spawnfile 0.1.10 → 0.1.11

package/dist/compiler/buildCompilePlanTeams.js

@@ -22,7 +22,9 @@ export const resolveTeamNetworks = (manifest) => (manifest.networks ?? []).map((
         rooms: network.rooms.map((room) => ({
             id: room.id,
             members: [...room.members],
-            ...(room.name ? { name: room.name } : {})
+            ...(room.name ? { name: room.name } : {}),
+            ...(room.visibility ? { visibility: room.visibility } : {}),
+            ...(room.write_policy ? { write_policy: room.write_policy } : {})
         }))
     };
     if (network.server) {

package/dist/compiler/compileProjectSupport.d.ts

@@ -10,6 +10,7 @@ export interface CompiledNodeOutput {
     report: {
         output_dir: string | null;
     };
+    slug?: string;
     value: ResolvedAgentNode | ResolvedTeamNode;
 }
 export declare const writeEmittedFiles: (outputDirectory: string, files: EmittedFile[]) => Promise<void>;

package/dist/compiler/compileProjectSupport.js

@@ -90,7 +90,7 @@ export const injectMoltnetWorkspaceFiles = async (outputDirectory, compiledNodes
             continue;
         }
         const runtimeOutputDirectory = path.join(outputDirectory, compiled.report.output_dir);
-        const moltnetClientConfigFiles = createMoltnetClientConfigFiles(compiled.value, artifacts);
+        const moltnetClientConfigFiles = createMoltnetClientConfigFiles(compiled.value, artifacts, compiled.slug);
         if (moltnetClientConfigFiles.length === 0) {
             continue;
         }

package/dist/compiler/moltnetArtifacts.d.ts

@@ -14,6 +14,8 @@ export interface MoltnetServerPlan {
         id: string;
         members: string[];
         name?: string;
+        visibility?: "public" | "private";
+        write_policy?: "members" | "operators" | "registered_agents";
     }>;
     server: TeamNetworkServer;
     secretPatches: MoltnetSecretPatch[];

package/dist/compiler/moltnetArtifacts.js

@@ -1,7 +1,8 @@
 import { SpawnfileError } from "../shared/index.js";
-import { createMoltnetOpenTokenDirectory, createMoltnetNativeServerConfig, createMoltnetNodeConfigPath, createMoltnetServerConfigPath, resolveMoltnetBaseUrl, resolveMoltnetClientAuth, resolveMoltnetStorePersistenceMountPath } from "./moltnetConfigLowering.js";
+import { createMoltnetOpenTokenDirectory, createMoltnetNativeServerConfig, createMoltnetNodeConfigPath, createMoltnetServerConfigPath, resolveMoltnetBaseUrl, resolveMoltnetStorePersistenceMountPath } from "./moltnetConfigLowering.js";
 import { listConcreteMoltnetRoomMemberIds } from "./moltnetRoomMemberships.js";
-import { resolveRuntimeConfig } from "./moltnetRuntimeConfig.js";
+import { assertCompatibleMoltnetNetworkName, assertCompatibleMoltnetRoomPolicy, assertCompatibleMoltnetServer } from "./moltnetRoomPolicyCompatibility.js";
+import { createMoltnetNodeConfigContent } from "./moltnetNodeConfig.js";
 import { createShortHash, slugify } from "./helpers.js";
 const DEFAULT_MOLTNET_PORT = 8787;
 const ROOTFS_PREFIX = "container/rootfs";
@@ -39,6 +40,8 @@ export const generateMoltnetArtifacts = async (plan) => {
                 if (existingPlan.baseUrl !== resolveMoltnetBaseUrl(server)) {
                     throw new SpawnfileError("validation_error", `Duplicate Moltnet network ${network.id} declares conflicting server URL`);
                 }
+                assertCompatibleMoltnetNetworkName(network.id, existingPlan.name, network.name);
+                assertCompatibleMoltnetServer(network.id, existingPlan.server, server);
                 for (const room of network.rooms) {
                     const concreteMembers = listConcreteMoltnetRoomMemberIds(plan, teamNode.value, network.id, room);
                     const existingRoom = existingPlan.rooms.find((entry) => entry.id === room.id);
@@ -46,12 +49,18 @@ export const generateMoltnetArtifacts = async (plan) => {
                         existingRoom.members = [
                             ...new Set([...existingRoom.members, ...concreteMembers])
                         ].sort();
+                        assertCompatibleMoltnetRoomPolicy(network.id, room.id, "visibility", existingRoom.visibility, room.visibility);
+                        assertCompatibleMoltnetRoomPolicy(network.id, room.id, "write_policy", existingRoom.write_policy, room.write_policy);
+                        existingRoom.visibility ??= room.visibility;
+                        existingRoom.write_policy ??= room.write_policy;
                     }
                     else {
                         existingPlan.rooms.push({
                             id: room.id,
                             members: concreteMembers,
-                            ...(room.name ? { name: room.name } : {})
+                            ...(room.name ? { name: room.name } : {}),
+                            ...(room.visibility ? { visibility: room.visibility } : {}),
+                            ...(room.write_policy ? { write_policy: room.write_policy } : {})
                         });
                     }
                 }
@@ -73,7 +82,9 @@ export const generateMoltnetArtifacts = async (plan) => {
                     rooms: network.rooms.map((room) => ({
                         id: room.id,
                         members: listConcreteMoltnetRoomMemberIds(plan, teamNode.value, network.id, room),
-                        ...(room.name ? { name: room.name } : {})
+                        ...(room.name ? { name: room.name } : {}),
+                        ...(room.visibility ? { visibility: room.visibility } : {}),
+                        ...(room.write_policy ? { write_policy: room.write_policy } : {})
                     })),
                     server,
                     secretPatches: [],
@@ -99,38 +110,35 @@ export const generateMoltnetArtifacts = async (plan) => {
             throw new SpawnfileError("validation_error", `Moltnet persistent mount ${mount.id} resolves to conflicting targets`);
         }
     };
-    for (const teamNode of teamNodes) {
-        for (const network of teamNode.value.networks ?? []) {
-            const serverPlan = serverPlans.get(createServerKey(network.id));
-            if (!serverPlan || !network.server || network.server.mode !== "managed" || !serverPlan.configPath) {
-                continue;
-            }
-            const native = createMoltnetNativeServerConfig({
-                networkId: network.id,
-                networkName: network.name,
-                rooms: serverPlan.rooms,
-                server: network.server
-            });
-            serverPlan.secretPatches = native.secretPatches;
-            configFiles.push({
-                content: `${JSON.stringify(native.config, null, 2)}\n`,
-                mode: 0o600,
-                path: createMoltnetServerConfigPath(serverPlan.id)
+    for (const serverPlan of serverPlans.values()) {
+        if (serverPlan.mode !== "managed" || serverPlan.server.mode !== "managed" || !serverPlan.configPath) {
+            continue;
+        }
+        const native = createMoltnetNativeServerConfig({
+            networkId: serverPlan.networkId,
+            networkName: serverPlan.name,
+            rooms: serverPlan.rooms,
+            server: serverPlan.server
+        });
+        serverPlan.secretPatches = native.secretPatches;
+        configFiles.push({
+            content: `${JSON.stringify(native.config, null, 2)}\n`,
+            mode: 0o600,
+            path: createMoltnetServerConfigPath(serverPlan.id)
+        });
+        const storeMountPath = resolveMoltnetStorePersistenceMountPath(serverPlan.networkId, serverPlan.server.store);
+        if (storeMountPath) {
+            const mountId = `moltnet-${serverPlan.networkId}-store`;
+            const store = serverPlan.server.store;
+            const volumeName = store.kind === "sqlite" || store.kind === "json"
+                ? store.persistence?.name
+                : undefined;
+            addPersistentMount({
+                id: mountId,
+                mountPath: storeMountPath,
+                reason: `managed Moltnet ${serverPlan.server.store.kind} store for ${serverPlan.networkId}`,
+                volumeName: createPersistentVolumeName(plan.root, mountId, volumeName)
             });
-            const storeMountPath = resolveMoltnetStorePersistenceMountPath(network.id, network.server.store);
-            if (storeMountPath) {
-                const mountId = `moltnet-${network.id}-store`;
-                const store = network.server.store;
-                const volumeName = store.kind === "sqlite" || store.kind === "json"
-                    ? store.persistence?.name
-                    : undefined;
-                addPersistentMount({
-                    id: mountId,
-                    mountPath: storeMountPath,
-                    reason: `managed Moltnet ${network.server.store.kind} store for ${network.id}`,
-                    volumeName: createPersistentVolumeName(plan.root, mountId, volumeName)
-                });
-            }
         }
     }
     for (const node of plan.nodes) {
@@ -169,10 +177,15 @@ export const generateMoltnetArtifacts = async (plan) => {
                 throw new SpawnfileError("validation_error", `Duplicate Moltnet node attachment for ${attachment.network}/${attachment.memberId}`);
             }
             nodePlanKeys.add(nodePlanKey);
-            const clientAuth = resolveMoltnetClientAuth(network.server, attachment.network, attachment.memberId, node.slug);
-            const usesPerAttachmentOpenToken = clientAuth.mode === "open" &&
-                clientAuth.staticToken !== true &&
-                Boolean(clientAuth.tokenEnv || clientAuth.tokenPath);
+            const nodeConfig = createMoltnetNodeConfigContent({
+                agentNode,
+                attachment: { ...attachment, memberId: attachment.memberId },
+                networkServer: serverPlan.server,
+                nodeSlug: node.slug,
+                plan,
+                serverPlan
+            });
+            const { clientAuth, usesPerAttachmentOpenToken } = nodeConfig;
             if (usesPerAttachmentOpenToken && clientAuth.tokenPath) {
                 const mountId = `agent-${node.slug}-moltnet-tokens`;
                 addPersistentMount({
@@ -183,66 +196,7 @@ export const generateMoltnetArtifacts = async (plan) => {
                 });
             }
             configFiles.push({
-                content: `${JSON.stringify({
-                    version: "moltnet.node.v1",
-                    moltnet: {
-                        base_url: serverPlan.baseUrl,
-                        network_id: attachment.network,
-                        ...(clientAuth.mode === "none"
-                            ? {}
-                            : { auth_mode: clientAuth.mode }),
-                        ...(clientAuth.staticToken
-                            ? { static_token: true }
-                            : {}),
-                        ...(!usesPerAttachmentOpenToken && clientAuth.tokenEnv
-                            ? {
-                                token_env: clientAuth.tokenEnv
-                            }
-                            : {}),
-                        ...(!usesPerAttachmentOpenToken && clientAuth.tokenPath
-                            ? {
-                                token_path: clientAuth.tokenPath
-                            }
-                            : {})
-                    },
-                    attachments: [
-                        {
-                            agent: {
-                                id: attachment.memberId,
-                                name: agentNode.name
-                            },
-                            ...(usesPerAttachmentOpenToken
-                                ? {
-                                    moltnet: {
-                                        ...(clientAuth.tokenEnv ? { token_env: clientAuth.tokenEnv } : {}),
-                                        ...(clientAuth.tokenPath ? { token_path: clientAuth.tokenPath } : {})
-                                    }
-                                }
-                                : {}),
-                            runtime: resolveRuntimeConfig(plan, agentNode, node.slug, attachment.network, attachment.memberId),
-                            ...(attachment.rooms
-                                ? {
-                                    rooms: Object.entries(attachment.rooms)
-                                        .sort(([left], [right]) => left.localeCompare(right))
-                                        .map(([roomId, policy]) => ({
-                                        id: roomId,
-                                        ...(policy.read ? { read: policy.read } : {}),
-                                        ...(policy.reply ? { reply: policy.reply } : {})
-                                    }))
-                                }
-                                : {}),
-                            ...(attachment.dms
-                                ? {
-                                    dms: {
-                                        enabled: attachment.dms.enabled,
-                                        ...(attachment.dms.read ? { read: attachment.dms.read } : {}),
-                                        ...(attachment.dms.reply ? { reply: attachment.dms.reply } : {})
-                                    }
-                                }
-                                : {})
-                        }
-                    ]
-                }, null, 2)}\n`,
+                content: nodeConfig.content,
                 mode: 0o600,
                 path: configPath
             });

package/dist/compiler/moltnetClientConfig.d.ts

@@ -8,4 +8,4 @@ export interface MoltnetWorkspaceLayout {
     workspaceRootPath: string;
 }
 export declare const resolveMoltnetWorkspaceLayout: (runtimeName: string, agentName: string) => MoltnetWorkspaceLayout;
-export declare const createMoltnetClientConfigFiles: (node: ResolvedAgentNode, artifacts: MoltnetArtifacts) => EmittedFile[];
+export declare const createMoltnetClientConfigFiles: (node: ResolvedAgentNode, artifacts: MoltnetArtifacts, agentSlug?: string) => EmittedFile[];

package/dist/compiler/moltnetClientConfig.js

@@ -19,16 +19,17 @@ const findServerPlan = (artifacts, attachment) => {
     }
     return plan;
 };
-const createAttachmentConfig = (node, artifacts, attachment) => {
+const createAttachmentConfig = (node, artifacts, attachment, agentSlug) => {
     if (!attachment.memberId) {
         throw new SpawnfileError("compile_error", `Moltnet client config requires a resolved member id for ${node.name}`);
     }
     const serverPlan = findServerPlan(artifacts, attachment);
-    const auth = resolveMoltnetClientAuth(serverPlan.server, attachment.network, attachment.memberId);
+    const auth = resolveMoltnetClientAuth(serverPlan.server, attachment.network, attachment.memberId, agentSlug);
     return {
         agent_name: node.name,
         auth: {
             mode: auth.mode,
+            ...(auth.registration ? { registration: auth.registration } : {}),
             ...(auth.tokenEnv ? { token_env: auth.tokenEnv } : {}),
             ...(auth.tokenPath ? { token_path: auth.tokenPath } : {})
         },
@@ -49,11 +50,16 @@ const createAttachmentConfig = (node, artifacts, attachment) => {
             ? {
                 rooms: Object.entries(attachment.rooms)
                     .sort(([left], [right]) => left.localeCompare(right))
-                    .map(([roomId, policy]) => ({
-                    id: roomId,
-                    ...(policy.read ? { read: policy.read } : {}),
-                    ...(policy.reply ? { reply: policy.reply } : {})
-                }))
+                    .map(([roomId, policy]) => {
+                    const room = serverPlan.rooms.find((entry) => entry.id === roomId);
+                    return {
+                        id: roomId,
+                        ...(room?.visibility ? { visibility: room.visibility } : {}),
+                        ...(room?.write_policy ? { write_policy: room.write_policy } : {}),
+                        ...(policy.read ? { read: policy.read } : {}),
+                        ...(policy.reply ? { reply: policy.reply } : {})
+                    };
+                })
             }
             : {})
     };
@@ -80,7 +86,7 @@ export const resolveMoltnetWorkspaceLayout = (runtimeName, agentName) => {
     }
     throw new SpawnfileError("compile_error", `Moltnet client config does not know how to emit files for runtime ${runtimeName}`);
 };
-export const createMoltnetClientConfigFiles = (node, artifacts) => {
+export const createMoltnetClientConfigFiles = (node, artifacts, agentSlug) => {
     const attachments = node.surfaces?.moltnet;
     if (!attachments || attachments.length === 0) {
         return [];
@@ -88,7 +94,7 @@ export const createMoltnetClientConfigFiles = (node, artifacts) => {
     const layout = resolveMoltnetWorkspaceLayout(node.runtime.name, node.name);
     return [
         {
-            content: createConfigContent(node, attachments.map((attachment) => createAttachmentConfig(node, artifacts, attachment))),
+            content: createConfigContent(node, attachments.map((attachment) => createAttachmentConfig(node, artifacts, attachment, agentSlug))),
             path: layout.clientConfigPath
         }
     ];

package/dist/compiler/moltnetConfigLowering.d.ts

@@ -5,6 +5,7 @@ export interface MoltnetSecretPatch {
 }
 export interface MoltnetClientAuthPlan {
     mode: "bearer" | "none" | "open";
+    registration?: "disabled" | "open" | "token";
     staticToken?: boolean;
     tokenEnv?: string;
     tokenPath?: string;
@@ -13,6 +14,8 @@ export interface MoltnetNativeRoomConfig {
     id: string;
     members: string[];
     name?: string;
+    visibility?: "public" | "private";
+    write_policy?: "members" | "operators" | "registered_agents";
 }
 export interface MoltnetNativeServerConfigInput {
     networkId: string;

package/dist/compiler/moltnetConfigLowering.js

@@ -55,14 +55,19 @@ export const resolveMoltnetClientAuth = (server, networkId, memberId, agentSlug)
         return { mode: "none" };
     }
     const client = server.auth.client;
-    if (server.auth.mode === "open" && !client) {
+    const registrationOpen = server.auth.mode === "open" || server.auth.agent_registration === "open";
+    if (registrationOpen && !client) {
         return {
             mode: "open",
+            registration: "open",
             tokenPath: createMoltnetOpenTokenPath(networkId, memberId, agentSlug)
         };
     }
     if (!client) {
-        return { mode: server.auth.mode };
+        return {
+            mode: server.auth.mode,
+            ...(server.auth.agent_registration ? { registration: server.auth.agent_registration } : {})
+        };
     }
     const tokenEnv = client.token_env
         ?? (client.token_id && server.mode === "managed"
@@ -70,6 +75,7 @@ export const resolveMoltnetClientAuth = (server, networkId, memberId, agentSlug)
             : undefined);
     return {
         mode: server.auth.mode,
+        ...(server.auth.agent_registration ? { registration: server.auth.agent_registration } : {}),
         ...(client.static_token ? { staticToken: true } : {}),
         ...(tokenEnv ? { tokenEnv } : {}),
         ...(client.token_path ? { tokenPath: client.token_path } : {})
@@ -129,6 +135,7 @@ export const createMoltnetNativeServerConfig = ({ networkId, networkName, rooms,
             },
             server: {
                 listen_addr: renderMoltnetListenAddr(server),
+                ...(server.console ? { console: server.console } : {}),
                 ...(server.human_ingress !== undefined ? { human_ingress: server.human_ingress } : {}),
                 ...(server.direct_messages !== undefined ? { direct_messages: server.direct_messages } : {}),
                 ...(server.debug_events !== undefined ? { debug_events: server.debug_events } : {}),
@@ -139,12 +146,16 @@ export const createMoltnetNativeServerConfig = ({ networkId, networkName, rooms,
             },
             auth: {
                 mode: server.auth.mode,
+                ...(server.auth.public_read !== undefined ? { public_read: server.auth.public_read } : {}),
+                ...(server.auth.agent_registration ? { agent_registration: server.auth.agent_registration } : {}),
                 ...(tokens.length > 0 ? { tokens } : {})
             },
             storage: storageConfigFor(networkId, server.store),
             rooms: rooms.map((room) => ({
                 id: room.id,
                 ...(room.name ? { name: room.name } : {}),
+                ...(room.visibility ? { visibility: room.visibility } : {}),
+                ...(room.write_policy ? { write_policy: room.write_policy } : {}),
                 members: room.members
             })),
             ...(pairings.length > 0 ? { pairings } : {})

package/dist/compiler/moltnetNodeConfig.d.ts

@@ -0,0 +1,27 @@
+import type { TeamNetworkServer } from "../manifest/index.js";
+import { type MoltnetClientAuthPlan } from "./moltnetConfigLowering.js";
+import type { CompilePlan, ResolvedAgentNode, ResolvedMoltnetAttachment } from "./types.js";
+interface MoltnetNodeConfigServerPlan {
+    baseUrl: string;
+    rooms: Array<{
+        id: string;
+        visibility?: "public" | "private";
+        write_policy?: "members" | "operators" | "registered_agents";
+    }>;
+}
+export interface MoltnetNodeConfigResult {
+    clientAuth: MoltnetClientAuthPlan;
+    content: string;
+    usesPerAttachmentOpenToken: boolean;
+}
+export declare const createMoltnetNodeConfigContent: ({ agentNode, attachment, networkServer, nodeSlug, plan, serverPlan }: {
+    agentNode: ResolvedAgentNode;
+    attachment: ResolvedMoltnetAttachment & {
+        memberId: string;
+    };
+    networkServer: TeamNetworkServer;
+    nodeSlug: string;
+    plan: CompilePlan;
+    serverPlan: MoltnetNodeConfigServerPlan;
+}) => MoltnetNodeConfigResult;
+export {};

package/dist/compiler/moltnetNodeConfig.js

@@ -0,0 +1,70 @@
+import { resolveMoltnetClientAuth } from "./moltnetConfigLowering.js";
+import { resolveRuntimeConfig } from "./moltnetRuntimeConfig.js";
+export const createMoltnetNodeConfigContent = ({ agentNode, attachment, networkServer, nodeSlug, plan, serverPlan }) => {
+    const clientAuth = resolveMoltnetClientAuth(networkServer, attachment.network, attachment.memberId, nodeSlug);
+    const usesPerAttachmentOpenToken = clientAuth.mode === "open" &&
+        clientAuth.staticToken !== true &&
+        Boolean(clientAuth.tokenEnv || clientAuth.tokenPath);
+    return {
+        clientAuth,
+        content: `${JSON.stringify({
+            version: "moltnet.node.v1",
+            moltnet: {
+                base_url: serverPlan.baseUrl,
+                network_id: attachment.network,
+                ...(clientAuth.mode === "none" ? {} : { auth_mode: clientAuth.mode }),
+                ...(clientAuth.registration ? { registration: clientAuth.registration } : {}),
+                ...(clientAuth.staticToken ? { static_token: true } : {}),
+                ...(!usesPerAttachmentOpenToken && clientAuth.tokenEnv
+                    ? { token_env: clientAuth.tokenEnv }
+                    : {}),
+                ...(!usesPerAttachmentOpenToken && clientAuth.tokenPath
+                    ? { token_path: clientAuth.tokenPath }
+                    : {})
+            },
+            attachments: [
+                {
+                    agent: {
+                        id: attachment.memberId,
+                        name: agentNode.name
+                    },
+                    ...(usesPerAttachmentOpenToken
+                        ? {
+                            moltnet: {
+                                ...(clientAuth.tokenEnv ? { token_env: clientAuth.tokenEnv } : {}),
+                                ...(clientAuth.tokenPath ? { token_path: clientAuth.tokenPath } : {})
+                            }
+                        }
+                        : {}),
+                    runtime: resolveRuntimeConfig(plan, agentNode, nodeSlug, attachment.network, attachment.memberId),
+                    ...(attachment.rooms
+                        ? {
+                            rooms: Object.entries(attachment.rooms)
+                                .sort(([left], [right]) => left.localeCompare(right))
+                                .map(([roomId, policy]) => {
+                                const room = serverPlan.rooms.find((entry) => entry.id === roomId);
+                                return {
+                                    id: roomId,
+                                    ...(room?.visibility ? { visibility: room.visibility } : {}),
+                                    ...(room?.write_policy ? { write_policy: room.write_policy } : {}),
+                                    ...(policy.read ? { read: policy.read } : {}),
+                                    ...(policy.reply ? { reply: policy.reply } : {})
+                                };
+                            })
+                        }
+                        : {}),
+                    ...(attachment.dms
+                        ? {
+                            dms: {
+                                enabled: attachment.dms.enabled,
+                                ...(attachment.dms.read ? { read: attachment.dms.read } : {}),
+                                ...(attachment.dms.reply ? { reply: attachment.dms.reply } : {})
+                            }
+                        }
+                        : {})
+                }
+            ]
+        }, null, 2)}\n`,
+        usesPerAttachmentOpenToken
+    };
+};

package/dist/compiler/moltnetRoomPolicyCompatibility.d.ts

@@ -0,0 +1,4 @@
+import type { TeamNetworkServer } from "../manifest/index.js";
+export declare const assertCompatibleMoltnetNetworkName: (networkId: string, existing: string | undefined, next: string | undefined) => void;
+export declare const assertCompatibleMoltnetServer: (networkId: string, existing: TeamNetworkServer, next: TeamNetworkServer) => void;
+export declare const assertCompatibleMoltnetRoomPolicy: (networkId: string, roomId: string, field: "visibility" | "write_policy", existing: string | undefined, next: string | undefined) => void;

package/dist/compiler/moltnetRoomPolicyCompatibility.js

@@ -0,0 +1,28 @@
+import { SpawnfileError } from "../shared/index.js";
+const stableStringify = (value) => {
+    if (Array.isArray(value)) {
+        return `[${value.map(stableStringify).join(",")}]`;
+    }
+    if (value && typeof value === "object") {
+        return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stableStringify(entry)}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+};
+export const assertCompatibleMoltnetNetworkName = (networkId, existing, next) => {
+    if (existing !== undefined && next !== undefined && existing !== next) {
+        throw new SpawnfileError("validation_error", `Duplicate Moltnet network ${networkId} declares conflicting network name: ${existing} vs ${next}`);
+    }
+};
+export const assertCompatibleMoltnetServer = (networkId, existing, next) => {
+    if (stableStringify(existing.auth) !== stableStringify(next.auth)) {
+        throw new SpawnfileError("validation_error", `Duplicate Moltnet network ${networkId} declares conflicting server.auth policy`);
+    }
+    if (stableStringify(existing) !== stableStringify(next)) {
+        throw new SpawnfileError("validation_error", `Duplicate Moltnet network ${networkId} declares conflicting server definition`);
+    }
+};
+export const assertCompatibleMoltnetRoomPolicy = (networkId, roomId, field, existing, next) => {
+    if (existing !== undefined && next !== undefined && existing !== next) {
+        throw new SpawnfileError("validation_error", `Duplicate Moltnet network ${networkId} room ${roomId} declares conflicting ${field}: ${existing} vs ${next}`);
+    }
+};

package/dist/compiler/types.d.ts

@@ -113,6 +113,8 @@ export interface ResolvedTeamNetworkRoom {
     id: string;
     members: string[];
     name?: string;
+    visibility?: "public" | "private";
+    write_policy?: "members" | "operators" | "registered_agents";
 }
 export interface ResolvedTeamNetwork {
     expose?: boolean;

package/dist/compiler/view/buildOrganizationView.js

@@ -30,7 +30,11 @@ const buildTreeNetworkSummaries = (node) => {
         return [];
     }
     return (node.value.networks ?? []).map((network) => ({
+        agentRegistration: network.server?.auth.agent_registration,
         authMode: network.server?.auth.mode,
+        consoleAnalytics: network.server?.mode === "managed"
+            ? network.server.console?.analytics?.provider
+            : undefined,
         debugEvents: network.server?.mode === "managed" ? network.server.debug_events : undefined,
         directMessages: network.server?.mode === "managed" ? network.server.direct_messages : undefined,
         expose: network.server?.mode === "managed" ? network.server.human_ingress : undefined,
@@ -38,11 +42,14 @@ const buildTreeNetworkSummaries = (node) => {
         id: network.id,
         name: network.name,
         provider: network.provider,
+        publicRead: network.server?.auth.public_read,
         serverMode: network.server?.mode,
         url: network.server?.url,
         rooms: network.rooms.map((room) => ({
             declaredMembers: [...room.members],
-            id: room.id
+            id: room.id,
+            ...(room.visibility ? { visibility: room.visibility } : {}),
+            ...(room.write_policy ? { writePolicy: room.write_policy } : {})
         }))
     }));
 };
@@ -107,7 +114,11 @@ const toNetworkMemberView = (membership) => ({
 });
 const createNetworkKey = (provider, networkId) => `${provider}::${networkId}`;
 const buildNetworkDeclaration = (teamNode, network, roomMemberships) => ({
+    agentRegistration: network.server?.auth.agent_registration,
     authMode: network.server?.auth.mode,
+    consoleAnalytics: network.server?.mode === "managed"
+        ? network.server.console?.analytics?.provider
+        : undefined,
     debugEvents: network.server?.mode === "managed" ? network.server.debug_events : undefined,
     declaringTeamName: teamNode.name,
     declaringTeamSource: teamNode.source,
@@ -115,6 +126,7 @@ const buildNetworkDeclaration = (teamNode, network, roomMemberships) => ({
     expose: network.server?.mode === "managed" ? network.server.human_ingress : undefined,
     httpEnabled: network.server?.mode === "managed" ? network.server.human_ingress === true : false,
     name: network.name,
+    publicRead: network.server?.auth.public_read,
     serverMode: network.server?.mode,
     url: network.server?.url,
     rooms: network.rooms.map((room) => {
@@ -126,7 +138,9 @@ const buildNetworkDeclaration = (teamNode, network, roomMemberships) => ({
         return {
             declaredMembers: [...room.members],
             id: room.id,
-            members: sortNetworkMembers(room.members, members)
+            members: sortNetworkMembers(room.members, members),
+            ...(room.visibility ? { visibility: room.visibility } : {}),
+            ...(room.write_policy ? { writePolicy: room.write_policy } : {})
         };
     })
 });
@@ -151,7 +165,9 @@ const buildNetworks = (plan) => {
                 declaringTeamName: declaration.declaringTeamName,
                 declaringTeamSource: declaration.declaringTeamSource,
                 declarations: [declaration],
+                agentRegistration: declaration.agentRegistration,
                 authMode: declaration.authMode,
+                consoleAnalytics: declaration.consoleAnalytics,
                 debugEvents: declaration.debugEvents,
                 directMessages: declaration.directMessages,
                 expose: declaration.expose,
@@ -159,6 +175,7 @@ const buildNetworks = (plan) => {
                 id: network.id,
                 name: declaration.name,
                 provider: network.provider,
+                publicRead: declaration.publicRead,
                 serverMode: declaration.serverMode,
                 url: declaration.url,
                 rooms: declaration.rooms
@@ -171,11 +188,15 @@ const buildNetworks = (plan) => {
         if (firstDeclaration) {
             network.declaringTeamName = firstDeclaration.declaringTeamName;
             network.declaringTeamSource = firstDeclaration.declaringTeamSource;
+            network.agentRegistration = firstDeclaration.agentRegistration;
             network.authMode = firstDeclaration.authMode;
+            network.consoleAnalytics = firstDeclaration.consoleAnalytics;
+            network.debugEvents = firstDeclaration.debugEvents;
             network.directMessages = firstDeclaration.directMessages;
             network.expose = firstDeclaration.expose;
             network.httpEnabled = firstDeclaration.httpEnabled;
             network.name = firstDeclaration.name;
+            network.publicRead = firstDeclaration.publicRead;
             network.serverMode = firstDeclaration.serverMode;
             network.url = firstDeclaration.url;
             network.rooms = firstDeclaration.rooms;

package/dist/compiler/view/renderNetworks.js

@@ -41,6 +41,8 @@ const formatNetwork = (network, options) => {
 const getDeclarations = (network) => network.declarations ?? [
     {
         authMode: network.authMode,
+        agentRegistration: network.agentRegistration,
+        consoleAnalytics: network.consoleAnalytics,
         declaringTeamName: network.declaringTeamName,
         declaringTeamSource: network.declaringTeamSource,
         debugEvents: network.debugEvents,
@@ -48,6 +50,7 @@ const getDeclarations = (network) => network.declarations ?? [
         expose: network.expose,
         httpEnabled: network.httpEnabled,
         name: network.name,
+        publicRead: network.publicRead,
         rooms: network.rooms,
         serverMode: network.serverMode,
         url: network.url
@@ -58,6 +61,9 @@ const formatDeclaration = (network, declaration, options, projectRoot) => {
         declaration.serverMode ? `server=${declaration.serverMode}` : undefined,
         declaration.url ? `url=${declaration.url}` : undefined,
         declaration.authMode ? `auth=${declaration.authMode}` : undefined,
+        declaration.publicRead !== undefined ? `public_read=${declaration.publicRead}` : undefined,
+        declaration.agentRegistration ? `registration=${declaration.agentRegistration}` : undefined,
+        declaration.consoleAnalytics ? `analytics=${declaration.consoleAnalytics}` : undefined,
         declaration.directMessages === false ? "dms=disabled" : undefined,
         declaration.debugEvents === true ? "debug_events" : undefined,
         declaration.expose === true || declaration.httpEnabled ? "human_ingress" : undefined
@@ -88,7 +94,11 @@ export const renderOrganizationNetworks = (view, options = {}) => {
                 const legacyDeclared = options.declared && !view.projectRoot
                     ? ` room ${room.id} declared [${room.declaredMembers.join(", ")}]`
                     : "";
-                lines.push(`${declarationPrefix}${roomLast ? glyphs.last : glyphs.branch}#${room.id}${legacyDeclared}`);
+                const roomMetadata = [
+                    room.visibility ? `visibility=${room.visibility}` : undefined,
+                    room.writePolicy ? `write=${room.writePolicy}` : undefined
+                ].filter((entry) => entry !== undefined);
+                lines.push(`${declarationPrefix}${roomLast ? glyphs.last : glyphs.branch}#${room.id}${roomMetadata.length > 0 ? ` ${roomMetadata.join(" ")}` : ""}${legacyDeclared}`);
                 if (options.declared) {
                     const declaredMembers = room.declaredMembers.length > 0
                         ? room.declaredMembers.join(", ")

package/dist/compiler/view/renderTree.js

@@ -28,12 +28,21 @@ const formatNetworkSummary = (network, options) => {
         network.serverMode ? `server=${network.serverMode}` : undefined,
         network.url ? `url=${network.url}` : undefined,
         network.authMode ? `auth=${network.authMode}` : undefined,
+        network.publicRead !== undefined ? `public_read=${network.publicRead}` : undefined,
+        network.agentRegistration ? `registration=${network.agentRegistration}` : undefined,
+        network.consoleAnalytics ? `analytics=${network.consoleAnalytics}` : undefined,
         network.directMessages === false ? "dms=disabled" : undefined,
         network.debugEvents === true ? "debug_events" : undefined,
         network.expose === true || network.httpEnabled ? "human_ingress" : undefined
     ].filter((entry) => entry !== undefined);
     const rooms = network.rooms
-        .map((room) => `${room.id} [${room.declaredMembers.join(", ")}]`)
+        .map((room) => {
+        const roomMetadata = [
+            room.visibility ? `visibility=${room.visibility}` : undefined,
+            room.writePolicy ? `write=${room.writePolicy}` : undefined
+        ].filter((entry) => entry !== undefined);
+        return `${room.id}${roomMetadata.length > 0 ? ` ${roomMetadata.join(" ")}` : ""} [${room.declaredMembers.join(", ")}]`;
+    })
         .join("; ");
     return `network ${id} "${network.name}"${metadata.length > 0 ? ` ${metadata.join(" ")}` : ""}: ${rooms}`;
 };

package/dist/compiler/view/types.d.ts

@@ -15,9 +15,13 @@ export interface OrganizationViewTreeNode {
 export interface OrganizationTreeNetworkRoomSummary {
     declaredMembers: string[];
     id: string;
+    visibility?: "public" | "private";
+    writePolicy?: "members" | "operators" | "registered_agents";
 }
 export interface OrganizationTreeNetworkSummary {
+    agentRegistration?: "disabled" | "open" | "token";
     authMode?: "bearer" | "none" | "open";
+    consoleAnalytics?: string;
     debugEvents?: boolean;
     directMessages?: boolean;
     expose?: boolean;
@@ -25,6 +29,7 @@ export interface OrganizationTreeNetworkSummary {
     id: string;
     name: string;
     provider: "moltnet";
+    publicRead?: boolean;
     serverMode?: "external" | "managed";
     url?: string;
     rooms: OrganizationTreeNetworkRoomSummary[];
@@ -48,7 +53,9 @@ export interface OrganizationNetworkMemberView {
     representativePath?: string[];
 }
 export interface OrganizationNetworkDeclarationView {
+    agentRegistration?: "disabled" | "open" | "token";
     authMode?: "bearer" | "none" | "open";
+    consoleAnalytics?: string;
     debugEvents?: boolean;
     declaringTeamName: string;
     declaringTeamSource: string;
@@ -56,6 +63,7 @@ export interface OrganizationNetworkDeclarationView {
     expose?: boolean;
     httpEnabled?: boolean;
     name: string;
+    publicRead?: boolean;
     rooms: OrganizationNetworkRoomView[];
     serverMode?: "external" | "managed";
     url?: string;
@@ -64,9 +72,13 @@ export interface OrganizationNetworkRoomView {
     declaredMembers: string[];
     id: string;
     members: OrganizationNetworkMemberView[];
+    visibility?: "public" | "private";
+    writePolicy?: "members" | "operators" | "registered_agents";
 }
 export interface OrganizationNetworkView {
+    agentRegistration?: "disabled" | "open" | "token";
     authMode?: "bearer" | "none" | "open";
+    consoleAnalytics?: string;
     debugEvents?: boolean;
     declaringTeamName: string;
     declaringTeamSource: string;
@@ -76,6 +88,7 @@ export interface OrganizationNetworkView {
     id: string;
     name: string;
     provider: "moltnet";
+    publicRead?: boolean;
     rooms: OrganizationNetworkRoomView[];
     serverMode?: "external" | "managed";
     url?: string;

package/dist/manifest/renderSpawnfileNetworks.js

@@ -35,6 +35,8 @@ const orderTeamAuth = (server) => withDefinedEntries([
         "auth",
         withDefinedEntries([
             ["mode", server.auth.mode],
+            ["public_read", server.auth.public_read],
+            ["agent_registration", server.auth.agent_registration],
             ["tokens", server.auth.tokens?.map(orderTeamAuthToken)],
             [
                 "client",
@@ -49,6 +51,7 @@ const orderTeamAuth = (server) => withDefinedEntries([
             ]
         ])
     ],
+    ["console", server.mode === "managed" ? server.console : undefined],
     ["store", orderTeamStore(server)],
     [
         "pairings",
@@ -75,6 +78,8 @@ export const orderTeamNetworks = (networks) => networks?.map((network) => withDe
         network.rooms.map((room) => withDefinedEntries([
             ["id", room.id],
             ["name", room.name],
+            ["visibility", room.visibility],
+            ["write_policy", room.write_policy],
             ["members", room.members]
         ]))
     ]

package/dist/manifest/schemas.d.ts

@@ -630,10 +630,24 @@ declare const teamManifestSchema: z.ZodObject<{
             id: z.ZodString;
             members: z.ZodArray<z.ZodString>;
             name: z.ZodOptional<z.ZodString>;
+            visibility: z.ZodOptional<z.ZodEnum<{
+                public: "public";
+                private: "private";
+            }>>;
+            write_policy: z.ZodOptional<z.ZodEnum<{
+                members: "members";
+                registered_agents: "registered_agents";
+                operators: "operators";
+            }>>;
         }, z.core.$strict>>;
         server: z.ZodDiscriminatedUnion<[z.ZodObject<{
             allowed_origins: z.ZodOptional<z.ZodArray<z.ZodString>>;
             auth: z.ZodObject<{
+                agent_registration: z.ZodOptional<z.ZodEnum<{
+                    token: "token";
+                    disabled: "disabled";
+                    open: "open";
+                }>>;
                 client: z.ZodOptional<z.ZodObject<{
                     static_token: z.ZodOptional<z.ZodBoolean>;
                     token_env: z.ZodOptional<z.ZodString>;
@@ -645,6 +659,7 @@ declare const teamManifestSchema: z.ZodObject<{
                     open: "open";
                     bearer: "bearer";
                 }>;
+                public_read: z.ZodOptional<z.ZodBoolean>;
                 tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
                     id: z.ZodString;
@@ -658,6 +673,12 @@ declare const teamManifestSchema: z.ZodObject<{
                     }>>;
                 }, z.core.$strict>>>;
             }, z.core.$strict>;
+            console: z.ZodOptional<z.ZodObject<{
+                analytics: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    provider: z.ZodLiteral<"google">;
+                    measurement_id: z.ZodString;
+                }, z.core.$strict>], "provider">>;
+            }, z.core.$strict>>;
             debug_events: z.ZodOptional<z.ZodBoolean>;
             direct_messages: z.ZodOptional<z.ZodBoolean>;
             human_ingress: z.ZodOptional<z.ZodBoolean>;
@@ -705,6 +726,11 @@ declare const teamManifestSchema: z.ZodObject<{
             url: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>, z.ZodObject<{
             auth: z.ZodObject<{
+                agent_registration: z.ZodOptional<z.ZodEnum<{
+                    token: "token";
+                    disabled: "disabled";
+                    open: "open";
+                }>>;
                 client: z.ZodOptional<z.ZodObject<{
                     static_token: z.ZodOptional<z.ZodBoolean>;
                     token_env: z.ZodOptional<z.ZodString>;
@@ -716,6 +742,7 @@ declare const teamManifestSchema: z.ZodObject<{
                     open: "open";
                     bearer: "bearer";
                 }>;
+                public_read: z.ZodOptional<z.ZodBoolean>;
                 tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
                     id: z.ZodString;
@@ -1286,10 +1313,24 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             id: z.ZodString;
             members: z.ZodArray<z.ZodString>;
             name: z.ZodOptional<z.ZodString>;
+            visibility: z.ZodOptional<z.ZodEnum<{
+                public: "public";
+                private: "private";
+            }>>;
+            write_policy: z.ZodOptional<z.ZodEnum<{
+                members: "members";
+                registered_agents: "registered_agents";
+                operators: "operators";
+            }>>;
         }, z.core.$strict>>;
         server: z.ZodDiscriminatedUnion<[z.ZodObject<{
             allowed_origins: z.ZodOptional<z.ZodArray<z.ZodString>>;
             auth: z.ZodObject<{
+                agent_registration: z.ZodOptional<z.ZodEnum<{
+                    token: "token";
+                    disabled: "disabled";
+                    open: "open";
+                }>>;
                 client: z.ZodOptional<z.ZodObject<{
                     static_token: z.ZodOptional<z.ZodBoolean>;
                     token_env: z.ZodOptional<z.ZodString>;
@@ -1301,6 +1342,7 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                     open: "open";
                     bearer: "bearer";
                 }>;
+                public_read: z.ZodOptional<z.ZodBoolean>;
                 tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
                     id: z.ZodString;
@@ -1314,6 +1356,12 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                     }>>;
                 }, z.core.$strict>>>;
             }, z.core.$strict>;
+            console: z.ZodOptional<z.ZodObject<{
+                analytics: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    provider: z.ZodLiteral<"google">;
+                    measurement_id: z.ZodString;
+                }, z.core.$strict>], "provider">>;
+            }, z.core.$strict>>;
             debug_events: z.ZodOptional<z.ZodBoolean>;
             direct_messages: z.ZodOptional<z.ZodBoolean>;
             human_ingress: z.ZodOptional<z.ZodBoolean>;
@@ -1361,6 +1409,11 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             url: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>, z.ZodObject<{
             auth: z.ZodObject<{
+                agent_registration: z.ZodOptional<z.ZodEnum<{
+                    token: "token";
+                    disabled: "disabled";
+                    open: "open";
+                }>>;
                 client: z.ZodOptional<z.ZodObject<{
                     static_token: z.ZodOptional<z.ZodBoolean>;
                     token_env: z.ZodOptional<z.ZodString>;
@@ -1372,6 +1425,7 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                     open: "open";
                     bearer: "bearer";
                 }>;
+                public_read: z.ZodOptional<z.ZodBoolean>;
                 tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
                     id: z.ZodString;

package/dist/manifest/teamNetworkAccessSchemas.d.ts

@@ -0,0 +1,15 @@
+import { z } from "zod";
+export declare const teamNetworkAgentRegistrationSchema: z.ZodEnum<{
+    token: "token";
+    disabled: "disabled";
+    open: "open";
+}>;
+export declare const teamNetworkRoomVisibilitySchema: z.ZodEnum<{
+    public: "public";
+    private: "private";
+}>;
+export declare const teamNetworkRoomWritePolicySchema: z.ZodEnum<{
+    members: "members";
+    registered_agents: "registered_agents";
+    operators: "operators";
+}>;

package/dist/manifest/teamNetworkAccessSchemas.js

@@ -0,0 +1,8 @@
+import { z } from "zod";
+export const teamNetworkAgentRegistrationSchema = z.enum(["disabled", "token", "open"]);
+export const teamNetworkRoomVisibilitySchema = z.enum(["public", "private"]);
+export const teamNetworkRoomWritePolicySchema = z.enum([
+    "members",
+    "registered_agents",
+    "operators"
+]);

package/dist/manifest/teamNetworkConsoleSchemas.d.ts

@@ -0,0 +1,7 @@
+import { z } from "zod";
+export declare const teamNetworkConsoleSchema: z.ZodObject<{
+    analytics: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        provider: z.ZodLiteral<"google">;
+        measurement_id: z.ZodString;
+    }, z.core.$strict>], "provider">>;
+}, z.core.$strict>;

package/dist/manifest/teamNetworkConsoleSchemas.js

@@ -0,0 +1,19 @@
+import { z } from "zod";
+const teamNetworkConsoleAnalyticsSchema = z
+    .discriminatedUnion("provider", [
+    z
+        .object({
+        provider: z.literal("google"),
+        measurement_id: z
+            .string()
+            .trim()
+            .min(1)
+            .regex(/^G-[A-Za-z0-9_-]+$/, "measurement_id must be a Google Analytics measurement ID")
+    })
+        .strict()
+]);
+export const teamNetworkConsoleSchema = z
+    .object({
+    analytics: teamNetworkConsoleAnalyticsSchema.optional()
+})
+    .strict();

package/dist/manifest/teamNetworkSchemas.d.ts

@@ -2,6 +2,11 @@ import { z } from "zod";
 export { teamWorkspaceDocsSchema, teamWorkspaceSchema } from "./workspaceSchemas.js";
 export type { TeamWorkspace, TeamWorkspaceDocs, TeamWorkspaceResource, TeamWorkspaceResource as TeamNetworkResource } from "./workspaceSchemas.js";
 declare const teamNetworkAuthSchema: z.ZodObject<{
+    agent_registration: z.ZodOptional<z.ZodEnum<{
+        token: "token";
+        disabled: "disabled";
+        open: "open";
+    }>>;
     client: z.ZodOptional<z.ZodObject<{
         static_token: z.ZodOptional<z.ZodBoolean>;
         token_env: z.ZodOptional<z.ZodString>;
@@ -13,6 +18,7 @@ declare const teamNetworkAuthSchema: z.ZodObject<{
         open: "open";
         bearer: "bearer";
     }>;
+    public_read: z.ZodOptional<z.ZodBoolean>;
     tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
         agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
         id: z.ZodString;
@@ -57,6 +63,11 @@ declare const teamNetworkStoreSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
 declare const teamNetworkServerSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     allowed_origins: z.ZodOptional<z.ZodArray<z.ZodString>>;
     auth: z.ZodObject<{
+        agent_registration: z.ZodOptional<z.ZodEnum<{
+            token: "token";
+            disabled: "disabled";
+            open: "open";
+        }>>;
         client: z.ZodOptional<z.ZodObject<{
             static_token: z.ZodOptional<z.ZodBoolean>;
             token_env: z.ZodOptional<z.ZodString>;
@@ -68,6 +79,7 @@ declare const teamNetworkServerSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             open: "open";
             bearer: "bearer";
         }>;
+        public_read: z.ZodOptional<z.ZodBoolean>;
         tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
             agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
             id: z.ZodString;
@@ -81,6 +93,12 @@ declare const teamNetworkServerSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             }>>;
         }, z.core.$strict>>>;
     }, z.core.$strict>;
+    console: z.ZodOptional<z.ZodObject<{
+        analytics: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            provider: z.ZodLiteral<"google">;
+            measurement_id: z.ZodString;
+        }, z.core.$strict>], "provider">>;
+    }, z.core.$strict>>;
     debug_events: z.ZodOptional<z.ZodBoolean>;
     direct_messages: z.ZodOptional<z.ZodBoolean>;
     human_ingress: z.ZodOptional<z.ZodBoolean>;
@@ -128,6 +146,11 @@ declare const teamNetworkServerSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     url: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>, z.ZodObject<{
     auth: z.ZodObject<{
+        agent_registration: z.ZodOptional<z.ZodEnum<{
+            token: "token";
+            disabled: "disabled";
+            open: "open";
+        }>>;
         client: z.ZodOptional<z.ZodObject<{
             static_token: z.ZodOptional<z.ZodBoolean>;
             token_env: z.ZodOptional<z.ZodString>;
@@ -139,6 +162,7 @@ declare const teamNetworkServerSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             open: "open";
             bearer: "bearer";
         }>;
+        public_read: z.ZodOptional<z.ZodBoolean>;
         tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
             agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
             id: z.ZodString;
@@ -159,6 +183,15 @@ declare const teamNetworkRoomSchema: z.ZodObject<{
     id: z.ZodString;
     members: z.ZodArray<z.ZodString>;
     name: z.ZodOptional<z.ZodString>;
+    visibility: z.ZodOptional<z.ZodEnum<{
+        public: "public";
+        private: "private";
+    }>>;
+    write_policy: z.ZodOptional<z.ZodEnum<{
+        members: "members";
+        registered_agents: "registered_agents";
+        operators: "operators";
+    }>>;
 }, z.core.$strict>;
 export declare const teamNetworkSchema: z.ZodObject<{
     id: z.ZodString;
@@ -168,10 +201,24 @@ export declare const teamNetworkSchema: z.ZodObject<{
         id: z.ZodString;
         members: z.ZodArray<z.ZodString>;
         name: z.ZodOptional<z.ZodString>;
+        visibility: z.ZodOptional<z.ZodEnum<{
+            public: "public";
+            private: "private";
+        }>>;
+        write_policy: z.ZodOptional<z.ZodEnum<{
+            members: "members";
+            registered_agents: "registered_agents";
+            operators: "operators";
+        }>>;
     }, z.core.$strict>>;
     server: z.ZodDiscriminatedUnion<[z.ZodObject<{
         allowed_origins: z.ZodOptional<z.ZodArray<z.ZodString>>;
         auth: z.ZodObject<{
+            agent_registration: z.ZodOptional<z.ZodEnum<{
+                token: "token";
+                disabled: "disabled";
+                open: "open";
+            }>>;
             client: z.ZodOptional<z.ZodObject<{
                 static_token: z.ZodOptional<z.ZodBoolean>;
                 token_env: z.ZodOptional<z.ZodString>;
@@ -183,6 +230,7 @@ export declare const teamNetworkSchema: z.ZodObject<{
                 open: "open";
                 bearer: "bearer";
             }>;
+            public_read: z.ZodOptional<z.ZodBoolean>;
             tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 id: z.ZodString;
@@ -196,6 +244,12 @@ export declare const teamNetworkSchema: z.ZodObject<{
                 }>>;
             }, z.core.$strict>>>;
         }, z.core.$strict>;
+        console: z.ZodOptional<z.ZodObject<{
+            analytics: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                provider: z.ZodLiteral<"google">;
+                measurement_id: z.ZodString;
+            }, z.core.$strict>], "provider">>;
+        }, z.core.$strict>>;
         debug_events: z.ZodOptional<z.ZodBoolean>;
         direct_messages: z.ZodOptional<z.ZodBoolean>;
         human_ingress: z.ZodOptional<z.ZodBoolean>;
@@ -243,6 +297,11 @@ export declare const teamNetworkSchema: z.ZodObject<{
         url: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>, z.ZodObject<{
         auth: z.ZodObject<{
+            agent_registration: z.ZodOptional<z.ZodEnum<{
+                token: "token";
+                disabled: "disabled";
+                open: "open";
+            }>>;
             client: z.ZodOptional<z.ZodObject<{
                 static_token: z.ZodOptional<z.ZodBoolean>;
                 token_env: z.ZodOptional<z.ZodString>;
@@ -254,6 +313,7 @@ export declare const teamNetworkSchema: z.ZodObject<{
                 open: "open";
                 bearer: "bearer";
             }>;
+            public_read: z.ZodOptional<z.ZodBoolean>;
             tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 id: z.ZodString;

package/dist/manifest/teamNetworkSchemas.js

@@ -1,4 +1,6 @@
 import { z } from "zod";
+import { teamNetworkAgentRegistrationSchema, teamNetworkRoomVisibilitySchema, teamNetworkRoomWritePolicySchema } from "./teamNetworkAccessSchemas.js";
+import { teamNetworkConsoleSchema } from "./teamNetworkConsoleSchemas.js";
 export { teamWorkspaceDocsSchema, teamWorkspaceSchema } from "./workspaceSchemas.js";
 const moltnetScopeSchema = z.enum(["observe", "write", "admin", "attach", "pair"]);
 const countTruthy = (value) => value.filter((entry) => Boolean(entry)).length;
@@ -48,8 +50,10 @@ const teamNetworkAuthClientSchema = z
 });
 const teamNetworkAuthSchema = z
     .object({
+    agent_registration: teamNetworkAgentRegistrationSchema.optional(),
     client: teamNetworkAuthClientSchema.optional(),
     mode: z.enum(["none", "bearer", "open"]),
+    public_read: z.boolean().optional(),
     tokens: z.array(teamNetworkAuthTokenSchema).optional()
 })
     .strict()
@@ -69,10 +73,10 @@ const teamNetworkAuthSchema = z
         }
         return;
     }
-    if (value.mode === "bearer" && !value.client) {
+    if (value.mode === "bearer" && !value.client && value.agent_registration !== "open") {
         context.addIssue({
             code: z.ZodIssueCode.custom,
-            message: "auth.mode bearer requires auth.client"
+            message: "auth.mode bearer requires auth.client unless agent_registration is open"
         });
     }
     if (value.mode === "open" && value.client) {
@@ -94,6 +98,9 @@ const teamNetworkAuthSchema = z
             });
         }
     }
+    if (value.mode === "open" && value.agent_registration && value.agent_registration !== "open") {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: "auth.mode open requires agent_registration open when declared" });
+    }
     if (value.tokens) {
         const tokenIds = value.tokens.map((token) => token.id);
         if (new Set(tokenIds).size !== tokenIds.length) {
@@ -182,6 +189,7 @@ const teamNetworkManagedServerSchema = z
     .object({
     allowed_origins: z.array(z.string().trim().min(1)).optional(),
     auth: teamNetworkAuthSchema,
+    console: teamNetworkConsoleSchema.optional(),
     debug_events: z.boolean().optional(),
     direct_messages: z.boolean().optional(),
     human_ingress: z.boolean().optional(),
@@ -201,13 +209,13 @@ const teamNetworkManagedServerSchema = z
                 message: "managed server with auth.mode bearer requires at least one auth token"
             });
         }
-        if (!value.auth.client?.token_id) {
+        if (value.auth.client && !value.auth.client.token_id) {
             context.addIssue({
                 code: z.ZodIssueCode.custom,
                 message: "managed bearer auth requires auth.client.token_id"
             });
         }
-        if (value.auth.client?.token_env || value.auth.client?.token_path) {
+        if (value.auth.client && (value.auth.client.token_env || value.auth.client.token_path)) {
             context.addIssue({
                 code: z.ZodIssueCode.custom,
                 message: "managed bearer auth requires auth.client.token_id"
@@ -243,6 +251,9 @@ const teamNetworkManagedServerSchema = z
                 message: "managed open auth client token source must be token_id"
             });
         }
+        if (value.auth.client.token_id && !value.auth.tokens?.some((token) => token.id === value.auth.client?.token_id)) {
+            context.addIssue({ code: z.ZodIssueCode.custom, message: `managed open auth references unknown token: ${value.auth.client.token_id}` });
+        }
     }
 });
 const teamNetworkExternalServerSchema = z
@@ -287,7 +298,7 @@ const teamNetworkExternalServerSchema = z
             message: "external open auth requires token_env or token_path"
         });
     }
-    if (value.auth.mode === "bearer") {
+    if (value.auth.mode === "bearer" && value.auth.client) {
         const sourceCount = countTruthy([
             value.auth.client.token_id,
             value.auth.client.token_env,
@@ -308,8 +319,10 @@ const teamNetworkServerSchema = z.discriminatedUnion("mode", [
 const teamNetworkRoomSchema = z
     .object({
     id: z.string().trim().min(1),
-    members: z.array(z.string().trim().min(1)).min(1),
-    name: z.string().trim().min(1).optional()
+    members: z.array(z.string().trim().min(1)),
+    name: z.string().trim().min(1).optional(),
+    visibility: teamNetworkRoomVisibilitySchema.optional(),
+    write_policy: teamNetworkRoomWritePolicySchema.optional()
 })
     .strict();
 export const teamNetworkSchema = z

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spawnfile",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "Canonical source compiler for autonomous agents and teams.",
   "license": "MIT",
   "type": "module",