spawnfile 0.1.13 → 0.1.17

package/dist/compiler/containerTargetPlanResolution.d.ts

@@ -0,0 +1,20 @@
+import type { ModelAuthMethod } from "../shared/index.js";
+import type { ContainerTarget, ContainerTargetInput, EmittedFile, RuntimeContainerMeta } from "../runtime/index.js";
+import type { ResolvedPackage } from "./types.js";
+export declare const createDefaultTargets: (inputs: ContainerTargetInput[]) => ContainerTarget[];
+export declare const resolveTargetEnvFiles: (configPath: string, target: ContainerTarget) => Array<{
+    envName: string;
+    filePath: string;
+}>;
+export declare const resolveTargetConfigEnvBindings: (meta: RuntimeContainerMeta, target: ContainerTarget) => RuntimeContainerMeta["configEnvBindings"];
+export declare const assertTargetHasConfig: (runtimeName: string, targetId: string, meta: RuntimeContainerMeta, files: EmittedFile[]) => void;
+export declare const resolveTargetPackages: (target: ContainerTarget, inputs: ContainerTargetInput[]) => ResolvedPackage[];
+export declare const resolveInstancePaths: (runtimeName: string, targetId: string, meta: RuntimeContainerMeta) => {
+    configPath: string;
+    homePath?: string;
+    instanceRoot: string;
+    workspacePath: string;
+};
+export declare const resolveTargetModelSecrets: (target: ContainerTarget, inputs: ContainerTargetInput[]) => string[];
+export declare const resolveTargetModelAuthMethods: (target: ContainerTarget, inputs: ContainerTargetInput[]) => Record<string, ModelAuthMethod>;
+export declare const resolveTargetExposure: (target: ContainerTarget, inputs: ContainerTargetInput[]) => boolean;

package/dist/compiler/containerTargetPlanResolution.js

@@ -0,0 +1,97 @@
+import path from "node:path";
+import { SpawnfileError } from "../shared/index.js";
+import { listExecutionModelSecretNames, resolveExecutionModelAuthMethods } from "./modelEnv.js";
+const CONFIG_FILE_PLACEHOLDER = "<config-file>";
+const INSTANCE_ROOT_PLACEHOLDER = "<instance-root>";
+export const createDefaultTargets = (inputs) => inputs.map((input) => ({
+    files: input.emittedFiles,
+    id: `${input.kind}-${input.slug}`,
+    sourceIds: [input.id]
+}));
+export const resolveTargetEnvFiles = (configPath, target) => (target.envFiles ?? []).map((binding) => ({
+    envName: binding.envName,
+    filePath: path.posix.join(path.posix.dirname(configPath), binding.relativePath)
+}));
+export const resolveTargetConfigEnvBindings = (meta, target) => [...(meta.configEnvBindings ?? []), ...(target.configEnvBindings ?? [])];
+export const assertTargetHasConfig = (runtimeName, targetId, meta, files) => {
+    if (!files.some((file) => file.path === meta.configFileName)) {
+        throw new SpawnfileError("runtime_error", `Container target ${targetId} for ${runtimeName} is missing ${meta.configFileName}`);
+    }
+};
+const createPackageIdentity = (pkg) => `${pkg.manager}\u0000${pkg.name}\u0000${pkg.version ?? ""}\u0000${pkg.scope ?? ""}`;
+const createPackageConflictIdentity = (pkg) => `${pkg.manager}\u0000${pkg.name}`;
+const createPackageLabel = (pkg) => `${pkg.manager} package ${pkg.name}`;
+export const resolveTargetPackages = (target, inputs) => {
+    const sourceIds = new Set(target.sourceIds ?? []);
+    if (sourceIds.size === 0)
+        return [];
+    const byIdentity = new Map();
+    for (const input of inputs) {
+        if (!sourceIds.has(input.id) || input.value.kind !== "agent")
+            continue;
+        for (const currentPackage of input.value.packages ?? []) {
+            const conflictIdentity = createPackageConflictIdentity(currentPackage);
+            const existingPackage = byIdentity.get(conflictIdentity);
+            if (!existingPackage) {
+                byIdentity.set(conflictIdentity, currentPackage);
+                continue;
+            }
+            if (createPackageIdentity(existingPackage) !== createPackageIdentity(currentPackage)) {
+                throw new SpawnfileError("validation_error", `Container target ${target.id} declares conflicting package definitions for ${createPackageLabel(currentPackage)}`);
+            }
+        }
+    }
+    return [...byIdentity.values()].sort((left, right) => createPackageIdentity(left).localeCompare(createPackageIdentity(right)));
+};
+const replaceContainerPathTemplate = (template, instanceRoot, configFileName) => template
+    .replaceAll(INSTANCE_ROOT_PLACEHOLDER, instanceRoot)
+    .replaceAll(CONFIG_FILE_PLACEHOLDER, configFileName);
+export const resolveInstancePaths = (runtimeName, targetId, meta) => {
+    const instanceRoot = `/var/lib/spawnfile/instances/${runtimeName}/${targetId}`;
+    return {
+        configPath: replaceContainerPathTemplate(meta.instancePaths.configPathTemplate, instanceRoot, meta.configFileName),
+        homePath: meta.instancePaths.homePathTemplate
+            ? replaceContainerPathTemplate(meta.instancePaths.homePathTemplate, instanceRoot, meta.configFileName)
+            : undefined,
+        instanceRoot,
+        workspacePath: replaceContainerPathTemplate(meta.instancePaths.workspacePathTemplate, instanceRoot, meta.configFileName)
+    };
+};
+export const resolveTargetModelSecrets = (target, inputs) => {
+    const sourceIds = new Set(target.sourceIds ?? []);
+    if (sourceIds.size === 0)
+        return [];
+    const secretNames = new Set();
+    for (const input of inputs) {
+        if (!sourceIds.has(input.id) || input.value.kind !== "agent")
+            continue;
+        for (const secretName of listExecutionModelSecretNames(input.value.execution)) {
+            secretNames.add(secretName);
+        }
+    }
+    return [...secretNames].sort();
+};
+export const resolveTargetModelAuthMethods = (target, inputs) => {
+    const sourceIds = new Set(target.sourceIds ?? []);
+    if (sourceIds.size === 0)
+        return {};
+    const methods = new Map();
+    for (const input of inputs) {
+        if (!sourceIds.has(input.id) || input.value.kind !== "agent")
+            continue;
+        for (const [provider, method] of Object.entries(resolveExecutionModelAuthMethods(input.value.execution))) {
+            const existingMethod = methods.get(provider);
+            if (existingMethod && existingMethod !== method) {
+                throw new SpawnfileError("validation_error", `Container target ${target.id} declares conflicting auth methods for provider ${provider}`);
+            }
+            methods.set(provider, method);
+        }
+    }
+    return Object.fromEntries([...methods.entries()].sort(([left], [right]) => left.localeCompare(right)));
+};
+export const resolveTargetExposure = (target, inputs) => {
+    const sourceIds = new Set(target.sourceIds ?? []);
+    if (sourceIds.size === 0)
+        return false;
+    return inputs.some((input) => sourceIds.has(input.id) && input.value.kind === "agent" && input.value.expose === true);
+};

package/dist/compiler/containerTargetResources.d.ts

@@ -1,4 +1,25 @@
 import type { ContainerTarget, ContainerTargetInput, RuntimeContainerMeta } from "../runtime/index.js";
 import type { RuntimeTargetPlan } from "./containerArtifactsTypes.js";
 import { type WorkspaceResourcePlan } from "./workspaceResources.js";
-export declare const resolveTargetResources: (target: ContainerTarget, inputs: ContainerTargetInput[], instancePaths: RuntimeTargetPlan["instancePaths"], meta: RuntimeContainerMeta) => WorkspaceResourcePlan[];
+export interface ResolvedTargetResourcePlan extends WorkspaceResourcePlan {
+    canonicalBackingPath: string;
+    ownerId: string;
+    persistentMountId?: string;
+    replacementSentinel?: string;
+    resolvedIdentity: string;
+    volumeName?: string;
+}
+export interface WorkspaceResourcePersistentMount {
+    /** The author's `name`, when declared on the resource. */
+    declared_volume_name?: string;
+    id: string;
+    lifecycle: "exclusive-reattach";
+    mount_path: string;
+    reason: string;
+    volume_name: string;
+}
+export declare const resolveWorkspaceResourceVolumes: (runtimePlans: readonly RuntimeTargetPlan[]) => {
+    resources: ResolvedTargetResourcePlan[];
+    mounts: WorkspaceResourcePersistentMount[];
+};
+export declare const resolveTargetResources: (target: ContainerTarget, inputs: ContainerTargetInput[], instancePaths: RuntimeTargetPlan["instancePaths"], meta: RuntimeContainerMeta, planRoot: string, deploymentLineage?: string) => ResolvedTargetResourcePlan[];

package/dist/compiler/containerTargetResources.js

@@ -1,10 +1,48 @@
 import path from "node:path";
+import { createHash } from "node:crypto";
 import { SpawnfileError } from "../shared/index.js";
+import { createExclusiveReattachVolumeName } from "../shared/index.js";
 import { mergeWorkspaceResourcePlans } from "./workspaceResources.js";
 const CONFIG_FILE_PLACEHOLDER = "<config-file>";
 const INSTANCE_ROOT_PLACEHOLDER = "<instance-root>";
 const SOURCE_AGENT_PLACEHOLDER = "<agent-name>";
 const SOURCE_SLUG_PLACEHOLDER = "<source-slug>";
+const digest = (value) => createHash("sha256").update(value).digest("hex");
+export const resolveWorkspaceResourceVolumes = (runtimePlans) => {
+    const resources = runtimePlans.flatMap((runtimePlan) => (runtimePlan.resources ?? []));
+    const byBackingPath = new Map();
+    const backingPathByVolumeName = new Map();
+    for (const resource of resources.filter((candidate) => candidate.kind === "volume")) {
+        const existing = byBackingPath.get(resource.canonicalBackingPath);
+        // Two DIFFERENT declared resources landing on one backing path is always a
+        // mistake: the path segment derives from an explicit `name` when one is
+        // given, so `id: a`/`id: b` both declaring `name: X` in one scope used to
+        // collapse into a single directory and volume, silently, with both
+        // workspace symlinks pointing at it. The same id across runtime plans is
+        // the legitimate `sharing: team` case and still merges.
+        if (existing && existing.id !== resource.id) {
+            throw new SpawnfileError("validation_error", `Workspace resources ${existing.id} and ${resource.id} resolve to the same backing volume ${resource.canonicalBackingPath}; a declared volume name must be unique within its scope`);
+        }
+        if (existing && (existing.mode !== resource.mode || existing.sharing !== resource.sharing || existing.volumeName !== resource.volumeName || (resource.sharing === "per_agent" && existing.ownerId !== resource.ownerId))) {
+            throw new SpawnfileError("validation_error", `Workspace volume ${resource.canonicalBackingPath} has incompatible mode, sharing, or owner declarations`);
+        }
+        const conflictingPath = backingPathByVolumeName.get(resource.volumeName);
+        if (conflictingPath && conflictingPath !== resource.canonicalBackingPath)
+            throw new SpawnfileError("validation_error", "Workspace volume name collision");
+        byBackingPath.set(resource.canonicalBackingPath, resource);
+        backingPathByVolumeName.set(resource.volumeName, resource.canonicalBackingPath);
+    }
+    // Workspace `kind: volume` resources are durable product state: an author
+    // declares one precisely so it outlives the container. They are therefore
+    // `exclusive-reattach` — deployment-stable name, reattached rather than
+    // recreated, one live holder at a time.
+    return { resources, mounts: [...byBackingPath.values()].map((resource) => ({
+            ...(resource.name?.trim() ? { declared_volume_name: resource.name.trim() } : {}),
+            id: resource.persistentMountId, lifecycle: "exclusive-reattach",
+            mount_path: resource.canonicalBackingPath,
+            reason: `Workspace ${resource.sharing} resource ${resource.id}`, volume_name: resource.volumeName
+        })) };
+};
 const replaceSourceWorkspacePathTemplate = (template, input, instancePaths, meta) => {
     const agentName = input.value.kind === "agent" ? input.value.name : input.slug;
     const instanceRoot = instancePaths.instanceRoot ?? path.posix.dirname(instancePaths.workspacePath);
@@ -21,10 +59,12 @@ const sourceTargetId = (target, input, isMergedTarget) => isMergedTarget ? `${ta
 const pathsOverlap = (left, right) => left === right || left.startsWith(`${right}/`) || right.startsWith(`${left}/`);
 const dedupeAndAssertResourcePlans = (target, resources) => {
     const byLinkPath = new Map();
+    const volumesByBackingPath = new Map();
+    const backingPathByVolumeName = new Map();
     for (const resource of resources) {
         const existing = byLinkPath.get(resource.linkPath);
         if (existing) {
-            if (existing.backingPath !== resource.backingPath || existing.id !== resource.id) {
+            if (existing.resolvedIdentity !== resource.resolvedIdentity) {
                 throw new SpawnfileError("validation_error", `Container target ${target.id} declares conflicting workspace resources at ${resource.linkPath}`);
             }
             continue;
@@ -34,10 +74,33 @@ const dedupeAndAssertResourcePlans = (target, resources) => {
             throw new SpawnfileError("validation_error", `Container target ${target.id} declares overlapping workspace resource links ${overlapping.linkPath} and ${resource.linkPath}`);
         }
         byLinkPath.set(resource.linkPath, resource);
+        if (resource.kind !== "volume")
+            continue;
+        const existingVolume = volumesByBackingPath.get(resource.canonicalBackingPath);
+        if (existingVolume && existingVolume.id !== resource.id) {
+            throw new SpawnfileError("validation_error", `Container target ${target.id} declares workspace resources ${existingVolume.id} and ${resource.id} that resolve to the same backing volume ${resource.canonicalBackingPath}; a declared volume name must be unique within its scope`);
+        }
+        if (existingVolume) {
+            const incompatible = existingVolume.mode !== resource.mode ||
+                existingVolume.sharing !== resource.sharing ||
+                existingVolume.volumeName !== resource.volumeName ||
+                (resource.sharing === "per_agent" && existingVolume.ownerId !== resource.ownerId);
+            if (incompatible) {
+                throw new SpawnfileError("validation_error", `Container target ${target.id} declares incompatible workspace volume owners or modes at ${resource.canonicalBackingPath}`);
+            }
+        }
+        else {
+            volumesByBackingPath.set(resource.canonicalBackingPath, resource);
+        }
+        const conflictingBackingPath = backingPathByVolumeName.get(resource.volumeName);
+        if (conflictingBackingPath && conflictingBackingPath !== resource.canonicalBackingPath) {
+            throw new SpawnfileError("validation_error", `Container target ${target.id} workspace volume identity collision`);
+        }
+        backingPathByVolumeName.set(resource.volumeName, resource.canonicalBackingPath);
     }
     return [...byLinkPath.values()].sort((left, right) => left.linkPath.localeCompare(right.linkPath) || left.id.localeCompare(right.id));
 };
-export const resolveTargetResources = (target, inputs, instancePaths, meta) => {
+export const resolveTargetResources = (target, inputs, instancePaths, meta, planRoot, deploymentLineage = "compile") => {
     const sourceIds = new Set(target.sourceIds ?? []);
     if (sourceIds.size === 0) {
         return [];
@@ -50,6 +113,35 @@ export const resolveTargetResources = (target, inputs, instancePaths, meta) => {
         return mergeWorkspaceResourcePlans(input.value.workspaceResources ?? [], `${target.id}/${input.id}`, {
             targetId: sourceTargetId(target, input, isMergedTarget),
             workspacePath: resolveSourceWorkspacePath(input, instancePaths, meta)
+        }).map((resource) => {
+            const canonicalBackingPath = path.posix.normalize(resource.backingPath);
+            const ownerId = resource.sharing === "per_agent" ? input.id : canonicalBackingPath;
+            const resolvedIdentity = `sha256:${digest(JSON.stringify({
+                backingPath: canonicalBackingPath,
+                kind: resource.kind,
+                mode: resource.mode,
+                ownerId,
+                ...(resource.kind === "bundle" ? { archivePath: resource.archivePath, sha256: resource.sha256 } : {}),
+                sharing: resource.sharing
+            }))}`;
+            if (resource.kind !== "volume")
+                return { ...resource, backingPath: canonicalBackingPath, canonicalBackingPath, ownerId, resolvedIdentity };
+            const pathDigest = digest(canonicalBackingPath);
+            return {
+                ...resource,
+                backingPath: canonicalBackingPath,
+                canonicalBackingPath,
+                ownerId,
+                persistentMountId: `workspace-resource-${pathDigest.slice(0, 24)}`,
+                replacementSentinel: path.posix.join(canonicalBackingPath, ".spawnfile-resource-identity"),
+                resolvedIdentity,
+                // Author-declared `name` verbatim (an operator can pre-create or
+                // migrate the host volume under exactly that name); otherwise a
+                // deployment-stable derived name. Never run-scoped: a fresh
+                // NOOPOLIS_RUN_ID must not strand the previous run's state.
+                volumeName: resource.name?.trim()
+                    || createExclusiveReattachVolumeName(`${planRoot}\0${deploymentLineage}`, `workspace-resource-${pathDigest.slice(0, 24)}`)
+            };
         });
     });
     return dedupeAndAssertResourcePlans(target, resources);

package/dist/compiler/containerVolumeBootstrap.d.ts

@@ -0,0 +1,3 @@
+export declare const VOLUME_BOOTSTRAP_MARKER = ".spawnfile-volume-init";
+export declare const VOLUME_BOOTSTRAP_CLAIM = ".spawnfile-volume-init.claim";
+export declare const VOLUME_BOOTSTRAP_MARKER_CONTENT = "spawnfile.volume-bootstrap.v1";

package/dist/compiler/containerVolumeBootstrap.js

@@ -0,0 +1,3 @@
+export const VOLUME_BOOTSTRAP_MARKER = ".spawnfile-volume-init";
+export const VOLUME_BOOTSTRAP_CLAIM = `${VOLUME_BOOTSTRAP_MARKER}.claim`;
+export const VOLUME_BOOTSTRAP_MARKER_CONTENT = "spawnfile.volume-bootstrap.v1";

package/dist/compiler/containerWorkspaceResourceRender.js

@@ -1,11 +1,17 @@
+import { VOLUME_BOOTSTRAP_MARKER, VOLUME_BOOTSTRAP_MARKER_CONTENT } from "./containerVolumeBootstrap.js";
 const shellQuote = (value) => `'${value.replace(/'/g, `'\"'\"'`)}'`;
 export const createWorkspaceResourceCommands = (plan) => (plan.resources ?? []).flatMap((resource) => {
     const readonlyFlag = resource.mode === "readonly" ? "readonly" : "mutable";
     if (resource.kind === "volume") {
+        const resolved = resource;
         return [
-            `prepare_volume_resource ${shellQuote(resource.id)} ${shellQuote(resource.linkPath)} ${shellQuote(resource.backingPath)} ${shellQuote(readonlyFlag)}`
+            `prepare_volume_resource ${shellQuote(resource.id)} ${shellQuote(resource.linkPath)} ${shellQuote(resource.backingPath)} ${shellQuote(readonlyFlag)} ${shellQuote(resolved.resolvedIdentity ?? "")}`
         ];
     }
+    if (resource.kind === "bundle")
+        return [
+            `prepare_bundle_resource ${shellQuote(resource.id)} ${shellQuote(resource.linkPath)} ${shellQuote(resource.backingPath)} ${shellQuote(resource.archivePath ?? "")} ${shellQuote(resource.sha256 ?? "")}`
+        ];
     const selectorKind = resource.branch
         ? "branch"
         : resource.tag
@@ -58,15 +64,57 @@ export const createWorkspaceResourceShellFunctions = () => [
     '  local link_path="$2"',
     '  local backing_path="$3"',
     '  local mode="$4"',
+    '  local identity="$5"',
     '  mkdir -p "$backing_path"',
     '  if [ ! -d "$backing_path" ]; then',
     '    echo "Workspace volume resource $id backing path is not a directory: $backing_path" >&2',
     "    exit 1",
     "  fi",
+    '  local sentinel="$backing_path/.spawnfile-resource-identity"',
+    '  if [ -f "$sentinel" ]; then',
+    '    if [ "$(cat "$sentinel")" != "$identity" ]; then',
+    '      echo "Workspace volume resource $id replacement sentinel mismatch" >&2',
+    "      exit 1",
+    "    fi",
+    "  else",
+    `    local bootstrap="$backing_path/${VOLUME_BOOTSTRAP_MARKER}"`,
+    `    local bootstrap_claim="$backing_path/${VOLUME_BOOTSTRAP_MARKER}.claim"`,
+    '    local first_entry',
+    '    first_entry="$(find "$backing_path" -mindepth 1 -maxdepth 1 -print -quit)"',
+    '    if [ -n "$first_entry" ]; then',
+    '      if [ "$first_entry" = "$bootstrap" ]; then',
+    '        mv -T --no-clobber -- "$bootstrap" "$bootstrap_claim"',
+    '      elif [ "$first_entry" != "$bootstrap_claim" ]; then',
+    '      echo "Workspace volume resource $id is nonempty without an authenticated replacement sentinel" >&2',
+    "      exit 1",
+    "      fi",
+    '      if [ "$(find "$backing_path" -mindepth 1 -maxdepth 1 ! -name ' + `'${VOLUME_BOOTSTRAP_MARKER}.claim'` + ' -print -quit)" != "" ] || [ -L "$bootstrap_claim" ] || [ ! -f "$bootstrap_claim" ] || [ "$(stat -c "%u:%g:%a:%h" "$bootstrap_claim")" != "${volume_bootstrap_uid}:${volume_bootstrap_gid}:600:1" ] || [ "$(cat "$bootstrap_claim")" != "' + VOLUME_BOOTSTRAP_MARKER_CONTENT + '" ]; then',
+    '        echo "Workspace volume resource $id bootstrap marker mismatch" >&2',
+    "        exit 1",
+    "      fi",
+    '      rm -- "$bootstrap_claim"',
+    "    fi",
+    '    printf "%s\\n" "$identity" > "$sentinel"',
+    "  fi",
     '  mark_readonly_resource "$backing_path" "$mode"',
     '  prepare_resource_link "$id" "$link_path" "$backing_path"',
     "}",
     "",
+    "prepare_bundle_resource() {",
+    '  local id="$1" link_path="$2" backing_path="$3" archive="$4" identity="$5"',
+    '  [ -f "$archive" ] || { echo "Workspace bundle $id archive missing" >&2; exit 1; }',
+    '  local sentinel="$backing_path/.spawnfile-bundle-identity"',
+    '  if [ -e "$backing_path" ]; then',
+    '    [ -f "$sentinel" ] && [ "$(cat "$sentinel")" = "$identity" ] || { echo "Workspace bundle $id identity mismatch" >&2; exit 1; }',
+    "  else",
+    '    mkdir -p "$backing_path"',
+    '    tar --no-same-owner --no-same-permissions -xf "$archive" -C "$backing_path"',
+    '    printf %s "$identity" > "$sentinel"',
+    "  fi",
+    '  mark_readonly_resource "$backing_path" readonly',
+    '  prepare_resource_link "$id" "$link_path" "$backing_path"',
+    "}",
+    "",
     "prepare_git_resource() {",
     '  local id="$1"',
     '  local link_path="$2"',

package/dist/compiler/daimonTelemetryArtifacts.d.ts

@@ -0,0 +1,22 @@
+import type { ContainerPersistentMountReport } from "../report/index.js";
+import type { CompiledNodeArtifact, RuntimeTargetPlan } from "./containerArtifactsTypes.js";
+import type { CompilePlan } from "./types.js";
+export interface DaimonTelemetryArtifactBundle {
+    /** One durable volume per legacy Pi agent, mounted onto its telemetry directory. */
+    mounts: ContainerPersistentMountReport[];
+    /** Runtime target plan id (e.g. "pi-app") -> { node id -> telemetry persistent mount id
+     * }, so `containerArtifacts.ts` can stamp `runtime_instances[].telemetry_mount_ids` and
+     * `artifactsExportPlan.ts`'s `planDaimonFiles` can resolve each agent's telemetry volume
+     * without re-deriving container paths of its own. */
+    telemetryMountIdsByInstance: Map<string, Record<string, string>>;
+}
+/**
+ * Registers one run-scoped durable volume per legacy Pi agent for its daimon turn/wake
+ * causal telemetry directory (`<instanceRoot>/runtime/agents/<slug>/telemetry` — the parent
+ * of `causal.jsonl`, see `appCoreSource.ts`'s `runtimeHomePath`/`instanceRoot`), mirroring
+ * exactly how `moltnetArtifacts.ts` mounts the Moltnet causal directory (Piece 4b,
+ * Decision 21: daimon inner-truth telemetry was container-local — `docker cp` only — until
+ * now). Daimon's own write path is untouched: this only makes the HOST side of that same
+ * directory a named volume, so `docker rm` no longer discards it.
+ */
+export declare const createDaimonTelemetryArtifacts: (plan: CompilePlan, runtimePlans: RuntimeTargetPlan[], compiledNodes: CompiledNodeArtifact[]) => DaimonTelemetryArtifactBundle;

package/dist/compiler/daimonTelemetryArtifacts.js

@@ -0,0 +1,56 @@
+import path from "node:path/posix";
+import { resolveNoopolisRunId } from "../runtime/index.js";
+import { createPersistentVolumeName } from "./moltnetArtifactPaths.js";
+/** Only the legacy generated Pi application writes this telemetry layout. */
+const PI_TELEMETRY_RUNTIME_NAMES = new Set(["pi"]);
+const createTelemetryMountId = (agentSlug) => `agent-${agentSlug}-daimon-telemetry`;
+/**
+ * Registers one run-scoped durable volume per legacy Pi agent for its daimon turn/wake
+ * causal telemetry directory (`<instanceRoot>/runtime/agents/<slug>/telemetry` — the parent
+ * of `causal.jsonl`, see `appCoreSource.ts`'s `runtimeHomePath`/`instanceRoot`), mirroring
+ * exactly how `moltnetArtifacts.ts` mounts the Moltnet causal directory (Piece 4b,
+ * Decision 21: daimon inner-truth telemetry was container-local — `docker cp` only — until
+ * now). Daimon's own write path is untouched: this only makes the HOST side of that same
+ * directory a named volume, so `docker rm` no longer discards it.
+ */
+export const createDaimonTelemetryArtifacts = (plan, runtimePlans, compiledNodes) => {
+    // Same run-scoping key as every other durable mount (see
+    // moltnetArtifactPaths.ts's createPersistentVolumeName doc comment): present for
+    // `spawnfile run`/`up` (which always call ensureNoopolisRunId() first), absent for a
+    // bare `spawnfile compile`/`build`, keeping those byte-identical to before this module
+    // existed.
+    const runId = resolveNoopolisRunId(process.env);
+    const agentSlugByNodeId = new Map(compiledNodes
+        .filter((node) => node.kind === "agent" && Boolean(node.id))
+        .map((node) => [node.id, node.slug]));
+    const mounts = [];
+    const telemetryMountIdsByInstance = new Map();
+    for (const runtimePlan of runtimePlans) {
+        if (!PI_TELEMETRY_RUNTIME_NAMES.has(runtimePlan.runtimeName) || !runtimePlan.instancePaths.homePath) {
+            continue;
+        }
+        const instanceRoot = runtimePlan.instancePaths.instanceRoot ?? path.dirname(runtimePlan.instancePaths.homePath);
+        const mountIdsByNodeId = {};
+        for (const nodeId of runtimePlan.sourceIds ?? []) {
+            const agentSlug = agentSlugByNodeId.get(nodeId);
+            if (!agentSlug) {
+                continue;
+            }
+            const mountId = createTelemetryMountId(agentSlug);
+            mounts.push({
+                id: mountId,
+                mount_path: path.join(instanceRoot, "runtime", "agents", agentSlug, "telemetry"),
+                reason: `daimon turn/wake causal telemetry for ${agentSlug}`,
+                volume_name: createPersistentVolumeName(plan.root, mountId, runId)
+            });
+            mountIdsByNodeId[nodeId] = mountId;
+        }
+        if (Object.keys(mountIdsByNodeId).length > 0) {
+            telemetryMountIdsByInstance.set(runtimePlan.id, mountIdsByNodeId);
+        }
+    }
+    return {
+        mounts: mounts.sort((left, right) => left.id.localeCompare(right.id)),
+        telemetryMountIdsByInstance
+    };
+};

package/dist/compiler/deploymentLineage.d.ts

@@ -0,0 +1,40 @@
+import type { ContainerPersistentMountReport } from "../report/types.js";
+/**
+ * Lineage namespace for `spawnfile dev up`.
+ *
+ * A derived `exclusive-reattach` volume name folds in the deployment lineage,
+ * and `dev up` used to delegate straight to `up` with no distinguishing
+ * identity — so both defaulted to the lineage `default` and resolved to the
+ * SAME host volumes. A dev deployment started while production was stopped
+ * therefore attached production's volumes and wrote into live state. That is
+ * strictly worse than the loss this branch set out to fix: loss is recoverable
+ * from a backup, a dev agent editing production's message store is not.
+ *
+ * The namespace applies to the lineage only, never to the deployment name, so
+ * deployment records, labels, and `spawnfile dev stop --deployment <name>` are
+ * unchanged. It also applies regardless of `--deployment`, so `dev up
+ * --deployment blue` and `up --deployment blue` still cannot collide.
+ */
+export declare const DEV_DEPLOYMENT_LINEAGE_NAMESPACE = "dev";
+/**
+ * Combines a lineage namespace with a deployment name. The result is only ever
+ * a hash input (`createExclusiveReattachVolumeName`), so any injective
+ * encoding works; `\0` cannot occur in a deployment name and therefore cannot
+ * be used to forge a collision with a production lineage.
+ */
+export declare const resolveDeploymentLineage: (deploymentName: string, namespace?: string) => string;
+/**
+ * An author-declared volume name carries no lineage — that is the point of
+ * declaring it, and it is what lets an operator pre-create or migrate the
+ * volume. It also means the namespace above cannot protect a declared volume:
+ * `dev up` would attach production's `clank-newsroom-store` by that exact name.
+ *
+ * "I declared a stable host volume name" and "this is a throwaway dev
+ * deployment" are contradictory intentions, and the branch's established
+ * posture for that situation is to fail closed with a named, explicit
+ * override rather than to warn into a scrolling log. So `dev up` refuses,
+ * listing the exact volumes it would have attached, and `--allow-declared-volumes`
+ * is how an operator says they meant it (a scratch clone of the project, or a
+ * deliberate read of real state).
+ */
+export declare const assertNoDeclaredVolumeNames: (mounts: readonly ContainerPersistentMountReport[]) => void;

package/dist/compiler/deploymentLineage.js

@@ -0,0 +1,50 @@
+import { SpawnfileError } from "../shared/index.js";
+/**
+ * Lineage namespace for `spawnfile dev up`.
+ *
+ * A derived `exclusive-reattach` volume name folds in the deployment lineage,
+ * and `dev up` used to delegate straight to `up` with no distinguishing
+ * identity — so both defaulted to the lineage `default` and resolved to the
+ * SAME host volumes. A dev deployment started while production was stopped
+ * therefore attached production's volumes and wrote into live state. That is
+ * strictly worse than the loss this branch set out to fix: loss is recoverable
+ * from a backup, a dev agent editing production's message store is not.
+ *
+ * The namespace applies to the lineage only, never to the deployment name, so
+ * deployment records, labels, and `spawnfile dev stop --deployment <name>` are
+ * unchanged. It also applies regardless of `--deployment`, so `dev up
+ * --deployment blue` and `up --deployment blue` still cannot collide.
+ */
+export const DEV_DEPLOYMENT_LINEAGE_NAMESPACE = "dev";
+/**
+ * Combines a lineage namespace with a deployment name. The result is only ever
+ * a hash input (`createExclusiveReattachVolumeName`), so any injective
+ * encoding works; `\0` cannot occur in a deployment name and therefore cannot
+ * be used to forge a collision with a production lineage.
+ */
+export const resolveDeploymentLineage = (deploymentName, namespace) => namespace ? `${namespace}\0${deploymentName}` : deploymentName;
+/**
+ * An author-declared volume name carries no lineage — that is the point of
+ * declaring it, and it is what lets an operator pre-create or migrate the
+ * volume. It also means the namespace above cannot protect a declared volume:
+ * `dev up` would attach production's `clank-newsroom-store` by that exact name.
+ *
+ * "I declared a stable host volume name" and "this is a throwaway dev
+ * deployment" are contradictory intentions, and the branch's established
+ * posture for that situation is to fail closed with a named, explicit
+ * override rather than to warn into a scrolling log. So `dev up` refuses,
+ * listing the exact volumes it would have attached, and `--allow-declared-volumes`
+ * is how an operator says they meant it (a scratch clone of the project, or a
+ * deliberate read of real state).
+ */
+export const assertNoDeclaredVolumeNames = (mounts) => {
+    const declared = [...new Set(mounts.flatMap((mount) => mount.declared_volume_name ? [mount.declared_volume_name] : []))].sort();
+    if (declared.length === 0)
+        return;
+    throw new SpawnfileError("validation_error", `This dev deployment would attach ${declared.length} author-declared volume`
+        + `${declared.length === 1 ? "" : "s"} by name, which a production deployment of `
+        + `this project uses too: ${declared.join(", ")}. A declared name carries no `
+        + "deployment identity, so dev would write into that live state. Remove the "
+        + "declared name, run dev against a copy of the project, or pass "
+        + "--allow-declared-volumes to attach them deliberately.");
+};

package/dist/compiler/dockerBuildContext.d.ts

@@ -0,0 +1,16 @@
+export declare const DOCKER_BUILD_CONTEXT_IGNORE_PATTERNS: readonly ["runtimes/", "spawnfile-report.json", "deployments/"];
+export interface DockerBuildContextFile {
+    mode: number;
+    path: string;
+    size: number;
+}
+export interface DockerBuildContextIgnoreViolation {
+    pattern: string;
+    source: string;
+}
+export declare const matchesDockerBuildIgnorePattern: (relativePath: string, pattern: string) => boolean;
+export declare const createDockerIgnoreContent: () => string;
+export declare const listDockerBuildContextFiles: (directory: string) => Promise<DockerBuildContextFile[]>;
+export declare const createDockerBuildContextDigest: (directory: string) => Promise<string>;
+export declare const extractDockerBuildContextSources: (dockerfile: string) => string[];
+export declare const findIgnoredDockerBuildSources: (dockerfile: string, patterns?: readonly string[]) => DockerBuildContextIgnoreViolation[];