spawnfile 0.1.13 → 0.1.14

package/dist/compiler/moltnetRoomMemberships.js

@@ -1,5 +1,7 @@
 import { SpawnfileError } from "../shared/index.js";
 import { resolveTeamRepresentatives } from "./moltnetRepresentativeResolution.js";
+import { resolveCanonicalAgentMemberId } from "./organizationIdentity.js";
+import { isAttachedExternalRoomMember } from "./buildCompilePlanTeams.js";
 const hasOwn = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
 const findAgentBySource = (plan, source) => {
     const node = plan.nodes.find((entry) => entry.kind === "agent" && entry.value.source === source);
@@ -18,6 +20,19 @@ const findTeamBySource = (plan, source) => {
 const clonePolicy = (policy) => ({
     ...(policy.wake ? { wake: policy.wake } : {})
 });
+const defaultNestedRepresentativePolicy = () => ({
+    wake: "mentions"
+});
+const resolveConcreteMemberId = (plan, agentSource, authoredMemberId) => {
+    if (!plan.organizationIdentity)
+        return authoredMemberId;
+    const canonicalMemberId = resolveCanonicalAgentMemberId(plan, agentSource);
+    if (!canonicalMemberId ||
+        plan.organizationIdentity.agentMembers.filter((member) => member.memberId === canonicalMemberId).length !== 1) {
+        throw new SpawnfileError("validation_error", `Unable to resolve exactly one canonical Moltnet member id for ${agentSource}`);
+    }
+    return canonicalMemberId;
+};
 const findDirectRoomPolicy = (plan, teamNode, agentSource, memberId, networkId, roomId) => {
     const agentNode = findAgentBySource(plan, agentSource);
     for (const attachment of agentNode.surfaces?.moltnet ?? []) {
@@ -47,23 +62,31 @@ const compareRoomMemberships = (left, right) => [
     left.agentSource.localeCompare(right.agentSource)
 ].find((result) => result !== 0) ?? 0;
 export const listConcreteMoltnetRoomMemberIds = (plan, teamNode, networkId, room, memberships = plan.moltnetRoomMemberships) => {
+    const externalMembers = room.members.filter((memberId) => isAttachedExternalRoomMember(teamNode, networkId, memberId));
     if (memberships) {
         return [
-            ...new Set(memberships
-                .filter((membership) => membership.declaringTeamSource === teamNode.source
-                && membership.networkId === networkId
-                && membership.roomId === room.id)
-                .map((membership) => membership.concreteMemberId))
+            ...new Set([
+                ...memberships
+                    .filter((membership) => membership.declaringTeamSource === teamNode.source
+                    && membership.networkId === networkId
+                    && membership.roomId === room.id)
+                    .map((membership) => membership.concreteMemberId),
+                ...externalMembers
+            ])
         ].sort();
     }
     const concreteMembers = [];
     for (const declaredSlot of room.members) {
         const member = teamNode.members.find((entry) => entry.id === declaredSlot);
         if (!member) {
+            if (isAttachedExternalRoomMember(teamNode, networkId, declaredSlot)) {
+                concreteMembers.push(declaredSlot);
+                continue;
+            }
             throw new SpawnfileError("validation_error", `Team ${teamNode.name} Moltnet room ${room.id} references unknown member ${declaredSlot}`);
         }
         if (member.kind === "agent") {
-            concreteMembers.push(member.id);
+            concreteMembers.push(resolveConcreteMemberId(plan, member.nodeSource, member.id));
             continue;
         }
         const childTeam = findTeamBySource(plan, member.nodeSource);
@@ -71,7 +94,7 @@ export const listConcreteMoltnetRoomMemberIds = (plan, teamNode, networkId, room
         if (representatives.length === 0) {
             throw new SpawnfileError("validation_error", `Team ${childTeam.name} has no concrete representative for Moltnet room ${room.id} on ${teamNode.name}`);
         }
-        concreteMembers.push(...representatives.map((representative) => representative.memberId));
+        concreteMembers.push(...representatives.map((representative) => resolveConcreteMemberId(plan, representative.agentSource, representative.memberId)));
     }
     return [...new Set(concreteMembers)].sort();
 };
@@ -87,6 +110,9 @@ export const resolveMoltnetRoomMemberships = (plan) => {
                 for (const declaredSlot of room.members) {
                     const declaredMember = teamNode.members.find((member) => member.id === declaredSlot);
                     if (!declaredMember) {
+                        if (isAttachedExternalRoomMember(teamNode, network.id, declaredSlot)) {
+                            continue;
+                        }
                         throw new SpawnfileError("validation_error", `Team ${teamNode.name} Moltnet room ${room.id} references unknown member ${declaredSlot}`);
                     }
                     if (declaredMember.kind === "agent") {
@@ -95,7 +121,7 @@ export const resolveMoltnetRoomMemberships = (plan) => {
                         memberships.push({
                             agentName: agentNode.name,
                             agentSource: agentNode.source,
-                            concreteMemberId: declaredSlot,
+                            concreteMemberId: resolveConcreteMemberId(plan, agentNode.source, declaredSlot),
                             declaredSlot,
                             declaringTeamName: teamNode.name,
                             declaringTeamSource: teamNode.source,
@@ -114,10 +140,11 @@ export const resolveMoltnetRoomMemberships = (plan) => {
                     }
                     for (const representative of representatives) {
                         const agentNode = findAgentBySource(plan, representative.agentSource);
+                        const policy = findDirectRoomPolicy(plan, teamNode, agentNode.source, representative.memberId, network.id, room.id) ?? defaultNestedRepresentativePolicy();
                         memberships.push({
                             agentName: agentNode.name,
                             agentSource: agentNode.source,
-                            concreteMemberId: representative.memberId,
+                            concreteMemberId: resolveConcreteMemberId(plan, representative.agentSource, representative.memberId),
                             declaredSlot,
                             declaringTeamName: teamNode.name,
                             declaringTeamSource: teamNode.source,
@@ -128,6 +155,7 @@ export const resolveMoltnetRoomMemberships = (plan) => {
                             representedTeamName: childTeam.name,
                             representedTeamSource: childTeam.source,
                             representativePath: [declaredSlot, ...representative.path],
+                            ...(policy ? { policy } : {}),
                             roomId: room.id
                         });
                     }

package/dist/compiler/moltnetServerPlans.d.ts

@@ -0,0 +1,9 @@
+import type { MoltnetServerPlan } from "./moltnetArtifactTypes.js";
+import type { CompilePlan, ResolvedTeamNode } from "./types.js";
+interface TeamPlanNode {
+    id: string;
+    slug: string;
+    value: ResolvedTeamNode;
+}
+export declare const resolveMoltnetServerPlans: (plan: CompilePlan, teamNodes: readonly TeamPlanNode[]) => Map<string, MoltnetServerPlan>;
+export {};

package/dist/compiler/moltnetServerPlans.js

@@ -0,0 +1,132 @@
+import { SpawnfileError } from "../shared/index.js";
+import { createMoltnetServerConfigPath, resolveMoltnetBaseUrl } from "./moltnetConfigLowering.js";
+import { listConcreteMoltnetRoomMemberIds } from "./moltnetRoomMemberships.js";
+import { assertCompatibleMoltnetNetworkName, assertCompatibleMoltnetRoomPolicy, assertCompatibleMoltnetServer } from "./moltnetRoomPolicyCompatibility.js";
+import { resolveNetworkPort, toContainerRootfsPath } from "./moltnetArtifactPaths.js";
+const DEFAULT_MOLTNET_PORT = 8787;
+const orderedDeclarations = (teamNodes) => [...teamNodes]
+    .sort((left, right) => left.value.source.localeCompare(right.value.source))
+    .flatMap((team) => [...(team.value.networks ?? [])]
+    .sort((left, right) => left.id.localeCompare(right.id))
+    .map((network) => ({ network, team })));
+const organizationTeamIds = (plan) => {
+    const root = plan.nodes.find((node) => node.kind === "team" && node.value.source === plan.root);
+    if (!root)
+        return new Set();
+    const ids = new Set([root.id]);
+    const pending = [root.id];
+    while (pending.length > 0) {
+        const parent = pending.shift();
+        for (const edge of plan.edges.filter((entry) => entry.kind === "team_member" && entry.from === parent)) {
+            const child = plan.nodes.find((node) => node.id === edge.to);
+            if (!child || child.kind !== "team" || ids.has(child.id))
+                continue;
+            ids.add(child.id);
+            pending.push(child.id);
+        }
+    }
+    return ids;
+};
+const assertCompatibleOwner = (existing, declaration) => {
+    const { network } = declaration;
+    const server = network.server;
+    if (!server)
+        return;
+    if (existing.baseUrl !== resolveMoltnetBaseUrl(server)) {
+        throw new SpawnfileError("validation_error", `Duplicate Moltnet network ${network.id} declares conflicting server URL`);
+    }
+    assertCompatibleMoltnetNetworkName(network.id, existing.name, network.name);
+    assertCompatibleMoltnetServer(network.id, existing.server, server);
+};
+const createOwnedPlan = (declaration, fallbackPort) => {
+    const { network, team } = declaration;
+    const server = network.server;
+    if (!server) {
+        throw new SpawnfileError("validation_error", `Moltnet network ${network.id} must declare server`);
+    }
+    const port = server.mode === "managed"
+        ? resolveNetworkPort(network, fallbackPort)
+        : undefined;
+    const serverId = `${team.slug}-${network.id}`;
+    return {
+        baseUrl: resolveMoltnetBaseUrl(server),
+        ...(server.mode === "managed"
+            ? { configPath: toContainerRootfsPath(createMoltnetServerConfigPath(serverId)) }
+            : {}),
+        id: serverId,
+        mode: server.mode,
+        name: network.name,
+        networkId: network.id,
+        ...(port ? { port } : {}),
+        rooms: [],
+        server,
+        secretPatches: [],
+        teamSource: team.value.source
+    };
+};
+const mergeRooms = (plan, serverPlan, declaration) => {
+    const { network, team } = declaration;
+    for (const room of network.rooms) {
+        const concreteMembers = listConcreteMoltnetRoomMemberIds(plan, team.value, network.id, room);
+        const existingRoom = serverPlan.rooms.find((entry) => entry.id === room.id);
+        if (!existingRoom) {
+            serverPlan.rooms.push({
+                id: room.id,
+                members: concreteMembers,
+                ...(room.name ? { name: room.name } : {}),
+                ...(room.visibility ? { visibility: room.visibility } : {}),
+                ...(room.write_policy ? { write_policy: room.write_policy } : {})
+            });
+            continue;
+        }
+        existingRoom.members = [
+            ...new Set([...existingRoom.members, ...concreteMembers])
+        ].sort();
+        assertCompatibleMoltnetRoomPolicy(network.id, room.id, "visibility", existingRoom.visibility, room.visibility);
+        assertCompatibleMoltnetRoomPolicy(network.id, room.id, "write_policy", existingRoom.write_policy, room.write_policy);
+        existingRoom.visibility ??= room.visibility;
+        existingRoom.write_policy ??= room.write_policy;
+    }
+};
+export const resolveMoltnetServerPlans = (plan, teamNodes) => {
+    const organizationIds = plan.organizationIdentity
+        ? organizationTeamIds(plan)
+        : undefined;
+    const declarations = orderedDeclarations(organizationIds
+        ? teamNodes.filter((team) => organizationIds.has(team.id))
+        : teamNodes);
+    const ownerlessRoot = declarations.find((declaration) => declaration.team.value.source === plan.root && !declaration.network.server);
+    if (ownerlessRoot) {
+        throw new SpawnfileError("validation_error", `Root Moltnet network ${ownerlessRoot.network.id} must declare a server owner`);
+    }
+    const serverPlans = new Map();
+    let nextPort = DEFAULT_MOLTNET_PORT;
+    for (const declaration of declarations) {
+        if (!declaration.network.server)
+            continue;
+        const existing = serverPlans.get(declaration.network.id);
+        if (existing) {
+            assertCompatibleOwner(existing, declaration);
+            continue;
+        }
+        const serverPlan = createOwnedPlan(declaration, nextPort);
+        serverPlans.set(declaration.network.id, serverPlan);
+        if (serverPlan.port)
+            nextPort = Math.max(nextPort, serverPlan.port + 1);
+    }
+    const declarationCounts = new Map();
+    for (const declaration of declarations) {
+        const networkId = declaration.network.id;
+        const serverPlan = serverPlans.get(networkId);
+        if (!serverPlan) {
+            throw new SpawnfileError("validation_error", `Moltnet network ${networkId} must resolve to at least one server owner`);
+        }
+        declarationCounts.set(networkId, (declarationCounts.get(networkId) ?? 0) + 1);
+        mergeRooms(plan, serverPlan, declaration);
+    }
+    for (const [networkId, count] of declarationCounts) {
+        if (count > 1)
+            serverPlans.get(networkId)?.rooms.sort((left, right) => left.id.localeCompare(right.id));
+    }
+    return serverPlans;
+};

package/dist/compiler/organizationIdentity.d.ts

@@ -0,0 +1,27 @@
+import type { CompilePlan, MoltnetExternalParticipantIntent } from "./types.js";
+export declare const ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE = "^[a-z][a-z0-9-]{0,62}$";
+export declare const ORGANIZATION_MEMBER_ID_PATTERN_SOURCE = "^[a-z][a-z0-9-]{0,62}(\\.[a-z][a-z0-9-]{0,62}){0,7}$";
+export declare const MAX_ORGANIZATION_MEMBER_DEPTH = 8;
+export declare const MAX_ORGANIZATION_MEMBER_ID_BYTES = 255;
+export declare const MAX_ORGANIZATION_AGENT_MEMBERS = 128;
+export declare const MAX_EXTERNAL_PARTICIPANTS = 32;
+export interface ResolvedOrganizationAgentMember {
+    readonly authoredMemberKey: string;
+    readonly kind: "agent";
+    readonly memberId: string;
+    readonly principalId: string;
+}
+export interface ResolvedExternalParticipant {
+    readonly authoredParticipantKey: string;
+    readonly kind: "service";
+    readonly memberId: string;
+    readonly principalId: string;
+}
+export interface ResolvedOrganizationIdentity {
+    readonly agentMembers: readonly ResolvedOrganizationAgentMember[];
+    readonly externalParticipants: readonly ResolvedExternalParticipant[];
+}
+export declare const resolveCanonicalAgentMemberId: (plan: CompilePlan, agentSource: string) => string | undefined;
+export declare const resolveOrganizationIdentity: (plan: CompilePlan) => ResolvedOrganizationIdentity | undefined;
+export declare const validateB31MoltnetAuth: (plan: CompilePlan) => void;
+export declare const resolveMoltnetExternalParticipantIntents: (plan: CompilePlan) => MoltnetExternalParticipantIntent[];

package/dist/compiler/organizationIdentity.js

@@ -0,0 +1,297 @@
+import { SpawnfileError } from "../shared/index.js";
+export const ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE = "^[a-z][a-z0-9-]{0,62}$";
+export const ORGANIZATION_MEMBER_ID_PATTERN_SOURCE = "^[a-z][a-z0-9-]{0,62}(\\.[a-z][a-z0-9-]{0,62}){0,7}$";
+export const MAX_ORGANIZATION_MEMBER_DEPTH = 8;
+export const MAX_ORGANIZATION_MEMBER_ID_BYTES = 255;
+export const MAX_ORGANIZATION_AGENT_MEMBERS = 128;
+export const MAX_EXTERNAL_PARTICIPANTS = 32;
+const segment = new RegExp(ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE, "u");
+const memberIdPattern = new RegExp(ORGANIZATION_MEMBER_ID_PATTERN_SOURCE, "u");
+const fail = (message) => { throw new SpawnfileError("validation_error", message); };
+const required = (value, message) => value == null ? fail(message) : value;
+const assertSegment = (value, label) => {
+    if (!segment.test(value))
+        fail(`${label} must match ${ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE}`);
+};
+const freeze = (value) => {
+    if (value && typeof value === "object") {
+        Object.freeze(value);
+        for (const child of Object.values(value))
+            freeze(child);
+    }
+    return value;
+};
+const byAscii = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const exact = (actual, expected) => actual?.length === expected.length && actual.every((value, index) => value === expected[index]);
+const teamNodes = (plan) => new Map(plan.nodes.filter((node) => node.kind === "team").map((node) => [node.value.source, node.value]));
+const rootTeam = (plan) => {
+    const node = plan.nodes.find((entry) => entry.id === plan.root || entry.value.source === plan.root);
+    return node?.value.kind === "team" ? node.value : undefined;
+};
+const pathsToAgents = (plan) => {
+    const teams = teamNodes(plan);
+    const edges = plan.edges.filter((edge) => edge.kind === "team_member");
+    const paths = new Map();
+    const teamPaths = new Map();
+    const visitedNodeIds = new Set();
+    const walk = (source, prefix, seen) => {
+        if (seen.has(source))
+            fail(`organization member graph cycle at ${source}`);
+        const team = teams.get(source);
+        if (!team)
+            return;
+        const priorTeamPath = teamPaths.get(source);
+        if (priorTeamPath)
+            fail(`team is reached through multiple organization paths: ${source}`);
+        teamPaths.set(source, prefix);
+        const node = plan.nodes.find((entry) => entry.value.source === source);
+        if (!node || node.kind !== "team")
+            return fail(`organization graph references missing team ${source}`);
+        const resolvedNode = node;
+        visitedNodeIds.add(resolvedNode.id);
+        const outgoing = edges
+            .filter((entry) => entry.from === resolvedNode.id)
+            .sort((left, right) => byAscii(left.label, right.label));
+        const memberSlots = new Set(team.members.map((member) => member.id));
+        if (memberSlots.size !== team.members.length || outgoing.length !== team.members.length) {
+            fail(`organization graph cardinality mismatch for team ${team.name}`);
+        }
+        const localSlots = new Set();
+        for (const edge of outgoing) {
+            if (localSlots.has(edge.label))
+                fail(`duplicate organization member slot: ${edge.label}`);
+            localSlots.add(edge.label);
+            assertSegment(edge.label, "organization member slot");
+            const next = [...prefix, edge.label];
+            if (next.length > MAX_ORGANIZATION_MEMBER_DEPTH)
+                fail("organization member depth exceeds 8");
+            const child = plan.nodes.find((node) => node.id === edge.to);
+            if (!child)
+                throw new SpawnfileError("validation_error", `organization graph references missing node ${edge.to}`);
+            const resolvedChild = child;
+            const member = team.members.find((entry) => entry.id === edge.label);
+            if (!member || member.kind !== resolvedChild.kind || member.nodeSource !== resolvedChild.value.source) {
+                fail(`organization graph member edge mismatch: ${edge.label}`);
+            }
+            if (resolvedChild.kind === "agent") {
+                const previous = paths.get(resolvedChild.value.source);
+                if (previous)
+                    fail(`agent source is reached through multiple organization paths: ${resolvedChild.value.source}`);
+                paths.set(resolvedChild.value.source, next);
+                visitedNodeIds.add(resolvedChild.id);
+            }
+            else
+                walk(resolvedChild.value.source, next, new Set([...seen, source]));
+        }
+    };
+    walk(plan.root, [], new Set());
+    const rootNode = plan.nodes.find((node) => node.value.source === plan.root);
+    const organizationNodeIds = new Set(rootNode ? [rootNode.id] : []);
+    for (const edge of edges) {
+        organizationNodeIds.add(edge.from);
+        organizationNodeIds.add(edge.to);
+    }
+    const extra = plan.nodes.find((node) => organizationNodeIds.has(node.id) && !visitedNodeIds.has(node.id));
+    if (extra)
+        fail(`unreachable organization graph node: ${extra.id}`);
+    return paths;
+};
+export const resolveCanonicalAgentMemberId = (plan, agentSource) => {
+    const identity = plan.organizationIdentity;
+    if (!identity)
+        return undefined;
+    const path = pathsToAgents(plan).get(agentSource);
+    return path?.join(".");
+};
+export const resolveOrganizationIdentity = (plan) => {
+    const root = rootTeam(plan);
+    const declaredTeams = plan.nodes.filter((node) => node.kind === "team" && node.value.externalParticipants !== undefined);
+    if (declaredTeams.some((node) => node.value.source !== root?.source)) {
+        fail("external_participants may only be declared on the root team");
+    }
+    if (!root?.externalParticipants)
+        return undefined;
+    const paths = pathsToAgents(plan);
+    const agents = [];
+    const agentIds = new Set();
+    for (const node of plan.nodes.filter((entry) => entry.kind === "agent")) {
+        const path = paths.get(node.value.source);
+        if (!path)
+            continue;
+        if (path.length > MAX_ORGANIZATION_MEMBER_DEPTH)
+            fail("organization member depth exceeds 8");
+        path.forEach((part) => assertSegment(part, "organization member slot"));
+        const memberId = path.join(".");
+        if (!memberIdPattern.test(memberId) || Buffer.byteLength(memberId, "ascii") > MAX_ORGANIZATION_MEMBER_ID_BYTES)
+            fail(`invalid organization member id: ${memberId}`);
+        if (agentIds.has(memberId))
+            fail(`duplicate organization member id: ${memberId}`);
+        agentIds.add(memberId);
+        agents.push({ authoredMemberKey: path.at(-1), kind: "agent", memberId, principalId: `agent:${memberId}` });
+    }
+    if (agents.length > MAX_ORGANIZATION_AGENT_MEMBERS)
+        fail("organization has too many agent members");
+    const seen = new Set();
+    const externalParticipants = root.externalParticipants.map((service) => {
+        assertSegment(service.id, "external participant id");
+        if (seen.has(service.id))
+            fail(`organization member collision: ${service.id}`);
+        seen.add(service.id);
+        return { authoredParticipantKey: service.id, kind: "service", memberId: service.id, principalId: `system:${service.id}` };
+    });
+    for (const agent of agents)
+        if (seen.has(agent.memberId))
+            fail(`organization member collision: ${agent.memberId}`);
+    if (externalParticipants.length > MAX_EXTERNAL_PARTICIPANTS)
+        fail("too many external participants");
+    const result = { agentMembers: agents.sort((a, b) => byAscii(a.memberId, b.memberId)), externalParticipants: externalParticipants.sort((a, b) => byAscii(a.memberId, b.memberId)) };
+    return freeze(structuredClone(result));
+};
+const actorTokenFor = (server, tokenId, memberId, allowObserve = false) => {
+    const token = server.auth.tokens?.filter((entry) => entry.id === tokenId);
+    if (token?.length !== 1)
+        fail(`Moltnet actor token ${tokenId} must exist exactly once`);
+    const selected = required(token?.[0], `Moltnet actor token ${tokenId} must exist exactly once`);
+    const validScopes = exact(selected.scopes, ["attach", "write"])
+        || allowObserve && exact(selected.scopes, ["attach", "observe", "write"]);
+    if (!validScopes || !exact(selected.agents, [memberId])) {
+        fail(`Moltnet actor token ${tokenId} has invalid scopes or agents for ${memberId}`);
+    }
+    return selected;
+};
+export const validateB31MoltnetAuth = (plan) => {
+    const root = rootTeam(plan);
+    if (!root?.externalParticipants)
+        return;
+    const identity = plan.organizationIdentity;
+    const resolvedIdentity = required(identity, "B31 organization identity is missing");
+    const paths = pathsToAgents(plan);
+    const agentBySource = new Map(resolvedIdentity.agentMembers.map((member) => {
+        const source = [...paths.entries()].find(([, path]) => path.join(".") === member.memberId)?.[0];
+        return [source, member];
+    }));
+    const networkIds = new Set(root.externalParticipants.flatMap((service) => service.surfaces.moltnet.map((attachment) => attachment.network)));
+    for (const network of root.networks ?? []) {
+        if (!root.externalParticipants.some((service) => service.surfaces.moltnet.some((attachment) => attachment.network === network.id)))
+            continue;
+        assertSegment(network.id, "B31 network id");
+        if (network.server?.mode !== "managed" || network.server.auth.mode !== "bearer" || network.server.direct_messages !== true) {
+            fail(`B31 network ${network.id} requires managed bearer direct_messages`);
+        }
+        const server = network.server;
+        const managedServer = required(server, `B31 network ${network.id} requires a managed server`);
+        if (JSON.stringify(managedServer.auth.client) !== JSON.stringify({ token_id: "operator" })) {
+            fail(`B31 network ${network.id} requires auth.client token_id operator`);
+        }
+        const tokens = managedServer.auth.tokens ?? [];
+        const operator = tokens.find((token) => token.id === "operator");
+        if (tokens.filter((token) => token.id === "operator").length !== 1 || !operator || operator.agents !== undefined || !exact(operator.scopes, ["admin", "observe", "write"])) {
+            fail(`B31 network ${network.id} has invalid operator token`);
+        }
+        const operatorSecret = operator?.secret;
+        const usedTokenIds = new Set();
+        const usedEnvNames = new Set();
+        for (const token of tokens) {
+            assertSegment(token.id, "Moltnet token id");
+            if (!/^[A-Z_][A-Z0-9_]{0,127}$/u.test(token.secret))
+                fail(`invalid Moltnet token env name ${token.secret}`);
+            if (usedTokenIds.has(token.id) || usedEnvNames.has(token.secret))
+                fail(`duplicate Moltnet token identity ${token.id}`);
+            usedTokenIds.add(token.id);
+            usedEnvNames.add(token.secret);
+            if (token.id !== "operator" && token.secret === operatorSecret)
+                fail("operator and actor token env identities must differ");
+        }
+    }
+    const selectedByNetwork = new Map();
+    const selectedActorKeys = new Set();
+    for (const member of resolvedIdentity.agentMembers) {
+        const source = [...agentBySource.entries()].find(([, value]) => value.memberId === member.memberId)?.[0];
+        const node = plan.nodes.find((entry) => entry.kind === "agent" && entry.value.source === source);
+        const attachments = node?.value?.surfaces?.moltnet ?? [];
+        for (const attachment of attachments.filter((entry) => networkIds.has(entry.network))) {
+            const network = root.networks?.find((entry) => entry.id === attachment.network);
+            const selectedTokenId = required(attachment.auth?.tokenId, `B31 agent ${member.memberId} must select auth.token_id`);
+            const actorKey = `${attachment.network}\u0000${member.memberId}`;
+            if (selectedActorKeys.has(actorKey))
+                fail(`B31 actor ${member.memberId} selects more than one token on ${attachment.network}`);
+            selectedActorKeys.add(actorKey);
+            if (network?.server?.mode === "managed") {
+                const token = actorTokenFor(network.server, selectedTokenId, member.memberId);
+                const selected = selectedByNetwork.get(attachment.network) ?? new Map();
+                const previous = selected.get(selectedTokenId);
+                if (previous)
+                    fail(`Moltnet actor token ${selectedTokenId} is shared by ${previous} and ${member.memberId}`);
+                selected.set(selectedTokenId, member.memberId);
+                selectedByNetwork.set(attachment.network, selected);
+                if (token.id === "operator")
+                    fail(`B31 actor ${member.memberId} must not use operator token`);
+            }
+        }
+    }
+    for (const service of root.externalParticipants) {
+        for (const attachment of service.surfaces.moltnet) {
+            const network = root.networks?.find((entry) => entry.id === attachment.network);
+            if (network?.server?.mode !== "managed")
+                continue;
+            const token = actorTokenFor(network.server, attachment.auth.token_id, service.id, true);
+            if (token.id === "operator")
+                fail(`B31 external participant ${service.id} must not use operator token`);
+            const selected = selectedByNetwork.get(attachment.network) ?? new Map();
+            const previous = selected.get(token.id);
+            if (previous)
+                fail(`Moltnet actor token ${token.id} is shared by ${previous} and ${service.id}`);
+            selected.set(token.id, service.id);
+            selectedByNetwork.set(attachment.network, selected);
+        }
+    }
+    for (const network of root.networks ?? []) {
+        const selected = selectedByNetwork.get(network.id);
+        if (network.server?.mode === "managed" && selected) {
+            for (const token of network.server.auth.tokens ?? []) {
+                if (token.id !== "operator" && !selected.has(token.id)) {
+                    fail(`Moltnet actor token ${token.id} is not selected by exactly one actor`);
+                }
+            }
+        }
+    }
+};
+export const resolveMoltnetExternalParticipantIntents = (plan) => {
+    const identity = plan.organizationIdentity;
+    const root = rootTeam(plan);
+    if (!identity || !root?.externalParticipants)
+        return [];
+    const paths = pathsToAgents(plan);
+    const agents = new Map(identity.agentMembers.map((member) => [member.memberId, member]));
+    const networkIds = new Set((root.networks ?? []).map((network) => network.id));
+    const result = [];
+    for (const service of root.externalParticipants) {
+        const participant = identity.externalParticipants.find((entry) => entry.memberId === service.id);
+        if (!participant)
+            throw new SpawnfileError("validation_error", `missing external participant identity: ${service.id}`);
+        const resolvedParticipant = participant;
+        for (const attachment of service.surfaces.moltnet) {
+            if (!networkIds.has(attachment.network))
+                fail(`external participant ${service.id} references unknown network ${attachment.network}`);
+            const peers = [];
+            for (const [memberId, agent] of agents) {
+                const node = plan.nodes.find((entry) => entry.kind === "agent" && paths.get(entry.value.source)?.join(".") === memberId);
+                const authored = node?.value?.surfaces?.moltnet ?? [];
+                const eligible = authored.filter((entry) => entry.network === attachment.network && entry.dms?.enabled === true);
+                if (eligible.length > 1)
+                    fail(`duplicate eligible Moltnet peer for ${service.id}/${attachment.network}`);
+                if (eligible.length === 1)
+                    peers.push(agent.memberId);
+            }
+            if (new Set(peers).size !== peers.length)
+                fail(`duplicate eligible Moltnet peer for ${service.id}/${attachment.network}`);
+            if (peers.length === 0)
+                fail(`external participant ${service.id}/${attachment.network} has no eligible direct-message peers`);
+            peers.sort(byAscii);
+            const network = root.networks?.find((entry) => entry.id === attachment.network);
+            const token = network?.server?.mode === "managed" ? actorTokenFor(network.server, attachment.auth.token_id, service.id, true) : undefined;
+            result.push({ participant: resolvedParticipant, networkId: attachment.network, tokenId: attachment.auth.token_id, tokenEnv: token?.secret ?? "", directMessagePeers: peers });
+        }
+    }
+    return result;
+};

package/dist/compiler/organizationReadyEvidence.d.ts

@@ -0,0 +1,49 @@
+import { WORLD_BINDINGS_IMAGE_PATH } from "../distribution/types.js";
+import type { GeneratedContainerArtifacts } from "./containerArtifacts.js";
+import type { MoltnetArtifacts } from "./moltnetArtifacts.js";
+import type { CompilePlan } from "./types.js";
+import type { ResolvedWorldBindings } from "./worldBindings.js";
+export declare const ORGANIZATION_READINESS_EVIDENCE_VERSION: "spawnfile.organization-ready-evidence.v1";
+export interface OrganizationReadinessEvidence {
+    readonly version: typeof ORGANIZATION_READINESS_EVIDENCE_VERSION;
+    readonly compileFingerprint: string;
+    readonly compileVersion: string;
+    readonly projectLabel: string;
+    readonly organizationMembers: readonly {
+        readonly memberId: string;
+        readonly nodeId: string;
+    }[];
+    readonly worldBindings: {
+        readonly schema: "simfile.world-bindings.v1";
+        readonly artifactPath: typeof WORLD_BINDINGS_IMAGE_PATH;
+        readonly digest: string;
+        readonly assignments: readonly {
+            readonly memberId: string;
+            readonly nodeId: string;
+        }[];
+    } | null;
+    readonly networks: readonly {
+        readonly id: string;
+        readonly mode: "external" | "managed";
+        readonly internalPort: number | null;
+        readonly rooms: readonly {
+            readonly id: string;
+            readonly members: readonly string[];
+        }[];
+        readonly nodes: readonly {
+            readonly nodeId: string;
+            readonly memberId: string;
+            readonly configPath: string;
+            readonly sha256: string;
+        }[];
+    }[];
+    readonly hasExternalMoltnet: boolean;
+}
+export interface CreateOrganizationReadinessEvidenceInput {
+    compileVersion: string;
+    containerArtifacts: GeneratedContainerArtifacts;
+    moltnetArtifacts: MoltnetArtifacts | null;
+    plan: CompilePlan;
+    worldBindings?: ResolvedWorldBindings;
+}
+export declare const createOrganizationReadinessEvidence: (input: CreateOrganizationReadinessEvidenceInput) => OrganizationReadinessEvidence;