spawnfile 0.1.12 → 0.1.14

package/dist/compiler/containerArtifacts.js

@@ -1,109 +1,38 @@
-import { buildDistributionReport, createDistributionImageLabels, DISTRIBUTION_REPORT_OUTPUT_FILE, normalizeProjectLabelSlug } from "../distribution/index.js";
+import { createHash } from "node:crypto";
+import { buildDistributionReport, createDistributionImageLabels, DISTRIBUTION_REPORT_OUTPUT_FILE, normalizeProjectLabelSlug, WORLD_BINDINGS_IMAGE_PATH } from "../distribution/index.js";
 import { SpawnfileError } from "../shared/index.js";
+import { createMoltnetSummary, createOrganizationSummary } from "./containerArtifactSummaries.js";
 import { createEnvVariableMap, createRuntimeTargetPlans } from "./containerArtifactsPlans.js";
+import { createDockerIgnoreContent } from "./dockerBuildContext.js";
+import { createDaimonTelemetryArtifacts } from "./daimonTelemetryArtifacts.js";
 import { createRootfsFiles, renderDockerfile, renderEntrypoint, renderEnvExample } from "./containerArtifactsRender.js";
-const createOrganizationSummary = (plan, compiledNodes) => {
-    const nodes = compiledNodes.map((node) => ({
-        id: node.id ?? `${node.kind}:${node.slug}`,
-        kind: node.kind,
-        name: node.value.name,
-        runtimeName: node.runtimeName,
-        source: node.value.source
-    }));
-    const rootNode = nodes.find((node) => node.source === plan.root)
-        ?? nodes.find((node) => !plan.edges.some((edge) => edge.to === node.id))
-        ?? nodes[0];
-    if (!rootNode) {
-        throw new SpawnfileError("compile_error", `Unable to resolve the root node for ${plan.root}`);
-    }
-    const memberEdges = plan.edges.filter((edge) => edge.kind === "team_member");
-    const teamsByAgent = new Map();
-    for (const edge of memberEdges) {
-        teamsByAgent.set(edge.to, [...(teamsByAgent.get(edge.to) ?? []), edge.from]);
-    }
-    const agentNodes = nodes.filter((node) => node.kind === "agent");
-    const teamNodes = nodes.filter((node) => node.kind === "team");
-    const agentIds = new Set(agentNodes.map((node) => node.id));
-    return {
-        agents: agentNodes
-            .map((node) => ({
-            id: node.id,
-            name: node.name,
-            runtime: node.runtimeName,
-            teams: [...(teamsByAgent.get(node.id) ?? [])].sort()
-        }))
-            .sort((left, right) => left.id.localeCompare(right.id)),
-        project: rootNode.name,
-        teams: teamNodes
-            .map((node) => ({
-            agents: memberEdges
-                .filter((edge) => edge.from === node.id && agentIds.has(edge.to))
-                .map((edge) => edge.to)
-                .sort(),
-            id: node.id,
-            name: node.name
-        }))
-            .sort((left, right) => left.id.localeCompare(right.id))
-    };
-};
-const resolveMoltnetOperatorTokenSecret = (plan) => {
-    const client = plan.server.auth.client;
-    if (!client) {
-        return undefined;
-    }
-    if (client.token_env) {
-        return client.token_env;
-    }
-    if (client.token_path) {
-        return client.token_path;
-    }
-    if (!client.token_id) {
-        return undefined;
+import { createMemoryArtifactBundle } from "./memoryArtifacts.js";
+import { SIMFILE_WORLD_BINDINGS_VERSION, WORLD_BINDINGS_OUTPUT_FILE } from "./worldBindings.js";
+export const createContainerArtifacts = async (plan, compiledNodes, options = {}) => {
+    const runtimePlans = await createRuntimeTargetPlans(plan, compiledNodes, options.worldBindings);
+    const daimonTelemetryArtifacts = createDaimonTelemetryArtifacts(plan, runtimePlans, compiledNodes);
+    const envVariableMap = createEnvVariableMap(compiledNodes, runtimePlans, options.moltnet);
+    const projectedWorldTokenEnvNames = [...new Set(runtimePlans.flatMap((runtimePlan) => runtimePlan.worldTokenEnvNames ?? []))].sort();
+    const worldTokenEnvNames = (options.worldBindings?.artifact.bindings ?? [])
+        .map((binding) => binding.token_env)
+        .sort();
+    const recipeEnvNames = new Set(runtimePlans.flatMap((runtimePlan) => Object.keys(runtimePlan.recipeEnv ?? {})));
+    const moltnetSecretEnvNames = new Set((options.moltnet?.serverPlans ?? []).flatMap((serverPlan) => serverPlan.secretPatches.map((patch) => patch.envName)));
+    for (const name of worldTokenEnvNames) {
+        if (envVariableMap.has(name) || recipeEnvNames.has(name) || moltnetSecretEnvNames.has(name)) {
+            throw new SpawnfileError("validation_error", `World token env ${name} conflicts with an existing environment authority`);
+        }
     }
-    return plan.server.auth.tokens?.find((token) => token.id === client.token_id)?.secret;
-};
-const createMoltnetSummary = (moltnet) => {
-    if (!moltnet) {
-        return undefined;
+    for (const name of projectedWorldTokenEnvNames) {
+        envVariableMap.set(name, {
+            categories: ["runtime"],
+            description: "World bearer token for a native runtime projection",
+            generated: false,
+            name,
+            required: true
+        });
     }
-    return {
-        node_plans: moltnet.nodePlans.map((plan) => ({
-            config_path: plan.configPath,
-            network_id: plan.networkId
-        })),
-        server_plans: moltnet.serverPlans.map((plan) => {
-            const operatorTokenSecret = resolveMoltnetOperatorTokenSecret(plan);
-            return {
-                auth_mode: plan.server.auth.mode,
-                base_url: plan.baseUrl,
-                ...(plan.configPath ? { config_path: plan.configPath } : {}),
-                ...(plan.server.mode === "managed"
-                    ? { direct_messages: plan.server.direct_messages }
-                    : {}),
-                id: plan.id,
-                mode: plan.mode,
-                network_id: plan.networkId,
-                ...(operatorTokenSecret ? { operator_token_secret: operatorTokenSecret } : {}),
-                ...(plan.port ? { port: plan.port } : {}),
-                ...(plan.server.auth.public_read !== undefined
-                    ? { public_read: plan.server.auth.public_read }
-                    : {}),
-                rooms: plan.rooms.map((room) => ({
-                    id: room.id,
-                    members: [...room.members],
-                    ...(room.visibility ? { visibility: room.visibility } : {}),
-                    ...(room.write_policy ? { write_policy: room.write_policy } : {})
-                })),
-                ...(plan.server.mode === "managed"
-                    ? { store_kind: plan.server.store.kind }
-                    : {})
-            };
-        })
-    };
-};
-export const createContainerArtifacts = async (plan, compiledNodes, options = {}) => {
-    const runtimePlans = await createRuntimeTargetPlans(plan, compiledNodes);
-    const envVariables = [...createEnvVariableMap(compiledNodes, runtimePlans).values()].sort((left, right) => left.name.localeCompare(right.name));
+    const envVariables = [...envVariableMap.values()].sort((left, right) => left.name.localeCompare(right.name));
     const requiredSecrets = envVariables
         .filter((variable) => variable.required)
         .map((variable) => variable.name)
@@ -116,14 +45,50 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         .filter((variable) => variable.required && variable.categories.includes("runtime"))
         .map((variable) => variable.name)
         .sort();
-    const persistentMounts = (options.moltnet?.persistentMounts ?? [])
-        .map((mount) => ({
-        id: mount.id,
-        mount_path: mount.mountPath,
-        reason: mount.reason,
-        volume_name: mount.volumeName
-    }))
-        .sort((left, right) => left.id.localeCompare(right.id));
+    const memoryArtifacts = createMemoryArtifactBundle(plan);
+    const persistentMountsById = new Map();
+    for (const mount of memoryArtifacts.mounts) {
+        const existing = persistentMountsById.get(mount.id);
+        if (existing) {
+            if (existing.mount_path !== mount.mount_path || existing.volume_name !== mount.volume_name) {
+                throw new Error(`Container persistent mount ${mount.id} resolves to conflicting targets`);
+            }
+            continue;
+        }
+        persistentMountsById.set(mount.id, {
+            mount_path: mount.mount_path,
+            reason: mount.reason,
+            volume_name: mount.volume_name
+        });
+    }
+    const persistentMounts = [
+        ...memoryArtifacts.mounts,
+        ...daimonTelemetryArtifacts.mounts,
+        ...((options.moltnet?.persistentMounts ?? []).map((mount) => ({
+            id: mount.id,
+            mount_path: mount.mountPath,
+            reason: mount.reason,
+            volume_name: mount.volumeName
+        })))
+    ]
+        .sort((left, right) => left.id.localeCompare(right.id))
+        .filter((mount) => {
+        const existing = persistentMountsById.get(mount.id);
+        if (existing) {
+            if (existing.mount_path === mount.mount_path &&
+                existing.volume_name === mount.volume_name &&
+                existing.reason === mount.reason) {
+                return true;
+            }
+            throw new Error(`Container persistent mount ${mount.id} resolves to conflicting targets`);
+        }
+        persistentMountsById.set(mount.id, {
+            mount_path: mount.mount_path,
+            reason: mount.reason,
+            volume_name: mount.volume_name
+        });
+        return true;
+    });
     const runtimeInternalPorts = runtimePlans.flatMap((plan) => plan.port ? [plan.port] : []);
     const internalPorts = [...new Set([...runtimeInternalPorts, ...(options.moltnet?.ports ?? [])])].sort((left, right) => left - right);
     const runtimePublishedPorts = runtimePlans.flatMap((plan) => plan.publishedPort ? [plan.publishedPort] : []);
@@ -140,18 +105,25 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         ...new Set(runtimePlans.flatMap((plan) => (plan.instancePaths.homePath ? [plan.instancePaths.homePath] : [])))
     ].sort();
     const runtimeInstances = runtimePlans
-        .map((plan) => ({
-        config_path: plan.instancePaths.configPath,
-        home_path: plan.instancePaths.homePath ?? null,
-        id: plan.id,
-        internal_port: plan.port ?? null,
-        model_auth_methods: plan.modelAuthMethods,
-        model_secrets_required: plan.modelSecretsRequired,
-        node_ids: [...(plan.sourceIds ?? [])],
-        published_port: plan.publishedPort ?? null,
-        runtime: plan.runtimeName,
-        workspace_path: plan.instancePaths.workspacePath
-    }))
+        .map((plan) => {
+        const telemetryMountIds = daimonTelemetryArtifacts.telemetryMountIdsByInstance.get(plan.id);
+        return {
+            config_path: plan.instancePaths.configPath,
+            home_path: plan.instancePaths.homePath ?? null,
+            id: plan.id,
+            internal_port: plan.port ?? null,
+            model_auth_methods: plan.modelAuthMethods,
+            model_secrets_required: plan.modelSecretsRequired,
+            ...(plan.engineByNodeId && Object.keys(plan.engineByNodeId).length > 0
+                ? { engine_by_node_id: plan.engineByNodeId }
+                : {}),
+            node_ids: [...(plan.sourceIds ?? [])],
+            published_port: plan.publishedPort ?? null,
+            runtime: plan.runtimeName,
+            ...(telemetryMountIds ? { telemetry_mount_ids: telemetryMountIds } : {}),
+            workspace_path: plan.instancePaths.workspacePath
+        };
+    })
         .sort((left, right) => left.id.localeCompare(right.id));
     const runtimesInstalled = [...new Set(runtimePlans.map((plan) => plan.runtimeName))].sort();
     const workspaceResources = [
@@ -168,7 +140,7 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             }
         ]))).values()
     ].sort((left, right) => left.link_path.localeCompare(right.link_path) || left.id.localeCompare(right.id));
-    const moltnetSummary = createMoltnetSummary(options.moltnet);
+    const moltnetSummary = createMoltnetSummary(options.moltnet, options.moltnetRelease);
     const organization = createOrganizationSummary(plan, compiledNodes);
     const projectSlug = normalizeProjectLabelSlug(organization.project);
     const mergedModelAuthMethods = Object.assign({}, ...runtimePlans.map((runtimePlan) => runtimePlan.modelAuthMethods));
@@ -182,6 +154,13 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             }
         ])).values()
     ];
+    const worldBindingsEvidence = options.worldBindings
+        ? {
+            artifact_path: WORLD_BINDINGS_IMAGE_PATH,
+            digest: `sha256:${createHash("sha256").update(options.worldBindings.canonicalBytes).digest("hex")}`,
+            schema: SIMFILE_WORLD_BINDINGS_VERSION
+        }
+        : undefined;
     const distributionReport = buildDistributionReport({
         envVariables: envVariables.map((variable) => ({
             categories: variable.categories,
@@ -210,12 +189,16 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             mount: resource.mount,
             sharing: resource.sharing
         })),
-        runtimeInstances
+        runtimeInstances,
+        ...(worldBindingsEvidence ? { worldBindings: worldBindingsEvidence } : {})
     });
     const distributionLabels = createDistributionImageLabels(projectSlug, distributionReport.compile_fingerprint);
     const files = [
         ...createRootfsFiles(runtimePlans),
         ...(options.moltnet?.files ?? []),
+        ...(options.worldBindings
+            ? [{ content: options.worldBindings.canonicalBytes, mode: 0o600, path: WORLD_BINDINGS_OUTPUT_FILE }]
+            : []),
         {
             content: `${JSON.stringify(distributionReport, null, 2)}\n`,
             path: DISTRIBUTION_REPORT_OUTPUT_FILE
@@ -224,12 +207,24 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             content: await renderDockerfile(runtimePlans, {
                 distribution: {
                     labels: distributionLabels,
-                    reportOutputFile: DISTRIBUTION_REPORT_OUTPUT_FILE
+                    reportOutputFile: DISTRIBUTION_REPORT_OUTPUT_FILE,
+                    ...(options.worldBindings
+                        ? { worldBindingsOutputFile: WORLD_BINDINGS_OUTPUT_FILE }
+                        : {})
                 },
                 hasMoltnet: Boolean(options.moltnet),
                 hasStagedMoltnetBinaries: options.hasStagedMoltnetBinaries,
+                ...(options.moltnet
+                    ? {
+                        moltnet: {
+                            nodePlans: options.moltnet.nodePlans,
+                            serverPlans: options.moltnet.serverPlans
+                        }
+                    }
+                    : {}),
                 moltnetPublishedPorts: options.moltnet?.publishedPorts ?? [],
-                persistentMountPaths: persistentMounts.map((mount) => mount.mount_path)
+                persistentMountPaths: persistentMounts.map((mount) => mount.mount_path),
+                runtimePackageOverrides: options.runtimePackageOverrides
             }),
             path: "Dockerfile"
         },
@@ -237,6 +232,7 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             content: renderEntrypoint(runtimePlans, requiredSecrets.filter((secretName) => !modelSecretsRequired.includes(secretName)), {
                 moltnet: options.moltnet
                     ? {
+                        externalParticipantArtifacts: options.moltnet.externalParticipantArtifacts ?? [],
                         nodePlans: options.moltnet.nodePlans,
                         serverPlans: options.moltnet.serverPlans
                     }
@@ -247,6 +243,10 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         {
             content: renderEnvExample(envVariables),
             path: ".env.example"
+        },
+        {
+            content: createDockerIgnoreContent(),
+            path: ".dockerignore"
         }
     ];
     return {
@@ -280,6 +280,7 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             runtime_secrets_required: runtimeSecretsRequired,
             runtimes_installed: runtimesInstalled,
             secrets_required: requiredSecrets,
+            ...(memoryArtifacts.memories.length > 0 ? { memory: memoryArtifacts.memories } : {}),
             ...(persistentMounts.length > 0 ? { persistent_mounts: persistentMounts } : {}),
             ...(workspaceResources.length > 0 ? { workspace_resources: workspaceResources } : {})
         }

package/dist/compiler/containerArtifactsPlans.d.ts

@@ -1,4 +1,6 @@
-import type { CompilePlan } from "./types.js";
 import type { CompiledNodeArtifact, ContainerEnvVariable, RuntimeTargetPlan } from "./containerArtifactsTypes.js";
-export declare const createEnvVariableMap: (compiledNodes: CompiledNodeArtifact[], runtimePlans: RuntimeTargetPlan[]) => Map<string, ContainerEnvVariable>;
-export declare const createRuntimeTargetPlans: (plan: CompilePlan, compiledNodes: CompiledNodeArtifact[]) => Promise<RuntimeTargetPlan[]>;
+import type { MoltnetArtifacts } from "./moltnetArtifacts.js";
+import type { CompilePlan } from "./types.js";
+import { type ResolvedWorldBindings } from "./worldBindings.js";
+export declare const createEnvVariableMap: (compiledNodes: CompiledNodeArtifact[], runtimePlans: RuntimeTargetPlan[], moltnet?: MoltnetArtifacts | null) => Map<string, ContainerEnvVariable>;
+export declare const createRuntimeTargetPlans: (plan: CompilePlan, compiledNodes: CompiledNodeArtifact[], worldBindings?: ResolvedWorldBindings) => Promise<RuntimeTargetPlan[]>;

package/dist/compiler/containerArtifactsPlans.js

@@ -1,69 +1,10 @@
-import path from "node:path";
 import { createRuntimeInstallRecipe, getRuntimeAdapter } from "../runtime/index.js";
-import { SpawnfileError } from "../shared/index.js";
 import { listAgentSurfaceSecretNames } from "./agentSurfaces.js";
-import { listExecutionModelSecretNames, resolveExecutionModelAuthMethods } from "./modelEnv.js";
 import { resolveTargetResources } from "./containerTargetResources.js";
-const CONFIG_FILE_PLACEHOLDER = "<config-file>";
-const INSTANCE_ROOT_PLACEHOLDER = "<instance-root>";
-const createDefaultTargets = (inputs) => inputs.map((input) => ({
-    files: input.emittedFiles,
-    id: `${input.kind}-${input.slug}`,
-    sourceIds: [input.id]
-}));
-const resolveTargetEnvFiles = (configPath, target) => (target.envFiles ?? []).map((binding) => ({
-    envName: binding.envName,
-    filePath: path.posix.join(path.posix.dirname(configPath), binding.relativePath)
-}));
-const resolveTargetConfigEnvBindings = (meta, target) => [...(meta.configEnvBindings ?? []), ...(target.configEnvBindings ?? [])];
-const assertTargetHasConfig = (runtimeName, targetId, meta, files) => {
-    if (!files.some((file) => file.path === meta.configFileName)) {
-        throw new SpawnfileError("runtime_error", `Container target ${targetId} for ${runtimeName} is missing ${meta.configFileName}`);
-    }
-};
-const createPackageIdentity = (pkg) => `${pkg.manager}\u0000${pkg.name}\u0000${pkg.version ?? ""}\u0000${pkg.scope ?? ""}`;
-const createPackageConflictIdentity = (pkg) => `${pkg.manager}\u0000${pkg.name}`;
-const createPackageLabel = (pkg) => `${pkg.manager} package ${pkg.name}`;
-const resolveTargetPackages = (target, inputs) => {
-    const sourceIds = new Set(target.sourceIds ?? []);
-    if (sourceIds.size === 0) {
-        return [];
-    }
-    const byIdentity = new Map();
-    for (const input of inputs) {
-        if (!sourceIds.has(input.id) || input.value.kind !== "agent") {
-            continue;
-        }
-        const candidatePackages = input.value.packages ?? [];
-        for (const currentPackage of candidatePackages) {
-            const conflictIdentity = createPackageConflictIdentity(currentPackage);
-            const existingPackage = byIdentity.get(conflictIdentity);
-            if (!existingPackage) {
-                byIdentity.set(conflictIdentity, currentPackage);
-                continue;
-            }
-            if (createPackageIdentity(existingPackage) !== createPackageIdentity(currentPackage)) {
-                throw new SpawnfileError("validation_error", `Container target ${target.id} declares conflicting package definitions for ${createPackageLabel(currentPackage)}`);
-            }
-        }
-    }
-    return [...byIdentity.values()].sort((left, right) => createPackageIdentity(left).localeCompare(createPackageIdentity(right)));
-};
-const replaceContainerPathTemplate = (template, instanceRoot, configFileName) => template
-    .replaceAll(INSTANCE_ROOT_PLACEHOLDER, instanceRoot)
-    .replaceAll(CONFIG_FILE_PLACEHOLDER, configFileName);
-const resolveInstancePaths = (runtimeName, targetId, meta) => {
-    const instanceRoot = `/var/lib/spawnfile/instances/${runtimeName}/${targetId}`;
-    return {
-        configPath: replaceContainerPathTemplate(meta.instancePaths.configPathTemplate, instanceRoot, meta.configFileName),
-        homePath: meta.instancePaths.homePathTemplate
-            ? replaceContainerPathTemplate(meta.instancePaths.homePathTemplate, instanceRoot, meta.configFileName)
-            : undefined,
-        instanceRoot,
-        workspacePath: replaceContainerPathTemplate(meta.instancePaths.workspacePathTemplate, instanceRoot, meta.configFileName)
-    };
-};
-export const createEnvVariableMap = (compiledNodes, runtimePlans) => {
+import { assertTargetHasConfig, createDefaultTargets, resolveInstancePaths, resolveTargetConfigEnvBindings, resolveTargetEnvFiles, resolveTargetExposure, resolveTargetModelAuthMethods, resolveTargetModelSecrets, resolveTargetPackages } from "./containerTargetPlanResolution.js";
+import { listExecutionModelSecretNames } from "./modelEnv.js";
+import { findWorldBindingForNode } from "./worldBindings.js";
+export const createEnvVariableMap = (compiledNodes, runtimePlans, moltnet) => {
     const variables = new Map();
     const register = (name, required, description, category, generated = false) => {
         const current = variables.get(name);
@@ -89,9 +30,8 @@ export const createEnvVariableMap = (compiledNodes, runtimePlans) => {
     };
     for (const node of compiledNodes) {
         if (node.value.kind === "agent") {
-            for (const secret of node.value.secrets) {
+            for (const secret of node.value.secrets)
                 registerSecret(secret);
-            }
             for (const secretName of listExecutionModelSecretNames(node.value.execution)) {
                 register(secretName, true, `Model provider auth for ${secretName}`, "model");
             }
@@ -100,9 +40,8 @@ export const createEnvVariableMap = (compiledNodes, runtimePlans) => {
             }
             continue;
         }
-        for (const secret of node.value.shared.secrets) {
+        for (const secret of node.value.shared.secrets)
             registerSecret(secret);
-        }
     }
     for (const runtimePlan of runtimePlans) {
         for (const variable of runtimePlan.meta.env ?? []) {
@@ -112,52 +51,14 @@ export const createEnvVariableMap = (compiledNodes, runtimePlans) => {
             register(binding.envName, true, `Injected into ${runtimePlan.runtimeName} runtime config`, "runtime", binding.generated ?? false);
         }
     }
-    return variables;
-};
-const resolveTargetModelSecrets = (target, inputs) => {
-    const sourceIds = new Set(target.sourceIds ?? []);
-    if (sourceIds.size === 0) {
-        return [];
-    }
-    const secretNames = new Set();
-    for (const input of inputs) {
-        if (!sourceIds.has(input.id) || input.value.kind !== "agent") {
-            continue;
-        }
-        for (const secretName of listExecutionModelSecretNames(input.value.execution)) {
-            secretNames.add(secretName);
-        }
-    }
-    return [...secretNames].sort();
-};
-const resolveTargetModelAuthMethods = (target, inputs) => {
-    const sourceIds = new Set(target.sourceIds ?? []);
-    if (sourceIds.size === 0) {
-        return {};
-    }
-    const methods = new Map();
-    for (const input of inputs) {
-        if (!sourceIds.has(input.id) || input.value.kind !== "agent") {
-            continue;
-        }
-        for (const [provider, method] of Object.entries(resolveExecutionModelAuthMethods(input.value.execution))) {
-            const existingMethod = methods.get(provider);
-            if (existingMethod && existingMethod !== method) {
-                throw new SpawnfileError("validation_error", `Container target ${target.id} declares conflicting auth methods for provider ${provider}`);
-            }
-            methods.set(provider, method);
+    for (const serverPlan of moltnet?.serverPlans ?? []) {
+        for (const patch of serverPlan.secretPatches) {
+            register(patch.envName, true, `Managed Moltnet secret for ${serverPlan.networkId}`, "surface");
         }
     }
-    return Object.fromEntries([...methods.entries()].sort(([left], [right]) => left.localeCompare(right)));
-};
-const resolveTargetExposure = (target, inputs) => {
-    const sourceIds = new Set(target.sourceIds ?? []);
-    if (sourceIds.size === 0) {
-        return false;
-    }
-    return inputs.some((input) => sourceIds.has(input.id) && input.value.kind === "agent" && input.value.expose === true);
+    return variables;
 };
-export const createRuntimeTargetPlans = async (plan, compiledNodes) => {
+export const createRuntimeTargetPlans = async (plan, compiledNodes, worldBindings) => {
     const runtimeNames = Object.keys(plan.runtimes).sort();
     const runtimePlans = [];
     for (const runtimeName of runtimeNames) {
@@ -165,13 +66,20 @@ export const createRuntimeTargetPlans = async (plan, compiledNodes) => {
         const recipe = await createRuntimeInstallRecipe(runtimeName);
         const targetInputs = compiledNodes
             .filter((node) => node.runtimeName === runtimeName && node.emittedFiles.length > 0)
-            .map((node) => ({
-            emittedFiles: node.emittedFiles,
-            id: node.id ?? `${node.kind}:${node.slug}`,
-            kind: node.kind,
-            slug: node.slug,
-            value: node.value
-        }));
+            .map((node) => {
+            const id = node.id ?? `${node.kind}:${node.slug}`;
+            const worldBinding = node.kind === "agent"
+                ? findWorldBindingForNode(worldBindings, id)
+                : undefined;
+            return {
+                emittedFiles: node.emittedFiles,
+                id,
+                kind: node.kind,
+                slug: node.slug,
+                value: node.value,
+                ...(worldBinding ? { worldBinding } : {})
+            };
+        });
         const targets = (await adapter.createContainerTargets?.(targetInputs)) ??
             createDefaultTargets(targetInputs);
         targets.forEach((target, index) => {
@@ -180,6 +88,7 @@ export const createRuntimeTargetPlans = async (plan, compiledNodes) => {
             const portStride = adapter.container.portStride ?? 1;
             runtimePlans.push({
                 configEnvBindings: resolveTargetConfigEnvBindings(adapter.container, target) ?? [],
+                ...(target.engineByNodeId ? { engineByNodeId: target.engineByNodeId } : {}),
                 envFiles: resolveTargetEnvFiles(instancePaths.configPath, target),
                 packages: resolveTargetPackages(target, targetInputs),
                 id: target.id,
@@ -191,12 +100,16 @@ export const createRuntimeTargetPlans = async (plan, compiledNodes) => {
                 publishedPort: resolveTargetExposure(target, targetInputs) && adapter.container.port
                     ? adapter.container.port + (index * portStride)
                     : undefined,
+                recipeEnv: recipe.env,
                 resources: resolveTargetResources(target, targetInputs, instancePaths, adapter.container),
                 runtimeName,
                 runtimeRoot: recipe.runtimeRoot,
                 sourceIds: [...(target.sourceIds ?? [])].sort(),
                 targetConfigEnvBindings: target.configEnvBindings,
-                targetFiles: target.files
+                targetFiles: target.files,
+                ...(target.worldTokenEnvNames
+                    ? { worldTokenEnvNames: target.worldTokenEnvNames }
+                    : {})
             });
         });
     }

package/dist/compiler/containerArtifactsRender.d.ts

@@ -1,4 +1,4 @@
-import type { EmittedFile } from "../runtime/index.js";
+import type { EmittedFile, RuntimeContainerPackageOverrides } from "../runtime/index.js";
 import type { ContainerEnvVariable, RuntimeTargetPlan } from "./containerArtifactsTypes.js";
 import type { EntrypointOptions } from "./containerEntrypointRender.js";
 export { renderEntrypoint } from "./containerEntrypointRender.js";
@@ -7,8 +7,10 @@ export declare const renderEnvExample: (variables: ContainerEnvVariable[]) => st
 export interface DockerfileDistributionOptions {
     labels: Record<string, string>;
     reportOutputFile: string;
+    worldBindingsOutputFile?: string;
 }
 export declare const renderDockerfile: (runtimePlans: RuntimeTargetPlan[], options?: EntrypointOptions & {
     distribution?: DockerfileDistributionOptions;
+    runtimePackageOverrides?: RuntimeContainerPackageOverrides;
 }) => Promise<string>;
 export declare const createRootfsFiles: (runtimePlans: RuntimeTargetPlan[]) => EmittedFile[];