spawnfile 0.1.13 → 0.1.14

package/dist/cli/targetWorldReadinessCommand.js

@@ -0,0 +1,43 @@
+import { createCanonicalTargetWorldReadinessReceiptBytes, verifyTargetWorldReadinessReceipt } from "../target/worldReadiness.js";
+import { formatCaughtTargetCliError } from "./targetReceiptOutput.js";
+import { readTargetWorldReadinessRequestFile } from "./targetRequestFile.js";
+export const registerTargetWorldReadinessCommand = (target, session, streams, setExitCode) => {
+    target.command("query_world_readiness")
+        .description("Query one exact running world's public readiness document")
+        .argument("<request-file>", "Strict world readiness request JSON file")
+        .action(async (requestFile) => {
+        let request;
+        try {
+            request = await readTargetWorldReadinessRequestFile(requestFile);
+        }
+        catch {
+            streams.stderr("error: Invalid world readiness request");
+            setExitCode(2);
+            return;
+        }
+        let activeSession;
+        try {
+            activeSession = typeof session === "function"
+                ? await session(target.opts().config)
+                : session;
+            if (typeof activeSession.queryWorldReadiness !== "function")
+                throw new TypeError();
+        }
+        catch {
+            streams.stderr("error: Invalid target configuration");
+            setExitCode(2);
+            return;
+        }
+        try {
+            const receipt = verifyTargetWorldReadinessReceipt({
+                receipt: await activeSession.queryWorldReadiness(request),
+                request
+            });
+            streams.stdout(createCanonicalTargetWorldReadinessReceiptBytes(receipt));
+        }
+        catch (error) {
+            streams.stderr(formatCaughtTargetCliError(error, "Target world readiness query crashed"));
+            setExitCode(1);
+        }
+    });
+};

package/dist/cli/upCommand.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "commander";
+import type { CliHandlers, CliStreams } from "./runCli.js";
+export declare const registerUpCommand: (program: Command, handlers: CliHandlers, streams: CliStreams) => void;

package/dist/cli/upCommand.js

@@ -0,0 +1,133 @@
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+import { createDeploymentInstanceDigest, readDeploymentRecord, recordLifecycleOutcomeEvidence } from "../deployment/index.js";
+import { SpawnfileError } from "../shared/index.js";
+import { requireMachineLifecycle, runMachineLifecycle } from "./lifecycleMachine.js";
+import { resolveCommandInput } from "./resolveCommandInput.js";
+import { runImageUpCommand } from "./upImageCommand.js";
+import { createUpLifecycleInvocation, createUpProjectOptions } from "./upLifecycleInvocation.js";
+import { reconcileUpLifecycle } from "./upLifecycleRecovery.js";
+const readSelectedTargetReceipt = async (file) => {
+    if (typeof file !== "string" || file.length < 1 || Buffer.byteLength(file, "utf8") > 4096) {
+        throw new SpawnfileError("validation_error", "Invalid selected target receipt");
+    }
+    let handle;
+    try {
+        handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.size < 1 || stat.size > 65_536)
+            throw new Error();
+        return JSON.parse(await handle.readFile("utf8"));
+    }
+    catch {
+        throw new SpawnfileError("validation_error", "Invalid selected target receipt");
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+};
+export const registerUpCommand = (program, handlers, streams) => {
+    program
+        .command("up")
+        .description("Deploy an organization from a project or a published image reference")
+        .argument("[path]", "Project directory, Spawnfile path, or image reference", process.cwd())
+        .option("-o, --out <directory>", "Output directory")
+        .option("-t, --tag <image>", "Docker image tag")
+        .option("--auth-profile <name>", "Local Spawnfile auth profile")
+        .option("--context <name>", "Docker context for the deployment target")
+        .option("--deployment <name>", "Detached deployment record name")
+        .option("--docker-command <command>", "Docker command")
+        .option("--name <container>", "Docker container name")
+        .option("--env-file <file>", "Path to an env file for runtime secrets")
+        .option("--world-bindings <file>", "Path to a versioned world-bindings artifact")
+        .option("--selected-target-receipt-digest <digest>", "Selected target receipt digest for an organization handoff")
+        .option("--selected-target-receipt <file>", "Selected target receipt for an organization handoff")
+        .option("--network-attachment-handle <handle>", "Opaque network attachment handle for an organization handoff")
+        .option("--organization-handoff-run-id <id>", "Authorized run id for an organization handoff")
+        .option("--descriptor-digest <digest>", "Production descriptor digest for an organization handoff")
+        .option("--image", "Interpret the argument as an image reference")
+        .option("--pull", "Pull the image before deploying")
+        .option("-d, --detach", "Run the container in detached mode")
+        .option("--json", "Render a spawnfile.up-receipt.v1 machine-readable receipt")
+        .option("--lifecycle-invocation <id>", "Durably bind this exact JSON lifecycle invocation")
+        .action(async (inputPath, options) => {
+        requireMachineLifecycle(options.lifecycleInvocation, options.json);
+        const upInput = resolveCommandInput(inputPath, { forceImage: options.image });
+        if (upInput.kind === "invalid") {
+            throw new SpawnfileError("validation_error", `Cannot resolve "${inputPath}" as a project path or image reference. ` +
+                "Pass a project directory, a Spawnfile path, or an image like 'name:tag' (use --image to force image mode).");
+        }
+        if (upInput.kind === "image") {
+            if (options.selectedTargetReceiptDigest !== undefined ||
+                options.selectedTargetReceipt !== undefined ||
+                options.networkAttachmentHandle !== undefined ||
+                options.organizationHandoffRunId !== undefined ||
+                options.descriptorDigest !== undefined) {
+                throw new SpawnfileError("validation_error", "Organization handoff inputs are only supported for project-mode deployments");
+            }
+            if (options.worldBindings !== undefined) {
+                throw new SpawnfileError("validation_error", "`--world-bindings` is only supported for project-mode deployments");
+            }
+            if (options.json) {
+                throw new SpawnfileError("validation_error", "`spawnfile up --json` is not yet supported for image-mode deployments " +
+                    "(there is no source Spawnfile to derive compiled_schedule from).");
+            }
+            await runImageUpCommand(upInput.ref, options, handlers, streams);
+            return;
+        }
+        const handoffValues = [
+            options.descriptorDigest,
+            options.organizationHandoffRunId,
+            options.selectedTargetReceipt,
+            options.selectedTargetReceiptDigest,
+            options.networkAttachmentHandle,
+            options.worldBindings
+        ];
+        if (handoffValues.some((value) => value !== undefined) &&
+            handoffValues.some((value) => value === undefined)) {
+            throw new SpawnfileError("validation_error", "Organization handoff requires --organization-handoff-run-id, --descriptor-digest, --selected-target-receipt, --selected-target-receipt-digest, --network-attachment-handle, and --world-bindings");
+        }
+        if (options.lifecycleInvocation !== undefined &&
+            (!options.detach ||
+                !options.deployment ||
+                handoffValues.some((value) => value === undefined))) {
+            throw new SpawnfileError("validation_error", "Machine lifecycle up requires a detached deployment with durable organization handoff authority");
+        }
+        if (options.json) {
+            const exactInvocation = options.lifecycleInvocation === undefined
+                ? undefined
+                : createUpLifecycleInvocation(inputPath, {
+                    ...options,
+                    forceImage: options.image,
+                    lifecycleInvocation: options.lifecycleInvocation
+                });
+            const render = async (capability) => {
+                const selectedTargetReceipt = options.selectedTargetReceipt === undefined
+                    ? undefined
+                    : await readSelectedTargetReceipt(options.selectedTargetReceipt);
+                const result = await handlers.upProject(inputPath, createUpProjectOptions({ ...options, selectedTargetReceipt }));
+                const receipt = await handlers.buildUpReceipt(inputPath, result);
+                const bytes = JSON.stringify(receipt, null, 2);
+                if (exactInvocation && capability) {
+                    await recordLifecycleOutcomeEvidence(exactInvocation, bytes, capability, result.deploymentRecordPath
+                        ? createDeploymentInstanceDigest(await readDeploymentRecord(result.deploymentRecordPath))
+                        : "");
+                }
+                return bytes;
+            };
+            const output = options.lifecycleInvocation === undefined
+                ? await render()
+                : await runMachineLifecycle(exactInvocation, render, () => reconcileUpLifecycle(inputPath, options, exactInvocation));
+            streams.stdout(output);
+            return;
+        }
+        const result = await handlers.upProject(inputPath, createUpProjectOptions(options));
+        streams.stdout(`built image ${result.imageTag}`);
+        streams.stdout(`compiled to ${result.outputDirectory}`);
+        streams.stdout(`report: ${result.reportPath}`);
+        if (options.detach) {
+            streams.stdout(`running container ${result.containerName ?? "unknown"}`);
+            streams.stdout(`image: ${result.imageTag}`);
+        }
+    });
+};

package/dist/cli/upImageCommand.d.ts

@@ -0,0 +1,11 @@
+import type { CliHandlers, CliStreams } from "./runCli.js";
+interface ImageUpOptions {
+    authProfile?: string;
+    context?: string;
+    deployment?: string;
+    dockerCommand?: string;
+    envFile?: string;
+    pull?: boolean;
+}
+export declare const runImageUpCommand: (ref: string, options: ImageUpOptions, handlers: CliHandlers, streams: CliStreams) => Promise<void>;
+export {};

package/dist/cli/upImageCommand.js

@@ -0,0 +1,41 @@
+import { readRunEnvFile } from "../compiler/runProjectAuth.js";
+const shortDigest = (digest) => digest ? digest.replace(/^sha256:/, "").slice(0, 12) : "unknown";
+const redeploySummary = (previous, newRef, newDigest) => {
+    if (previous.ref === newRef &&
+        newDigest !== null &&
+        previous.digest === newDigest) {
+        return `redeployed image ${newRef} (digest unchanged ${shortDigest(newDigest)})`;
+    }
+    return (`redeployed image: ${previous.ref} (${shortDigest(previous.digest)}) ` +
+        `→ ${newRef} (${shortDigest(newDigest)})`);
+};
+export const runImageUpCommand = async (ref, options, handlers, streams) => {
+    const authProfile = options.authProfile && handlers.requireAuthProfile
+        ? await handlers.requireAuthProfile(options.authProfile)
+        : null;
+    const envFileEnv = await readRunEnvFile(options.envFile);
+    const consumed = await handlers.consumeImageUp(ref, {
+        authProfile,
+        authProfileName: options.authProfile ?? null,
+        authValues: authProfile?.env ?? {},
+        deploymentName: options.deployment,
+        dockerCommand: options.dockerCommand,
+        dockerContext: options.context,
+        envFileEnv,
+        envFilePath: options.envFile ?? null,
+        pull: options.pull,
+    });
+    if (consumed.previous) {
+        const digest = consumed.record.source.kind === "image"
+            ? consumed.record.source.digest
+            : null;
+        streams.stdout(redeploySummary(consumed.previous, consumed.imageRef, digest));
+    }
+    else {
+        streams.stdout(`deployed image ${consumed.imageRef}`);
+    }
+    streams.stdout(`deployment: ${consumed.deploymentName}`);
+    streams.stdout(`running container ${consumed.containerName}`);
+    streams.stdout(`record: ${consumed.recordPath}`);
+    streams.stdout(`next: spawnfile status --deployment ${consumed.deploymentName} --live`);
+};

package/dist/cli/upLifecycleInvocation.d.ts

@@ -0,0 +1,41 @@
+import type { LifecycleInvocation } from "../deployment/index.js";
+export interface UpLifecycleOptions {
+    authProfile?: string;
+    context?: string;
+    deployment?: string;
+    descriptorDigest?: string;
+    detach?: boolean;
+    dockerCommand?: string;
+    envFile?: string;
+    forceImage?: boolean;
+    lifecycleInvocation?: string;
+    name?: string;
+    networkAttachmentHandle?: string;
+    organizationHandoffRunId?: string;
+    out?: string;
+    pull?: boolean;
+    selectedTargetReceipt?: unknown;
+    selectedTargetReceiptDigest?: string;
+    tag?: string;
+    worldBindings?: string;
+}
+export declare const createUpLifecycleInvocation: (inputPath: string, options: UpLifecycleOptions & {
+    lifecycleInvocation: string;
+}) => LifecycleInvocation;
+export declare const createUpProjectOptions: (options: UpLifecycleOptions) => {
+    worldBindingsPath?: string | undefined;
+    selectedTargetReceipt?: {} | null | undefined;
+    selectedTargetReceiptDigest?: string | undefined;
+    networkAttachmentHandle?: string | undefined;
+    authProfile: string | undefined;
+    containerName: string | undefined;
+    detach: boolean | undefined;
+    deploymentName: string | undefined;
+    dockerCommand: string | undefined;
+    dockerContext: string | undefined;
+    descriptorDigest: string | undefined;
+    envFilePath: string | undefined;
+    imageTag: string | undefined;
+    organizationHandoffRunId: string | undefined;
+    outputDirectory: string | undefined;
+};

package/dist/cli/upLifecycleInvocation.js

@@ -0,0 +1,48 @@
+import path from "node:path";
+import { createLifecycleInvocation, digestLifecycleBinding, } from "./lifecycleMachine.js";
+export const createUpLifecycleInvocation = (inputPath, options) => createLifecycleInvocation(options.lifecycleInvocation, "up", {
+    input_kind: "project",
+    project_path: path.resolve(inputPath),
+}, {
+    auth_profile_digest: digestLifecycleBinding(options.authProfile),
+    container_name: options.name ?? null,
+    deployment: options.deployment ?? null,
+    detach: options.detach ?? false,
+    docker_command_digest: digestLifecycleBinding(options.dockerCommand),
+    docker_context: options.context ?? null,
+    descriptor_digest: options.descriptorDigest ?? null,
+    env_file_digest: digestLifecycleBinding(options.envFile),
+    force_image: options.forceImage ?? false,
+    image_tag: options.tag ?? null,
+    network_attachment_handle_digest: digestLifecycleBinding(options.networkAttachmentHandle),
+    organization_handoff_run_id: options.organizationHandoffRunId ?? null,
+    output_directory: options.out ? path.resolve(options.out) : null,
+    pull: options.pull ?? false,
+    selected_target_receipt_digest: options.selectedTargetReceiptDigest ?? null,
+    world_bindings_digest: digestLifecycleBinding(options.worldBindings),
+});
+export const createUpProjectOptions = (options) => ({
+    authProfile: options.authProfile,
+    containerName: options.name,
+    detach: options.detach,
+    deploymentName: options.deployment,
+    dockerCommand: options.dockerCommand,
+    dockerContext: options.context,
+    descriptorDigest: options.descriptorDigest,
+    envFilePath: options.envFile,
+    imageTag: options.tag,
+    organizationHandoffRunId: options.organizationHandoffRunId,
+    outputDirectory: options.out,
+    ...(options.networkAttachmentHandle !== undefined
+        ? { networkAttachmentHandle: options.networkAttachmentHandle }
+        : {}),
+    ...(options.selectedTargetReceiptDigest !== undefined
+        ? { selectedTargetReceiptDigest: options.selectedTargetReceiptDigest }
+        : {}),
+    ...(options.selectedTargetReceipt !== undefined
+        ? { selectedTargetReceipt: options.selectedTargetReceipt }
+        : {}),
+    ...(options.worldBindings !== undefined
+        ? { worldBindingsPath: options.worldBindings }
+        : {}),
+});

package/dist/cli/upLifecycleRecovery.d.ts

@@ -0,0 +1,4 @@
+import { findLifecycleOutcomeEvidence } from "../deployment/index.js";
+import type { LifecycleReconciliation } from "./lifecycleMachine.js";
+import type { UpLifecycleOptions } from "./upLifecycleInvocation.js";
+export declare const reconcileUpLifecycle: (inputPath: string, options: UpLifecycleOptions, invocation: Parameters<typeof findLifecycleOutcomeEvidence>[0]) => Promise<LifecycleReconciliation>;

package/dist/cli/upLifecycleRecovery.js

@@ -0,0 +1,53 @@
+import path from "node:path";
+import { findLifecycleOutcomeEvidence, createDeploymentInstanceDigest, readDeploymentRecord, resolveDeploymentRecordPath, } from "../deployment/index.js";
+import { resolveProjectOutputDirectory } from "../filesystem/index.js";
+import { DEFAULT_OUTPUT_DIRECTORY, REPORT_FILENAME } from "../shared/index.js";
+import { readUtf8File } from "../filesystem/index.js";
+const ambiguous = (reason) => ({
+    reason,
+    status: "ambiguous",
+});
+const exactHandoff = (record, options) => record.organization_handoff !== undefined &&
+    record.organization_handoff_handle !== undefined &&
+    record.organization_handoff.network_attachment_handle ===
+        options.networkAttachmentHandle &&
+    record.organization_handoff.selected_target_receipt_digest ===
+        options.selectedTargetReceiptDigest;
+export const reconcileUpLifecycle = async (inputPath, options, invocation) => {
+    const outputDirectory = resolveProjectOutputDirectory(inputPath, options.out, DEFAULT_OUTPUT_DIRECTORY);
+    const deployment = options.deployment;
+    if (!deployment)
+        return ambiguous("up_deployment_not_bound");
+    const recordPath = resolveDeploymentRecordPath(outputDirectory, deployment);
+    try {
+        const record = await readDeploymentRecord(recordPath);
+        const report = JSON.parse(await readUtf8File(path.join(outputDirectory, REPORT_FILENAME)));
+        const requestedRoot = path.resolve(inputPath);
+        if (record.name !== deployment ||
+            record.output_directory !== outputDirectory ||
+            record.source.kind !== "project" ||
+            path.resolve(record.source.root) !== requestedRoot ||
+            record.compile_fingerprint !== report.compile_fingerprint ||
+            record.auth_profile !== (options.authProfile ?? null) ||
+            (options.context !== undefined &&
+                (record.target.kind !== "context" ||
+                    record.target.name !== options.context)) ||
+            (options.name !== undefined &&
+                record.units[0]?.container_name !== options.name) ||
+            !exactHandoff(record, options))
+            return ambiguous("up_durable_evidence_drifted");
+        const evidence = await findLifecycleOutcomeEvidence(invocation);
+        if (!evidence)
+            return ambiguous("up_receipt_evidence_absent");
+        if (evidence.deployment_instance_digest !==
+            createDeploymentInstanceDigest(record))
+            return ambiguous("up_deployment_instance_changed");
+        return {
+            outcomeBytes: evidence.completion.outcome_bytes,
+            status: "completed",
+        };
+    }
+    catch {
+        return ambiguous("up_durable_evidence_absent_or_invalid");
+    }
+};

package/dist/compiler/agentNodeMerge.d.ts

@@ -0,0 +1,2 @@
+import type { ResolvedAgentNode } from "./types.js";
+export declare const mergeCompatibleAgentNode: (existing: ResolvedAgentNode, next: ResolvedAgentNode) => void;

package/dist/compiler/agentNodeMerge.js

@@ -0,0 +1,79 @@
+import path from "node:path";
+import { SpawnfileError } from "../shared/index.js";
+import { stableStringify } from "./helpers.js";
+import { mergeWorkspaceResources } from "./workspaceResources.js";
+const assertSame = (field, existing, next, nodeName) => {
+    if (stableStringify(existing) === stableStringify(next)) {
+        return;
+    }
+    throw new SpawnfileError("compile_error", `Agent ${nodeName} resolves with incompatible ${field} across team imports`);
+};
+const mergeEnvStrict = (existing, next, nodeName) => {
+    const merged = { ...existing };
+    for (const [key, value] of Object.entries(next)) {
+        if (merged[key] !== undefined && merged[key] !== value) {
+            throw new SpawnfileError("validation_error", `Agent ${nodeName} receives conflicting environment variable ${key} across team imports`);
+        }
+        merged[key] = value;
+    }
+    return merged;
+};
+const mergeByKeyStrict = (existing, next, getKey, label, nodeName) => {
+    const merged = new Map();
+    for (const value of existing ?? []) {
+        merged.set(getKey(value), value);
+    }
+    for (const value of next ?? []) {
+        const key = getKey(value);
+        const previous = merged.get(key);
+        if (previous && stableStringify(previous) !== stableStringify(value)) {
+            throw new SpawnfileError("validation_error", `Agent ${nodeName} receives conflicting ${label} ${key} across team imports`);
+        }
+        merged.set(key, value);
+    }
+    return merged.size > 0 ? [...merged.values()] : undefined;
+};
+const mergeDocuments = (existing, next, agentSourcePath) => {
+    const agentDirectory = path.dirname(agentSourcePath);
+    const isAgentLocalDoc = (doc) => {
+        const sourcePath = path.resolve(doc.sourcePath);
+        return sourcePath === agentDirectory || sourcePath.startsWith(`${agentDirectory}${path.sep}`);
+    };
+    const merged = new Map(existing.filter(isAgentLocalDoc).map((doc) => [doc.role, doc]));
+    for (const doc of next.filter(isAgentLocalDoc)) {
+        if (!merged.has(doc.role)) {
+            merged.set(doc.role, doc);
+        }
+    }
+    return [...merged.values()];
+};
+const packageKey = (pkg) => `${pkg.manager}::${pkg.name}`;
+const skillKey = (skill) => skill.ref;
+export const mergeCompatibleAgentNode = (existing, next) => {
+    assertSame("description", existing.description, next.description, existing.name);
+    assertSame("execution", existing.execution, next.execution, existing.name);
+    assertSame("expose", existing.expose, next.expose, existing.name);
+    assertSame("memory", existing.memory, next.memory, existing.name);
+    assertSame("name", existing.name, next.name, existing.name);
+    assertSame("policy mode", existing.policyMode, next.policyMode, existing.name);
+    assertSame("policy on_degrade", existing.policyOnDegrade, next.policyOnDegrade, existing.name);
+    assertSame("runtime", existing.runtime, next.runtime, existing.name);
+    assertSame("schedule", existing.schedule, next.schedule, existing.name);
+    assertSame("source", existing.source, next.source, existing.name);
+    assertSame("source path", existing.sourcePath, next.sourcePath, existing.name);
+    assertSame("surfaces", existing.surfaces, next.surfaces, existing.name);
+    existing.docs = mergeDocuments(existing.docs, next.docs, existing.sourcePath ?? existing.source);
+    existing.env = mergeEnvStrict(existing.env, next.env, existing.name);
+    existing.mcpServers = mergeByKeyStrict(existing.mcpServers, next.mcpServers, (server) => server.name, "MCP server", existing.name) ?? [];
+    existing.packages = mergeByKeyStrict(existing.packages, next.packages, packageKey, "package", existing.name);
+    existing.secrets = mergeByKeyStrict(existing.secrets, next.secrets, (secret) => secret.name, "secret", existing.name) ?? [];
+    existing.skills = mergeByKeyStrict(existing.skills, next.skills, skillKey, "skill", existing.name) ?? [];
+    existing.workspaceResources = mergeWorkspaceResources([
+        ...(existing.workspaceResources ?? []),
+        ...(next.workspaceResources ?? [])
+    ], [], existing.name, {
+        kind: "agent",
+        key: existing.source,
+        name: existing.name
+    });
+};

package/dist/compiler/agentSurfaces.js

@@ -23,11 +23,21 @@ export const resolveAgentSurfaces = (surfaces) => {
     }
     if (surfaces.moltnet) {
         resolved.moltnet = surfaces.moltnet.map((attachment) => ({
+            ...(attachment.auth
+                ? {
+                    auth: {
+                        tokenId: attachment.auth.token_id
+                    }
+                }
+                : {}),
             ...(attachment.dms
                 ? {
                     dms: {
                         enabled: attachment.dms.enabled,
-                        ...(attachment.dms.wake ? { wake: attachment.dms.wake } : {})
+                        ...(attachment.dms.wake ? { wake: attachment.dms.wake } : {}),
+                        ...(attachment.dms.allowed_wake_senders !== undefined
+                            ? { allowedWakeSenders: [...attachment.dms.allowed_wake_senders] }
+                            : {})
                     }
                 }
                 : {}),

package/dist/compiler/buildCompilePlan.js

@@ -2,9 +2,12 @@ import { getCanonicalManifestPath, getManifestPath } from "../filesystem/index.j
 import { loadManifest, isAgentManifest } from "../manifest/index.js";
 import { assignStableNodeIds } from "./helpers.js";
 import { resolvePlanMoltnetAttachments } from "./moltnetResolution.js";
+import { resolvePlanMemoryAccess } from "./memoryResolution.js";
 import { resolveMoltnetRoomMemberships } from "./moltnetRoomMemberships.js";
 import { createRuntimeGroups } from "./buildCompilePlanRuntime.js";
+import { validateAllowedWakeSenders } from "./moltnetAllowedWakeSendersValidation.js";
 import { createCompilePlanTraversal } from "./buildCompilePlanTraversal.js";
+import { resolveMoltnetExternalParticipantIntents, resolveOrganizationIdentity, validateB31MoltnetAuth } from "./organizationIdentity.js";
 export const buildCompilePlan = async (inputPath) => {
     const rootManifestPath = getCanonicalManifestPath(getManifestPath(inputPath));
     const loadCache = new Map();
@@ -60,7 +63,21 @@ export const buildCompilePlan = async (inputPath) => {
         root: rootManifestPath,
         runtimes: createRuntimeGroups(compilePlanNodes)
     };
+    const organizationIdentity = resolveOrganizationIdentity(compilePlan);
+    if (organizationIdentity)
+        compilePlan.organizationIdentity = organizationIdentity;
+    // Reject duplicate or invalid authored actor selections before attachment
+    // synthesis can merge them into a single canonical attachment.
+    validateB31MoltnetAuth(compilePlan);
+    const externalParticipantIntents = resolveMoltnetExternalParticipantIntents(compilePlan);
+    if (organizationIdentity)
+        compilePlan.moltnetExternalParticipantIntents = externalParticipantIntents;
     compilePlan.moltnetRoomMemberships = resolveMoltnetRoomMemberships(compilePlan);
+    resolvePlanMemoryAccess(compilePlan);
     resolvePlanMoltnetAttachments(compilePlan);
+    // Recheck the actual canonical attachments emitted after representative
+    // synthesis and duplicate merging.
+    validateB31MoltnetAuth(compilePlan);
+    validateAllowedWakeSenders(compilePlan);
     return compilePlan;
 };

package/dist/compiler/buildCompilePlanAgent.d.ts

@@ -0,0 +1,11 @@
+import { type AgentManifest } from "../manifest/index.js";
+import type { AgentVisitContext } from "./buildCompilePlanRuntime.js";
+import type { ResolvedAgentNode } from "./types.js";
+interface ResolveAgentNodeOptions {
+    context: AgentVisitContext;
+    manifest: AgentManifest;
+    manifestPath: string;
+    source: string;
+}
+export declare const resolveAgentNode: ({ context, manifest, manifestPath, source }: ResolveAgentNodeOptions) => Promise<ResolvedAgentNode>;
+export {};

package/dist/compiler/buildCompilePlanAgent.js

@@ -0,0 +1,56 @@
+import { mergeExecution } from "../manifest/index.js";
+import { resolveAgentSurfaces } from "./agentSurfaces.js";
+import { resolveDescription, resolveRuntime } from "./buildCompilePlanRuntime.js";
+import { DEFAULT_POLICY_MODE, DEFAULT_POLICY_ON_DEGRADE, mergeResolvedDocuments, resolveEffectiveEnvironment } from "./buildCompilePlanTraversalHelpers.js";
+import { getMcpNames, validateEffectiveSkillRequirements } from "./compilePlanHelpers.js";
+import { applyExecutionDefaults } from "./executionDefaults.js";
+import { resolveDeclaredMemoryBanks } from "./memoryResolution.js";
+import { assertRuntimeSupportsExecutionModelAuth } from "./modelAuth.js";
+import { loadResolvedSkills, mergeResolvedSkills } from "./surfaces.js";
+import { assertRuntimeSupportsAgentSurfaces } from "./surfaceSupport.js";
+import { mergeWorkspaceResources } from "./workspaceResources.js";
+export const resolveAgentNode = async ({ context, manifest, manifestPath, source }) => {
+    const runtime = await resolveRuntime(manifest, context);
+    const execution = applyExecutionDefaults(context.isSubagent
+        ? mergeExecution(context.inheritedExecution, manifest.execution)
+        : manifest.execution);
+    assertRuntimeSupportsExecutionModelAuth(runtime.name, execution, manifest.name);
+    const environment = resolveEffectiveEnvironment(context.inheritedShared?.surface?.environment, manifest.environment);
+    const inheritedSkills = context.inheritedShared
+        ? await loadResolvedSkills(context.inheritedShared.manifestPath, context.inheritedShared.surface?.workspace?.skills)
+        : [];
+    const localSkills = await loadResolvedSkills(manifestPath, manifest.workspace?.skills);
+    const skills = mergeResolvedSkills(inheritedSkills, localSkills);
+    validateEffectiveSkillRequirements(manifest.name, getMcpNames(environment.mcpServers), skills);
+    const docs = await mergeResolvedDocuments(manifestPath, manifest.workspace?.docs, context.inheritedShared?.manifestPath, context.inheritedShared?.surface?.workspace?.docs);
+    const workspaceResources = mergeWorkspaceResources(context.inheritedResources, manifest.workspace?.resources, manifest.name, {
+        kind: "agent",
+        key: source,
+        name: manifest.name
+    });
+    const candidate = {
+        description: resolveDescription(manifest.description, docs),
+        docs,
+        env: environment.env,
+        execution,
+        expose: manifest.expose ?? false,
+        kind: "agent",
+        mcpServers: environment.mcpServers,
+        name: manifest.name,
+        policyMode: manifest.policy?.mode ?? DEFAULT_POLICY_MODE,
+        policyOnDegrade: manifest.policy?.on_degrade ?? DEFAULT_POLICY_ON_DEGRADE,
+        runtime,
+        memory: resolveDeclaredMemoryBanks(manifest.memory, source, "agent", manifest.name),
+        schedule: manifest.schedule,
+        secrets: environment.secrets,
+        packages: environment.packages,
+        skills,
+        source,
+        ...(source === manifestPath ? {} : { sourcePath: manifestPath }),
+        surfaces: resolveAgentSurfaces(manifest.surfaces),
+        subagents: [],
+        workspaceResources
+    };
+    assertRuntimeSupportsAgentSurfaces(runtime.name, candidate.surfaces, manifest.name);
+    return candidate;
+};

package/dist/compiler/buildCompilePlanTeams.d.ts

@@ -2,4 +2,5 @@ import type { TeamManifest } from "../manifest/index.js";
 import type { ResolvedTeamNetwork, ResolvedTeamNode } from "./types.js";
 export declare const resolveTeamExternalIds: (manifest: TeamManifest) => string[];
 export declare const resolveTeamNetworks: (manifest: TeamManifest) => ResolvedTeamNetwork[];
+export declare const isAttachedExternalRoomMember: (teamNode: ResolvedTeamNode, networkId: string, memberId: string) => boolean;
 export declare const validateTeamNetworkRooms: (teamNode: ResolvedTeamNode) => void;

package/dist/compiler/buildCompilePlanTeams.js

@@ -32,12 +32,15 @@ export const resolveTeamNetworks = (manifest) => (manifest.networks ?? []).map((
     }
     return resolved;
 });
+export const isAttachedExternalRoomMember = (teamNode, networkId, memberId) => teamNode.externalParticipants?.some((participant) => participant.id === memberId
+    && participant.surfaces.moltnet.some((attachment) => attachment.network === networkId)) === true;
 export const validateTeamNetworkRooms = (teamNode) => {
     for (const network of teamNode.networks ?? []) {
         for (const room of network.rooms) {
             for (const roomMemberId of room.members) {
                 const resolvedMember = teamNode.members.find((member) => member.id === roomMemberId);
-                if (!resolvedMember) {
+                if (!resolvedMember
+                    && !isAttachedExternalRoomMember(teamNode, network.id, roomMemberId)) {
                     throw new SpawnfileError("validation_error", `Team ${teamNode.name} Moltnet room ${room.id} references unknown member ${roomMemberId}`);
                 }
             }