spawnfile 0.1.13 → 0.1.14

package/dist/compiler/containerArtifactSummaries.js

@@ -0,0 +1,138 @@
+import { SpawnfileError } from "../shared/index.js";
+export const createOrganizationSummary = (plan, compiledNodes) => {
+    const nodes = compiledNodes.map((node) => ({
+        id: node.id ?? `${node.kind}:${node.slug}`,
+        kind: node.kind,
+        name: node.value.name,
+        runtimeName: node.runtimeName,
+        source: node.value.source
+    }));
+    const rootNode = nodes.find((node) => node.source === plan.root)
+        ?? nodes.find((node) => !plan.edges.some((edge) => edge.to === node.id))
+        ?? nodes[0];
+    if (!rootNode) {
+        throw new SpawnfileError("compile_error", `Unable to resolve the root node for ${plan.root}`);
+    }
+    const memberEdges = plan.edges.filter((edge) => edge.kind === "team_member");
+    const teamsByAgent = new Map();
+    for (const edge of memberEdges) {
+        teamsByAgent.set(edge.to, [...(teamsByAgent.get(edge.to) ?? []), edge.from]);
+    }
+    const agentNodes = nodes.filter((node) => node.kind === "agent");
+    const teamNodes = nodes.filter((node) => node.kind === "team");
+    const agentIds = new Set(agentNodes.map((node) => node.id));
+    return {
+        agents: agentNodes
+            .map((node) => ({
+            id: node.id,
+            name: node.name,
+            runtime: node.runtimeName,
+            teams: [...(teamsByAgent.get(node.id) ?? [])].sort()
+        }))
+            .sort((left, right) => left.id.localeCompare(right.id)),
+        project: rootNode.name,
+        teams: teamNodes
+            .map((node) => ({
+            agents: memberEdges
+                .filter((edge) => edge.from === node.id && agentIds.has(edge.to))
+                .map((edge) => edge.to)
+                .sort(),
+            id: node.id,
+            name: node.name
+        }))
+            .sort((left, right) => left.id.localeCompare(right.id))
+    };
+};
+const resolveMoltnetOperatorCredential = (plan) => {
+    const client = plan.server.auth.client;
+    if (!client) {
+        return {};
+    }
+    if (client.token_env) {
+        return { secret: client.token_env };
+    }
+    if (client.token_path) {
+        return { secret: client.token_path };
+    }
+    if (!client.token_id) {
+        return {};
+    }
+    const token = plan.server.auth.tokens?.find((candidate) => candidate.id === client.token_id);
+    const agents = [...new Set((token?.agents ?? []).map((agent) => agent.trim()))].filter(Boolean);
+    return {
+        ...(agents.length === 1 ? { agentId: agents[0] } : {}),
+        id: client.token_id,
+        ...(token?.secret ? { secret: token.secret } : {})
+    };
+};
+export const createMoltnetSummary = (moltnet, release) => {
+    if (!moltnet) {
+        return undefined;
+    }
+    return {
+        node_plans: moltnet.nodePlans.map((plan) => ({
+            config_path: plan.configPath,
+            ...(plan.credentialAgentId ? { credential_agent_id: plan.credentialAgentId } : {}),
+            ...(plan.credentialId ? { credential_id: plan.credentialId } : {}),
+            ...(plan.credentialSecret ? { credential_secret: plan.credentialSecret } : {}),
+            ...(plan.memberId ? { member_id: plan.memberId } : {}),
+            network_id: plan.networkId
+        })),
+        release,
+        server_plans: moltnet.serverPlans.map((plan) => {
+            const operatorCredential = resolveMoltnetOperatorCredential(plan);
+            return {
+                ...(plan.server.auth.agent_registration
+                    ? { agent_registration: plan.server.auth.agent_registration }
+                    : {}),
+                auth_mode: plan.server.auth.mode,
+                ...(plan.server.mode === "managed" && plan.server.auth.tokens
+                    ? {
+                        auth_tokens: plan.server.auth.tokens.map((token) => ({
+                            agents: [...new Set((token.agents ?? []).map((agent) => agent.trim()))]
+                                .filter(Boolean)
+                                .sort(),
+                            id: token.id,
+                            scopes: [...token.scopes].sort(),
+                            secret: token.secret
+                        }))
+                    }
+                    : {}),
+                base_url: plan.baseUrl,
+                ...(plan.configPath ? { config_path: plan.configPath } : {}),
+                ...(plan.server.mode === "managed"
+                    ? {
+                        debug_events: plan.server.debug_events,
+                        direct_messages: plan.server.direct_messages,
+                        human_ingress: plan.server.human_ingress,
+                        trust_forwarded_proto: plan.server.trust_forwarded_proto
+                    }
+                    : {}),
+                id: plan.id,
+                mode: plan.mode,
+                network_id: plan.networkId,
+                network_name: plan.name,
+                ...(operatorCredential.agentId
+                    ? { operator_agent_id: operatorCredential.agentId }
+                    : {}),
+                ...(operatorCredential.id ? { operator_token_id: operatorCredential.id } : {}),
+                ...(operatorCredential.secret
+                    ? { operator_token_secret: operatorCredential.secret }
+                    : {}),
+                ...(plan.port ? { port: plan.port } : {}),
+                ...(plan.server.auth.public_read !== undefined
+                    ? { public_read: plan.server.auth.public_read }
+                    : {}),
+                rooms: plan.rooms.map((room) => ({
+                    id: room.id,
+                    members: [...room.members],
+                    ...(room.visibility ? { visibility: room.visibility } : {}),
+                    ...(room.write_policy ? { write_policy: room.write_policy } : {})
+                })),
+                ...(plan.server.mode === "managed"
+                    ? { store_kind: plan.server.store.kind }
+                    : {})
+            };
+        })
+    };
+};

package/dist/compiler/containerArtifacts.d.ts

@@ -1,10 +1,20 @@
+import type { RuntimeContainerPackageOverrides } from "../runtime/index.js";
 import type { MoltnetArtifacts } from "./moltnetArtifacts.js";
+import type { MoltnetReleaseIdentity } from "./moltnetBinaries.js";
 import type { CompiledNodeArtifact, GeneratedContainerArtifacts } from "./containerArtifactsTypes.js";
 import type { CompilePlan } from "./types.js";
+import { type ResolvedWorldBindings } from "./worldBindings.js";
 export type { CompiledNodeArtifact, GeneratedContainerArtifacts } from "./containerArtifactsTypes.js";
 export interface ContainerArtifactOptions {
     generatedAt?: string;
     hasStagedMoltnetBinaries?: boolean;
     moltnet?: MoltnetArtifacts | null;
+    moltnetRelease?: MoltnetReleaseIdentity;
+    worldBindings?: ResolvedWorldBindings;
+    /** Resolved local overrides for runtime install npm packages, produced by
+     * stageRuntimePackageOverrides.ts from a compile-time-only
+     * RuntimePackageOverrideRequest (see compileProject.ts). Undefined for a
+     * standard compile. */
+    runtimePackageOverrides?: RuntimeContainerPackageOverrides;
 }
 export declare const createContainerArtifacts: (plan: CompilePlan, compiledNodes: CompiledNodeArtifact[], options?: ContainerArtifactOptions) => Promise<GeneratedContainerArtifacts>;

package/dist/compiler/containerArtifacts.js

@@ -1,109 +1,38 @@
-import { buildDistributionReport, createDistributionImageLabels, DISTRIBUTION_REPORT_OUTPUT_FILE, normalizeProjectLabelSlug } from "../distribution/index.js";
+import { createHash } from "node:crypto";
+import { buildDistributionReport, createDistributionImageLabels, DISTRIBUTION_REPORT_OUTPUT_FILE, normalizeProjectLabelSlug, WORLD_BINDINGS_IMAGE_PATH } from "../distribution/index.js";
 import { SpawnfileError } from "../shared/index.js";
+import { createMoltnetSummary, createOrganizationSummary } from "./containerArtifactSummaries.js";
 import { createEnvVariableMap, createRuntimeTargetPlans } from "./containerArtifactsPlans.js";
+import { createDockerIgnoreContent } from "./dockerBuildContext.js";
+import { createDaimonTelemetryArtifacts } from "./daimonTelemetryArtifacts.js";
 import { createRootfsFiles, renderDockerfile, renderEntrypoint, renderEnvExample } from "./containerArtifactsRender.js";
-const createOrganizationSummary = (plan, compiledNodes) => {
-    const nodes = compiledNodes.map((node) => ({
-        id: node.id ?? `${node.kind}:${node.slug}`,
-        kind: node.kind,
-        name: node.value.name,
-        runtimeName: node.runtimeName,
-        source: node.value.source
-    }));
-    const rootNode = nodes.find((node) => node.source === plan.root)
-        ?? nodes.find((node) => !plan.edges.some((edge) => edge.to === node.id))
-        ?? nodes[0];
-    if (!rootNode) {
-        throw new SpawnfileError("compile_error", `Unable to resolve the root node for ${plan.root}`);
-    }
-    const memberEdges = plan.edges.filter((edge) => edge.kind === "team_member");
-    const teamsByAgent = new Map();
-    for (const edge of memberEdges) {
-        teamsByAgent.set(edge.to, [...(teamsByAgent.get(edge.to) ?? []), edge.from]);
-    }
-    const agentNodes = nodes.filter((node) => node.kind === "agent");
-    const teamNodes = nodes.filter((node) => node.kind === "team");
-    const agentIds = new Set(agentNodes.map((node) => node.id));
-    return {
-        agents: agentNodes
-            .map((node) => ({
-            id: node.id,
-            name: node.name,
-            runtime: node.runtimeName,
-            teams: [...(teamsByAgent.get(node.id) ?? [])].sort()
-        }))
-            .sort((left, right) => left.id.localeCompare(right.id)),
-        project: rootNode.name,
-        teams: teamNodes
-            .map((node) => ({
-            agents: memberEdges
-                .filter((edge) => edge.from === node.id && agentIds.has(edge.to))
-                .map((edge) => edge.to)
-                .sort(),
-            id: node.id,
-            name: node.name
-        }))
-            .sort((left, right) => left.id.localeCompare(right.id))
-    };
-};
-const resolveMoltnetOperatorTokenSecret = (plan) => {
-    const client = plan.server.auth.client;
-    if (!client) {
-        return undefined;
-    }
-    if (client.token_env) {
-        return client.token_env;
-    }
-    if (client.token_path) {
-        return client.token_path;
-    }
-    if (!client.token_id) {
-        return undefined;
+import { createMemoryArtifactBundle } from "./memoryArtifacts.js";
+import { SIMFILE_WORLD_BINDINGS_VERSION, WORLD_BINDINGS_OUTPUT_FILE } from "./worldBindings.js";
+export const createContainerArtifacts = async (plan, compiledNodes, options = {}) => {
+    const runtimePlans = await createRuntimeTargetPlans(plan, compiledNodes, options.worldBindings);
+    const daimonTelemetryArtifacts = createDaimonTelemetryArtifacts(plan, runtimePlans, compiledNodes);
+    const envVariableMap = createEnvVariableMap(compiledNodes, runtimePlans, options.moltnet);
+    const projectedWorldTokenEnvNames = [...new Set(runtimePlans.flatMap((runtimePlan) => runtimePlan.worldTokenEnvNames ?? []))].sort();
+    const worldTokenEnvNames = (options.worldBindings?.artifact.bindings ?? [])
+        .map((binding) => binding.token_env)
+        .sort();
+    const recipeEnvNames = new Set(runtimePlans.flatMap((runtimePlan) => Object.keys(runtimePlan.recipeEnv ?? {})));
+    const moltnetSecretEnvNames = new Set((options.moltnet?.serverPlans ?? []).flatMap((serverPlan) => serverPlan.secretPatches.map((patch) => patch.envName)));
+    for (const name of worldTokenEnvNames) {
+        if (envVariableMap.has(name) || recipeEnvNames.has(name) || moltnetSecretEnvNames.has(name)) {
+            throw new SpawnfileError("validation_error", `World token env ${name} conflicts with an existing environment authority`);
+        }
     }
-    return plan.server.auth.tokens?.find((token) => token.id === client.token_id)?.secret;
-};
-const createMoltnetSummary = (moltnet) => {
-    if (!moltnet) {
-        return undefined;
+    for (const name of projectedWorldTokenEnvNames) {
+        envVariableMap.set(name, {
+            categories: ["runtime"],
+            description: "World bearer token for a native runtime projection",
+            generated: false,
+            name,
+            required: true
+        });
     }
-    return {
-        node_plans: moltnet.nodePlans.map((plan) => ({
-            config_path: plan.configPath,
-            network_id: plan.networkId
-        })),
-        server_plans: moltnet.serverPlans.map((plan) => {
-            const operatorTokenSecret = resolveMoltnetOperatorTokenSecret(plan);
-            return {
-                auth_mode: plan.server.auth.mode,
-                base_url: plan.baseUrl,
-                ...(plan.configPath ? { config_path: plan.configPath } : {}),
-                ...(plan.server.mode === "managed"
-                    ? { direct_messages: plan.server.direct_messages }
-                    : {}),
-                id: plan.id,
-                mode: plan.mode,
-                network_id: plan.networkId,
-                ...(operatorTokenSecret ? { operator_token_secret: operatorTokenSecret } : {}),
-                ...(plan.port ? { port: plan.port } : {}),
-                ...(plan.server.auth.public_read !== undefined
-                    ? { public_read: plan.server.auth.public_read }
-                    : {}),
-                rooms: plan.rooms.map((room) => ({
-                    id: room.id,
-                    members: [...room.members],
-                    ...(room.visibility ? { visibility: room.visibility } : {}),
-                    ...(room.write_policy ? { write_policy: room.write_policy } : {})
-                })),
-                ...(plan.server.mode === "managed"
-                    ? { store_kind: plan.server.store.kind }
-                    : {})
-            };
-        })
-    };
-};
-export const createContainerArtifacts = async (plan, compiledNodes, options = {}) => {
-    const runtimePlans = await createRuntimeTargetPlans(plan, compiledNodes);
-    const envVariables = [...createEnvVariableMap(compiledNodes, runtimePlans).values()].sort((left, right) => left.name.localeCompare(right.name));
+    const envVariables = [...envVariableMap.values()].sort((left, right) => left.name.localeCompare(right.name));
     const requiredSecrets = envVariables
         .filter((variable) => variable.required)
         .map((variable) => variable.name)
@@ -116,14 +45,50 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         .filter((variable) => variable.required && variable.categories.includes("runtime"))
         .map((variable) => variable.name)
         .sort();
-    const persistentMounts = (options.moltnet?.persistentMounts ?? [])
-        .map((mount) => ({
-        id: mount.id,
-        mount_path: mount.mountPath,
-        reason: mount.reason,
-        volume_name: mount.volumeName
-    }))
-        .sort((left, right) => left.id.localeCompare(right.id));
+    const memoryArtifacts = createMemoryArtifactBundle(plan);
+    const persistentMountsById = new Map();
+    for (const mount of memoryArtifacts.mounts) {
+        const existing = persistentMountsById.get(mount.id);
+        if (existing) {
+            if (existing.mount_path !== mount.mount_path || existing.volume_name !== mount.volume_name) {
+                throw new Error(`Container persistent mount ${mount.id} resolves to conflicting targets`);
+            }
+            continue;
+        }
+        persistentMountsById.set(mount.id, {
+            mount_path: mount.mount_path,
+            reason: mount.reason,
+            volume_name: mount.volume_name
+        });
+    }
+    const persistentMounts = [
+        ...memoryArtifacts.mounts,
+        ...daimonTelemetryArtifacts.mounts,
+        ...((options.moltnet?.persistentMounts ?? []).map((mount) => ({
+            id: mount.id,
+            mount_path: mount.mountPath,
+            reason: mount.reason,
+            volume_name: mount.volumeName
+        })))
+    ]
+        .sort((left, right) => left.id.localeCompare(right.id))
+        .filter((mount) => {
+        const existing = persistentMountsById.get(mount.id);
+        if (existing) {
+            if (existing.mount_path === mount.mount_path &&
+                existing.volume_name === mount.volume_name &&
+                existing.reason === mount.reason) {
+                return true;
+            }
+            throw new Error(`Container persistent mount ${mount.id} resolves to conflicting targets`);
+        }
+        persistentMountsById.set(mount.id, {
+            mount_path: mount.mount_path,
+            reason: mount.reason,
+            volume_name: mount.volume_name
+        });
+        return true;
+    });
     const runtimeInternalPorts = runtimePlans.flatMap((plan) => plan.port ? [plan.port] : []);
     const internalPorts = [...new Set([...runtimeInternalPorts, ...(options.moltnet?.ports ?? [])])].sort((left, right) => left - right);
     const runtimePublishedPorts = runtimePlans.flatMap((plan) => plan.publishedPort ? [plan.publishedPort] : []);
@@ -140,18 +105,25 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         ...new Set(runtimePlans.flatMap((plan) => (plan.instancePaths.homePath ? [plan.instancePaths.homePath] : [])))
     ].sort();
     const runtimeInstances = runtimePlans
-        .map((plan) => ({
-        config_path: plan.instancePaths.configPath,
-        home_path: plan.instancePaths.homePath ?? null,
-        id: plan.id,
-        internal_port: plan.port ?? null,
-        model_auth_methods: plan.modelAuthMethods,
-        model_secrets_required: plan.modelSecretsRequired,
-        node_ids: [...(plan.sourceIds ?? [])],
-        published_port: plan.publishedPort ?? null,
-        runtime: plan.runtimeName,
-        workspace_path: plan.instancePaths.workspacePath
-    }))
+        .map((plan) => {
+        const telemetryMountIds = daimonTelemetryArtifacts.telemetryMountIdsByInstance.get(plan.id);
+        return {
+            config_path: plan.instancePaths.configPath,
+            home_path: plan.instancePaths.homePath ?? null,
+            id: plan.id,
+            internal_port: plan.port ?? null,
+            model_auth_methods: plan.modelAuthMethods,
+            model_secrets_required: plan.modelSecretsRequired,
+            ...(plan.engineByNodeId && Object.keys(plan.engineByNodeId).length > 0
+                ? { engine_by_node_id: plan.engineByNodeId }
+                : {}),
+            node_ids: [...(plan.sourceIds ?? [])],
+            published_port: plan.publishedPort ?? null,
+            runtime: plan.runtimeName,
+            ...(telemetryMountIds ? { telemetry_mount_ids: telemetryMountIds } : {}),
+            workspace_path: plan.instancePaths.workspacePath
+        };
+    })
         .sort((left, right) => left.id.localeCompare(right.id));
     const runtimesInstalled = [...new Set(runtimePlans.map((plan) => plan.runtimeName))].sort();
     const workspaceResources = [
@@ -168,7 +140,7 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             }
         ]))).values()
     ].sort((left, right) => left.link_path.localeCompare(right.link_path) || left.id.localeCompare(right.id));
-    const moltnetSummary = createMoltnetSummary(options.moltnet);
+    const moltnetSummary = createMoltnetSummary(options.moltnet, options.moltnetRelease);
     const organization = createOrganizationSummary(plan, compiledNodes);
     const projectSlug = normalizeProjectLabelSlug(organization.project);
     const mergedModelAuthMethods = Object.assign({}, ...runtimePlans.map((runtimePlan) => runtimePlan.modelAuthMethods));
@@ -182,6 +154,13 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             }
         ])).values()
     ];
+    const worldBindingsEvidence = options.worldBindings
+        ? {
+            artifact_path: WORLD_BINDINGS_IMAGE_PATH,
+            digest: `sha256:${createHash("sha256").update(options.worldBindings.canonicalBytes).digest("hex")}`,
+            schema: SIMFILE_WORLD_BINDINGS_VERSION
+        }
+        : undefined;
     const distributionReport = buildDistributionReport({
         envVariables: envVariables.map((variable) => ({
             categories: variable.categories,
@@ -210,12 +189,16 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             mount: resource.mount,
             sharing: resource.sharing
         })),
-        runtimeInstances
+        runtimeInstances,
+        ...(worldBindingsEvidence ? { worldBindings: worldBindingsEvidence } : {})
     });
     const distributionLabels = createDistributionImageLabels(projectSlug, distributionReport.compile_fingerprint);
     const files = [
         ...createRootfsFiles(runtimePlans),
         ...(options.moltnet?.files ?? []),
+        ...(options.worldBindings
+            ? [{ content: options.worldBindings.canonicalBytes, mode: 0o600, path: WORLD_BINDINGS_OUTPUT_FILE }]
+            : []),
         {
             content: `${JSON.stringify(distributionReport, null, 2)}\n`,
             path: DISTRIBUTION_REPORT_OUTPUT_FILE
@@ -224,12 +207,24 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             content: await renderDockerfile(runtimePlans, {
                 distribution: {
                     labels: distributionLabels,
-                    reportOutputFile: DISTRIBUTION_REPORT_OUTPUT_FILE
+                    reportOutputFile: DISTRIBUTION_REPORT_OUTPUT_FILE,
+                    ...(options.worldBindings
+                        ? { worldBindingsOutputFile: WORLD_BINDINGS_OUTPUT_FILE }
+                        : {})
                 },
                 hasMoltnet: Boolean(options.moltnet),
                 hasStagedMoltnetBinaries: options.hasStagedMoltnetBinaries,
+                ...(options.moltnet
+                    ? {
+                        moltnet: {
+                            nodePlans: options.moltnet.nodePlans,
+                            serverPlans: options.moltnet.serverPlans
+                        }
+                    }
+                    : {}),
                 moltnetPublishedPorts: options.moltnet?.publishedPorts ?? [],
-                persistentMountPaths: persistentMounts.map((mount) => mount.mount_path)
+                persistentMountPaths: persistentMounts.map((mount) => mount.mount_path),
+                runtimePackageOverrides: options.runtimePackageOverrides
             }),
             path: "Dockerfile"
         },
@@ -237,6 +232,7 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             content: renderEntrypoint(runtimePlans, requiredSecrets.filter((secretName) => !modelSecretsRequired.includes(secretName)), {
                 moltnet: options.moltnet
                     ? {
+                        externalParticipantArtifacts: options.moltnet.externalParticipantArtifacts ?? [],
                         nodePlans: options.moltnet.nodePlans,
                         serverPlans: options.moltnet.serverPlans
                     }
@@ -247,6 +243,10 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         {
             content: renderEnvExample(envVariables),
             path: ".env.example"
+        },
+        {
+            content: createDockerIgnoreContent(),
+            path: ".dockerignore"
         }
     ];
     return {
@@ -280,6 +280,7 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             runtime_secrets_required: runtimeSecretsRequired,
             runtimes_installed: runtimesInstalled,
             secrets_required: requiredSecrets,
+            ...(memoryArtifacts.memories.length > 0 ? { memory: memoryArtifacts.memories } : {}),
             ...(persistentMounts.length > 0 ? { persistent_mounts: persistentMounts } : {}),
             ...(workspaceResources.length > 0 ? { workspace_resources: workspaceResources } : {})
         }

package/dist/compiler/containerArtifactsPlans.d.ts

@@ -1,4 +1,6 @@
-import type { CompilePlan } from "./types.js";
 import type { CompiledNodeArtifact, ContainerEnvVariable, RuntimeTargetPlan } from "./containerArtifactsTypes.js";
-export declare const createEnvVariableMap: (compiledNodes: CompiledNodeArtifact[], runtimePlans: RuntimeTargetPlan[]) => Map<string, ContainerEnvVariable>;
-export declare const createRuntimeTargetPlans: (plan: CompilePlan, compiledNodes: CompiledNodeArtifact[]) => Promise<RuntimeTargetPlan[]>;
+import type { MoltnetArtifacts } from "./moltnetArtifacts.js";
+import type { CompilePlan } from "./types.js";
+import { type ResolvedWorldBindings } from "./worldBindings.js";
+export declare const createEnvVariableMap: (compiledNodes: CompiledNodeArtifact[], runtimePlans: RuntimeTargetPlan[], moltnet?: MoltnetArtifacts | null) => Map<string, ContainerEnvVariable>;
+export declare const createRuntimeTargetPlans: (plan: CompilePlan, compiledNodes: CompiledNodeArtifact[], worldBindings?: ResolvedWorldBindings) => Promise<RuntimeTargetPlan[]>;