR: undefined,
+                RAYON_NUM_THREADS: "2",
             },
             extendEnv: true,
             stdin: "ignore",
@@ -128,8 +146,8 @@ function runGritCheck(config, catalog, subjectPaths) {
         });
         const process = yield* command.pipe(mapPlatform("ExecutionFailed", "Failed to start Grit"));
         const output = yield* Effect.all({
-            stdout: collectBoundedOutput(process.stdout, "stdout"),
-            stderr: collectBoundedOutput(process.stderr, "stderr"),
+            stdout: collectBoundedOutput(process.stdout, "stdout", outputLimit),
+            stderr: collectBoundedOutput(process.stderr, "stderr", outputLimit),
             exitCode: process.exitCode.pipe(Effect.map(Number), mapPlatform("ExecutionFailed", "Failed to observe Grit exit")),
         }, { concurrency: "unbounded" });
         return Object.freeze(output);
@@ -147,7 +165,7 @@ function runGritCheck(config, catalog, subjectPaths) {
         if (observation.stdout.trim().length > 0) {
             return fail("InvalidOutput", "Grit check emitted unexpected stdout alongside its stderr JSON report");
         }
-        return decodeGritReport(observation.stderr).pipe(Effect.map(resultFromGritReport));
+        return decodeGritReport(observation.stderr).pipe(Effect.flatMap((report) => resultFromGritReport(report, programs)));
     }));
 }
 function decodeGritReport(stderr) {
@@ -159,47 +177,61 @@ function decodeGritReport(stderr) {
         catch: (error) => failure("InvalidOutput", `Grit check emitted an invalid report: ${errorMessage(error)}`),
     })));
 }
-function resultFromGritReport(report) {
-    const findings = report.results
-        .map((result) => Object.freeze({
-        path: result.path,
-        start: Object.freeze({
-            line: result.start.line,
-            column: result.start.col,
-            offset: result.start.offset,
-        }),
-        end: Object.freeze({
-            line: result.end.line,
-            column: result.end.col,
-            offset: result.end.offset,
-        }),
-        message: result.extra.message,
-    }))
-        .sort(compareFindings);
+function resultFromGritReport(report, programs) {
+    const programsByPattern = new Map(programs.map((program) => [program.patternName, program]));
+    const findingsByProgram = new Map(programs.map(({ id }) => [id, []]));
+    for (const result of report.results) {
+        const program = programsByPattern.get(result.local_name);
+        if (program === undefined || !result.check_id.startsWith(`#${result.local_name}/`)) {
+            return fail("InvalidOutput", `Grit check reported unexpected pattern identity '${result.local_name}'`);
+        }
+        findingsByProgram.get(program.id)?.push(Object.freeze({
+            path: result.path,
+            start: Object.freeze({
+                line: result.start.line,
+                column: result.start.col,
+                offset: result.start.offset,
+            }),
+            end: Object.freeze({
+                line: result.end.line,
+                column: result.end.col,
+                offset: result.end.offset,
+            }),
+            message: result.extra.message,
+        }));
+    }
+    return Effect.succeed(Object.freeze({
+        results: Object.freeze(programs.map(({ id }) => Object.freeze({
+            programId: id,
+            findings: Object.freeze((findingsByProgram.get(id) ?? []).sort(compareFindings)),
+        }))),
+    }));
+}
+function materializeProgram(program, index) {
     return Object.freeze({
-        findings: Object.freeze(findings),
+        id: program.id,
+        patternName: `${GRIT_PATTERN_PREFIX}${index}`,
+        program: program.program,
     });
 }
-function renderGritCatalog(program) {
+function renderGritCatalog(programs) {
     return `${JSON.stringify({
         version: "0.0.2",
-        patterns: [
-            {
-                name: GRIT_PATTERN_NAME,
-                title: GRIT_PATTERN_NAME,
-                level: "error",
-                body: program,
-            },
-        ],
+        patterns: programs.map(({ id, patternName, program }) => Object.freeze({
+            name: patternName,
+            title: id,
+            level: "error",
+            body: program,
+        })),
     }, undefined, 2)}\n`;
 }
-function collectBoundedOutput(stream, channel) {
-    return Stream.runFoldEffect(stream.pipe(Stream.mapError((error) => failure("ExecutionFailed", `Failed to drain Grit ${channel}: ${error.message}`))), () => Object.freeze({ buffer: new Uint8Array(MAX_GRIT_OUTPUT_BYTES), bytes: 0 }), (state, chunk) => {
+function collectBoundedOutput(stream, channel, outputLimit) {
+    return Stream.runFoldEffect(stream.pipe(Stream.mapError((error) => failure("ExecutionFailed", `Failed to drain Grit ${channel}: ${error.message}`))), () => Object.freeze({ buffer: new Uint8Array(outputLimit), bytes: 0 }), (state, chunk) => {
         if (chunk.byteLength === 0)
             return Effect.succeed(state);
         const bytes = state.bytes + chunk.byteLength;
-        return bytes > MAX_GRIT_OUTPUT_BYTES
-            ? fail("InvalidOutput", `Grit ${channel} exceeded its ${MAX_GRIT_OUTPUT_BYTES}-byte output limit`)
+        return bytes > outputLimit
+            ? fail("InvalidOutput", `Grit ${channel} exceeded its ${outputLimit}-byte output limit`)
             : Effect.sync(() => {
                 state.buffer.set(chunk, state.bytes);
                 return Object.freeze({ buffer: state.buffer, bytes });
@@ -209,6 +241,9 @@ function collectBoundedOutput(stream, channel) {
         catch: (error) => failure("InvalidOutput", `Grit ${channel} was not valid UTF-8: ${errorMessage(error)}`),
     })));
 }
+function gritOutputLimit(programCount) {
+    return Math.min(MAX_GRIT_BATCH_OUTPUT_BYTES, MAX_GRIT_OUTPUT_BYTES_PER_PROGRAM * programCount);
+}
 function mapPlatform(reason, context) {
     return (effect) => effect.pipe(Effect.mapError((error) => failure(reason, `${context}: ${error.message}`)));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@habitat-ai/resource-rule-evaluation",
-  "version": "0.2.4",
+  "version": "0.3.1",
   "private": false,
   "repository": {
     "type": "git",