spawnfile 0.1.13 → 0.1.14

package/dist/manifest/schemas.js

@@ -1,7 +1,10 @@
 import { z } from "zod";
 import { agentScheduleSchema } from "./scheduleSchemas.js";
 import { executionSchema } from "./executionSchemas.js";
+import { memoryBanksSchema } from "./memorySchemas.js";
+import { mcpServerSchema } from "./mcpSchemas.js";
 import { surfacesSchema } from "./surfaceSchemas.js";
+import { externalParticipantServiceSchema } from "./externalParticipantSchemas.js";
 import { teamNetworkSchema, teamWorkspaceSchema } from "./teamNetworkSchemas.js";
 const skillRequirementSchema = z
     .object({
@@ -14,36 +17,6 @@ const skillReferenceSchema = z
     requires: skillRequirementSchema.optional()
 })
     .strict();
-const mcpAuthSchema = z
-    .object({
-    secret: z.string()
-})
-    .strict();
-const mcpServerSchema = z
-    .object({
-    args: z.array(z.string()).optional(),
-    auth: mcpAuthSchema.optional(),
-    command: z.string().optional(),
-    env: z.record(z.string(), z.string()).optional(),
-    name: z.string(),
-    transport: z.enum(["sse", "stdio", "streamable_http"]),
-    url: z.string().optional()
-})
-    .strict()
-    .superRefine((value, context) => {
-    if (value.transport === "stdio" && !value.command) {
-        context.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "stdio MCP servers must declare command"
-        });
-    }
-    if (value.transport !== "stdio" && !value.url) {
-        context.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: `${value.transport} MCP servers must declare url`
-        });
-    }
-});
 const runtimeBindingSchema = z.union([
     z.string().min(1),
     z
@@ -111,6 +84,7 @@ const commonManifestSchema = z
     description: z.string().optional(),
     execution: executionSchema.optional(),
     kind: z.enum(["agent", "team"]),
+    memory: memoryBanksSchema.optional(),
     name: z
         .string()
         .min(1)
@@ -132,26 +106,71 @@ const sharedSurfaceSchema = z
     workspace: teamWorkspaceSchema.optional()
 })
     .strict();
-const memberSchema = z
+const referencedMemberSchema = z
     .object({
     id: z.string().min(1),
     ref: z.string()
 })
     .strict();
+const refineAgentMemoryAccess = (value, context) => {
+    for (const memory of value.memory ?? []) {
+        if (memory.access?.members) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "agent memory banks must not declare access.members"
+            });
+        }
+    }
+};
+const inlineAgentMemberSchema = z
+    .object({
+    description: z.string().optional(),
+    environment: environmentSchema.optional(),
+    execution: executionSchema.optional(),
+    expose: z.boolean().optional(),
+    id: z.string().min(1),
+    memory: memoryBanksSchema.optional(),
+    policy: policySchema.optional(),
+    runtime: runtimeBindingSchema.optional(),
+    schedule: agentScheduleSchema.optional(),
+    surfaces: surfacesSchema.optional(),
+    workspace: teamWorkspaceSchema
+})
+    .strict()
+    .superRefine((value, context) => {
+    refineAgentMemoryAccess(value, context);
+    if (!value.workspace.docs?.system) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "inline agent members must declare workspace.docs.system",
+            path: ["workspace", "docs", "system"]
+        });
+    }
+});
+const memberSchema = z.union([
+    referencedMemberSchema,
+    inlineAgentMemberSchema
+], {
+    error: "team member must be either {id, ref} or an inline agent declaring workspace.docs.system"
+});
 const agentManifestSchema = commonManifestSchema
     .extend({
     expose: z.boolean().optional(),
     kind: z.literal("agent"),
     environment: environmentSchema.optional(),
+    memory: memoryBanksSchema.optional(),
     runtime: runtimeBindingSchema.optional(),
     schedule: agentScheduleSchema.optional(),
     subagents: z.array(subagentSchema).optional(),
     workspace: teamWorkspaceSchema.optional()
 })
+    .superRefine(refineAgentMemoryAccess)
     .strict();
 const teamManifestSchema = commonManifestSchema
     .extend({
+    memory: memoryBanksSchema.optional(),
     external: z.array(z.string().min(1)).optional(),
+    external_participants: z.array(externalParticipantServiceSchema).min(1).max(32).optional(),
     kind: z.literal("team"),
     lead: z.string().min(1).optional(),
     members: z.array(memberSchema),
@@ -194,9 +213,11 @@ const teamManifestSchema = commonManifestSchema
             });
         }
         for (const network of value.networks) {
+            const externalRoomMembers = new Set(value.external_participants?.filter((participant) => participant.surfaces.moltnet.some((attachment) => attachment.network === network.id))
+                .map((participant) => participant.id) ?? []);
             for (const room of network.rooms) {
                 for (const memberId of room.members) {
-                    if (!memberIds.has(memberId)) {
+                    if (!memberIds.has(memberId) && !externalRoomMembers.has(memberId)) {
                         context.addIssue({
                             code: z.ZodIssueCode.custom,
                             message: `network ${network.id} room ${room.id} references unknown member ${memberId}`
@@ -204,6 +225,29 @@ const teamManifestSchema = commonManifestSchema
                     }
                 }
             }
+            const externalAttached = value.external_participants?.some((participant) => participant.surfaces.moltnet.some((attachment) => attachment.network === network.id)) === true;
+            const operatorClient = network.server?.mode === "managed" &&
+                network.server.auth.mode === "bearer" &&
+                network.server.auth.client?.token_id === "operator";
+            const operatorOnly = operatorClient &&
+                network.server?.auth.tokens?.some((token) => token.id === "operator" && token.agents === undefined &&
+                    token.scopes.length === 3 && token.scopes.every((scope, index) => scope === ["admin", "observe", "write"][index])) === true;
+            if ((operatorOnly && !externalAttached) || (operatorClient && externalAttached && !operatorOnly)) {
+                context.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    message: `network ${network.id} topology operator requires a same-network external participant attachment`
+                });
+            }
+        }
+    }
+    for (const memory of value.memory ?? []) {
+        for (const memberId of memory.access?.members ?? []) {
+            if (!memberIds.has(memberId)) {
+                context.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    message: `memory ${memory.id} access references unknown member ${memberId}`
+                });
+            }
         }
     }
 })
@@ -214,3 +258,5 @@ export const manifestSchema = z.discriminatedUnion("kind", [
 ]);
 export const isAgentManifest = (manifest) => manifest.kind === "agent";
 export const isTeamManifest = (manifest) => manifest.kind === "team";
+export const isInlineAgentMember = (member) => !("ref" in member);
+export const isReferencedMember = (member) => "ref" in member;

package/dist/manifest/surfaceSchemas.d.ts

@@ -124,8 +124,15 @@ declare const moltnetDmSchema: z.ZodObject<{
         mentions: "mentions";
         thread_only: "thread_only";
     }>>;
+    allowed_wake_senders: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+declare const moltnetAttachmentAuthSchema: z.ZodObject<{
+    token_id: z.ZodString;
 }, z.core.$strict>;
 declare const moltnetAttachmentSchema: z.ZodObject<{
+    auth: z.ZodOptional<z.ZodObject<{
+        token_id: z.ZodString;
+    }, z.core.$strict>>;
     dms: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodBoolean;
         wake: z.ZodOptional<z.ZodEnum<{
@@ -134,6 +141,7 @@ declare const moltnetAttachmentSchema: z.ZodObject<{
             mentions: "mentions";
             thread_only: "thread_only";
         }>>;
+        allowed_wake_senders: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
     network: z.ZodString;
     rooms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -146,6 +154,9 @@ declare const moltnetAttachmentSchema: z.ZodObject<{
     }, z.core.$strict>>>;
 }, z.core.$strict>;
 declare const moltnetSurfaceSchema: z.ZodArray<z.ZodObject<{
+    auth: z.ZodOptional<z.ZodObject<{
+        token_id: z.ZodString;
+    }, z.core.$strict>>;
     dms: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodBoolean;
         wake: z.ZodOptional<z.ZodEnum<{
@@ -154,6 +165,7 @@ declare const moltnetSurfaceSchema: z.ZodArray<z.ZodObject<{
             mentions: "mentions";
             thread_only: "thread_only";
         }>>;
+        allowed_wake_senders: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
     network: z.ZodString;
     rooms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -183,6 +195,9 @@ export declare const surfacesSchema: z.ZodObject<{
         }, z.core.$strict>>;
     }, z.core.$strict>>;
     moltnet: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        auth: z.ZodOptional<z.ZodObject<{
+            token_id: z.ZodString;
+        }, z.core.$strict>>;
         dms: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodBoolean;
             wake: z.ZodOptional<z.ZodEnum<{
@@ -191,6 +206,7 @@ export declare const surfacesSchema: z.ZodObject<{
                 mentions: "mentions";
                 thread_only: "thread_only";
             }>>;
+            allowed_wake_senders: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
         network: z.ZodString;
         rooms: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -259,6 +275,7 @@ export type HttpSurfaceAccess = never;
 export type HttpSurfaceAuth = never;
 export type HttpSurface = never;
 export type MoltnetAttachment = z.infer<typeof moltnetAttachmentSchema>;
+export type MoltnetAttachmentAuth = z.infer<typeof moltnetAttachmentAuthSchema>;
 export type MoltnetDM = z.infer<typeof moltnetDmSchema>;
 export type MoltnetRoomBehavior = z.infer<typeof moltnetRoomBehaviorSchema>;
 export type MoltnetSurface = z.infer<typeof moltnetSurfaceSchema>;

package/dist/manifest/surfaceSchemas.js

@@ -179,6 +179,22 @@ const webhookSurfaceSchema = z
 })
     .strict();
 const moltnetWakeSchema = z.enum(["all", "mentions", "thread_only", "never"]);
+const moltnetWakeSenderSchema = z
+    .string()
+    .regex(/^[a-z][a-z0-9-]{0,62}$/u, {
+    message: "moltnet allowed wake senders must match ^[a-z][a-z0-9-]{0,62}$"
+});
+const moltnetAllowedWakeSendersSchema = z
+    .array(moltnetWakeSenderSchema)
+    .max(32)
+    .superRefine((value, context) => {
+    if (new Set(value).size !== value.length) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "moltnet allowed_wake_senders must be unique"
+        });
+    }
+});
 const moltnetRoomBehaviorSchema = z
     .object({
     wake: moltnetWakeSchema.optional()
@@ -187,11 +203,18 @@ const moltnetRoomBehaviorSchema = z
 const moltnetDmSchema = z
     .object({
     enabled: z.boolean(),
-    wake: moltnetWakeSchema.optional()
+    wake: moltnetWakeSchema.optional(),
+    allowed_wake_senders: moltnetAllowedWakeSendersSchema.optional()
+})
+    .strict();
+const moltnetAttachmentAuthSchema = z
+    .object({
+    token_id: z.string().trim().min(1)
 })
     .strict();
 const moltnetAttachmentSchema = z
     .object({
+    auth: moltnetAttachmentAuthSchema.optional(),
     dms: moltnetDmSchema.optional(),
     network: z.string().min(1),
     rooms: z.record(z.string().min(1), moltnetRoomBehaviorSchema).optional()

package/dist/manifest/teamNetworkAccessSchemas.d.ts

@@ -5,8 +5,8 @@ export declare const teamNetworkAgentRegistrationSchema: z.ZodEnum<{
     open: "open";
 }>;
 export declare const teamNetworkRoomVisibilitySchema: z.ZodEnum<{
-    public: "public";
     private: "private";
+    public: "public";
 }>;
 export declare const teamNetworkRoomWritePolicySchema: z.ZodEnum<{
     members: "members";

package/dist/manifest/teamNetworkAuthSchemas.d.ts

@@ -0,0 +1,48 @@
+import { z } from "zod";
+export declare const countTruthy: (value: unknown[]) => number;
+declare const teamNetworkAuthTokenSchema: z.ZodObject<{
+    agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    id: z.ZodString;
+    secret: z.ZodString;
+    scopes: z.ZodArray<z.ZodEnum<{
+        observe: "observe";
+        write: "write";
+        admin: "admin";
+        attach: "attach";
+        pair: "pair";
+    }>>;
+}, z.core.$strict>;
+export declare const isTopologyOperatorToken: (token: z.infer<typeof teamNetworkAuthTokenSchema>) => boolean;
+export declare const teamNetworkAuthSchema: z.ZodObject<{
+    agent_registration: z.ZodOptional<z.ZodEnum<{
+        token: "token";
+        disabled: "disabled";
+        open: "open";
+    }>>;
+    client: z.ZodOptional<z.ZodObject<{
+        static_token: z.ZodOptional<z.ZodBoolean>;
+        token_env: z.ZodOptional<z.ZodString>;
+        token_id: z.ZodOptional<z.ZodString>;
+        token_path: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    mode: z.ZodEnum<{
+        none: "none";
+        bearer: "bearer";
+        open: "open";
+    }>;
+    public_read: z.ZodOptional<z.ZodBoolean>;
+    tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        id: z.ZodString;
+        secret: z.ZodString;
+        scopes: z.ZodArray<z.ZodEnum<{
+            observe: "observe";
+            write: "write";
+            admin: "admin";
+            attach: "attach";
+            pair: "pair";
+        }>>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type TeamNetworkAuth = z.infer<typeof teamNetworkAuthSchema>;
+export {};

package/dist/manifest/teamNetworkAuthSchemas.js

@@ -0,0 +1,103 @@
+import { z } from "zod";
+import { teamNetworkAgentRegistrationSchema } from "./teamNetworkAccessSchemas.js";
+const moltnetScopeSchema = z.enum(["observe", "write", "admin", "attach", "pair"]);
+export const countTruthy = (value) => value.filter((entry) => Boolean(entry)).length;
+const teamNetworkAuthTokenSchema = z
+    .object({
+    agents: z.array(z.string().trim().min(1)).optional(),
+    id: z.string().trim().min(1),
+    secret: z.string().trim().min(1),
+    scopes: z.array(moltnetScopeSchema).min(1)
+})
+    .strict();
+export const isTopologyOperatorToken = (token) => token.id === "operator" &&
+    token.agents === undefined &&
+    token.scopes.length === 3 &&
+    token.scopes.every((scope, index) => scope === ["admin", "observe", "write"][index]);
+const teamNetworkAuthClientSchema = z
+    .object({
+    static_token: z.boolean().optional(),
+    token_env: z.string().trim().min(1).optional(),
+    token_id: z.string().trim().min(1).optional(),
+    token_path: z.string().trim().min(1).optional()
+})
+    .strict()
+    .superRefine((value, context) => {
+    const tokenSourceCount = countTruthy([value.token_id, value.token_env, value.token_path]);
+    if (tokenSourceCount > 1) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "auth.client must declare exactly one of token_id, token_env, or token_path"
+        });
+    }
+    if (value.static_token === true && tokenSourceCount === 0) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "auth.client.static_token requires exactly one token source"
+        });
+    }
+});
+export const teamNetworkAuthSchema = z
+    .object({
+    agent_registration: teamNetworkAgentRegistrationSchema.optional(),
+    client: teamNetworkAuthClientSchema.optional(),
+    mode: z.enum(["none", "bearer", "open"]),
+    public_read: z.boolean().optional(),
+    tokens: z.array(teamNetworkAuthTokenSchema).optional()
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.mode === "none") {
+        if (value.tokens && value.tokens.length > 0) {
+            context.addIssue({ code: z.ZodIssueCode.custom, message: "auth.mode none must not declare tokens" });
+        }
+        if (value.client) {
+            context.addIssue({ code: z.ZodIssueCode.custom, message: "auth.mode none must not declare client" });
+        }
+        return;
+    }
+    if (value.mode === "bearer" && !value.client && value.agent_registration !== "open") {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "auth.mode bearer requires auth.client unless agent_registration is open"
+        });
+    }
+    if (value.mode === "open" && value.client) {
+        const tokenSourceCount = countTruthy([
+            value.client.token_id,
+            value.client.token_env,
+            value.client.token_path
+        ]);
+        if (value.client.static_token !== true) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "open auth with auth.client requires static_token: true"
+            });
+        }
+        if (tokenSourceCount === 0) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "open auth with auth.client requires exactly one token source"
+            });
+        }
+    }
+    if (value.mode === "open" && value.agent_registration && value.agent_registration !== "open") {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "auth.mode open requires agent_registration open when declared"
+        });
+    }
+    if (value.tokens) {
+        const tokenIds = value.tokens.map((token) => token.id);
+        if (new Set(tokenIds).size !== tokenIds.length) {
+            context.addIssue({ code: z.ZodIssueCode.custom, message: "auth.tokens ids must be unique" });
+        }
+        const tokenSecrets = value.tokens.map((token) => token.secret);
+        if (new Set(tokenSecrets).size !== tokenSecrets.length) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "auth.tokens secret environment bindings must be unique"
+            });
+        }
+    }
+});