bootproof 0.3.0 → 0.4.0

package/dist/registry.d.ts

@@ -1,38 +1,90 @@
-import type { Attestation } from "./types.js";
+import type { Inference, Attestation, FailureClass } from "./types.js";
+import type { RepairReceipt, RepairKind } from "./repair.js";
+import { type SignatureTrustResult } from "./proof.js";
+export type RegistryMode = "local_export" | "federated_public_candidate" | "cloud_upload_candidate";
+export interface RegistrySignature {
+    algorithm: "ed25519";
+    publicKey: string;
+    value: string;
+}
 export interface RegistryEntry {
     schema: "bootproof/registry-entry/v1";
-    tool: string;
-    repo: {
-        remote: string | null;
-        commit: string | null;
-        dirty: boolean | null;
-    };
-    environment: Attestation["environment"];
-    plan: {
-        provider: string;
-        healthUrl: string;
-        steps: {
-            kind: string;
-            command?: string;
-        }[];
-    };
-    result: {
-        booted: boolean;
-        healthVerified: boolean;
-        healthObservation: string | null;
-        failureClass: string | null;
-        redactedEvidence: string | null;
+    createdAt: string;
+    bootproofVersion: string;
+    source: "local_cli";
+    registryMode: RegistryMode;
+    repoFingerprint: string;
+    repoHost: string | null;
+    repoOwnerHash: string;
+    repoNameHash: string;
+    publicRepoHint?: string;
+    commitHash: string | null;
+    branch: string | null;
+    os: string;
+    arch: string;
+    platform: string;
+    packageManager: string;
+    detectedStack: string[];
+    detectedServices: string[];
+    selectedCommandHash: string | null;
+    selectedCommandRedacted: string | null;
+    failureClass: FailureClass | null;
+    failureEvidenceFingerprint: string | null;
+    evidenceHeadRedacted: string | null;
+    evidenceTailRedacted: string | null;
+    healthStatus: "healthy" | "unhealthy" | "connection_error" | "not_observed";
+    healthUrlPattern: string | null;
+    healthRedirectLocationPattern: string | null;
+    repairActionType?: RepairKind;
+    repairCommandHash?: string;
+    repairCommandRedacted?: string;
+    beforeFailureClass?: FailureClass;
+    afterFailureClass?: FailureClass;
+    progressed?: boolean;
+    verified: boolean;
+    attestationHash: string;
+    repairReceiptHash?: string;
+    redactionsApplied: string[];
+    signature?: RegistrySignature;
+    optInRequired: true;
+}
+export interface FederatedReceipt {
+    schema: "bootproof/federated-receipt/v1";
+    createdAt: string;
+    registryEntry: RegistryEntry;
+    attestationHash: string;
+    repairReceiptHash?: string;
+    signature?: RegistrySignature;
+    publicRepoDeclaration: true;
+    crawlerHint: {
+        repoUrl?: string;
+        commitHash: string | null;
+        branch: string | null;
     };
     redactionsApplied: string[];
-    attestationSha256: string;
-    attestedAt: string;
-    signer: {
-        publicKey: string;
-        algorithm: "ed25519";
-    } | null;
-    signature: string | null;
+    noSecretsIncluded: true;
+}
+export interface RegistryBuildOptions {
+    registryMode?: RegistryMode;
+    inference?: Pick<Inference, "packageManager" | "stack" | "services" | "composeApplicationServices">;
+    repairReceipt?: RepairReceipt | null;
+    createdAt?: string;
+    branch?: string | null;
+    sign?: boolean;
+}
+export interface FederatedReceiptBuildOptions {
+    createdAt?: string;
+    sign?: boolean;
 }
-export declare function buildRegistryEntry(att: Attestation): RegistryEntry;
+export declare function currentGitBranch(repo: string): string | null;
+export declare function buildRegistryEntry(att: Attestation, options?: RegistryBuildOptions): RegistryEntry;
+export declare function buildFederatedReceipt(registryEntry: RegistryEntry, options?: FederatedReceiptBuildOptions): FederatedReceipt;
 export declare function verifyRegistryEntry(entry: RegistryEntry): boolean;
+export declare function evaluateRegistryEntrySignature(entry: RegistryEntry): SignatureTrustResult;
+export declare function verifyFederatedReceipt(receipt: FederatedReceipt): boolean;
+export declare function validateRegistryEntry(value: unknown): string[];
+export declare function validateFederatedReceipt(value: unknown): string[];
 export declare function registryEntryPath(repo: string): string;
+export declare function federatedReceiptPath(repo: string, receipt: FederatedReceipt): string;
 export declare function writeRegistryEntry(repo: string, entry: RegistryEntry): string;
+export declare function writeFederatedReceipt(repo: string, receipt: FederatedReceipt): string;

package/dist/registry.js

@@ -1,70 +1,372 @@
-// The proposed BootProof registry is federated by design (docs/REGISTRY.md):
-//   WRITE PATH: developers may commit signed proof to their own repositories.
-//   FUTURE READ PATH: an index could discover public artifacts and verify every signature.
-// No public index is operated today. The CLI never uploads evidence. `attest export` produces a
-// redacted, re-signed local entry; sharing it remains a deliberate git/PR action.
+// Registry exports are local artifacts only. They never upload, call a registry service, or
+// claim that a public index exists. See docs/REGISTRY.md.
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { buildExecutionEnv } from "./exec.js";
 import { redactText } from "./redact.js";
-import { signDetached, verifyDetached } from "./proof.js";
-export function buildRegistryEntry(att) {
-    const redactions = new Set();
-    let redactedEvidence = null;
-    if (att.result.failureEvidence) {
-        const r = redactText(att.result.failureEvidence);
-        redactedEvidence = r.text;
-        r.applied.forEach(a => redactions.add(a));
-    }
-    const fullHash = crypto.createHash("sha256").update(JSON.stringify(att)).digest("hex");
+import { evaluateDetachedSignature, signDetached, verifyDetached, } from "./proof.js";
+const PUBLIC_REPO_HOSTS = new Set(["github.com", "gitlab.com", "bitbucket.org", "codeberg.org"]);
+const REGISTRY_ENTRY_KEYS = new Set([
+    "schema", "createdAt", "bootproofVersion", "source", "registryMode", "repoFingerprint",
+    "repoHost", "repoOwnerHash", "repoNameHash", "publicRepoHint", "commitHash", "branch",
+    "os", "arch", "platform", "packageManager", "detectedStack", "detectedServices",
+    "selectedCommandHash", "selectedCommandRedacted", "failureClass", "failureEvidenceFingerprint",
+    "evidenceHeadRedacted", "evidenceTailRedacted", "healthStatus", "healthUrlPattern",
+    "healthRedirectLocationPattern", "repairActionType", "repairCommandHash",
+    "repairCommandRedacted", "beforeFailureClass", "afterFailureClass", "progressed", "verified",
+    "attestationHash", "repairReceiptHash", "redactionsApplied", "signature", "optInRequired",
+]);
+const FEDERATED_RECEIPT_KEYS = new Set([
+    "schema", "createdAt", "registryEntry", "attestationHash", "repairReceiptHash", "signature",
+    "publicRepoDeclaration", "crawlerHint", "redactionsApplied", "noSecretsIncluded",
+]);
+function sha256(value) {
+    return crypto.createHash("sha256").update(value).digest("hex");
+}
+function hashObject(value) {
+    return sha256(JSON.stringify(value));
+}
+function canonicalWithoutSignature(value) {
+    const { signature: _signature, ...body } = value;
+    return Buffer.from(JSON.stringify(body));
+}
+function signed(value) {
+    const result = signDetached(canonicalWithoutSignature(value));
+    return { algorithm: "ed25519", publicKey: result.publicKeyPem, value: result.signature };
+}
+function safeRepoIdentity(att) {
+    const fallbackName = path.basename(path.resolve(att.repo.path)) || "repository";
+    const fallbackOwner = path.basename(path.dirname(path.resolve(att.repo.path))) || "local";
+    const remote = att.repo.remote?.trim() ?? "";
+    let candidate = remote;
+    const scp = remote.match(/^git@([^:]+):(.+)$/i);
+    if (scp)
+        candidate = `https://${scp[1]}/${scp[2]}`;
+    try {
+        const url = new URL(candidate);
+        const host = url.hostname.toLowerCase();
+        const parts = url.pathname.split("/").filter(Boolean);
+        const name = parts.at(-1)?.replace(/\.git$/i, "") ?? "";
+        const owner = parts.slice(0, -1).join("/");
+        const safeSegments = [...parts.slice(0, -1), name].every(part => /^[A-Za-z0-9_.-]+$/.test(part));
+        const safeIdentity = Boolean(host && owner && name && safeSegments) &&
+            !url.search &&
+            !url.hash;
+        const safePublic = url.protocol === "https:" &&
+            PUBLIC_REPO_HOSTS.has(host) &&
+            !url.username &&
+            !url.password &&
+            !url.port &&
+            safeIdentity;
+        if (safeIdentity) {
+            return {
+                host,
+                owner,
+                name,
+                publicUrl: safePublic ? `https://${host}/${owner}/${name}` : null,
+                fingerprintSource: `${host}/${owner}/${name}`,
+            };
+        }
+    }
+    catch {
+        // Non-public or local remotes are represented only by hashes below.
+    }
+    return {
+        host: null,
+        owner: fallbackOwner,
+        name: fallbackName,
+        publicUrl: null,
+        fingerprintSource: remote || path.resolve(att.repo.path),
+    };
+}
+function redactRegistryText(input) {
+    if (!input)
+        return { text: null, applied: [] };
+    const base = redactText(input);
+    let text = base.text;
+    const applied = new Set(base.applied);
+    const privateKey = /-----BEGIN(?: [A-Z0-9]+)? PRIVATE KEY-----[\s\S]*?-----END(?: [A-Z0-9]+)? PRIVATE KEY-----/g;
+    if (privateKey.test(text)) {
+        text = text.replace(privateKey, "[redacted-private-key]");
+        applied.add("private keys");
+    }
+    const envAssignment = /(^|[\s;])([A-Za-z_][A-Za-z0-9_]*)=(?:"[^"]*"|'[^']*'|[^\s;]+)/gm;
+    if (envAssignment.test(text)) {
+        text = text.replace(envAssignment, "$1$2=[redacted]");
+        applied.add("environment values");
+    }
+    const localPath = /\/(?:Users|home)\/[^/\s]+/g;
+    if (localPath.test(text) || text.includes("~/")) {
+        text = text.replace(localPath, "[home]").replace(/~(?=\/)/g, "[home]");
+        applied.add("local user paths");
+    }
+    return { text, applied: [...applied] };
+}
+function redactUrlPattern(value) {
+    if (!value)
+        return { text: null, applied: [] };
+    try {
+        const absolute = new URL(value, "http://bootproof.invalid");
+        const relative = !/^[a-z][a-z0-9+.-]*:\/\//i.test(value);
+        const dynamicPath = absolute.pathname
+            .split("/")
+            .map(segment => /^\d+$/.test(segment) || /^[0-9a-f]{8}-[0-9a-f-]{27,}$/i.test(segment) ? ":id" : segment)
+            .join("/");
+        const port = absolute.port ? ":<port>" : "";
+        const text = relative
+            ? dynamicPath || "/"
+            : `${absolute.protocol}//${absolute.hostname}${port}${dynamicPath || "/"}`;
+        const applied = ["URL query and credentials"];
+        if (absolute.port)
+            applied.push("URL port");
+        if (dynamicPath !== absolute.pathname)
+            applied.push("dynamic URL path segments");
+        return { text, applied };
+    }
+    catch {
+        return redactRegistryText(value);
+    }
+}
+function failedProcessEvidence(att) {
+    const failed = att.observed.find(step => !step.ok && (step.evidenceHead || step.evidenceTail));
+    return {
+        head: failed?.evidenceHead ?? null,
+        tail: failed?.evidenceTail ?? att.result.failureEvidence,
+    };
+}
+function healthStatus(att) {
+    const evidence = att.result.healthEvidence;
+    if (att.result.healthVerified && evidence?.acceptedAsHealthy)
+        return "healthy";
+    if (evidence?.connectionError)
+        return "connection_error";
+    if (evidence || att.result.healthObservation)
+        return "unhealthy";
+    return "not_observed";
+}
+function repairCommand(receipt) {
+    return receipt?.repair?.planDelta
+        ?? receipt?.repair?.envDelta
+        ?? receipt?.proposedAction.command?.display
+        ?? receipt?.proposedAction.instruction
+        ?? null;
+}
+function registryRepairKind(receipt) {
+    if (receipt.repair)
+        return receipt.repair.kind;
+    return receipt.actionType === "command" ? "environment" : "plan-step";
+}
+export function currentGitBranch(repo) {
+    try {
+        const branch = execFileSync("git", ["-C", repo, "symbolic-ref", "--quiet", "--short", "HEAD"], { encoding: "utf8", env: buildExecutionEnv(), stdio: ["ignore", "pipe", "ignore"] }).trim();
+        return branch || null;
+    }
+    catch {
+        return null;
+    }
+}
+export function buildRegistryEntry(att, options = {}) {
+    const redactions = new Set(["repository identity hashed"]);
+    const identity = safeRepoIdentity(att);
+    const selectedCommand = att.plan.steps.find(step => step.kind === "start-app")?.command ?? null;
+    const processEvidence = failedProcessEvidence(att);
+    const head = redactRegistryText(processEvidence.head);
+    const tail = redactRegistryText(processEvidence.tail);
+    const command = redactRegistryText(selectedCommand);
+    const healthUrl = redactUrlPattern(att.result.healthEvidence?.requestedUrl ?? att.plan.healthUrl);
+    const healthRedirect = redactUrlPattern(att.result.healthEvidence?.redirectLocation);
+    const receipt = options.repairReceipt ?? null;
+    const repair = repairCommand(receipt);
+    const repairRedacted = redactRegistryText(repair);
+    for (const result of [head, tail, command, healthUrl, healthRedirect, repairRedacted]) {
+        result.applied.forEach(item => redactions.add(item));
+    }
+    const detectedServices = [
+        ...(options.inference?.services.map(service => service.kind) ?? []),
+        ...(options.inference?.composeApplicationServices.map(service => service.name) ?? []),
+    ];
+    const platform = att.environment.os.trim().split(/\s+/)[0] || "unknown";
     const entry = {
         schema: "bootproof/registry-entry/v1",
-        tool: att.tool,
-        repo: { remote: att.repo.remote, commit: att.repo.commit, dirty: att.repo.dirty },
-        environment: att.environment,
-        plan: {
-            provider: att.plan.provider,
-            healthUrl: att.plan.healthUrl,
-            steps: att.plan.steps.map(s => {
-                const r = s.command ? redactText(s.command) : null;
-                if (r)
-                    r.applied.forEach(a => redactions.add(a));
-                return { kind: s.kind, command: r?.text };
-            }),
-        },
-        result: {
-            booted: att.result.booted,
-            healthVerified: att.result.healthVerified,
-            healthObservation: att.result.healthObservation,
-            failureClass: att.result.failureClass,
-            redactedEvidence,
-        },
-        redactionsApplied: [...redactions],
-        attestationSha256: fullHash,
-        attestedAt: att.finishedAt,
-        signer: null,
-        signature: null,
+        createdAt: options.createdAt ?? new Date().toISOString(),
+        bootproofVersion: att.tool.replace(/^bootproof@/, ""),
+        source: "local_cli",
+        registryMode: options.registryMode ?? "local_export",
+        repoFingerprint: sha256(`bootproof/repo/v1\0${identity.fingerprintSource}`),
+        repoHost: identity.host,
+        repoOwnerHash: sha256(`bootproof/repo-owner/v1\0${identity.owner}`),
+        repoNameHash: sha256(`bootproof/repo-name/v1\0${identity.name}`),
+        ...(identity.publicUrl ? { publicRepoHint: identity.publicUrl } : {}),
+        commitHash: att.repo.commit,
+        branch: options.branch ?? null,
+        os: att.environment.os,
+        arch: att.environment.arch,
+        platform,
+        packageManager: options.inference?.packageManager ?? "unknown",
+        detectedStack: [...new Set(options.inference?.stack ?? [])].sort(),
+        detectedServices: [...new Set(detectedServices)].sort(),
+        selectedCommandHash: selectedCommand ? sha256(selectedCommand) : null,
+        selectedCommandRedacted: command.text,
+        failureClass: att.result.failureClass,
+        failureEvidenceFingerprint: att.result.failureEvidence ? sha256(att.result.failureEvidence) : null,
+        evidenceHeadRedacted: head.text,
+        evidenceTailRedacted: tail.text,
+        healthStatus: healthStatus(att),
+        healthUrlPattern: healthUrl.text,
+        healthRedirectLocationPattern: healthRedirect.text,
+        ...(receipt ? { repairActionType: registryRepairKind(receipt) } : {}),
+        ...(repair ? { repairCommandHash: sha256(repair) } : {}),
+        ...(repairRedacted.text ? { repairCommandRedacted: repairRedacted.text } : {}),
+        ...(receipt ? { beforeFailureClass: receipt.beforeFailureClass } : {}),
+        ...(receipt?.afterFailureClass ? { afterFailureClass: receipt.afterFailureClass } : {}),
+        ...(receipt ? { progressed: receipt.progressed } : {}),
+        verified: att.result.booted === true && att.result.healthVerified === true,
+        attestationHash: hashObject(att),
+        ...(receipt ? { repairReceiptHash: hashObject(receipt) } : {}),
+        redactionsApplied: [...redactions].sort(),
+        optInRequired: true,
     };
-    const signed = signDetached(canonical(entry));
-    entry.signature = signed.signature;
-    entry.signer = { publicKey: signed.publicKeyPem, algorithm: "ed25519" };
+    if (options.sign)
+        entry.signature = signed(entry);
+    assertValidRegistryEntry(entry);
     return entry;
 }
-function canonical(entry) {
-    const { signature: _s, signer: _k, ...body } = entry;
-    return Buffer.from(JSON.stringify(body));
+export function buildFederatedReceipt(registryEntry, options = {}) {
+    const receipt = {
+        schema: "bootproof/federated-receipt/v1",
+        createdAt: options.createdAt ?? registryEntry.createdAt,
+        registryEntry,
+        attestationHash: registryEntry.attestationHash,
+        ...(registryEntry.repairReceiptHash ? { repairReceiptHash: registryEntry.repairReceiptHash } : {}),
+        publicRepoDeclaration: true,
+        crawlerHint: {
+            ...(registryEntry.publicRepoHint ? { repoUrl: registryEntry.publicRepoHint } : {}),
+            commitHash: registryEntry.commitHash,
+            branch: registryEntry.branch,
+        },
+        redactionsApplied: [...registryEntry.redactionsApplied],
+        noSecretsIncluded: true,
+    };
+    if (options.sign)
+        receipt.signature = signed(receipt);
+    assertValidFederatedReceipt(receipt);
+    return receipt;
 }
 export function verifyRegistryEntry(entry) {
-    if (!entry.signature || !entry.signer)
-        return false;
-    return verifyDetached(canonical(entry), entry.signature, entry.signer.publicKey);
+    return Boolean(entry.signature &&
+        verifyDetached(canonicalWithoutSignature(entry), entry.signature.value, entry.signature.publicKey));
+}
+export function evaluateRegistryEntrySignature(entry) {
+    return evaluateDetachedSignature(canonicalWithoutSignature(entry), entry.signature?.value, entry.signature?.publicKey);
+}
+export function verifyFederatedReceipt(receipt) {
+    return Boolean(receipt.signature &&
+        verifyDetached(canonicalWithoutSignature(receipt), receipt.signature.value, receipt.signature.publicKey));
+}
+function unknownKeys(value, allowed) {
+    return Object.keys(value).filter(key => !allowed.has(key));
+}
+export function validateRegistryEntry(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return ["entry must be an object"];
+    const entry = value;
+    const errors = unknownKeys(value, REGISTRY_ENTRY_KEYS).map(key => `unsupported field: ${key}`);
+    if (entry.schema !== "bootproof/registry-entry/v1")
+        errors.push("invalid schema");
+    if (entry.source !== "local_cli")
+        errors.push("invalid source");
+    if (!["local_export", "federated_public_candidate", "cloud_upload_candidate"].includes(String(entry.registryMode))) {
+        errors.push("invalid registryMode");
+    }
+    for (const key of [
+        "createdAt", "bootproofVersion", "repoFingerprint", "repoOwnerHash", "repoNameHash",
+        "os", "arch", "platform", "packageManager", "attestationHash",
+    ]) {
+        if (typeof entry[key] !== "string" || !entry[key])
+            errors.push(`${key} must be a non-empty string`);
+    }
+    for (const key of ["detectedStack", "detectedServices", "redactionsApplied"]) {
+        if (!Array.isArray(entry[key]) || entry[key]?.some(item => typeof item !== "string")) {
+            errors.push(`${key} must be a string array`);
+        }
+    }
+    if (!["healthy", "unhealthy", "connection_error", "not_observed"].includes(String(entry.healthStatus))) {
+        errors.push("invalid healthStatus");
+    }
+    if (typeof entry.verified !== "boolean")
+        errors.push("verified must be boolean");
+    if (entry.optInRequired !== true)
+        errors.push("optInRequired must be true");
+    if (entry.signature && (entry.signature.algorithm !== "ed25519" ||
+        typeof entry.signature.publicKey !== "string" ||
+        typeof entry.signature.value !== "string")) {
+        errors.push("invalid signature");
+    }
+    return errors;
+}
+export function validateFederatedReceipt(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return ["receipt must be an object"];
+    const receipt = value;
+    const errors = unknownKeys(value, FEDERATED_RECEIPT_KEYS).map(key => `unsupported field: ${key}`);
+    if (receipt.schema !== "bootproof/federated-receipt/v1")
+        errors.push("invalid schema");
+    if (typeof receipt.createdAt !== "string" || !receipt.createdAt)
+        errors.push("createdAt must be a non-empty string");
+    errors.push(...validateRegistryEntry(receipt.registryEntry).map(error => `registryEntry: ${error}`));
+    if (receipt.registryEntry?.registryMode !== "federated_public_candidate") {
+        errors.push("registryEntry.registryMode must be federated_public_candidate");
+    }
+    if (receipt.attestationHash !== receipt.registryEntry?.attestationHash)
+        errors.push("attestationHash must match registryEntry");
+    if (receipt.repairReceiptHash !== receipt.registryEntry?.repairReceiptHash)
+        errors.push("repairReceiptHash must match registryEntry");
+    if (receipt.publicRepoDeclaration !== true)
+        errors.push("publicRepoDeclaration must be true");
+    if (!receipt.crawlerHint || typeof receipt.crawlerHint !== "object")
+        errors.push("crawlerHint must be an object");
+    if (!Array.isArray(receipt.redactionsApplied) || receipt.redactionsApplied.some(item => typeof item !== "string")) {
+        errors.push("redactionsApplied must be a string array");
+    }
+    if (receipt.noSecretsIncluded !== true)
+        errors.push("noSecretsIncluded must be true");
+    if (receipt.signature && (receipt.signature.algorithm !== "ed25519" ||
+        typeof receipt.signature.publicKey !== "string" ||
+        typeof receipt.signature.value !== "string")) {
+        errors.push("invalid signature");
+    }
+    return errors;
+}
+function assertValidRegistryEntry(entry) {
+    const errors = validateRegistryEntry(entry);
+    if (errors.length)
+        throw new Error(`invalid registry entry: ${errors.join("; ")}`);
+}
+function assertValidFederatedReceipt(receipt) {
+    const errors = validateFederatedReceipt(receipt);
+    if (errors.length)
+        throw new Error(`invalid federated receipt: ${errors.join("; ")}`);
 }
 export function registryEntryPath(repo) {
     return path.join(repo, ".bootproof", "registry-entry.json");
 }
+export function federatedReceiptPath(repo, receipt) {
+    const timestamp = receipt.createdAt.replace(/[:.]/g, "-");
+    return path.join(repo, ".bootproof", "registry", `${timestamp}-${receipt.attestationHash.slice(0, 12)}.json`);
+}
 export function writeRegistryEntry(repo, entry) {
-    const p = registryEntryPath(repo);
-    fs.mkdirSync(path.dirname(p), { recursive: true });
-    fs.writeFileSync(p, JSON.stringify(entry, null, 2) + "\n");
-    return p;
+    assertValidRegistryEntry(entry);
+    const output = registryEntryPath(repo);
+    fs.mkdirSync(path.dirname(output), { recursive: true });
+    fs.writeFileSync(output, JSON.stringify(entry, null, 2) + "\n");
+    return output;
+}
+export function writeFederatedReceipt(repo, receipt) {
+    assertValidFederatedReceipt(receipt);
+    const output = federatedReceiptPath(repo, receipt);
+    fs.mkdirSync(path.dirname(output), { recursive: true });
+    fs.writeFileSync(output, JSON.stringify(receipt, null, 2) + "\n");
+    return output;
 }

package/dist/remote.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
+import { buildExecutionEnv } from "./exec.js";
 const REMOTE_PROVIDERS = {
     "github.com": "github",
     "gitlab.com": "gitlab",
@@ -73,13 +74,12 @@ export function cloneRemoteTarget(value, cwd) {
         execFileSync("git", ["-c", "credential.helper=", "clone", "--depth", "1", "--single-branch", "--no-tags", "--", remote.canonicalUrl, repoPath], {
             encoding: "utf8",
             stdio: ["ignore", "pipe", "pipe"],
-            env: {
-                ...process.env,
+            env: buildExecutionEnv({
                 GIT_ASKPASS: "",
                 GIT_CONFIG_GLOBAL: isolatedGitConfig,
                 GIT_CONFIG_NOSYSTEM: "1",
                 GIT_TERMINAL_PROMPT: "0",
-            },
+            }),
         });
         fs.rmSync(isolatedGitConfig, { force: true });
         const marker = {

package/dist/repair-playbooks.d.ts

@@ -0,0 +1,24 @@
+import { type RepairAction } from "./repair-safety.js";
+import type { Attestation, FailureClass } from "./types.js";
+export interface DeterministicRepairFileChange {
+    path: string;
+    before: string | null;
+    after: string;
+}
+export interface DeterministicRepairCandidate {
+    id: string;
+    failureClass: FailureClass;
+    action: RepairAction;
+    followUpActions?: RepairAction[];
+    fileChanges?: DeterministicRepairFileChange[];
+}
+export interface RepairCandidateOptions {
+    repoPath?: string;
+    homebrewAvailable?: boolean;
+    homebrewPrefix?: string | null;
+    homebrewPostgresPackage?: string | null;
+    environment?: NodeJS.ProcessEnv;
+}
+export declare function executableAvailableOnPath(executable: string, environment?: NodeJS.ProcessEnv): boolean;
+export declare function deterministicRepairCandidateFor(attestation: Attestation, options?: RepairCandidateOptions): DeterministicRepairCandidate | null;
+export declare function repairProgressed(beforeFailureClass: FailureClass, after: Attestation | null): boolean;