spawnfile 0.1.10 → 0.1.12

package/dist/compiler/containerArtifacts.js

@@ -1,5 +1,106 @@
+import { buildDistributionReport, createDistributionImageLabels, DISTRIBUTION_REPORT_OUTPUT_FILE, normalizeProjectLabelSlug } from "../distribution/index.js";
+import { SpawnfileError } from "../shared/index.js";
 import { createEnvVariableMap, createRuntimeTargetPlans } from "./containerArtifactsPlans.js";
 import { createRootfsFiles, renderDockerfile, renderEntrypoint, renderEnvExample } from "./containerArtifactsRender.js";
+const createOrganizationSummary = (plan, compiledNodes) => {
+    const nodes = compiledNodes.map((node) => ({
+        id: node.id ?? `${node.kind}:${node.slug}`,
+        kind: node.kind,
+        name: node.value.name,
+        runtimeName: node.runtimeName,
+        source: node.value.source
+    }));
+    const rootNode = nodes.find((node) => node.source === plan.root)
+        ?? nodes.find((node) => !plan.edges.some((edge) => edge.to === node.id))
+        ?? nodes[0];
+    if (!rootNode) {
+        throw new SpawnfileError("compile_error", `Unable to resolve the root node for ${plan.root}`);
+    }
+    const memberEdges = plan.edges.filter((edge) => edge.kind === "team_member");
+    const teamsByAgent = new Map();
+    for (const edge of memberEdges) {
+        teamsByAgent.set(edge.to, [...(teamsByAgent.get(edge.to) ?? []), edge.from]);
+    }
+    const agentNodes = nodes.filter((node) => node.kind === "agent");
+    const teamNodes = nodes.filter((node) => node.kind === "team");
+    const agentIds = new Set(agentNodes.map((node) => node.id));
+    return {
+        agents: agentNodes
+            .map((node) => ({
+            id: node.id,
+            name: node.name,
+            runtime: node.runtimeName,
+            teams: [...(teamsByAgent.get(node.id) ?? [])].sort()
+        }))
+            .sort((left, right) => left.id.localeCompare(right.id)),
+        project: rootNode.name,
+        teams: teamNodes
+            .map((node) => ({
+            agents: memberEdges
+                .filter((edge) => edge.from === node.id && agentIds.has(edge.to))
+                .map((edge) => edge.to)
+                .sort(),
+            id: node.id,
+            name: node.name
+        }))
+            .sort((left, right) => left.id.localeCompare(right.id))
+    };
+};
+const resolveMoltnetOperatorTokenSecret = (plan) => {
+    const client = plan.server.auth.client;
+    if (!client) {
+        return undefined;
+    }
+    if (client.token_env) {
+        return client.token_env;
+    }
+    if (client.token_path) {
+        return client.token_path;
+    }
+    if (!client.token_id) {
+        return undefined;
+    }
+    return plan.server.auth.tokens?.find((token) => token.id === client.token_id)?.secret;
+};
+const createMoltnetSummary = (moltnet) => {
+    if (!moltnet) {
+        return undefined;
+    }
+    return {
+        node_plans: moltnet.nodePlans.map((plan) => ({
+            config_path: plan.configPath,
+            network_id: plan.networkId
+        })),
+        server_plans: moltnet.serverPlans.map((plan) => {
+            const operatorTokenSecret = resolveMoltnetOperatorTokenSecret(plan);
+            return {
+                auth_mode: plan.server.auth.mode,
+                base_url: plan.baseUrl,
+                ...(plan.configPath ? { config_path: plan.configPath } : {}),
+                ...(plan.server.mode === "managed"
+                    ? { direct_messages: plan.server.direct_messages }
+                    : {}),
+                id: plan.id,
+                mode: plan.mode,
+                network_id: plan.networkId,
+                ...(operatorTokenSecret ? { operator_token_secret: operatorTokenSecret } : {}),
+                ...(plan.port ? { port: plan.port } : {}),
+                ...(plan.server.auth.public_read !== undefined
+                    ? { public_read: plan.server.auth.public_read }
+                    : {}),
+                rooms: plan.rooms.map((room) => ({
+                    id: room.id,
+                    members: [...room.members],
+                    ...(room.visibility ? { visibility: room.visibility } : {}),
+                    ...(room.write_policy ? { write_policy: room.write_policy } : {})
+                })),
+                ...(plan.server.mode === "managed"
+                    ? { store_kind: plan.server.store.kind }
+                    : {})
+            };
+        })
+    };
+};
 export const createContainerArtifacts = async (plan, compiledNodes, options = {}) => {
     const runtimePlans = await createRuntimeTargetPlans(plan, compiledNodes);
     const envVariables = [...createEnvVariableMap(compiledNodes, runtimePlans).values()].sort((left, right) => left.name.localeCompare(right.name));
@@ -23,11 +124,108 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         volume_name: mount.volumeName
     }))
         .sort((left, right) => left.id.localeCompare(right.id));
+    const runtimeInternalPorts = runtimePlans.flatMap((plan) => plan.port ? [plan.port] : []);
+    const internalPorts = [...new Set([...runtimeInternalPorts, ...(options.moltnet?.ports ?? [])])].sort((left, right) => left - right);
+    const runtimePublishedPorts = runtimePlans.flatMap((plan) => plan.publishedPort ? [plan.publishedPort] : []);
+    const publishedPorts = [
+        ...new Set([...runtimePublishedPorts, ...(options.moltnet?.publishedPorts ?? [])])
+    ].sort((left, right) => left - right);
+    const portMappings = runtimePlans
+        .flatMap((plan) => plan.port && plan.publishedPort
+        ? [{ internal_port: plan.port, published_port: plan.publishedPort }]
+        : [])
+        .sort((left, right) => left.published_port - right.published_port
+        || left.internal_port - right.internal_port);
+    const runtimeHomes = [
+        ...new Set(runtimePlans.flatMap((plan) => (plan.instancePaths.homePath ? [plan.instancePaths.homePath] : [])))
+    ].sort();
+    const runtimeInstances = runtimePlans
+        .map((plan) => ({
+        config_path: plan.instancePaths.configPath,
+        home_path: plan.instancePaths.homePath ?? null,
+        id: plan.id,
+        internal_port: plan.port ?? null,
+        model_auth_methods: plan.modelAuthMethods,
+        model_secrets_required: plan.modelSecretsRequired,
+        node_ids: [...(plan.sourceIds ?? [])],
+        published_port: plan.publishedPort ?? null,
+        runtime: plan.runtimeName,
+        workspace_path: plan.instancePaths.workspacePath
+    }))
+        .sort((left, right) => left.id.localeCompare(right.id));
+    const runtimesInstalled = [...new Set(runtimePlans.map((plan) => plan.runtimeName))].sort();
+    const workspaceResources = [
+        ...new Map(runtimePlans.flatMap((plan) => (plan.resources ?? []).map((resource) => [
+            `${resource.kind}:${resource.id}:${resource.linkPath}`,
+            {
+                backing_path: resource.backingPath,
+                id: resource.id,
+                kind: resource.kind,
+                link_path: resource.linkPath,
+                mode: resource.mode,
+                mount: resource.mount,
+                sharing: resource.sharing
+            }
+        ]))).values()
+    ].sort((left, right) => left.link_path.localeCompare(right.link_path) || left.id.localeCompare(right.id));
+    const moltnetSummary = createMoltnetSummary(options.moltnet);
+    const organization = createOrganizationSummary(plan, compiledNodes);
+    const projectSlug = normalizeProjectLabelSlug(organization.project);
+    const mergedModelAuthMethods = Object.assign({}, ...runtimePlans.map((runtimePlan) => runtimePlan.modelAuthMethods));
+    const moltnetNetworks = [
+        ...new Map((options.moltnet?.serverPlans ?? []).map((serverPlan) => [
+            serverPlan.networkId,
+            {
+                binding: "env",
+                id: serverPlan.networkId,
+                server_mode: serverPlan.mode
+            }
+        ])).values()
+    ];
+    const distributionReport = buildDistributionReport({
+        envVariables: envVariables.map((variable) => ({
+            categories: variable.categories,
+            generated: variable.generated,
+            name: variable.name,
+            required: variable.required
+        })),
+        generatedAt: options.generatedAt ?? new Date().toISOString(),
+        internalPorts,
+        modelAuthMethods: mergedModelAuthMethods,
+        moltnetNetworks,
+        organization,
+        persistentMounts: persistentMounts.map((mount) => ({
+            durability: "persistent",
+            id: mount.id,
+            kind: "volume",
+            target: mount.mount_path
+        })),
+        portMappings,
+        publishedPorts,
+        resources: workspaceResources.map((resource) => ({
+            id: resource.id,
+            kind: resource.kind,
+            link_path: resource.link_path,
+            mode: resource.mode,
+            mount: resource.mount,
+            sharing: resource.sharing
+        })),
+        runtimeInstances
+    });
+    const distributionLabels = createDistributionImageLabels(projectSlug, distributionReport.compile_fingerprint);
     const files = [
         ...createRootfsFiles(runtimePlans),
         ...(options.moltnet?.files ?? []),
+        {
+            content: `${JSON.stringify(distributionReport, null, 2)}\n`,
+            path: DISTRIBUTION_REPORT_OUTPUT_FILE
+        },
         {
             content: await renderDockerfile(runtimePlans, {
+                distribution: {
+                    labels: distributionLabels,
+                    reportOutputFile: DISTRIBUTION_REPORT_OUTPUT_FILE
+                },
                 hasMoltnet: Boolean(options.moltnet),
                 hasStagedMoltnetBinaries: options.hasStagedMoltnetBinaries,
                 moltnetPublishedPorts: options.moltnet?.publishedPorts ?? [],
@@ -51,38 +249,12 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             path: ".env.example"
         }
     ];
-    const runtimePorts = runtimePlans.flatMap((plan) => plan.publishedPort ? [plan.publishedPort] : []);
-    const moltnetPorts = options.moltnet?.publishedPorts ?? [];
-    const ports = [...new Set([...runtimePorts, ...moltnetPorts])].sort((left, right) => left - right);
-    const runtimeHomes = [
-        ...new Set(runtimePlans.flatMap((plan) => (plan.instancePaths.homePath ? [plan.instancePaths.homePath] : [])))
-    ].sort();
-    const runtimeInstances = runtimePlans
-        .map((plan) => ({
-        config_path: plan.instancePaths.configPath,
-        home_path: plan.instancePaths.homePath ?? null,
-        id: plan.id,
-        model_auth_methods: plan.modelAuthMethods,
-        model_secrets_required: plan.modelSecretsRequired,
-        runtime: plan.runtimeName
-    }))
-        .sort((left, right) => left.id.localeCompare(right.id));
-    const runtimesInstalled = [...new Set(runtimePlans.map((plan) => plan.runtimeName))].sort();
-    const workspaceResources = [
-        ...new Map(runtimePlans.flatMap((plan) => (plan.resources ?? []).map((resource) => [
-            `${resource.kind}:${resource.id}:${resource.linkPath}`,
-            {
-                backing_path: resource.backingPath,
-                id: resource.id,
-                kind: resource.kind,
-                link_path: resource.linkPath,
-                mode: resource.mode,
-                mount: resource.mount,
-                sharing: resource.sharing
-            }
-        ]))).values()
-    ].sort((left, right) => left.link_path.localeCompare(right.link_path) || left.id.localeCompare(right.id));
     return {
+        distribution: {
+            fingerprint: distributionReport.compile_fingerprint,
+            labels: distributionLabels,
+            report: distributionReport
+        },
         executablePaths: ["entrypoint.sh"],
         files,
         ...(options.moltnet
@@ -97,8 +269,12 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             dockerfile: "Dockerfile",
             entrypoint: "entrypoint.sh",
             env_example: ".env.example",
+            internal_ports: internalPorts,
             model_secrets_required: modelSecretsRequired,
-            ports,
+            ...(moltnetSummary ? { moltnet: moltnetSummary } : {}),
+            port_mappings: portMappings,
+            ports: publishedPorts,
+            published_ports: publishedPorts,
             runtime_instances: runtimeInstances,
             runtime_homes: runtimeHomes,
             runtime_secrets_required: runtimeSecretsRequired,

package/dist/compiler/containerArtifactsPlans.js

@@ -65,12 +65,13 @@ const resolveInstancePaths = (runtimeName, targetId, meta) => {
 };
 export const createEnvVariableMap = (compiledNodes, runtimePlans) => {
     const variables = new Map();
-    const register = (name, required, description, category) => {
+    const register = (name, required, description, category, generated = false) => {
         const current = variables.get(name);
         if (!current) {
             variables.set(name, {
                 categories: [category],
                 description,
+                generated,
                 name,
                 required
             });
@@ -79,6 +80,7 @@ export const createEnvVariableMap = (compiledNodes, runtimePlans) => {
         variables.set(name, {
             ...current,
             categories: [...new Set([...current.categories, category])],
+            generated: current.generated && generated,
             required: current.required || required
         });
     };
@@ -104,10 +106,10 @@ export const createEnvVariableMap = (compiledNodes, runtimePlans) => {
     }
     for (const runtimePlan of runtimePlans) {
         for (const variable of runtimePlan.meta.env ?? []) {
-            register(variable.name, variable.required, variable.description, "runtime");
+            register(variable.name, variable.required, variable.description, "runtime", variable.generated ?? false);
         }
         for (const binding of runtimePlan.targetConfigEnvBindings ?? []) {
-            register(binding.envName, true, `Injected into ${runtimePlan.runtimeName} runtime config`, "runtime");
+            register(binding.envName, true, `Injected into ${runtimePlan.runtimeName} runtime config`, "runtime", binding.generated ?? false);
         }
     }
     return variables;
@@ -165,7 +167,7 @@ export const createRuntimeTargetPlans = async (plan, compiledNodes) => {
             .filter((node) => node.runtimeName === runtimeName && node.emittedFiles.length > 0)
             .map((node) => ({
             emittedFiles: node.emittedFiles,
-            id: `${node.kind}:${node.slug}`,
+            id: node.id ?? `${node.kind}:${node.slug}`,
             kind: node.kind,
             slug: node.slug,
             value: node.value
@@ -192,6 +194,7 @@ export const createRuntimeTargetPlans = async (plan, compiledNodes) => {
                 resources: resolveTargetResources(target, targetInputs, instancePaths, adapter.container),
                 runtimeName,
                 runtimeRoot: recipe.runtimeRoot,
+                sourceIds: [...(target.sourceIds ?? [])].sort(),
                 targetConfigEnvBindings: target.configEnvBindings,
                 targetFiles: target.files
             });

package/dist/compiler/containerArtifactsRender.d.ts

@@ -4,5 +4,11 @@ import type { EntrypointOptions } from "./containerEntrypointRender.js";
 export { renderEntrypoint } from "./containerEntrypointRender.js";
 export type { EntrypointOptions } from "./containerEntrypointRender.js";
 export declare const renderEnvExample: (variables: ContainerEnvVariable[]) => string;
-export declare const renderDockerfile: (runtimePlans: RuntimeTargetPlan[], options?: EntrypointOptions) => Promise<string>;
+export interface DockerfileDistributionOptions {
+    labels: Record<string, string>;
+    reportOutputFile: string;
+}
+export declare const renderDockerfile: (runtimePlans: RuntimeTargetPlan[], options?: EntrypointOptions & {
+    distribution?: DockerfileDistributionOptions;
+}) => Promise<string>;
 export declare const createRootfsFiles: (runtimePlans: RuntimeTargetPlan[]) => EmittedFile[];

package/dist/compiler/containerArtifactsRender.js

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { DISTRIBUTION_REPORT_IMAGE_PATH } from "../distribution/index.js";
 import { createRuntimeInstallRecipe } from "../runtime/index.js";
 import { SpawnfileError } from "../shared/index.js";
 export { renderEntrypoint } from "./containerEntrypointRender.js";
@@ -194,6 +195,11 @@ export const renderDockerfile = async (runtimePlans, options = {}) => {
     }
     lines.push('RUN if ! id -u spawnfile >/dev/null 2>&1; then useradd --create-home --home-dir /home/spawnfile --shell /bin/bash spawnfile; fi', "");
     lines.push("COPY container/rootfs/ /", "COPY .env.example /opt/spawnfile/.env.example", 'COPY entrypoint.sh /opt/spawnfile/entrypoint.sh', "RUN chmod +x /opt/spawnfile/entrypoint.sh");
+    if (options.distribution) {
+        lines.push("", `COPY ${options.distribution.reportOutputFile} ${DISTRIBUTION_REPORT_IMAGE_PATH}`, ...Object.entries(options.distribution.labels)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([name, value]) => `LABEL ${name}=${shellQuote(value)}`));
+    }
     lines.push(`RUN ${createStateOwnershipCommand(options.persistentMountPaths)}`);
     if (exposedPorts.length > 0) {
         lines.push(`EXPOSE ${exposedPorts.join(" ")}`);

package/dist/compiler/containerArtifactsTypes.d.ts

@@ -1,3 +1,4 @@
+import type { DistributionReport } from "../distribution/index.js";
 import type { ContainerReport } from "../report/index.js";
 import type { EmittedFile, RuntimeContainerConfigEnvBinding, RuntimeContainerMeta } from "../runtime/index.js";
 import type { ModelAuthMethod } from "../shared/index.js";
@@ -7,6 +8,7 @@ import type { WorkspaceResourcePlan } from "./workspaceResources.js";
 export interface ContainerEnvVariable {
     categories: Array<"model" | "project" | "runtime" | "surface">;
     description: string;
+    generated: boolean;
     name: string;
     required: boolean;
 }
@@ -32,17 +34,24 @@ export interface RuntimeTargetPlan {
     resources?: WorkspaceResourcePlan[];
     runtimeName: string;
     runtimeRoot: string;
+    sourceIds?: string[];
     targetConfigEnvBindings?: RuntimeContainerConfigEnvBinding[];
     targetFiles: EmittedFile[];
 }
 export interface CompiledNodeArtifact {
     emittedFiles: EmittedFile[];
+    id?: string;
     kind: "agent" | "team";
     runtimeName: string | null;
     slug: string;
     value: ResolvedAgentNode | ResolvedTeamNode;
 }
 export interface GeneratedContainerArtifacts {
+    distribution: {
+        fingerprint: string;
+        labels: Record<string, string>;
+        report: DistributionReport;
+    };
     executablePaths: string[];
     files: EmittedFile[];
     moltnet?: {

package/dist/compiler/containerEntrypointRender.js

@@ -1,5 +1,6 @@
 import path from "node:path";
 import { resolveMoltnetStorePath } from "./moltnetConfigLowering.js";
+import { networkUrlEnvName } from "./networkBinding.js";
 import { createWorkspaceResourceCommands, createWorkspaceResourceShellFunctions } from "./containerWorkspaceResourceRender.js";
 const MOLTNET_SERVER_DATA_DIRECTORY = "/var/lib/spawnfile/moltnet/servers";
 const shellQuote = (value) => `'${value.replace(/'/g, `'\"'\"'`)}'`;
@@ -8,9 +9,9 @@ const createEnvironmentAssignments = (plan) => {
     if (plan.instancePaths.homePath) {
         envAssignments.push(`HOME=${shellQuote(plan.instancePaths.homePath)}`);
     }
-    if (plan.instancePaths.homePath && ((plan.runtimeName === "tinyclaw" &&
-        (plan.modelAuthMethods.openai === "api_key" || plan.modelAuthMethods.openai === "codex")) ||
-        (plan.runtimeName === "picoclaw" && plan.modelAuthMethods.openai === "codex"))) {
+    if (plan.instancePaths.homePath &&
+        plan.runtimeName === "picoclaw" &&
+        plan.modelAuthMethods.openai === "codex") {
         envAssignments.push(`CODEX_HOME=${shellQuote(path.posix.join(plan.instancePaths.homePath, ".codex"))}`);
     }
     if (plan.meta.homeEnv && plan.instancePaths.homePath) {
@@ -29,14 +30,6 @@ const createEnvironmentAssignments = (plan) => {
 };
 const createEnvFileWrites = (plan) => plan.envFiles.map((binding) => `write_env_file ${shellQuote(binding.envName)} ${shellQuote(binding.filePath)}`);
 const createConfigEnvWrites = (plan) => (plan.configEnvBindings ?? []).map((binding) => `apply_json_env_value ${shellQuote(plan.instancePaths.configPath)} ${shellQuote(binding.envName)} ${shellQuote(binding.jsonPath)}`);
-const createAuthSetupCommands = (plan) => {
-    if (plan.runtimeName !== "tinyclaw" ||
-        !plan.instancePaths.homePath ||
-        plan.modelAuthMethods.openai !== "api_key") {
-        return [];
-    }
-    return [`configure_codex_api_key_auth ${shellQuote(plan.instancePaths.homePath)}`];
-};
 const createMoltnetStorePrepareCommands = (serverPlan) => {
     const server = serverPlan.server;
     if (server.mode !== "managed" || server.store.kind === "memory" || server.store.kind === "postgres") {
@@ -145,15 +138,6 @@ export const renderEntrypoint = (runtimePlans, requiredSecrets, options = {}) =>
         "PY",
         "}",
         "",
-        "configure_codex_api_key_auth() {",
-        '  local home_path="$1"',
-        '  if [ -z "${OPENAI_API_KEY:-}" ]; then',
-        "    return",
-        "  fi",
-        '  mkdir -p "$home_path/.codex"',
-        '  printf "%s\\n" "${OPENAI_API_KEY:-}" | HOME="$home_path" CODEX_HOME="$home_path/.codex" codex login --with-api-key >/dev/null',
-        "}",
-        "",
         ...createWorkspaceResourceShellFunctions()
     ];
     lines.push('if [ -n "${OPENCLAW_GATEWAY_TOKEN:-}" ] && [ -z "${OPENCLAW_HOOKS_TOKEN:-}" ]; then', '  export OPENCLAW_HOOKS_TOKEN="hooks-${OPENCLAW_GATEWAY_TOKEN}"', "fi", "");
@@ -171,7 +155,7 @@ export const renderEntrypoint = (runtimePlans, requiredSecrets, options = {}) =>
         const plan = runtimePlans[0];
         const commandTokens = resolveStartCommand(plan);
         const envAssignments = createEnvironmentAssignments(plan);
-        lines.push(`mkdir -p ${shellQuote(plan.instancePaths.workspacePath)}`, ...createWorkspaceResourceCommands(plan), `require_file ${shellQuote(plan.instancePaths.configPath)}`, ...createEnvFileWrites(plan), ...createConfigEnvWrites(plan), ...createAuthSetupCommands(plan), `${envAssignments.join(" ")} exec ${commandTokens.map(shellQuote).join(" ")}`);
+        lines.push(`mkdir -p ${shellQuote(plan.instancePaths.workspacePath)}`, ...createWorkspaceResourceCommands(plan), `require_file ${shellQuote(plan.instancePaths.configPath)}`, ...createEnvFileWrites(plan), ...createConfigEnvWrites(plan), `${envAssignments.join(" ")} exec ${commandTokens.map(shellQuote).join(" ")}`);
         return `${lines.join("\n").trimEnd()}\n`;
     }
     lines.push("PIDS=()", "", "terminate_children() {", '  for pid in "${PIDS[@]:-}"; do', '    kill "$pid" 2>/dev/null || true', "  done", "}", "", "trap terminate_children INT TERM EXIT", "");
@@ -183,25 +167,28 @@ export const renderEntrypoint = (runtimePlans, requiredSecrets, options = {}) =>
         if (!serverPlan.configPath) {
             continue;
         }
+        const urlEnv = networkUrlEnvName(serverPlan.networkId);
+        const serverLines = [];
         for (const patch of serverPlan.secretPatches) {
-            lines.push(`apply_json_env_value ${shellQuote(serverPlan.configPath)} ${shellQuote(patch.envName)} ${shellQuote(patch.jsonPath)}`);
+            serverLines.push(`apply_json_env_value ${shellQuote(serverPlan.configPath)} ${shellQuote(patch.envName)} ${shellQuote(patch.jsonPath)}`);
         }
-        lines.push(...createMoltnetStorePrepareCommands(serverPlan), `MOLTNET_CONFIG=${shellQuote(serverPlan.configPath)} /usr/local/bin/moltnet &`, 'PIDS+=("$!")', "");
-    }
-    for (const serverPlan of managedMoltnetServerPlans) {
-        if (!serverPlan.port) {
-            continue;
+        serverLines.push(...createMoltnetStorePrepareCommands(serverPlan), `MOLTNET_CONFIG=${shellQuote(serverPlan.configPath)} /usr/local/bin/moltnet &`, 'PIDS+=("$!")');
+        if (serverPlan.port) {
+            serverLines.push(`until curl -sf ${shellQuote(`http://127.0.0.1:${serverPlan.port}/healthz`)} >/dev/null; do sleep 1; done`);
         }
-        lines.push(`until curl -sf ${shellQuote(`http://127.0.0.1:${serverPlan.port}/healthz`)} >/dev/null; do sleep 1; done`);
-        lines.push("");
+        // Suppress the in-image managed server when an external endpoint is bound.
+        lines.push(`if [ -z "\${${urlEnv}:-}" ]; then`, ...serverLines.map((line) => `  ${line}`), "fi", "");
     }
     for (const plan of runtimePlans) {
         const commandTokens = resolveStartCommand(plan);
         const envAssignments = createEnvironmentAssignments(plan);
-        lines.push(`mkdir -p ${shellQuote(plan.instancePaths.workspacePath)}`, ...createWorkspaceResourceCommands(plan), `require_file ${shellQuote(plan.instancePaths.configPath)}`, ...createEnvFileWrites(plan), ...createConfigEnvWrites(plan), ...createAuthSetupCommands(plan), `${envAssignments.join(" ")} ${commandTokens.map(shellQuote).join(" ")} &`, 'PIDS+=("$!")', "", ...createRuntimeReadinessWait(plan));
+        lines.push(`mkdir -p ${shellQuote(plan.instancePaths.workspacePath)}`, ...createWorkspaceResourceCommands(plan), `require_file ${shellQuote(plan.instancePaths.configPath)}`, ...createEnvFileWrites(plan), ...createConfigEnvWrites(plan), `${envAssignments.join(" ")} ${commandTokens.map(shellQuote).join(" ")} &`, 'PIDS+=("$!")', "", ...createRuntimeReadinessWait(plan));
     }
     for (const nodePlan of moltnetNodePlans) {
-        lines.push(`/usr/local/bin/moltnet node ${shellQuote(nodePlan.configPath)} &`, 'PIDS+=("$!")', "");
+        const urlEnv = networkUrlEnvName(nodePlan.networkId);
+        lines.push(
+        // Rebind the bridge endpoint when an external network URL is provided.
+        `if [ -n "\${${urlEnv}:-}" ]; then`, `  apply_json_env_value ${shellQuote(nodePlan.configPath)} ${shellQuote(urlEnv)} ${shellQuote("moltnet.base_url")}`, "fi", `/usr/local/bin/moltnet node ${shellQuote(nodePlan.configPath)} &`, 'PIDS+=("$!")', "");
     }
     lines.push('if [ "${#PIDS[@]}" -eq 0 ]; then', '  echo "No runtime targets were generated for this compile output" >&2', "  exit 1", "fi", "", "status=0", 'for pid in "${PIDS[@]}"; do', '  if ! wait "$pid"; then', "    status=1", "  fi", "done", "", 'exit "$status"');
     return `${lines.join("\n").trimEnd()}\n`;

package/dist/compiler/index.d.ts

@@ -1,6 +1,7 @@
 export * from "./addProjectNode.js";
 export * from "./buildCompilePlan.js";
 export * from "./buildProject.js";
+export * from "./publishProject.js";
 export * from "./upProject.js";
 export * from "./compileProject.js";
 export * from "./initProject.js";

package/dist/compiler/index.js

@@ -1,6 +1,7 @@
 export * from "./addProjectNode.js";
 export * from "./buildCompilePlan.js";
 export * from "./buildProject.js";
+export * from "./publishProject.js";
 export * from "./upProject.js";
 export * from "./compileProject.js";
 export * from "./initProject.js";

package/dist/compiler/moltnetArtifacts.d.ts

@@ -14,6 +14,8 @@ export interface MoltnetServerPlan {
         id: string;
         members: string[];
         name?: string;
+        visibility?: "public" | "private";
+        write_policy?: "members" | "operators" | "registered_agents";
     }>;
     server: TeamNetworkServer;
     secretPatches: MoltnetSecretPatch[];