spawnfile 0.1.13 → 0.1.17

package/dist/compiler/moltnetRepresentativeResolution.js

@@ -1,7 +1,18 @@
 import { SpawnfileError } from "../shared/index.js";
+import { resolveMoltnetClientAuth } from "./moltnetConfigLowering.js";
 const cloneAttachment = (attachment, context) => ({
-    ...(attachment.dms ? { dms: { ...attachment.dms } } : {}),
-    memberId: context.memberId,
+    ...(attachment.auth ? { auth: { ...attachment.auth } } : {}),
+    ...(attachment.dms
+        ? {
+            dms: {
+                ...attachment.dms,
+                ...(attachment.dms.allowedWakeSenders !== undefined
+                    ? { allowedWakeSenders: [...attachment.dms.allowedWakeSenders] }
+                    : {})
+            }
+        }
+        : {}),
+    memberId: context.resolvedMemberId ?? context.memberId,
     network: attachment.network,
     ...(attachment.rooms
         ? {
@@ -60,7 +71,7 @@ export const resolveTeamRepresentatives = (plan, teamNode, seen = []) => {
     }
     return representatives;
 };
-export const resolveMoltnetAttachments = (attachments, context, nodeName) => {
+export const resolveMoltnetAttachments = (attachments, context, nodeName, runtimeName) => {
     if (!attachments || attachments.length === 0) {
         return undefined;
     }
@@ -72,6 +83,9 @@ export const resolveMoltnetAttachments = (attachments, context, nodeName) => {
         if (!network) {
             throw new SpawnfileError("validation_error", `Agent ${nodeName} references unknown Moltnet network ${attachment.network} on team ${context.teamName}`);
         }
+        if (network.server) {
+            resolveMoltnetClientAuth(network.server, network.id, context.memberId, undefined, attachment.auth?.tokenId, runtimeName);
+        }
         for (const roomId of Object.keys(attachment.rooms ?? {})) {
             const room = network.rooms.find((entry) => entry.id === roomId);
             if (!room) {

package/dist/compiler/moltnetResolution.js

@@ -1,6 +1,7 @@
 import { SpawnfileError } from "../shared/index.js";
 import { resolveMoltnetRoomMemberships } from "./moltnetRoomMemberships.js";
 import { resolveMoltnetAttachments } from "./moltnetRepresentativeResolution.js";
+import { resolveCanonicalAgentMemberId } from "./organizationIdentity.js";
 export { resolveMoltnetAttachments, resolveTeamRepresentatives } from "./moltnetRepresentativeResolution.js";
 const findTeamBySource = (plan, source) => {
     const node = plan.nodes.find((entry) => entry.kind === "team" && entry.value.source === source);
@@ -25,12 +26,16 @@ const validateGlobalMemberIds = (plan) => {
         context
     ]));
     for (const context of uniqueContexts.values()) {
-        const previous = seen.get(context.memberId);
+        const memberId = (plan.organizationIdentity?.externalParticipants.length ?? 0) > 0
+            ? resolveCanonicalAgentMemberId(plan, context.agentSource) ?? context.memberId
+            : context.memberId;
+        const previous = seen.get(memberId);
         const label = `${context.teamName} (${context.teamSource}) member ${context.memberId}`;
-        if (previous && previous !== label) {
-            throw new SpawnfileError("validation_error", `Moltnet member_id ${context.memberId} is declared by multiple direct agent member slots: ${previous}; ${label}`);
+        if (previous &&
+            previous.agentSource !== context.agentSource) {
+            throw new SpawnfileError("validation_error", `Moltnet member_id ${memberId} is declared by multiple direct agent member slots: ${previous.label}; ${label}`);
         }
-        seen.set(context.memberId, label);
+        seen.set(memberId, { agentSource: context.agentSource, label });
     }
 };
 const getRoomMemberships = (plan) => {
@@ -41,25 +46,59 @@ const getRoomMemberships = (plan) => {
 const synthesizeRepresentativeAttachments = (memberships) => memberships
     .filter((membership) => membership.representedSlot !== undefined)
     .map((membership) => ({
-    contextRooms: {
-        [membership.declaringTeamSource]: [membership.roomId]
-    },
-    memberId: membership.concreteMemberId,
-    network: membership.networkId,
-    rooms: {
-        [membership.roomId]: {}
-    },
-    teamSource: membership.declaringTeamSource
+    agentSource: membership.agentSource,
+    directTeamSource: membership.directTeamSource,
+    attachment: {
+        contextRooms: {
+            [membership.declaringTeamSource]: [membership.roomId]
+        },
+        memberId: membership.concreteMemberId,
+        network: membership.networkId,
+        rooms: {
+            [membership.roomId]: membership.policy ? { ...membership.policy } : {}
+        },
+        teamSource: membership.declaringTeamSource
+    }
 }));
-const roomPolicyKey = (policy) => JSON.stringify(policy ?? {});
+const areEquivalentDmPolicy = (left, right) => {
+    if (left.enabled !== right.enabled || left.wake !== right.wake) {
+        return false;
+    }
+    const leftSenders = left.allowedWakeSenders;
+    const rightSenders = right.allowedWakeSenders;
+    if (leftSenders === undefined || rightSenders === undefined) {
+        return leftSenders === rightSenders;
+    }
+    if (leftSenders.length !== rightSenders.length) {
+        return false;
+    }
+    return leftSenders.every((sender, index) => sender === rightSenders[index]);
+};
+const areEquivalentRoomPolicy = (left, right) => left.wake === right.wake;
 const hasRoomPolicy = (policy) => policy.wake !== undefined;
+const cloneMoltnetDm = (dms) => ({
+    ...dms,
+    ...(dms.allowedWakeSenders !== undefined
+        ? { allowedWakeSenders: [...dms.allowedWakeSenders] }
+        : {})
+});
 const mergeAttachment = (target, next, nodeName) => {
+    if (target.auth &&
+        next.auth &&
+        target.auth.tokenId !== next.auth.tokenId) {
+        throw new SpawnfileError("validation_error", `Agent ${nodeName} declares incompatible Moltnet auth for ${next.network}/${next.memberId ?? "unknown"}`);
+    }
+    if (!target.auth && next.auth) {
+        target.auth = { ...next.auth };
+    }
     if (target.dms &&
         next.dms &&
-        roomPolicyKey(target.dms) !== roomPolicyKey(next.dms)) {
+        !areEquivalentDmPolicy(target.dms, next.dms)) {
         throw new SpawnfileError("validation_error", `Agent ${nodeName} declares incompatible Moltnet dms for ${next.network}/${next.memberId ?? "unknown"}`);
     }
-    target.dms ??= next.dms ? { ...next.dms } : undefined;
+    if (!target.dms && next.dms) {
+        target.dms = cloneMoltnetDm(next.dms);
+    }
     target.teamSource ??= next.teamSource;
     target.rooms ??= {};
     for (const [roomId, policy] of Object.entries(next.rooms ?? {})) {
@@ -68,7 +107,7 @@ const mergeAttachment = (target, next, nodeName) => {
         const nextHasPolicy = hasRoomPolicy(policy);
         if (existingHasPolicy &&
             nextHasPolicy &&
-            roomPolicyKey(existingPolicy) !== roomPolicyKey(policy)) {
+            !areEquivalentRoomPolicy(existingPolicy, policy)) {
             throw new SpawnfileError("validation_error", `Agent ${nodeName} declares incompatible Moltnet room policy for ${next.network}/${next.memberId ?? "unknown"} room ${roomId}`);
         }
         target.rooms[roomId] = existingPolicy && existingHasPolicy && !nextHasPolicy
@@ -103,6 +142,7 @@ const mergeAgentAttachments = (agentNode, attachments) => {
             continue;
         }
         merged.set(key, {
+            ...(attachment.auth ? { auth: { ...attachment.auth } } : {}),
             contextRooms: attachment.contextRooms
                 ? Object.fromEntries(Object.entries(attachment.contextRooms).map(([teamSource, roomIds]) => [
                     teamSource,
@@ -111,7 +151,7 @@ const mergeAgentAttachments = (agentNode, attachments) => {
                 : attachment.teamSource
                     ? { [attachment.teamSource]: Object.keys(attachment.rooms ?? {}).sort() }
                     : undefined,
-            ...(attachment.dms ? { dms: { ...attachment.dms } } : {}),
+            ...(attachment.dms ? { dms: cloneMoltnetDm(attachment.dms) } : {}),
             memberId: attachment.memberId,
             network: attachment.network,
             ...(attachment.rooms
@@ -132,8 +172,10 @@ export const resolvePlanMoltnetAttachments = (plan) => {
     const roomMemberships = getRoomMemberships(plan);
     const synthesizedAttachments = synthesizeRepresentativeAttachments(roomMemberships);
     const synthesizedByAgent = new Map();
-    for (const attachment of synthesizedAttachments) {
-        const representativeContext = (plan.memberships ?? []).find((context) => context.memberId === attachment.memberId);
+    for (const synthesized of synthesizedAttachments) {
+        const { agentSource, attachment, directTeamSource } = synthesized;
+        const representativeContext = (plan.memberships ?? []).find((context) => context.agentSource === agentSource &&
+            context.teamSource === directTeamSource);
         if (!representativeContext) {
             throw new SpawnfileError("validation_error", `Unable to find direct member context for synthesized Moltnet member ${attachment.memberId ?? "unknown"}`);
         }
@@ -157,12 +199,16 @@ export const resolvePlanMoltnetAttachments = (plan) => {
                 continue;
             }
             const teamNode = findTeamBySource(plan, context.teamSource);
+            const resolvedMemberId = (plan.organizationIdentity?.externalParticipants.length ?? 0) > 0
+                ? resolveCanonicalAgentMemberId(plan, context.agentSource) ?? context.memberId
+                : context.memberId;
             const resolved = resolveMoltnetAttachments(declaredAttachments, {
                 memberId: context.memberId,
                 networks: teamNode.networks ?? [],
+                resolvedMemberId,
                 teamName: context.teamName,
                 teamSource: context.teamSource
-            }, agentNode.name);
+            }, agentNode.name, agentNode.runtime.name);
             resolvedAttachments.push(...(resolved ?? []));
         }
         resolvedAttachments.push(...(synthesizedByAgent.get(agentNode.source) ?? []));

package/dist/compiler/moltnetRoomMemberships.js

@@ -1,5 +1,8 @@
 import { SpawnfileError } from "../shared/index.js";
 import { resolveTeamRepresentatives } from "./moltnetRepresentativeResolution.js";
+import { resolveCanonicalAgentMemberId } from "./organizationIdentity.js";
+import { isDeclaredPairedRemoteRoomMember } from "../manifest/index.js";
+import { isAttachedExternalRoomMember } from "./buildCompilePlanTeams.js";
 const hasOwn = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
 const findAgentBySource = (plan, source) => {
     const node = plan.nodes.find((entry) => entry.kind === "agent" && entry.value.source === source);
@@ -18,6 +21,21 @@ const findTeamBySource = (plan, source) => {
 const clonePolicy = (policy) => ({
     ...(policy.wake ? { wake: policy.wake } : {})
 });
+const defaultNestedRepresentativePolicy = () => ({
+    wake: "mentions"
+});
+// Ordinary Moltnet uses direct member slots. B31's externally authorized
+// organization uses its canonical nested principal identifiers instead.
+const resolveConcreteMemberId = (plan, agentSource, authoredMemberId) => {
+    if ((plan.organizationIdentity?.externalParticipants.length ?? 0) === 0) {
+        return authoredMemberId;
+    }
+    const canonicalMemberId = resolveCanonicalAgentMemberId(plan, agentSource);
+    if (!canonicalMemberId) {
+        throw new SpawnfileError("validation_error", `Unable to resolve canonical Moltnet member id for ${agentSource}`);
+    }
+    return canonicalMemberId;
+};
 const findDirectRoomPolicy = (plan, teamNode, agentSource, memberId, networkId, roomId) => {
     const agentNode = findAgentBySource(plan, agentSource);
     for (const attachment of agentNode.surfaces?.moltnet ?? []) {
@@ -47,23 +65,40 @@ const compareRoomMemberships = (left, right) => [
     left.agentSource.localeCompare(right.agentSource)
 ].find((result) => result !== 0) ?? 0;
 export const listConcreteMoltnetRoomMemberIds = (plan, teamNode, networkId, room, memberships = plan.moltnetRoomMemberships) => {
+    const network = teamNode.networks?.find((candidate) => candidate.id === networkId);
+    const externalMembers = room.members.filter((memberId) => isAttachedExternalRoomMember(teamNode, networkId, memberId));
+    const remoteMembers = network
+        ? room.members.filter((memberId) => isDeclaredPairedRemoteRoomMember(network, room, memberId))
+        : [];
     if (memberships) {
         return [
-            ...new Set(memberships
-                .filter((membership) => membership.declaringTeamSource === teamNode.source
-                && membership.networkId === networkId
-                && membership.roomId === room.id)
-                .map((membership) => membership.concreteMemberId))
+            ...new Set([
+                ...memberships
+                    .filter((membership) => membership.declaringTeamSource === teamNode.source
+                    && membership.networkId === networkId
+                    && membership.roomId === room.id)
+                    .map((membership) => membership.concreteMemberId),
+                ...externalMembers,
+                ...remoteMembers
+            ])
         ].sort();
     }
     const concreteMembers = [];
     for (const declaredSlot of room.members) {
         const member = teamNode.members.find((entry) => entry.id === declaredSlot);
         if (!member) {
+            if (isAttachedExternalRoomMember(teamNode, networkId, declaredSlot)) {
+                concreteMembers.push(declaredSlot);
+                continue;
+            }
+            if (network && isDeclaredPairedRemoteRoomMember(network, room, declaredSlot)) {
+                concreteMembers.push(declaredSlot);
+                continue;
+            }
             throw new SpawnfileError("validation_error", `Team ${teamNode.name} Moltnet room ${room.id} references unknown member ${declaredSlot}`);
         }
         if (member.kind === "agent") {
-            concreteMembers.push(member.id);
+            concreteMembers.push(resolveConcreteMemberId(plan, member.nodeSource, member.id));
             continue;
         }
         const childTeam = findTeamBySource(plan, member.nodeSource);
@@ -71,7 +106,7 @@ export const listConcreteMoltnetRoomMemberIds = (plan, teamNode, networkId, room
         if (representatives.length === 0) {
             throw new SpawnfileError("validation_error", `Team ${childTeam.name} has no concrete representative for Moltnet room ${room.id} on ${teamNode.name}`);
         }
-        concreteMembers.push(...representatives.map((representative) => representative.memberId));
+        concreteMembers.push(...representatives.map((representative) => resolveConcreteMemberId(plan, representative.agentSource, representative.memberId)));
     }
     return [...new Set(concreteMembers)].sort();
 };
@@ -87,6 +122,12 @@ export const resolveMoltnetRoomMemberships = (plan) => {
                 for (const declaredSlot of room.members) {
                     const declaredMember = teamNode.members.find((member) => member.id === declaredSlot);
                     if (!declaredMember) {
+                        if (isAttachedExternalRoomMember(teamNode, network.id, declaredSlot)) {
+                            continue;
+                        }
+                        if (isDeclaredPairedRemoteRoomMember(network, room, declaredSlot)) {
+                            continue;
+                        }
                         throw new SpawnfileError("validation_error", `Team ${teamNode.name} Moltnet room ${room.id} references unknown member ${declaredSlot}`);
                     }
                     if (declaredMember.kind === "agent") {
@@ -95,7 +136,7 @@ export const resolveMoltnetRoomMemberships = (plan) => {
                         memberships.push({
                             agentName: agentNode.name,
                             agentSource: agentNode.source,
-                            concreteMemberId: declaredSlot,
+                            concreteMemberId: resolveConcreteMemberId(plan, agentNode.source, declaredSlot),
                             declaredSlot,
                             declaringTeamName: teamNode.name,
                             declaringTeamSource: teamNode.source,
@@ -114,10 +155,11 @@ export const resolveMoltnetRoomMemberships = (plan) => {
                     }
                     for (const representative of representatives) {
                         const agentNode = findAgentBySource(plan, representative.agentSource);
+                        const policy = findDirectRoomPolicy(plan, teamNode, agentNode.source, representative.memberId, network.id, room.id) ?? defaultNestedRepresentativePolicy();
                         memberships.push({
                             agentName: agentNode.name,
                             agentSource: agentNode.source,
-                            concreteMemberId: representative.memberId,
+                            concreteMemberId: resolveConcreteMemberId(plan, representative.agentSource, representative.memberId),
                             declaredSlot,
                             declaringTeamName: teamNode.name,
                             declaringTeamSource: teamNode.source,
@@ -128,6 +170,7 @@ export const resolveMoltnetRoomMemberships = (plan) => {
                             representedTeamName: childTeam.name,
                             representedTeamSource: childTeam.source,
                             representativePath: [declaredSlot, ...representative.path],
+                            ...(policy ? { policy } : {}),
                             roomId: room.id
                         });
                     }

package/dist/compiler/moltnetRoomPolicyCompatibility.d.ts

@@ -1,4 +1,4 @@
 import type { TeamNetworkServer } from "../manifest/index.js";
 export declare const assertCompatibleMoltnetNetworkName: (networkId: string, existing: string | undefined, next: string | undefined) => void;
 export declare const assertCompatibleMoltnetServer: (networkId: string, existing: TeamNetworkServer, next: TeamNetworkServer) => void;
-export declare const assertCompatibleMoltnetRoomPolicy: (networkId: string, roomId: string, field: "visibility" | "write_policy", existing: string | undefined, next: string | undefined) => void;
+export declare const assertCompatibleMoltnetRoomPolicy: (networkId: string, roomId: string, field: "federation" | "visibility" | "write_policy", existing: string | string[] | undefined, next: string | string[] | undefined) => void;

package/dist/compiler/moltnetRoomPolicyCompatibility.js

@@ -22,7 +22,9 @@ export const assertCompatibleMoltnetServer = (networkId, existing, next) => {
     }
 };
 export const assertCompatibleMoltnetRoomPolicy = (networkId, roomId, field, existing, next) => {
-    if (existing !== undefined && next !== undefined && existing !== next) {
+    if (existing !== undefined
+        && next !== undefined
+        && stableStringify(existing) !== stableStringify(next)) {
         throw new SpawnfileError("validation_error", `Duplicate Moltnet network ${networkId} room ${roomId} declares conflicting ${field}: ${existing} vs ${next}`);
     }
 };

package/dist/compiler/moltnetRuntimeConfig.d.ts

@@ -1,2 +1,2 @@
 import type { CompilePlan, ResolvedAgentNode } from "./types.js";
-export declare const resolveRuntimeConfig: (plan: CompilePlan, agentNode: ResolvedAgentNode, nodeSlug: string, _networkId: string, _agentId: string) => Record<string, string>;
+export declare const resolveRuntimeConfig: (plan: CompilePlan, agentNode: ResolvedAgentNode, nodeSlug: string, networkId: string, moltnetAgentId: string) => Record<string, string>;

package/dist/compiler/moltnetRuntimeConfig.js

@@ -1,5 +1,6 @@
 import { getRuntimeAdapter } from "../runtime/index.js";
 import { SpawnfileError } from "../shared/index.js";
+import { createMoltnetDaimonReceiptStorePath } from "./moltnetConfigLowering.js";
 const INSTANCE_ROOT_PLACEHOLDER = "<instance-root>";
 const CONFIG_FILE_PLACEHOLDER = "<config-file>";
 const resolveSequentialRuntimePort = (plan, runtimeName, slug) => {
@@ -28,7 +29,14 @@ const resolveRuntimeInstancePaths = (runtimeName, slug) => {
             : undefined
     };
 };
-export const resolveRuntimeConfig = (plan, agentNode, nodeSlug, _networkId, _agentId) => {
+const resolveDaimonAgentId = (plan, agentNode) => {
+    const compiled = plan.nodes.find((node) => node.kind === "agent" && node.value.source === agentNode.source);
+    if (!compiled) {
+        throw new SpawnfileError("compile_error", `Unable to resolve Daimon runtime agent identity for ${agentNode.name}`);
+    }
+    return compiled.id;
+};
+export const resolveRuntimeConfig = (plan, agentNode, nodeSlug, networkId, moltnetAgentId) => {
     switch (agentNode.runtime.name) {
         case "openclaw": {
             const port = resolveSequentialRuntimePort(plan, "openclaw", nodeSlug);
@@ -51,7 +59,19 @@ export const resolveRuntimeConfig = (plan, agentNode, nodeSlug, _networkId, _age
                 kind: "picoclaw"
             };
         }
-        case "daimon":
+        case "daimon": {
+            const port = getRuntimeAdapter("daimon").container.port;
+            if (!port) {
+                throw new SpawnfileError("compile_error", `Unable to resolve Daimon control port for Moltnet agent ${agentNode.name}`);
+            }
+            return {
+                agent_id: resolveDaimonAgentId(plan, agentNode),
+                control_url: `http://127.0.0.1:${port}`,
+                kind: "daimon",
+                receipt_store_path: createMoltnetDaimonReceiptStorePath(networkId, moltnetAgentId),
+                token_env: "SPAWNFILE_DAIMON_CONTROL_TOKEN"
+            };
+        }
         case "pi": {
             const port = getRuntimeAdapter(agentNode.runtime.name).container.port;
             if (!port) {

package/dist/compiler/moltnetServerPlans.d.ts

@@ -0,0 +1,9 @@
+import type { MoltnetServerPlan } from "./moltnetArtifactTypes.js";
+import type { CompilePlan, ResolvedTeamNode } from "./types.js";
+interface TeamPlanNode {
+    id: string;
+    slug: string;
+    value: ResolvedTeamNode;
+}
+export declare const resolveMoltnetServerPlans: (plan: CompilePlan, teamNodes: readonly TeamPlanNode[]) => Map<string, MoltnetServerPlan>;
+export {};

package/dist/compiler/moltnetServerPlans.js

@@ -0,0 +1,151 @@
+import { SpawnfileError } from "../shared/index.js";
+import { createMoltnetServerConfigPath, resolveMoltnetBaseUrl } from "./moltnetConfigLowering.js";
+import { listConcreteMoltnetRoomMemberIds } from "./moltnetRoomMemberships.js";
+import { assertCompatibleMoltnetNetworkName, assertCompatibleMoltnetRoomPolicy, assertCompatibleMoltnetServer } from "./moltnetRoomPolicyCompatibility.js";
+import { resolveNetworkPort, toContainerRootfsPath } from "./moltnetArtifactPaths.js";
+const DEFAULT_MOLTNET_PORT = 8787;
+const orderedDeclarations = (teamNodes) => [...teamNodes]
+    .sort((left, right) => left.value.source.localeCompare(right.value.source))
+    .flatMap((team) => [...(team.value.networks ?? [])]
+    .sort((left, right) => left.id.localeCompare(right.id))
+    .map((network) => ({ network, team })));
+const organizationTeamIds = (plan) => {
+    const root = plan.nodes.find((node) => node.kind === "team" && node.value.source === plan.root);
+    if (!root)
+        return new Set();
+    const ids = new Set([root.id]);
+    const pending = [root.id];
+    while (pending.length > 0) {
+        const parent = pending.shift();
+        for (const edge of plan.edges.filter((entry) => entry.kind === "team_member" && entry.from === parent)) {
+            const child = plan.nodes.find((node) => node.id === edge.to);
+            if (!child || child.kind !== "team" || ids.has(child.id))
+                continue;
+            ids.add(child.id);
+            pending.push(child.id);
+        }
+    }
+    return ids;
+};
+const assertCompatibleOwner = (existing, declaration) => {
+    const { network } = declaration;
+    const server = network.server;
+    if (!server)
+        return;
+    if (existing.baseUrl !== resolveMoltnetBaseUrl(server)) {
+        throw new SpawnfileError("validation_error", `Duplicate Moltnet network ${network.id} declares conflicting server URL`);
+    }
+    assertCompatibleMoltnetNetworkName(network.id, existing.name, network.name);
+    assertCompatibleMoltnetServer(network.id, existing.server, server);
+};
+const createOwnedPlan = (declaration, fallbackPort) => {
+    const { network, team } = declaration;
+    const server = network.server;
+    if (!server) {
+        throw new SpawnfileError("validation_error", `Moltnet network ${network.id} must declare server`);
+    }
+    const port = server.mode === "managed"
+        ? resolveNetworkPort(network, fallbackPort)
+        : undefined;
+    const serverId = `${team.slug}-${network.id}`;
+    return {
+        baseUrl: resolveMoltnetBaseUrl(server),
+        ...(server.mode === "managed"
+            ? { configPath: toContainerRootfsPath(createMoltnetServerConfigPath(serverId)) }
+            : {}),
+        id: serverId,
+        mode: server.mode,
+        name: network.name,
+        networkId: network.id,
+        ...(port ? { port } : {}),
+        rooms: [],
+        server,
+        secretPatches: [],
+        teamSource: team.value.source
+    };
+};
+const mergeRooms = (plan, serverPlan, declaration) => {
+    const { network, team } = declaration;
+    for (const room of network.rooms) {
+        const concreteMembers = listConcreteMoltnetRoomMemberIds(plan, team.value, network.id, room);
+        const existingRoom = serverPlan.rooms.find((entry) => entry.id === room.id);
+        if (!existingRoom) {
+            serverPlan.rooms.push({
+                ...(room.federation ? { federation: room.federation } : {}),
+                id: room.id,
+                members: concreteMembers,
+                ...(room.name ? { name: room.name } : {}),
+                ...(room.visibility ? { visibility: room.visibility } : {}),
+                ...(room.write_policy ? { write_policy: room.write_policy } : {})
+            });
+            continue;
+        }
+        existingRoom.members = [
+            ...new Set([...existingRoom.members, ...concreteMembers])
+        ].sort();
+        assertCompatibleMoltnetRoomPolicy(network.id, room.id, "federation", existingRoom.federation, room.federation);
+        assertCompatibleMoltnetRoomPolicy(network.id, room.id, "visibility", existingRoom.visibility, room.visibility);
+        assertCompatibleMoltnetRoomPolicy(network.id, room.id, "write_policy", existingRoom.write_policy, room.write_policy);
+        existingRoom.federation ??= room.federation;
+        existingRoom.visibility ??= room.visibility;
+        existingRoom.write_policy ??= room.write_policy;
+    }
+};
+export const resolveMoltnetServerPlans = (plan, teamNodes) => {
+    const organizationIds = plan.organizationIdentity
+        ? organizationTeamIds(plan)
+        : undefined;
+    const declarations = orderedDeclarations(organizationIds
+        ? teamNodes.filter((team) => organizationIds.has(team.id))
+        : teamNodes);
+    const ownerlessRoot = declarations.find((declaration) => declaration.team.value.source === plan.root && !declaration.network.server);
+    if (ownerlessRoot) {
+        throw new SpawnfileError("validation_error", `Root Moltnet network ${ownerlessRoot.network.id} must declare a server owner`);
+    }
+    const serverPlans = new Map();
+    let nextPort = DEFAULT_MOLTNET_PORT;
+    for (const declaration of declarations) {
+        if (!declaration.network.server)
+            continue;
+        const existing = serverPlans.get(declaration.network.id);
+        if (existing) {
+            assertCompatibleOwner(existing, declaration);
+            continue;
+        }
+        const serverPlan = createOwnedPlan(declaration, nextPort);
+        serverPlans.set(declaration.network.id, serverPlan);
+        if (serverPlan.port)
+            nextPort = Math.max(nextPort, serverPlan.port + 1);
+    }
+    const declarationCounts = new Map();
+    for (const declaration of declarations) {
+        const networkId = declaration.network.id;
+        const serverPlan = serverPlans.get(networkId);
+        if (!serverPlan) {
+            throw new SpawnfileError("validation_error", `Moltnet network ${networkId} must resolve to at least one server owner`);
+        }
+        declarationCounts.set(networkId, (declarationCounts.get(networkId) ?? 0) + 1);
+        mergeRooms(plan, serverPlan, declaration);
+    }
+    for (const [networkId, count] of declarationCounts) {
+        if (count > 1)
+            serverPlans.get(networkId)?.rooms.sort((left, right) => left.id.localeCompare(right.id));
+    }
+    for (const serverPlan of serverPlans.values()) {
+        const pairingIds = new Set(serverPlan.server.mode === "managed"
+            ? (serverPlan.server.pairings ?? []).map((pairing) => pairing.id)
+            : []);
+        for (const room of serverPlan.rooms) {
+            if (serverPlan.server.mode === "external" && room.federation !== undefined) {
+                throw new SpawnfileError("validation_error", `External Moltnet network ${serverPlan.networkId} room ${room.id} cannot declare federation`);
+            }
+            if (!Array.isArray(room.federation))
+                continue;
+            const unknownPairing = room.federation.find((pairingId) => !pairingIds.has(pairingId));
+            if (unknownPairing) {
+                throw new SpawnfileError("validation_error", `Moltnet network ${serverPlan.networkId} room ${room.id} federation references unknown pairing ${unknownPairing}`);
+            }
+        }
+    }
+    return serverPlans;
+};

package/dist/compiler/organizationExternalParticipants.d.ts

@@ -0,0 +1,3 @@
+import type { CompilePlan, MoltnetExternalParticipantIntent } from "./types.js";
+export declare const validateB31MoltnetAuth: (plan: CompilePlan) => void;
+export declare const resolveMoltnetExternalParticipantIntents: (plan: CompilePlan) => MoltnetExternalParticipantIntent[];