spawnfile 0.1.11 → 0.1.13

package/dist/compiler/compileProject.js

@@ -22,9 +22,7 @@ const createTeamOutputDirectory = (baseDirectory, runtimeName, node) => path.joi
 const compileAgentNode = async (baseDirectory, node) => {
     const runtime = await assertRuntimeCanCompile(node.runtimeName ?? node.value.runtime.name);
     const adapter = getRuntimeAdapter(runtime.name);
-    const diagnostics = [
-        ...createRuntimeLifecycleDiagnostics(runtime)
-    ];
+    const diagnostics = [...createRuntimeLifecycleDiagnostics(runtime)];
     for (const diagnostic of adapter.validateRuntimeOptions?.(node.value.runtime.options) ?? []) {
         diagnostics.push(diagnostic);
     }
@@ -37,6 +35,7 @@ const compileAgentNode = async (baseDirectory, node) => {
     await writeEmittedFiles(outputDirectory, result.files);
     return {
         emittedFiles: result.files,
+        id: node.id,
         kind: node.kind,
         report: {
             capabilities: result.capabilities,
@@ -63,6 +62,7 @@ const compileTeamNode = async (baseDirectory, node) => {
     if (!runtimeName) {
         return {
             emittedFiles: [],
+            id: node.id,
             kind: node.kind,
             report: {
                 capabilities: createTeamCapabilities("degraded", "Team spans multiple runtimes and cannot lower to one native team artifact in v0.1"),
@@ -88,6 +88,7 @@ const compileTeamNode = async (baseDirectory, node) => {
     if (!adapter.compileTeam) {
         return {
             emittedFiles: [],
+            id: node.id,
             kind: node.kind,
             report: {
                 capabilities: createTeamCapabilities("degraded", `Runtime ${runtime.name} does not provide native team compilation in v0.1`),
@@ -113,6 +114,7 @@ const compileTeamNode = async (baseDirectory, node) => {
     await writeEmittedFiles(outputDirectory, result.files);
     return {
         emittedFiles: result.files,
+        id: node.id,
         kind: node.kind,
         report: {
             capabilities: result.capabilities,
@@ -200,7 +202,11 @@ const augmentNodeReports = (compiledNodes, support) => {
 };
 export const compileProject = async (inputPath, options = {}) => {
     const plan = await buildCompilePlan(inputPath);
-    const outputDirectory = path.resolve(options.outputDirectory ?? DEFAULT_OUTPUT_DIRECTORY);
+    // The default output directory lives under the resolved project root, not the
+    // process working directory, so `spawnfile compile ./org` writes ./org/.spawn.
+    const outputDirectory = options.outputDirectory
+        ? path.resolve(options.outputDirectory)
+        : path.join(path.dirname(plan.root), DEFAULT_OUTPUT_DIRECTORY);
     if (options.clean ?? true) {
         await removeDirectory(outputDirectory);
     }
@@ -226,20 +232,25 @@ export const compileProject = async (inputPath, options = {}) => {
     }
     const moltnetArtifacts = await generateMoltnetArtifacts(plan);
     const hasStagedMoltnetBinaries = moltnetArtifacts
-        ? await stageMoltnetBinaries(outputDirectory)
+        ? await stageMoltnetBinaries(outputDirectory, {
+            architecture: options.containerArchitecture
+        })
         : false;
     await injectMoltnetWorkspaceFiles(outputDirectory, compiledNodes, moltnetArtifacts);
+    const generatedAt = new Date().toISOString();
     const containerArtifacts = await createContainerArtifacts(plan, compiledNodes, {
+        generatedAt,
         hasStagedMoltnetBinaries,
         moltnet: moltnetArtifacts
     });
     await writeEmittedFiles(outputDirectory, containerArtifacts.files);
     await Promise.all(containerArtifacts.executablePaths.map((filePath) => chmod(path.join(outputDirectory, filePath), 0o755)));
-    const report = createCompileReport(plan.root, nodeReports, [], containerArtifacts.report);
-    const reportPath = await writeCompileReport(outputDirectory, report);
-    return {
+    const report = createCompileReport(plan.root, nodeReports, [], containerArtifacts.report, {
+        compileFingerprint: containerArtifacts.distribution.fingerprint,
+        generatedAt,
         outputDirectory,
-        report,
-        reportPath
-    };
+        projectName: containerArtifacts.distribution.report.organization.project
+    });
+    const reportPath = await writeCompileReport(outputDirectory, report);
+    return { outputDirectory, report, reportPath };
 };

package/dist/compiler/containerArtifacts.d.ts

@@ -3,6 +3,7 @@ import type { CompiledNodeArtifact, GeneratedContainerArtifacts } from "./contai
 import type { CompilePlan } from "./types.js";
 export type { CompiledNodeArtifact, GeneratedContainerArtifacts } from "./containerArtifactsTypes.js";
 export interface ContainerArtifactOptions {
+    generatedAt?: string;
     hasStagedMoltnetBinaries?: boolean;
     moltnet?: MoltnetArtifacts | null;
 }

package/dist/compiler/containerArtifacts.js

@@ -1,5 +1,106 @@
+import { buildDistributionReport, createDistributionImageLabels, DISTRIBUTION_REPORT_OUTPUT_FILE, normalizeProjectLabelSlug } from "../distribution/index.js";
+import { SpawnfileError } from "../shared/index.js";
 import { createEnvVariableMap, createRuntimeTargetPlans } from "./containerArtifactsPlans.js";
 import { createRootfsFiles, renderDockerfile, renderEntrypoint, renderEnvExample } from "./containerArtifactsRender.js";
+const createOrganizationSummary = (plan, compiledNodes) => {
+    const nodes = compiledNodes.map((node) => ({
+        id: node.id ?? `${node.kind}:${node.slug}`,
+        kind: node.kind,
+        name: node.value.name,
+        runtimeName: node.runtimeName,
+        source: node.value.source
+    }));
+    const rootNode = nodes.find((node) => node.source === plan.root)
+        ?? nodes.find((node) => !plan.edges.some((edge) => edge.to === node.id))
+        ?? nodes[0];
+    if (!rootNode) {
+        throw new SpawnfileError("compile_error", `Unable to resolve the root node for ${plan.root}`);
+    }
+    const memberEdges = plan.edges.filter((edge) => edge.kind === "team_member");
+    const teamsByAgent = new Map();
+    for (const edge of memberEdges) {
+        teamsByAgent.set(edge.to, [...(teamsByAgent.get(edge.to) ?? []), edge.from]);
+    }
+    const agentNodes = nodes.filter((node) => node.kind === "agent");
+    const teamNodes = nodes.filter((node) => node.kind === "team");
+    const agentIds = new Set(agentNodes.map((node) => node.id));
+    return {
+        agents: agentNodes
+            .map((node) => ({
+            id: node.id,
+            name: node.name,
+            runtime: node.runtimeName,
+            teams: [...(teamsByAgent.get(node.id) ?? [])].sort()
+        }))
+            .sort((left, right) => left.id.localeCompare(right.id)),
+        project: rootNode.name,
+        teams: teamNodes
+            .map((node) => ({
+            agents: memberEdges
+                .filter((edge) => edge.from === node.id && agentIds.has(edge.to))
+                .map((edge) => edge.to)
+                .sort(),
+            id: node.id,
+            name: node.name
+        }))
+            .sort((left, right) => left.id.localeCompare(right.id))
+    };
+};
+const resolveMoltnetOperatorTokenSecret = (plan) => {
+    const client = plan.server.auth.client;
+    if (!client) {
+        return undefined;
+    }
+    if (client.token_env) {
+        return client.token_env;
+    }
+    if (client.token_path) {
+        return client.token_path;
+    }
+    if (!client.token_id) {
+        return undefined;
+    }
+    return plan.server.auth.tokens?.find((token) => token.id === client.token_id)?.secret;
+};
+const createMoltnetSummary = (moltnet) => {
+    if (!moltnet) {
+        return undefined;
+    }
+    return {
+        node_plans: moltnet.nodePlans.map((plan) => ({
+            config_path: plan.configPath,
+            network_id: plan.networkId
+        })),
+        server_plans: moltnet.serverPlans.map((plan) => {
+            const operatorTokenSecret = resolveMoltnetOperatorTokenSecret(plan);
+            return {
+                auth_mode: plan.server.auth.mode,
+                base_url: plan.baseUrl,
+                ...(plan.configPath ? { config_path: plan.configPath } : {}),
+                ...(plan.server.mode === "managed"
+                    ? { direct_messages: plan.server.direct_messages }
+                    : {}),
+                id: plan.id,
+                mode: plan.mode,
+                network_id: plan.networkId,
+                ...(operatorTokenSecret ? { operator_token_secret: operatorTokenSecret } : {}),
+                ...(plan.port ? { port: plan.port } : {}),
+                ...(plan.server.auth.public_read !== undefined
+                    ? { public_read: plan.server.auth.public_read }
+                    : {}),
+                rooms: plan.rooms.map((room) => ({
+                    id: room.id,
+                    members: [...room.members],
+                    ...(room.visibility ? { visibility: room.visibility } : {}),
+                    ...(room.write_policy ? { write_policy: room.write_policy } : {})
+                })),
+                ...(plan.server.mode === "managed"
+                    ? { store_kind: plan.server.store.kind }
+                    : {})
+            };
+        })
+    };
+};
 export const createContainerArtifacts = async (plan, compiledNodes, options = {}) => {
     const runtimePlans = await createRuntimeTargetPlans(plan, compiledNodes);
     const envVariables = [...createEnvVariableMap(compiledNodes, runtimePlans).values()].sort((left, right) => left.name.localeCompare(right.name));
@@ -23,11 +124,108 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         volume_name: mount.volumeName
     }))
         .sort((left, right) => left.id.localeCompare(right.id));
+    const runtimeInternalPorts = runtimePlans.flatMap((plan) => plan.port ? [plan.port] : []);
+    const internalPorts = [...new Set([...runtimeInternalPorts, ...(options.moltnet?.ports ?? [])])].sort((left, right) => left - right);
+    const runtimePublishedPorts = runtimePlans.flatMap((plan) => plan.publishedPort ? [plan.publishedPort] : []);
+    const publishedPorts = [
+        ...new Set([...runtimePublishedPorts, ...(options.moltnet?.publishedPorts ?? [])])
+    ].sort((left, right) => left - right);
+    const portMappings = runtimePlans
+        .flatMap((plan) => plan.port && plan.publishedPort
+        ? [{ internal_port: plan.port, published_port: plan.publishedPort }]
+        : [])
+        .sort((left, right) => left.published_port - right.published_port
+        || left.internal_port - right.internal_port);
+    const runtimeHomes = [
+        ...new Set(runtimePlans.flatMap((plan) => (plan.instancePaths.homePath ? [plan.instancePaths.homePath] : [])))
+    ].sort();
+    const runtimeInstances = runtimePlans
+        .map((plan) => ({
+        config_path: plan.instancePaths.configPath,
+        home_path: plan.instancePaths.homePath ?? null,
+        id: plan.id,
+        internal_port: plan.port ?? null,
+        model_auth_methods: plan.modelAuthMethods,
+        model_secrets_required: plan.modelSecretsRequired,
+        node_ids: [...(plan.sourceIds ?? [])],
+        published_port: plan.publishedPort ?? null,
+        runtime: plan.runtimeName,
+        workspace_path: plan.instancePaths.workspacePath
+    }))
+        .sort((left, right) => left.id.localeCompare(right.id));
+    const runtimesInstalled = [...new Set(runtimePlans.map((plan) => plan.runtimeName))].sort();
+    const workspaceResources = [
+        ...new Map(runtimePlans.flatMap((plan) => (plan.resources ?? []).map((resource) => [
+            `${resource.kind}:${resource.id}:${resource.linkPath}`,
+            {
+                backing_path: resource.backingPath,
+                id: resource.id,
+                kind: resource.kind,
+                link_path: resource.linkPath,
+                mode: resource.mode,
+                mount: resource.mount,
+                sharing: resource.sharing
+            }
+        ]))).values()
+    ].sort((left, right) => left.link_path.localeCompare(right.link_path) || left.id.localeCompare(right.id));
+    const moltnetSummary = createMoltnetSummary(options.moltnet);
+    const organization = createOrganizationSummary(plan, compiledNodes);
+    const projectSlug = normalizeProjectLabelSlug(organization.project);
+    const mergedModelAuthMethods = Object.assign({}, ...runtimePlans.map((runtimePlan) => runtimePlan.modelAuthMethods));
+    const moltnetNetworks = [
+        ...new Map((options.moltnet?.serverPlans ?? []).map((serverPlan) => [
+            serverPlan.networkId,
+            {
+                binding: "env",
+                id: serverPlan.networkId,
+                server_mode: serverPlan.mode
+            }
+        ])).values()
+    ];
+    const distributionReport = buildDistributionReport({
+        envVariables: envVariables.map((variable) => ({
+            categories: variable.categories,
+            generated: variable.generated,
+            name: variable.name,
+            required: variable.required
+        })),
+        generatedAt: options.generatedAt ?? new Date().toISOString(),
+        internalPorts,
+        modelAuthMethods: mergedModelAuthMethods,
+        moltnetNetworks,
+        organization,
+        persistentMounts: persistentMounts.map((mount) => ({
+            durability: "persistent",
+            id: mount.id,
+            kind: "volume",
+            target: mount.mount_path
+        })),
+        portMappings,
+        publishedPorts,
+        resources: workspaceResources.map((resource) => ({
+            id: resource.id,
+            kind: resource.kind,
+            link_path: resource.link_path,
+            mode: resource.mode,
+            mount: resource.mount,
+            sharing: resource.sharing
+        })),
+        runtimeInstances
+    });
+    const distributionLabels = createDistributionImageLabels(projectSlug, distributionReport.compile_fingerprint);
     const files = [
         ...createRootfsFiles(runtimePlans),
         ...(options.moltnet?.files ?? []),
+        {
+            content: `${JSON.stringify(distributionReport, null, 2)}\n`,
+            path: DISTRIBUTION_REPORT_OUTPUT_FILE
+        },
         {
             content: await renderDockerfile(runtimePlans, {
+                distribution: {
+                    labels: distributionLabels,
+                    reportOutputFile: DISTRIBUTION_REPORT_OUTPUT_FILE
+                },
                 hasMoltnet: Boolean(options.moltnet),
                 hasStagedMoltnetBinaries: options.hasStagedMoltnetBinaries,
                 moltnetPublishedPorts: options.moltnet?.publishedPorts ?? [],
@@ -51,38 +249,12 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             path: ".env.example"
         }
     ];
-    const runtimePorts = runtimePlans.flatMap((plan) => plan.publishedPort ? [plan.publishedPort] : []);
-    const moltnetPorts = options.moltnet?.publishedPorts ?? [];
-    const ports = [...new Set([...runtimePorts, ...moltnetPorts])].sort((left, right) => left - right);
-    const runtimeHomes = [
-        ...new Set(runtimePlans.flatMap((plan) => (plan.instancePaths.homePath ? [plan.instancePaths.homePath] : [])))
-    ].sort();
-    const runtimeInstances = runtimePlans
-        .map((plan) => ({
-        config_path: plan.instancePaths.configPath,
-        home_path: plan.instancePaths.homePath ?? null,
-        id: plan.id,
-        model_auth_methods: plan.modelAuthMethods,
-        model_secrets_required: plan.modelSecretsRequired,
-        runtime: plan.runtimeName
-    }))
-        .sort((left, right) => left.id.localeCompare(right.id));
-    const runtimesInstalled = [...new Set(runtimePlans.map((plan) => plan.runtimeName))].sort();
-    const workspaceResources = [
-        ...new Map(runtimePlans.flatMap((plan) => (plan.resources ?? []).map((resource) => [
-            `${resource.kind}:${resource.id}:${resource.linkPath}`,
-            {
-                backing_path: resource.backingPath,
-                id: resource.id,
-                kind: resource.kind,
-                link_path: resource.linkPath,
-                mode: resource.mode,
-                mount: resource.mount,
-                sharing: resource.sharing
-            }
-        ]))).values()
-    ].sort((left, right) => left.link_path.localeCompare(right.link_path) || left.id.localeCompare(right.id));
     return {
+        distribution: {
+            fingerprint: distributionReport.compile_fingerprint,
+            labels: distributionLabels,
+            report: distributionReport
+        },
         executablePaths: ["entrypoint.sh"],
         files,
         ...(options.moltnet
@@ -97,8 +269,12 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             dockerfile: "Dockerfile",
             entrypoint: "entrypoint.sh",
             env_example: ".env.example",
+            internal_ports: internalPorts,
             model_secrets_required: modelSecretsRequired,
-            ports,
+            ...(moltnetSummary ? { moltnet: moltnetSummary } : {}),
+            port_mappings: portMappings,
+            ports: publishedPorts,
+            published_ports: publishedPorts,
             runtime_instances: runtimeInstances,
             runtime_homes: runtimeHomes,
             runtime_secrets_required: runtimeSecretsRequired,

package/dist/compiler/containerArtifactsPlans.js

@@ -65,12 +65,13 @@ const resolveInstancePaths = (runtimeName, targetId, meta) => {
 };
 export const createEnvVariableMap = (compiledNodes, runtimePlans) => {
     const variables = new Map();
-    const register = (name, required, description, category) => {
+    const register = (name, required, description, category, generated = false) => {
         const current = variables.get(name);
         if (!current) {
             variables.set(name, {
                 categories: [category],
                 description,
+                generated,
                 name,
                 required
             });
@@ -79,6 +80,7 @@ export const createEnvVariableMap = (compiledNodes, runtimePlans) => {
         variables.set(name, {
             ...current,
             categories: [...new Set([...current.categories, category])],
+            generated: current.generated && generated,
             required: current.required || required
         });
     };
@@ -104,10 +106,10 @@ export const createEnvVariableMap = (compiledNodes, runtimePlans) => {
     }
     for (const runtimePlan of runtimePlans) {
         for (const variable of runtimePlan.meta.env ?? []) {
-            register(variable.name, variable.required, variable.description, "runtime");
+            register(variable.name, variable.required, variable.description, "runtime", variable.generated ?? false);
         }
         for (const binding of runtimePlan.targetConfigEnvBindings ?? []) {
-            register(binding.envName, true, `Injected into ${runtimePlan.runtimeName} runtime config`, "runtime");
+            register(binding.envName, true, `Injected into ${runtimePlan.runtimeName} runtime config`, "runtime", binding.generated ?? false);
         }
     }
     return variables;
@@ -165,7 +167,7 @@ export const createRuntimeTargetPlans = async (plan, compiledNodes) => {
             .filter((node) => node.runtimeName === runtimeName && node.emittedFiles.length > 0)
             .map((node) => ({
             emittedFiles: node.emittedFiles,
-            id: `${node.kind}:${node.slug}`,
+            id: node.id ?? `${node.kind}:${node.slug}`,
             kind: node.kind,
             slug: node.slug,
             value: node.value
@@ -192,6 +194,7 @@ export const createRuntimeTargetPlans = async (plan, compiledNodes) => {
                 resources: resolveTargetResources(target, targetInputs, instancePaths, adapter.container),
                 runtimeName,
                 runtimeRoot: recipe.runtimeRoot,
+                sourceIds: [...(target.sourceIds ?? [])].sort(),
                 targetConfigEnvBindings: target.configEnvBindings,
                 targetFiles: target.files
             });

package/dist/compiler/containerArtifactsRender.d.ts

@@ -4,5 +4,11 @@ import type { EntrypointOptions } from "./containerEntrypointRender.js";
 export { renderEntrypoint } from "./containerEntrypointRender.js";
 export type { EntrypointOptions } from "./containerEntrypointRender.js";
 export declare const renderEnvExample: (variables: ContainerEnvVariable[]) => string;
-export declare const renderDockerfile: (runtimePlans: RuntimeTargetPlan[], options?: EntrypointOptions) => Promise<string>;
+export interface DockerfileDistributionOptions {
+    labels: Record<string, string>;
+    reportOutputFile: string;
+}
+export declare const renderDockerfile: (runtimePlans: RuntimeTargetPlan[], options?: EntrypointOptions & {
+    distribution?: DockerfileDistributionOptions;
+}) => Promise<string>;
 export declare const createRootfsFiles: (runtimePlans: RuntimeTargetPlan[]) => EmittedFile[];

package/dist/compiler/containerArtifactsRender.js

@@ -1,18 +1,18 @@
 import path from "node:path";
+import { DISTRIBUTION_REPORT_IMAGE_PATH } from "../distribution/index.js";
 import { createRuntimeInstallRecipe } from "../runtime/index.js";
 import { SpawnfileError } from "../shared/index.js";
 export { renderEntrypoint } from "./containerEntrypointRender.js";
 import { MOLTNET_BIN_DIRECTORY, MOLTNET_BINARY_NAMES } from "./moltnetBinaries.js";
+import { collectPackagesByManager, createAptPackageInstallItem, createNpmPackageInstallCommand, createNpmPackageInstallItem, createPackageInstallCommand, createPipxPackageInstallCommand, createPipxPackageInstallItem, getNpmInstallItemName } from "./containerPackageRender.js";
 const CONTAINER_ROOTFS_ROOT = "container/rootfs";
 const GATEWAY_PORT_PLACEHOLDER = "<gateway-port>";
 const MOLTNET_INSTALL_SCRIPT_URL = "https://moltnet.dev/install.sh";
 const MOLTNET_RELEASE_METADATA_URL = "https://api.github.com/repos/noopolis/moltnet/releases/latest";
 const WORKSPACE_PLACEHOLDER = "<workspace-path>";
+const RUNTIME_ROOT_PLACEHOLDER = "<runtime-root>";
 const shellQuote = (value) => `'${value.replace(/'/g, `'\"'\"'`)}'`;
 const extractNodeMajorVersion = (image) => Number(image.match(/^node:(\d+)/)?.[1] ?? "0");
-const createPackageInstallCommand = (packages) => `RUN apt-get update && apt-get install -y --no-install-recommends ${packages.join(" ")} && rm -rf /var/lib/apt/lists/*`;
-const createNpmPackageInstallCommand = (packages) => `RUN npm install -g --omit=dev --no-fund --no-audit ${packages.join(" ")}`;
-const createPipxPackageInstallCommand = (packages) => `RUN PIPX_HOME=/opt/pipx PIPX_BIN_DIR=/usr/local/bin pipx install ${packages.join(" ")}`;
 const createStateOwnershipCommand = (persistentMountPaths = []) => {
     const mountPaths = [...new Set(persistentMountPaths)].sort();
     const mkdirPaths = [...new Set(["/var/lib/spawnfile", ...mountPaths])].sort();
@@ -20,7 +20,6 @@ const createStateOwnershipCommand = (persistentMountPaths = []) => {
     const chownPaths = [
         ...new Set([
             "/var/lib/spawnfile",
-            "/opt/spawnfile",
             ...mountPaths.filter((mountPath) => !mountPath.startsWith("/var/lib/spawnfile/"))
         ])
     ].sort();
@@ -30,70 +29,13 @@ const createStateOwnershipCommand = (persistentMountPaths = []) => {
         `chown -R spawnfile:spawnfile ${chownPaths.map(shellQuote).join(" ")}`
     ].join(" && ");
 };
-const dedupePackages = (packages) => {
-    const seen = new Map();
-    for (const currentPackage of packages) {
-        seen.set(`${currentPackage.manager}\u0000${currentPackage.name}\u0000${currentPackage.version ?? ""}\u0000${currentPackage.scope ?? ""}`, currentPackage);
-    }
-    return [...seen.values()].sort((left, right) => `${left.manager}\u0000${left.name}\u0000${left.version ?? ""}\u0000${left.scope ?? ""}`.localeCompare(`${right.manager}\u0000${right.name}\u0000${right.version ?? ""}\u0000${right.scope ?? ""}`));
-};
-const createPackageIdentity = (pkg) => `${pkg.manager}\u0000${pkg.name}\u0000${pkg.version ?? ""}\u0000${pkg.scope ?? ""}`;
-const createPackageConflictIdentity = (pkg) => `${pkg.manager}\u0000${pkg.name}`;
-const assertImagePackageCompatibility = (packages) => {
-    const byName = new Map();
-    for (const currentPackage of packages) {
-        const conflictIdentity = createPackageConflictIdentity(currentPackage);
-        const existingPackage = byName.get(conflictIdentity);
-        if (!existingPackage) {
-            byName.set(conflictIdentity, currentPackage);
-            continue;
-        }
-        if (createPackageIdentity(existingPackage) !== createPackageIdentity(currentPackage)) {
-            throw new SpawnfileError("validation_error", `Generated container declares conflicting package definitions for ${currentPackage.manager} package ${currentPackage.name}`);
-        }
-    }
-};
-const createAptPackageInstallItem = (pkg) => pkg.version ? `${pkg.name}=${pkg.version}` : pkg.name;
-const createNpmPackageInstallItem = (pkg) => pkg.version ? `${pkg.name}@${pkg.version}` : pkg.name;
-const createPipxPackageInstallItem = (pkg) => pkg.version ? `${pkg.name}==${pkg.version}` : pkg.name;
-const getNpmInstallItemName = (item) => {
-    if (!item.startsWith("@")) {
-        const versionMarker = item.indexOf("@");
-        return versionMarker === -1 ? item : item.slice(0, versionMarker);
-    }
-    const slashIndex = item.indexOf("/");
-    if (slashIndex === -1) {
-        return item;
-    }
-    const versionMarker = item.indexOf("@", slashIndex);
-    return versionMarker === -1 ? item : item.slice(0, versionMarker);
-};
-const collectPackagesByManager = (runtimePlans) => {
-    const packagesByManager = {
-        apt: [],
-        npm: [],
-        pipx: []
-    };
-    const imagePackages = runtimePlans.flatMap((plan) => plan.packages ?? []);
-    assertImagePackageCompatibility(imagePackages);
-    const resolvedPackages = dedupePackages(imagePackages);
-    for (const packageConfig of resolvedPackages) {
-        if (packageConfig.manager === "apt") {
-            packagesByManager.apt.push(packageConfig);
-            continue;
-        }
-        if (packageConfig.manager === "npm") {
-            packagesByManager.npm.push(packageConfig);
-            continue;
-        }
-        if (packageConfig.manager === "pipx") {
-            packagesByManager.pipx.push(packageConfig);
-            continue;
-        }
+const selectBaseImage = (runtimePlans, runtimeRecipes) => {
+    const recipeBaseImages = [
+        ...new Set(runtimeRecipes.flatMap((recipe) => recipe.baseImage ? [recipe.baseImage] : []))
+    ];
+    if (recipeBaseImages.length === 1 && runtimePlans.length === runtimeRecipes.length) {
+        return recipeBaseImages[0];
     }
-    return packagesByManager;
-};
-const selectBaseImage = (runtimePlans) => {
     const firstRuntimeMeta = runtimePlans[0]?.meta;
     if (runtimePlans.length <= 1) {
         return firstRuntimeMeta?.standaloneBaseImage ?? "debian:bookworm-slim";
@@ -132,12 +74,13 @@ export const renderEnvExample = (variables) => {
 export const renderDockerfile = async (runtimePlans, options = {}) => {
     const runtimeNames = [...new Set(runtimePlans.map((plan) => plan.runtimeName))];
     const runtimeRecipes = await Promise.all(runtimeNames.map((runtimeName) => createRuntimeInstallRecipe(runtimeName)));
-    const baseImage = selectBaseImage(runtimePlans);
+    const recipeByRuntimeName = new Map(runtimeRecipes.map((recipe) => [recipe.runtimeName, recipe]));
+    const baseImage = selectBaseImage(runtimePlans, runtimeRecipes);
     const needsJsonEnvWriter = runtimePlans.some((plan) => (plan.configEnvBindings?.length ?? 0) > 0);
     const needsGit = runtimePlans.some((plan) => (plan.resources ?? []).some((resource) => resource.kind === "git"));
     const systemDeps = [
         ...new Set([
-            ...runtimePlans.flatMap((plan) => plan.meta.systemDeps),
+            ...runtimePlans.flatMap((plan) => recipeByRuntimeName.get(plan.runtimeName)?.baseImage ? [] : plan.meta.systemDeps),
             ...(needsGit ? ["git"] : []),
             ...(options.hasMoltnet && !options.hasStagedMoltnetBinaries
                 ? ["ca-certificates", "curl", "tar"]
@@ -194,6 +137,17 @@ export const renderDockerfile = async (runtimePlans, options = {}) => {
     }
     lines.push('RUN if ! id -u spawnfile >/dev/null 2>&1; then useradd --create-home --home-dir /home/spawnfile --shell /bin/bash spawnfile; fi', "");
     lines.push("COPY container/rootfs/ /", "COPY .env.example /opt/spawnfile/.env.example", 'COPY entrypoint.sh /opt/spawnfile/entrypoint.sh', "RUN chmod +x /opt/spawnfile/entrypoint.sh");
+    const postRootfsCommands = [
+        ...new Set(runtimePlans.flatMap((plan) => plan.meta.postRootfsCommands ?? []))
+    ];
+    for (const command of postRootfsCommands) {
+        lines.push(`RUN ${command}`);
+    }
+    if (options.distribution) {
+        lines.push("", `COPY ${options.distribution.reportOutputFile} ${DISTRIBUTION_REPORT_IMAGE_PATH}`, ...Object.entries(options.distribution.labels)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([name, value]) => `LABEL ${name}=${shellQuote(value)}`));
+    }
     lines.push(`RUN ${createStateOwnershipCommand(options.persistentMountPaths)}`);
     if (exposedPorts.length > 0) {
         lines.push(`EXPOSE ${exposedPorts.join(" ")}`);
@@ -207,11 +161,19 @@ export const createRootfsFiles = (runtimePlans) => runtimePlans.flatMap((plan) =
         return {
             content: file.content
                 .replaceAll(WORKSPACE_PLACEHOLDER, plan.instancePaths.workspacePath)
+                .replaceAll(RUNTIME_ROOT_PLACEHOLDER, plan.runtimeRoot)
                 .replaceAll(`"${GATEWAY_PORT_PLACEHOLDER}"`, plan.port ? String(plan.port) : "0")
                 .replaceAll(GATEWAY_PORT_PLACEHOLDER, plan.port ? String(plan.port) : ""),
             path: `${CONTAINER_ROOTFS_ROOT}${plan.instancePaths.configPath}`
         };
     }
+    if (file.path.startsWith("runtime/")) {
+        const relativeRuntimePath = file.path.slice("runtime/".length);
+        return {
+            content: file.content,
+            path: `${CONTAINER_ROOTFS_ROOT}${path.posix.join(plan.runtimeRoot, relativeRuntimePath)}`
+        };
+    }
     if (file.path.startsWith("workspace/")) {
         const relativeWorkspacePath = file.path.slice("workspace/".length);
         return {

package/dist/compiler/containerArtifactsTypes.d.ts

@@ -1,3 +1,4 @@
+import type { DistributionReport } from "../distribution/index.js";
 import type { ContainerReport } from "../report/index.js";
 import type { EmittedFile, RuntimeContainerConfigEnvBinding, RuntimeContainerMeta } from "../runtime/index.js";
 import type { ModelAuthMethod } from "../shared/index.js";
@@ -7,6 +8,7 @@ import type { WorkspaceResourcePlan } from "./workspaceResources.js";
 export interface ContainerEnvVariable {
     categories: Array<"model" | "project" | "runtime" | "surface">;
     description: string;
+    generated: boolean;
     name: string;
     required: boolean;
 }
@@ -32,17 +34,24 @@ export interface RuntimeTargetPlan {
     resources?: WorkspaceResourcePlan[];
     runtimeName: string;
     runtimeRoot: string;
+    sourceIds?: string[];
     targetConfigEnvBindings?: RuntimeContainerConfigEnvBinding[];
     targetFiles: EmittedFile[];
 }
 export interface CompiledNodeArtifact {
     emittedFiles: EmittedFile[];
+    id?: string;
     kind: "agent" | "team";
     runtimeName: string | null;
     slug: string;
     value: ResolvedAgentNode | ResolvedTeamNode;
 }
 export interface GeneratedContainerArtifacts {
+    distribution: {
+        fingerprint: string;
+        labels: Record<string, string>;
+        report: DistributionReport;
+    };
     executablePaths: string[];
     files: EmittedFile[];
     moltnet?: {