@jinn-network/client 0.1.9 → 0.2.0

package/dist/task-creator/environment/publication.js

@@ -0,0 +1,139 @@
+// SPDX-License-Identifier: Apache-2.0
+import { createHash } from 'node:crypto';
+import { ENVIRONMENT_BUILD_RECIPE_V1, TASK_ENVIRONMENT_SPEC_V1, DigestQualifiedImageV1Schema, EnvironmentBuildRecipeV1Schema, hashTaskEnvironmentSpecV1, parseTaskEnvironmentSpecV1, } from './contracts.js';
+import { canonicalJson } from '../../harnesses/engine/canonical-json.js';
+import { DEFAULT_PUBLICATION_RIGHTS_POLICY_VERSION, evaluateDefaultRightsPolicy, isApprovedImage, } from './policy.js';
+import { APPROVED_BASE_IMAGES } from './recipes.js';
+export const DEFAULT_ENVIRONMENT_IMAGE_REPOSITORY = 'ghcr.io/jinn-network/task-environment';
+/**
+ * Orders local build evidence and public disclosure so a failed gate leaves no
+ * registry or artifact-store side effect behind.
+ */
+export class EnvironmentPublicationController {
+    dependencies;
+    approvedBaseImages;
+    imageRepository;
+    clock;
+    constructor(dependencies) {
+        this.dependencies = dependencies;
+        this.approvedBaseImages = dependencies.approvedBaseImages ?? APPROVED_BASE_IMAGES;
+        this.imageRepository = dependencies.imageRepository ?? DEFAULT_ENVIRONMENT_IMAGE_REPOSITORY;
+        this.clock = dependencies.clock ?? (() => new Date());
+    }
+    async publish(rawRecipe) {
+        const recipe = EnvironmentBuildRecipeV1Schema.parse(rawRecipe);
+        assertSourceBinding(recipe);
+        if (!isApprovedImage(recipe.baseImage, this.approvedBaseImages)) {
+            throw new Error('environment base image is not approved for publication');
+        }
+        const verifiedInputs = await this.verifyInputRights(recipe.inputRights);
+        const rights = evaluateDefaultRightsPolicy({ inputRights: recipe.inputRights, verifiedInputs });
+        if (!rights.allowed)
+            throw new Error(`environment publication rights denied: ${rights.code}`);
+        const built = await this.dependencies.builder.build(recipe);
+        if (built.platform !== recipe.platform || built.workspace !== recipe.workspace || built.smoke.status !== 'pass') {
+            throw new Error('local environment build did not satisfy its immutable recipe');
+        }
+        const scan = await this.dependencies.scanner.scan(built);
+        if (scan.status !== 'pass')
+            throw new Error('environment secret scan failed');
+        const sbom = await this.dependencies.sbomGenerator.generate(built);
+        const publishedImage = await this.dependencies.publisher.publish({ image: built, repository: this.imageRepository });
+        const parsedImage = DigestQualifiedImageV1Schema.parse(publishedImage);
+        const image = {
+            reference: parsedImage.reference,
+            digest: parsedImage.digest,
+        };
+        assertPublishedImageRepository(image, this.imageRepository);
+        const recipeUpload = await this.dependencies.uploader.upload({ kind: 'recipe', document: recipe });
+        const sbomUpload = await this.dependencies.uploader.upload({ kind: 'sbom', document: sbom.document });
+        const unsigned = this.unsignedSpec(recipe, image, recipeUpload.cid, sbomUpload.cid);
+        const attestation = await this.dependencies.attestor.attest({ environmentHash: hashTaskEnvironmentSpecV1(unsigned) });
+        const spec = parseTaskEnvironmentSpecV1({ ...unsigned, attestation });
+        const environmentUpload = await this.dependencies.uploader.upload({ kind: 'environment', document: spec });
+        if (!environmentUpload.cid.trim())
+            throw new Error('environment publication returned no environment CID');
+        return { spec, environmentCid: environmentUpload.cid };
+    }
+    async verifyInputRights(inputRights) {
+        const verifiedInputs = {};
+        for (const rights of inputRights) {
+            const input = parseGitHubInputRef(rights.inputRef);
+            const facts = await this.dependencies.githubChecker.check(input);
+            if (facts.inputRef !== rights.inputRef) {
+                throw new Error(`GitHub evidence did not bind the declared input: ${rights.inputRef}`);
+            }
+            verifiedInputs[rights.inputRef] = facts;
+        }
+        return verifiedInputs;
+    }
+    unsignedSpec(recipe, image, recipeCid, sbomCid) {
+        return {
+            schemaVersion: TASK_ENVIRONMENT_SPEC_V1,
+            source: recipe.source,
+            inputs: recipe.inputRights.map((rights) => ({
+                inputRef: rights.inputRef,
+                sha256: sha256Canonical({ inputRef: rights.inputRef, rights }),
+                rights,
+            })),
+            execution: {
+                platform: recipe.platform,
+                workspace: recipe.workspace,
+                image,
+                testCommands: recipe.testCommands,
+                parser: recipe.parser,
+                timeoutSeconds: recipe.timeoutSeconds,
+                environment: recipe.environment,
+            },
+            build: {
+                recipeCid,
+                recipeHash: sha256Canonical({ schemaVersion: ENVIRONMENT_BUILD_RECIPE_V1, recipe }),
+                provider: 'explicit',
+                providerId: recipe.recipeId,
+                providerVersion: 'v1',
+            },
+            publication: {
+                publicRepoVerifiedAt: this.clock().toISOString(),
+                rightsPolicyVersion: DEFAULT_PUBLICATION_RIGHTS_POLICY_VERSION,
+                buildSmoke: 'pass',
+                imageSecretScan: 'pass',
+                sbomCid,
+            },
+            attestation: {
+                scheme: 'eip191',
+                algo: 'secp256k1',
+                environmentHash: sha256Canonical({ provisional: 'attestation-not-signed' }),
+                operatorSafe: '0x0000000000000000000000000000000000000000',
+                signer: '0x0000000000000000000000000000000000000000',
+                signature: `0x${'0'.repeat(130)}`,
+            },
+        };
+    }
+}
+function assertSourceBinding(recipe) {
+    const canonicalRepoUrl = `https://github.com/${recipe.source.repo}.git`;
+    if (recipe.source.repoUrl !== canonicalRepoUrl) {
+        throw new Error('environment source.repoUrl must equal the canonical GitHub URL for source.repo');
+    }
+    const sourceInputRef = `git+${recipe.source.repoUrl}#${recipe.source.baseCommit}`;
+    if (!recipe.inputRights.some((rights) => rights.inputRef === sourceInputRef)) {
+        throw new Error('environment recipe requires an exact source input-rights record');
+    }
+}
+function parseGitHubInputRef(inputRef) {
+    const match = /^git\+https:\/\/github\.com\/([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)\.git#([0-9a-f]{40})$/.exec(inputRef);
+    if (!match)
+        throw new Error(`publication requires a GitHub input pinned to a full commit: ${inputRef}`);
+    return { repo: match[1], baseCommit: match[2] };
+}
+function assertPublishedImageRepository(image, imageRepository) {
+    const prefix = `${imageRepository}/`;
+    const digestOffset = image.reference.lastIndexOf('@');
+    if (!image.reference.startsWith(prefix) || digestOffset <= prefix.length) {
+        throw new Error('image publisher must return an image in the requested image repository');
+    }
+}
+function sha256Canonical(value) {
+    return `sha256:${createHash('sha256').update(canonicalJson(value)).digest('hex')}`;
+}
+//# sourceMappingURL=publication.js.map

package/dist/task-creator/environment/publication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publication.js","sourceRoot":"","sources":["../../../src/task-creator/environment/publication.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,4BAA4B,EAC5B,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,GAI3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AAUzE,OAAO,EACL,yCAAyC,EACzC,2BAA2B,EAC3B,eAAe,GAGhB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,MAAM,CAAC,MAAM,oCAAoC,GAAG,uCAAgD,CAAC;AAwBrG;;;GAGG;AACH,MAAM,OAAO,gCAAgC;IAKd;IAJZ,kBAAkB,CAA2B;IAC7C,eAAe,CAAS;IACxB,KAAK,CAAa;IAEnC,YAA6B,YAA0D;QAA1D,iBAAY,GAAZ,YAAY,CAA8C;QACrF,IAAI,CAAC,kBAAkB,GAAG,YAAY,CAAC,kBAAkB,IAAI,oBAAoB,CAAC;QAClF,IAAI,CAAC,eAAe,GAAG,YAAY,CAAC,eAAe,IAAI,oCAAoC,CAAC;QAC5F,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAmC;QAC/C,MAAM,MAAM,GAAG,8BAA8B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/D,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,2BAA2B,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAE9F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChH,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEnE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QACrH,MAAM,WAAW,GAAG,4BAA4B,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG;YACZ,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,MAAM,EAAE,WAAW,CAAC,MAA4B;SACjD,CAAC;QACF,8BAA8B,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAE5D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACnG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtG,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QACpF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtH,MAAM,IAAI,GAAG,0BAA0B,CAAC,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QACtE,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC1G,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,iBAAiB,CAAC,GAAG,EAAE,CAAC;IACzD,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,WAAwC;QACtE,MAAM,cAAc,GAAkD,EAAE,CAAC;QACzE,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,oDAAoD,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QAC1C,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IAEO,YAAY,CAClB,MAAgC,EAChC,KAAwD,EACxD,SAAiB,EACjB,OAAe;QAEf,OAAO;YACL,aAAa,EAAE,wBAAwB;YACvC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC1C,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAC9D,MAAM;aACP,CAAC,CAAC;YACH,SAAS,EAAE;gBACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK;gBACL,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC;YACD,KAAK,EAAE;gBACL,SAAS;gBACT,UAAU,EAAE,eAAe,CAAC,EAAE,aAAa,EAAE,2BAA2B,EAAE,MAAM,EAAE,CAAC;gBACnF,QAAQ,EAAE,UAAU;gBACpB,UAAU,EAAE,MAAM,CAAC,QAAQ;gBAC3B,eAAe,EAAE,IAAI;aACtB;YACD,WAAW,EAAE;gBACX,oBAAoB,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;gBAChD,mBAAmB,EAAE,yCAAyC;gBAC9D,UAAU,EAAE,MAAM;gBAClB,eAAe,EAAE,MAAM;gBACvB,OAAO;aACR;YACD,WAAW,EAAE;gBACX,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,WAAW;gBACjB,eAAe,EAAE,eAAe,CAAC,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;gBAC3E,YAAY,EAAE,4CAA4C;gBAC1D,MAAM,EAAE,4CAA4C;gBACpD,SAAS,EAAE,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAClC;SACF,CAAC;IACJ,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,MAAgC;IAC3D,MAAM,gBAAgB,GAAG,sBAAsB,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;IACxE,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,gBAAgB,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IAClF,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,cAAc,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,KAAK,GAAG,sFAAsF,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpH,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,QAAQ,EAAE,CAAC,CAAC;IACxG,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,8BAA8B,CACrC,KAAwD,EACxD,eAAuB;IAEvB,MAAM,MAAM,GAAG,GAAG,eAAe,GAAG,CAAC;IACrC,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACrF,CAAC"}

package/dist/task-creator/environment/publish-cli.d.ts

@@ -0,0 +1,427 @@
+import { z } from 'zod/v3';
+import { type Eip191EnvironmentAttestationV1, type EnvironmentBuildRecipeV1 } from './contracts.js';
+import { type EnvironmentCommandRunner } from './adapters.js';
+import { type GitHubFetch } from './github.js';
+import type { EnvironmentAttestor } from './interfaces.js';
+import { type EnvironmentPublicationControllerDependencies, type PublishedTaskEnvironmentV1 } from './publication.js';
+declare const EnvironmentPublicationCliConfigSchema: z.ZodObject<{
+    recipe: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<"jinn.environment-build-recipe.v1">;
+        recipeId: z.ZodString;
+        source: z.ZodObject<{
+            repo: z.ZodString;
+            repoUrl: z.ZodString;
+            baseCommit: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            repo: string;
+            repoUrl: string;
+            baseCommit: string;
+        }, {
+            repo: string;
+            repoUrl: string;
+            baseCommit: string;
+        }>;
+        platform: z.ZodLiteral<"linux/amd64">;
+        baseImage: z.ZodEffects<z.ZodObject<{
+            reference: z.ZodString;
+            digest: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            reference: string;
+            digest: string;
+        }, {
+            reference: string;
+            digest: string;
+        }>, {
+            reference: string;
+            digest: string;
+        }, {
+            reference: string;
+            digest: string;
+        }>;
+        workspace: z.ZodLiteral<"/testbed">;
+        installCommands: z.ZodArray<z.ZodObject<{
+            bin: z.ZodString;
+            args: z.ZodArray<z.ZodString, "many">;
+            cwd: z.ZodOptional<z.ZodString>;
+            environment: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, "strict", z.ZodTypeAny, {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }, {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }>, "many">;
+        smokeCommands: z.ZodArray<z.ZodObject<{
+            bin: z.ZodString;
+            args: z.ZodArray<z.ZodString, "many">;
+            cwd: z.ZodOptional<z.ZodString>;
+            environment: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, "strict", z.ZodTypeAny, {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }, {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }>, "many">;
+        testCommands: z.ZodArray<z.ZodObject<{
+            bin: z.ZodString;
+            args: z.ZodArray<z.ZodString, "many">;
+            cwd: z.ZodOptional<z.ZodString>;
+            environment: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, "strict", z.ZodTypeAny, {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }, {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }>, "many">;
+        parser: z.ZodObject<{
+            id: z.ZodString;
+            version: z.ZodString;
+            digest: z.ZodString;
+            bundleId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        }, {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        }>;
+        inputRights: z.ZodArray<z.ZodUnion<[z.ZodObject<{
+            inputRef: z.ZodString;
+            rightsRef: z.ZodString;
+            basis: z.ZodLiteral<"spdx">;
+            spdxId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        }, {
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        }>, z.ZodObject<{
+            inputRef: z.ZodString;
+            rightsRef: z.ZodString;
+            basis: z.ZodLiteral<"authorization">;
+            authorizationRef: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        }, {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        }>]>, "many">;
+        timeoutSeconds: z.ZodNumber;
+        environment: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        source: {
+            repo: string;
+            repoUrl: string;
+            baseCommit: string;
+        };
+        schemaVersion: "jinn.environment-build-recipe.v1";
+        environment: Record<string, string>;
+        recipeId: string;
+        platform: "linux/amd64";
+        baseImage: {
+            reference: string;
+            digest: string;
+        };
+        workspace: "/testbed";
+        installCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        smokeCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        testCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        parser: {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        };
+        inputRights: ({
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        } | {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        })[];
+        timeoutSeconds: number;
+    }, {
+        source: {
+            repo: string;
+            repoUrl: string;
+            baseCommit: string;
+        };
+        schemaVersion: "jinn.environment-build-recipe.v1";
+        environment: Record<string, string>;
+        recipeId: string;
+        platform: "linux/amd64";
+        baseImage: {
+            reference: string;
+            digest: string;
+        };
+        workspace: "/testbed";
+        installCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        smokeCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        testCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        parser: {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        };
+        inputRights: ({
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        } | {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        })[];
+        timeoutSeconds: number;
+    }>;
+    ipfsRegistryUrl: z.ZodString;
+    operatorSafe: z.ZodString;
+    signer: z.ZodObject<{
+        command: z.ZodEffects<z.ZodString, string, string>;
+    }, "strict", z.ZodTypeAny, {
+        command: string;
+    }, {
+        command: string;
+    }>;
+    imageRepository: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    signer: {
+        command: string;
+    };
+    ipfsRegistryUrl: string;
+    operatorSafe: string;
+    recipe: {
+        source: {
+            repo: string;
+            repoUrl: string;
+            baseCommit: string;
+        };
+        schemaVersion: "jinn.environment-build-recipe.v1";
+        environment: Record<string, string>;
+        recipeId: string;
+        platform: "linux/amd64";
+        baseImage: {
+            reference: string;
+            digest: string;
+        };
+        workspace: "/testbed";
+        installCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        smokeCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        testCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        parser: {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        };
+        inputRights: ({
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        } | {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        })[];
+        timeoutSeconds: number;
+    };
+    imageRepository?: string | undefined;
+}, {
+    signer: {
+        command: string;
+    };
+    ipfsRegistryUrl: string;
+    operatorSafe: string;
+    recipe: {
+        source: {
+            repo: string;
+            repoUrl: string;
+            baseCommit: string;
+        };
+        schemaVersion: "jinn.environment-build-recipe.v1";
+        environment: Record<string, string>;
+        recipeId: string;
+        platform: "linux/amd64";
+        baseImage: {
+            reference: string;
+            digest: string;
+        };
+        workspace: "/testbed";
+        installCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        smokeCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        testCommands: {
+            args: string[];
+            bin: string;
+            cwd?: string | undefined;
+            environment?: Record<string, string> | undefined;
+        }[];
+        parser: {
+            id: string;
+            version: string;
+            digest: string;
+            bundleId: string;
+        };
+        inputRights: ({
+            inputRef: string;
+            rightsRef: string;
+            basis: "spdx";
+            spdxId: string;
+        } | {
+            inputRef: string;
+            rightsRef: string;
+            basis: "authorization";
+            authorizationRef: string;
+        })[];
+        timeoutSeconds: number;
+    };
+    imageRepository?: string | undefined;
+}>;
+export type EnvironmentPublicationCliConfig = z.infer<typeof EnvironmentPublicationCliConfigSchema>;
+export type EnvironmentPublicationCliResult = {
+    mode: 'preflight';
+    recipeId: string;
+    source: {
+        repo: string;
+        baseCommit: string;
+    };
+} | {
+    mode: 'published';
+    environmentCid: string;
+    environmentHash: `sha256:${string}`;
+    imageReference: string;
+};
+type PublicationControllerPort = {
+    publish(recipe: EnvironmentBuildRecipeV1): Promise<PublishedTaskEnvironmentV1>;
+};
+export type EnvironmentPublicationCliDependencies = {
+    commandRunner?: EnvironmentCommandRunner;
+    githubFetch?: GitHubFetch;
+    controllerFactory?: (dependencies: EnvironmentPublicationControllerDependencies) => PublicationControllerPort;
+};
+export type RunEnvironmentPublicationCliInput = EnvironmentPublicationCliDependencies & {
+    rawConfig: unknown;
+    environment?: NodeJS.ProcessEnv;
+    /** Local path for the exact canonical signed environment artifact. Execute mode only. */
+    outputPath?: string;
+};
+/**
+ * Validates an operator-supplied publication config. This object intentionally
+ * has no credential, private-key, Docker-config, or token field.
+ */
+export declare function parseEnvironmentPublicationCliConfig(input: unknown): EnvironmentPublicationCliConfig;
+/**
+ * Preflight is the default and makes no Docker, network, IPFS, signer, or
+ * registry calls. Execution requires the exact explicit opt-in environment.
+ */
+export declare function runEnvironmentPublicationCli(input: RunEnvironmentPublicationCliInput): Promise<EnvironmentPublicationCliResult>;
+export type ExternalCommandEnvironmentAttestorOptions = {
+    command: string;
+    operatorSafe: string;
+    commandRunner?: EnvironmentCommandRunner;
+};
+/**
+ * Delegates signing to an operator-provided absolute executable. The protocol
+ * passes exactly one argument (the SHA-256 environment hash) and expects an
+ * EIP-191 attestation JSON object on stdout; no private key is read or passed.
+ */
+export declare class ExternalCommandEnvironmentAttestor implements EnvironmentAttestor {
+    private readonly options;
+    private readonly commandRunner;
+    constructor(options: ExternalCommandEnvironmentAttestorOptions);
+    attest(input: {
+        environmentHash: `sha256:${string}`;
+    }): Promise<Eip191EnvironmentAttestationV1>;
+}
+export {};