spawnfile 0.1.13 → 0.1.17

package/dist/compiler/organizationExternalParticipants.js

@@ -0,0 +1,176 @@
+import { SpawnfileError } from "../shared/index.js";
+import { assertOrganizationSegment, compareOrganizationIds, exactOrganizationStrings, organizationAgentPaths, organizationIdentityFail, requiredOrganizationIdentity, rootOrganizationTeam, } from "./organizationIdentityGraph.js";
+const actorTokenFor = (server, tokenId, memberId, observePolicy = "forbid") => {
+    const token = server.auth.tokens?.filter((entry) => entry.id === tokenId);
+    if (token?.length !== 1) {
+        organizationIdentityFail(`Moltnet actor token ${tokenId} must exist exactly once`);
+    }
+    const selected = requiredOrganizationIdentity(token?.[0], `Moltnet actor token ${tokenId} must exist exactly once`);
+    const validScopes = (observePolicy !== "require" && exactOrganizationStrings(selected.scopes, ["attach", "write"])) || (observePolicy !== "forbid"
+        && exactOrganizationStrings(selected.scopes, ["attach", "observe", "write"]));
+    if (!validScopes || !exactOrganizationStrings(selected.agents, [memberId])) {
+        organizationIdentityFail(`Moltnet actor token ${tokenId} has invalid scopes or agents for ${memberId}`);
+    }
+    return selected;
+};
+const isPairingAuthToken = (server, token) => token.agents === undefined
+    && exactOrganizationStrings(token.scopes, ["pair"])
+    && (server.pairings ?? []).filter((pairing) => pairing.id === token.id && pairing.token_secret === token.secret).length === 1;
+const isObserveOnlyConsoleToken = (token) => token.agents === undefined && exactOrganizationStrings(token.scopes, ["observe"]);
+const validateB31Networks = (plan) => {
+    const root = requiredOrganizationIdentity(rootOrganizationTeam(plan), "B31 root team is missing");
+    const services = requiredOrganizationIdentity(root.externalParticipants, "B31 participants are missing");
+    const networkIds = new Set(services.flatMap((service) => service.surfaces.moltnet.map((attachment) => attachment.network)));
+    for (const network of root.networks ?? []) {
+        if (!networkIds.has(network.id))
+            continue;
+        assertOrganizationSegment(network.id, "B31 network id");
+        if (network.server?.mode !== "managed" || network.server.auth.mode !== "bearer"
+            || network.server.direct_messages !== true) {
+            organizationIdentityFail(`B31 network ${network.id} requires managed bearer direct_messages`);
+        }
+        const server = requiredOrganizationIdentity(network.server, `B31 network ${network.id} requires a managed server`);
+        if (JSON.stringify(server.auth.client) !== JSON.stringify({ token_id: "operator" })) {
+            organizationIdentityFail(`B31 network ${network.id} requires auth.client token_id operator`);
+        }
+        const tokens = server.auth.tokens ?? [];
+        const operator = tokens.find((token) => token.id === "operator");
+        if (tokens.filter((token) => token.id === "operator").length !== 1 || !operator
+            || operator.agents !== undefined
+            || !exactOrganizationStrings(operator.scopes, ["admin", "observe", "write"])) {
+            organizationIdentityFail(`B31 network ${network.id} has invalid operator token`);
+        }
+        const resolvedOperator = requiredOrganizationIdentity(operator, `B31 network ${network.id} has invalid operator token`);
+        const usedTokenIds = new Set();
+        const usedEnvNames = new Set();
+        for (const token of tokens) {
+            assertOrganizationSegment(token.id, "Moltnet token id");
+            if (!/^[A-Z_][A-Z0-9_]{0,127}$/u.test(token.secret)) {
+                organizationIdentityFail(`invalid Moltnet token env name ${token.secret}`);
+            }
+            if (usedTokenIds.has(token.id) || usedEnvNames.has(token.secret)) {
+                organizationIdentityFail(`duplicate Moltnet token identity ${token.id}`);
+            }
+            usedTokenIds.add(token.id);
+            usedEnvNames.add(token.secret);
+            if (token.id !== "operator" && token.secret === resolvedOperator.secret) {
+                organizationIdentityFail("operator and actor token env identities must differ");
+            }
+        }
+    }
+    return networkIds;
+};
+export const validateB31MoltnetAuth = (plan) => {
+    const root = rootOrganizationTeam(plan);
+    if (!root?.externalParticipants?.length)
+        return;
+    const identity = requiredOrganizationIdentity(plan.organizationIdentity, "B31 organization identity is missing");
+    const paths = organizationAgentPaths(plan);
+    const networkIds = validateB31Networks(plan);
+    const selectedByNetwork = new Map();
+    const selectedActorKeys = new Set();
+    for (const member of identity.agentMembers) {
+        const source = [...paths.entries()].find(([, path]) => path.join(".") === member.memberId)?.[0];
+        const node = plan.nodes.find((entry) => entry.kind === "agent"
+            && entry.value.source === source);
+        const attachments = node?.value?.surfaces?.moltnet ?? [];
+        for (const attachment of attachments.filter((entry) => networkIds.has(entry.network))) {
+            const network = root.networks?.find((entry) => entry.id === attachment.network);
+            const selectedTokenId = requiredOrganizationIdentity(attachment.auth?.tokenId, `B31 agent ${member.memberId} must select auth.token_id`);
+            const actorKey = `${attachment.network}\u0000${member.memberId}`;
+            if (selectedActorKeys.has(actorKey)) {
+                organizationIdentityFail(`B31 actor ${member.memberId} selects more than one token on ${attachment.network}`);
+            }
+            selectedActorKeys.add(actorKey);
+            if (network?.server?.mode === "managed") {
+                const token = actorTokenFor(network.server, selectedTokenId, member.memberId, node?.runtimeName === "daimon" ? "require" : "forbid");
+                const selected = selectedByNetwork.get(attachment.network) ?? new Map();
+                const previous = selected.get(selectedTokenId);
+                if (previous) {
+                    organizationIdentityFail(`Moltnet actor token ${selectedTokenId} is shared by ${previous} and ${member.memberId}`);
+                }
+                selected.set(selectedTokenId, member.memberId);
+                selectedByNetwork.set(attachment.network, selected);
+                if (token.id === "operator") {
+                    organizationIdentityFail(`B31 actor ${member.memberId} must not use operator token`);
+                }
+            }
+        }
+    }
+    for (const service of root.externalParticipants) {
+        for (const attachment of service.surfaces.moltnet) {
+            const network = root.networks?.find((entry) => entry.id === attachment.network);
+            if (network?.server?.mode !== "managed")
+                continue;
+            const token = actorTokenFor(network.server, attachment.auth.token_id, service.id, "allow");
+            if (token.id === "operator") {
+                organizationIdentityFail(`B31 external participant ${service.id} must not use operator token`);
+            }
+            const selected = selectedByNetwork.get(attachment.network) ?? new Map();
+            const previous = selected.get(token.id);
+            if (previous)
+                organizationIdentityFail(`Moltnet actor token ${token.id} is shared by ${previous} and ${service.id}`);
+            selected.set(token.id, service.id);
+            selectedByNetwork.set(attachment.network, selected);
+        }
+    }
+    for (const network of root.networks ?? []) {
+        const selected = selectedByNetwork.get(network.id);
+        if (network.server?.mode !== "managed" || !selected)
+            continue;
+        for (const token of network.server.auth.tokens ?? []) {
+            if (token.id !== "operator" && !selected.has(token.id)
+                && !isPairingAuthToken(network.server, token)
+                && !isObserveOnlyConsoleToken(token)) {
+                organizationIdentityFail(`Moltnet actor token ${token.id} is not selected by exactly one actor`);
+            }
+        }
+    }
+};
+export const resolveMoltnetExternalParticipantIntents = (plan) => {
+    const identity = plan.organizationIdentity;
+    const root = rootOrganizationTeam(plan);
+    if (!identity || !root?.externalParticipants?.length)
+        return [];
+    const paths = organizationAgentPaths(plan);
+    const agents = new Map(identity.agentMembers.map((member) => [member.memberId, member]));
+    const networkIds = new Set((root.networks ?? []).map((network) => network.id));
+    const result = [];
+    for (const service of root.externalParticipants) {
+        const participant = identity.externalParticipants.find((entry) => entry.memberId === service.id);
+        if (!participant) {
+            throw new SpawnfileError("validation_error", `missing external participant identity: ${service.id}`);
+        }
+        for (const attachment of service.surfaces.moltnet) {
+            if (!networkIds.has(attachment.network)) {
+                organizationIdentityFail(`external participant ${service.id} references unknown network ${attachment.network}`);
+            }
+            const peers = [];
+            for (const [memberId, agent] of agents) {
+                const node = plan.nodes.find((entry) => entry.kind === "agent"
+                    && paths.get(entry.value.source)?.join(".") === memberId);
+                const authored = node?.value?.surfaces?.moltnet ?? [];
+                const eligible = authored.filter((entry) => entry.network === attachment.network && entry.dms?.enabled === true);
+                if (eligible.length > 1) {
+                    organizationIdentityFail(`duplicate eligible Moltnet peer for ${service.id}/${attachment.network}`);
+                }
+                if (eligible.length === 1)
+                    peers.push(agent.memberId);
+            }
+            if (new Set(peers).size !== peers.length) {
+                organizationIdentityFail(`duplicate eligible Moltnet peer for ${service.id}/${attachment.network}`);
+            }
+            if (peers.length === 0) {
+                organizationIdentityFail(`external participant ${service.id}/${attachment.network} has no eligible direct-message peers`);
+            }
+            peers.sort(compareOrganizationIds);
+            const network = root.networks?.find((entry) => entry.id === attachment.network);
+            const token = network?.server?.mode === "managed"
+                ? actorTokenFor(network.server, attachment.auth.token_id, service.id, "allow")
+                : undefined;
+            result.push({ participant, networkId: attachment.network, tokenId: attachment.auth.token_id,
+                tokenEnv: token?.secret ?? "", directMessagePeers: peers });
+        }
+    }
+    return result;
+};

package/dist/compiler/organizationIdentity.d.ts

@@ -0,0 +1,21 @@
+import type { CompilePlan } from "./types.js";
+export { MAX_EXTERNAL_PARTICIPANTS, MAX_ORGANIZATION_AGENT_MEMBERS, MAX_ORGANIZATION_MEMBER_DEPTH, MAX_ORGANIZATION_MEMBER_ID_BYTES, ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE, ORGANIZATION_MEMBER_ID_PATTERN_SOURCE, } from "./organizationIdentityGraph.js";
+export { resolveMoltnetExternalParticipantIntents, validateB31MoltnetAuth, } from "./organizationExternalParticipants.js";
+export interface ResolvedOrganizationAgentMember {
+    readonly authoredMemberKey: string;
+    readonly kind: "agent";
+    readonly memberId: string;
+    readonly principalId: string;
+}
+export interface ResolvedExternalParticipant {
+    readonly authoredParticipantKey: string;
+    readonly kind: "service";
+    readonly memberId: string;
+    readonly principalId: string;
+}
+export interface ResolvedOrganizationIdentity {
+    readonly agentMembers: readonly ResolvedOrganizationAgentMember[];
+    readonly externalParticipants: readonly ResolvedExternalParticipant[];
+}
+export declare const resolveCanonicalAgentMemberId: (plan: CompilePlan, agentSource: string) => string | undefined;
+export declare const resolveOrganizationIdentity: (plan: CompilePlan) => ResolvedOrganizationIdentity | undefined;

package/dist/compiler/organizationIdentity.js

@@ -0,0 +1,64 @@
+import { assertOrganizationSegment, compareOrganizationIds, freezeOrganizationIdentity, MAX_EXTERNAL_PARTICIPANTS, MAX_ORGANIZATION_AGENT_MEMBERS, MAX_ORGANIZATION_MEMBER_DEPTH, MAX_ORGANIZATION_MEMBER_ID_BYTES, ORGANIZATION_MEMBER_ID_PATTERN_SOURCE, organizationAgentPaths, organizationIdentityFail, rootOrganizationTeam, } from "./organizationIdentityGraph.js";
+export { MAX_EXTERNAL_PARTICIPANTS, MAX_ORGANIZATION_AGENT_MEMBERS, MAX_ORGANIZATION_MEMBER_DEPTH, MAX_ORGANIZATION_MEMBER_ID_BYTES, ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE, ORGANIZATION_MEMBER_ID_PATTERN_SOURCE, } from "./organizationIdentityGraph.js";
+export { resolveMoltnetExternalParticipantIntents, validateB31MoltnetAuth, } from "./organizationExternalParticipants.js";
+const memberIdPattern = new RegExp(ORGANIZATION_MEMBER_ID_PATTERN_SOURCE, "u");
+export const resolveCanonicalAgentMemberId = (plan, agentSource) => {
+    if (!plan.organizationIdentity)
+        return undefined;
+    return organizationAgentPaths(plan).get(agentSource)?.join(".");
+};
+export const resolveOrganizationIdentity = (plan) => {
+    const root = rootOrganizationTeam(plan);
+    const declaredTeams = plan.nodes.filter((node) => node.kind === "team"
+        && (node.value.externalParticipants?.length ?? 0) > 0);
+    if (declaredTeams.some((node) => node.value.source !== root?.source)) {
+        organizationIdentityFail("external_participants may only be declared on the root team");
+    }
+    if (!root)
+        return undefined;
+    const paths = organizationAgentPaths(plan);
+    const agents = [];
+    const agentIds = new Set();
+    for (const node of plan.nodes.filter((entry) => entry.kind === "agent")) {
+        const path = paths.get(node.value.source);
+        if (!path)
+            continue;
+        if (path.length > MAX_ORGANIZATION_MEMBER_DEPTH) {
+            organizationIdentityFail("organization member depth exceeds 8");
+        }
+        path.forEach((part) => assertOrganizationSegment(part, "organization member slot"));
+        const memberId = path.join(".");
+        if (!memberIdPattern.test(memberId)
+            || Buffer.byteLength(memberId, "ascii") > MAX_ORGANIZATION_MEMBER_ID_BYTES) {
+            organizationIdentityFail(`invalid organization member id: ${memberId}`);
+        }
+        if (agentIds.has(memberId))
+            organizationIdentityFail(`duplicate organization member id: ${memberId}`);
+        agentIds.add(memberId);
+        agents.push({ authoredMemberKey: path.at(-1), kind: "agent", memberId, principalId: `agent:${memberId}` });
+    }
+    if (agents.length > MAX_ORGANIZATION_AGENT_MEMBERS) {
+        organizationIdentityFail("organization has too many agent members");
+    }
+    const seen = new Set();
+    const externalParticipants = (root.externalParticipants ?? []).map((service) => {
+        assertOrganizationSegment(service.id, "external participant id");
+        if (seen.has(service.id))
+            organizationIdentityFail(`organization member collision: ${service.id}`);
+        seen.add(service.id);
+        return { authoredParticipantKey: service.id, kind: "service",
+            memberId: service.id, principalId: `system:${service.id}` };
+    });
+    for (const agent of agents) {
+        if (seen.has(agent.memberId))
+            organizationIdentityFail(`organization member collision: ${agent.memberId}`);
+    }
+    if (externalParticipants.length > MAX_EXTERNAL_PARTICIPANTS) {
+        organizationIdentityFail("too many external participants");
+    }
+    const result = {
+        agentMembers: agents.sort((a, b) => compareOrganizationIds(a.memberId, b.memberId)),
+        externalParticipants: externalParticipants.sort((a, b) => compareOrganizationIds(a.memberId, b.memberId)),
+    };
+    return freezeOrganizationIdentity(structuredClone(result));
+};

package/dist/compiler/organizationIdentityGraph.d.ts

@@ -0,0 +1,15 @@
+import type { CompilePlan, ResolvedTeamNode } from "./types.js";
+export declare const ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE = "^[a-z][a-z0-9-]{0,62}$";
+export declare const ORGANIZATION_MEMBER_ID_PATTERN_SOURCE = "^[a-z][a-z0-9-]{0,62}(\\.[a-z][a-z0-9-]{0,62}){0,7}$";
+export declare const MAX_ORGANIZATION_MEMBER_DEPTH = 8;
+export declare const MAX_ORGANIZATION_MEMBER_ID_BYTES = 255;
+export declare const MAX_ORGANIZATION_AGENT_MEMBERS = 128;
+export declare const MAX_EXTERNAL_PARTICIPANTS = 32;
+export declare const organizationIdentityFail: (message: string) => never;
+export declare const requiredOrganizationIdentity: <T>(value: T, message: string) => NonNullable<T>;
+export declare const assertOrganizationSegment: (value: string, label: string) => void;
+export declare const freezeOrganizationIdentity: <T>(value: T) => T;
+export declare const compareOrganizationIds: (left: string, right: string) => number;
+export declare const exactOrganizationStrings: (actual: readonly string[] | undefined, expected: readonly string[]) => boolean;
+export declare const rootOrganizationTeam: (plan: CompilePlan) => ResolvedTeamNode | undefined;
+export declare const organizationAgentPaths: (plan: CompilePlan) => Map<string, string[]>;

package/dist/compiler/organizationIdentityGraph.js

@@ -0,0 +1,115 @@
+import { SpawnfileError } from "../shared/index.js";
+export const ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE = "^[a-z][a-z0-9-]{0,62}$";
+export const ORGANIZATION_MEMBER_ID_PATTERN_SOURCE = "^[a-z][a-z0-9-]{0,62}(\\.[a-z][a-z0-9-]{0,62}){0,7}$";
+export const MAX_ORGANIZATION_MEMBER_DEPTH = 8;
+export const MAX_ORGANIZATION_MEMBER_ID_BYTES = 255;
+export const MAX_ORGANIZATION_AGENT_MEMBERS = 128;
+export const MAX_EXTERNAL_PARTICIPANTS = 32;
+const segment = new RegExp(ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE, "u");
+export const organizationIdentityFail = (message) => {
+    throw new SpawnfileError("validation_error", message);
+};
+export const requiredOrganizationIdentity = (value, message) => value == null ? organizationIdentityFail(message) : value;
+export const assertOrganizationSegment = (value, label) => {
+    if (!segment.test(value)) {
+        organizationIdentityFail(`${label} must match ${ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE}`);
+    }
+};
+export const freezeOrganizationIdentity = (value) => {
+    if (value && typeof value === "object") {
+        Object.freeze(value);
+        for (const child of Object.values(value)) {
+            freezeOrganizationIdentity(child);
+        }
+    }
+    return value;
+};
+export const compareOrganizationIds = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+export const exactOrganizationStrings = (actual, expected) => actual?.length === expected.length
+    && actual.every((value, index) => value === expected[index]);
+const teamNodes = (plan) => new Map(plan.nodes.filter((node) => node.kind === "team")
+    .map((node) => [node.value.source, node.value]));
+export const rootOrganizationTeam = (plan) => {
+    const node = plan.nodes.find((entry) => entry.id === plan.root || entry.value.source === plan.root);
+    return node?.value.kind === "team" ? node.value : undefined;
+};
+export const organizationAgentPaths = (plan) => {
+    const teams = teamNodes(plan);
+    const edges = plan.edges.filter((edge) => edge.kind === "team_member");
+    const paths = new Map();
+    const teamPaths = new Map();
+    const visitedNodeIds = new Set();
+    // External-participant authority needs one unambiguous path per principal.
+    // Ordinary organizations still have a canonical identity, but retain the
+    // compiler's long-standing ability to reuse an identical agent/team ref.
+    const requireUniquePaths = (rootOrganizationTeam(plan)?.externalParticipants?.length ?? 0) > 0;
+    const walk = (source, prefix, seen) => {
+        if (seen.has(source))
+            organizationIdentityFail(`organization member graph cycle at ${source}`);
+        const team = teams.get(source);
+        if (!team)
+            return;
+        if (teamPaths.has(source)) {
+            if (requireUniquePaths) {
+                organizationIdentityFail(`team is reached through multiple organization paths: ${source}`);
+            }
+            return;
+        }
+        teamPaths.set(source, prefix);
+        const node = plan.nodes.find((entry) => entry.value.source === source);
+        if (!node || node.kind !== "team") {
+            throw new SpawnfileError("validation_error", `organization graph references missing team ${source}`);
+        }
+        visitedNodeIds.add(node.id);
+        const outgoing = edges.filter((entry) => entry.from === node.id)
+            .sort((left, right) => compareOrganizationIds(left.label, right.label));
+        const memberSlots = new Set(team.members.map((member) => member.id));
+        if (memberSlots.size !== team.members.length || outgoing.length !== team.members.length) {
+            organizationIdentityFail(`organization graph cardinality mismatch for team ${team.name}`);
+        }
+        const localSlots = new Set();
+        for (const edge of outgoing) {
+            if (localSlots.has(edge.label)) {
+                organizationIdentityFail(`duplicate organization member slot: ${edge.label}`);
+            }
+            localSlots.add(edge.label);
+            assertOrganizationSegment(edge.label, "organization member slot");
+            const next = [...prefix, edge.label];
+            if (next.length > MAX_ORGANIZATION_MEMBER_DEPTH) {
+                organizationIdentityFail("organization member depth exceeds 8");
+            }
+            const child = plan.nodes.find((candidate) => candidate.id === edge.to);
+            if (!child) {
+                throw new SpawnfileError("validation_error", `organization graph references missing node ${edge.to}`);
+            }
+            const member = team.members.find((entry) => entry.id === edge.label);
+            if (!member || member.kind !== child.kind || member.nodeSource !== child.value.source) {
+                organizationIdentityFail(`organization graph member edge mismatch: ${edge.label}`);
+            }
+            if (child.kind === "agent") {
+                if (paths.has(child.value.source) && requireUniquePaths) {
+                    organizationIdentityFail(`agent source is reached through multiple organization paths: ${child.value.source}`);
+                }
+                const prior = paths.get(child.value.source);
+                if (!prior || compareOrganizationIds(next.join("."), prior.join(".")) < 0) {
+                    paths.set(child.value.source, next);
+                }
+                visitedNodeIds.add(child.id);
+            }
+            else {
+                walk(child.value.source, next, new Set([...seen, source]));
+            }
+        }
+    };
+    walk(plan.root, [], new Set());
+    const rootNode = plan.nodes.find((node) => node.value.source === plan.root);
+    const organizationNodeIds = new Set(rootNode ? [rootNode.id] : []);
+    for (const edge of edges) {
+        organizationNodeIds.add(edge.from);
+        organizationNodeIds.add(edge.to);
+    }
+    const extra = plan.nodes.find((node) => organizationNodeIds.has(node.id) && !visitedNodeIds.has(node.id));
+    if (extra)
+        organizationIdentityFail(`unreachable organization graph node: ${extra.id}`);
+    return paths;
+};

package/dist/compiler/organizationReadyEvidence.d.ts

@@ -0,0 +1,57 @@
+import { WORLD_BINDINGS_IMAGE_PATH } from "../distribution/types.js";
+import type { GeneratedContainerArtifacts } from "./containerArtifacts.js";
+import type { MoltnetArtifacts } from "./moltnetArtifacts.js";
+import type { CompilePlan } from "./types.js";
+import type { ResolvedWorldBindings } from "./worldBindings.js";
+export declare const ORGANIZATION_READINESS_EVIDENCE_VERSION: "spawnfile.organization-ready-evidence.v1";
+export interface OrganizationReadinessEvidence {
+    readonly version: typeof ORGANIZATION_READINESS_EVIDENCE_VERSION;
+    readonly compileFingerprint: string;
+    readonly compileVersion: string;
+    readonly projectLabel: string;
+    readonly organizationMembers: readonly {
+        readonly memberId: string;
+        readonly nodeId: string;
+    }[];
+    readonly worldBindings: {
+        readonly schema: "simfile.world-bindings.v1";
+        readonly artifactPath: typeof WORLD_BINDINGS_IMAGE_PATH;
+        readonly digest: string;
+        readonly assignments: readonly {
+            readonly memberId: string;
+            readonly nodeId: string;
+        }[];
+    } | null;
+    readonly daimon?: {
+        readonly receiptPath: string;
+        readonly agents: readonly {
+            readonly agentId: string;
+            readonly engine: string;
+        }[];
+    } | null;
+    readonly networks: readonly {
+        readonly id: string;
+        readonly mode: "external" | "managed";
+        readonly internalPort: number | null;
+        readonly rooms: readonly {
+            readonly id: string;
+            readonly members: readonly string[];
+        }[];
+        readonly nodes: readonly {
+            readonly nodeId: string;
+            readonly memberId: string;
+            readonly configPath: string;
+            readonly receiptPath: string;
+            readonly sha256: string;
+        }[];
+    }[];
+    readonly hasExternalMoltnet: boolean;
+}
+export interface CreateOrganizationReadinessEvidenceInput {
+    compileVersion: string;
+    containerArtifacts: GeneratedContainerArtifacts;
+    moltnetArtifacts: MoltnetArtifacts | null;
+    plan: CompilePlan;
+    worldBindings?: ResolvedWorldBindings;
+}
+export declare const createOrganizationReadinessEvidence: (input: CreateOrganizationReadinessEvidenceInput) => OrganizationReadinessEvidence;