@jinn-network/client 0.1.9 → 0.2.0

package/dist/task-creator/environment/contracts.d.ts

@@ -0,0 +1,1338 @@
+import { z } from 'zod/v3';
+export declare const ENVIRONMENT_BUILD_REQUEST_V1: "jinn.environment-build-request.v1";
+export declare const ENVIRONMENT_BUILD_RECIPE_V1: "jinn.environment-build-recipe.v1";
+export declare const TASK_ENVIRONMENT_SPEC_V1: "jinn.task-environment.v1";
+export declare const DigestQualifiedImageV1Schema: z.ZodEffects<z.ZodObject<{
+    reference: z.ZodString;
+    digest: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    reference: string;
+    digest: string;
+}, {
+    reference: string;
+    digest: string;
+}>, {
+    reference: string;
+    digest: string;
+}, {
+    reference: string;
+    digest: string;
+}>;
+export declare const EnvironmentSourceV1Schema: z.ZodObject<{
+    repo: z.ZodString;
+    repoUrl: z.ZodString;
+    baseCommit: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    repo: string;
+    repoUrl: string;
+    baseCommit: string;
+}, {
+    repo: string;
+    repoUrl: string;
+    baseCommit: string;
+}>;
+export type EnvironmentSourceV1 = z.infer<typeof EnvironmentSourceV1Schema>;
+/** A shell-free command representation executed relative to the workspace. */
+export declare const CommandSpecSchema: z.ZodObject<{
+    bin: z.ZodString;
+    args: z.ZodArray<z.ZodString, "many">;
+    cwd: z.ZodOptional<z.ZodString>;
+    environment: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, "strict", z.ZodTypeAny, {
+    args: string[];
+    bin: string;
+    cwd?: string | undefined;
+    environment?: Record<string, string> | undefined;
+}, {
+    args: string[];
+    bin: string;
+    cwd?: string | undefined;
+    environment?: Record<string, string> | undefined;
+}>;
+export type CommandSpec = z.infer<typeof CommandSpecSchema>;
+/**
+ * A rights record belongs to exactly one disclosed input. An SPDX assertion is
+ * still checked against repository metadata by the publication policy; an
+ * explicit authorization can carry a repository-specific permission record.
+ */
+export declare const InputRightsRefV1Schema: z.ZodUnion<[z.ZodObject<{
+    inputRef: z.ZodString;
+    rightsRef: z.ZodString;
+    basis: z.ZodLiteral<"spdx">;
+    spdxId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    inputRef: string;
+    rightsRef: string;
+    basis: "spdx";
+    spdxId: string;
+}, {
+    inputRef: string;
+    rightsRef: string;
+    basis: "spdx";
+    spdxId: string;
+}>, z.ZodObject<{
+    inputRef: z.ZodString;
+    rightsRef: z.ZodString;
+    basis: z.ZodLiteral<"authorization">;
+    authorizationRef: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    inputRef: string;
+    rightsRef: string;
+    basis: "authorization";
+    authorizationRef: string;
+}, {
+    inputRef: string;
+    rightsRef: string;
+    basis: "authorization";
+    authorizationRef: string;
+}>]>;
+export type InputRightsRefV1 = z.infer<typeof InputRightsRefV1Schema>;
+/** Identity of parser code bound by the durable evaluator enable marker. */
+export declare const TrustedParserIdentityV1Schema: z.ZodObject<{
+    id: z.ZodString;
+    version: z.ZodString;
+    digest: z.ZodString;
+    bundleId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    version: string;
+    digest: string;
+    bundleId: string;
+}, {
+    id: string;
+    version: string;
+    digest: string;
+    bundleId: string;
+}>;
+export type TrustedParserIdentityV1 = z.infer<typeof TrustedParserIdentityV1Schema>;
+export declare const EnvironmentBuildRequestV1Schema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"jinn.environment-build-request.v1">;
+    repo: z.ZodString;
+    repoUrl: z.ZodString;
+    baseCommit: z.ZodString;
+    language: z.ZodOptional<z.ZodString>;
+    workspaceHint: z.ZodOptional<z.ZodString>;
+    testPathHints: z.ZodArray<z.ZodString, "many">;
+    commandHints: z.ZodArray<z.ZodString, "many">;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: "jinn.environment-build-request.v1";
+    repo: string;
+    repoUrl: string;
+    baseCommit: string;
+    testPathHints: string[];
+    commandHints: string[];
+    language?: string | undefined;
+    workspaceHint?: string | undefined;
+}, {
+    schemaVersion: "jinn.environment-build-request.v1";
+    repo: string;
+    repoUrl: string;
+    baseCommit: string;
+    testPathHints: string[];
+    commandHints: string[];
+    language?: string | undefined;
+    workspaceHint?: string | undefined;
+}>;
+export type EnvironmentBuildRequestV1 = z.infer<typeof EnvironmentBuildRequestV1Schema>;
+export declare const EnvironmentBuildRecipeV1Schema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"jinn.environment-build-recipe.v1">;
+    recipeId: z.ZodString;
+    source: z.ZodObject<{
+        repo: z.ZodString;
+        repoUrl: z.ZodString;
+        baseCommit: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        repo: string;
+        repoUrl: string;
+        baseCommit: string;
+    }, {
+        repo: string;
+        repoUrl: string;
+        baseCommit: string;
+    }>;
+    platform: z.ZodLiteral<"linux/amd64">;
+    baseImage: z.ZodEffects<z.ZodObject<{
+        reference: z.ZodString;
+        digest: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        reference: string;
+        digest: string;
+    }, {
+        reference: string;
+        digest: string;
+    }>, {
+        reference: string;
+        digest: string;
+    }, {
+        reference: string;
+        digest: string;
+    }>;
+    workspace: z.ZodLiteral<"/testbed">;
+    installCommands: z.ZodArray<z.ZodObject<{
+        bin: z.ZodString;
+        args: z.ZodArray<z.ZodString, "many">;
+        cwd: z.ZodOptional<z.ZodString>;
+        environment: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strict", z.ZodTypeAny, {
+        args: string[];
+        bin: string;
+        cwd?: string | undefined;
+        environment?: Record<string, string> | undefined;
+    }, {
+        args: string[];
+        bin: string;
+        cwd?: string | undefined;
+        environment?: Record<string, string> | undefined;
+    }>, "many">;
+    smokeCommands: z.ZodArray<z.ZodObject<{
+        bin: z.ZodString;
+        args: z.ZodArray<z.ZodString, "many">;
+        cwd: z.ZodOptional<z.ZodString>;
+        environment: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strict", z.ZodTypeAny, {
+        args: string[];
+        bin: string;
+        cwd?: string | undefined;
+        environment?: Record<string, string> | undefined;
+    }, {
+        args: string[];
+        bin: string;
+        cwd?: string | undefined;
+        environment?: Record<string, string> | undefined;
+    }>, "many">;
+    testCommands: z.ZodArray<z.ZodObject<{
+        bin: z.ZodString;
+        args: z.ZodArray<z.ZodString, "many">;
+        cwd: z.ZodOptional<z.ZodString>;
+        environment: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strict", z.ZodTypeAny, {
+        args: string[];
+        bin: string;
+        cwd?: string | undefined;
+        environment?: Record<string, string> | undefined;
+    }, {
+        args: string[];
+        bin: string;
+        cwd?: string | undefined;
+        environment?: Record<string, string> | undefined;
+    }>, "many">;
+    parser: z.ZodObject<{
+        id: z.ZodString;
+        version: z.ZodString;
+        digest: z.ZodString;
+        bundleId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        version: string;
+        digest: string;
+        bundleId: string;
+    }, {
+        id: string;
+        version: string;
+        digest: string;
+        bundleId: string;
+    }>;
+    inputRights: z.ZodArray<z.ZodUnion<[z.ZodObject<{
+        inputRef: z.ZodString;
+        rightsRef: z.ZodString;
+        basis: z.ZodLiteral<"spdx">;
+        spdxId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        inputRef: string;
+        rightsRef: string;
+        basis: "spdx";
+        spdxId: string;
+    }, {
+        inputRef: string;
+        rightsRef: string;
+        basis: "spdx";
+        spdxId: string;
+    }>, z.ZodObject<{
+        inputRef: z.ZodString;
+        rightsRef: z.ZodString;
+        basis: z.ZodLiteral<"authorization">;
+        authorizationRef: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        inputRef: string;
+        rightsRef: string;
+        basis: "authorization";
+        authorizationRef: string;
+    }, {
+        inputRef: string;
+        rightsRef: string;
+        basis: "authorization";
+        authorizationRef: string;
+    }>]>, "many">;
+    timeoutSeconds: z.ZodNumber;
+    environment: z.ZodRecord<z.ZodString, z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    source: {
+        repo: string;
+        repoUrl: string;
+        baseCommit: string;
+    };
+    schemaVersion: "jinn.environment-build-recipe.v1";
+    environment: Record<string, string>;
+    recipeId: string;
+    platform: "linux/amd64";
+    baseImage: {
+        reference: string;
+        digest: string;
+    };
+    workspace: "/testbed";
+    installCommands: {
+        args: string[];
+        bin: string;
+        cwd?: string | undefined;
+        environment?: Record<string, string> | undefined;
+    }[];
+    smokeCommands: {
+        args: string[];
+        bin: string;
+        cwd?: string | undefined;
+        environment?: Record<string, string> | undefined;
+    }[];
+    testCommands: {
+        args: string[];
+        bin: string;
+        cwd?: string | undefined;
+        environment?: Record<string, string> | undefined;
+    }[];
+    parser: {
+        id: string;
+        version: string;
+        digest: string;
+        bundleId: string;
+    };
+    inputRights: ({
+        inputRef: string;
+        rightsRef: string;
+        basis: "spdx";
+        spdxId: string;
+    } | {
+        inputRef: string;
+        rightsRef: string;
+        basis: "authorization";
+        authorizationRef: string;
+    })[];
+    timeoutSeconds: number;
+}, {
+    source: {
+        repo: string;
+        repoUrl: string;
+        baseCommit: string;
+    };
+    schemaVersion: "jinn.environment-build-recipe.v1";
+    environment: Record<string, string>;
+    recipeId: string;
+    platform: "linux/amd64";
+    baseImage: {
+        reference: string;
+        digest: string;
+    };
+    workspace: "/testbed";
+    installCommands: {
+        args: string[];
+        bin: string;
+        cwd?: string | undefined;
+        environment?: Record<string, string> | undefined;
+    }[];
+    smokeCommands: {
+        args: string[];
+        bin: string;
+        cwd?: string | undefined;
+        environment?: Record<string, string> | undefined;
+    }[];
+    testCommands: {
+        args: string[];
+        bin: string;
+        cwd?: string | undefined;
+        environment?: Record<string, string> | undefined;
+    }[];
+    parser: {
+        id: string;
+        version: string;
+        digest: string;
+        bundleId: string;
+    };
+    inputRights: ({
+        inputRef: string;
+        rightsRef: string;
+        basis: "spdx";
+        spdxId: string;
+    } | {
+        inputRef: string;
+        rightsRef: string;
+        basis: "authorization";
+        authorizationRef: string;
+    })[];
+    timeoutSeconds: number;
+}>;
+export type EnvironmentBuildRecipeV1 = z.infer<typeof EnvironmentBuildRecipeV1Schema>;
+export declare const Eip191EnvironmentAttestationV1Schema: z.ZodObject<{
+    scheme: z.ZodLiteral<"eip191">;
+    algo: z.ZodLiteral<"secp256k1">;
+    environmentHash: z.ZodString;
+    operatorSafe: z.ZodString;
+    signer: z.ZodString;
+    signature: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    signature: string;
+    scheme: "eip191";
+    algo: "secp256k1";
+    signer: string;
+    environmentHash: string;
+    operatorSafe: string;
+}, {
+    signature: string;
+    scheme: "eip191";
+    algo: "secp256k1";
+    signer: string;
+    environmentHash: string;
+    operatorSafe: string;
+}>;
+export type Eip191EnvironmentAttestationV1 = z.infer<typeof Eip191EnvironmentAttestationV1Schema>;
+/** Domain-separated EIP-191 message for an immutable evaluator environment. */
+export declare function environmentAttestationMessageV1(environmentHash: string): string;
+/**
+ * Verify the signer named by a parsed attestation. This deliberately verifies
+ * the hash-bound domain message rather than merely checking signature shape.
+ */
+export declare function verifyEnvironmentAttestationV1(attestation: Eip191EnvironmentAttestationV1): Promise<boolean>;
+/** Structural schema used only while computing the non-self-referential hash. */
+declare const TaskEnvironmentSpecV1BaseSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"jinn.task-environment.v1">;
+    source: z.ZodObject<{
+        repo: z.ZodString;
+        repoUrl: z.ZodString;
+        baseCommit: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        repo: string;
+        repoUrl: string;
+        baseCommit: string;
+    }, {
+        repo: string;
+        repoUrl: string;
+        baseCommit: string;
+    }>;
+    inputs: z.ZodArray<z.ZodEffects<z.ZodObject<{
+        inputRef: z.ZodString;
+        sha256: z.ZodString;
+        rights: z.ZodUnion<[z.ZodObject<{
+            inputRef: z.ZodString;
+            rightsRef: z.ZodString;
+            basis: z.ZodLiteral<"spdx">;
+            spdxId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        }, {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        }>, z.ZodObject<{
+            inputRef: z.ZodString;
+            rightsRef: z.ZodString;
+            basis: z.ZodLiteral<"authorization">;
+            authorizationRef: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        }, {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        }>]>;
+    }, "strict", z.ZodTypeAny, {
+        sha256: string;
+        inputRef: string;
+        rights: {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        } | {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        };
+    }, {
+        sha256: string;
+        inputRef: string;
+        rights: {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        } | {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        };
+    }>, {
+        sha256: string;
+        inputRef: string;
+        rights: {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        } | {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        };
+    }, {
+        sha256: string;
+        inputRef: string;
+        rights: {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        } | {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        };
+    }>, "many">;
+    execution: z.ZodObject<{
+        platform: z.ZodLiteral<"linux/amd64">;
+        workspace: z.ZodLiteral<"/testbed">;
+        image: z.ZodEffects<z.ZodObject<{
+            reference: z.ZodString;
+            digest: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            reference: string;
+            digest: string;
+        }, {
+            reference: string;
+            digest: string;
+        }>, {
+            reference: string;
+            digest: string;
+        }, {
+            reference: string;
+            digest: string;
+        }>;
+        testCommands: z.ZodArray<z.ZodObject<{
+            bin: z.ZodString;
+            args: z.ZodArray<z.ZodString, "many">;
+            cwd: z.ZodOptional<z.ZodString>;
+            environment: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, "strict", z.ZodTypeAny, {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }, {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }>, "many">;
+        parser: z.ZodObject<{
+            id: z.ZodString;
+            version: z.ZodString;
+            digest: z.ZodString;
+            bundleId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        }, {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        }>;
+        timeoutSeconds: z.ZodNumber;
+        environment: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        image: {
+            reference: string;
+            digest: string;
+        };
+        environment: Record<string, string>;
+        platform: "linux/amd64";
+        workspace: "/testbed";
+        testCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        parser: {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        };
+        timeoutSeconds: number;
+    }, {
+        image: {
+            reference: string;
+            digest: string;
+        };
+        environment: Record<string, string>;
+        platform: "linux/amd64";
+        workspace: "/testbed";
+        testCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        parser: {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        };
+        timeoutSeconds: number;
+    }>;
+    build: z.ZodObject<{
+        recipeCid: z.ZodString;
+        recipeHash: z.ZodString;
+        provider: z.ZodEnum<["explicit", "deterministic", "agentic"]>;
+        providerId: z.ZodString;
+        providerVersion: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        recipeCid: string;
+        recipeHash: string;
+        provider: "explicit" | "deterministic" | "agentic";
+        providerId: string;
+        providerVersion: string;
+    }, {
+        recipeCid: string;
+        recipeHash: string;
+        provider: "explicit" | "deterministic" | "agentic";
+        providerId: string;
+        providerVersion: string;
+    }>;
+    publication: z.ZodObject<{
+        publicRepoVerifiedAt: z.ZodString;
+        rightsPolicyVersion: z.ZodString;
+        buildSmoke: z.ZodLiteral<"pass">;
+        imageSecretScan: z.ZodLiteral<"pass">;
+        sbomCid: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        publicRepoVerifiedAt: string;
+        rightsPolicyVersion: string;
+        buildSmoke: "pass";
+        imageSecretScan: "pass";
+        sbomCid: string;
+    }, {
+        publicRepoVerifiedAt: string;
+        rightsPolicyVersion: string;
+        buildSmoke: "pass";
+        imageSecretScan: "pass";
+        sbomCid: string;
+    }>;
+    attestation: z.ZodObject<{
+        scheme: z.ZodLiteral<"eip191">;
+        algo: z.ZodLiteral<"secp256k1">;
+        environmentHash: z.ZodString;
+        operatorSafe: z.ZodString;
+        signer: z.ZodString;
+        signature: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        signature: string;
+        scheme: "eip191";
+        algo: "secp256k1";
+        signer: string;
+        environmentHash: string;
+        operatorSafe: string;
+    }, {
+        signature: string;
+        scheme: "eip191";
+        algo: "secp256k1";
+        signer: string;
+        environmentHash: string;
+        operatorSafe: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    source: {
+        repo: string;
+        repoUrl: string;
+        baseCommit: string;
+    };
+    inputs: {
+        sha256: string;
+        inputRef: string;
+        rights: {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        } | {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        };
+    }[];
+    schemaVersion: "jinn.task-environment.v1";
+    execution: {
+        image: {
+            reference: string;
+            digest: string;
+        };
+        environment: Record<string, string>;
+        platform: "linux/amd64";
+        workspace: "/testbed";
+        testCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        parser: {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        };
+        timeoutSeconds: number;
+    };
+    build: {
+        recipeCid: string;
+        recipeHash: string;
+        provider: "explicit" | "deterministic" | "agentic";
+        providerId: string;
+        providerVersion: string;
+    };
+    publication: {
+        publicRepoVerifiedAt: string;
+        rightsPolicyVersion: string;
+        buildSmoke: "pass";
+        imageSecretScan: "pass";
+        sbomCid: string;
+    };
+    attestation: {
+        signature: string;
+        scheme: "eip191";
+        algo: "secp256k1";
+        signer: string;
+        environmentHash: string;
+        operatorSafe: string;
+    };
+}, {
+    source: {
+        repo: string;
+        repoUrl: string;
+        baseCommit: string;
+    };
+    inputs: {
+        sha256: string;
+        inputRef: string;
+        rights: {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        } | {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        };
+    }[];
+    schemaVersion: "jinn.task-environment.v1";
+    execution: {
+        image: {
+            reference: string;
+            digest: string;
+        };
+        environment: Record<string, string>;
+        platform: "linux/amd64";
+        workspace: "/testbed";
+        testCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        parser: {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        };
+        timeoutSeconds: number;
+    };
+    build: {
+        recipeCid: string;
+        recipeHash: string;
+        provider: "explicit" | "deterministic" | "agentic";
+        providerId: string;
+        providerVersion: string;
+    };
+    publication: {
+        publicRepoVerifiedAt: string;
+        rightsPolicyVersion: string;
+        buildSmoke: "pass";
+        imageSecretScan: "pass";
+        sbomCid: string;
+    };
+    attestation: {
+        signature: string;
+        scheme: "eip191";
+        algo: "secp256k1";
+        signer: string;
+        environmentHash: string;
+        operatorSafe: string;
+    };
+}>;
+export type TaskEnvironmentSpecV1 = z.infer<typeof TaskEnvironmentSpecV1BaseSchema>;
+/**
+ * The signed hash covers only immutable build/publication bindings. The
+ * verification timestamp is an observation, and the attestation would make a
+ * self-referential signing payload, so neither is included.
+ */
+export declare function taskEnvironmentHashPayloadV1(spec: TaskEnvironmentSpecV1): object;
+export declare function hashTaskEnvironmentSpecV1(spec: TaskEnvironmentSpecV1): `sha256:${string}`;
+/**
+ * Public task-environment parser. It binds the EIP-191 payload to the exact
+ * canonical immutable environment body before consumers may trust the spec.
+ */
+export declare const TaskEnvironmentSpecV1Schema: z.ZodEffects<z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"jinn.task-environment.v1">;
+    source: z.ZodObject<{
+        repo: z.ZodString;
+        repoUrl: z.ZodString;
+        baseCommit: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        repo: string;
+        repoUrl: string;
+        baseCommit: string;
+    }, {
+        repo: string;
+        repoUrl: string;
+        baseCommit: string;
+    }>;
+    inputs: z.ZodArray<z.ZodEffects<z.ZodObject<{
+        inputRef: z.ZodString;
+        sha256: z.ZodString;
+        rights: z.ZodUnion<[z.ZodObject<{
+            inputRef: z.ZodString;
+            rightsRef: z.ZodString;
+            basis: z.ZodLiteral<"spdx">;
+            spdxId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        }, {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        }>, z.ZodObject<{
+            inputRef: z.ZodString;
+            rightsRef: z.ZodString;
+            basis: z.ZodLiteral<"authorization">;
+            authorizationRef: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        }, {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        }>]>;
+    }, "strict", z.ZodTypeAny, {
+        sha256: string;
+        inputRef: string;
+        rights: {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        } | {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        };
+    }, {
+        sha256: string;
+        inputRef: string;
+        rights: {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        } | {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        };
+    }>, {
+        sha256: string;
+        inputRef: string;
+        rights: {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        } | {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        };
+    }, {
+        sha256: string;
+        inputRef: string;
+        rights: {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        } | {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        };
+    }>, "many">;
+    execution: z.ZodObject<{
+        platform: z.ZodLiteral<"linux/amd64">;
+        workspace: z.ZodLiteral<"/testbed">;
+        image: z.ZodEffects<z.ZodObject<{
+            reference: z.ZodString;
+            digest: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            reference: string;
+            digest: string;
+        }, {
+            reference: string;
+            digest: string;
+        }>, {
+            reference: string;
+            digest: string;
+        }, {
+            reference: string;
+            digest: string;
+        }>;
+        testCommands: z.ZodArray<z.ZodObject<{
+            bin: z.ZodString;
+            args: z.ZodArray<z.ZodString, "many">;
+            cwd: z.ZodOptional<z.ZodString>;
+            environment: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, "strict", z.ZodTypeAny, {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }, {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }>, "many">;
+        parser: z.ZodObject<{
+            id: z.ZodString;
+            version: z.ZodString;
+            digest: z.ZodString;
+            bundleId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        }, {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        }>;
+        timeoutSeconds: z.ZodNumber;
+        environment: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        image: {
+            reference: string;
+            digest: string;
+        };
+        environment: Record<string, string>;
+        platform: "linux/amd64";
+        workspace: "/testbed";
+        testCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        parser: {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        };
+        timeoutSeconds: number;
+    }, {
+        image: {
+            reference: string;
+            digest: string;
+        };
+        environment: Record<string, string>;
+        platform: "linux/amd64";
+        workspace: "/testbed";
+        testCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        parser: {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        };
+        timeoutSeconds: number;
+    }>;
+    build: z.ZodObject<{
+        recipeCid: z.ZodString;
+        recipeHash: z.ZodString;
+        provider: z.ZodEnum<["explicit", "deterministic", "agentic"]>;
+        providerId: z.ZodString;
+        providerVersion: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        recipeCid: string;
+        recipeHash: string;
+        provider: "explicit" | "deterministic" | "agentic";
+        providerId: string;
+        providerVersion: string;
+    }, {
+        recipeCid: string;
+        recipeHash: string;
+        provider: "explicit" | "deterministic" | "agentic";
+        providerId: string;
+        providerVersion: string;
+    }>;
+    publication: z.ZodObject<{
+        publicRepoVerifiedAt: z.ZodString;
+        rightsPolicyVersion: z.ZodString;
+        buildSmoke: z.ZodLiteral<"pass">;
+        imageSecretScan: z.ZodLiteral<"pass">;
+        sbomCid: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        publicRepoVerifiedAt: string;
+        rightsPolicyVersion: string;
+        buildSmoke: "pass";
+        imageSecretScan: "pass";
+        sbomCid: string;
+    }, {
+        publicRepoVerifiedAt: string;
+        rightsPolicyVersion: string;
+        buildSmoke: "pass";
+        imageSecretScan: "pass";
+        sbomCid: string;
+    }>;
+    attestation: z.ZodObject<{
+        scheme: z.ZodLiteral<"eip191">;
+        algo: z.ZodLiteral<"secp256k1">;
+        environmentHash: z.ZodString;
+        operatorSafe: z.ZodString;
+        signer: z.ZodString;
+        signature: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        signature: string;
+        scheme: "eip191";
+        algo: "secp256k1";
+        signer: string;
+        environmentHash: string;
+        operatorSafe: string;
+    }, {
+        signature: string;
+        scheme: "eip191";
+        algo: "secp256k1";
+        signer: string;
+        environmentHash: string;
+        operatorSafe: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    source: {
+        repo: string;
+        repoUrl: string;
+        baseCommit: string;
+    };
+    inputs: {
+        sha256: string;
+        inputRef: string;
+        rights: {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        } | {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        };
+    }[];
+    schemaVersion: "jinn.task-environment.v1";
+    execution: {
+        image: {
+            reference: string;
+            digest: string;
+        };
+        environment: Record<string, string>;
+        platform: "linux/amd64";
+        workspace: "/testbed";
+        testCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        parser: {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        };
+        timeoutSeconds: number;
+    };
+    build: {
+        recipeCid: string;
+        recipeHash: string;
+        provider: "explicit" | "deterministic" | "agentic";
+        providerId: string;
+        providerVersion: string;
+    };
+    publication: {
+        publicRepoVerifiedAt: string;
+        rightsPolicyVersion: string;
+        buildSmoke: "pass";
+        imageSecretScan: "pass";
+        sbomCid: string;
+    };
+    attestation: {
+        signature: string;
+        scheme: "eip191";
+        algo: "secp256k1";
+        signer: string;
+        environmentHash: string;
+        operatorSafe: string;
+    };
+}, {
+    source: {
+        repo: string;
+        repoUrl: string;
+        baseCommit: string;
+    };
+    inputs: {
+        sha256: string;
+        inputRef: string;
+        rights: {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        } | {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        };
+    }[];
+    schemaVersion: "jinn.task-environment.v1";
+    execution: {
+        image: {
+            reference: string;
+            digest: string;
+        };
+        environment: Record<string, string>;
+        platform: "linux/amd64";
+        workspace: "/testbed";
+        testCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        parser: {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        };
+        timeoutSeconds: number;
+    };
+    build: {
+        recipeCid: string;
+        recipeHash: string;
+        provider: "explicit" | "deterministic" | "agentic";
+        providerId: string;
+        providerVersion: string;
+    };
+    publication: {
+        publicRepoVerifiedAt: string;
+        rightsPolicyVersion: string;
+        buildSmoke: "pass";
+        imageSecretScan: "pass";
+        sbomCid: string;
+    };
+    attestation: {
+        signature: string;
+        scheme: "eip191";
+        algo: "secp256k1";
+        signer: string;
+        environmentHash: string;
+        operatorSafe: string;
+    };
+}>, {
+    source: {
+        repo: string;
+        repoUrl: string;
+        baseCommit: string;
+    };
+    inputs: {
+        sha256: string;
+        inputRef: string;
+        rights: {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        } | {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        };
+    }[];
+    schemaVersion: "jinn.task-environment.v1";
+    execution: {
+        image: {
+            reference: string;
+            digest: string;
+        };
+        environment: Record<string, string>;
+        platform: "linux/amd64";
+        workspace: "/testbed";
+        testCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        parser: {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        };
+        timeoutSeconds: number;
+    };
+    build: {
+        recipeCid: string;
+        recipeHash: string;
+        provider: "explicit" | "deterministic" | "agentic";
+        providerId: string;
+        providerVersion: string;
+    };
+    publication: {
+        publicRepoVerifiedAt: string;
+        rightsPolicyVersion: string;
+        buildSmoke: "pass";
+        imageSecretScan: "pass";
+        sbomCid: string;
+    };
+    attestation: {
+        signature: string;
+        scheme: "eip191";
+        algo: "secp256k1";
+        signer: string;
+        environmentHash: string;
+        operatorSafe: string;
+    };
+}, {
+    source: {
+        repo: string;
+        repoUrl: string;
+        baseCommit: string;
+    };
+    inputs: {
+        sha256: string;
+        inputRef: string;
+        rights: {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        } | {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        };
+    }[];
+    schemaVersion: "jinn.task-environment.v1";
+    execution: {
+        image: {
+            reference: string;
+            digest: string;
+        };
+        environment: Record<string, string>;
+        platform: "linux/amd64";
+        workspace: "/testbed";
+        testCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        parser: {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        };
+        timeoutSeconds: number;
+    };
+    build: {
+        recipeCid: string;
+        recipeHash: string;
+        provider: "explicit" | "deterministic" | "agentic";
+        providerId: string;
+        providerVersion: string;
+    };
+    publication: {
+        publicRepoVerifiedAt: string;
+        rightsPolicyVersion: string;
+        buildSmoke: "pass";
+        imageSecretScan: "pass";
+        sbomCid: string;
+    };
+    attestation: {
+        signature: string;
+        scheme: "eip191";
+        algo: "secp256k1";
+        signer: string;
+        environmentHash: string;
+        operatorSafe: string;
+    };
+}>;
+export declare function parseTaskEnvironmentSpecV1(input: unknown): TaskEnvironmentSpecV1;
+export {};