bootproof 0.3.0 → 0.4.0

package/dist/infer.js

@@ -42,6 +42,12 @@ const REPO_COMPOSE_FILES = [
     "docker/docker-compose.yml",
     "docker/docker-compose.yaml",
 ];
+const VITE_CONFIG_FILES = [
+    "vite.config.js",
+    "vite.config.ts",
+    "vite.config.mjs",
+    "vite.config.cjs",
+];
 function detectRepoComposeFile(repo) {
     return REPO_COMPOSE_FILES.find(file => exists(repo, file)) ?? null;
 }
@@ -192,6 +198,45 @@ function pickAppCommand(pkg, pm) {
     }
     return { command: null, source: "no dev/start/serve/preview script found", script: null };
 }
+function shellSegmentExecutable(segment) {
+    let remaining = segment.trim();
+    while (/^[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|[^\s]+)\s+/.test(remaining)) {
+        remaining = remaining.replace(/^[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|[^\s]+)\s+/, "");
+    }
+    return remaining.match(/^([A-Za-z0-9_.-]+)/)?.[1] ?? null;
+}
+function projectCliFromScript(scriptCommand, packageManager) {
+    const standardCommands = new Set([
+        "npm", "pnpm", "yarn", "bun", "node", "npx", "corepack",
+        "go", "ruby", "bundle", "make", "python", "python3", "php", "composer",
+        "cd", "echo", "env", "export", "sh", "bash", "true", "false", "test",
+    ]);
+    if (packageManager !== "unknown")
+        standardCommands.add(packageManager);
+    for (const segment of scriptCommand.split(/\s*(?:&&|\|\||;)\s*/)) {
+        const executable = shellSegmentExecutable(segment);
+        if (executable && !standardCommands.has(executable))
+            return executable;
+    }
+    return null;
+}
+function executableAvailable(repo, executable) {
+    const localBin = path.join(repo, "node_modules", ".bin", executable);
+    if (exists(repo, path.relative(repo, localBin)))
+        return true;
+    const extensions = process.platform === "win32"
+        ? (process.env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";")
+        : [""];
+    for (const directory of (process.env.PATH ?? "").split(path.delimiter).filter(Boolean)) {
+        for (const extension of extensions) {
+            if (fs.existsSync(path.join(directory, `${executable}${extension.toLowerCase()}`))
+                || fs.existsSync(path.join(directory, `${executable}${extension.toUpperCase()}`))) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
 function detectNestedFrontend(repo) {
     const preferred = ["superset-frontend", "frontend", "web", "ui", "client"];
     for (const dir of preferred) {
@@ -233,6 +278,52 @@ function detectGoEntrypoint(repo) {
         portFlag: /(?:Int|IntVar)\(\s*["']port["']/m.test(sourceText),
     };
 }
+function detectGoService(repo) {
+    if (!exists(repo, "go.mod")) {
+        return {
+            ollamaLike: false,
+            command: null,
+            commandSource: null,
+            port: null,
+            healthCandidates: [],
+            markers: [],
+        };
+    }
+    const moduleFile = readText(repo, "go.mod");
+    const mainFile = readText(repo, "main.go");
+    const commandFile = readText(repo, "cmd/cmd.go");
+    const routesFile = readText(repo, "server/routes.go");
+    const envConfigFile = readText(repo, "envconfig/config.go");
+    const evidence = [moduleFile, mainFile, commandFile, routesFile, envConfigFile].join("\n");
+    const exactModule = /^module\s+github\.com\/ollama\/ollama\s*$/m.test(moduleFile);
+    const ollamaModule = /^module\s+\S*ollama(?:\/\S*)?\s*$/mi.test(moduleFile);
+    const markers = [
+        exactModule || ollamaModule ? "ollama module" : null,
+        /\bOLLAMA_HOST\b/.test(evidence) ? "OLLAMA_HOST" : null,
+        /\b11434\b/.test(evidence) ? "port 11434" : null,
+        /["'`]\/api\/tags["'`]/.test(evidence) ? "/api/tags" : null,
+        /\bUse:\s*["']serve["']|\bollama serve\b/i.test(evidence) ? "serve command" : null,
+    ].filter((marker) => marker !== null);
+    const hasRootEntrypoint = exists(repo, "main.go");
+    const hasServeEvidence = markers.includes("serve command");
+    const strongOllamaEvidence = exactModule || markers.length >= 3;
+    const ollamaLike = hasRootEntrypoint && hasServeEvidence && strongOllamaEvidence;
+    return {
+        ollamaLike,
+        command: ollamaLike ? "go run . serve" : null,
+        commandSource: ollamaLike ? "Ollama Go service entrypoint: main.go + serve command" : null,
+        port: ollamaLike ? 11434 : null,
+        healthCandidates: ollamaLike
+            ? [
+                "http://127.0.0.1:11434/",
+                "http://localhost:11434/",
+                "http://127.0.0.1:11434/api/tags",
+                "http://localhost:11434/api/tags",
+            ]
+            : [],
+        markers,
+    };
+}
 function detectRubyCommand(repo) {
     if (!exists(repo, "Gemfile") || !exists(repo, "bin/rails"))
         return null;
@@ -244,12 +335,13 @@ function detectArchitecture(repo, pkg, nestedFrontend, repoComposeFile) {
     const setupPy = readText(repo, "setup.py");
     const requirements = readText(repo, "requirements.txt");
     const compose = repoComposeFile ? readText(repo, repoComposeFile) : "";
+    const composer = readJson(path.join(repo, "composer.json"));
     const rootDeps = { ...(pkg?.dependencies ?? {}), ...(pkg?.devDependencies ?? {}) };
     const nestedDeps = { ...(nestedFrontend?.pkg?.dependencies ?? {}), ...(nestedFrontend?.pkg?.devDependencies ?? {}) };
-    const backendMarkers = present(repo, ["pyproject.toml", "setup.py", "requirements.txt", "manage.py", "go.mod", "go.work", "Gemfile", "config/database.yml", "Makefile", "superset/app.py", "superset/config.py"]);
+    const backendMarkers = present(repo, ["pyproject.toml", "setup.py", "requirements.txt", "manage.py", "go.mod", "go.work", "Gemfile", "config/database.yml", "Makefile", "superset/app.py", "superset/config.py", "artisan", "composer.json"]);
     if (isDirectory(repo, "pkg"))
         backendMarkers.push("pkg/");
-    const frontendMarkers = present(repo, ["package.json", "yarn.lock", "pnpm-lock.yaml", "nx.json"]);
+    const frontendMarkers = present(repo, ["package.json", "yarn.lock", "pnpm-lock.yaml", "nx.json", ...VITE_CONFIG_FILES]);
     if (isDirectory(repo, "public"))
         frontendMarkers.push("public/");
     if (isDirectory(repo, "packages"))
@@ -261,18 +353,50 @@ function detectArchitecture(repo, pkg, nestedFrontend, repoComposeFile) {
         (exists(repo, "superset/app.py") || exists(repo, "superset/config.py") || /\bflask\b/i.test(pyproject + setupPy + makefile));
     const hasFlask = hasFlaskBackend && (/\bflask\b/i.test(pyproject + setupPy + makefile) || exists(repo, "superset/app.py"));
     const hasDjango = exists(repo, "manage.py") && /\bdjango\b/i.test(pyproject + requirements);
-    const hasPythonBackend = hasFlaskBackend || hasDjango;
+    const hasLargePythonNodeHybrid = exists(repo, "pyproject.toml")
+        && exists(repo, "Makefile")
+        && exists(repo, "package.json")
+        && exists(repo, "pnpm-lock.yaml");
+    const hasPythonBackend = hasFlaskBackend || hasDjango || hasLargePythonNodeHybrid;
     const hasGoBackend = exists(repo, "go.mod") || exists(repo, "go.work");
     const hasRubyBackend = exists(repo, "Gemfile");
+    const hasLaravel = exists(repo, "artisan") && Boolean(composer);
+    const hasPhpBackend = hasLaravel;
+    const viteConfig = VITE_CONFIG_FILES.find(file => exists(repo, file)) ?? null;
+    const hasLaravelViteFrontend = hasLaravel && Boolean(pkg) && Boolean(viteConfig);
     const makeCommand = detectMakeCommand(repo, makefile);
     const goEntrypoint = detectGoEntrypoint(repo);
+    const goService = detectGoService(repo);
     const rubyCommand = detectRubyCommand(repo);
     const hasMakeDrivenBackend = Boolean(makefile && /^[A-Za-z0-9_.-]+:\s*(?:[^=]|$)/m.test(makefile));
-    const hasNodeFrontend = Boolean(pkg) && (isDirectory(repo, "public") || isDirectory(repo, "packages") || exists(repo, "nx.json") || hasGoBackend || hasRubyBackend);
+    const hasNodeFrontend = Boolean(pkg) && (isDirectory(repo, "public")
+        || isDirectory(repo, "packages")
+        || exists(repo, "nx.json")
+        || hasGoBackend
+        || hasRubyBackend
+        || hasLaravelViteFrontend
+        || hasLargePythonNodeHybrid);
     const hasReact = Boolean(rootDeps.react || nestedDeps.react);
     const hasReactFrontend = Boolean(nestedFrontend && hasReact);
     const hasCelery = /\bcelery\b/i.test(pyproject + setupPy + makefile + compose);
     const hasCompose = serviceMarkers.length > 0;
+    if (hasLargePythonNodeHybrid) {
+        if (isDirectory(repo, "src"))
+            backendMarkers.push("src/");
+        if (isDirectory(repo, "static"))
+            frontendMarkers.push("static/");
+        if (isDirectory(repo, "devservices"))
+            serviceMarkers.push("devservices/");
+    }
+    if (hasGoBackend) {
+        if (exists(repo, "main.go"))
+            backendMarkers.push("main.go");
+        if (isDirectory(repo, "cmd"))
+            backendMarkers.push("cmd/");
+        if (isDirectory(repo, "server"))
+            backendMarkers.push("server/");
+        backendMarkers.push(...goService.markers);
+    }
     const stack = [];
     if (hasPythonBackend)
         stack.push("python-backend");
@@ -284,8 +408,14 @@ function detectArchitecture(repo, pkg, nestedFrontend, repoComposeFile) {
         stack.push("go-backend");
     if (hasRubyBackend)
         stack.push("ruby-backend");
-    if (hasMakeDrivenBackend && !hasPythonBackend && !hasGoBackend && !hasRubyBackend)
+    if (hasPhpBackend)
+        stack.push("php-backend");
+    if (hasLaravel)
+        stack.push("laravel");
+    if (hasLargePythonNodeHybrid
+        || (hasMakeDrivenBackend && !hasPythonBackend && !hasGoBackend && !hasRubyBackend && !hasPhpBackend)) {
         stack.push("make-driven");
+    }
     if (hasNodeFrontend)
         stack.push("node-frontend");
     if (hasReactFrontend)
@@ -294,7 +424,7 @@ function detectArchitecture(repo, pkg, nestedFrontend, repoComposeFile) {
         stack.push("react");
     if (rootDeps.next)
         stack.push("nextjs");
-    if (rootDeps.vite)
+    if (rootDeps.vite || viteConfig)
         stack.push("vite");
     if (rootDeps.express)
         stack.push("express");
@@ -308,6 +438,10 @@ function detectArchitecture(repo, pkg, nestedFrontend, repoComposeFile) {
         stack.push("docker-compose");
     if (hasCelery)
         stack.push("celery");
+    if (hasLargePythonNodeHybrid)
+        stack.push("large-hybrid-app");
+    if (hasLargePythonNodeHybrid && isDirectory(repo, "devservices"))
+        stack.push("devservices-backed");
     const setupSteps = [];
     if (/^\s*superset db upgrade\s*$/m.test(makefile))
         setupSteps.push("superset db upgrade");
@@ -327,18 +461,28 @@ function detectArchitecture(repo, pkg, nestedFrontend, repoComposeFile) {
         workerCommand,
         makeCommand,
         goEntrypoint,
+        goService,
         rubyCommand,
         hasPythonBackend,
+        hasLargePythonNodeHybrid,
         hasFlask,
         hasDjango,
         hasGoBackend,
         hasRubyBackend,
+        hasPhpBackend,
+        hasLaravel,
+        hasLaravelViteFrontend,
+        sailCommand: hasLaravel && exists(repo, "vendor/bin/sail") ? "./vendor/bin/sail up" : null,
         hasMakeDrivenBackend,
         hasNodeFrontend,
     };
 }
-function detectPort(pkg, repo, commands) {
-    const sources = [JSON.stringify(pkg?.scripts ?? {}), readText(repo, "Makefile"), ...commands.filter((v) => Boolean(v))].join("\n");
+function detectPort(pkg, repo, commands, options = {}) {
+    const sources = [
+        options.ignorePackageScripts ? "" : JSON.stringify(pkg?.scripts ?? {}),
+        readText(repo, "Makefile"),
+        ...commands.filter((v) => Boolean(v)),
+    ].join("\n");
     const m = sources.match(/(?:-p|--port)(?:=|\s+|[\\"]+)(\d{2,5})/);
     if (m)
         return { port: Number(m[1]), evidence: `port flag in command evidence: ${m[0].replace(/\\"/g, "").trim()}` };
@@ -349,10 +493,11 @@ function detectPort(pkg, repo, commands) {
     if (listen)
         return { port: Number(listen[1]), evidence: "HTTP listen address in source" };
     const envEx = readText(repo, ".env.example");
-    const pm = envEx.match(/^PORT=(\d{2,5})/m);
+    const pm = envEx.match(/^(?:APP_)?PORT=(\d{2,5})/m);
     if (pm)
-        return { port: Number(pm[1]), evidence: "PORT in .env.example" };
-    return { port: 3000, evidence: "default assumption (3000); not evidence-based" };
+        return { port: Number(pm[1]), evidence: `${pm[0].split("=")[0]} in .env.example` };
+    const defaultPort = options.defaultPort ?? 3000;
+    return { port: defaultPort, evidence: `default assumption (${defaultPort}); not evidence-based` };
 }
 function detectServices(pkg, repo, repoComposeFile) {
     const out = [];
@@ -534,45 +679,74 @@ export function inferRepo(repoPath, opts = {}) {
     const architecture = detectArchitecture(repo, pkg, nestedFrontend, repoComposeFile);
     const pm = detectPackageManager(repo, pkg, nestedFrontend?.dir ?? null);
     const rootApp = pickAppCommand(pkg, pm.pm);
+    const rootScriptText = rootApp.script ? String(pkg?.scripts?.[rootApp.script] ?? "") : "";
+    const projectCliCommand = architecture.hasLargePythonNodeHybrid && rootScriptText
+        ? projectCliFromScript(rootScriptText, pm.pm)
+        : null;
+    const projectCliReady = projectCliCommand === null
+        ? null
+        : executableAvailable(repo, projectCliCommand);
+    const assetDevServerCommand = architecture.hasLaravelViteFrontend && /\bvite\b/i.test(rootScriptText)
+        ? rootApp.command
+        : null;
     const commandEvidence = [
         architecture.flaskCommand,
         architecture.makeCommand?.command ?? null,
         architecture.goEntrypoint?.sourceText ?? null,
+        architecture.goService.command,
         architecture.rubyCommand?.commandBase ?? null,
+        architecture.sailCommand,
     ];
-    const { port, evidence: portEvidence } = detectPort(pkg, repo, commandEvidence);
-    const goCommand = architecture.goEntrypoint
+    const { port, evidence: portEvidence } = detectPort(pkg, repo, commandEvidence, {
+        ignorePackageScripts: architecture.hasLaravel,
+        defaultPort: architecture.goService.port
+            ?? (architecture.sailCommand ? 80 : architecture.hasLaravel ? 8000 : 3000),
+    });
+    const goCommand = architecture.goService.command ?? (architecture.goEntrypoint
         ? [
             architecture.goEntrypoint.commandBase,
             architecture.goEntrypoint.portFlag ? `--port ${port}` : "",
             architecture.goEntrypoint.dataDirFlag ? "--data .bootproof/runtime/go-app" : "",
         ].filter(Boolean).join(" ")
-        : null;
+        : null);
     const rubyCommand = architecture.rubyCommand ? `${architecture.rubyCommand.commandBase} -p ${port}` : null;
     const djangoCommand = architecture.hasDjango ? `python manage.py runserver 127.0.0.1:${port}` : null;
+    const laravelCommand = architecture.hasLaravel
+        ? architecture.sailCommand ?? `php artisan serve --host=127.0.0.1 --port=${port}`
+        : null;
     const repositoryBackendCommand = architecture.makeCommand?.command ?? goCommand ?? rubyCommand;
-    const backendCommand = architecture.flaskCommand ?? djangoCommand ?? repositoryBackendCommand;
+    const backendCommand = architecture.flaskCommand ?? djangoCommand ?? laravelCommand ?? repositoryBackendCommand;
     const nestedFrontendCommand = architecture.frontendMakeCommand;
     const frontendCommand = nestedFrontendCommand ?? rootApp.command;
     const appCommand = architecture.flaskCommand
         ?? djangoCommand
+        ?? laravelCommand
         ?? (architecture.hasGoBackend && architecture.hasNodeFrontend && rootApp.command ? rootApp.command : null)
         ?? repositoryBackendCommand
         ?? rootApp.command;
+    const selectedProjectCliCommand = rootApp.command === appCommand ? projectCliCommand : null;
+    const selectedProjectCliReady = selectedProjectCliCommand === null ? null : projectCliReady;
     const appCommandSource = architecture.flaskCommand
         ? `Makefile Flask command: ${architecture.flaskCommand}`
         : djangoCommand && appCommand === djangoCommand
             ? "Django entrypoint: manage.py"
-            : architecture.makeCommand && appCommand === architecture.makeCommand.command
-                ? architecture.makeCommand.source
-                : goCommand && appCommand === goCommand
-                    ? architecture.goEntrypoint?.source ?? rootApp.source
-                    : rubyCommand && appCommand === rubyCommand
-                        ? architecture.rubyCommand?.source ?? rootApp.source
-                        : rootApp.source;
+            : laravelCommand && appCommand === laravelCommand
+                ? architecture.sailCommand
+                    ? "Laravel Sail entrypoint: vendor/bin/sail"
+                    : "Laravel entrypoint: artisan"
+                : architecture.makeCommand && appCommand === architecture.makeCommand.command
+                    ? architecture.makeCommand.source
+                    : goCommand && appCommand === goCommand
+                        ? architecture.goService.commandSource ?? architecture.goEntrypoint?.source ?? rootApp.source
+                        : rubyCommand && appCommand === rubyCommand
+                            ? architecture.rubyCommand?.source ?? rootApp.source
+                            : selectedProjectCliCommand && selectedProjectCliReady === false
+                                ? `${rootApp.source}; project CLI ${selectedProjectCliCommand} readiness not established`
+                                : rootApp.source;
     const recognizedApplication = architecture.hasPythonBackend ||
         architecture.hasGoBackend ||
         architecture.hasRubyBackend ||
+        architecture.hasPhpBackend ||
         architecture.hasMakeDrivenBackend ||
         composeApplicationServices.some(service => service.source === "build");
     const workspaces = opts.workspace ? [] : rankWorkspaces(rootRepo, rootPkg);
@@ -582,6 +756,7 @@ export function inferRepo(repoPath, opts = {}) {
     const rootDeps = { ...(pkg?.dependencies ?? {}), ...(pkg?.devDependencies ?? {}) };
     const preparationCommands = [];
     const nodePreparationRequired = Boolean(rootApp.command &&
+        !architecture.hasLaravel &&
         (Object.keys(rootDeps).length > 0 || exists(repo, "yarn.lock") || exists(repo, "pnpm-lock.yaml") || exists(repo, "package-lock.json") || exists(repo, "nx.json")));
     if (nodePreparationRequired) {
         const command = installCommand(pm.pm, pm.packageDir);
@@ -594,6 +769,9 @@ export function inferRepo(repoPath, opts = {}) {
     if (rubyCommand && appCommand === rubyCommand) {
         preparationCommands.push({ id: "bundle-install", kind: "install", command: "bundle install", description: "install declared Ruby gems", source: "Gemfile and bin/rails present" });
     }
+    if (laravelCommand && appCommand === laravelCommand) {
+        preparationCommands.push({ id: "composer-install", kind: "install", command: "composer install", description: "install declared PHP dependencies", source: "composer.json and artisan present" });
+    }
     const dependencyInstallRequired = preparationCommands.length > 0;
     const incompleteAppCommand = Boolean(architecture.hasGoBackend && architecture.hasNodeFrontend && rootApp.command);
     const multiAppCommand = Boolean(rootApp.command && /\b(?:turbo|nx)\s+run\s+dev\b[^\n]*--parallel\b/i.test(rootApp.source));
@@ -601,28 +779,38 @@ export function inferRepo(repoPath, opts = {}) {
         ? "multi-workspace development pipeline; no single application health target selected"
         : incompleteAppCommand
             ? "frontend/dev pipeline only; Go backend markers also detected"
-            : architecture.hasFlask && nestedFrontend
-                ? "Python/Flask backend command; React frontend and worker require separate orchestration"
-                : djangoCommand && appCommand === djangoCommand
-                    ? "Django application command"
-                    : goCommand && appCommand === goCommand && nestedFrontend
-                        ? "Go application command serving repository-embedded frontend assets"
-                        : rubyCommand && appCommand === rubyCommand
-                            ? "Rails application command"
-                            : architecture.makeCommand && appCommand === architecture.makeCommand.command
-                                ? "repository-defined Make target"
-                                : appCommand
-                                    ? "application command"
-                                    : "no runnable command selected";
+            : architecture.hasLargePythonNodeHybrid && rootApp.command === appCommand
+                ? selectedProjectCliCommand && selectedProjectCliReady === false
+                    ? `large Python/Node hybrid package script; project CLI ${selectedProjectCliCommand} readiness not established`
+                    : "large Python/Node hybrid package script"
+                : architecture.hasFlask && nestedFrontend
+                    ? "Python/Flask backend command; React frontend and worker require separate orchestration"
+                    : djangoCommand && appCommand === djangoCommand
+                        ? "Django application command"
+                        : laravelCommand && appCommand === laravelCommand
+                            ? architecture.sailCommand
+                                ? "Laravel application through Sail"
+                                : "Laravel application command; Vite is an asset development server only"
+                            : goCommand && appCommand === goCommand && nestedFrontend
+                                ? "Go application command serving repository-embedded frontend assets"
+                                : rubyCommand && appCommand === rubyCommand
+                                    ? "Rails application command"
+                                    : architecture.makeCommand && appCommand === architecture.makeCommand.command
+                                        ? "repository-defined Make target"
+                                        : appCommand
+                                            ? "application command"
+                                            : "no runnable command selected";
     const healthCandidates = notApp
         ? []
         : !appCommand && composeHealthCandidates.length
             ? composeHealthCandidates
             : !appCommand
                 ? []
-                : architecture.hasGoBackend && architecture.hasNodeFrontend
-                    ? [`http://localhost:${port}/api/health`, `http://localhost:${port}/`]
-                    : [`http://localhost:${port}/`];
+                : architecture.goService.ollamaLike
+                    ? architecture.goService.healthCandidates
+                    : architecture.hasGoBackend && architecture.hasNodeFrontend
+                        ? [`http://localhost:${port}/api/health`, `http://localhost:${port}/`]
+                        : [`http://localhost:${port}/`];
     let confidence = 0;
     if (appCommand)
         confidence += 35;
@@ -636,6 +824,8 @@ export function inferRepo(repoPath, opts = {}) {
         confidence += 10;
     if (services.length || env.required.length)
         confidence += 5;
+    if (selectedProjectCliCommand && selectedProjectCliReady === false)
+        confidence = Math.min(confidence, 60);
     return {
         repoPath: repo,
         isApplication: !notApp,
@@ -656,14 +846,23 @@ export function inferRepo(repoPath, opts = {}) {
         dependencyInstallRequired,
         appCommand,
         appCommandSource,
+        selectedPackageScriptName: rootApp.command === appCommand ? rootApp.script : null,
+        selectedPackageScriptCommand: rootApp.command === appCommand ? rootScriptText || null : null,
+        projectCliCommand: selectedProjectCliCommand,
+        projectCliReady: selectedProjectCliReady,
         backendCommand,
         frontendCommand,
+        asset_dev_server_command: assetDevServerCommand,
         workerCommand: architecture.workerCommand,
         commandScope,
         incompleteAppCommand,
         multiAppCommand,
         port,
-        portEvidence,
+        portEvidence: architecture.goService.port
+            ? "known Ollama service port from repository evidence"
+            : portEvidence,
+        observedPort: null,
+        healthCandidateSource: architecture.goService.ollamaLike ? "known_service" : "inferred",
         healthCandidates,
         services,
         requiredEnv: env.required,

package/dist/plan.js

@@ -106,6 +106,8 @@ export function buildPlan(inf, provider) {
         steps,
         healthUrl,
         healthCandidates,
+        observedPort: inf.observedPort,
+        healthCandidateSource: inf.healthCandidateSource,
         generatedFiles: [
             ...(composeFileFor(inf) ? [{ path: "docker-compose.bootproof.yml", purpose: "service containers" }] : []),
             ...(envExampleFor(inf) ? [{ path: ".env.bootproof.example", purpose: "suggested local env values (never auto-applied)" }] : []),

package/dist/proof.d.ts

@@ -1,6 +1,45 @@
-import type { Attestation, ObservedStep, RunPlan, FailureClass } from "./types.js";
-export declare const TOOL_ID = "bootproof@0.3.0";
+import type { Attestation, AttestationTrust, ObservedStep, RunPlan, FailureClass, HealthEvidence, VerificationMode, ExternalVerificationClassification } from "./types.js";
+export declare const TOOL_ID = "bootproof@0.4.0";
+export type { AttestationTrust } from "./types.js";
+export type SignerTrustTier = "invalid" | "self" | "known" | "unknown-foreign";
+export interface SignatureTrustResult {
+    integrityValid: boolean;
+    tier: SignerTrustTier;
+    fingerprint: string | null;
+    label: string | null;
+}
 export declare function gitInfo(repo: string): Attestation["repo"];
+export declare function knownSignersPath(): string;
+export interface RotationResult {
+    schema: "bootproof/key-rotation/v1";
+    rotatedAt: string;
+    oldPublicKey: string;
+    newPublicKey: string;
+    backedUpTo: string | null;
+    reSignedAttestation: boolean;
+}
+/**
+ * Rotate the local ed25519 signing key. The old key's public key is archived
+ * (so existing attestations remain independently verifiable), a new keypair is
+ * generated, and the latest attestation in the given repo is optionally
+ * re-signed with the new key.
+ *
+ * Rotation does NOT invalidate existing attestations — they still carry the
+ * old public key inline and verify with it. Rotation only affects what key
+ * future attestations will be signed with.
+ */
+export declare function rotateSigner(opts?: {
+    repo?: string;
+    resignAttestation?: boolean;
+    backup?: boolean;
+}): RotationResult;
+export declare function signerFingerprint(publicKeyPem: string): string;
+export declare function trustSigner(publicKeyPem: string, label?: string): {
+    fingerprint: string;
+    firstSeenAt: string;
+    label: string | null;
+};
+export declare function evaluateDetachedSignature(body: Buffer, signature: string | null | undefined, publicKeyPem: string | null | undefined): SignatureTrustResult;
 export declare function buildAttestation(input: {
     repo: string;
     plan: RunPlan;
@@ -9,16 +48,53 @@ export declare function buildAttestation(input: {
     booted: boolean;
     healthVerified: boolean;
     healthObservation: string | null;
+    healthEvidence?: HealthEvidence | null;
     observedHealthCandidates?: string[];
     failureClass: FailureClass | null;
     failureEvidence: string | null;
     explanation: string;
+    verificationMode?: VerificationMode;
+    bootproofOrchestrated?: boolean;
+    externalHealthUrl?: string | null;
+    observedStatus?: number | null;
+    observedFinalUrl?: string | null;
+    observedAt?: string | null;
+    responseSnippet?: string;
+    classification?: ExternalVerificationClassification | null;
+    trust?: AttestationTrust;
 }): Attestation;
+/**
+ * Detect GitHub Actions OIDC environment. Present only when the workflow has
+ * `permissions: id-token: write`. The presence of these env vars IS the consent —
+ * the workflow author explicitly granted the OIDC scope.
+ */
+export declare function detectOidcEnv(env?: NodeJS.ProcessEnv): {
+    requestUrl: string;
+    requestToken: string;
+} | null;
+/**
+ * Fetch the OIDC JWT from GitHub Actions and decode its claims (without verification —
+ * verification is the receiver's job, not the signer's). Returns a compact record of
+ * claims suitable for embedding in the attestation trust block.
+ */
+export declare function fetchOidcClaims(requestUrl: string, requestToken: string, fetchImpl?: typeof fetch): Promise<Record<string, string>>;
+/**
+ * Resolve the trust block for an attestation. When `--ci-oidc` is requested and
+ * the GitHub Actions OIDC environment is present, fetch the OIDC token and return
+ * a ci_oidc_signed trust block. Otherwise return local_developer_signed.
+ */
+export declare function resolveTrust(opts?: {
+    ciOidc?: boolean;
+    env?: NodeJS.ProcessEnv;
+    fetchImpl?: typeof fetch;
+}): Promise<AttestationTrust>;
 export declare function signDetached(body: Buffer): {
     signature: string;
     publicKeyPem: string;
 };
 export declare function verifyDetached(body: Buffer, signature: string, publicKeyPem: string): boolean;
 export declare function verifySignature(att: Attestation): boolean;
+export declare function evaluateAttestationSignature(att: Attestation): SignatureTrustResult;
+export declare function currentGitHead(repo: string): string | null;
 export declare function attestationPath(repo: string): string;
 export declare function writeAttestation(repo: string, att: Attestation): string;