spawnfile 0.1.10 → 0.1.12

package/dist/compiler/moltnetArtifacts.js

@@ -1,7 +1,9 @@
 import { SpawnfileError } from "../shared/index.js";
-import { createMoltnetOpenTokenDirectory, createMoltnetNativeServerConfig, createMoltnetNodeConfigPath, createMoltnetServerConfigPath, resolveMoltnetBaseUrl, resolveMoltnetClientAuth, resolveMoltnetStorePersistenceMountPath } from "./moltnetConfigLowering.js";
+import { createMoltnetOpenTokenDirectory, createMoltnetNativeServerConfig, createMoltnetNodeConfigPath, createMoltnetServerConfigPath, resolveMoltnetBaseUrl, resolveMoltnetStorePersistenceMountPath } from "./moltnetConfigLowering.js";
+import { assertNetworkBindingEnvUniqueness } from "./networkBinding.js";
 import { listConcreteMoltnetRoomMemberIds } from "./moltnetRoomMemberships.js";
-import { resolveRuntimeConfig } from "./moltnetRuntimeConfig.js";
+import { assertCompatibleMoltnetNetworkName, assertCompatibleMoltnetRoomPolicy, assertCompatibleMoltnetServer } from "./moltnetRoomPolicyCompatibility.js";
+import { createMoltnetNodeConfigContent } from "./moltnetNodeConfig.js";
 import { createShortHash, slugify } from "./helpers.js";
 const DEFAULT_MOLTNET_PORT = 8787;
 const ROOTFS_PREFIX = "container/rootfs";
@@ -39,6 +41,8 @@ export const generateMoltnetArtifacts = async (plan) => {
                 if (existingPlan.baseUrl !== resolveMoltnetBaseUrl(server)) {
                     throw new SpawnfileError("validation_error", `Duplicate Moltnet network ${network.id} declares conflicting server URL`);
                 }
+                assertCompatibleMoltnetNetworkName(network.id, existingPlan.name, network.name);
+                assertCompatibleMoltnetServer(network.id, existingPlan.server, server);
                 for (const room of network.rooms) {
                     const concreteMembers = listConcreteMoltnetRoomMemberIds(plan, teamNode.value, network.id, room);
                     const existingRoom = existingPlan.rooms.find((entry) => entry.id === room.id);
@@ -46,12 +50,18 @@ export const generateMoltnetArtifacts = async (plan) => {
                         existingRoom.members = [
                             ...new Set([...existingRoom.members, ...concreteMembers])
                         ].sort();
+                        assertCompatibleMoltnetRoomPolicy(network.id, room.id, "visibility", existingRoom.visibility, room.visibility);
+                        assertCompatibleMoltnetRoomPolicy(network.id, room.id, "write_policy", existingRoom.write_policy, room.write_policy);
+                        existingRoom.visibility ??= room.visibility;
+                        existingRoom.write_policy ??= room.write_policy;
                     }
                     else {
                         existingPlan.rooms.push({
                             id: room.id,
                             members: concreteMembers,
-                            ...(room.name ? { name: room.name } : {})
+                            ...(room.name ? { name: room.name } : {}),
+                            ...(room.visibility ? { visibility: room.visibility } : {}),
+                            ...(room.write_policy ? { write_policy: room.write_policy } : {})
                         });
                     }
                 }
@@ -73,7 +83,9 @@ export const generateMoltnetArtifacts = async (plan) => {
                     rooms: network.rooms.map((room) => ({
                         id: room.id,
                         members: listConcreteMoltnetRoomMemberIds(plan, teamNode.value, network.id, room),
-                        ...(room.name ? { name: room.name } : {})
+                        ...(room.name ? { name: room.name } : {}),
+                        ...(room.visibility ? { visibility: room.visibility } : {}),
+                        ...(room.write_policy ? { write_policy: room.write_policy } : {})
                     })),
                     server,
                     secretPatches: [],
@@ -99,38 +111,35 @@ export const generateMoltnetArtifacts = async (plan) => {
             throw new SpawnfileError("validation_error", `Moltnet persistent mount ${mount.id} resolves to conflicting targets`);
         }
     };
-    for (const teamNode of teamNodes) {
-        for (const network of teamNode.value.networks ?? []) {
-            const serverPlan = serverPlans.get(createServerKey(network.id));
-            if (!serverPlan || !network.server || network.server.mode !== "managed" || !serverPlan.configPath) {
-                continue;
-            }
-            const native = createMoltnetNativeServerConfig({
-                networkId: network.id,
-                networkName: network.name,
-                rooms: serverPlan.rooms,
-                server: network.server
-            });
-            serverPlan.secretPatches = native.secretPatches;
-            configFiles.push({
-                content: `${JSON.stringify(native.config, null, 2)}\n`,
-                mode: 0o600,
-                path: createMoltnetServerConfigPath(serverPlan.id)
+    for (const serverPlan of serverPlans.values()) {
+        if (serverPlan.mode !== "managed" || serverPlan.server.mode !== "managed" || !serverPlan.configPath) {
+            continue;
+        }
+        const native = createMoltnetNativeServerConfig({
+            networkId: serverPlan.networkId,
+            networkName: serverPlan.name,
+            rooms: serverPlan.rooms,
+            server: serverPlan.server
+        });
+        serverPlan.secretPatches = native.secretPatches;
+        configFiles.push({
+            content: `${JSON.stringify(native.config, null, 2)}\n`,
+            mode: 0o600,
+            path: createMoltnetServerConfigPath(serverPlan.id)
+        });
+        const storeMountPath = resolveMoltnetStorePersistenceMountPath(serverPlan.networkId, serverPlan.server.store);
+        if (storeMountPath) {
+            const mountId = `moltnet-${serverPlan.networkId}-store`;
+            const store = serverPlan.server.store;
+            const volumeName = store.kind === "sqlite" || store.kind === "json"
+                ? store.persistence?.name
+                : undefined;
+            addPersistentMount({
+                id: mountId,
+                mountPath: storeMountPath,
+                reason: `managed Moltnet ${serverPlan.server.store.kind} store for ${serverPlan.networkId}`,
+                volumeName: createPersistentVolumeName(plan.root, mountId, volumeName)
             });
-            const storeMountPath = resolveMoltnetStorePersistenceMountPath(network.id, network.server.store);
-            if (storeMountPath) {
-                const mountId = `moltnet-${network.id}-store`;
-                const store = network.server.store;
-                const volumeName = store.kind === "sqlite" || store.kind === "json"
-                    ? store.persistence?.name
-                    : undefined;
-                addPersistentMount({
-                    id: mountId,
-                    mountPath: storeMountPath,
-                    reason: `managed Moltnet ${network.server.store.kind} store for ${network.id}`,
-                    volumeName: createPersistentVolumeName(plan.root, mountId, volumeName)
-                });
-            }
         }
     }
     for (const node of plan.nodes) {
@@ -169,10 +178,15 @@ export const generateMoltnetArtifacts = async (plan) => {
                 throw new SpawnfileError("validation_error", `Duplicate Moltnet node attachment for ${attachment.network}/${attachment.memberId}`);
             }
             nodePlanKeys.add(nodePlanKey);
-            const clientAuth = resolveMoltnetClientAuth(network.server, attachment.network, attachment.memberId, node.slug);
-            const usesPerAttachmentOpenToken = clientAuth.mode === "open" &&
-                clientAuth.staticToken !== true &&
-                Boolean(clientAuth.tokenEnv || clientAuth.tokenPath);
+            const nodeConfig = createMoltnetNodeConfigContent({
+                agentNode,
+                attachment: { ...attachment, memberId: attachment.memberId },
+                networkServer: serverPlan.server,
+                nodeSlug: node.slug,
+                plan,
+                serverPlan
+            });
+            const { clientAuth, usesPerAttachmentOpenToken } = nodeConfig;
             if (usesPerAttachmentOpenToken && clientAuth.tokenPath) {
                 const mountId = `agent-${node.slug}-moltnet-tokens`;
                 addPersistentMount({
@@ -183,66 +197,7 @@ export const generateMoltnetArtifacts = async (plan) => {
                 });
             }
             configFiles.push({
-                content: `${JSON.stringify({
-                    version: "moltnet.node.v1",
-                    moltnet: {
-                        base_url: serverPlan.baseUrl,
-                        network_id: attachment.network,
-                        ...(clientAuth.mode === "none"
-                            ? {}
-                            : { auth_mode: clientAuth.mode }),
-                        ...(clientAuth.staticToken
-                            ? { static_token: true }
-                            : {}),
-                        ...(!usesPerAttachmentOpenToken && clientAuth.tokenEnv
-                            ? {
-                                token_env: clientAuth.tokenEnv
-                            }
-                            : {}),
-                        ...(!usesPerAttachmentOpenToken && clientAuth.tokenPath
-                            ? {
-                                token_path: clientAuth.tokenPath
-                            }
-                            : {})
-                    },
-                    attachments: [
-                        {
-                            agent: {
-                                id: attachment.memberId,
-                                name: agentNode.name
-                            },
-                            ...(usesPerAttachmentOpenToken
-                                ? {
-                                    moltnet: {
-                                        ...(clientAuth.tokenEnv ? { token_env: clientAuth.tokenEnv } : {}),
-                                        ...(clientAuth.tokenPath ? { token_path: clientAuth.tokenPath } : {})
-                                    }
-                                }
-                                : {}),
-                            runtime: resolveRuntimeConfig(plan, agentNode, node.slug, attachment.network, attachment.memberId),
-                            ...(attachment.rooms
-                                ? {
-                                    rooms: Object.entries(attachment.rooms)
-                                        .sort(([left], [right]) => left.localeCompare(right))
-                                        .map(([roomId, policy]) => ({
-                                        id: roomId,
-                                        ...(policy.read ? { read: policy.read } : {}),
-                                        ...(policy.reply ? { reply: policy.reply } : {})
-                                    }))
-                                }
-                                : {}),
-                            ...(attachment.dms
-                                ? {
-                                    dms: {
-                                        enabled: attachment.dms.enabled,
-                                        ...(attachment.dms.read ? { read: attachment.dms.read } : {}),
-                                        ...(attachment.dms.reply ? { reply: attachment.dms.reply } : {})
-                                    }
-                                }
-                                : {})
-                        }
-                    ]
-                }, null, 2)}\n`,
+                content: nodeConfig.content,
                 mode: 0o600,
                 path: configPath
             });
@@ -253,6 +208,10 @@ export const generateMoltnetArtifacts = async (plan) => {
         }
     }
     const managedServerPlans = [...serverPlans.values()].filter((serverPlan) => serverPlan.mode === "managed");
+    assertNetworkBindingEnvUniqueness([...serverPlans.values()].map((serverPlan) => ({
+        id: serverPlan.networkId,
+        members: [...new Set(serverPlan.rooms.flatMap((room) => room.members))]
+    })));
     return {
         files: configFiles,
         nodePlans: nodePlans.sort((left, right) => left.configPath.localeCompare(right.configPath)),

package/dist/compiler/moltnetClientConfig.d.ts

@@ -7,5 +7,5 @@ export interface MoltnetWorkspaceLayout {
     skillPaths: string[];
     workspaceRootPath: string;
 }
-export declare const resolveMoltnetWorkspaceLayout: (runtimeName: string, agentName: string) => MoltnetWorkspaceLayout;
-export declare const createMoltnetClientConfigFiles: (node: ResolvedAgentNode, artifacts: MoltnetArtifacts) => EmittedFile[];
+export declare const resolveMoltnetWorkspaceLayout: (runtimeName: string, _agentName: string) => MoltnetWorkspaceLayout;
+export declare const createMoltnetClientConfigFiles: (node: ResolvedAgentNode, artifacts: MoltnetArtifacts, agentSlug?: string) => EmittedFile[];

package/dist/compiler/moltnetClientConfig.js

@@ -19,16 +19,17 @@ const findServerPlan = (artifacts, attachment) => {
     }
     return plan;
 };
-const createAttachmentConfig = (node, artifacts, attachment) => {
+const createAttachmentConfig = (node, artifacts, attachment, agentSlug) => {
     if (!attachment.memberId) {
         throw new SpawnfileError("compile_error", `Moltnet client config requires a resolved member id for ${node.name}`);
     }
     const serverPlan = findServerPlan(artifacts, attachment);
-    const auth = resolveMoltnetClientAuth(serverPlan.server, attachment.network, attachment.memberId);
+    const auth = resolveMoltnetClientAuth(serverPlan.server, attachment.network, attachment.memberId, agentSlug);
     return {
         agent_name: node.name,
         auth: {
             mode: auth.mode,
+            ...(auth.registration ? { registration: auth.registration } : {}),
             ...(auth.tokenEnv ? { token_env: auth.tokenEnv } : {}),
             ...(auth.tokenPath ? { token_path: auth.tokenPath } : {})
         },
@@ -37,8 +38,7 @@ const createAttachmentConfig = (node, artifacts, attachment) => {
             ? {
                 dms: {
                     enabled: attachment.dms.enabled,
-                    ...(attachment.dms.read ? { read: attachment.dms.read } : {}),
-                    ...(attachment.dms.reply ? { reply: attachment.dms.reply } : {})
+                    ...(attachment.dms.wake ? { wake: attachment.dms.wake } : {})
                 }
             }
             : {}),
@@ -49,16 +49,20 @@ const createAttachmentConfig = (node, artifacts, attachment) => {
             ? {
                 rooms: Object.entries(attachment.rooms)
                     .sort(([left], [right]) => left.localeCompare(right))
-                    .map(([roomId, policy]) => ({
-                    id: roomId,
-                    ...(policy.read ? { read: policy.read } : {}),
-                    ...(policy.reply ? { reply: policy.reply } : {})
-                }))
+                    .map(([roomId, policy]) => {
+                    const room = serverPlan.rooms.find((entry) => entry.id === roomId);
+                    return {
+                        id: roomId,
+                        ...(room?.visibility ? { visibility: room.visibility } : {}),
+                        ...(room?.write_policy ? { write_policy: room.write_policy } : {}),
+                        ...(policy.wake ? { wake: policy.wake } : {})
+                    };
+                })
             }
             : {})
     };
 };
-export const resolveMoltnetWorkspaceLayout = (runtimeName, agentName) => {
+export const resolveMoltnetWorkspaceLayout = (runtimeName, _agentName) => {
     if (runtimeName === "openclaw" || runtimeName === "picoclaw") {
         return {
             clientConfigPath: `workspace/${GENERATED_CONFIG_PATH}`,
@@ -67,20 +71,9 @@ export const resolveMoltnetWorkspaceLayout = (runtimeName, agentName) => {
             workspaceRootPath: "workspace"
         };
     }
-    if (runtimeName === "tinyclaw") {
-        return {
-            clientConfigPath: `workspace/${agentName}/${GENERATED_CONFIG_PATH}`,
-            cliRuntime: runtimeName,
-            skillPaths: [
-                `workspace/${agentName}/.agents/skills/${GENERATED_SKILL_NAME}/SKILL.md`,
-                `workspace/${agentName}/.claude/skills/${GENERATED_SKILL_NAME}/SKILL.md`
-            ],
-            workspaceRootPath: `workspace/${agentName}`
-        };
-    }
     throw new SpawnfileError("compile_error", `Moltnet client config does not know how to emit files for runtime ${runtimeName}`);
 };
-export const createMoltnetClientConfigFiles = (node, artifacts) => {
+export const createMoltnetClientConfigFiles = (node, artifacts, agentSlug) => {
     const attachments = node.surfaces?.moltnet;
     if (!attachments || attachments.length === 0) {
         return [];
@@ -88,7 +81,7 @@ export const createMoltnetClientConfigFiles = (node, artifacts) => {
     const layout = resolveMoltnetWorkspaceLayout(node.runtime.name, node.name);
     return [
         {
-            content: createConfigContent(node, attachments.map((attachment) => createAttachmentConfig(node, artifacts, attachment))),
+            content: createConfigContent(node, attachments.map((attachment) => createAttachmentConfig(node, artifacts, attachment, agentSlug))),
             path: layout.clientConfigPath
         }
     ];

package/dist/compiler/moltnetConfigLowering.d.ts

@@ -5,6 +5,7 @@ export interface MoltnetSecretPatch {
 }
 export interface MoltnetClientAuthPlan {
     mode: "bearer" | "none" | "open";
+    registration?: "disabled" | "open" | "token";
     staticToken?: boolean;
     tokenEnv?: string;
     tokenPath?: string;
@@ -13,6 +14,8 @@ export interface MoltnetNativeRoomConfig {
     id: string;
     members: string[];
     name?: string;
+    visibility?: "public" | "private";
+    write_policy?: "members" | "operators" | "registered_agents";
 }
 export interface MoltnetNativeServerConfigInput {
     networkId: string;

package/dist/compiler/moltnetConfigLowering.js

@@ -55,14 +55,19 @@ export const resolveMoltnetClientAuth = (server, networkId, memberId, agentSlug)
         return { mode: "none" };
     }
     const client = server.auth.client;
-    if (server.auth.mode === "open" && !client) {
+    const registrationOpen = server.auth.mode === "open" || server.auth.agent_registration === "open";
+    if (registrationOpen && !client) {
         return {
             mode: "open",
+            registration: "open",
             tokenPath: createMoltnetOpenTokenPath(networkId, memberId, agentSlug)
         };
     }
     if (!client) {
-        return { mode: server.auth.mode };
+        return {
+            mode: server.auth.mode,
+            ...(server.auth.agent_registration ? { registration: server.auth.agent_registration } : {})
+        };
     }
     const tokenEnv = client.token_env
         ?? (client.token_id && server.mode === "managed"
@@ -70,6 +75,7 @@ export const resolveMoltnetClientAuth = (server, networkId, memberId, agentSlug)
             : undefined);
     return {
         mode: server.auth.mode,
+        ...(server.auth.agent_registration ? { registration: server.auth.agent_registration } : {}),
         ...(client.static_token ? { staticToken: true } : {}),
         ...(tokenEnv ? { tokenEnv } : {}),
         ...(client.token_path ? { tokenPath: client.token_path } : {})
@@ -129,6 +135,7 @@ export const createMoltnetNativeServerConfig = ({ networkId, networkName, rooms,
             },
             server: {
                 listen_addr: renderMoltnetListenAddr(server),
+                ...(server.console ? { console: server.console } : {}),
                 ...(server.human_ingress !== undefined ? { human_ingress: server.human_ingress } : {}),
                 ...(server.direct_messages !== undefined ? { direct_messages: server.direct_messages } : {}),
                 ...(server.debug_events !== undefined ? { debug_events: server.debug_events } : {}),
@@ -139,12 +146,16 @@ export const createMoltnetNativeServerConfig = ({ networkId, networkName, rooms,
             },
             auth: {
                 mode: server.auth.mode,
+                ...(server.auth.public_read !== undefined ? { public_read: server.auth.public_read } : {}),
+                ...(server.auth.agent_registration ? { agent_registration: server.auth.agent_registration } : {}),
                 ...(tokens.length > 0 ? { tokens } : {})
             },
             storage: storageConfigFor(networkId, server.store),
             rooms: rooms.map((room) => ({
                 id: room.id,
                 ...(room.name ? { name: room.name } : {}),
+                ...(room.visibility ? { visibility: room.visibility } : {}),
+                ...(room.write_policy ? { write_policy: room.write_policy } : {}),
                 members: room.members
             })),
             ...(pairings.length > 0 ? { pairings } : {})

package/dist/compiler/moltnetNodeConfig.d.ts

@@ -0,0 +1,27 @@
+import type { TeamNetworkServer } from "../manifest/index.js";
+import { type MoltnetClientAuthPlan } from "./moltnetConfigLowering.js";
+import type { CompilePlan, ResolvedAgentNode, ResolvedMoltnetAttachment } from "./types.js";
+interface MoltnetNodeConfigServerPlan {
+    baseUrl: string;
+    rooms: Array<{
+        id: string;
+        visibility?: "public" | "private";
+        write_policy?: "members" | "operators" | "registered_agents";
+    }>;
+}
+export interface MoltnetNodeConfigResult {
+    clientAuth: MoltnetClientAuthPlan;
+    content: string;
+    usesPerAttachmentOpenToken: boolean;
+}
+export declare const createMoltnetNodeConfigContent: ({ agentNode, attachment, networkServer, nodeSlug, plan, serverPlan }: {
+    agentNode: ResolvedAgentNode;
+    attachment: ResolvedMoltnetAttachment & {
+        memberId: string;
+    };
+    networkServer: TeamNetworkServer;
+    nodeSlug: string;
+    plan: CompilePlan;
+    serverPlan: MoltnetNodeConfigServerPlan;
+}) => MoltnetNodeConfigResult;
+export {};

package/dist/compiler/moltnetNodeConfig.js

@@ -0,0 +1,68 @@
+import { resolveMoltnetClientAuth } from "./moltnetConfigLowering.js";
+import { resolveRuntimeConfig } from "./moltnetRuntimeConfig.js";
+export const createMoltnetNodeConfigContent = ({ agentNode, attachment, networkServer, nodeSlug, plan, serverPlan }) => {
+    const clientAuth = resolveMoltnetClientAuth(networkServer, attachment.network, attachment.memberId, nodeSlug);
+    const usesPerAttachmentOpenToken = clientAuth.mode === "open" &&
+        clientAuth.staticToken !== true &&
+        Boolean(clientAuth.tokenEnv || clientAuth.tokenPath);
+    return {
+        clientAuth,
+        content: `${JSON.stringify({
+            version: "moltnet.node.v1",
+            moltnet: {
+                base_url: serverPlan.baseUrl,
+                network_id: attachment.network,
+                ...(clientAuth.mode === "none" ? {} : { auth_mode: clientAuth.mode }),
+                ...(clientAuth.registration ? { registration: clientAuth.registration } : {}),
+                ...(clientAuth.staticToken ? { static_token: true } : {}),
+                ...(!usesPerAttachmentOpenToken && clientAuth.tokenEnv
+                    ? { token_env: clientAuth.tokenEnv }
+                    : {}),
+                ...(!usesPerAttachmentOpenToken && clientAuth.tokenPath
+                    ? { token_path: clientAuth.tokenPath }
+                    : {})
+            },
+            attachments: [
+                {
+                    agent: {
+                        id: attachment.memberId,
+                        name: agentNode.name
+                    },
+                    ...(usesPerAttachmentOpenToken
+                        ? {
+                            moltnet: {
+                                ...(clientAuth.tokenEnv ? { token_env: clientAuth.tokenEnv } : {}),
+                                ...(clientAuth.tokenPath ? { token_path: clientAuth.tokenPath } : {})
+                            }
+                        }
+                        : {}),
+                    runtime: resolveRuntimeConfig(plan, agentNode, nodeSlug, attachment.network, attachment.memberId),
+                    ...(attachment.rooms
+                        ? {
+                            rooms: Object.entries(attachment.rooms)
+                                .sort(([left], [right]) => left.localeCompare(right))
+                                .map(([roomId, policy]) => {
+                                const room = serverPlan.rooms.find((entry) => entry.id === roomId);
+                                return {
+                                    id: roomId,
+                                    ...(room?.visibility ? { visibility: room.visibility } : {}),
+                                    ...(room?.write_policy ? { write_policy: room.write_policy } : {}),
+                                    ...(policy.wake ? { wake: policy.wake } : {})
+                                };
+                            })
+                        }
+                        : {}),
+                    ...(attachment.dms
+                        ? {
+                            dms: {
+                                enabled: attachment.dms.enabled,
+                                ...(attachment.dms.wake ? { wake: attachment.dms.wake } : {})
+                            }
+                        }
+                        : {})
+                }
+            ]
+        }, null, 2)}\n`,
+        usesPerAttachmentOpenToken
+    };
+};

package/dist/compiler/moltnetResolution.js

@@ -52,7 +52,7 @@ const synthesizeRepresentativeAttachments = (memberships) => memberships
     teamSource: membership.declaringTeamSource
 }));
 const roomPolicyKey = (policy) => JSON.stringify(policy ?? {});
-const hasRoomPolicy = (policy) => policy.read !== undefined || policy.reply !== undefined;
+const hasRoomPolicy = (policy) => policy.wake !== undefined;
 const mergeAttachment = (target, next, nodeName) => {
     if (target.dms &&
         next.dms &&

package/dist/compiler/moltnetRoomMemberships.js

@@ -16,8 +16,7 @@ const findTeamBySource = (plan, source) => {
     return node.value;
 };
 const clonePolicy = (policy) => ({
-    ...(policy.read ? { read: policy.read } : {}),
-    ...(policy.reply ? { reply: policy.reply } : {})
+    ...(policy.wake ? { wake: policy.wake } : {})
 });
 const findDirectRoomPolicy = (plan, teamNode, agentSource, memberId, networkId, roomId) => {
     const agentNode = findAgentBySource(plan, agentSource);

package/dist/compiler/moltnetRoomPolicyCompatibility.d.ts

@@ -0,0 +1,4 @@
+import type { TeamNetworkServer } from "../manifest/index.js";
+export declare const assertCompatibleMoltnetNetworkName: (networkId: string, existing: string | undefined, next: string | undefined) => void;
+export declare const assertCompatibleMoltnetServer: (networkId: string, existing: TeamNetworkServer, next: TeamNetworkServer) => void;
+export declare const assertCompatibleMoltnetRoomPolicy: (networkId: string, roomId: string, field: "visibility" | "write_policy", existing: string | undefined, next: string | undefined) => void;

package/dist/compiler/moltnetRoomPolicyCompatibility.js

@@ -0,0 +1,28 @@
+import { SpawnfileError } from "../shared/index.js";
+const stableStringify = (value) => {
+    if (Array.isArray(value)) {
+        return `[${value.map(stableStringify).join(",")}]`;
+    }
+    if (value && typeof value === "object") {
+        return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stableStringify(entry)}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+};
+export const assertCompatibleMoltnetNetworkName = (networkId, existing, next) => {
+    if (existing !== undefined && next !== undefined && existing !== next) {
+        throw new SpawnfileError("validation_error", `Duplicate Moltnet network ${networkId} declares conflicting network name: ${existing} vs ${next}`);
+    }
+};
+export const assertCompatibleMoltnetServer = (networkId, existing, next) => {
+    if (stableStringify(existing.auth) !== stableStringify(next.auth)) {
+        throw new SpawnfileError("validation_error", `Duplicate Moltnet network ${networkId} declares conflicting server.auth policy`);
+    }
+    if (stableStringify(existing) !== stableStringify(next)) {
+        throw new SpawnfileError("validation_error", `Duplicate Moltnet network ${networkId} declares conflicting server definition`);
+    }
+};
+export const assertCompatibleMoltnetRoomPolicy = (networkId, roomId, field, existing, next) => {
+    if (existing !== undefined && next !== undefined && existing !== next) {
+        throw new SpawnfileError("validation_error", `Duplicate Moltnet network ${networkId} room ${roomId} declares conflicting ${field}: ${existing} vs ${next}`);
+    }
+};

package/dist/compiler/moltnetRuntimeConfig.d.ts

@@ -1,2 +1,2 @@
 import type { CompilePlan, ResolvedAgentNode } from "./types.js";
-export declare const resolveRuntimeConfig: (plan: CompilePlan, agentNode: ResolvedAgentNode, nodeSlug: string, networkId: string, agentId: string) => Record<string, string>;
+export declare const resolveRuntimeConfig: (plan: CompilePlan, agentNode: ResolvedAgentNode, nodeSlug: string, _networkId: string, _agentId: string) => Record<string, string>;

package/dist/compiler/moltnetRuntimeConfig.js

@@ -1,6 +1,5 @@
 import { getRuntimeAdapter } from "../runtime/index.js";
 import { SpawnfileError } from "../shared/index.js";
-const DEFAULT_TINYCLAW_PORT = 3777;
 const INSTANCE_ROOT_PLACEHOLDER = "<instance-root>";
 const CONFIG_FILE_PLACEHOLDER = "<config-file>";
 const resolveSequentialRuntimePort = (plan, runtimeName, slug) => {
@@ -16,7 +15,6 @@ const resolveSequentialRuntimePort = (plan, runtimeName, slug) => {
     }
     return basePort + (index * (adapter.container.portStride ?? 1));
 };
-const createTinyClawChannel = (networkId, agentId) => `moltnet:${networkId}:${agentId}`;
 const replaceContainerPathTemplate = (template, instanceRoot, configFileName) => template
     .replaceAll(INSTANCE_ROOT_PLACEHOLDER, instanceRoot)
     .replaceAll(CONFIG_FILE_PLACEHOLDER, configFileName);
@@ -30,7 +28,7 @@ const resolveRuntimeInstancePaths = (runtimeName, slug) => {
             : undefined
     };
 };
-export const resolveRuntimeConfig = (plan, agentNode, nodeSlug, networkId, agentId) => {
+export const resolveRuntimeConfig = (plan, agentNode, nodeSlug, _networkId, _agentId) => {
     switch (agentNode.runtime.name) {
         case "openclaw": {
             const port = resolveSequentialRuntimePort(plan, "openclaw", nodeSlug);
@@ -53,16 +51,6 @@ export const resolveRuntimeConfig = (plan, agentNode, nodeSlug, networkId, agent
                 kind: "picoclaw"
             };
         }
-        case "tinyclaw": {
-            const channel = createTinyClawChannel(networkId, agentId);
-            return {
-                ack_url: `http://127.0.0.1:${DEFAULT_TINYCLAW_PORT}/api/responses`,
-                channel,
-                inbound_url: `http://127.0.0.1:${DEFAULT_TINYCLAW_PORT}/api/message`,
-                kind: "tinyclaw",
-                outbound_url: `http://127.0.0.1:${DEFAULT_TINYCLAW_PORT}/api/responses/pending?channel=${encodeURIComponent(channel)}`
-            };
-        }
         default:
             throw new SpawnfileError("compile_error", `Moltnet does not know how to attach runtime ${agentNode.runtime.name} directly`);
     }

package/dist/compiler/networkBinding.d.ts

@@ -0,0 +1,14 @@
+/** Uppercases an id and replaces every non-[A-Z0-9] character with `_`. */
+export declare const normalizeNetworkEnvSegment: (id: string) => string;
+export declare const networkUrlEnvName: (networkId: string) => string;
+export declare const networkTokenEnvName: (networkId: string, memberId?: string) => string;
+export interface NetworkBindingInput {
+    id: string;
+    members: string[];
+}
+/**
+ * Asserts that every generated network binding env name (URL and token vars,
+ * across all networks and members) is globally unique after normalization.
+ * Collisions are baked into immutable images, so they must fail at compile.
+ */
+export declare const assertNetworkBindingEnvUniqueness: (networks: NetworkBindingInput[]) => void;

package/dist/compiler/networkBinding.js

@@ -0,0 +1,34 @@
+import { SpawnfileError } from "../shared/index.js";
+const ENV_PREFIX = "SPAWNFILE_NETWORK_";
+/** Uppercases an id and replaces every non-[A-Z0-9] character with `_`. */
+export const normalizeNetworkEnvSegment = (id) => id.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
+export const networkUrlEnvName = (networkId) => `${ENV_PREFIX}${normalizeNetworkEnvSegment(networkId)}_URL`;
+export const networkTokenEnvName = (networkId, memberId) => memberId === undefined
+    ? `${ENV_PREFIX}${normalizeNetworkEnvSegment(networkId)}_TOKEN`
+    : `${ENV_PREFIX}${normalizeNetworkEnvSegment(networkId)}_TOKEN_${normalizeNetworkEnvSegment(memberId)}`;
+/**
+ * Asserts that every generated network binding env name (URL and token vars,
+ * across all networks and members) is globally unique after normalization.
+ * Collisions are baked into immutable images, so they must fail at compile.
+ */
+export const assertNetworkBindingEnvUniqueness = (networks) => {
+    const seen = new Map();
+    const claim = (envName, owner) => {
+        const existing = seen.get(envName);
+        if (existing && existing !== owner) {
+            throw new SpawnfileError("validation_error", `Network binding env name ${envName} collides between ${existing} and ${owner}. ` +
+                "Rename a network or member so their normalized env names stay unique.");
+        }
+        seen.set(envName, owner);
+    };
+    for (const network of networks) {
+        claim(networkUrlEnvName(network.id), `network ${network.id} url`);
+        const members = [...new Set(network.members)];
+        if (members.length === 1) {
+            claim(networkTokenEnvName(network.id), `network ${network.id} token`);
+        }
+        for (const member of members) {
+            claim(networkTokenEnvName(network.id, member), `network ${network.id} member ${member}`);
+        }
+    }
+};

package/dist/compiler/publishProject.d.ts

@@ -0,0 +1,13 @@
+import { type BuildProjectOptions, type BuildProjectResult } from "./buildProject.js";
+export type DockerPushRunner = (command: string, args: string[]) => Promise<string>;
+export interface PublishProjectOptions extends BuildProjectOptions {
+    pushRunner?: DockerPushRunner;
+}
+export interface PublishProjectResult extends BuildProjectResult {
+    digest: string | null;
+}
+/**
+ * Compiles, builds, verifies, and pushes a project image. Pre-push verification
+ * refuses to publish a report that leaks creator paths or omits secret markers.
+ */
+export declare const publishProject: (inputPath: string, options?: PublishProjectOptions) => Promise<PublishProjectResult>;