@habitat-ai/service 0.2.0 → 0.2.2

package/dist/service/modules/catalog/model/policy/catalog.js

@@ -1,5 +1,5 @@
 import { Validator } from "typebox/schema";
-import { BlueprintDefinitionSchema, CompatibilityIndexSchema, CompatibilityRuleSourceSchema, HabitatInstanceManifestSchema, MAX_CATALOG_ISSUES, PolicyPackManifestSchema, PolicyPackPackageJsonSchema, } from "../dto/catalog.js";
+import { BlueprintDefinitionSchema, CompatibilityBaselineSchema, CompatibilityIndexSchema, CompatibilityRuleSourceSchema, HabitatInstanceManifestSchema, MAX_CATALOG_ISSUES, PolicyPackManifestSchema, PolicyPackPackageJsonSchema, } from "../dto/catalog.js";
 const MEMBER_PLACEHOLDER = "{member}";
 const GLOB_CHARACTERS = /[*?[\]!]/;
 const blueprintValidator = new Validator({}, BlueprintDefinitionSchema);
@@ -8,6 +8,7 @@ const policyPackPackageJsonValidator = new Validator({}, PolicyPackPackageJsonSc
 const instanceValidator = new Validator({}, HabitatInstanceManifestSchema);
 const compatibilityIndexValidator = new Validator({}, CompatibilityIndexSchema);
 const compatibilityRuleValidator = new Validator({}, CompatibilityRuleSourceSchema);
+const compatibilityBaselineValidator = new Validator({}, CompatibilityBaselineSchema);
 /** Validates the selected policy-pack filesystem locators. */
 export function admitPolicyPackSelection(selection, path) {
     const issues = [];
@@ -73,9 +74,31 @@ export function admitCompatibilityRule(value, relativePath) {
     const admitted = admit(compatibilityRuleValidator, value, relativePath);
     return admitted.ok ? { ok: true, source: { rule: admitted.value, relativePath } } : admitted;
 }
+/** Admits the exact empty baseline supported by compatibility execution. */
+export function admitCompatibilityBaseline(value, relativePath) {
+    return admit(compatibilityBaselineValidator, value, relativePath);
+}
 /** Collects filesystem paths that schema-admitted documents require the service to observe. */
 export function referencedRepositoryPaths(documents, path) {
     const references = new Set();
+    for (const root of Object.values(documents.compatibilityIndex?.ownerRoots ?? {})) {
+        if (relativePathIssues(root, ".habitat/index.json", path).length === 0) {
+            references.add(toRepositoryPath(root, path));
+        }
+    }
+    for (const source of documents.compatibilityRules) {
+        const rule = source.rule;
+        const paths = [
+            rule.supportFiles.baseline,
+            rule.runner.name === "grit" ? rule.runner.files.pattern : rule.runner.files.structure,
+            ...(rule.runner.name === "grit" ? rule.runner.acquisition.roots : []),
+        ];
+        for (const referencedPath of paths) {
+            if (relativePathIssues(referencedPath, source.relativePath, path).length === 0) {
+                references.add(toRepositoryPath(referencedPath, path));
+            }
+        }
+    }
     for (const source of documents.blueprints) {
         const directory = path.dirname(source.relativePath);
         for (const rule of source.definition.rules) {
@@ -126,10 +149,10 @@ export function resolveCatalog(documents, pathFacts, workspaceRoot, workspaceRea
     for (const source of blueprints) {
         issues.push(...validateBlueprint(source, path));
     }
-    const compatibility = resolveCompatibility(documents, issues, path);
+    const compatibility = resolveCompatibility(documents, issues, pathFacts, workspaceRoot, workspaceRealRoot, path);
     const ruleSources = [
         ...blueprints.flatMap((source) => source.definition.rules.map((rule) => ({ identity: rule.id, path: source.relativePath }))),
-        ...compatibility.rules.map((rule) => ({ identity: rule.id, path: rule.manifestPath })),
+        ...compatibility.rules.map((rule) => ({ identity: rule.ruleId, path: rule.manifestPath })),
     ];
     issues.push(...duplicateIssues(ruleSources, "authority-duplicate-rule", "rule"));
     const definitions = new Map(blueprints.map((source) => [blueprintIdentity(source.definition), source]));
@@ -276,24 +299,74 @@ export function rejected(issues) {
             : [issue("authority-resolution-failed", "", "Catalog resolution failed.")],
     };
 }
-function resolveCompatibility(documents, issues, path) {
+function resolveCompatibility(documents, issues, pathFacts, workspaceRoot, workspaceRealRoot, path) {
     if (!documents.compatibilityIndex) {
         return { schemaVersion: 2, ownerRoots: {}, rules: [] };
     }
     const ownerRoots = Object.fromEntries(Object.entries(documents.compatibilityIndex.ownerRoots).sort(([left], [right]) => textOrder(left, right)));
     for (const [owner, root] of Object.entries(ownerRoots)) {
         issues.push(...relativePathIssues(root, `.habitat/index.json#ownerRoots:${owner}`, path));
+        issues.push(...pathFactIssues(root, "directory", `.habitat/index.json#ownerRoots:${owner}`, pathFacts, workspaceRoot, workspaceRealRoot, path));
     }
     const rules = [...documents.compatibilityRules]
         .sort((left, right) => textOrder(left.rule.id, right.rule.id) || textOrder(left.relativePath, right.relativePath))
         .map((source) => {
-        if (!Object.hasOwn(ownerRoots, source.rule.ownerProject)) {
-            issues.push(issue("authority-compatibility-invalid", source.relativePath, `Legacy rule ownerProject "${source.rule.ownerProject}" has no owner root.`));
+        const rule = source.rule;
+        if (!Object.hasOwn(ownerRoots, rule.ownerProject)) {
+            issues.push(issue("authority-compatibility-invalid", source.relativePath, `Legacy rule ownerProject "${rule.ownerProject}" has no owner root.`));
         }
-        return {
-            id: source.rule.id,
-            ownerProject: source.rule.ownerProject,
+        for (const pattern of rule.pathCoverage[0].patterns) {
+            issues.push(...repositoryPatternIssues(pattern, source.relativePath, path));
+        }
+        const baselinePath = rule.supportFiles.baseline;
+        const runnerAssetPath = rule.runner.name === "grit" ? rule.runner.files.pattern : rule.runner.files.structure;
+        issues.push(...pathFactIssues(baselinePath, "file", source.relativePath, pathFacts, workspaceRoot, workspaceRealRoot, path), ...pathFactIssues(runnerAssetPath, "file", source.relativePath, pathFacts, workspaceRoot, workspaceRealRoot, path));
+        const provenance = {
+            kind: "local",
+            authorityRoot: workspaceRoot,
+            relativePath: source.relativePath,
+        };
+        const asset = (relativePath) => ({
+            provenance,
+            relativePath,
+            absolutePath: path.resolve(workspaceRoot, relativePath),
+        });
+        const common = {
+            ruleId: rule.id,
+            ownerProject: rule.ownerProject,
             manifestPath: source.relativePath,
+            lane: rule.lane,
+            message: rule.message,
+            remediate: rule.remediate,
+            provenance,
+            coveragePatterns: [...rule.pathCoverage[0].patterns],
+            baseline: asset(baselinePath),
+        };
+        if (rule.runner.name === "habitat") {
+            return {
+                ...common,
+                runner: {
+                    name: "habitat",
+                    mode: "structure",
+                    structure: asset(runnerAssetPath),
+                },
+            };
+        }
+        const entries = [];
+        for (const root of rule.runner.acquisition.roots) {
+            const admission = pathFactAnyIssues(root, source.relativePath, pathFacts, workspaceRoot, workspaceRealRoot, path);
+            issues.push(...admission.issues);
+            if (admission.kind !== undefined)
+                entries.push({ kind: admission.kind, path: root });
+        }
+        return {
+            ...common,
+            runner: {
+                name: "grit",
+                pattern: asset(runnerAssetPath),
+                patternName: rule.runner.patternName,
+                acquisition: { kind: "check", entries },
+            },
         };
     });
     return { schemaVersion: 2, ownerRoots, rules };
@@ -501,6 +574,15 @@ function pathFactIssues(relativePath, expectedKind, sourcePath, facts, workspace
     }
     return [];
 }
+function pathFactAnyIssues(relativePath, sourcePath, facts, workspaceRoot, workspaceRealRoot, path) {
+    const normalized = toRepositoryPath(relativePath, path);
+    const fact = facts.get(normalized);
+    const kind = fact?.kind === "directory" || fact?.kind === "file" ? fact.kind : undefined;
+    return {
+        kind,
+        issues: pathFactIssues(normalized, kind ?? "directory", sourcePath, facts, workspaceRoot, workspaceRealRoot, path),
+    };
+}
 function ruleAssetPath(source, rule, path) {
     const asset = rule.runner.name === "habitat" ? rule.runner.structure : rule.runner.pattern;
     return toRepositoryPath(path.join(path.dirname(source.relativePath), asset), path);
@@ -520,6 +602,19 @@ function relativePathIssues(candidate, sourcePath, path) {
         ]
         : [];
 }
+function repositoryPatternIssues(candidate, sourcePath, path) {
+    const invalid = candidate.includes("\\") ||
+        path.isAbsolute(candidate) ||
+        candidate.includes("//") ||
+        candidate.endsWith("/") ||
+        candidate.split("/").some((segment) => segment === "" || segment === "..") ||
+        /[\u0000-\u001f\u007f]/u.test(candidate);
+    return invalid
+        ? [
+            issue("authority-path-invalid", sourcePath, `Coverage pattern must be repository-relative and traversal-free: "${candidate}".`),
+        ]
+        : [];
+}
 function pathTemplateIssues(template, sourcePath, path) {
     const placeholderCount = template.split(MEMBER_PLACEHOLDER).length - 1;
     const substituted = template.replaceAll(MEMBER_PLACEHOLDER, "member");

package/dist/service/modules/catalog/model/policy/check.d.ts

@@ -2,7 +2,9 @@ import type { RuleEvaluationFinding } from "@habitat-ai/resource-rule-evaluation
 import type { HabitatCatalog } from "../dto/catalog.js";
 import type { CheckApplicationReport, CheckCatalogInput, CheckCatalogResult, CheckSelectionIssue } from "../dto/check.js";
 import type { HabitatStructureApplication, StructureDiagnostic } from "./structure.js";
-type RuleApplication = HabitatCatalog["applications"][number];
+type InstanceApplication = HabitatCatalog["applications"][number];
+type CompatibilityRule = HabitatCatalog["compatibility"]["rules"][number];
+type RuleApplication = InstanceApplication | CompatibilityRule;
 type ResolvedGritRunner = Extract<RuleApplication["runner"], {
     name: "grit";
 }>;
@@ -12,7 +14,7 @@ type GritCheckRunner = Omit<ResolvedGritRunner, "acquisition"> & {
     };
 };
 /** Resolved application mechanically executable by the Grit check resource. */
-export type GritCheckApplication = Omit<RuleApplication, "runner"> & {
+export type GritCheckApplication = RuleApplication & {
     readonly runner: GritCheckRunner;
 };
 /** Runner set executable by catalog.check. */
@@ -23,6 +25,12 @@ type GritCheckApplicationReport = Extract<CheckApplicationReport, {
 type StructureCheckApplicationReport = Extract<CheckApplicationReport, {
     runner: "habitat";
 }>;
+type CompatibilityGritCheckApplicationReport = Extract<GritCheckApplicationReport, {
+    instanceId: null;
+}>;
+type CompatibilityGritCheckApplication = Extract<GritCheckApplication, {
+    readonly baseline: unknown;
+}>;
 type CheckSelection = {
     readonly ok: true;
     readonly applications: readonly ExecutableCheckApplication[];
@@ -46,6 +54,8 @@ export declare function evaluatedApplication(application: GritCheckApplication,
 export declare function failedApplication(application: GritCheckApplication, reason: Extract<GritCheckApplicationReport["disposition"], {
     kind: "failed";
 }>["reason"], detail: string): GritCheckApplicationReport;
+/** Reports an exact-coverage compatibility rule that has no current subject files. */
+export declare function notApplicableApplication(application: CompatibilityGritCheckApplication): CompatibilityGritCheckApplicationReport;
 /** Produces one native Habitat report from pure structure diagnostics. */
 export declare function evaluatedStructureApplication(application: HabitatStructureApplication, diagnostics: readonly StructureDiagnostic[]): StructureCheckApplicationReport;
 /** Produces one deterministic native Habitat operational-error report. */
@@ -54,4 +64,6 @@ export declare function failedStructureApplication(application: HabitatStructure
 }>["reason"], detail: string): StructureCheckApplicationReport;
 /** Completes a check from already ordered application reports. */
 export declare function completedCheck(applications: readonly CheckApplicationReport[]): CheckCatalogResult;
+/** Narrows a resolved check application to one compatibility rule. */
+export declare function isCompatibilityRule(application: RuleApplication): application is CompatibilityRule;
 export {};

package/dist/service/modules/catalog/model/policy/check.js

@@ -36,8 +36,13 @@ export function selectCheckApplications(catalog, input) {
     }
     if (issues.length > 0)
         return refused(issues);
-    const selected = catalog.applications.filter((application) => (selectors?.owner === undefined || application.ownerProject === selectors.owner) &&
-        (selectors?.instance === undefined || application.instanceId === selectors.instance) &&
+    const applications = [
+        ...catalog.applications,
+        ...catalog.compatibility.rules,
+    ];
+    const selected = applications.filter((application) => (selectors?.owner === undefined || application.ownerProject === selectors.owner) &&
+        (selectors?.instance === undefined ||
+            (isInstanceApplication(application) && application.instanceId === selectors.instance)) &&
         (requestedRules.length === 0 || requestedRules.includes(application.ruleId)) &&
         (selectors?.runner === undefined || application.runner.name === selectors.runner));
     if (hasExplicitSelectors && selected.length === 0 && !isKnownEmptyRunnerSelection(selectors)) {
@@ -47,7 +52,7 @@ export function selectCheckApplications(catalog, input) {
     }
     const unsupported = selected.filter(isUnsupportedGritApplication);
     if (unsupported.length > 0) {
-        return refused(unsupported.map((application) => issue("runner-unsupported", `${application.instanceId}:${application.ruleId}`, `Rule "${application.ruleId}" requires Grit ${application.runner.acquisition.kind}, which catalog.check does not execute.`)));
+        return refused(unsupported.map((application) => issue("runner-unsupported", applicationIdentityText(application), `Rule "${application.ruleId}" requires Grit ${application.runner.acquisition.kind}, which catalog.check does not execute.`)));
     }
     return {
         ok: true,
@@ -97,6 +102,22 @@ export function failedApplication(application, reason, detail) {
         findings: [],
     };
 }
+/** Reports an exact-coverage compatibility rule that has no current subject files. */
+export function notApplicableApplication(application) {
+    return {
+        ownerProject: application.ownerProject,
+        instanceId: null,
+        ruleId: application.ruleId,
+        runner: "grit",
+        lane: application.lane,
+        locked: true,
+        message: application.message,
+        remediate: application.remediate,
+        status: "pass",
+        disposition: { kind: "not-applicable", reason: "no-matched-acquisition-roots" },
+        findings: [],
+    };
+}
 /** Produces one native Habitat report from pure structure diagnostics. */
 export function evaluatedStructureApplication(application, diagnostics) {
     const severity = application.lane === "enforced" ? "error" : "advisory";
@@ -133,6 +154,18 @@ export function completedCheck(applications) {
     };
 }
 function applicationIdentity(application) {
+    if (isCompatibilityRule(application)) {
+        return {
+            ownerProject: application.ownerProject,
+            instanceId: null,
+            ruleId: application.ruleId,
+            runner: "grit",
+            lane: application.lane,
+            locked: true,
+            message: application.message,
+            remediate: application.remediate,
+        };
+    }
     return {
         ownerProject: application.ownerProject,
         instanceId: application.instanceId,
@@ -145,6 +178,18 @@ function applicationIdentity(application) {
     };
 }
 function structureApplicationIdentity(application) {
+    if (isCompatibilityRule(application)) {
+        return {
+            ownerProject: application.ownerProject,
+            instanceId: null,
+            ruleId: application.ruleId,
+            runner: "habitat",
+            lane: application.lane,
+            locked: true,
+            message: application.message,
+            remediate: application.remediate,
+        };
+    }
     return {
         ownerProject: application.ownerProject,
         instanceId: application.instanceId,
@@ -167,7 +212,7 @@ function isExecutableCheckApplication(application) {
 }
 function compareApplications(left, right) {
     return (compareText(left.ruleId, right.ruleId) ||
-        compareText(left.instanceId, right.instanceId) ||
+        compareText(instanceId(left) ?? "", instanceId(right) ?? "") ||
         compareText(left.ownerProject, right.ownerProject));
 }
 function compareText(left, right) {
@@ -180,11 +225,15 @@ function issue(code, selector, message) {
     return { code, selector, message };
 }
 function selectionIssue(catalog, kind, value) {
+    const applications = [
+        ...catalog.applications,
+        ...catalog.compatibility.rules,
+    ];
     const matches = {
-        owner: catalog.applications.some((application) => application.ownerProject === value),
+        owner: applications.some((application) => application.ownerProject === value),
         instance: catalog.applications.some((application) => application.instanceId === value),
-        rule: catalog.applications.some((application) => application.ruleId === value),
-        runner: catalog.applications.some((application) => application.runner.name === value),
+        rule: applications.some((application) => application.ruleId === value),
+        runner: applications.some((application) => application.runner.name === value),
     };
     if (matches[kind] || (kind === "runner" && knownRunnerSelectors.has(value)))
         return undefined;
@@ -193,6 +242,20 @@ function selectionIssue(catalog, kind, value) {
         ? issue("selector-unknown", `${kind}:${value}`, `No resolved application uses ${kind} "${value}".`)
         : issue("selector-wrong-namespace", `${kind}:${value}`, `"${value}" is a known ${actualKind}, not a ${kind}.`);
 }
+/** Narrows a resolved check application to one compatibility rule. */
+export function isCompatibilityRule(application) {
+    return "baseline" in application;
+}
+function isInstanceApplication(application) {
+    return "instanceId" in application;
+}
+function instanceId(application) {
+    return isInstanceApplication(application) ? application.instanceId : null;
+}
+function applicationIdentityText(application) {
+    const instance = instanceId(application);
+    return instance === null ? application.ruleId : `${instance}:${application.ruleId}`;
+}
 function isKnownEmptyRunnerSelection(selectors) {
     return (selectors?.owner === undefined &&
         selectors?.instance === undefined &&

package/dist/service/modules/catalog/model/policy/structure.d.ts

@@ -1,8 +1,7 @@
 import type { SourceInventoryResult } from "@habitat-ai/resource-source-inventory";
 import type { HabitatCatalog } from "../dto/catalog.js";
 import type { StructureCheckFinding } from "../dto/check.js";
-import { type StructureScope } from "../dto/structure.js";
-type RuleApplication = HabitatCatalog["applications"][number];
+type RuleApplication = HabitatCatalog["applications"][number] | HabitatCatalog["compatibility"]["rules"][number];
 /** Resolved application executable by the native Habitat structure policy. */
 export type HabitatStructureApplication = RuleApplication & {
     readonly runner: Extract<RuleApplication["runner"], {
@@ -12,9 +11,16 @@ export type HabitatStructureApplication = RuleApplication & {
 /** Narrows one resolved application to the native structure runner. */
 export declare function isHabitatStructureApplication(application: RuleApplication): application is HabitatStructureApplication;
 /** Live or inventory-derived kind understood by native structure evaluation. */
-export type StructureRootKind = StructureScope["kind"] | "other";
-type BoundStructureScope = Omit<StructureScope, "allowEmpty"> & {
+export type StructureRootKind = "directory" | "file" | "other";
+type BoundStructureScope = {
+    readonly name: string;
+    readonly relativePath: string;
+    readonly kind: "directory" | "file";
+    readonly mode: "open" | "closed";
     readonly allowEmpty: boolean;
+    readonly required?: readonly string[];
+    readonly allowed?: readonly string[];
+    readonly forbidden?: readonly string[];
     readonly bindingPath: string;
 };
 /** Schema-admitted structure application with inapplicable unbound scopes removed. */

package/dist/service/modules/catalog/model/policy/structure.js

@@ -1,13 +1,43 @@
 import picomatch from "picomatch";
 import { Validator } from "typebox/schema";
-import { STRUCTURE_PICOMATCH_OPTIONS, StructureDocumentSchema, } from "../dto/structure.js";
+import { CompatibilityStructureDocumentSchema, STRUCTURE_PICOMATCH_OPTIONS, StructureDocumentSchema, } from "../dto/structure.js";
 /** Narrows one resolved application to the native structure runner. */
 export function isHabitatStructureApplication(application) {
     return application.runner.name === "habitat";
 }
 const structureValidator = new Validator({}, StructureDocumentSchema);
+const compatibilityStructureValidator = new Validator({}, CompatibilityStructureDocumentSchema);
 /** Admits TypeBox-valid structure authority and resolves its root-role applicability. */
 export function admitStructureDocument(value, application) {
+    if (isCompatibilityStructureApplication(application)) {
+        if (!compatibilityStructureValidator.Check(value)) {
+            const [, errors] = compatibilityStructureValidator.Errors(value);
+            return {
+                ok: false,
+                detail: errors
+                    .slice(0, 20)
+                    .map((error) => error.message)
+                    .join("; ") || "Structure document does not satisfy compatibility schema version 1.",
+            };
+        }
+        return {
+            ok: true,
+            admitted: {
+                application,
+                scopes: value.scopes.map((scope) => ({
+                    name: scope.name,
+                    relativePath: scope.root,
+                    kind: scope.kind,
+                    mode: scope.mode,
+                    allowEmpty: scope.allowEmpty ?? false,
+                    ...(scope.required === undefined ? {} : { required: scope.required }),
+                    ...(scope.allowed === undefined ? {} : { allowed: scope.allowed }),
+                    ...(scope.forbidden === undefined ? {} : { forbidden: scope.forbidden }),
+                    bindingPath: ".",
+                })),
+            },
+        };
+    }
     if (!structureValidator.Check(value)) {
         const [, errors] = structureValidator.Errors(value);
         return {
@@ -40,10 +70,23 @@ export function admitStructureDocument(value, application) {
                 detail: `Structure scope "${scope.name}" resolves beyond the maximum repository path length.`,
             };
         }
-        scopes.push({ ...scope, allowEmpty: scope.allowEmpty ?? false, bindingPath: binding.path });
+        scopes.push({
+            name: scope.name,
+            relativePath: scope.relativePath,
+            kind: scope.kind,
+            mode: scope.mode,
+            allowEmpty: scope.allowEmpty ?? false,
+            ...(scope.required === undefined ? {} : { required: scope.required }),
+            ...(scope.allowed === undefined ? {} : { allowed: scope.allowed }),
+            ...(scope.forbidden === undefined ? {} : { forbidden: scope.forbidden }),
+            bindingPath: binding.path,
+        });
     }
     return { ok: true, admitted: { application, scopes } };
 }
+function isCompatibilityStructureApplication(application) {
+    return "baseline" in application;
+}
 /** Derives ancestors and direct children while pruning tracked non-file descendants. */
 export function makeStructureUniverse(inventory) {
     const trackedNonFilePaths = new Set(inventory.trackedNonFilePaths);