@habitat-ai/service 0.2.0 → 0.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (20) hide show
  1. package/dist/service/impl.d.ts +222 -2
  2. package/dist/service/modules/catalog/contract/catalog.d.ts +111 -1
  3. package/dist/service/modules/catalog/model/dto/catalog.d.ts +124 -5
  4. package/dist/service/modules/catalog/model/dto/catalog.js +141 -10
  5. package/dist/service/modules/catalog/model/dto/check.d.ts +60 -0
  6. package/dist/service/modules/catalog/model/dto/check.js +135 -98
  7. package/dist/service/modules/catalog/model/dto/structure.d.ts +18 -0
  8. package/dist/service/modules/catalog/model/dto/structure.js +39 -0
  9. package/dist/service/modules/catalog/model/policy/catalog.d.ts +16 -4
  10. package/dist/service/modules/catalog/model/policy/catalog.js +104 -9
  11. package/dist/service/modules/catalog/model/policy/check.d.ts +14 -2
  12. package/dist/service/modules/catalog/model/policy/check.js +70 -7
  13. package/dist/service/modules/catalog/model/policy/structure.d.ts +10 -4
  14. package/dist/service/modules/catalog/model/policy/structure.js +45 -2
  15. package/dist/service/modules/catalog/module.d.ts +222 -2
  16. package/dist/service/modules/catalog/router/catalog.router.d.ts +111 -1
  17. package/dist/service/modules/catalog/router/catalog.router.js +191 -6
  18. package/dist/service/modules/catalog/router.d.ts +111 -1
  19. package/dist/service/router.d.ts +111 -1
  20. package/package.json +9 -4
package/dist/service/modules/catalog/module.d.ts CHANGED
@@ -150,9 +150,59 @@ export declare const module: import("@orpc/server").SharedRouterImplementerWithM
150
150
  schemaVersion: import("typebox").TLiteral<2>;
151
151
  ownerRoots: import("typebox").TRecord<"^.*$", import("typebox").TString>;
152
152
  rules: import("typebox").TArray<import("typebox").TObject<{
153
- id: import("typebox").TString;
153
+ ruleId: import("typebox").TString;
154
154
  ownerProject: import("typebox").TString;
155
155
  manifestPath: import("typebox").TString;
156
+ lane: import("typebox").TLiteral<"enforced">;
157
+ message: import("typebox").TString;
158
+ remediate: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
159
+ provenance: import("typebox").TObject<{
160
+ kind: import("typebox").TLiteral<"local">;
161
+ authorityRoot: import("typebox").TString;
162
+ relativePath: import("typebox").TString;
163
+ }>;
164
+ coveragePatterns: import("typebox").TArray<import("typebox").TString>;
165
+ baseline: import("typebox").TObject<{
166
+ provenance: import("typebox").TObject<{
167
+ kind: import("typebox").TLiteral<"local">;
168
+ authorityRoot: import("typebox").TString;
169
+ relativePath: import("typebox").TString;
170
+ }>;
171
+ relativePath: import("typebox").TString;
172
+ absolutePath: import("typebox").TString;
173
+ }>;
174
+ runner: import("typebox").TUnion<[import("typebox").TObject<{
175
+ name: import("typebox").TLiteral<"habitat">;
176
+ mode: import("typebox").TLiteral<"structure">;
177
+ structure: import("typebox").TObject<{
178
+ provenance: import("typebox").TObject<{
179
+ kind: import("typebox").TLiteral<"local">;
180
+ authorityRoot: import("typebox").TString;
181
+ relativePath: import("typebox").TString;
182
+ }>;
183
+ relativePath: import("typebox").TString;
184
+ absolutePath: import("typebox").TString;
185
+ }>;
186
+ }>, import("typebox").TObject<{
187
+ name: import("typebox").TLiteral<"grit">;
188
+ pattern: import("typebox").TObject<{
189
+ provenance: import("typebox").TObject<{
190
+ kind: import("typebox").TLiteral<"local">;
191
+ authorityRoot: import("typebox").TString;
192
+ relativePath: import("typebox").TString;
193
+ }>;
194
+ relativePath: import("typebox").TString;
195
+ absolutePath: import("typebox").TString;
196
+ }>;
197
+ patternName: import("typebox").TString;
198
+ acquisition: import("typebox").TObject<{
199
+ kind: import("typebox").TLiteral<"check">;
200
+ entries: import("typebox").TArray<import("typebox").TObject<{
201
+ kind: import("typebox").TUnion<[import("typebox").TLiteral<"directory">, import("typebox").TLiteral<"file">]>;
202
+ path: import("typebox").TString;
203
+ }>>;
204
+ }>;
205
+ }>]>;
156
206
  }>>;
157
207
  }>;
158
208
  }>;
@@ -222,6 +272,42 @@ export declare const module: import("@orpc/server").SharedRouterImplementerWithM
222
272
  severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
223
273
  baselined: import("typebox").TLiteral<false>;
224
274
  }>>;
275
+ }>, import("typebox").TObject<{
276
+ ownerProject: import("typebox").TString;
277
+ instanceId: import("typebox").TNull;
278
+ ruleId: import("typebox").TString;
279
+ runner: import("typebox").TLiteral<"grit">;
280
+ lane: import("typebox").TUnion<[import("typebox").TLiteral<"enforced">, import("typebox").TLiteral<"advisory">]>;
281
+ locked: import("typebox").TLiteral<true>;
282
+ status: import("typebox").TUnion<[import("typebox").TLiteral<"pass">, import("typebox").TLiteral<"fail">, import("typebox").TLiteral<"advisory-findings">, import("typebox").TLiteral<"error">]>;
283
+ message: import("typebox").TString;
284
+ remediate: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
285
+ disposition: import("typebox").TUnion<[import("typebox").TObject<{
286
+ kind: import("typebox").TLiteral<"evaluated">;
287
+ }>, import("typebox").TObject<{
288
+ kind: import("typebox").TLiteral<"not-applicable">;
289
+ reason: import("typebox").TLiteral<"no-matched-acquisition-roots">;
290
+ }>, import("typebox").TObject<{
291
+ kind: import("typebox").TLiteral<"failed">;
292
+ reason: import("typebox").TUnion<[import("typebox").TUnion<[import("typebox").TLiteral<"InvalidInput">, import("typebox").TLiteral<"SetupFailed">, import("typebox").TLiteral<"ExecutionFailed">, import("typebox").TLiteral<"TimedOut">, import("typebox").TLiteral<"InvalidOutput">]>, import("typebox").TLiteral<"PatternReadFailed">, import("typebox").TLiteral<"PatternInvalid">, import("typebox").TLiteral<"FindingPathInvalid">]>;
293
+ detail: import("typebox").TString;
294
+ }>]>;
295
+ findings: import("typebox").TArray<import("typebox").TObject<{
296
+ path: import("typebox").TString;
297
+ start: import("typebox").TObject<{
298
+ line: import("typebox").TReadonly<import("typebox").TInteger>;
299
+ column: import("typebox").TReadonly<import("typebox").TInteger>;
300
+ offset: import("typebox").TReadonly<import("typebox").TInteger>;
301
+ }>;
302
+ end: import("typebox").TObject<{
303
+ line: import("typebox").TReadonly<import("typebox").TInteger>;
304
+ column: import("typebox").TReadonly<import("typebox").TInteger>;
305
+ offset: import("typebox").TReadonly<import("typebox").TInteger>;
306
+ }>;
307
+ message: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
308
+ severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
309
+ baselined: import("typebox").TLiteral<false>;
310
+ }>>;
225
311
  }>, import("typebox").TObject<{
226
312
  ownerProject: import("typebox").TString;
227
313
  instanceId: import("typebox").TString;
@@ -246,6 +332,30 @@ export declare const module: import("@orpc/server").SharedRouterImplementerWithM
246
332
  severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
247
333
  baselined: import("typebox").TLiteral<false>;
248
334
  }>>;
335
+ }>, import("typebox").TObject<{
336
+ ownerProject: import("typebox").TString;
337
+ instanceId: import("typebox").TNull;
338
+ ruleId: import("typebox").TString;
339
+ runner: import("typebox").TLiteral<"habitat">;
340
+ lane: import("typebox").TUnion<[import("typebox").TLiteral<"enforced">, import("typebox").TLiteral<"advisory">]>;
341
+ locked: import("typebox").TLiteral<true>;
342
+ status: import("typebox").TUnion<[import("typebox").TLiteral<"pass">, import("typebox").TLiteral<"fail">, import("typebox").TLiteral<"advisory-findings">, import("typebox").TLiteral<"error">]>;
343
+ message: import("typebox").TString;
344
+ remediate: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
345
+ disposition: import("typebox").TUnion<[import("typebox").TObject<{
346
+ kind: import("typebox").TLiteral<"evaluated">;
347
+ }>, import("typebox").TObject<{
348
+ kind: import("typebox").TLiteral<"failed">;
349
+ reason: import("typebox").TUnion<[import("typebox").TLiteral<"StructureReadFailed">, import("typebox").TLiteral<"StructureInvalid">, import("typebox").TLiteral<"InventoryFailed">, import("typebox").TLiteral<"StructureObservationFailed">]>;
350
+ detail: import("typebox").TString;
351
+ }>]>;
352
+ findings: import("typebox").TArray<import("typebox").TObject<{
353
+ path: import("typebox").TString;
354
+ code: import("typebox").TUnion<[import("typebox").TLiteral<"root-missing">, import("typebox").TLiteral<"wrong-root-kind">, import("typebox").TLiteral<"missing-required-child">, import("typebox").TLiteral<"forbidden-child">, import("typebox").TLiteral<"unexpected-child">]>;
355
+ message: import("typebox").TString;
356
+ severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
357
+ baselined: import("typebox").TLiteral<false>;
358
+ }>>;
249
359
  }>]>>;
250
360
  }>]>>, object>;
251
361
  }, import("../../base.js").Context & object, {
@@ -413,9 +523,59 @@ export declare const module: import("@orpc/server").SharedRouterImplementerWithM
413
523
  schemaVersion: import("typebox").TLiteral<2>;
414
524
  ownerRoots: import("typebox").TRecord<"^.*$", import("typebox").TString>;
415
525
  rules: import("typebox").TArray<import("typebox").TObject<{
416
- id: import("typebox").TString;
526
+ ruleId: import("typebox").TString;
417
527
  ownerProject: import("typebox").TString;
418
528
  manifestPath: import("typebox").TString;
529
+ lane: import("typebox").TLiteral<"enforced">;
530
+ message: import("typebox").TString;
531
+ remediate: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
532
+ provenance: import("typebox").TObject<{
533
+ kind: import("typebox").TLiteral<"local">;
534
+ authorityRoot: import("typebox").TString;
535
+ relativePath: import("typebox").TString;
536
+ }>;
537
+ coveragePatterns: import("typebox").TArray<import("typebox").TString>;
538
+ baseline: import("typebox").TObject<{
539
+ provenance: import("typebox").TObject<{
540
+ kind: import("typebox").TLiteral<"local">;
541
+ authorityRoot: import("typebox").TString;
542
+ relativePath: import("typebox").TString;
543
+ }>;
544
+ relativePath: import("typebox").TString;
545
+ absolutePath: import("typebox").TString;
546
+ }>;
547
+ runner: import("typebox").TUnion<[import("typebox").TObject<{
548
+ name: import("typebox").TLiteral<"habitat">;
549
+ mode: import("typebox").TLiteral<"structure">;
550
+ structure: import("typebox").TObject<{
551
+ provenance: import("typebox").TObject<{
552
+ kind: import("typebox").TLiteral<"local">;
553
+ authorityRoot: import("typebox").TString;
554
+ relativePath: import("typebox").TString;
555
+ }>;
556
+ relativePath: import("typebox").TString;
557
+ absolutePath: import("typebox").TString;
558
+ }>;
559
+ }>, import("typebox").TObject<{
560
+ name: import("typebox").TLiteral<"grit">;
561
+ pattern: import("typebox").TObject<{
562
+ provenance: import("typebox").TObject<{
563
+ kind: import("typebox").TLiteral<"local">;
564
+ authorityRoot: import("typebox").TString;
565
+ relativePath: import("typebox").TString;
566
+ }>;
567
+ relativePath: import("typebox").TString;
568
+ absolutePath: import("typebox").TString;
569
+ }>;
570
+ patternName: import("typebox").TString;
571
+ acquisition: import("typebox").TObject<{
572
+ kind: import("typebox").TLiteral<"check">;
573
+ entries: import("typebox").TArray<import("typebox").TObject<{
574
+ kind: import("typebox").TUnion<[import("typebox").TLiteral<"directory">, import("typebox").TLiteral<"file">]>;
575
+ path: import("typebox").TString;
576
+ }>>;
577
+ }>;
578
+ }>]>;
419
579
  }>>;
420
580
  }>;
421
581
  }>;
@@ -492,6 +652,42 @@ export declare const module: import("@orpc/server").SharedRouterImplementerWithM
492
652
  severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
493
653
  baselined: import("typebox").TLiteral<false>;
494
654
  }>>;
655
+ }>, import("typebox").TObject<{
656
+ ownerProject: import("typebox").TString;
657
+ instanceId: import("typebox").TNull;
658
+ ruleId: import("typebox").TString;
659
+ runner: import("typebox").TLiteral<"grit">;
660
+ lane: import("typebox").TUnion<[import("typebox").TLiteral<"enforced">, import("typebox").TLiteral<"advisory">]>;
661
+ locked: import("typebox").TLiteral<true>;
662
+ status: import("typebox").TUnion<[import("typebox").TLiteral<"pass">, import("typebox").TLiteral<"fail">, import("typebox").TLiteral<"advisory-findings">, import("typebox").TLiteral<"error">]>;
663
+ message: import("typebox").TString;
664
+ remediate: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
665
+ disposition: import("typebox").TUnion<[import("typebox").TObject<{
666
+ kind: import("typebox").TLiteral<"evaluated">;
667
+ }>, import("typebox").TObject<{
668
+ kind: import("typebox").TLiteral<"not-applicable">;
669
+ reason: import("typebox").TLiteral<"no-matched-acquisition-roots">;
670
+ }>, import("typebox").TObject<{
671
+ kind: import("typebox").TLiteral<"failed">;
672
+ reason: import("typebox").TUnion<[import("typebox").TUnion<[import("typebox").TLiteral<"InvalidInput">, import("typebox").TLiteral<"SetupFailed">, import("typebox").TLiteral<"ExecutionFailed">, import("typebox").TLiteral<"TimedOut">, import("typebox").TLiteral<"InvalidOutput">]>, import("typebox").TLiteral<"PatternReadFailed">, import("typebox").TLiteral<"PatternInvalid">, import("typebox").TLiteral<"FindingPathInvalid">]>;
673
+ detail: import("typebox").TString;
674
+ }>]>;
675
+ findings: import("typebox").TArray<import("typebox").TObject<{
676
+ path: import("typebox").TString;
677
+ start: import("typebox").TObject<{
678
+ line: import("typebox").TReadonly<import("typebox").TInteger>;
679
+ column: import("typebox").TReadonly<import("typebox").TInteger>;
680
+ offset: import("typebox").TReadonly<import("typebox").TInteger>;
681
+ }>;
682
+ end: import("typebox").TObject<{
683
+ line: import("typebox").TReadonly<import("typebox").TInteger>;
684
+ column: import("typebox").TReadonly<import("typebox").TInteger>;
685
+ offset: import("typebox").TReadonly<import("typebox").TInteger>;
686
+ }>;
687
+ message: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
688
+ severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
689
+ baselined: import("typebox").TLiteral<false>;
690
+ }>>;
495
691
  }>, import("typebox").TObject<{
496
692
  ownerProject: import("typebox").TString;
497
693
  instanceId: import("typebox").TString;
@@ -516,6 +712,30 @@ export declare const module: import("@orpc/server").SharedRouterImplementerWithM
516
712
  severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
517
713
  baselined: import("typebox").TLiteral<false>;
518
714
  }>>;
715
+ }>, import("typebox").TObject<{
716
+ ownerProject: import("typebox").TString;
717
+ instanceId: import("typebox").TNull;
718
+ ruleId: import("typebox").TString;
719
+ runner: import("typebox").TLiteral<"habitat">;
720
+ lane: import("typebox").TUnion<[import("typebox").TLiteral<"enforced">, import("typebox").TLiteral<"advisory">]>;
721
+ locked: import("typebox").TLiteral<true>;
722
+ status: import("typebox").TUnion<[import("typebox").TLiteral<"pass">, import("typebox").TLiteral<"fail">, import("typebox").TLiteral<"advisory-findings">, import("typebox").TLiteral<"error">]>;
723
+ message: import("typebox").TString;
724
+ remediate: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
725
+ disposition: import("typebox").TUnion<[import("typebox").TObject<{
726
+ kind: import("typebox").TLiteral<"evaluated">;
727
+ }>, import("typebox").TObject<{
728
+ kind: import("typebox").TLiteral<"failed">;
729
+ reason: import("typebox").TUnion<[import("typebox").TLiteral<"StructureReadFailed">, import("typebox").TLiteral<"StructureInvalid">, import("typebox").TLiteral<"InventoryFailed">, import("typebox").TLiteral<"StructureObservationFailed">]>;
730
+ detail: import("typebox").TString;
731
+ }>]>;
732
+ findings: import("typebox").TArray<import("typebox").TObject<{
733
+ path: import("typebox").TString;
734
+ code: import("typebox").TUnion<[import("typebox").TLiteral<"root-missing">, import("typebox").TLiteral<"wrong-root-kind">, import("typebox").TLiteral<"missing-required-child">, import("typebox").TLiteral<"forbidden-child">, import("typebox").TLiteral<"unexpected-child">]>;
735
+ message: import("typebox").TString;
736
+ severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
737
+ baselined: import("typebox").TLiteral<false>;
738
+ }>>;
519
739
  }>]>>;
520
740
  }>]>>, object>;
521
741
  };
package/dist/service/modules/catalog/router/catalog.router.d.ts CHANGED
@@ -158,9 +158,59 @@ export declare const catalog: {
158
158
  schemaVersion: import("typebox").TLiteral<2>;
159
159
  ownerRoots: import("typebox").TRecord<"^.*$", import("typebox").TString>;
160
160
  rules: import("typebox").TArray<import("typebox").TObject<{
161
- id: import("typebox").TString;
161
+ ruleId: import("typebox").TString;
162
162
  ownerProject: import("typebox").TString;
163
163
  manifestPath: import("typebox").TString;
164
+ lane: import("typebox").TLiteral<"enforced">;
165
+ message: import("typebox").TString;
166
+ remediate: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
167
+ provenance: import("typebox").TObject<{
168
+ kind: import("typebox").TLiteral<"local">;
169
+ authorityRoot: import("typebox").TString;
170
+ relativePath: import("typebox").TString;
171
+ }>;
172
+ coveragePatterns: import("typebox").TArray<import("typebox").TString>;
173
+ baseline: import("typebox").TObject<{
174
+ provenance: import("typebox").TObject<{
175
+ kind: import("typebox").TLiteral<"local">;
176
+ authorityRoot: import("typebox").TString;
177
+ relativePath: import("typebox").TString;
178
+ }>;
179
+ relativePath: import("typebox").TString;
180
+ absolutePath: import("typebox").TString;
181
+ }>;
182
+ runner: import("typebox").TUnion<[import("typebox").TObject<{
183
+ name: import("typebox").TLiteral<"habitat">;
184
+ mode: import("typebox").TLiteral<"structure">;
185
+ structure: import("typebox").TObject<{
186
+ provenance: import("typebox").TObject<{
187
+ kind: import("typebox").TLiteral<"local">;
188
+ authorityRoot: import("typebox").TString;
189
+ relativePath: import("typebox").TString;
190
+ }>;
191
+ relativePath: import("typebox").TString;
192
+ absolutePath: import("typebox").TString;
193
+ }>;
194
+ }>, import("typebox").TObject<{
195
+ name: import("typebox").TLiteral<"grit">;
196
+ pattern: import("typebox").TObject<{
197
+ provenance: import("typebox").TObject<{
198
+ kind: import("typebox").TLiteral<"local">;
199
+ authorityRoot: import("typebox").TString;
200
+ relativePath: import("typebox").TString;
201
+ }>;
202
+ relativePath: import("typebox").TString;
203
+ absolutePath: import("typebox").TString;
204
+ }>;
205
+ patternName: import("typebox").TString;
206
+ acquisition: import("typebox").TObject<{
207
+ kind: import("typebox").TLiteral<"check">;
208
+ entries: import("typebox").TArray<import("typebox").TObject<{
209
+ kind: import("typebox").TUnion<[import("typebox").TLiteral<"directory">, import("typebox").TLiteral<"file">]>;
210
+ path: import("typebox").TString;
211
+ }>>;
212
+ }>;
213
+ }>]>;
164
214
  }>>;
165
215
  }>;
166
216
  }>;
@@ -237,6 +287,42 @@ export declare const catalog: {
237
287
  severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
238
288
  baselined: import("typebox").TLiteral<false>;
239
289
  }>>;
290
+ }>, import("typebox").TObject<{
291
+ ownerProject: import("typebox").TString;
292
+ instanceId: import("typebox").TNull;
293
+ ruleId: import("typebox").TString;
294
+ runner: import("typebox").TLiteral<"grit">;
295
+ lane: import("typebox").TUnion<[import("typebox").TLiteral<"enforced">, import("typebox").TLiteral<"advisory">]>;
296
+ locked: import("typebox").TLiteral<true>;
297
+ status: import("typebox").TUnion<[import("typebox").TLiteral<"pass">, import("typebox").TLiteral<"fail">, import("typebox").TLiteral<"advisory-findings">, import("typebox").TLiteral<"error">]>;
298
+ message: import("typebox").TString;
299
+ remediate: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
300
+ disposition: import("typebox").TUnion<[import("typebox").TObject<{
301
+ kind: import("typebox").TLiteral<"evaluated">;
302
+ }>, import("typebox").TObject<{
303
+ kind: import("typebox").TLiteral<"not-applicable">;
304
+ reason: import("typebox").TLiteral<"no-matched-acquisition-roots">;
305
+ }>, import("typebox").TObject<{
306
+ kind: import("typebox").TLiteral<"failed">;
307
+ reason: import("typebox").TUnion<[import("typebox").TUnion<[import("typebox").TLiteral<"InvalidInput">, import("typebox").TLiteral<"SetupFailed">, import("typebox").TLiteral<"ExecutionFailed">, import("typebox").TLiteral<"TimedOut">, import("typebox").TLiteral<"InvalidOutput">]>, import("typebox").TLiteral<"PatternReadFailed">, import("typebox").TLiteral<"PatternInvalid">, import("typebox").TLiteral<"FindingPathInvalid">]>;
308
+ detail: import("typebox").TString;
309
+ }>]>;
310
+ findings: import("typebox").TArray<import("typebox").TObject<{
311
+ path: import("typebox").TString;
312
+ start: import("typebox").TObject<{
313
+ line: import("typebox").TReadonly<import("typebox").TInteger>;
314
+ column: import("typebox").TReadonly<import("typebox").TInteger>;
315
+ offset: import("typebox").TReadonly<import("typebox").TInteger>;
316
+ }>;
317
+ end: import("typebox").TObject<{
318
+ line: import("typebox").TReadonly<import("typebox").TInteger>;
319
+ column: import("typebox").TReadonly<import("typebox").TInteger>;
320
+ offset: import("typebox").TReadonly<import("typebox").TInteger>;
321
+ }>;
322
+ message: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
323
+ severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
324
+ baselined: import("typebox").TLiteral<false>;
325
+ }>>;
240
326
  }>, import("typebox").TObject<{
241
327
  ownerProject: import("typebox").TString;
242
328
  instanceId: import("typebox").TString;
@@ -261,6 +347,30 @@ export declare const catalog: {
261
347
  severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
262
348
  baselined: import("typebox").TLiteral<false>;
263
349
  }>>;
350
+ }>, import("typebox").TObject<{
351
+ ownerProject: import("typebox").TString;
352
+ instanceId: import("typebox").TNull;
353
+ ruleId: import("typebox").TString;
354
+ runner: import("typebox").TLiteral<"habitat">;
355
+ lane: import("typebox").TUnion<[import("typebox").TLiteral<"enforced">, import("typebox").TLiteral<"advisory">]>;
356
+ locked: import("typebox").TLiteral<true>;
357
+ status: import("typebox").TUnion<[import("typebox").TLiteral<"pass">, import("typebox").TLiteral<"fail">, import("typebox").TLiteral<"advisory-findings">, import("typebox").TLiteral<"error">]>;
358
+ message: import("typebox").TString;
359
+ remediate: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
360
+ disposition: import("typebox").TUnion<[import("typebox").TObject<{
361
+ kind: import("typebox").TLiteral<"evaluated">;
362
+ }>, import("typebox").TObject<{
363
+ kind: import("typebox").TLiteral<"failed">;
364
+ reason: import("typebox").TUnion<[import("typebox").TLiteral<"StructureReadFailed">, import("typebox").TLiteral<"StructureInvalid">, import("typebox").TLiteral<"InventoryFailed">, import("typebox").TLiteral<"StructureObservationFailed">]>;
365
+ detail: import("typebox").TString;
366
+ }>]>;
367
+ findings: import("typebox").TArray<import("typebox").TObject<{
368
+ path: import("typebox").TString;
369
+ code: import("typebox").TUnion<[import("typebox").TLiteral<"root-missing">, import("typebox").TLiteral<"wrong-root-kind">, import("typebox").TLiteral<"missing-required-child">, import("typebox").TLiteral<"forbidden-child">, import("typebox").TLiteral<"unexpected-child">]>;
370
+ message: import("typebox").TString;
371
+ severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
372
+ baselined: import("typebox").TLiteral<false>;
373
+ }>>;
264
374
  }>]>>;
265
375
  }>]>>, object>;
266
376
  };
package/dist/service/modules/catalog/router/catalog.router.js CHANGED
@@ -1,8 +1,8 @@
1
1
  import { MAX_SOURCE_INVENTORY_ENTRIES } from "@habitat-ai/resource-source-inventory";
2
2
  import { Effect } from "effect";
3
3
  import { parse as parseToml } from "smol-toml";
4
- import { admitBlueprintSource, admitCompatibilityIndex, admitCompatibilityRule, admitInstanceSource, admitPolicyPackManifest, admitPolicyPackPackageJson, admitPolicyPackSelection, referencedRepositoryPaths, rejected, resolveCatalog, } from "../model/policy/catalog.js";
5
- import { completedCheck, evaluatedApplication, evaluatedStructureApplication, extractGritProgram, failedApplication, failedStructureApplication, selectCheckApplications, } from "../model/policy/check.js";
4
+ import { admitBlueprintSource, admitCompatibilityBaseline, admitCompatibilityIndex, admitCompatibilityRule, admitInstanceSource, admitPolicyPackManifest, admitPolicyPackPackageJson, admitPolicyPackSelection, referencedRepositoryPaths, rejected, resolveCatalog, } from "../model/policy/catalog.js";
5
+ import { completedCheck, evaluatedApplication, evaluatedStructureApplication, extractGritProgram, failedApplication, failedStructureApplication, isCompatibilityRule, notApplicableApplication, selectCheckApplications, } from "../model/policy/check.js";
6
6
  import { admitStructureDocument, evaluateStructurePlan, isHabitatStructureApplication, makeStructureUniverse, planStructureEvaluation, structureChildObservationPaths, } from "../model/policy/structure.js";
7
7
  import { module } from "../module.js";
8
8
  const authorityGlobs = [
@@ -23,6 +23,13 @@ const excludedDirectorySegments = new Set([
23
23
  "vendor",
24
24
  ]);
25
25
  const excludedRepositoryGlobs = [...excludedDirectorySegments].map((segment) => `**/${segment}/**`);
26
+ const compatibilityProtectedRoots = [
27
+ ".git",
28
+ ".habitat/cache/patterns",
29
+ "dist",
30
+ "node_modules",
31
+ "tools/habitat/dist",
32
+ ];
26
33
  const MAX_MANIFEST_DIRECTORIES = 50_000;
27
34
  function resolveCurrentCatalog(context) {
28
35
  return Effect.gen(function* () {
@@ -333,10 +340,69 @@ function resolveCurrentCatalog(context) {
333
340
  continue;
334
341
  }
335
342
  const admitted = admitCompatibilityRule(parsed.success, relativePath);
336
- if (admitted.ok)
337
- compatibilityRules.push(admitted.source);
338
- else
343
+ if (!admitted.ok) {
339
344
  issues.push(...admitted.issues);
345
+ continue;
346
+ }
347
+ const baselinePath = admitted.source.rule.supportFiles.baseline;
348
+ const absoluteBaselinePath = path.resolve(workspaceRoot, baselinePath);
349
+ if (!isContained(workspaceRoot, absoluteBaselinePath, path)) {
350
+ issues.push({
351
+ code: "authority-path-escape",
352
+ path: baselinePath,
353
+ message: "Compatibility baseline escapes workspaceRoot.",
354
+ });
355
+ continue;
356
+ }
357
+ const baselineRealPath = yield* Effect.result(fileSystem.realPath(absoluteBaselinePath));
358
+ if (baselineRealPath._tag === "Failure") {
359
+ issues.push(filesystemIssue(baselineRealPath.failure, baselinePath, "resolve compatibility baseline", "Compatibility baseline does not exist."));
360
+ continue;
361
+ }
362
+ if (!isContained(workspaceRealRoot, baselineRealPath.success, path)) {
363
+ issues.push({
364
+ code: "authority-path-escape",
365
+ path: baselinePath,
366
+ message: "Compatibility baseline escapes workspaceRoot through a symbolic link.",
367
+ });
368
+ continue;
369
+ }
370
+ const baselineStat = yield* Effect.result(fileSystem.stat(baselineRealPath.success));
371
+ if (baselineStat._tag === "Failure") {
372
+ issues.push(filesystemIssue(baselineStat.failure, baselinePath, "inspect compatibility baseline", "Compatibility baseline does not exist."));
373
+ continue;
374
+ }
375
+ if (baselineStat.success.type !== "File") {
376
+ issues.push({
377
+ code: "authority-path-kind-mismatch",
378
+ path: baselinePath,
379
+ message: "Compatibility baseline must be a regular file.",
380
+ });
381
+ continue;
382
+ }
383
+ const baselineRead = yield* Effect.result(fileSystem.readFileString(baselineRealPath.success));
384
+ if (baselineRead._tag === "Failure") {
385
+ issues.push(filesystemIssue(baselineRead.failure, baselinePath, "read compatibility baseline", "Compatibility baseline does not exist."));
386
+ continue;
387
+ }
388
+ const baselineParsed = yield* Effect.result(Effect.try({
389
+ try: () => JSON.parse(baselineRead.success),
390
+ catch: (cause) => cause,
391
+ }));
392
+ if (baselineParsed._tag === "Failure") {
393
+ issues.push({
394
+ code: "authority-json-invalid",
395
+ path: baselinePath,
396
+ message: "Compatibility baseline is not valid JSON.",
397
+ });
398
+ continue;
399
+ }
400
+ const baseline = admitCompatibilityBaseline(baselineParsed.success, baselinePath);
401
+ if (!baseline.ok) {
402
+ issues.push(...baseline.issues);
403
+ continue;
404
+ }
405
+ compatibilityRules.push({ ...admitted.source, baseline: baseline.value });
340
406
  }
341
407
  if (issues.length > 0)
342
408
  return rejected(issues);
@@ -572,7 +638,19 @@ const check = module.check.effect(function* ({ context, input }) {
572
638
  reports.push(failedApplication(application, "PatternInvalid", program.detail));
573
639
  continue;
574
640
  }
575
- const subjects = resolvedSubjects(application, context.workspaceRoot, context.path);
641
+ const subjectPreparation = yield* prepareGritSubjects(application, context.workspaceRoot, context.fileSystem, context.path);
642
+ if (subjectPreparation.kind === "failed") {
643
+ reports.push(failedApplication(application, "SetupFailed", subjectPreparation.detail));
644
+ continue;
645
+ }
646
+ if (subjectPreparation.kind === "not-applicable") {
647
+ if (!isCompatibilityRule(application)) {
648
+ return yield* Effect.die(new Error("Version-three Grit applications cannot be not applicable."));
649
+ }
650
+ reports.push(notApplicableApplication(application));
651
+ continue;
652
+ }
653
+ const subjects = subjectPreparation.subjects;
576
654
  const evaluation = yield* Effect.result(context.ruleEvaluation.evaluate({
577
655
  program: program.program,
578
656
  subjectPaths: subjects.map((subject) => subject.absolutePath),
@@ -623,6 +701,113 @@ function hasExactCauseCode(error, code) {
623
701
  const cause = "cause" in error.reason ? error.reason.cause : undefined;
624
702
  return typeof cause === "object" && cause !== null && "code" in cause && cause.code === code;
625
703
  }
704
+ function prepareGritSubjects(application, workspaceRoot, fileSystem, path) {
705
+ if (!isCompatibilityRule(application)) {
706
+ return Effect.succeed({
707
+ kind: "ready",
708
+ subjects: resolvedSubjects(application, workspaceRoot, path),
709
+ });
710
+ }
711
+ return Effect.gen(function* () {
712
+ const workspaceRealPath = yield* Effect.result(fileSystem.realPath(workspaceRoot));
713
+ if (workspaceRealPath._tag === "Failure") {
714
+ return {
715
+ kind: "failed",
716
+ detail: "Unable to canonicalize the compatibility workspace root.",
717
+ };
718
+ }
719
+ const authority = resolvedSubjects(application, workspaceRoot, path);
720
+ for (const root of authority) {
721
+ const canonical = yield* Effect.result(fileSystem.realPath(root.absolutePath));
722
+ if (canonical._tag === "Failure") {
723
+ return {
724
+ kind: "failed",
725
+ detail: `Unable to canonicalize compatibility acquisition root "${toRepositoryPath(path.relative(workspaceRoot, root.absolutePath), path.sep)}".`,
726
+ };
727
+ }
728
+ const expectedCanonical = path.resolve(workspaceRealPath.success, path.relative(workspaceRoot, root.absolutePath));
729
+ if (canonical.success !== expectedCanonical ||
730
+ !isContained(workspaceRealPath.success, canonical.success, path)) {
731
+ return {
732
+ kind: "failed",
733
+ detail: `Compatibility acquisition root "${toRepositoryPath(path.relative(workspaceRoot, root.absolutePath), path.sep)}" is a symbolic link; compatibility checks accept direct workspace roots only.`,
734
+ };
735
+ }
736
+ }
737
+ const resolvedCoveragePatterns = application.coveragePatterns.map((pattern) => path.resolve(workspaceRoot, pattern));
738
+ const compatibilityExcludes = [path.resolve(workspaceRoot, "**/node_modules/**")];
739
+ const globAttempts = yield* Effect.all(resolvedCoveragePatterns.map((pattern) => Effect.result(fileSystem.glob(pattern, { exclude: compatibilityExcludes }))));
740
+ const failedGlob = globAttempts.find((attempt) => attempt._tag === "Failure");
741
+ if (failedGlob?._tag === "Failure") {
742
+ return {
743
+ kind: "failed",
744
+ detail: "Unable to enumerate compatibility exact-path coverage.",
745
+ };
746
+ }
747
+ const directAttempts = yield* Effect.all(resolvedCoveragePatterns.map((pattern) => Effect.result(fileSystem.stat(pattern))));
748
+ const failedDirect = directAttempts.find((attempt) => attempt._tag === "Failure" && !isNotFound(attempt.failure));
749
+ if (failedDirect?._tag === "Failure") {
750
+ return {
751
+ kind: "failed",
752
+ detail: "Unable to inspect compatibility exact-path coverage.",
753
+ };
754
+ }
755
+ const candidates = stablePaths([
756
+ ...globAttempts.flatMap((attempt) => attempt._tag === "Success"
757
+ ? attempt.success.map((candidate) => path.isAbsolute(candidate)
758
+ ? path.resolve(candidate)
759
+ : path.resolve(workspaceRoot, candidate))
760
+ : []),
761
+ ...directAttempts.flatMap((attempt, index) => attempt._tag === "Success" && attempt.success.type === "File"
762
+ ? [resolvedCoveragePatterns[index]]
763
+ : []),
764
+ ].filter((candidate) => candidate !== undefined)).filter((candidate) => !isCompatibilityProtectedSubject(candidate, workspaceRoot, path) &&
765
+ authority.some((root) => root.kind === "file"
766
+ ? candidate === root.absolutePath
767
+ : isContained(root.absolutePath, candidate, path)));
768
+ const subjects = [];
769
+ for (const candidate of candidates) {
770
+ const canonical = yield* Effect.result(fileSystem.realPath(candidate));
771
+ if (canonical._tag === "Failure") {
772
+ if (isNotFound(canonical.failure))
773
+ continue;
774
+ return {
775
+ kind: "failed",
776
+ detail: `Unable to canonicalize compatibility subject "${toRepositoryPath(path.relative(workspaceRoot, candidate), path.sep)}".`,
777
+ };
778
+ }
779
+ const expectedCanonical = path.resolve(workspaceRealPath.success, path.relative(workspaceRoot, candidate));
780
+ if (canonical.success !== expectedCanonical ||
781
+ !isContained(workspaceRealPath.success, canonical.success, path)) {
782
+ return {
783
+ kind: "failed",
784
+ detail: `Exact coverage selected symbolic link "${toRepositoryPath(path.relative(workspaceRoot, candidate), path.sep)}"; compatibility checks accept regular files only.`,
785
+ };
786
+ }
787
+ const stat = yield* Effect.result(fileSystem.stat(canonical.success));
788
+ if (stat._tag === "Failure") {
789
+ if (isNotFound(stat.failure))
790
+ continue;
791
+ return {
792
+ kind: "failed",
793
+ detail: `Unable to inspect compatibility subject "${toRepositoryPath(path.relative(workspaceRoot, candidate), path.sep)}".`,
794
+ };
795
+ }
796
+ if (stat.success.type === "File") {
797
+ subjects.push({ absolutePath: candidate, kind: "file" });
798
+ }
799
+ }
800
+ return subjects.length === 0
801
+ ? { kind: "not-applicable" }
802
+ : { kind: "ready", subjects };
803
+ });
804
+ }
805
+ function isCompatibilityProtectedSubject(candidate, workspaceRoot, path) {
806
+ const relative = toRepositoryPath(path.relative(workspaceRoot, candidate), path.sep);
807
+ if (relative.split("/").includes("node_modules"))
808
+ return true;
809
+ return compatibilityProtectedRoots.some((root) => relative === root || relative.startsWith(`${root}/`));
810
+ }
626
811
  function resolvedSubjects(application, workspaceRoot, path) {
627
812
  const subjects = new Map();
628
813
  for (const entry of application.runner.acquisition.entries) {