spawnfile 0.1.13 → 0.1.17

package/dist/compiler/containerArtifacts.js

@@ -1,109 +1,87 @@
-import { buildDistributionReport, createDistributionImageLabels, DISTRIBUTION_REPORT_OUTPUT_FILE, normalizeProjectLabelSlug } from "../distribution/index.js";
+import { createHash } from "node:crypto";
+import { buildDistributionReport, createDistributionImageLabels, DISTRIBUTION_REPORT_OUTPUT_FILE, normalizeProjectLabelSlug, WORLD_BINDINGS_IMAGE_PATH } from "../distribution/index.js";
+import { DAIMON_LOCAL_RUNTIME_IDENTITY_ENV, loadLocalDaimonRuntimeIdentity } from "../runtime/index.js";
 import { SpawnfileError } from "../shared/index.js";
+import { createMoltnetSummary, createOrganizationSummary } from "./containerArtifactSummaries.js";
 import { createEnvVariableMap, createRuntimeTargetPlans } from "./containerArtifactsPlans.js";
+import { createDockerIgnoreContent } from "./dockerBuildContext.js";
+import { createDaimonTelemetryArtifacts } from "./daimonTelemetryArtifacts.js";
 import { createRootfsFiles, renderDockerfile, renderEntrypoint, renderEnvExample } from "./containerArtifactsRender.js";
-const createOrganizationSummary = (plan, compiledNodes) => {
-    const nodes = compiledNodes.map((node) => ({
-        id: node.id ?? `${node.kind}:${node.slug}`,
-        kind: node.kind,
-        name: node.value.name,
-        runtimeName: node.runtimeName,
-        source: node.value.source
-    }));
-    const rootNode = nodes.find((node) => node.source === plan.root)
-        ?? nodes.find((node) => !plan.edges.some((edge) => edge.to === node.id))
-        ?? nodes[0];
-    if (!rootNode) {
-        throw new SpawnfileError("compile_error", `Unable to resolve the root node for ${plan.root}`);
-    }
-    const memberEdges = plan.edges.filter((edge) => edge.kind === "team_member");
-    const teamsByAgent = new Map();
-    for (const edge of memberEdges) {
-        teamsByAgent.set(edge.to, [...(teamsByAgent.get(edge.to) ?? []), edge.from]);
-    }
-    const agentNodes = nodes.filter((node) => node.kind === "agent");
-    const teamNodes = nodes.filter((node) => node.kind === "team");
-    const agentIds = new Set(agentNodes.map((node) => node.id));
-    return {
-        agents: agentNodes
-            .map((node) => ({
-            id: node.id,
-            name: node.name,
-            runtime: node.runtimeName,
-            teams: [...(teamsByAgent.get(node.id) ?? [])].sort()
-        }))
-            .sort((left, right) => left.id.localeCompare(right.id)),
-        project: rootNode.name,
-        teams: teamNodes
-            .map((node) => ({
-            agents: memberEdges
-                .filter((edge) => edge.from === node.id && agentIds.has(edge.to))
-                .map((edge) => edge.to)
-                .sort(),
-            id: node.id,
-            name: node.name
-        }))
-            .sort((left, right) => left.id.localeCompare(right.id))
-    };
+import { createMemoryArtifactBundle } from "./memoryArtifacts.js";
+import { resolveWorkspaceResourceVolumes } from "./containerTargetResources.js";
+import { mergePersistentMounts } from "./containerPersistentMounts.js";
+import { SIMFILE_WORLD_BINDINGS_VERSION, WORLD_BINDINGS_OUTPUT_FILE } from "./worldBindings.js";
+/**
+ * Enforces the `specs/SURFACES.md` Moltnet/daimon promise: "A release without
+ * `daimon-bridge` is rejected; the public pi-only release cannot be relabeled
+ * as dual-capability."
+ *
+ * A daimon Moltnet attachment lowers a node runtime config of
+ * `kind: "daimon"` carrying `agent_id`, `token_env`, and `receipt_store_path`
+ * (`./moltnetRuntimeConfig.ts`). No published Moltnet release implements that
+ * kind -- `pkg/bridgeconfig` has no `RuntimeDaimon` through the latest tag, and
+ * `pkg/nodeconfig` decodes with `DisallowUnknownFields()`, so the node exits on
+ * `agent_id` at strict decode, before `Validate()` is even reached. The
+ * entrypoint launches `moltnet node <config> &` and then `wait -n`
+ * (`./containerEntrypointRender.ts`), so that exit tears the whole container
+ * down. Both a locally built Moltnet (`./localMoltnetAuthority.ts`) and, since
+ * the v0.1.18 pin, the published authority (`./moltnetReleaseAuthority.ts`) can
+ * advertise `daimon-bridge`; anything older, including every release through
+ * v0.1.17, advertises only `pi-bridge` and is still rejected here.
+ *
+ * This throws rather than warning, which is the opposite call from the other
+ * unlowerable-declaration diagnostics in this compiler. Those keep working
+ * projects compiling; here every affected project is already broken, and the
+ * failure it replaces is an opaque JSON decode error at container boot.
+ *
+ * `receiptStorePath` is set on a node plan if and only if the attached agent's
+ * runtime is daimon (`./moltnetArtifacts.ts`), so it is the exact daimon
+ * signal on an already-resolved plan.
+ */
+const assertMoltnetDaimonBridgeCapability = (moltnet, release) => {
+    const daimonNetworks = [...new Set((moltnet?.nodePlans ?? [])
+            .filter((nodePlan) => nodePlan.receiptStorePath !== undefined)
+            .map((nodePlan) => nodePlan.networkId))].sort();
+    if (daimonNetworks.length === 0)
+        return;
+    const capabilities = release?.capabilities ?? [];
+    if (capabilities.includes("daimon-bridge"))
+        return;
+    throw new SpawnfileError("compile_error", `Moltnet release ${release?.version ?? "(unstaged)"} does not advertise the daimon-bridge capability, but `
+        + `${daimonNetworks.length} network attachment(s) lower a daimon runtime bridge (${daimonNetworks.join(", ")}). `
+        + "The published release implements pi-bridge only and rejects a daimon node config at strict JSON decode, so "
+        + "the container would exit at boot. Build Moltnet locally (scripts/build-local-moltnet.ts, then "
+        + "SPAWNFILE_LOCAL_MOLTNET_RELEASE_DIR with SPAWNFILE_ALLOW_LOCAL_E2E=1) to stage a daimon-bridge release, or "
+        + "remove the Moltnet attachment from the daimon agent(s).");
 };
-const resolveMoltnetOperatorTokenSecret = (plan) => {
-    const client = plan.server.auth.client;
-    if (!client) {
-        return undefined;
-    }
-    if (client.token_env) {
-        return client.token_env;
-    }
-    if (client.token_path) {
-        return client.token_path;
-    }
-    if (!client.token_id) {
-        return undefined;
+export const createContainerArtifacts = async (plan, compiledNodes, options = {}) => {
+    assertMoltnetDaimonBridgeCapability(options.moltnet, options.moltnetRelease);
+    const localDaimonIdentityPath = process.env[DAIMON_LOCAL_RUNTIME_IDENTITY_ENV]?.trim();
+    const localDaimonIdentity = localDaimonIdentityPath ? await loadLocalDaimonRuntimeIdentity(localDaimonIdentityPath) : undefined;
+    const runtimePlans = await createRuntimeTargetPlans(plan, compiledNodes, options.worldBindings, options.deploymentLineage);
+    const daimonTelemetryArtifacts = createDaimonTelemetryArtifacts(plan, runtimePlans, compiledNodes);
+    const envVariableMap = createEnvVariableMap(compiledNodes, runtimePlans, options.moltnet);
+    const projectedWorldTokenEnvNames = [...new Set(runtimePlans.flatMap((runtimePlan) => runtimePlan.worldTokenEnvNames ?? []))].sort();
+    const worldTokenEnvNames = (options.worldBindings?.artifact.bindings ?? [])
+        .map((binding) => binding.token_env)
+        .sort();
+    const recipeEnvNames = new Set(runtimePlans.flatMap((runtimePlan) => Object.keys(runtimePlan.recipeEnv ?? {})));
+    const moltnetSecretEnvNames = new Set((options.moltnet?.serverPlans ?? []).flatMap((serverPlan) => serverPlan.secretPatches.map((patch) => patch.envName)));
+    for (const name of worldTokenEnvNames) {
+        if (envVariableMap.has(name) || recipeEnvNames.has(name) || moltnetSecretEnvNames.has(name)) {
+            throw new SpawnfileError("validation_error", `World token env ${name} conflicts with an existing environment authority`);
+        }
     }
-    return plan.server.auth.tokens?.find((token) => token.id === client.token_id)?.secret;
-};
-const createMoltnetSummary = (moltnet) => {
-    if (!moltnet) {
-        return undefined;
+    for (const name of projectedWorldTokenEnvNames) {
+        envVariableMap.set(name, {
+            categories: ["runtime"],
+            description: "World bearer token for a native runtime projection",
+            generated: false,
+            name,
+            required: true
+        });
     }
-    return {
-        node_plans: moltnet.nodePlans.map((plan) => ({
-            config_path: plan.configPath,
-            network_id: plan.networkId
-        })),
-        server_plans: moltnet.serverPlans.map((plan) => {
-            const operatorTokenSecret = resolveMoltnetOperatorTokenSecret(plan);
-            return {
-                auth_mode: plan.server.auth.mode,
-                base_url: plan.baseUrl,
-                ...(plan.configPath ? { config_path: plan.configPath } : {}),
-                ...(plan.server.mode === "managed"
-                    ? { direct_messages: plan.server.direct_messages }
-                    : {}),
-                id: plan.id,
-                mode: plan.mode,
-                network_id: plan.networkId,
-                ...(operatorTokenSecret ? { operator_token_secret: operatorTokenSecret } : {}),
-                ...(plan.port ? { port: plan.port } : {}),
-                ...(plan.server.auth.public_read !== undefined
-                    ? { public_read: plan.server.auth.public_read }
-                    : {}),
-                rooms: plan.rooms.map((room) => ({
-                    id: room.id,
-                    members: [...room.members],
-                    ...(room.visibility ? { visibility: room.visibility } : {}),
-                    ...(room.write_policy ? { write_policy: room.write_policy } : {})
-                })),
-                ...(plan.server.mode === "managed"
-                    ? { store_kind: plan.server.store.kind }
-                    : {})
-            };
-        })
-    };
-};
-export const createContainerArtifacts = async (plan, compiledNodes, options = {}) => {
-    const runtimePlans = await createRuntimeTargetPlans(plan, compiledNodes);
-    const envVariables = [...createEnvVariableMap(compiledNodes, runtimePlans).values()].sort((left, right) => left.name.localeCompare(right.name));
+    const envVariables = [...envVariableMap.values()].sort((left, right) => left.name.localeCompare(right.name));
     const requiredSecrets = envVariables
         .filter((variable) => variable.required)
         .map((variable) => variable.name)
@@ -116,14 +94,23 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         .filter((variable) => variable.required && variable.categories.includes("runtime"))
         .map((variable) => variable.name)
         .sort();
-    const persistentMounts = (options.moltnet?.persistentMounts ?? [])
-        .map((mount) => ({
-        id: mount.id,
-        mount_path: mount.mountPath,
-        reason: mount.reason,
-        volume_name: mount.volumeName
-    }))
-        .sort((left, right) => left.id.localeCompare(right.id));
+    const memoryArtifacts = createMemoryArtifactBundle(plan, options.deploymentLineage);
+    const { resources: resolvedWorkspaceResources, mounts: workspaceResourceMounts } = resolveWorkspaceResourceVolumes(runtimePlans);
+    const persistentMountCandidates = [
+        ...memoryArtifacts.mounts,
+        ...workspaceResourceMounts,
+        ...daimonTelemetryArtifacts.mounts,
+        ...runtimePlans.flatMap((runtimePlan) => runtimePlan.persistentMounts ?? []),
+        ...((options.moltnet?.persistentMounts ?? []).map((mount) => ({
+            ...(mount.declaredVolumeName ? { declared_volume_name: mount.declaredVolumeName } : {}),
+            id: mount.id,
+            ...(mount.lifecycle ? { lifecycle: mount.lifecycle } : {}),
+            mount_path: mount.mountPath,
+            reason: mount.reason,
+            volume_name: mount.volumeName
+        })))
+    ];
+    const persistentMounts = mergePersistentMounts(persistentMountCandidates);
     const runtimeInternalPorts = runtimePlans.flatMap((plan) => plan.port ? [plan.port] : []);
     const internalPorts = [...new Set([...runtimeInternalPorts, ...(options.moltnet?.ports ?? [])])].sort((left, right) => left - right);
     const runtimePublishedPorts = runtimePlans.flatMap((plan) => plan.publishedPort ? [plan.publishedPort] : []);
@@ -140,18 +127,25 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         ...new Set(runtimePlans.flatMap((plan) => (plan.instancePaths.homePath ? [plan.instancePaths.homePath] : [])))
     ].sort();
     const runtimeInstances = runtimePlans
-        .map((plan) => ({
-        config_path: plan.instancePaths.configPath,
-        home_path: plan.instancePaths.homePath ?? null,
-        id: plan.id,
-        internal_port: plan.port ?? null,
-        model_auth_methods: plan.modelAuthMethods,
-        model_secrets_required: plan.modelSecretsRequired,
-        node_ids: [...(plan.sourceIds ?? [])],
-        published_port: plan.publishedPort ?? null,
-        runtime: plan.runtimeName,
-        workspace_path: plan.instancePaths.workspacePath
-    }))
+        .map((plan) => {
+        const telemetryMountIds = daimonTelemetryArtifacts.telemetryMountIdsByInstance.get(plan.id);
+        return {
+            config_path: plan.instancePaths.configPath,
+            home_path: plan.instancePaths.homePath ?? null,
+            id: plan.id,
+            internal_port: plan.port ?? null,
+            model_auth_methods: plan.modelAuthMethods,
+            model_secrets_required: plan.modelSecretsRequired,
+            ...(plan.engineByNodeId && Object.keys(plan.engineByNodeId).length > 0
+                ? { engine_by_node_id: plan.engineByNodeId }
+                : {}),
+            node_ids: [...(plan.sourceIds ?? [])],
+            published_port: plan.publishedPort ?? null,
+            runtime: plan.runtimeName,
+            ...(telemetryMountIds ? { telemetry_mount_ids: telemetryMountIds } : {}),
+            workspace_path: plan.instancePaths.workspacePath
+        };
+    })
         .sort((left, right) => left.id.localeCompare(right.id));
     const runtimesInstalled = [...new Set(runtimePlans.map((plan) => plan.runtimeName))].sort();
     const workspaceResources = [
@@ -164,11 +158,18 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
                 link_path: resource.linkPath,
                 mode: resource.mode,
                 mount: resource.mount,
-                sharing: resource.sharing
+                mount_path: resource.linkPath,
+                replacement_sentinel: resource.replacementSentinel ? {
+                    path: resource.replacementSentinel,
+                    result: "verified_on_startup"
+                } : undefined,
+                resolved_identity: resource.resolvedIdentity,
+                sharing: resource.sharing,
+                volume_name: resource.volumeName ?? null
             }
         ]))).values()
     ].sort((left, right) => left.link_path.localeCompare(right.link_path) || left.id.localeCompare(right.id));
-    const moltnetSummary = createMoltnetSummary(options.moltnet);
+    const moltnetSummary = createMoltnetSummary(options.moltnet, options.moltnetRelease);
     const organization = createOrganizationSummary(plan, compiledNodes);
     const projectSlug = normalizeProjectLabelSlug(organization.project);
     const mergedModelAuthMethods = Object.assign({}, ...runtimePlans.map((runtimePlan) => runtimePlan.modelAuthMethods));
@@ -182,6 +183,13 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             }
         ])).values()
     ];
+    const worldBindingsEvidence = options.worldBindings
+        ? {
+            artifact_path: WORLD_BINDINGS_IMAGE_PATH,
+            digest: `sha256:${createHash("sha256").update(options.worldBindings.canonicalBytes).digest("hex")}`,
+            schema: SIMFILE_WORLD_BINDINGS_VERSION
+        }
+        : undefined;
     const distributionReport = buildDistributionReport({
         envVariables: envVariables.map((variable) => ({
             categories: variable.categories,
@@ -194,10 +202,19 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         modelAuthMethods: mergedModelAuthMethods,
         moltnetNetworks,
         organization,
+        // The report deliberately omits the compiler-DERIVED volume name: it
+        // encodes the creator's plan root and deployment lineage and is private to
+        // that host. An author-DECLARED name is different — it is part of the
+        // declaration the image publishes, so a consumer must honour it verbatim
+        // or an operator who pre-created that volume silently gets an empty one.
         persistentMounts: persistentMounts.map((mount) => ({
+            ...(mount.declared_volume_name
+                ? { declared_volume_name: mount.declared_volume_name }
+                : {}),
             durability: "persistent",
             id: mount.id,
             kind: "volume",
+            ...(mount.lifecycle ? { lifecycle: mount.lifecycle } : {}),
             target: mount.mount_path
         })),
         portMappings,
@@ -210,12 +227,22 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             mount: resource.mount,
             sharing: resource.sharing
         })),
-        runtimeInstances
+        runtimeInstances,
+        ...(worldBindingsEvidence ? { worldBindings: worldBindingsEvidence } : {})
     });
     const distributionLabels = createDistributionImageLabels(projectSlug, distributionReport.compile_fingerprint);
     const files = [
-        ...createRootfsFiles(runtimePlans),
+        ...createRootfsFiles(runtimePlans, persistentMounts.map((mount) => mount.mount_path), options.moltnet
+            ? {
+                externalParticipantArtifacts: options.moltnet.externalParticipantArtifacts,
+                nodePlans: options.moltnet.nodePlans,
+                serverPlans: options.moltnet.serverPlans
+            }
+            : undefined, persistentMounts),
         ...(options.moltnet?.files ?? []),
+        ...(options.worldBindings
+            ? [{ content: options.worldBindings.canonicalBytes, mode: 0o600, path: WORLD_BINDINGS_OUTPUT_FILE }]
+            : []),
         {
             content: `${JSON.stringify(distributionReport, null, 2)}\n`,
             path: DISTRIBUTION_REPORT_OUTPUT_FILE
@@ -224,12 +251,25 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             content: await renderDockerfile(runtimePlans, {
                 distribution: {
                     labels: distributionLabels,
-                    reportOutputFile: DISTRIBUTION_REPORT_OUTPUT_FILE
+                    reportOutputFile: DISTRIBUTION_REPORT_OUTPUT_FILE,
+                    ...(options.worldBindings
+                        ? { worldBindingsOutputFile: WORLD_BINDINGS_OUTPUT_FILE }
+                        : {})
                 },
                 hasMoltnet: Boolean(options.moltnet),
                 hasStagedMoltnetBinaries: options.hasStagedMoltnetBinaries,
+                hasWorkspaceBundles: options.hasWorkspaceBundles,
+                ...(options.moltnet
+                    ? {
+                        moltnet: {
+                            nodePlans: options.moltnet.nodePlans,
+                            serverPlans: options.moltnet.serverPlans
+                        }
+                    }
+                    : {}),
                 moltnetPublishedPorts: options.moltnet?.publishedPorts ?? [],
-                persistentMountPaths: persistentMounts.map((mount) => mount.mount_path)
+                persistentMountPaths: persistentMounts.map((mount) => mount.mount_path),
+                runtimePackageOverrides: options.runtimePackageOverrides
             }),
             path: "Dockerfile"
         },
@@ -237,16 +277,23 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             content: renderEntrypoint(runtimePlans, requiredSecrets.filter((secretName) => !modelSecretsRequired.includes(secretName)), {
                 moltnet: options.moltnet
                     ? {
+                        externalParticipantArtifacts: options.moltnet.externalParticipantArtifacts ?? [],
                         nodePlans: options.moltnet.nodePlans,
                         serverPlans: options.moltnet.serverPlans
                     }
-                    : undefined
+                    : undefined,
+                persistentMounts,
+                persistentMountPaths: persistentMounts.map((mount) => mount.mount_path)
             }),
             path: "entrypoint.sh"
         },
         {
             content: renderEnvExample(envVariables),
             path: ".env.example"
+        },
+        {
+            content: createDockerIgnoreContent(),
+            path: ".dockerignore"
         }
     ];
     return {
@@ -270,6 +317,11 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             entrypoint: "entrypoint.sh",
             env_example: ".env.example",
             internal_ports: internalPorts,
+            ...(localDaimonIdentity ? { local_daimon_runtime: {
+                    capability_receipt_sha256: localDaimonIdentity.capabilityReceipt,
+                    image_reference: localDaimonIdentity.imageReference,
+                    registry_authority: localDaimonIdentity.registryAuthority
+                } } : {}),
             model_secrets_required: modelSecretsRequired,
             ...(moltnetSummary ? { moltnet: moltnetSummary } : {}),
             port_mappings: portMappings,
@@ -280,6 +332,7 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             runtime_secrets_required: runtimeSecretsRequired,
             runtimes_installed: runtimesInstalled,
             secrets_required: requiredSecrets,
+            ...(memoryArtifacts.memories.length > 0 ? { memory: memoryArtifacts.memories } : {}),
             ...(persistentMounts.length > 0 ? { persistent_mounts: persistentMounts } : {}),
             ...(workspaceResources.length > 0 ? { workspace_resources: workspaceResources } : {})
         }

package/dist/compiler/containerArtifactsPlans.d.ts

@@ -1,4 +1,6 @@
-import type { CompilePlan } from "./types.js";
 import type { CompiledNodeArtifact, ContainerEnvVariable, RuntimeTargetPlan } from "./containerArtifactsTypes.js";
-export declare const createEnvVariableMap: (compiledNodes: CompiledNodeArtifact[], runtimePlans: RuntimeTargetPlan[]) => Map<string, ContainerEnvVariable>;
-export declare const createRuntimeTargetPlans: (plan: CompilePlan, compiledNodes: CompiledNodeArtifact[]) => Promise<RuntimeTargetPlan[]>;
+import type { MoltnetArtifacts } from "./moltnetArtifacts.js";
+import type { CompilePlan } from "./types.js";
+import { type ResolvedWorldBindings } from "./worldBindings.js";
+export declare const createEnvVariableMap: (compiledNodes: CompiledNodeArtifact[], runtimePlans: RuntimeTargetPlan[], moltnet?: MoltnetArtifacts | null) => Map<string, ContainerEnvVariable>;
+export declare const createRuntimeTargetPlans: (plan: CompilePlan, compiledNodes: CompiledNodeArtifact[], worldBindings?: ResolvedWorldBindings, deploymentLineage?: string) => Promise<RuntimeTargetPlan[]>;