@habitat-ai/service 0.2.0 → 0.2.2

package/dist/service/modules/catalog/router/catalog.router.js

@@ -1,16 +1,15 @@
 import { MAX_SOURCE_INVENTORY_ENTRIES } from "@habitat-ai/resource-source-inventory";
 import { Effect } from "effect";
 import { parse as parseToml } from "smol-toml";
-import { admitBlueprintSource, admitCompatibilityIndex, admitCompatibilityRule, admitInstanceSource, admitPolicyPackManifest, admitPolicyPackPackageJson, admitPolicyPackSelection, referencedRepositoryPaths, rejected, resolveCatalog, } from "../model/policy/catalog.js";
-import { completedCheck, evaluatedApplication, evaluatedStructureApplication, extractGritProgram, failedApplication, failedStructureApplication, selectCheckApplications, } from "../model/policy/check.js";
+import { admitBlueprintSource, admitCompatibilityBaseline, admitCompatibilityIndex, admitCompatibilityRule, admitInstanceSource, admitPolicyPackManifest, admitPolicyPackPackageJson, admitPolicyPackSelection, referencedRepositoryPaths, rejected, resolveCatalog, } from "../model/policy/catalog.js";
+import { completedCheck, evaluatedApplication, evaluatedStructureApplication, extractGritProgram, failedApplication, failedStructureApplication, isCompatibilityRule, notApplicableApplication, selectCheckApplications, } from "../model/policy/check.js";
 import { admitStructureDocument, evaluateStructurePlan, isHabitatStructureApplication, makeStructureUniverse, planStructureEvaluation, structureChildObservationPaths, } from "../model/policy/structure.js";
 import { module } from "../module.js";
 const authorityGlobs = [
     { kind: "blueprint", pattern: ".habitat/blueprints/*/blueprint.toml" },
-    // Effect's glob provider requires a dynamic pattern even for this exact optional file.
-    { kind: "index", pattern: ".habitat/{index.json}" },
     { kind: "rule", pattern: ".habitat/**/rule.json" },
 ];
+const compatibilityIndexAuthorityPath = ".habitat/index.json";
 const excludedDirectorySegments = new Set([
     ".git",
     ".nx",
@@ -23,6 +22,13 @@ const excludedDirectorySegments = new Set([
     "vendor",
 ]);
 const excludedRepositoryGlobs = [...excludedDirectorySegments].map((segment) => `**/${segment}/**`);
+const compatibilityProtectedRoots = [
+    ".git",
+    ".habitat/cache/patterns",
+    "dist",
+    "node_modules",
+    "tools/habitat/dist",
+];
 const MAX_MANIFEST_DIRECTORIES = 50_000;
 function resolveCurrentCatalog(context) {
     return Effect.gen(function* () {
@@ -119,6 +125,13 @@ function resolveCurrentCatalog(context) {
                 pathsByKind[kind].push(relativePath);
             }
         }
+        const compatibilityIndexStat = yield* Effect.result(fileSystem.stat(path.resolve(workspaceRoot, compatibilityIndexAuthorityPath)));
+        if (compatibilityIndexStat._tag === "Success") {
+            pathsByKind.index.push(compatibilityIndexAuthorityPath);
+        }
+        else if (!isNotFound(compatibilityIndexStat.failure)) {
+            enumerationIssues.push(filesystemIssue(compatibilityIndexStat.failure, compatibilityIndexAuthorityPath, "inspect compatibility index", "Compatibility index does not exist."));
+        }
         // The installed glob provider skips hidden directories, so manifests use a confined traversal.
         const manifestCandidates = [];
         const pendingDirectories = [{ relativePath: "", realPath: workspaceRealRoot }];
@@ -333,10 +346,69 @@ function resolveCurrentCatalog(context) {
                 continue;
             }
             const admitted = admitCompatibilityRule(parsed.success, relativePath);
-            if (admitted.ok)
-                compatibilityRules.push(admitted.source);
-            else
+            if (!admitted.ok) {
                 issues.push(...admitted.issues);
+                continue;
+            }
+            const baselinePath = admitted.source.rule.supportFiles.baseline;
+            const absoluteBaselinePath = path.resolve(workspaceRoot, baselinePath);
+            if (!isContained(workspaceRoot, absoluteBaselinePath, path)) {
+                issues.push({
+                    code: "authority-path-escape",
+                    path: baselinePath,
+                    message: "Compatibility baseline escapes workspaceRoot.",
+                });
+                continue;
+            }
+            const baselineRealPath = yield* Effect.result(fileSystem.realPath(absoluteBaselinePath));
+            if (baselineRealPath._tag === "Failure") {
+                issues.push(filesystemIssue(baselineRealPath.failure, baselinePath, "resolve compatibility baseline", "Compatibility baseline does not exist."));
+                continue;
+            }
+            if (!isContained(workspaceRealRoot, baselineRealPath.success, path)) {
+                issues.push({
+                    code: "authority-path-escape",
+                    path: baselinePath,
+                    message: "Compatibility baseline escapes workspaceRoot through a symbolic link.",
+                });
+                continue;
+            }
+            const baselineStat = yield* Effect.result(fileSystem.stat(baselineRealPath.success));
+            if (baselineStat._tag === "Failure") {
+                issues.push(filesystemIssue(baselineStat.failure, baselinePath, "inspect compatibility baseline", "Compatibility baseline does not exist."));
+                continue;
+            }
+            if (baselineStat.success.type !== "File") {
+                issues.push({
+                    code: "authority-path-kind-mismatch",
+                    path: baselinePath,
+                    message: "Compatibility baseline must be a regular file.",
+                });
+                continue;
+            }
+            const baselineRead = yield* Effect.result(fileSystem.readFileString(baselineRealPath.success));
+            if (baselineRead._tag === "Failure") {
+                issues.push(filesystemIssue(baselineRead.failure, baselinePath, "read compatibility baseline", "Compatibility baseline does not exist."));
+                continue;
+            }
+            const baselineParsed = yield* Effect.result(Effect.try({
+                try: () => JSON.parse(baselineRead.success),
+                catch: (cause) => cause,
+            }));
+            if (baselineParsed._tag === "Failure") {
+                issues.push({
+                    code: "authority-json-invalid",
+                    path: baselinePath,
+                    message: "Compatibility baseline is not valid JSON.",
+                });
+                continue;
+            }
+            const baseline = admitCompatibilityBaseline(baselineParsed.success, baselinePath);
+            if (!baseline.ok) {
+                issues.push(...baseline.issues);
+                continue;
+            }
+            compatibilityRules.push({ ...admitted.source, baseline: baseline.value });
         }
         if (issues.length > 0)
             return rejected(issues);
@@ -572,7 +644,19 @@ const check = module.check.effect(function* ({ context, input }) {
             reports.push(failedApplication(application, "PatternInvalid", program.detail));
             continue;
         }
-        const subjects = resolvedSubjects(application, context.workspaceRoot, context.path);
+        const subjectPreparation = yield* prepareGritSubjects(application, context.workspaceRoot, context.fileSystem, context.path);
+        if (subjectPreparation.kind === "failed") {
+            reports.push(failedApplication(application, "SetupFailed", subjectPreparation.detail));
+            continue;
+        }
+        if (subjectPreparation.kind === "not-applicable") {
+            if (!isCompatibilityRule(application)) {
+                return yield* Effect.die(new Error("Version-three Grit applications cannot be not applicable."));
+            }
+            reports.push(notApplicableApplication(application));
+            continue;
+        }
+        const subjects = subjectPreparation.subjects;
         const evaluation = yield* Effect.result(context.ruleEvaluation.evaluate({
             program: program.program,
             subjectPaths: subjects.map((subject) => subject.absolutePath),
@@ -623,6 +707,113 @@ function hasExactCauseCode(error, code) {
     const cause = "cause" in error.reason ? error.reason.cause : undefined;
     return typeof cause === "object" && cause !== null && "code" in cause && cause.code === code;
 }
+function prepareGritSubjects(application, workspaceRoot, fileSystem, path) {
+    if (!isCompatibilityRule(application)) {
+        return Effect.succeed({
+            kind: "ready",
+            subjects: resolvedSubjects(application, workspaceRoot, path),
+        });
+    }
+    return Effect.gen(function* () {
+        const workspaceRealPath = yield* Effect.result(fileSystem.realPath(workspaceRoot));
+        if (workspaceRealPath._tag === "Failure") {
+            return {
+                kind: "failed",
+                detail: "Unable to canonicalize the compatibility workspace root.",
+            };
+        }
+        const authority = resolvedSubjects(application, workspaceRoot, path);
+        for (const root of authority) {
+            const canonical = yield* Effect.result(fileSystem.realPath(root.absolutePath));
+            if (canonical._tag === "Failure") {
+                return {
+                    kind: "failed",
+                    detail: `Unable to canonicalize compatibility acquisition root "${toRepositoryPath(path.relative(workspaceRoot, root.absolutePath), path.sep)}".`,
+                };
+            }
+            const expectedCanonical = path.resolve(workspaceRealPath.success, path.relative(workspaceRoot, root.absolutePath));
+            if (canonical.success !== expectedCanonical ||
+                !isContained(workspaceRealPath.success, canonical.success, path)) {
+                return {
+                    kind: "failed",
+                    detail: `Compatibility acquisition root "${toRepositoryPath(path.relative(workspaceRoot, root.absolutePath), path.sep)}" is a symbolic link; compatibility checks accept direct workspace roots only.`,
+                };
+            }
+        }
+        const resolvedCoveragePatterns = application.coveragePatterns.map((pattern) => path.resolve(workspaceRoot, pattern));
+        const compatibilityExcludes = [path.resolve(workspaceRoot, "**/node_modules/**")];
+        const globAttempts = yield* Effect.all(resolvedCoveragePatterns.map((pattern) => Effect.result(fileSystem.glob(pattern, { exclude: compatibilityExcludes }))));
+        const failedGlob = globAttempts.find((attempt) => attempt._tag === "Failure");
+        if (failedGlob?._tag === "Failure") {
+            return {
+                kind: "failed",
+                detail: "Unable to enumerate compatibility exact-path coverage.",
+            };
+        }
+        const directAttempts = yield* Effect.all(resolvedCoveragePatterns.map((pattern) => Effect.result(fileSystem.stat(pattern))));
+        const failedDirect = directAttempts.find((attempt) => attempt._tag === "Failure" && !isNotFound(attempt.failure));
+        if (failedDirect?._tag === "Failure") {
+            return {
+                kind: "failed",
+                detail: "Unable to inspect compatibility exact-path coverage.",
+            };
+        }
+        const candidates = stablePaths([
+            ...globAttempts.flatMap((attempt) => attempt._tag === "Success"
+                ? attempt.success.map((candidate) => path.isAbsolute(candidate)
+                    ? path.resolve(candidate)
+                    : path.resolve(workspaceRoot, candidate))
+                : []),
+            ...directAttempts.flatMap((attempt, index) => attempt._tag === "Success" && attempt.success.type === "File"
+                ? [resolvedCoveragePatterns[index]]
+                : []),
+        ].filter((candidate) => candidate !== undefined)).filter((candidate) => !isCompatibilityProtectedSubject(candidate, workspaceRoot, path) &&
+            authority.some((root) => root.kind === "file"
+                ? candidate === root.absolutePath
+                : isContained(root.absolutePath, candidate, path)));
+        const subjects = [];
+        for (const candidate of candidates) {
+            const canonical = yield* Effect.result(fileSystem.realPath(candidate));
+            if (canonical._tag === "Failure") {
+                if (isNotFound(canonical.failure))
+                    continue;
+                return {
+                    kind: "failed",
+                    detail: `Unable to canonicalize compatibility subject "${toRepositoryPath(path.relative(workspaceRoot, candidate), path.sep)}".`,
+                };
+            }
+            const expectedCanonical = path.resolve(workspaceRealPath.success, path.relative(workspaceRoot, candidate));
+            if (canonical.success !== expectedCanonical ||
+                !isContained(workspaceRealPath.success, canonical.success, path)) {
+                return {
+                    kind: "failed",
+                    detail: `Exact coverage selected symbolic link "${toRepositoryPath(path.relative(workspaceRoot, candidate), path.sep)}"; compatibility checks accept regular files only.`,
+                };
+            }
+            const stat = yield* Effect.result(fileSystem.stat(canonical.success));
+            if (stat._tag === "Failure") {
+                if (isNotFound(stat.failure))
+                    continue;
+                return {
+                    kind: "failed",
+                    detail: `Unable to inspect compatibility subject "${toRepositoryPath(path.relative(workspaceRoot, candidate), path.sep)}".`,
+                };
+            }
+            if (stat.success.type === "File") {
+                subjects.push({ absolutePath: candidate, kind: "file" });
+            }
+        }
+        return subjects.length === 0
+            ? { kind: "not-applicable" }
+            : { kind: "ready", subjects };
+    });
+}
+function isCompatibilityProtectedSubject(candidate, workspaceRoot, path) {
+    const relative = toRepositoryPath(path.relative(workspaceRoot, candidate), path.sep);
+    if (relative.split("/").includes("node_modules"))
+        return true;
+    return compatibilityProtectedRoots.some((root) => relative === root || relative.startsWith(`${root}/`));
+}
 function resolvedSubjects(application, workspaceRoot, path) {
     const subjects = new Map();
     for (const entry of application.runner.acquisition.entries) {

package/dist/service/modules/catalog/router.d.ts

@@ -157,9 +157,59 @@ export declare const router: {
                 schemaVersion: import("typebox").TLiteral<2>;
                 ownerRoots: import("typebox").TRecord<"^.*$", import("typebox").TString>;
                 rules: import("typebox").TArray<import("typebox").TObject<{
-                    id: import("typebox").TString;
+                    ruleId: import("typebox").TString;
                     ownerProject: import("typebox").TString;
                     manifestPath: import("typebox").TString;
+                    lane: import("typebox").TLiteral<"enforced">;
+                    message: import("typebox").TString;
+                    remediate: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
+                    provenance: import("typebox").TObject<{
+                        kind: import("typebox").TLiteral<"local">;
+                        authorityRoot: import("typebox").TString;
+                        relativePath: import("typebox").TString;
+                    }>;
+                    coveragePatterns: import("typebox").TArray<import("typebox").TString>;
+                    baseline: import("typebox").TObject<{
+                        provenance: import("typebox").TObject<{
+                            kind: import("typebox").TLiteral<"local">;
+                            authorityRoot: import("typebox").TString;
+                            relativePath: import("typebox").TString;
+                        }>;
+                        relativePath: import("typebox").TString;
+                        absolutePath: import("typebox").TString;
+                    }>;
+                    runner: import("typebox").TUnion<[import("typebox").TObject<{
+                        name: import("typebox").TLiteral<"habitat">;
+                        mode: import("typebox").TLiteral<"structure">;
+                        structure: import("typebox").TObject<{
+                            provenance: import("typebox").TObject<{
+                                kind: import("typebox").TLiteral<"local">;
+                                authorityRoot: import("typebox").TString;
+                                relativePath: import("typebox").TString;
+                            }>;
+                            relativePath: import("typebox").TString;
+                            absolutePath: import("typebox").TString;
+                        }>;
+                    }>, import("typebox").TObject<{
+                        name: import("typebox").TLiteral<"grit">;
+                        pattern: import("typebox").TObject<{
+                            provenance: import("typebox").TObject<{
+                                kind: import("typebox").TLiteral<"local">;
+                                authorityRoot: import("typebox").TString;
+                                relativePath: import("typebox").TString;
+                            }>;
+                            relativePath: import("typebox").TString;
+                            absolutePath: import("typebox").TString;
+                        }>;
+                        patternName: import("typebox").TString;
+                        acquisition: import("typebox").TObject<{
+                            kind: import("typebox").TLiteral<"check">;
+                            entries: import("typebox").TArray<import("typebox").TObject<{
+                                kind: import("typebox").TUnion<[import("typebox").TLiteral<"directory">, import("typebox").TLiteral<"file">]>;
+                                path: import("typebox").TString;
+                            }>>;
+                        }>;
+                    }>]>;
                 }>>;
             }>;
         }>;
@@ -236,6 +286,42 @@ export declare const router: {
                 severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
                 baselined: import("typebox").TLiteral<false>;
             }>>;
+        }>, import("typebox").TObject<{
+            ownerProject: import("typebox").TString;
+            instanceId: import("typebox").TNull;
+            ruleId: import("typebox").TString;
+            runner: import("typebox").TLiteral<"grit">;
+            lane: import("typebox").TUnion<[import("typebox").TLiteral<"enforced">, import("typebox").TLiteral<"advisory">]>;
+            locked: import("typebox").TLiteral<true>;
+            status: import("typebox").TUnion<[import("typebox").TLiteral<"pass">, import("typebox").TLiteral<"fail">, import("typebox").TLiteral<"advisory-findings">, import("typebox").TLiteral<"error">]>;
+            message: import("typebox").TString;
+            remediate: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
+            disposition: import("typebox").TUnion<[import("typebox").TObject<{
+                kind: import("typebox").TLiteral<"evaluated">;
+            }>, import("typebox").TObject<{
+                kind: import("typebox").TLiteral<"not-applicable">;
+                reason: import("typebox").TLiteral<"no-matched-acquisition-roots">;
+            }>, import("typebox").TObject<{
+                kind: import("typebox").TLiteral<"failed">;
+                reason: import("typebox").TUnion<[import("typebox").TUnion<[import("typebox").TLiteral<"InvalidInput">, import("typebox").TLiteral<"SetupFailed">, import("typebox").TLiteral<"ExecutionFailed">, import("typebox").TLiteral<"TimedOut">, import("typebox").TLiteral<"InvalidOutput">]>, import("typebox").TLiteral<"PatternReadFailed">, import("typebox").TLiteral<"PatternInvalid">, import("typebox").TLiteral<"FindingPathInvalid">]>;
+                detail: import("typebox").TString;
+            }>]>;
+            findings: import("typebox").TArray<import("typebox").TObject<{
+                path: import("typebox").TString;
+                start: import("typebox").TObject<{
+                    line: import("typebox").TReadonly<import("typebox").TInteger>;
+                    column: import("typebox").TReadonly<import("typebox").TInteger>;
+                    offset: import("typebox").TReadonly<import("typebox").TInteger>;
+                }>;
+                end: import("typebox").TObject<{
+                    line: import("typebox").TReadonly<import("typebox").TInteger>;
+                    column: import("typebox").TReadonly<import("typebox").TInteger>;
+                    offset: import("typebox").TReadonly<import("typebox").TInteger>;
+                }>;
+                message: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
+                severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
+                baselined: import("typebox").TLiteral<false>;
+            }>>;
         }>, import("typebox").TObject<{
             ownerProject: import("typebox").TString;
             instanceId: import("typebox").TString;
@@ -260,6 +346,30 @@ export declare const router: {
                 severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
                 baselined: import("typebox").TLiteral<false>;
             }>>;
+        }>, import("typebox").TObject<{
+            ownerProject: import("typebox").TString;
+            instanceId: import("typebox").TNull;
+            ruleId: import("typebox").TString;
+            runner: import("typebox").TLiteral<"habitat">;
+            lane: import("typebox").TUnion<[import("typebox").TLiteral<"enforced">, import("typebox").TLiteral<"advisory">]>;
+            locked: import("typebox").TLiteral<true>;
+            status: import("typebox").TUnion<[import("typebox").TLiteral<"pass">, import("typebox").TLiteral<"fail">, import("typebox").TLiteral<"advisory-findings">, import("typebox").TLiteral<"error">]>;
+            message: import("typebox").TString;
+            remediate: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
+            disposition: import("typebox").TUnion<[import("typebox").TObject<{
+                kind: import("typebox").TLiteral<"evaluated">;
+            }>, import("typebox").TObject<{
+                kind: import("typebox").TLiteral<"failed">;
+                reason: import("typebox").TUnion<[import("typebox").TLiteral<"StructureReadFailed">, import("typebox").TLiteral<"StructureInvalid">, import("typebox").TLiteral<"InventoryFailed">, import("typebox").TLiteral<"StructureObservationFailed">]>;
+                detail: import("typebox").TString;
+            }>]>;
+            findings: import("typebox").TArray<import("typebox").TObject<{
+                path: import("typebox").TString;
+                code: import("typebox").TUnion<[import("typebox").TLiteral<"root-missing">, import("typebox").TLiteral<"wrong-root-kind">, import("typebox").TLiteral<"missing-required-child">, import("typebox").TLiteral<"forbidden-child">, import("typebox").TLiteral<"unexpected-child">]>;
+                message: import("typebox").TString;
+                severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
+                baselined: import("typebox").TLiteral<false>;
+            }>>;
         }>]>>;
     }>]>>, object>;
 };

package/dist/service/router.d.ts

@@ -158,9 +158,59 @@ export declare const router: {
                     schemaVersion: import("typebox").TLiteral<2>;
                     ownerRoots: import("typebox").TRecord<"^.*$", import("typebox").TString>;
                     rules: import("typebox").TArray<import("typebox").TObject<{
-                        id: import("typebox").TString;
+                        ruleId: import("typebox").TString;
                         ownerProject: import("typebox").TString;
                         manifestPath: import("typebox").TString;
+                        lane: import("typebox").TLiteral<"enforced">;
+                        message: import("typebox").TString;
+                        remediate: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
+                        provenance: import("typebox").TObject<{
+                            kind: import("typebox").TLiteral<"local">;
+                            authorityRoot: import("typebox").TString;
+                            relativePath: import("typebox").TString;
+                        }>;
+                        coveragePatterns: import("typebox").TArray<import("typebox").TString>;
+                        baseline: import("typebox").TObject<{
+                            provenance: import("typebox").TObject<{
+                                kind: import("typebox").TLiteral<"local">;
+                                authorityRoot: import("typebox").TString;
+                                relativePath: import("typebox").TString;
+                            }>;
+                            relativePath: import("typebox").TString;
+                            absolutePath: import("typebox").TString;
+                        }>;
+                        runner: import("typebox").TUnion<[import("typebox").TObject<{
+                            name: import("typebox").TLiteral<"habitat">;
+                            mode: import("typebox").TLiteral<"structure">;
+                            structure: import("typebox").TObject<{
+                                provenance: import("typebox").TObject<{
+                                    kind: import("typebox").TLiteral<"local">;
+                                    authorityRoot: import("typebox").TString;
+                                    relativePath: import("typebox").TString;
+                                }>;
+                                relativePath: import("typebox").TString;
+                                absolutePath: import("typebox").TString;
+                            }>;
+                        }>, import("typebox").TObject<{
+                            name: import("typebox").TLiteral<"grit">;
+                            pattern: import("typebox").TObject<{
+                                provenance: import("typebox").TObject<{
+                                    kind: import("typebox").TLiteral<"local">;
+                                    authorityRoot: import("typebox").TString;
+                                    relativePath: import("typebox").TString;
+                                }>;
+                                relativePath: import("typebox").TString;
+                                absolutePath: import("typebox").TString;
+                            }>;
+                            patternName: import("typebox").TString;
+                            acquisition: import("typebox").TObject<{
+                                kind: import("typebox").TLiteral<"check">;
+                                entries: import("typebox").TArray<import("typebox").TObject<{
+                                    kind: import("typebox").TUnion<[import("typebox").TLiteral<"directory">, import("typebox").TLiteral<"file">]>;
+                                    path: import("typebox").TString;
+                                }>>;
+                            }>;
+                        }>]>;
                     }>>;
                 }>;
             }>;
@@ -237,6 +287,42 @@ export declare const router: {
                     severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
                     baselined: import("typebox").TLiteral<false>;
                 }>>;
+            }>, import("typebox").TObject<{
+                ownerProject: import("typebox").TString;
+                instanceId: import("typebox").TNull;
+                ruleId: import("typebox").TString;
+                runner: import("typebox").TLiteral<"grit">;
+                lane: import("typebox").TUnion<[import("typebox").TLiteral<"enforced">, import("typebox").TLiteral<"advisory">]>;
+                locked: import("typebox").TLiteral<true>;
+                status: import("typebox").TUnion<[import("typebox").TLiteral<"pass">, import("typebox").TLiteral<"fail">, import("typebox").TLiteral<"advisory-findings">, import("typebox").TLiteral<"error">]>;
+                message: import("typebox").TString;
+                remediate: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
+                disposition: import("typebox").TUnion<[import("typebox").TObject<{
+                    kind: import("typebox").TLiteral<"evaluated">;
+                }>, import("typebox").TObject<{
+                    kind: import("typebox").TLiteral<"not-applicable">;
+                    reason: import("typebox").TLiteral<"no-matched-acquisition-roots">;
+                }>, import("typebox").TObject<{
+                    kind: import("typebox").TLiteral<"failed">;
+                    reason: import("typebox").TUnion<[import("typebox").TUnion<[import("typebox").TLiteral<"InvalidInput">, import("typebox").TLiteral<"SetupFailed">, import("typebox").TLiteral<"ExecutionFailed">, import("typebox").TLiteral<"TimedOut">, import("typebox").TLiteral<"InvalidOutput">]>, import("typebox").TLiteral<"PatternReadFailed">, import("typebox").TLiteral<"PatternInvalid">, import("typebox").TLiteral<"FindingPathInvalid">]>;
+                    detail: import("typebox").TString;
+                }>]>;
+                findings: import("typebox").TArray<import("typebox").TObject<{
+                    path: import("typebox").TString;
+                    start: import("typebox").TObject<{
+                        line: import("typebox").TReadonly<import("typebox").TInteger>;
+                        column: import("typebox").TReadonly<import("typebox").TInteger>;
+                        offset: import("typebox").TReadonly<import("typebox").TInteger>;
+                    }>;
+                    end: import("typebox").TObject<{
+                        line: import("typebox").TReadonly<import("typebox").TInteger>;
+                        column: import("typebox").TReadonly<import("typebox").TInteger>;
+                        offset: import("typebox").TReadonly<import("typebox").TInteger>;
+                    }>;
+                    message: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
+                    severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
+                    baselined: import("typebox").TLiteral<false>;
+                }>>;
             }>, import("typebox").TObject<{
                 ownerProject: import("typebox").TString;
                 instanceId: import("typebox").TString;
@@ -261,6 +347,30 @@ export declare const router: {
                     severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
                     baselined: import("typebox").TLiteral<false>;
                 }>>;
+            }>, import("typebox").TObject<{
+                ownerProject: import("typebox").TString;
+                instanceId: import("typebox").TNull;
+                ruleId: import("typebox").TString;
+                runner: import("typebox").TLiteral<"habitat">;
+                lane: import("typebox").TUnion<[import("typebox").TLiteral<"enforced">, import("typebox").TLiteral<"advisory">]>;
+                locked: import("typebox").TLiteral<true>;
+                status: import("typebox").TUnion<[import("typebox").TLiteral<"pass">, import("typebox").TLiteral<"fail">, import("typebox").TLiteral<"advisory-findings">, import("typebox").TLiteral<"error">]>;
+                message: import("typebox").TString;
+                remediate: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
+                disposition: import("typebox").TUnion<[import("typebox").TObject<{
+                    kind: import("typebox").TLiteral<"evaluated">;
+                }>, import("typebox").TObject<{
+                    kind: import("typebox").TLiteral<"failed">;
+                    reason: import("typebox").TUnion<[import("typebox").TLiteral<"StructureReadFailed">, import("typebox").TLiteral<"StructureInvalid">, import("typebox").TLiteral<"InventoryFailed">, import("typebox").TLiteral<"StructureObservationFailed">]>;
+                    detail: import("typebox").TString;
+                }>]>;
+                findings: import("typebox").TArray<import("typebox").TObject<{
+                    path: import("typebox").TString;
+                    code: import("typebox").TUnion<[import("typebox").TLiteral<"root-missing">, import("typebox").TLiteral<"wrong-root-kind">, import("typebox").TLiteral<"missing-required-child">, import("typebox").TLiteral<"forbidden-child">, import("typebox").TLiteral<"unexpected-child">]>;
+                    message: import("typebox").TString;
+                    severity: import("typebox").TUnion<[import("typebox").TLiteral<"error">, import("typebox").TLiteral<"advisory">]>;
+                    baselined: import("typebox").TLiteral<false>;
+                }>>;
             }>]>>;
         }>]>>, object>;
     };

package/package.json

@@ -1,7 +1,12 @@
 {
   "name": "@habitat-ai/service",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "private": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rawr-ai/rawr-hq-template.git",
+    "directory": "services/habitat"
+  },
   "type": "module",
   "packageManager": "bun@1.3.14",
   "files": [
@@ -19,13 +24,13 @@
     "test": "bun test test"
   },
   "dependencies": {
-    "@habitat-ai/resource-rule-evaluation": "0.2.0",
-    "@habitat-ai/resource-source-inventory": "0.2.0",
+    "@habitat-ai/resource-rule-evaluation": "0.2.2",
+    "@habitat-ai/resource-source-inventory": "0.2.2",
     "@opentelemetry/api": "^1.9.0",
     "@orpc/contract": "2.0.0-beta.20",
     "@orpc/experimental-effect": "2.0.0-beta.20",
     "@orpc/server": "2.0.0-beta.20",
-    "@habitat-ai/typebox-adapter": "0.1.0",
+    "@habitat-ai/typebox-adapter": "0.1.1",
     "effect": "4.0.0-beta.101",
     "picomatch": "4.0.4",
     "smol-toml": "1.7.0",