@jinn-network/client 0.1.9 → 0.2.0

package/dist/task-creator/environment/publish-cli.js

@@ -0,0 +1,180 @@
+// SPDX-License-Identifier: Apache-2.0
+import { readFile, mkdir, rename, rm, writeFile } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { isAbsolute } from 'node:path';
+import { basename, dirname, resolve } from 'node:path';
+import { z } from 'zod/v3';
+import { Eip191EnvironmentAttestationV1Schema, EnvironmentBuildRecipeV1Schema, parseTaskEnvironmentSpecV1, verifyEnvironmentAttestationV1, } from './contracts.js';
+import { canonicalJson } from '../../harnesses/engine/canonical-json.js';
+import { DockerBuildxEnvironmentBuilder, DockerImagePublisher, IpfsEnvironmentArtifactUploader, Syft131SpdxSbomGenerator, Trivy066SecretScanner, defaultEnvironmentCommandRunner, } from './adapters.js';
+import { createGitHubRepoPublicationChecker } from './github.js';
+import { EnvironmentPublicationController, DEFAULT_ENVIRONMENT_IMAGE_REPOSITORY, } from './publication.js';
+const EXECUTE_ENVIRONMENT_VARIABLE = 'JINN_TASK_CREATOR_ENVIRONMENT_PUBLISH_EXECUTE';
+const AddressSchema = z.string().regex(/^0x[0-9a-fA-F]{40}$/, 'must be an Ethereum address');
+const EnvironmentPublicationCliConfigSchema = z.object({
+    recipe: EnvironmentBuildRecipeV1Schema,
+    ipfsRegistryUrl: z.string().url(),
+    operatorSafe: AddressSchema,
+    signer: z.object({
+        command: z.string().min(1).refine(isAbsolute, 'must be an absolute path'),
+    }).strict(),
+    imageRepository: z.string().min(1).optional(),
+}).strict();
+/**
+ * Validates an operator-supplied publication config. This object intentionally
+ * has no credential, private-key, Docker-config, or token field.
+ */
+export function parseEnvironmentPublicationCliConfig(input) {
+    assertNoSecretBearingConfigFields(input);
+    const config = EnvironmentPublicationCliConfigSchema.parse(input);
+    assertPublicRegistryUrl(config.ipfsRegistryUrl);
+    if (config.imageRepository !== undefined && /\s|@/.test(config.imageRepository)) {
+        throw new Error('imageRepository must be an OCI repository without credentials');
+    }
+    return config;
+}
+/**
+ * Preflight is the default and makes no Docker, network, IPFS, signer, or
+ * registry calls. Execution requires the exact explicit opt-in environment.
+ */
+export async function runEnvironmentPublicationCli(input) {
+    const config = parseEnvironmentPublicationCliConfig(input.rawConfig);
+    if (input.environment?.[EXECUTE_ENVIRONMENT_VARIABLE] !== '1') {
+        if (input.outputPath !== undefined) {
+            throw new Error('--output requires execute mode (set JINN_TASK_CREATOR_ENVIRONMENT_PUBLISH_EXECUTE=1)');
+        }
+        return {
+            mode: 'preflight',
+            recipeId: config.recipe.recipeId,
+            source: { repo: config.recipe.source.repo, baseCommit: config.recipe.source.baseCommit },
+        };
+    }
+    const commandRunner = input.commandRunner ?? defaultEnvironmentCommandRunner;
+    const dependencies = {
+        builder: new DockerBuildxEnvironmentBuilder({ commandRunner }),
+        scanner: new Trivy066SecretScanner({ commandRunner }),
+        sbomGenerator: new Syft131SpdxSbomGenerator({ commandRunner }),
+        publisher: new DockerImagePublisher({ commandRunner }),
+        uploader: new IpfsEnvironmentArtifactUploader({ registryUrl: config.ipfsRegistryUrl }),
+        attestor: new ExternalCommandEnvironmentAttestor({ command: config.signer.command, commandRunner, operatorSafe: config.operatorSafe }),
+        githubChecker: createGitHubRepoPublicationChecker({ fetchImpl: input.githubFetch ?? defaultGitHubFetch }),
+        imageRepository: config.imageRepository ?? DEFAULT_ENVIRONMENT_IMAGE_REPOSITORY,
+    };
+    const controller = input.controllerFactory?.(dependencies) ?? new EnvironmentPublicationController(dependencies);
+    const published = await controller.publish(config.recipe);
+    const spec = parseTaskEnvironmentSpecV1(published.spec);
+    const canonicalSpec = canonicalJson(spec);
+    if (input.outputPath !== undefined) {
+        await atomicWriteCanonicalEnvironmentSpec(input.outputPath, canonicalSpec);
+    }
+    return {
+        mode: 'published',
+        environmentCid: published.environmentCid,
+        environmentHash: spec.attestation.environmentHash,
+        imageReference: spec.execution.image.reference,
+    };
+}
+/** Write an exactly canonical, structurally valid signed artifact without a partial target file. */
+async function atomicWriteCanonicalEnvironmentSpec(outputPath, contents) {
+    if (!outputPath.trim())
+        throw new Error('--output must name a non-empty path');
+    const target = resolve(outputPath);
+    await mkdir(dirname(target), { recursive: true });
+    const temporary = resolve(dirname(target), `.${basename(target)}.${randomUUID()}.tmp`);
+    try {
+        await writeFile(temporary, contents, { encoding: 'utf8', mode: 0o644, flag: 'wx' });
+        await rename(temporary, target);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+    const written = await readFile(target, 'utf8');
+    if (written !== contents)
+        throw new Error('environment publication atomic output did not preserve canonical signed spec bytes');
+    const parsed = parseTaskEnvironmentSpecV1(JSON.parse(written));
+    if (canonicalJson(parsed) !== contents) {
+        throw new Error('environment publication atomic output is not a canonical signed spec');
+    }
+}
+/**
+ * Delegates signing to an operator-provided absolute executable. The protocol
+ * passes exactly one argument (the SHA-256 environment hash) and expects an
+ * EIP-191 attestation JSON object on stdout; no private key is read or passed.
+ */
+export class ExternalCommandEnvironmentAttestor {
+    options;
+    commandRunner;
+    constructor(options) {
+        this.options = options;
+        if (!isAbsolute(options.command))
+            throw new Error('external signer command must be an absolute path');
+        this.commandRunner = options.commandRunner ?? defaultEnvironmentCommandRunner;
+    }
+    async attest(input) {
+        const result = await this.commandRunner(this.options.command, [input.environmentHash], {
+            env: externalSignerEnvironment(),
+        });
+        if (result.exitCode !== 0) {
+            throw new Error(`external signer command failed (exit ${result.exitCode}): ${result.stderr.trim()}`);
+        }
+        let raw;
+        try {
+            raw = JSON.parse(result.stdout);
+        }
+        catch {
+            throw new Error('external signer command did not return JSON attestation');
+        }
+        const attestation = Eip191EnvironmentAttestationV1Schema.parse(raw);
+        if (attestation.environmentHash !== input.environmentHash) {
+            throw new Error('external signer attestation does not bind the requested environment hash');
+        }
+        if (attestation.operatorSafe.toLowerCase() !== this.options.operatorSafe.toLowerCase()) {
+            throw new Error('external signer attestation operatorSafe does not match configured operatorSafe');
+        }
+        if (!await verifyEnvironmentAttestationV1(attestation)) {
+            throw new Error('external signer returned an invalid environment attestation');
+        }
+        return attestation;
+    }
+}
+const defaultGitHubFetch = async (url, init) => {
+    const response = await fetch(url, { headers: init?.headers });
+    return {
+        ok: response.ok,
+        status: response.status,
+        async json() { return response.json(); },
+    };
+};
+function assertPublicRegistryUrl(value) {
+    const url = new URL(value);
+    if (url.protocol !== 'https:' || url.username !== '' || url.password !== '') {
+        throw new Error('ipfsRegistryUrl must be a credential-free HTTPS URL');
+    }
+}
+function assertNoSecretBearingConfigFields(value, path = []) {
+    if (Array.isArray(value)) {
+        value.forEach((entry, index) => assertNoSecretBearingConfigFields(entry, [...path, String(index)]));
+        return;
+    }
+    if (value === null || typeof value !== 'object')
+        return;
+    for (const [key, entry] of Object.entries(value)) {
+        if (isSecretBearingKey(key)) {
+            throw new Error(`secret-bearing config field is not accepted: ${[...path, key].join('.')}`);
+        }
+        assertNoSecretBearingConfigFields(entry, [...path, key]);
+    }
+}
+function isSecretBearingKey(key) {
+    const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, '');
+    return (normalized.includes('privatekey') || normalized.includes('credential') ||
+        normalized.includes('creds') || normalized === 'dockerconfig' ||
+        normalized === 'dockerauthconfig' || normalized.includes('token') ||
+        normalized.includes('apikey') || normalized.includes('password') ||
+        normalized.includes('secret') || normalized === 'accesskey' ||
+        normalized.endsWith('accesskeyid'));
+}
+function externalSignerEnvironment() {
+    return process.env.PATH === undefined ? {} : { PATH: process.env.PATH };
+}
+//# sourceMappingURL=publish-cli.js.map

package/dist/task-creator/environment/publish-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-cli.js","sourceRoot":"","sources":["../../../src/task-creator/environment/publish-cli.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EACL,oCAAoC,EACpC,8BAA8B,EAC9B,0BAA0B,EAC1B,8BAA8B,GAG/B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AACzE,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,+BAA+B,EAC/B,wBAAwB,EACxB,qBAAqB,EACrB,+BAA+B,GAEhC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,kCAAkC,EAAoB,MAAM,aAAa,CAAC;AAEnF,OAAO,EACL,gCAAgC,EAChC,oCAAoC,GAGrC,MAAM,kBAAkB,CAAC;AAE1B,MAAM,4BAA4B,GAAG,+CAAwD,CAAC;AAC9F,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,6BAA6B,CAAC,CAAC;AAE7F,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,8BAA8B;IACtC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACjC,YAAY,EAAE,aAAa;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,0BAA0B,CAAC;KAC1E,CAAC,CAAC,MAAM,EAAE;IACX,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC,MAAM,EAAE,CAAC;AAkCZ;;;GAGG;AACH,MAAM,UAAU,oCAAoC,CAAC,KAAc;IACjE,iCAAiC,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,qCAAqC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClE,uBAAuB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAAwC;IACzF,MAAM,MAAM,GAAG,oCAAoC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,4BAA4B,CAAC,KAAK,GAAG,EAAE,CAAC;QAC9D,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;YAChC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;SACzF,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,+BAA+B,CAAC;IAC7E,MAAM,YAAY,GAAiD;QACjE,OAAO,EAAE,IAAI,8BAA8B,CAAC,EAAE,aAAa,EAAE,CAAC;QAC9D,OAAO,EAAE,IAAI,qBAAqB,CAAC,EAAE,aAAa,EAAE,CAAC;QACrD,aAAa,EAAE,IAAI,wBAAwB,CAAC,EAAE,aAAa,EAAE,CAAC;QAC9D,SAAS,EAAE,IAAI,oBAAoB,CAAC,EAAE,aAAa,EAAE,CAAC;QACtD,QAAQ,EAAE,IAAI,+BAA+B,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;QACtF,QAAQ,EAAE,IAAI,kCAAkC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;QACtI,aAAa,EAAE,kCAAkC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;QACzG,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,oCAAoC;KAChF,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,iBAAiB,EAAE,CAAC,YAAY,CAAC,IAAI,IAAI,gCAAgC,CAAC,YAAY,CAAC,CAAC;IACjH,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,0BAA0B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,mCAAmC,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,eAAqC;QACvE,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS;KAC/C,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,KAAK,UAAU,mCAAmC,CAAC,UAAkB,EAAE,QAAgB;IACrF,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IACvF,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,MAAM,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;IAChI,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAQD;;;;GAIG;AACH,MAAM,OAAO,kCAAkC;IAGhB;IAFZ,aAAa,CAA2B;IAEzD,YAA6B,OAAkD;QAAlD,YAAO,GAAP,OAAO,CAA2C;QAC7E,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtG,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,+BAA+B,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA8C;QACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE;YACrF,GAAG,EAAE,yBAAyB,EAAE;SACjC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,QAAQ,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,WAAW,GAAG,oCAAoC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpE,IAAI,WAAW,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,WAAW,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,CAAC,MAAM,8BAA8B,CAAC,WAAW,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;CACF;AAED,MAAM,kBAAkB,GAAgB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAC1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,KAAK,CAAC,IAAI,KAAK,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;KACzC,CAAC;AACJ,CAAC,CAAC;AAEF,SAAS,uBAAuB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,iCAAiC,CAAC,KAAc,EAAE,OAAiB,EAAE;IAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,iCAAiC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpG,OAAO;IACT,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IACxD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,iCAAiC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC/D,OAAO,CACL,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACtE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,UAAU,KAAK,cAAc;QAC7D,UAAU,KAAK,kBAAkB,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QACjE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;QAChE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,KAAK,WAAW;QAC3D,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB;IAChC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;AAC1E,CAAC"}

package/dist/task-creator/environment/recipes.d.ts

@@ -0,0 +1,19 @@
+import { type EnvironmentBuildRecipeV1, type TrustedParserIdentityV1 } from './contracts.js';
+import type { EnvironmentRecipeResolver } from './resolver.js';
+/** Bound to the patch bundle whose durable enable self-test registers this parser. */
+export declare const TRUSTED_VITEST_JSON_PARSER_V1: TrustedParserIdentityV1;
+type EnvironmentRecipePresetV1 = Omit<EnvironmentBuildRecipeV1, 'source'> & {
+    readonly repo: string;
+    readonly repoUrl: string;
+};
+export declare const JINN_MONO_RECIPE_V1: EnvironmentRecipePresetV1;
+export declare const UNJS_DESTR_RECIPE_V1: EnvironmentRecipePresetV1;
+export declare const APPROVED_BASE_IMAGES: readonly {
+    reference: string;
+    digest: string;
+}[];
+/** Resolve the approved Jinn recipe at one immutable pre-fix source commit. */
+export declare function resolveJinnMonoRecipeV1(baseCommit: string): EnvironmentBuildRecipeV1;
+/** Ordered explicit repository configuration. It always outranks later discovery resolvers. */
+export declare function createPresetEnvironmentRecipeResolvers(): EnvironmentRecipeResolver[];
+export {};

package/dist/task-creator/environment/recipes.js

@@ -0,0 +1,122 @@
+// SPDX-License-Identifier: Apache-2.0
+import { ENVIRONMENT_BUILD_RECIPE_V1, EnvironmentBuildRecipeV1Schema, } from './contracts.js';
+const EVALUATOR_BUNDLE_DIGEST = 'sha256:06a35a7340ec64d3de8f2990a02bb3024aeaec47dca838dbeacb6bd19a165cbd';
+/** Bound to the patch bundle whose durable enable self-test registers this parser. */
+export const TRUSTED_VITEST_JSON_PARSER_V1 = {
+    id: 'vitest-json.v1',
+    version: 'v1',
+    digest: EVALUATOR_BUNDLE_DIGEST,
+    bundleId: 'jinn.swe-rebench-v2.patch-bundle.v1',
+};
+export const JINN_MONO_RECIPE_V1 = {
+    schemaVersion: ENVIRONMENT_BUILD_RECIPE_V1,
+    recipeId: 'jinn-mono.v1',
+    repo: 'Jinn-Network/mono',
+    repoUrl: 'https://github.com/Jinn-Network/mono.git',
+    platform: 'linux/amd64',
+    baseImage: {
+        reference: 'node:22-bookworm-slim@sha256:53ada149d435c38b14476cb57e4a7da73c15595aba79bd6971b547ceb6d018bf',
+        digest: 'sha256:53ada149d435c38b14476cb57e4a7da73c15595aba79bd6971b547ceb6d018bf',
+    },
+    workspace: '/testbed',
+    installCommands: [
+        { bin: 'apt-get', args: ['update'] },
+        { bin: 'apt-get', args: ['install', '-y', '--no-install-recommends', 'python3', 'make', 'g++'] },
+        { bin: 'corepack', args: ['enable'] },
+        { bin: 'yarn', args: ['install', '--immutable'], cwd: 'client' },
+    ],
+    smokeCommands: [{ bin: 'yarn', args: ['vitest', '--version'], cwd: 'client' }],
+    testCommands: [{ bin: 'yarn', args: ['vitest', 'run', '--reporter=json', '--outputFile=/tmp/vitest-results.json'], cwd: 'client' }],
+    parser: TRUSTED_VITEST_JSON_PARSER_V1,
+    inputRights: [sourceRights('Jinn-Network/mono', 'Apache-2.0')],
+    timeoutSeconds: 300,
+    environment: { CI: '1' },
+};
+export const UNJS_DESTR_RECIPE_V1 = {
+    schemaVersion: ENVIRONMENT_BUILD_RECIPE_V1,
+    recipeId: 'unjs-destr.v1',
+    repo: 'unjs/destr',
+    repoUrl: 'https://github.com/unjs/destr.git',
+    platform: 'linux/amd64',
+    baseImage: {
+        reference: 'node:20-bookworm-slim@sha256:2cf067cfed83d5ea958367df9f966191a942351a2df77d6f0193e162b5febfc0',
+        digest: 'sha256:2cf067cfed83d5ea958367df9f966191a942351a2df77d6f0193e162b5febfc0',
+    },
+    workspace: '/testbed',
+    installCommands: [
+        { bin: 'corepack', args: ['enable'] },
+        { bin: 'pnpm', args: ['install', '--frozen-lockfile'] },
+    ],
+    smokeCommands: [{ bin: 'pnpm', args: ['exec', 'vitest', '--version'] }],
+    testCommands: [{ bin: 'pnpm', args: ['exec', 'vitest', 'run', '--reporter=json', '--outputFile=/tmp/vitest-results.json'] }],
+    parser: TRUSTED_VITEST_JSON_PARSER_V1,
+    inputRights: [sourceRights('unjs/destr', 'MIT')],
+    timeoutSeconds: 300,
+    environment: { CI: '1' },
+};
+export const APPROVED_BASE_IMAGES = [
+    JINN_MONO_RECIPE_V1.baseImage,
+    UNJS_DESTR_RECIPE_V1.baseImage,
+];
+/** Resolve the approved Jinn recipe at one immutable pre-fix source commit. */
+export function resolveJinnMonoRecipeV1(baseCommit) {
+    if (!/^[0-9a-f]{40}$/u.test(baseCommit)) {
+        throw new Error('Jinn environment recipe requires a 40-hex base commit');
+    }
+    const { repo, repoUrl, ...recipe } = JINN_MONO_RECIPE_V1;
+    return EnvironmentBuildRecipeV1Schema.parse({
+        ...recipe,
+        source: { repo, repoUrl, baseCommit },
+        inputRights: JINN_MONO_RECIPE_V1.inputRights.map((rights) => ({
+            ...rights,
+            inputRef: rights.inputRef.replace('$baseCommit', baseCommit),
+            rightsRef: rights.rightsRef.replace('$baseCommit', baseCommit),
+        })),
+    });
+}
+/** Ordered explicit repository configuration. It always outranks later discovery resolvers. */
+export function createPresetEnvironmentRecipeResolvers() {
+    return [new ExplicitPresetResolver(JINN_MONO_RECIPE_V1), new ExplicitPresetResolver(UNJS_DESTR_RECIPE_V1)];
+}
+class ExplicitPresetResolver {
+    preset;
+    id;
+    version = 'v1';
+    constructor(preset) {
+        this.preset = preset;
+        this.id = preset.recipeId;
+    }
+    async supports(request) {
+        return request.repo === this.preset.repo && request.repoUrl === this.preset.repoUrl
+            ? { supported: true, confidence: 'explicit' }
+            : { supported: false, reason: 'repository does not match explicit recipe' };
+    }
+    async resolve(request) {
+        if (request.repo !== this.preset.repo || request.repoUrl !== this.preset.repoUrl) {
+            throw new Error(`explicit recipe ${this.id} does not support ${request.repo}`);
+        }
+        const { repo: _repo, repoUrl: _repoUrl, ...recipe } = this.preset;
+        return {
+            ...recipe,
+            source: {
+                repo: request.repo,
+                repoUrl: request.repoUrl,
+                baseCommit: request.baseCommit,
+            },
+            inputRights: this.preset.inputRights.map((rights) => ({
+                ...rights,
+                inputRef: rights.inputRef.replace('$baseCommit', request.baseCommit),
+                rightsRef: rights.rightsRef.replace('$baseCommit', request.baseCommit),
+            })),
+        };
+    }
+}
+function sourceRights(repo, spdxId) {
+    return {
+        inputRef: `git+https://github.com/${repo}.git#$baseCommit`,
+        rightsRef: `https://api.github.com/repos/${repo}/license?ref=$baseCommit`,
+        basis: 'spdx',
+        spdxId,
+    };
+}
+//# sourceMappingURL=recipes.js.map

package/dist/task-creator/environment/recipes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipes.js","sourceRoot":"","sources":["../../../src/task-creator/environment/recipes.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,GAK/B,MAAM,gBAAgB,CAAC;AAGxB,MAAM,uBAAuB,GAAG,yEAAkF,CAAC;AAEnH,sFAAsF;AACtF,MAAM,CAAC,MAAM,6BAA6B,GAA4B;IACpE,EAAE,EAAE,gBAAgB;IACpB,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,uBAAuB;IAC/B,QAAQ,EAAE,qCAAqC;CAChD,CAAC;AAOF,MAAM,CAAC,MAAM,mBAAmB,GAA8B;IAC5D,aAAa,EAAE,2BAA2B;IAC1C,QAAQ,EAAE,cAAc;IACxB,IAAI,EAAE,mBAAmB;IACzB,OAAO,EAAE,0CAA0C;IACnD,QAAQ,EAAE,aAAa;IACvB,SAAS,EAAE;QACT,SAAS,EAAE,+FAA+F;QAC1G,MAAM,EAAE,yEAAyE;KAClF;IACD,SAAS,EAAE,UAAU;IACrB,eAAe,EAAE;QACf,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE;QACpC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;QAChG,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE;QACrC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE;KACjE;IACD,aAAa,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAC9E,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,uCAAuC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IACnI,MAAM,EAAE,6BAA6B;IACrC,WAAW,EAAE,CAAC,YAAY,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;IAC9D,cAAc,EAAE,GAAG;IACnB,WAAW,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;CACzB,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAA8B;IAC7D,aAAa,EAAE,2BAA2B;IAC1C,QAAQ,EAAE,eAAe;IACzB,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,mCAAmC;IAC5C,QAAQ,EAAE,aAAa;IACvB,SAAS,EAAE;QACT,SAAS,EAAE,+FAA+F;QAC1G,MAAM,EAAE,yEAAyE;KAClF;IACD,SAAS,EAAE,UAAU;IACrB,eAAe,EAAE;QACf,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE;QACrC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE;KACxD;IACD,aAAa,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;IACvE,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,uCAAuC,CAAC,EAAE,CAAC;IAC5H,MAAM,EAAE,6BAA6B;IACrC,WAAW,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAChD,cAAc,EAAE,GAAG;IACnB,WAAW,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;CACzB,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAqD;IACpF,mBAAmB,CAAC,SAAS;IAC7B,oBAAoB,CAAC,SAAS;CAC/B,CAAC;AAEF,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,mBAAmB,CAAC;IACzD,OAAO,8BAA8B,CAAC,KAAK,CAAC;QAC1C,GAAG,MAAM;QACT,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE;QACrC,WAAW,EAAE,mBAAmB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC5D,GAAG,MAAM;YACT,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC;YAC5D,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC;SAC/D,CAAC,CAAC;KACJ,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,sCAAsC;IACpD,OAAO,CAAC,IAAI,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,IAAI,sBAAsB,CAAC,oBAAoB,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,MAAM,sBAAsB;IAIG;IAHpB,EAAE,CAAS;IACX,OAAO,GAAG,IAAI,CAAC;IAExB,YAA6B,MAAiC;QAAjC,WAAM,GAAN,MAAM,CAA2B;QAC5D,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAkC;QAC/C,OAAO,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;YACjF,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE;YAC7C,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAkC;QAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,EAAE,qBAAqB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAClE,OAAO;YACL,GAAG,MAAM;YACT,MAAM,EAAE;gBACN,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B;YACD,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACpD,GAAG,MAAM;gBACT,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC;gBACpE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC;aACvE,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;CACF;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,OAAO;QACL,QAAQ,EAAE,0BAA0B,IAAI,kBAAkB;QAC1D,SAAS,EAAE,gCAAgC,IAAI,0BAA0B;QACzE,KAAK,EAAE,MAAM;QACb,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/task-creator/environment/resolver.d.ts

@@ -0,0 +1,53 @@
+import { z } from 'zod/v3';
+import { type EnvironmentBuildRecipeV1, type EnvironmentBuildRequestV1 } from './contracts.js';
+declare const ResolverSupportSchema: z.ZodDiscriminatedUnion<"supported", [z.ZodObject<{
+    supported: z.ZodLiteral<true>;
+    confidence: z.ZodEnum<["explicit", "deterministic", "agentic"]>;
+}, "strict", z.ZodTypeAny, {
+    supported: true;
+    confidence: "explicit" | "deterministic" | "agentic";
+}, {
+    supported: true;
+    confidence: "explicit" | "deterministic" | "agentic";
+}>, z.ZodObject<{
+    supported: z.ZodLiteral<false>;
+    reason: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    reason: string;
+    supported: false;
+}, {
+    reason: string;
+    supported: false;
+}>]>;
+export type EnvironmentRecipeResolver = {
+    readonly id: string;
+    readonly version: string;
+    supports(request: EnvironmentBuildRequestV1): Promise<z.infer<typeof ResolverSupportSchema>>;
+    /** Deliberately unknown until the registry has strictly parsed the artifact. */
+    resolve(request: EnvironmentBuildRequestV1): Promise<unknown>;
+};
+export type EnvironmentRecipeResolution = {
+    kind: 'resolved';
+    resolverId: string;
+    resolverVersion: string;
+    recipe: EnvironmentBuildRecipeV1;
+} | {
+    kind: 'awaiting_input';
+    reason: 'no-supported-environment-recipe';
+} | {
+    kind: 'terminal_error';
+    resolverId: string;
+    resolverVersion: string;
+    reason: string;
+};
+/**
+ * Resolver ordering is policy. The first configured resolver that claims a
+ * request wins; an exception or malformed recipe from that resolver is final
+ * rather than permission to reinterpret inputs in a later resolver.
+ */
+export declare class EnvironmentRecipeResolverRegistry {
+    private readonly resolvers;
+    constructor(resolvers: readonly EnvironmentRecipeResolver[]);
+    resolve(input: unknown): Promise<EnvironmentRecipeResolution>;
+}
+export {};

package/dist/task-creator/environment/resolver.js

@@ -0,0 +1,57 @@
+// SPDX-License-Identifier: Apache-2.0
+import { z } from 'zod/v3';
+import { EnvironmentBuildRecipeV1Schema, EnvironmentBuildRequestV1Schema, } from './contracts.js';
+const ResolverSupportSchema = z.discriminatedUnion('supported', [
+    z.object({ supported: z.literal(true), confidence: z.enum(['explicit', 'deterministic', 'agentic']) }).strict(),
+    z.object({ supported: z.literal(false), reason: z.string().min(1) }).strict(),
+]);
+/**
+ * Resolver ordering is policy. The first configured resolver that claims a
+ * request wins; an exception or malformed recipe from that resolver is final
+ * rather than permission to reinterpret inputs in a later resolver.
+ */
+export class EnvironmentRecipeResolverRegistry {
+    resolvers;
+    constructor(resolvers) {
+        this.resolvers = resolvers;
+    }
+    async resolve(input) {
+        const request = EnvironmentBuildRequestV1Schema.parse(input);
+        for (const resolver of this.resolvers) {
+            let support;
+            try {
+                support = ResolverSupportSchema.parse(await resolver.supports(request));
+            }
+            catch (error) {
+                return terminal(resolver, `invalid support declaration: ${message(error)}`);
+            }
+            if (!support.supported)
+                continue;
+            try {
+                const recipe = EnvironmentBuildRecipeV1Schema.parse(await resolver.resolve(request));
+                return {
+                    kind: 'resolved',
+                    resolverId: resolver.id,
+                    resolverVersion: resolver.version,
+                    recipe,
+                };
+            }
+            catch (error) {
+                return terminal(resolver, `invalid claimed recipe: ${message(error)}`);
+            }
+        }
+        return { kind: 'awaiting_input', reason: 'no-supported-environment-recipe' };
+    }
+}
+function terminal(resolver, reason) {
+    return {
+        kind: 'terminal_error',
+        resolverId: resolver.id,
+        resolverVersion: resolver.version,
+        reason,
+    };
+}
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=resolver.js.map

package/dist/task-creator/environment/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../src/task-creator/environment/resolver.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,GAGhC,MAAM,gBAAgB,CAAC;AAExB,MAAM,qBAAqB,GAAG,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE;IAC9D,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/G,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CAC9E,CAAC,CAAC;AAeH;;;;GAIG;AACH,MAAM,OAAO,iCAAiC;IACf;IAA7B,YAA6B,SAA+C;QAA/C,cAAS,GAAT,SAAS,CAAsC;IAAG,CAAC;IAEhF,KAAK,CAAC,OAAO,CAAC,KAAc;QAC1B,MAAM,OAAO,GAAG,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE7D,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,OAA8C,CAAC;YACnD,IAAI,CAAC;gBACH,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,SAAS;gBAAE,SAAS;YAEjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,8BAA8B,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBACrF,OAAO;oBACL,IAAI,EAAE,UAAU;oBAChB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,eAAe,EAAE,QAAQ,CAAC,OAAO;oBACjC,MAAM;iBACP,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IAC/E,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,QAAmC,EAAE,MAAc;IACnE,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,eAAe,EAAE,QAAQ,CAAC,OAAO;QACjC,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/task-creator/proofs/differential-receipt-bound-proof.d.ts

@@ -0,0 +1,27 @@
+import { type DifferentialAdmissionReceiptV2 } from '../../solver-types/_swe-rebench-v2-differential-admission.js';
+import type { MintedEnvironmentBindingV1 } from '../../solver-types/_swe-rebench-v2-minted-pool.js';
+import { type JinnDifferentialProofSource } from './public-repo-fixtures.js';
+type Sha256 = `sha256:${string}`;
+export type ReceiptBoundJinnDifferentialProof = {
+    source: JinnDifferentialProofSource;
+    receipt: DifferentialAdmissionReceiptV2;
+    receiptCid: string;
+    receiptHash: Sha256;
+    environment: MintedEnvironmentBindingV1;
+    testPatch: string;
+};
+export type BindJinnDifferentialReceiptToProofInput = {
+    source: JinnDifferentialProofSource;
+    receipt: unknown;
+    receiptCid: string;
+    /** Caller-provided artifact hash. If omitted, canonical receipt content supplies it. */
+    receiptHash?: Sha256;
+    environment: MintedEnvironmentBindingV1;
+    testPatch: string;
+};
+/**
+ * Verify the generated receipt and all public bindings needed before a Jinn
+ * task can be posted, evaluated, or represented in a proof record.
+ */
+export declare function bindJinnDifferentialReceiptToProof(input: BindJinnDifferentialReceiptToProofInput): Promise<ReceiptBoundJinnDifferentialProof>;
+export {};

package/dist/task-creator/proofs/differential-receipt-bound-proof.js

@@ -0,0 +1,86 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Fail-closed binding for proof/lifecycle consumers of a real Jinn
+ * differential-admission receipt. This is deliberately separate from the
+ * synthetic Vitest JSON parser-contract fixture: receipt absence or drift
+ * must stop a task before it can be posted or evaluated.
+ */
+import { createHash } from 'node:crypto';
+import { canonicalJson } from '../../harnesses/engine/canonical-json.js';
+import { hashDifferentialAdmissionReceiptV2, verifyDifferentialAdmissionReceiptV2, } from '../../solver-types/_swe-rebench-v2-differential-admission.js';
+import { verifyEnvironmentAttestationV1 } from '../environment/contracts.js';
+import { JINN_MONO_DIFFERENTIAL_PROOF_SOURCE, } from './public-repo-fixtures.js';
+import { isAcceptedIpfsCid } from './ipfs-cid.js';
+function sha256(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function sameCanonical(left, right) {
+    return canonicalJson(left) === canonicalJson(right);
+}
+function fail(message) {
+    throw new Error(`receipt-bound Jinn proof: ${message}`);
+}
+function assertCanonicalJinnSource(source) {
+    const expected = JINN_MONO_DIFFERENTIAL_PROOF_SOURCE;
+    if (source.id !== expected.id ||
+        source.repo !== expected.repo ||
+        source.baseCommit !== expected.baseCommit ||
+        source.fixCommit !== expected.fixCommit ||
+        source.instanceId !== expected.instanceId ||
+        source.language !== expected.language ||
+        source.evidenceKind !== expected.evidenceKind ||
+        !sameCanonical(source.testPaths, expected.testPaths)) {
+        fail('source must equal the reviewed Jinn #1422 base/fix/instance/path identity');
+    }
+}
+/**
+ * Verify the generated receipt and all public bindings needed before a Jinn
+ * task can be posted, evaluated, or represented in a proof record.
+ */
+export async function bindJinnDifferentialReceiptToProof(input) {
+    assertCanonicalJinnSource(input.source);
+    if (!isAcceptedIpfsCid(input.receiptCid))
+        fail('receipt CID must use a CIDv0 or lowercase-base32 CIDv1 format');
+    if (input.testPatch.trim() === '')
+        fail('public test patch is required');
+    const receipt = verifyDifferentialAdmissionReceiptV2(input.receipt);
+    const receiptHash = hashDifferentialAdmissionReceiptV2(receipt);
+    if (input.receiptHash !== undefined && input.receiptHash !== receiptHash) {
+        fail('receipt hash does not match canonical receipt content');
+    }
+    if (!sameCanonical(receipt.task, {
+        instanceId: input.source.instanceId,
+        repo: input.source.repo,
+        baseCommit: input.source.baseCommit,
+        fixCommit: input.source.fixCommit,
+    })) {
+        fail('receipt task identity does not match the reviewed Jinn source');
+    }
+    if (!sameCanonical(receipt.testPaths.map((path) => path.testPath), input.source.testPaths)) {
+        fail('receipt test paths do not match the reviewed Jinn regression paths');
+    }
+    if (receipt.testPatchHash !== sha256(input.testPatch)) {
+        fail('receipt public test-patch hash drifted');
+    }
+    if (receipt.environment.environmentHash !== input.environment.environmentHash ||
+        !sameCanonical(receipt.environment.image, input.environment.image) ||
+        !sameCanonical(receipt.environment.parser, input.environment.parser) ||
+        receipt.environment.platform !== input.environment.platform) {
+        fail('receipt environment binding drifted');
+    }
+    if (input.environment.attestation.environmentHash !== input.environment.environmentHash) {
+        fail('environment attestation does not bind its declared environment hash');
+    }
+    if (!await verifyEnvironmentAttestationV1(input.environment.attestation)) {
+        fail('environment attestation signature is invalid');
+    }
+    return {
+        source: input.source,
+        receipt,
+        receiptCid: input.receiptCid,
+        receiptHash,
+        environment: input.environment,
+        testPatch: input.testPatch,
+    };
+}
+//# sourceMappingURL=differential-receipt-bound-proof.js.map

package/dist/task-creator/proofs/differential-receipt-bound-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"differential-receipt-bound-proof.js","sourceRoot":"","sources":["../../../src/task-creator/proofs/differential-receipt-bound-proof.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AACzE,OAAO,EACL,kCAAkC,EAClC,oCAAoC,GAErC,MAAM,8DAA8D,CAAC;AAEtE,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EACL,mCAAmC,GAEpC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAuBlD,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,aAAa,CAAC,IAAa,EAAE,KAAc;IAClD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAmC;IACpE,MAAM,QAAQ,GAAG,mCAAmC,CAAC;IACrD,IACE,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE;QACzB,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;QAC7B,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QACzC,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;QACvC,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QACzC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;QACrC,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;QAC7C,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,EACpD,CAAC;QACD,IAAI,CAAC,2EAA2E,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAA8C;IAE9C,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,+DAA+D,CAAC,CAAC;IAChH,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAEzE,MAAM,OAAO,GAAG,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACzE,IAAI,CAAC,uDAAuD,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE;QAC/B,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QACnC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;QACvB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QACnC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;KAClC,CAAC,EAAE,CAAC;QACH,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3F,IAAI,CAAC,oEAAoE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,KAAK,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACjD,CAAC;IACD,IACE,OAAO,CAAC,WAAW,CAAC,eAAe,KAAK,KAAK,CAAC,WAAW,CAAC,eAAe;QACzE,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC;QAClE,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC;QACpE,OAAO,CAAC,WAAW,CAAC,QAAQ,KAAK,KAAK,CAAC,WAAW,CAAC,QAAQ,EAC3D,CAAC;QACD,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,eAAe,KAAK,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC;QACxF,IAAI,CAAC,qEAAqE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,MAAM,8BAA8B,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACvD,CAAC;IACD,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO;QACP,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW;QACX,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC"}

package/dist/task-creator/proofs/ipfs-cid.d.ts

@@ -0,0 +1,7 @@
+export declare function isIpfsCid(value: string): boolean;
+/**
+ * Hermetic tests deliberately use readable non-CID labels. Never admit those
+ * labels in an operator process; production must receive an actual CID.
+ */
+export declare function isTestOnlyIpfsCidFixture(value: string): boolean;
+export declare function isAcceptedIpfsCid(value: string): boolean;