spawnfile 0.1.12 → 0.1.14

package/dist/compiler/moltnetExternalParticipantArtifact.d.ts

@@ -0,0 +1,38 @@
+import type { ResolvedExternalParticipant } from "./organizationIdentity.js";
+import type { EmittedFile } from "../runtime/index.js";
+import type { MoltnetExternalParticipantIntent } from "./types.js";
+export declare const MOLTNET_EXTERNAL_PARTICIPANT_ARTIFACT_VERSION: "spawnfile.moltnet-external-participant.v1";
+export interface MoltnetExternalParticipantArtifactV1 {
+    readonly version: typeof MOLTNET_EXTERNAL_PARTICIPANT_ARTIFACT_VERSION;
+    readonly participant: {
+        readonly authored_key: string;
+        readonly kind: "service";
+        readonly member_id: string;
+        readonly principal_id: string;
+    };
+    readonly network: {
+        readonly id: string;
+    };
+    readonly auth: {
+        readonly mode: "bearer";
+        readonly token_id: string;
+        readonly token_env: string;
+    };
+    readonly direct_messages: readonly {
+        readonly members: readonly [string, string];
+    }[];
+}
+export interface BuildMoltnetExternalParticipantArtifactInput {
+    readonly participant: ResolvedExternalParticipant;
+    readonly networkId: string;
+    readonly tokenId: string;
+    readonly tokenEnv: string;
+    readonly directMessagePeers: readonly string[];
+}
+export declare const buildMoltnetExternalParticipantArtifact: (input: BuildMoltnetExternalParticipantArtifactInput) => MoltnetExternalParticipantArtifactV1;
+export declare const parseMoltnetExternalParticipantArtifact: (raw: unknown) => MoltnetExternalParticipantArtifactV1;
+export declare const renderMoltnetExternalParticipantArtifact: (artifact: MoltnetExternalParticipantArtifactV1) => string;
+export declare const createMoltnetExternalParticipantArtifactFiles: (intents: readonly MoltnetExternalParticipantIntent[]) => {
+    artifacts: MoltnetExternalParticipantArtifactV1[];
+    files: EmittedFile[];
+};

package/dist/compiler/moltnetExternalParticipantArtifact.js

@@ -0,0 +1,188 @@
+import { types as nodeTypes } from "node:util";
+import { SpawnfileError } from "../shared/index.js";
+import { createMoltnetExternalParticipantArtifactPath } from "./moltnetArtifactPaths.js";
+export const MOLTNET_EXTERNAL_PARTICIPANT_ARTIFACT_VERSION = "spawnfile.moltnet-external-participant.v1";
+const idPattern = /^[a-z][a-z0-9-]{0,62}(?:\.[a-z][a-z0-9-]{0,62}){0,7}$/u;
+const segmentPattern = /^[a-z][a-z0-9-]{0,62}$/u;
+const envPattern = /^[A-Z_][A-Z0-9_]{0,127}$/u;
+const MAX_HOSTILE_DEPTH = 16;
+const MAX_HOSTILE_NODES = 512;
+const isCanonicalMemberId = (value) => idPattern.test(value) && Buffer.byteLength(value, "ascii") <= 255;
+const fail = (message) => { throw new SpawnfileError("validation_error", `invalid Moltnet external participant artifact: ${message}`); };
+const isCanonicalArray = (value) => Array.isArray(value) && Object.getPrototypeOf(value) === Array.prototype;
+const requireCanonicalArray = (value, label) => {
+    if (value && typeof value === "object" && nodeTypes.isProxy(value))
+        fail(`${label} proxy`);
+    if (!isCanonicalArray(value))
+        return fail(`${label} array prototype`);
+    const array = value;
+    if (array.length > 128)
+        fail(`${label} cardinality exceeds 128`);
+    return array;
+};
+const keys = (value, expected) => {
+    if (Object.getPrototypeOf(value) !== Object.prototype)
+        fail("object prototype");
+    if (Object.getOwnPropertySymbols(value).length > 0)
+        fail("symbol property");
+    const actual = Object.getOwnPropertyNames(value).filter((key) => key !== "length");
+    if (actual.length !== expected.length || Object.keys(value).length !== expected.length || actual.some((key, index) => key !== expected[index]))
+        fail(`keys must be ${expected.join(",")}`);
+    for (const key of actual) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!descriptor || !("value" in descriptor) || descriptor.enumerable !== true)
+            fail("accessor or non-enumerable property");
+    }
+};
+const stringValue = (value, label, pattern = idPattern) => {
+    if (typeof value !== "string" || !pattern.test(value) || value.length > 255)
+        fail(`${label} value`);
+    return value;
+};
+const freezeCopy = (value, seen = new WeakSet()) => {
+    if (!value || typeof value !== "object")
+        return value;
+    if (seen.has(value))
+        fail("alias or cycle");
+    seen.add(value);
+    for (const child of Object.values(value))
+        freezeCopy(child, seen);
+    return Object.freeze(value);
+};
+const rejectAliases = (value, state = { nodes: 0, seen: new WeakSet() }, depth = 0) => {
+    if (!value || typeof value !== "object")
+        return;
+    if (nodeTypes.isProxy(value))
+        fail("proxy");
+    if (depth > MAX_HOSTILE_DEPTH)
+        fail("object depth exceeds 16");
+    state.nodes += 1;
+    if (state.nodes > MAX_HOSTILE_NODES)
+        fail("object node count exceeds 512");
+    if (state.seen.has(value))
+        fail("alias or cycle");
+    state.seen.add(value);
+    if (Array.isArray(value)) {
+        requireCanonicalArray(value, "array");
+        if (Object.getOwnPropertySymbols(value).length > 0 || Object.getOwnPropertyNames(value).some((key) => key !== "length" && !/^\d+$/u.test(key)))
+            fail("extended array");
+        for (let index = 0; index < value.length; index += 1) {
+            if (!Object.hasOwn(value, index))
+                fail("sparse array");
+            const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+            if (!descriptor || !("value" in descriptor) || descriptor.enumerable !== true)
+                fail("accessor or non-enumerable property");
+            rejectAliases(value[index], state, depth + 1);
+        }
+    }
+    else {
+        const ownNames = Object.getOwnPropertyNames(value);
+        if (ownNames.length > MAX_HOSTILE_NODES)
+            fail("object property count exceeds 512");
+        for (const key of ownNames) {
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            if (!descriptor) {
+                fail("missing property descriptor");
+                return;
+            }
+            if (!("value" in descriptor)) {
+                fail("accessor property");
+                return;
+            }
+            const child = descriptor.value;
+            rejectAliases(child, state, depth + 1);
+        }
+    }
+};
+export const buildMoltnetExternalParticipantArtifact = (input) => {
+    const { participant, networkId, tokenId, tokenEnv, directMessagePeers } = input;
+    if (participant.kind !== "service" || !segmentPattern.test(participant.authoredParticipantKey) || participant.principalId !== `system:${participant.memberId}`)
+        fail("participant identity");
+    rejectAliases(directMessagePeers);
+    const peers = [...directMessagePeers];
+    if (peers.length === 0 || peers.length > 128 || new Set(peers).size !== peers.length)
+        fail("direct-message peer cardinality");
+    if (peers.some((peer) => !isCanonicalMemberId(peer) || peer === participant.memberId))
+        fail("direct-message peer identity");
+    const members = peers.sort().map((peer) => [peer, participant.memberId].sort());
+    const artifact = {
+        version: MOLTNET_EXTERNAL_PARTICIPANT_ARTIFACT_VERSION,
+        participant: { authored_key: participant.authoredParticipantKey, kind: "service", member_id: participant.memberId, principal_id: participant.principalId },
+        network: { id: stringValue(networkId, "network id", segmentPattern) },
+        auth: { mode: "bearer", token_id: stringValue(tokenId, "token id"), token_env: stringValue(tokenEnv, "token env", envPattern) },
+        direct_messages: members.map((members) => ({ members }))
+    };
+    return parseMoltnetExternalParticipantArtifact(artifact);
+};
+export const parseMoltnetExternalParticipantArtifact = (raw) => {
+    rejectAliases(raw);
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        fail("root object");
+    const value = raw;
+    keys(value, ["version", "participant", "network", "auth", "direct_messages"]);
+    if (value.version !== MOLTNET_EXTERNAL_PARTICIPANT_ARTIFACT_VERSION)
+        fail("version");
+    const participant = value.participant;
+    const network = value.network;
+    const auth = value.auth;
+    if (!participant || typeof participant !== "object" || Array.isArray(participant))
+        fail("participant object");
+    if (!network || typeof network !== "object" || Array.isArray(network))
+        fail("network object");
+    if (!auth || typeof auth !== "object" || Array.isArray(auth))
+        fail("auth object");
+    keys(participant, ["authored_key", "kind", "member_id", "principal_id"]);
+    keys(network, ["id"]);
+    keys(auth, ["mode", "token_id", "token_env"]);
+    const member = stringValue(participant.member_id, "member id");
+    const authoredKey = stringValue(participant.authored_key, "authored key", segmentPattern);
+    if (participant.kind !== "service" || participant.principal_id !== `system:${member}` || authoredKey !== member)
+        fail("participant");
+    if (auth.mode !== "bearer")
+        fail("auth mode");
+    const messages = value.direct_messages;
+    const directMessages = requireCanonicalArray(messages, "direct messages");
+    if (directMessages.length === 0 || directMessages.length > 128 || directMessages.some((entry) => !entry || typeof entry !== "object" || Array.isArray(entry)))
+        fail("direct message cardinality");
+    const parsed = directMessages.map((entry) => {
+        const item = entry;
+        keys(item, ["members"]);
+        const members = requireCanonicalArray(item.members, "members");
+        if (members.length !== 2 || members.some((member) => typeof member !== "string"))
+            fail("members");
+        const pair = members;
+        if (!pair.every((entry) => isCanonicalMemberId(entry)) || pair[0] >= pair[1] || !pair.includes(member) || pair[0] === pair[1])
+            fail("member ordering");
+        return { members: [pair[0], pair[1]] };
+    });
+    const peerFor = (pair) => pair[0] === member ? pair[1] : pair[0];
+    if (parsed.some((entry, index) => index > 0 && peerFor(entry.members) <= peerFor(parsed[index - 1].members)))
+        fail("message ordering");
+    const result = { version: value.version, participant: { authored_key: participant.authored_key, kind: "service", member_id: member, principal_id: participant.principal_id }, network: { id: stringValue(network.id, "network id", segmentPattern) }, auth: { mode: "bearer", token_id: stringValue(auth.token_id, "token id", segmentPattern), token_env: stringValue(auth.token_env, "token env", envPattern) }, direct_messages: parsed };
+    return freezeCopy(structuredClone(result));
+};
+export const renderMoltnetExternalParticipantArtifact = (artifact) => `${JSON.stringify(parseMoltnetExternalParticipantArtifact(artifact), null, 2)}\n`;
+export const createMoltnetExternalParticipantArtifactFiles = (intents) => {
+    const ordered = [...intents].sort((left, right) => byArtifactKey(left, right));
+    const keys = new Set();
+    for (const intent of ordered) {
+        const key = `${intent.networkId}\u0000${intent.participant.memberId}`;
+        if (keys.has(key))
+            fail("duplicate external participant artifact");
+        keys.add(key);
+    }
+    const artifacts = ordered.map((intent) => buildMoltnetExternalParticipantArtifact(intent));
+    return {
+        artifacts,
+        files: artifacts.map((artifact) => ({
+            content: renderMoltnetExternalParticipantArtifact(artifact),
+            mode: 0o600,
+            path: createMoltnetExternalParticipantArtifactPath(artifact.network.id, artifact.participant.member_id)
+        }))
+    };
+};
+const byArtifactKey = (left, right) => {
+    const a = `${left.networkId}\u0000${left.participant.memberId}`;
+    const b = `${right.networkId}\u0000${right.participant.memberId}`;
+    return a < b ? -1 : a > b ? 1 : 0;
+};

package/dist/compiler/moltnetNodeConfig.js

@@ -1,7 +1,7 @@
 import { resolveMoltnetClientAuth } from "./moltnetConfigLowering.js";
 import { resolveRuntimeConfig } from "./moltnetRuntimeConfig.js";
 export const createMoltnetNodeConfigContent = ({ agentNode, attachment, networkServer, nodeSlug, plan, serverPlan }) => {
-    const clientAuth = resolveMoltnetClientAuth(networkServer, attachment.network, attachment.memberId, nodeSlug);
+    const clientAuth = resolveMoltnetClientAuth(networkServer, attachment.network, attachment.memberId, nodeSlug, attachment.auth?.tokenId);
     const usesPerAttachmentOpenToken = clientAuth.mode === "open" &&
         clientAuth.staticToken !== true &&
         Boolean(clientAuth.tokenEnv || clientAuth.tokenPath);
@@ -56,7 +56,12 @@ export const createMoltnetNodeConfigContent = ({ agentNode, attachment, networkS
                         ? {
                             dms: {
                                 enabled: attachment.dms.enabled,
-                                ...(attachment.dms.wake ? { wake: attachment.dms.wake } : {})
+                                ...(attachment.dms.wake ? { wake: attachment.dms.wake } : {}),
+                                ...(attachment.dms.allowedWakeSenders !== undefined
+                                    ? {
+                                        allowed_wake_senders: [...attachment.dms.allowedWakeSenders]
+                                    }
+                                    : {})
                             }
                         }
                         : {})

package/dist/compiler/moltnetReleaseAuthority.d.ts

@@ -0,0 +1,17 @@
+export declare const MOLTNET_RELEASE_AUTHORITY_VERSION: "spawnfile.moltnet-release-authority.v1";
+export type MoltnetTargetArchitecture = "amd64" | "arm64";
+export interface TrustedMoltnetReleaseAsset {
+    readonly architecture: MoltnetTargetArchitecture;
+    readonly asset: string;
+    readonly asset_sha256: `sha256:${string}`;
+}
+export interface TrustedMoltnetReleaseAuthority {
+    readonly version: typeof MOLTNET_RELEASE_AUTHORITY_VERSION;
+    readonly release_version: string;
+    readonly source_revision: string;
+    readonly capabilities: readonly ["pi-bridge"];
+    readonly assets: readonly TrustedMoltnetReleaseAsset[];
+}
+export declare const parseTrustedMoltnetReleaseAuthority: (raw: unknown) => TrustedMoltnetReleaseAuthority;
+export declare const readTrustedMoltnetReleaseAuthority: () => Promise<TrustedMoltnetReleaseAuthority>;
+export declare const trustedMoltnetReleaseAsset: (authority: TrustedMoltnetReleaseAuthority, architecture: MoltnetTargetArchitecture) => TrustedMoltnetReleaseAsset;

package/dist/compiler/moltnetReleaseAuthority.js

@@ -0,0 +1,73 @@
+import { readFile } from "node:fs/promises";
+import { SpawnfileError } from "../shared/index.js";
+export const MOLTNET_RELEASE_AUTHORITY_VERSION = "spawnfile.moltnet-release-authority.v1";
+const SHA256 = /^sha256:[a-f0-9]{64}$/u;
+const REVISION = /^[a-f0-9]{40}$/u;
+const VERSION = /^v?\d+\.\d+\.\d+(?:-\d+-g[a-f0-9]{7,40})?$/u;
+const exactKeys = (value, keys) => Object.keys(value).sort().join("\0") === [...keys].sort().join("\0");
+const fail = () => {
+    throw new SpawnfileError("compile_error", "Trusted Moltnet release authority is invalid");
+};
+export const parseTrustedMoltnetReleaseAuthority = (raw) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return fail();
+    const value = raw;
+    if (!exactKeys(value, [
+        "assets", "capabilities", "release_version", "source_revision", "version"
+    ])
+        || value.version !== MOLTNET_RELEASE_AUTHORITY_VERSION
+        || typeof value.release_version !== "string"
+        || !VERSION.test(value.release_version)
+        || typeof value.source_revision !== "string"
+        || !REVISION.test(value.source_revision)
+        || !Array.isArray(value.capabilities)
+        || value.capabilities.length !== 1
+        || value.capabilities[0] !== "pi-bridge"
+        || !Array.isArray(value.assets)
+        || value.assets.length !== 2)
+        return fail();
+    const assets = [];
+    for (const rawAsset of value.assets) {
+        if (!rawAsset || typeof rawAsset !== "object" || Array.isArray(rawAsset))
+            return fail();
+        const asset = rawAsset;
+        if (!exactKeys(asset, ["architecture", "asset", "asset_sha256"])
+            || asset.architecture !== "amd64" && asset.architecture !== "arm64"
+            || asset.asset !== `moltnet_linux_${asset.architecture}.tar.gz`
+            || typeof asset.asset_sha256 !== "string"
+            || !SHA256.test(asset.asset_sha256))
+            return fail();
+        assets.push(Object.freeze({
+            architecture: asset.architecture,
+            asset: asset.asset,
+            asset_sha256: asset.asset_sha256
+        }));
+    }
+    if (assets[0]?.architecture !== "amd64" || assets[1]?.architecture !== "arm64")
+        return fail();
+    const describedRevision = value.release_version.match(/-g([a-f0-9]{7,40})$/u)?.[1];
+    if (describedRevision && !value.source_revision.startsWith(describedRevision))
+        return fail();
+    return Object.freeze({
+        version: MOLTNET_RELEASE_AUTHORITY_VERSION,
+        release_version: value.release_version,
+        source_revision: value.source_revision,
+        capabilities: Object.freeze(["pi-bridge"]),
+        assets: Object.freeze(assets)
+    });
+};
+export const readTrustedMoltnetReleaseAuthority = async () => {
+    try {
+        return parseTrustedMoltnetReleaseAuthority(JSON.parse(await readFile(new URL("../../moltnet-releases.json", import.meta.url), "utf8")));
+    }
+    catch (error) {
+        if (error instanceof SpawnfileError)
+            throw error;
+        return fail();
+    }
+};
+export const trustedMoltnetReleaseAsset = (authority, architecture) => {
+    const parsed = parseTrustedMoltnetReleaseAuthority(authority);
+    const asset = parsed.assets.find((candidate) => candidate.architecture === architecture);
+    return asset ?? fail();
+};

package/dist/compiler/moltnetReleaseDownload.d.ts

@@ -0,0 +1,12 @@
+import { type MoltnetTargetArchitecture, type TrustedMoltnetReleaseAuthority } from "./moltnetReleaseAuthority.js";
+type ReleaseResponse = Pick<Response, "body" | "headers" | "ok" | "status" | "statusText">;
+export interface MoltnetReleaseDownloadDependencies {
+    readonly fetchRelease?: (input: string, init: RequestInit) => Promise<ReleaseResponse>;
+}
+export interface DownloadedMoltnetReleaseAsset {
+    readonly assetPath: string;
+    readonly cleanup: () => Promise<void>;
+}
+export declare const trustedMoltnetReleaseDownloadUrl: (authority: TrustedMoltnetReleaseAuthority, architecture: MoltnetTargetArchitecture) => string;
+export declare const downloadTrustedMoltnetReleaseAsset: (authority: TrustedMoltnetReleaseAuthority, architecture: MoltnetTargetArchitecture, dependencies?: MoltnetReleaseDownloadDependencies) => Promise<DownloadedMoltnetReleaseAsset>;
+export {};

package/dist/compiler/moltnetReleaseDownload.js

@@ -0,0 +1,85 @@
+import { createHash } from "node:crypto";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { SpawnfileError } from "../shared/index.js";
+import { parseTrustedMoltnetReleaseAuthority, trustedMoltnetReleaseAsset } from "./moltnetReleaseAuthority.js";
+const MAX_RELEASE_BYTES = 64 * 1024 * 1024;
+const DOWNLOAD_TIMEOUT_MS = 120_000;
+export const trustedMoltnetReleaseDownloadUrl = (authority, architecture) => {
+    const parsed = parseTrustedMoltnetReleaseAuthority(authority);
+    const asset = trustedMoltnetReleaseAsset(parsed, architecture);
+    return `https://github.com/noopolis/moltnet/releases/download/${parsed.release_version}/${asset.asset}`;
+};
+const responseBytes = async (response) => {
+    const declaredLength = response.headers.get("content-length");
+    if (declaredLength !== null) {
+        const bytes = Number(declaredLength);
+        if (!Number.isSafeInteger(bytes) || bytes < 1 || bytes > MAX_RELEASE_BYTES) {
+            throw new SpawnfileError("compile_error", "Pinned Moltnet release has an invalid content length");
+        }
+    }
+    if (response.body === null) {
+        throw new SpawnfileError("compile_error", "Pinned Moltnet release response has no body");
+    }
+    const chunks = [];
+    let total = 0;
+    const reader = response.body.getReader();
+    try {
+        for (;;) {
+            const item = await reader.read();
+            if (item.done)
+                break;
+            total += item.value.byteLength;
+            if (total > MAX_RELEASE_BYTES) {
+                await reader.cancel();
+                throw new SpawnfileError("compile_error", "Pinned Moltnet release exceeds the download limit");
+            }
+            chunks.push(item.value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    if (total === 0)
+        throw new SpawnfileError("compile_error", "Pinned Moltnet release is empty");
+    return Buffer.concat(chunks, total);
+};
+export const downloadTrustedMoltnetReleaseAsset = async (authority, architecture, dependencies = {}) => {
+    const parsed = parseTrustedMoltnetReleaseAuthority(authority);
+    const asset = trustedMoltnetReleaseAsset(parsed, architecture);
+    const url = trustedMoltnetReleaseDownloadUrl(parsed, architecture);
+    const fetchRelease = dependencies.fetchRelease ?? fetch;
+    let response;
+    try {
+        response = await fetchRelease(url, {
+            redirect: "follow",
+            signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS)
+        });
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new SpawnfileError("compile_error", `Unable to download pinned Moltnet release: ${reason}`);
+    }
+    if (!response.ok) {
+        throw new SpawnfileError("compile_error", `Unable to download pinned Moltnet release: HTTP ${response.status} ${response.statusText}`);
+    }
+    const bytes = await responseBytes(response);
+    const sha256 = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+    if (sha256 !== asset.asset_sha256) {
+        throw new SpawnfileError("compile_error", "Downloaded Moltnet release digest does not match trusted authority");
+    }
+    const directory = await mkdtemp(path.join(os.tmpdir(), "spawnfile-moltnet-release-"));
+    try {
+        const assetPath = path.join(directory, asset.asset);
+        await writeFile(assetPath, bytes, { flag: "wx" });
+        return Object.freeze({
+            assetPath,
+            cleanup: () => rm(directory, { force: true, recursive: true })
+        });
+    }
+    catch (error) {
+        await rm(directory, { force: true, recursive: true });
+        throw error;
+    }
+};

package/dist/compiler/moltnetRepresentativeResolution.d.ts

@@ -4,6 +4,7 @@ export interface MoltnetTeamContext {
     teamName: string;
     teamSource: string;
     networks: ResolvedTeamNetwork[];
+    resolvedMemberId?: string;
 }
 export interface TeamRepresentativeResolution {
     agentSource: string;

package/dist/compiler/moltnetRepresentativeResolution.js

@@ -1,7 +1,18 @@
 import { SpawnfileError } from "../shared/index.js";
+import { resolveMoltnetClientAuth } from "./moltnetConfigLowering.js";
 const cloneAttachment = (attachment, context) => ({
-    ...(attachment.dms ? { dms: { ...attachment.dms } } : {}),
-    memberId: context.memberId,
+    ...(attachment.auth ? { auth: { ...attachment.auth } } : {}),
+    ...(attachment.dms
+        ? {
+            dms: {
+                ...attachment.dms,
+                ...(attachment.dms.allowedWakeSenders !== undefined
+                    ? { allowedWakeSenders: [...attachment.dms.allowedWakeSenders] }
+                    : {})
+            }
+        }
+        : {}),
+    memberId: context.resolvedMemberId ?? context.memberId,
     network: attachment.network,
     ...(attachment.rooms
         ? {
@@ -72,6 +83,9 @@ export const resolveMoltnetAttachments = (attachments, context, nodeName) => {
         if (!network) {
             throw new SpawnfileError("validation_error", `Agent ${nodeName} references unknown Moltnet network ${attachment.network} on team ${context.teamName}`);
         }
+        if (network.server) {
+            resolveMoltnetClientAuth(network.server, network.id, context.memberId, undefined, attachment.auth?.tokenId);
+        }
         for (const roomId of Object.keys(attachment.rooms ?? {})) {
             const room = network.rooms.find((entry) => entry.id === roomId);
             if (!room) {

package/dist/compiler/moltnetResolution.js

@@ -1,6 +1,7 @@
 import { SpawnfileError } from "../shared/index.js";
 import { resolveMoltnetRoomMemberships } from "./moltnetRoomMemberships.js";
 import { resolveMoltnetAttachments } from "./moltnetRepresentativeResolution.js";
+import { resolveCanonicalAgentMemberId } from "./organizationIdentity.js";
 export { resolveMoltnetAttachments, resolveTeamRepresentatives } from "./moltnetRepresentativeResolution.js";
 const findTeamBySource = (plan, source) => {
     const node = plan.nodes.find((entry) => entry.kind === "team" && entry.value.source === source);
@@ -25,12 +26,22 @@ const validateGlobalMemberIds = (plan) => {
         context
     ]));
     for (const context of uniqueContexts.values()) {
-        const previous = seen.get(context.memberId);
+        let memberId = context.memberId;
+        if (plan.organizationIdentity) {
+            const canonicalMemberId = resolveCanonicalAgentMemberId(plan, context.agentSource);
+            const matches = plan.organizationIdentity.agentMembers.filter((member) => member.memberId === canonicalMemberId);
+            if (!canonicalMemberId || matches.length !== 1) {
+                throw new SpawnfileError("validation_error", `Unable to resolve exactly one canonical Moltnet member id for ${context.agentSource}`);
+            }
+            memberId = canonicalMemberId;
+        }
+        const previous = seen.get(memberId);
         const label = `${context.teamName} (${context.teamSource}) member ${context.memberId}`;
-        if (previous && previous !== label) {
-            throw new SpawnfileError("validation_error", `Moltnet member_id ${context.memberId} is declared by multiple direct agent member slots: ${previous}; ${label}`);
+        if (previous &&
+            previous.agentSource !== context.agentSource) {
+            throw new SpawnfileError("validation_error", `Moltnet member_id ${memberId} is declared by multiple direct agent member slots: ${previous.label}; ${label}`);
         }
-        seen.set(context.memberId, label);
+        seen.set(memberId, { agentSource: context.agentSource, label });
     }
 };
 const getRoomMemberships = (plan) => {
@@ -41,25 +52,59 @@ const getRoomMemberships = (plan) => {
 const synthesizeRepresentativeAttachments = (memberships) => memberships
     .filter((membership) => membership.representedSlot !== undefined)
     .map((membership) => ({
-    contextRooms: {
-        [membership.declaringTeamSource]: [membership.roomId]
-    },
-    memberId: membership.concreteMemberId,
-    network: membership.networkId,
-    rooms: {
-        [membership.roomId]: {}
-    },
-    teamSource: membership.declaringTeamSource
+    agentSource: membership.agentSource,
+    directTeamSource: membership.directTeamSource,
+    attachment: {
+        contextRooms: {
+            [membership.declaringTeamSource]: [membership.roomId]
+        },
+        memberId: membership.concreteMemberId,
+        network: membership.networkId,
+        rooms: {
+            [membership.roomId]: membership.policy ? { ...membership.policy } : {}
+        },
+        teamSource: membership.declaringTeamSource
+    }
 }));
-const roomPolicyKey = (policy) => JSON.stringify(policy ?? {});
+const areEquivalentDmPolicy = (left, right) => {
+    if (left.enabled !== right.enabled || left.wake !== right.wake) {
+        return false;
+    }
+    const leftSenders = left.allowedWakeSenders;
+    const rightSenders = right.allowedWakeSenders;
+    if (leftSenders === undefined || rightSenders === undefined) {
+        return leftSenders === rightSenders;
+    }
+    if (leftSenders.length !== rightSenders.length) {
+        return false;
+    }
+    return leftSenders.every((sender, index) => sender === rightSenders[index]);
+};
+const areEquivalentRoomPolicy = (left, right) => left.wake === right.wake;
 const hasRoomPolicy = (policy) => policy.wake !== undefined;
+const cloneMoltnetDm = (dms) => ({
+    ...dms,
+    ...(dms.allowedWakeSenders !== undefined
+        ? { allowedWakeSenders: [...dms.allowedWakeSenders] }
+        : {})
+});
 const mergeAttachment = (target, next, nodeName) => {
+    if (target.auth &&
+        next.auth &&
+        target.auth.tokenId !== next.auth.tokenId) {
+        throw new SpawnfileError("validation_error", `Agent ${nodeName} declares incompatible Moltnet auth for ${next.network}/${next.memberId ?? "unknown"}`);
+    }
+    if (!target.auth && next.auth) {
+        target.auth = { ...next.auth };
+    }
     if (target.dms &&
         next.dms &&
-        roomPolicyKey(target.dms) !== roomPolicyKey(next.dms)) {
+        !areEquivalentDmPolicy(target.dms, next.dms)) {
         throw new SpawnfileError("validation_error", `Agent ${nodeName} declares incompatible Moltnet dms for ${next.network}/${next.memberId ?? "unknown"}`);
     }
-    target.dms ??= next.dms ? { ...next.dms } : undefined;
+    if (!target.dms && next.dms) {
+        target.dms = cloneMoltnetDm(next.dms);
+    }
     target.teamSource ??= next.teamSource;
     target.rooms ??= {};
     for (const [roomId, policy] of Object.entries(next.rooms ?? {})) {
@@ -68,7 +113,7 @@ const mergeAttachment = (target, next, nodeName) => {
         const nextHasPolicy = hasRoomPolicy(policy);
         if (existingHasPolicy &&
             nextHasPolicy &&
-            roomPolicyKey(existingPolicy) !== roomPolicyKey(policy)) {
+            !areEquivalentRoomPolicy(existingPolicy, policy)) {
             throw new SpawnfileError("validation_error", `Agent ${nodeName} declares incompatible Moltnet room policy for ${next.network}/${next.memberId ?? "unknown"} room ${roomId}`);
         }
         target.rooms[roomId] = existingPolicy && existingHasPolicy && !nextHasPolicy
@@ -103,6 +148,7 @@ const mergeAgentAttachments = (agentNode, attachments) => {
             continue;
         }
         merged.set(key, {
+            ...(attachment.auth ? { auth: { ...attachment.auth } } : {}),
             contextRooms: attachment.contextRooms
                 ? Object.fromEntries(Object.entries(attachment.contextRooms).map(([teamSource, roomIds]) => [
                     teamSource,
@@ -111,7 +157,7 @@ const mergeAgentAttachments = (agentNode, attachments) => {
                 : attachment.teamSource
                     ? { [attachment.teamSource]: Object.keys(attachment.rooms ?? {}).sort() }
                     : undefined,
-            ...(attachment.dms ? { dms: { ...attachment.dms } } : {}),
+            ...(attachment.dms ? { dms: cloneMoltnetDm(attachment.dms) } : {}),
             memberId: attachment.memberId,
             network: attachment.network,
             ...(attachment.rooms
@@ -132,8 +178,12 @@ export const resolvePlanMoltnetAttachments = (plan) => {
     const roomMemberships = getRoomMemberships(plan);
     const synthesizedAttachments = synthesizeRepresentativeAttachments(roomMemberships);
     const synthesizedByAgent = new Map();
-    for (const attachment of synthesizedAttachments) {
-        const representativeContext = (plan.memberships ?? []).find((context) => context.memberId === attachment.memberId);
+    for (const synthesized of synthesizedAttachments) {
+        const { agentSource, attachment, directTeamSource } = synthesized;
+        const representativeContext = (plan.memberships ?? []).find((context) => context.agentSource === agentSource &&
+            (plan.organizationIdentity
+                ? context.teamSource === directTeamSource
+                : context.memberId === attachment.memberId));
         if (!representativeContext) {
             throw new SpawnfileError("validation_error", `Unable to find direct member context for synthesized Moltnet member ${attachment.memberId ?? "unknown"}`);
         }
@@ -157,9 +207,11 @@ export const resolvePlanMoltnetAttachments = (plan) => {
                 continue;
             }
             const teamNode = findTeamBySource(plan, context.teamSource);
+            const canonicalMemberId = resolveCanonicalAgentMemberId(plan, context.agentSource) ?? context.memberId;
             const resolved = resolveMoltnetAttachments(declaredAttachments, {
                 memberId: context.memberId,
                 networks: teamNode.networks ?? [],
+                resolvedMemberId: canonicalMemberId,
                 teamName: context.teamName,
                 teamSource: context.teamSource
             }, agentNode.name);