spawnfile 0.1.10 → 0.1.12

package/dist/distribution/tarReader.js

@@ -0,0 +1,69 @@
+import { SpawnfileError } from "../shared/index.js";
+const BLOCK_SIZE = 512;
+const parseOctal = (buffer, offset, length) => {
+    const raw = buffer
+        .subarray(offset, offset + length)
+        .toString("ascii")
+        .replace(/\0.*$/, "")
+        .trim();
+    if (raw === "") {
+        return 0;
+    }
+    const parsed = Number.parseInt(raw, 8);
+    if (!Number.isFinite(parsed) || parsed < 0) {
+        throw new SpawnfileError("validation_error", "Malformed tar header: invalid numeric field");
+    }
+    return parsed;
+};
+const isZeroBlock = (block) => block.every((byte) => byte === 0);
+/**
+ * Extracts exactly one regular file from a (single-file) tar stream such as the
+ * output of `docker cp <container>:<file> -`. Rejects symlinks, hardlinks,
+ * directories, path traversal, and oversized payloads, because the stream is
+ * untrusted input pulled from a registry.
+ */
+export const extractSingleFileFromTar = (tar, options) => {
+    let offset = 0;
+    let result = null;
+    while (offset + BLOCK_SIZE <= tar.length) {
+        const header = tar.subarray(offset, offset + BLOCK_SIZE);
+        if (isZeroBlock(header)) {
+            break;
+        }
+        offset += BLOCK_SIZE;
+        const name = header.subarray(0, 100).toString("ascii").replace(/\0.*$/, "");
+        const size = parseOctal(header, 124, 12);
+        const typeFlag = String.fromCharCode(header[156] ?? 0);
+        if (typeFlag === "5") {
+            throw new SpawnfileError("validation_error", `Refusing tar directory entry: ${name}`);
+        }
+        if (typeFlag === "2" || typeFlag === "1") {
+            throw new SpawnfileError("validation_error", `Refusing tar link entry: ${name}`);
+        }
+        if (typeFlag !== "0" && typeFlag !== "\0") {
+            // Skip metadata entries (pax headers, global headers) without treating
+            // them as the payload.
+            offset += Math.ceil(size / BLOCK_SIZE) * BLOCK_SIZE;
+            continue;
+        }
+        if (name.includes("..")) {
+            throw new SpawnfileError("validation_error", `Refusing tar entry with traversal: ${name}`);
+        }
+        if (size > options.maxBytes) {
+            throw new SpawnfileError("validation_error", `Embedded report exceeds the ${options.maxBytes}-byte size cap`);
+        }
+        if (result) {
+            throw new SpawnfileError("validation_error", "Expected a single-file tar stream but found multiple file entries");
+        }
+        const contentEnd = offset + size;
+        if (contentEnd > tar.length) {
+            throw new SpawnfileError("validation_error", "Truncated tar stream");
+        }
+        result = Buffer.from(tar.subarray(offset, contentEnd));
+        offset += Math.ceil(size / BLOCK_SIZE) * BLOCK_SIZE;
+    }
+    if (!result) {
+        throw new SpawnfileError("validation_error", "No file entry found in tar stream");
+    }
+    return result;
+};

package/dist/distribution/types.d.ts

@@ -0,0 +1,80 @@
+import type { ModelAuthMethod } from "../shared/index.js";
+export type DistributionSecretCategory = "model" | "project" | "runtime" | "surface";
+export interface DistributionSecretEntry {
+    generated: boolean;
+    name: string;
+    required: boolean;
+}
+export interface DistributionAgentSummary {
+    id: string;
+    name: string;
+    runtime: string | null;
+    teams: string[];
+}
+export interface DistributionTeamSummary {
+    agents: string[];
+    id: string;
+    name: string;
+}
+export interface DistributionOrganizationSummary {
+    agents: DistributionAgentSummary[];
+    project: string;
+    teams: DistributionTeamSummary[];
+}
+export interface DistributionPersistentMount {
+    durability: "persistent";
+    id: string;
+    kind: "volume";
+    target: string;
+}
+export interface DistributionWorkspaceResource {
+    id: string;
+    kind: "git" | "volume";
+    link_path: string;
+    mode: "mutable" | "readonly";
+    mount: string;
+    sharing: "per_agent" | "team";
+}
+export interface DistributionRuntimeInstance {
+    config_path: string;
+    home_path: string | null;
+    id: string;
+    internal_port: number | null;
+    model_auth_methods: Record<string, ModelAuthMethod>;
+    model_secrets_required: string[];
+    node_ids: string[];
+    published_port: number | null;
+    runtime: string;
+    workspace_path: string;
+}
+export interface DistributionMoltnetNetwork {
+    binding: "env";
+    id: string;
+    server_mode: "external" | "managed";
+}
+export interface DistributionPortMapping {
+    internal_port: number;
+    published_port: number;
+}
+export interface DistributionReport {
+    compile_fingerprint: string;
+    generated_at: string;
+    internal_ports: number[];
+    model_auth_methods: Record<string, ModelAuthMethod>;
+    moltnet: {
+        networks: DistributionMoltnetNetwork[];
+    };
+    organization: DistributionOrganizationSummary;
+    persistent_mounts: DistributionPersistentMount[];
+    port_mappings: DistributionPortMapping[];
+    ports: number[];
+    resources: DistributionWorkspaceResource[];
+    runtime_instances: DistributionRuntimeInstance[];
+    secrets: Record<DistributionSecretCategory, DistributionSecretEntry[]>;
+    version: "spawnfile.distribution-report.v1";
+}
+export declare const DISTRIBUTION_REPORT_VERSION = "spawnfile.distribution-report.v1";
+export declare const DISTRIBUTION_REPORT_IMAGE_PATH = "/spawnfile/spawnfile-report.json";
+export declare const DISTRIBUTION_REPORT_OUTPUT_FILE = "distribution-report.json";
+export declare const IMAGE_CONTRACT_VERSION = "spawnfile.image.v1";
+export type DistributionImageLabels = Record<"com.spawnfile.compile_fingerprint" | "com.spawnfile.image_contract" | "com.spawnfile.project" | "com.spawnfile.report", string> & Record<string, string>;

package/dist/distribution/types.js

@@ -0,0 +1,4 @@
+export const DISTRIBUTION_REPORT_VERSION = "spawnfile.distribution-report.v1";
+export const DISTRIBUTION_REPORT_IMAGE_PATH = "/spawnfile/spawnfile-report.json";
+export const DISTRIBUTION_REPORT_OUTPUT_FILE = "distribution-report.json";
+export const IMAGE_CONTRACT_VERSION = "spawnfile.image.v1";

package/dist/distribution/verifyDistributionReport.d.ts

@@ -0,0 +1,12 @@
+import type { DistributionReport } from "./types.js";
+export interface VerifyDistributionReportInput {
+    forbiddenPathFragments?: string[];
+    report: unknown;
+}
+/**
+ * Pre-push verification for a published image's distribution report. Confirms
+ * the report parses, is free of creator host-path fragments, and that every
+ * secret entry carries the required/generated markers. Throws on any violation
+ * so publishing refuses to ship a leaky or malformed image.
+ */
+export declare const verifyDistributionReport: (input: VerifyDistributionReportInput) => DistributionReport;

package/dist/distribution/verifyDistributionReport.js

@@ -0,0 +1,29 @@
+import { parseDistributionReport } from "./distributionReportSchema.js";
+import { SpawnfileError } from "../shared/index.js";
+/**
+ * Pre-push verification for a published image's distribution report. Confirms
+ * the report parses, is free of creator host-path fragments, and that every
+ * secret entry carries the required/generated markers. Throws on any violation
+ * so publishing refuses to ship a leaky or malformed image.
+ */
+export const verifyDistributionReport = (input) => {
+    const report = parseDistributionReport(input.report, "distribution report for publish");
+    const serialized = JSON.stringify(report);
+    for (const fragment of input.forbiddenPathFragments ?? []) {
+        const trimmed = fragment.trim();
+        if (trimmed.length > 0 && serialized.includes(trimmed)) {
+            throw new SpawnfileError("validation_error", `Distribution report leaks a creator path fragment and must not be published: ${trimmed}`);
+        }
+    }
+    if (serialized.includes("/Users/") || serialized.includes("\\Users\\")) {
+        throw new SpawnfileError("validation_error", "Distribution report contains an absolute home path and must not be published");
+    }
+    for (const category of ["model", "project", "runtime", "surface"]) {
+        for (const entry of report.secrets[category]) {
+            if (typeof entry.required !== "boolean" || typeof entry.generated !== "boolean") {
+                throw new SpawnfileError("validation_error", `Secret ${entry.name} is missing required/generated markers`);
+            }
+        }
+    }
+    return report;
+};

package/dist/filesystem/paths.d.ts

@@ -2,5 +2,11 @@ export declare const assertPortableRelativePath: (inputPath: string) => void;
 export declare const getCanonicalManifestPath: (filePath: string) => string;
 export declare const getManifestPath: (inputPath: string) => string;
 export declare const getProjectRoot: (manifestPath: string) => string;
+/**
+ * Resolves the output/record directory for a project argument. An explicit
+ * `--out` is honored as given; otherwise the default lives under the resolved
+ * project root, not the process working directory.
+ */
+export declare const resolveProjectOutputDirectory: (inputPath: string, outOption: string | undefined, defaultOutputName: string) => string;
 export declare const resolveProjectPath: (manifestPath: string, relativePath: string) => string;
 export declare const toPosixPath: (value: string) => string;

package/dist/filesystem/paths.js

@@ -13,6 +13,17 @@ export const getManifestPath = (inputPath) => path.basename(inputPath) === "Spaw
     ? path.resolve(inputPath)
     : path.resolve(inputPath, "Spawnfile");
 export const getProjectRoot = (manifestPath) => path.dirname(manifestPath);
+/**
+ * Resolves the output/record directory for a project argument. An explicit
+ * `--out` is honored as given; otherwise the default lives under the resolved
+ * project root, not the process working directory.
+ */
+export const resolveProjectOutputDirectory = (inputPath, outOption, defaultOutputName) => {
+    if (outOption) {
+        return path.resolve(outOption);
+    }
+    return path.join(getProjectRoot(getManifestPath(inputPath)), defaultOutputName);
+};
 export const resolveProjectPath = (manifestPath, relativePath) => {
     assertPortableRelativePath(relativePath);
     const projectRoot = getProjectRoot(manifestPath);

package/dist/manifest/loadManifest.js

@@ -115,8 +115,18 @@ const validateLocalTeamManifest = async (manifestPath, manifest) => {
     }
 };
 const parseManifest = (source) => {
+    let parsed;
     try {
-        return manifestSchema.parse(parseYaml(source));
+        parsed = parseYaml(source);
+    }
+    catch (error) {
+        // A YAML syntax error is a malformed manifest, not a runtime failure — wrap
+        // it so it exits as a usage error instead of leaking the parser's wording.
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new SpawnfileError("invalid_manifest", `Invalid Spawnfile manifest: ${reason}`);
+    }
+    try {
+        return manifestSchema.parse(parsed);
     }
     catch (error) {
         if (error instanceof z.ZodError) {
@@ -127,7 +137,17 @@ const parseManifest = (source) => {
     }
 };
 export const loadManifest = async (manifestPath) => {
-    const source = await readUtf8File(manifestPath);
+    let source;
+    try {
+        source = await readUtf8File(manifestPath);
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            // A missing Spawnfile is a usage/input error, not a runtime failure.
+            throw new SpawnfileError("validation_error", `No Spawnfile found at ${manifestPath}. Pass a project directory or Spawnfile path, or run 'spawnfile init'.`);
+        }
+        throw error;
+    }
     const manifest = parseManifest(source);
     if (isAgentManifest(manifest)) {
         await validateLocalAgentManifest(manifestPath, manifest);

package/dist/manifest/renderSpawnfile.js

@@ -67,8 +67,7 @@ const orderMoltnetRoomBehavior = (behavior) => {
         return undefined;
     }
     return withDefinedEntries([
-        ["read", behavior.read],
-        ["reply", behavior.reply]
+        ["wake", behavior.wake]
     ]);
 };
 const orderMoltnetDm = (dms) => {
@@ -77,8 +76,7 @@ const orderMoltnetDm = (dms) => {
     }
     return withDefinedEntries([
         ["enabled", dms.enabled],
-        ["read", dms.read],
-        ["reply", dms.reply]
+        ["wake", dms.wake]
     ]);
 };
 const orderMoltnetAttachment = (attachment) => withDefinedEntries([

package/dist/manifest/renderSpawnfileNetworks.js

@@ -35,6 +35,8 @@ const orderTeamAuth = (server) => withDefinedEntries([
         "auth",
         withDefinedEntries([
             ["mode", server.auth.mode],
+            ["public_read", server.auth.public_read],
+            ["agent_registration", server.auth.agent_registration],
             ["tokens", server.auth.tokens?.map(orderTeamAuthToken)],
             [
                 "client",
@@ -49,6 +51,7 @@ const orderTeamAuth = (server) => withDefinedEntries([
             ]
         ])
     ],
+    ["console", server.mode === "managed" ? server.console : undefined],
     ["store", orderTeamStore(server)],
     [
         "pairings",
@@ -75,6 +78,8 @@ export const orderTeamNetworks = (networks) => networks?.map((network) => withDe
         network.rooms.map((room) => withDefinedEntries([
             ["id", room.id],
             ["name", room.name],
+            ["visibility", room.visibility],
+            ["write_policy", room.write_policy],
             ["members", room.members]
         ]))
     ]

package/dist/manifest/schemas.d.ts

@@ -258,27 +258,21 @@ declare const agentManifestSchema: z.ZodObject<{
         moltnet: z.ZodOptional<z.ZodArray<z.ZodObject<{
             dms: z.ZodOptional<z.ZodObject<{
                 enabled: z.ZodBoolean;
-                read: z.ZodOptional<z.ZodEnum<{
+                wake: z.ZodOptional<z.ZodEnum<{
+                    never: "never";
                     all: "all";
                     mentions: "mentions";
                     thread_only: "thread_only";
                 }>>;
-                reply: z.ZodOptional<z.ZodEnum<{
-                    never: "never";
-                    auto: "auto";
-                }>>;
             }, z.core.$strict>>;
             network: z.ZodString;
             rooms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-                read: z.ZodOptional<z.ZodEnum<{
+                wake: z.ZodOptional<z.ZodEnum<{
+                    never: "never";
                     all: "all";
                     mentions: "mentions";
                     thread_only: "thread_only";
                 }>>;
-                reply: z.ZodOptional<z.ZodEnum<{
-                    never: "never";
-                    auto: "auto";
-                }>>;
             }, z.core.$strict>>>;
         }, z.core.$strict>>>;
         slack: z.ZodOptional<z.ZodObject<{
@@ -536,27 +530,21 @@ declare const teamManifestSchema: z.ZodObject<{
         moltnet: z.ZodOptional<z.ZodArray<z.ZodObject<{
             dms: z.ZodOptional<z.ZodObject<{
                 enabled: z.ZodBoolean;
-                read: z.ZodOptional<z.ZodEnum<{
+                wake: z.ZodOptional<z.ZodEnum<{
+                    never: "never";
                     all: "all";
                     mentions: "mentions";
                     thread_only: "thread_only";
                 }>>;
-                reply: z.ZodOptional<z.ZodEnum<{
-                    never: "never";
-                    auto: "auto";
-                }>>;
             }, z.core.$strict>>;
             network: z.ZodString;
             rooms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-                read: z.ZodOptional<z.ZodEnum<{
+                wake: z.ZodOptional<z.ZodEnum<{
+                    never: "never";
                     all: "all";
                     mentions: "mentions";
                     thread_only: "thread_only";
                 }>>;
-                reply: z.ZodOptional<z.ZodEnum<{
-                    never: "never";
-                    auto: "auto";
-                }>>;
             }, z.core.$strict>>>;
         }, z.core.$strict>>>;
         slack: z.ZodOptional<z.ZodObject<{
@@ -630,10 +618,24 @@ declare const teamManifestSchema: z.ZodObject<{
             id: z.ZodString;
             members: z.ZodArray<z.ZodString>;
             name: z.ZodOptional<z.ZodString>;
+            visibility: z.ZodOptional<z.ZodEnum<{
+                public: "public";
+                private: "private";
+            }>>;
+            write_policy: z.ZodOptional<z.ZodEnum<{
+                members: "members";
+                registered_agents: "registered_agents";
+                operators: "operators";
+            }>>;
         }, z.core.$strict>>;
         server: z.ZodDiscriminatedUnion<[z.ZodObject<{
             allowed_origins: z.ZodOptional<z.ZodArray<z.ZodString>>;
             auth: z.ZodObject<{
+                agent_registration: z.ZodOptional<z.ZodEnum<{
+                    token: "token";
+                    disabled: "disabled";
+                    open: "open";
+                }>>;
                 client: z.ZodOptional<z.ZodObject<{
                     static_token: z.ZodOptional<z.ZodBoolean>;
                     token_env: z.ZodOptional<z.ZodString>;
@@ -645,6 +647,7 @@ declare const teamManifestSchema: z.ZodObject<{
                     open: "open";
                     bearer: "bearer";
                 }>;
+                public_read: z.ZodOptional<z.ZodBoolean>;
                 tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
                     id: z.ZodString;
@@ -658,6 +661,12 @@ declare const teamManifestSchema: z.ZodObject<{
                     }>>;
                 }, z.core.$strict>>>;
             }, z.core.$strict>;
+            console: z.ZodOptional<z.ZodObject<{
+                analytics: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    provider: z.ZodLiteral<"google">;
+                    measurement_id: z.ZodString;
+                }, z.core.$strict>], "provider">>;
+            }, z.core.$strict>>;
             debug_events: z.ZodOptional<z.ZodBoolean>;
             direct_messages: z.ZodOptional<z.ZodBoolean>;
             human_ingress: z.ZodOptional<z.ZodBoolean>;
@@ -705,6 +714,11 @@ declare const teamManifestSchema: z.ZodObject<{
             url: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>, z.ZodObject<{
             auth: z.ZodObject<{
+                agent_registration: z.ZodOptional<z.ZodEnum<{
+                    token: "token";
+                    disabled: "disabled";
+                    open: "open";
+                }>>;
                 client: z.ZodOptional<z.ZodObject<{
                     static_token: z.ZodOptional<z.ZodBoolean>;
                     token_env: z.ZodOptional<z.ZodString>;
@@ -716,6 +730,7 @@ declare const teamManifestSchema: z.ZodObject<{
                     open: "open";
                     bearer: "bearer";
                 }>;
+                public_read: z.ZodOptional<z.ZodBoolean>;
                 tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
                     id: z.ZodString;
@@ -915,27 +930,21 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         moltnet: z.ZodOptional<z.ZodArray<z.ZodObject<{
             dms: z.ZodOptional<z.ZodObject<{
                 enabled: z.ZodBoolean;
-                read: z.ZodOptional<z.ZodEnum<{
+                wake: z.ZodOptional<z.ZodEnum<{
+                    never: "never";
                     all: "all";
                     mentions: "mentions";
                     thread_only: "thread_only";
                 }>>;
-                reply: z.ZodOptional<z.ZodEnum<{
-                    never: "never";
-                    auto: "auto";
-                }>>;
             }, z.core.$strict>>;
             network: z.ZodString;
             rooms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-                read: z.ZodOptional<z.ZodEnum<{
+                wake: z.ZodOptional<z.ZodEnum<{
+                    never: "never";
                     all: "all";
                     mentions: "mentions";
                     thread_only: "thread_only";
                 }>>;
-                reply: z.ZodOptional<z.ZodEnum<{
-                    never: "never";
-                    auto: "auto";
-                }>>;
             }, z.core.$strict>>>;
         }, z.core.$strict>>>;
         slack: z.ZodOptional<z.ZodObject<{
@@ -1192,27 +1201,21 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         moltnet: z.ZodOptional<z.ZodArray<z.ZodObject<{
             dms: z.ZodOptional<z.ZodObject<{
                 enabled: z.ZodBoolean;
-                read: z.ZodOptional<z.ZodEnum<{
+                wake: z.ZodOptional<z.ZodEnum<{
+                    never: "never";
                     all: "all";
                     mentions: "mentions";
                     thread_only: "thread_only";
                 }>>;
-                reply: z.ZodOptional<z.ZodEnum<{
-                    never: "never";
-                    auto: "auto";
-                }>>;
             }, z.core.$strict>>;
             network: z.ZodString;
             rooms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-                read: z.ZodOptional<z.ZodEnum<{
+                wake: z.ZodOptional<z.ZodEnum<{
+                    never: "never";
                     all: "all";
                     mentions: "mentions";
                     thread_only: "thread_only";
                 }>>;
-                reply: z.ZodOptional<z.ZodEnum<{
-                    never: "never";
-                    auto: "auto";
-                }>>;
             }, z.core.$strict>>>;
         }, z.core.$strict>>>;
         slack: z.ZodOptional<z.ZodObject<{
@@ -1286,10 +1289,24 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             id: z.ZodString;
             members: z.ZodArray<z.ZodString>;
             name: z.ZodOptional<z.ZodString>;
+            visibility: z.ZodOptional<z.ZodEnum<{
+                public: "public";
+                private: "private";
+            }>>;
+            write_policy: z.ZodOptional<z.ZodEnum<{
+                members: "members";
+                registered_agents: "registered_agents";
+                operators: "operators";
+            }>>;
         }, z.core.$strict>>;
         server: z.ZodDiscriminatedUnion<[z.ZodObject<{
             allowed_origins: z.ZodOptional<z.ZodArray<z.ZodString>>;
             auth: z.ZodObject<{
+                agent_registration: z.ZodOptional<z.ZodEnum<{
+                    token: "token";
+                    disabled: "disabled";
+                    open: "open";
+                }>>;
                 client: z.ZodOptional<z.ZodObject<{
                     static_token: z.ZodOptional<z.ZodBoolean>;
                     token_env: z.ZodOptional<z.ZodString>;
@@ -1301,6 +1318,7 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                     open: "open";
                     bearer: "bearer";
                 }>;
+                public_read: z.ZodOptional<z.ZodBoolean>;
                 tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
                     id: z.ZodString;
@@ -1314,6 +1332,12 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                     }>>;
                 }, z.core.$strict>>>;
             }, z.core.$strict>;
+            console: z.ZodOptional<z.ZodObject<{
+                analytics: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    provider: z.ZodLiteral<"google">;
+                    measurement_id: z.ZodString;
+                }, z.core.$strict>], "provider">>;
+            }, z.core.$strict>>;
             debug_events: z.ZodOptional<z.ZodBoolean>;
             direct_messages: z.ZodOptional<z.ZodBoolean>;
             human_ingress: z.ZodOptional<z.ZodBoolean>;
@@ -1361,6 +1385,11 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             url: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>, z.ZodObject<{
             auth: z.ZodObject<{
+                agent_registration: z.ZodOptional<z.ZodEnum<{
+                    token: "token";
+                    disabled: "disabled";
+                    open: "open";
+                }>>;
                 client: z.ZodOptional<z.ZodObject<{
                     static_token: z.ZodOptional<z.ZodBoolean>;
                     token_env: z.ZodOptional<z.ZodString>;
@@ -1372,6 +1401,7 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                     open: "open";
                     bearer: "bearer";
                 }>;
+                public_read: z.ZodOptional<z.ZodBoolean>;
                 tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
                     id: z.ZodString;
@@ -1486,6 +1516,6 @@ export type SkillReference = z.infer<typeof skillReferenceSchema>;
 export type TeamManifest = z.infer<typeof teamManifestSchema>;
 export type { ExecutionBlock, ModelEndpoint, ModelEntryAuth, ModelTarget } from "./executionSchemas.js";
 export type { TeamNetwork, TeamNetworkRoom, TeamNetworkServer, TeamWorkspace, TeamWorkspaceResource } from "./teamNetworkSchemas.js";
-export type { DiscordSurface, DiscordSurfaceAccess, HttpSurface, HttpSurfaceAccess, HttpSurfaceAuth, MoltnetAttachment, MoltnetDM, MoltnetRead, MoltnetReply, MoltnetRoomBehavior, MoltnetSurface, SlackSurface, SlackSurfaceAccess, SurfacesBlock, TelegramSurface, TelegramSurfaceAccess, WebhookSurface, WhatsAppSurface, WhatsAppSurfaceAccess } from "./surfaceSchemas.js";
+export type { DiscordSurface, DiscordSurfaceAccess, HttpSurface, HttpSurfaceAccess, HttpSurfaceAuth, MoltnetAttachment, MoltnetDM, MoltnetRoomBehavior, MoltnetSurface, MoltnetWake, SlackSurface, SlackSurfaceAccess, SurfacesBlock, TelegramSurface, TelegramSurfaceAccess, WebhookSurface, WhatsAppSurface, WhatsAppSurfaceAccess } from "./surfaceSchemas.js";
 export declare const isAgentManifest: (manifest: Manifest) => manifest is AgentManifest;
 export declare const isTeamManifest: (manifest: Manifest) => manifest is TeamManifest;