export interface PinataConfig {
    /** Bearer JWT for Pinata's API. Must come from env or GCP Secret Manager. */
    jwt: string;
    /** Pinata API host. Defaults to https://api.pinata.cloud. */
    baseUrl?: string;
}
export interface PinResult {
    /** IPFS CID returned by the pin service. */
    cid: string;
    /** Bytes uploaded. */
    size: number;
    /** ISO-8601 timestamp from Pinata. */
    timestamp: string;
}
/**
 * Pin a JSON blob to IPFS via Pinata. Returns the CID.
 *
 * This is the lower-level primitive — `publishHarness` below packages the
 * harness manifest into a JSON blob first.
 */
export declare function pinJson(config: PinataConfig, payload: unknown, metadata: {
    name: string;
    keyvalues?: Record<string, string>;
}): Promise<PinResult>;
export interface HarnessPublishOptions {
    /** Path to the harness directory (must have .harness/manifest.json). */
    harnessDir: string;
    /** Pinata config. */
    pinata: PinataConfig;
    /** When true, signs and pins; when false, runs the dry-run path only. */
    confirm: boolean;
    /** Optional override of the harness's name (defaults to manifest.vars.name). */
    name?: string;
    /**
     * GH #4 (HIGH-1): explicitly publish even when a present witness could NOT be cryptographically
     * verified (no verifier available). Off by default — publishing is fail-closed on an unverified
     * witness so a garbage signature can't masquerade as signed. The signature is NOT checked when set.
     */
    allowUnverified?: boolean;
}
export interface PublishResult {
    /** IPFS CID of the pinned manifest. */
    manifestCid: string;
    /** Bytes pinned. */
    manifestSize: number;
    /** Whether this was a confirmed pin or a dry-run. */
    confirmed: boolean;
}
/**
 * Publish a generated harness:
 *   1. Read .harness/manifest.json
 *   2. Verify the witness signature (TODO: wire into kernel.witnessVerify)
 *   3. Pin the manifest to IPFS via Pinata
 *   4. Return the CID
 *
 * Dry-run mode (`confirm: false`) does steps 1-2 and returns a CID of
 * `dry-run-no-pin` so smoke tests can assert the call shape without
 * spending Pinata quota.
 */
export declare function publishHarness(opts: HarnessPublishOptions): Promise<PublishResult>;
//# sourceMappingURL=publish.d.ts.map