spawnfile 0.1.13 → 0.1.17

package/dist/manifest/teamNetworkSchemas.d.ts

@@ -1,191 +1,19 @@
 import { z } from "zod";
 export { teamWorkspaceDocsSchema, teamWorkspaceSchema } from "./workspaceSchemas.js";
 export type { TeamWorkspace, TeamWorkspaceDocs, TeamWorkspaceResource, TeamWorkspaceResource as TeamNetworkResource } from "./workspaceSchemas.js";
-declare const teamNetworkAuthSchema: z.ZodObject<{
-    agent_registration: z.ZodOptional<z.ZodEnum<{
-        token: "token";
-        disabled: "disabled";
-        open: "open";
-    }>>;
-    client: z.ZodOptional<z.ZodObject<{
-        static_token: z.ZodOptional<z.ZodBoolean>;
-        token_env: z.ZodOptional<z.ZodString>;
-        token_id: z.ZodOptional<z.ZodString>;
-        token_path: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>>;
-    mode: z.ZodEnum<{
-        none: "none";
-        open: "open";
-        bearer: "bearer";
-    }>;
-    public_read: z.ZodOptional<z.ZodBoolean>;
-    tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        id: z.ZodString;
-        secret: z.ZodString;
-        scopes: z.ZodArray<z.ZodEnum<{
-            observe: "observe";
-            write: "write";
-            admin: "admin";
-            attach: "attach";
-            pair: "pair";
-        }>>;
-    }, z.core.$strict>>>;
-}, z.core.$strict>;
-declare const teamNetworkStoreSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    path: z.ZodOptional<z.ZodString>;
-    persistence: z.ZodOptional<z.ZodObject<{
-        mode: z.ZodEnum<{
-            durable: "durable";
-            ephemeral: "ephemeral";
-        }>;
-        mount: z.ZodOptional<z.ZodString>;
-        name: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>>;
-    kind: z.ZodLiteral<"sqlite">;
-}, z.core.$strict>, z.ZodObject<{
-    path: z.ZodOptional<z.ZodString>;
-    persistence: z.ZodOptional<z.ZodObject<{
-        mode: z.ZodEnum<{
-            durable: "durable";
-            ephemeral: "ephemeral";
-        }>;
-        mount: z.ZodOptional<z.ZodString>;
-        name: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>>;
-    kind: z.ZodLiteral<"json">;
-}, z.core.$strict>, z.ZodObject<{
-    kind: z.ZodLiteral<"postgres">;
-    dsn_secret: z.ZodString;
-}, z.core.$strict>, z.ZodObject<{
-    kind: z.ZodLiteral<"memory">;
-}, z.core.$strict>], "kind">;
-declare const teamNetworkServerSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    allowed_origins: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    auth: z.ZodObject<{
-        agent_registration: z.ZodOptional<z.ZodEnum<{
-            token: "token";
-            disabled: "disabled";
-            open: "open";
-        }>>;
-        client: z.ZodOptional<z.ZodObject<{
-            static_token: z.ZodOptional<z.ZodBoolean>;
-            token_env: z.ZodOptional<z.ZodString>;
-            token_id: z.ZodOptional<z.ZodString>;
-            token_path: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>>;
-        mode: z.ZodEnum<{
-            none: "none";
-            open: "open";
-            bearer: "bearer";
-        }>;
-        public_read: z.ZodOptional<z.ZodBoolean>;
-        tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            id: z.ZodString;
-            secret: z.ZodString;
-            scopes: z.ZodArray<z.ZodEnum<{
-                observe: "observe";
-                write: "write";
-                admin: "admin";
-                attach: "attach";
-                pair: "pair";
-            }>>;
-        }, z.core.$strict>>>;
-    }, z.core.$strict>;
-    console: z.ZodOptional<z.ZodObject<{
-        analytics: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
-            provider: z.ZodLiteral<"google">;
-            measurement_id: z.ZodString;
-        }, z.core.$strict>], "provider">>;
-    }, z.core.$strict>>;
-    debug_events: z.ZodOptional<z.ZodBoolean>;
-    direct_messages: z.ZodOptional<z.ZodBoolean>;
-    human_ingress: z.ZodOptional<z.ZodBoolean>;
-    listen: z.ZodObject<{
-        bind: z.ZodString;
-        port: z.ZodNumber;
-    }, z.core.$strict>;
-    mode: z.ZodLiteral<"managed">;
-    pairings: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        remote_base_url: z.ZodString;
-        remote_network_id: z.ZodString;
-        remote_network_name: z.ZodString;
-        token_secret: z.ZodString;
-    }, z.core.$strict>>>;
-    store: z.ZodDiscriminatedUnion<[z.ZodObject<{
-        path: z.ZodOptional<z.ZodString>;
-        persistence: z.ZodOptional<z.ZodObject<{
-            mode: z.ZodEnum<{
-                durable: "durable";
-                ephemeral: "ephemeral";
-            }>;
-            mount: z.ZodOptional<z.ZodString>;
-            name: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>>;
-        kind: z.ZodLiteral<"sqlite">;
-    }, z.core.$strict>, z.ZodObject<{
-        path: z.ZodOptional<z.ZodString>;
-        persistence: z.ZodOptional<z.ZodObject<{
-            mode: z.ZodEnum<{
-                durable: "durable";
-                ephemeral: "ephemeral";
-            }>;
-            mount: z.ZodOptional<z.ZodString>;
-            name: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>>;
-        kind: z.ZodLiteral<"json">;
-    }, z.core.$strict>, z.ZodObject<{
-        kind: z.ZodLiteral<"postgres">;
-        dsn_secret: z.ZodString;
-    }, z.core.$strict>, z.ZodObject<{
-        kind: z.ZodLiteral<"memory">;
-    }, z.core.$strict>], "kind">;
-    trust_forwarded_proto: z.ZodOptional<z.ZodBoolean>;
-    url: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>, z.ZodObject<{
-    auth: z.ZodObject<{
-        agent_registration: z.ZodOptional<z.ZodEnum<{
-            token: "token";
-            disabled: "disabled";
-            open: "open";
-        }>>;
-        client: z.ZodOptional<z.ZodObject<{
-            static_token: z.ZodOptional<z.ZodBoolean>;
-            token_env: z.ZodOptional<z.ZodString>;
-            token_id: z.ZodOptional<z.ZodString>;
-            token_path: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>>;
-        mode: z.ZodEnum<{
-            none: "none";
-            open: "open";
-            bearer: "bearer";
-        }>;
-        public_read: z.ZodOptional<z.ZodBoolean>;
-        tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            id: z.ZodString;
-            secret: z.ZodString;
-            scopes: z.ZodArray<z.ZodEnum<{
-                observe: "observe";
-                write: "write";
-                admin: "admin";
-                attach: "attach";
-                pair: "pair";
-            }>>;
-        }, z.core.$strict>>>;
-    }, z.core.$strict>;
-    mode: z.ZodLiteral<"external">;
-    url: z.ZodString;
-}, z.core.$strict>], "mode">;
+export type { TeamNetworkAuth } from "./teamNetworkAuthSchemas.js";
+export type { TeamNetworkServer, TeamNetworkStore } from "./teamNetworkServerSchemas.js";
 declare const teamNetworkRoomSchema: z.ZodObject<{
+    federation: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+        none: "none";
+        all: "all";
+    }>, z.ZodArray<z.ZodString>]>>;
     id: z.ZodString;
     members: z.ZodArray<z.ZodString>;
     name: z.ZodOptional<z.ZodString>;
     visibility: z.ZodOptional<z.ZodEnum<{
-        public: "public";
         private: "private";
+        public: "public";
     }>>;
     write_policy: z.ZodOptional<z.ZodEnum<{
         members: "members";
@@ -198,12 +26,16 @@ export declare const teamNetworkSchema: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
     provider: z.ZodLiteral<"moltnet">;
     rooms: z.ZodArray<z.ZodObject<{
+        federation: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+            none: "none";
+            all: "all";
+        }>, z.ZodArray<z.ZodString>]>>;
         id: z.ZodString;
         members: z.ZodArray<z.ZodString>;
         name: z.ZodOptional<z.ZodString>;
         visibility: z.ZodOptional<z.ZodEnum<{
-            public: "public";
             private: "private";
+            public: "public";
         }>>;
         write_policy: z.ZodOptional<z.ZodEnum<{
             members: "members";
@@ -211,12 +43,12 @@ export declare const teamNetworkSchema: z.ZodObject<{
             operators: "operators";
         }>>;
     }, z.core.$strict>>;
-    server: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    server: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
         allowed_origins: z.ZodOptional<z.ZodArray<z.ZodString>>;
         auth: z.ZodObject<{
             agent_registration: z.ZodOptional<z.ZodEnum<{
-                token: "token";
                 disabled: "disabled";
+                token: "token";
                 open: "open";
             }>>;
             client: z.ZodOptional<z.ZodObject<{
@@ -227,8 +59,8 @@ export declare const teamNetworkSchema: z.ZodObject<{
             }, z.core.$strict>>;
             mode: z.ZodEnum<{
                 none: "none";
-                open: "open";
                 bearer: "bearer";
+                open: "open";
             }>;
             public_read: z.ZodOptional<z.ZodBoolean>;
             tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -260,7 +92,12 @@ export declare const teamNetworkSchema: z.ZodObject<{
         mode: z.ZodLiteral<"managed">;
         pairings: z.ZodOptional<z.ZodArray<z.ZodObject<{
             id: z.ZodString;
-            remote_base_url: z.ZodString;
+            relay: z.ZodOptional<z.ZodObject<{
+                room: z.ZodString;
+                token_secret: z.ZodString;
+                url: z.ZodString;
+            }, z.core.$strict>>;
+            remote_base_url: z.ZodOptional<z.ZodString>;
             remote_network_id: z.ZodString;
             remote_network_name: z.ZodString;
             token_secret: z.ZodString;
@@ -298,8 +135,8 @@ export declare const teamNetworkSchema: z.ZodObject<{
     }, z.core.$strict>, z.ZodObject<{
         auth: z.ZodObject<{
             agent_registration: z.ZodOptional<z.ZodEnum<{
-                token: "token";
                 disabled: "disabled";
+                token: "token";
                 open: "open";
             }>>;
             client: z.ZodOptional<z.ZodObject<{
@@ -310,8 +147,8 @@ export declare const teamNetworkSchema: z.ZodObject<{
             }, z.core.$strict>>;
             mode: z.ZodEnum<{
                 none: "none";
-                open: "open";
                 bearer: "bearer";
+                open: "open";
             }>;
             public_read: z.ZodOptional<z.ZodBoolean>;
             tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -329,10 +166,8 @@ export declare const teamNetworkSchema: z.ZodObject<{
         }, z.core.$strict>;
         mode: z.ZodLiteral<"external">;
         url: z.ZodString;
-    }, z.core.$strict>], "mode">;
+    }, z.core.$strict>], "mode">>;
 }, z.core.$strict>;
 export type TeamNetwork = z.infer<typeof teamNetworkSchema>;
 export type TeamNetworkRoom = z.infer<typeof teamNetworkRoomSchema>;
-export type TeamNetworkServer = z.infer<typeof teamNetworkServerSchema>;
-export type TeamNetworkAuth = z.infer<typeof teamNetworkAuthSchema>;
-export type TeamNetworkStore = z.infer<typeof teamNetworkStoreSchema>;
+export declare const isDeclaredPairedRemoteRoomMember: (network: TeamNetwork, room: TeamNetworkRoom, memberId: string) => boolean;

package/dist/manifest/teamNetworkSchemas.js

@@ -1,323 +1,10 @@
 import { z } from "zod";
-import { teamNetworkAgentRegistrationSchema, teamNetworkRoomVisibilitySchema, teamNetworkRoomWritePolicySchema } from "./teamNetworkAccessSchemas.js";
-import { teamNetworkConsoleSchema } from "./teamNetworkConsoleSchemas.js";
+import { teamNetworkRoomFederationSchema, teamNetworkRoomVisibilitySchema, teamNetworkRoomWritePolicySchema } from "./teamNetworkAccessSchemas.js";
+import { teamNetworkServerSchema } from "./teamNetworkServerSchemas.js";
 export { teamWorkspaceDocsSchema, teamWorkspaceSchema } from "./workspaceSchemas.js";
-const moltnetScopeSchema = z.enum(["observe", "write", "admin", "attach", "pair"]);
-const countTruthy = (value) => value.filter((entry) => Boolean(entry)).length;
-const absolutePosixPathSchema = z
-    .string()
-    .trim()
-    .min(1)
-    .refine((value) => value.startsWith("/"), {
-    message: "path must be an absolute POSIX path"
-});
-const normalizePosixPath = (value) => value.replace(/\/+/g, "/").replace(/\/+$/u, "") || "/";
-const pathIsInsideMount = (filePath, mountPath) => {
-    const normalizedPath = normalizePosixPath(filePath);
-    const normalizedMount = normalizePosixPath(mountPath);
-    return normalizedPath.startsWith(`${normalizedMount}/`);
-};
-const teamNetworkAuthTokenSchema = z
-    .object({
-    agents: z.array(z.string().trim().min(1)).optional(),
-    id: z.string().trim().min(1),
-    secret: z.string().trim().min(1),
-    scopes: z.array(moltnetScopeSchema).min(1)
-})
-    .strict();
-const teamNetworkAuthClientSchema = z
-    .object({
-    static_token: z.boolean().optional(),
-    token_env: z.string().trim().min(1).optional(),
-    token_id: z.string().trim().min(1).optional(),
-    token_path: z.string().trim().min(1).optional()
-})
-    .strict()
-    .superRefine((value, context) => {
-    const tokenSourceCount = countTruthy([value.token_id, value.token_env, value.token_path]);
-    if (tokenSourceCount > 1) {
-        context.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "auth.client must declare exactly one of token_id, token_env, or token_path"
-        });
-    }
-    if (value.static_token === true && tokenSourceCount === 0) {
-        context.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "auth.client.static_token requires exactly one token source"
-        });
-    }
-});
-const teamNetworkAuthSchema = z
-    .object({
-    agent_registration: teamNetworkAgentRegistrationSchema.optional(),
-    client: teamNetworkAuthClientSchema.optional(),
-    mode: z.enum(["none", "bearer", "open"]),
-    public_read: z.boolean().optional(),
-    tokens: z.array(teamNetworkAuthTokenSchema).optional()
-})
-    .strict()
-    .superRefine((value, context) => {
-    if (value.mode === "none") {
-        if (value.tokens && value.tokens.length > 0) {
-            context.addIssue({
-                code: z.ZodIssueCode.custom,
-                message: "auth.mode none must not declare tokens"
-            });
-        }
-        if (value.client) {
-            context.addIssue({
-                code: z.ZodIssueCode.custom,
-                message: "auth.mode none must not declare client"
-            });
-        }
-        return;
-    }
-    if (value.mode === "bearer" && !value.client && value.agent_registration !== "open") {
-        context.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "auth.mode bearer requires auth.client unless agent_registration is open"
-        });
-    }
-    if (value.mode === "open" && value.client) {
-        const tokenSourceCount = countTruthy([
-            value.client.token_id,
-            value.client.token_env,
-            value.client.token_path
-        ]);
-        if (value.client.static_token !== true) {
-            context.addIssue({
-                code: z.ZodIssueCode.custom,
-                message: "open auth with auth.client requires static_token: true"
-            });
-        }
-        if (tokenSourceCount === 0) {
-            context.addIssue({
-                code: z.ZodIssueCode.custom,
-                message: "open auth with auth.client requires exactly one token source"
-            });
-        }
-    }
-    if (value.mode === "open" && value.agent_registration && value.agent_registration !== "open") {
-        context.addIssue({ code: z.ZodIssueCode.custom, message: "auth.mode open requires agent_registration open when declared" });
-    }
-    if (value.tokens) {
-        const tokenIds = value.tokens.map((token) => token.id);
-        if (new Set(tokenIds).size !== tokenIds.length) {
-            context.addIssue({
-                code: z.ZodIssueCode.custom,
-                message: "auth.tokens ids must be unique"
-            });
-        }
-    }
-});
-const teamNetworkStorePersistenceSchema = z
-    .object({
-    mode: z.enum(["durable", "ephemeral"]),
-    mount: absolutePosixPathSchema.optional(),
-    name: z.string().trim().min(1).optional()
-})
-    .strict()
-    .superRefine((value, context) => {
-    if (value.mode === "ephemeral" && (value.mount || value.name)) {
-        context.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "ephemeral persistence must not declare mount or name"
-        });
-    }
-});
-const teamNetworkFileStoreSchema = z
-    .object({
-    path: absolutePosixPathSchema.optional(),
-    persistence: teamNetworkStorePersistenceSchema.optional()
-})
-    .strict()
-    .superRefine((value, context) => {
-    if (value.path && value.persistence?.mount && !pathIsInsideMount(value.path, value.persistence.mount)) {
-        context.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "store.path must be inside persistence.mount"
-        });
-    }
-});
-const teamNetworkStoreSqliteSchema = teamNetworkFileStoreSchema.extend({
-    kind: z.literal("sqlite")
-});
-const teamNetworkStoreJsonSchema = teamNetworkFileStoreSchema.extend({
-    kind: z.literal("json")
-});
-const teamNetworkStorePostgresSchema = z
-    .object({
-    kind: z.literal("postgres"),
-    dsn_secret: z.string().trim().min(1)
-})
-    .strict();
-const teamNetworkStoreMemorySchema = z.object({ kind: z.literal("memory") }).strict();
-const teamNetworkStoreSchema = z.discriminatedUnion("kind", [
-    teamNetworkStoreSqliteSchema,
-    teamNetworkStoreJsonSchema,
-    teamNetworkStorePostgresSchema,
-    teamNetworkStoreMemorySchema
-]);
-const teamNetworkListenSchema = z
-    .object({
-    bind: z
-        .string()
-        .trim()
-        .min(1)
-        .superRefine((value, context) => {
-        if (value.startsWith("[") || value.endsWith("]") || /\[.*\]/.test(value)) {
-            context.addIssue({
-                code: z.ZodIssueCode.custom,
-                message: "listen.bind must be unbracketed"
-            });
-        }
-    }),
-    port: z.number().int().min(1).max(65535)
-})
-    .strict();
-const teamNetworkPairingSchema = z
-    .object({
-    id: z.string().trim().min(1),
-    remote_base_url: z.string().trim().min(1),
-    remote_network_id: z.string().trim().min(1),
-    remote_network_name: z.string().trim().min(1),
-    token_secret: z.string().trim().min(1)
-})
-    .strict();
-const teamNetworkManagedServerSchema = z
-    .object({
-    allowed_origins: z.array(z.string().trim().min(1)).optional(),
-    auth: teamNetworkAuthSchema,
-    console: teamNetworkConsoleSchema.optional(),
-    debug_events: z.boolean().optional(),
-    direct_messages: z.boolean().optional(),
-    human_ingress: z.boolean().optional(),
-    listen: teamNetworkListenSchema,
-    mode: z.literal("managed"),
-    pairings: z.array(teamNetworkPairingSchema).optional(),
-    store: teamNetworkStoreSchema,
-    trust_forwarded_proto: z.boolean().optional(),
-    url: z.string().trim().optional()
-})
-    .strict()
-    .superRefine((value, context) => {
-    if (value.auth.mode === "bearer") {
-        if (!value.auth.tokens || value.auth.tokens.length === 0) {
-            context.addIssue({
-                code: z.ZodIssueCode.custom,
-                message: "managed server with auth.mode bearer requires at least one auth token"
-            });
-        }
-        if (value.auth.client && !value.auth.client.token_id) {
-            context.addIssue({
-                code: z.ZodIssueCode.custom,
-                message: "managed bearer auth requires auth.client.token_id"
-            });
-        }
-        if (value.auth.client && (value.auth.client.token_env || value.auth.client.token_path)) {
-            context.addIssue({
-                code: z.ZodIssueCode.custom,
-                message: "managed bearer auth requires auth.client.token_id"
-            });
-        }
-        if (value.auth.client?.token_id && value.auth.tokens) {
-            const tokenById = new Map(value.auth.tokens.map((token) => [token.id, token]));
-            const selected = tokenById.get(value.auth.client.token_id);
-            if (!selected) {
-                context.addIssue({
-                    code: z.ZodIssueCode.custom,
-                    message: `managed bearer auth references unknown token: ${value.auth.client.token_id}`
-                });
-            }
-            else if (!(selected.scopes.includes("attach") && selected.scopes.includes("write"))) {
-                context.addIssue({
-                    code: z.ZodIssueCode.custom,
-                    message: "managed bearer auth.client.token_id must reference a token with attach and write scopes"
-                });
-            }
-        }
-    }
-    if (value.auth.mode === "open" && value.auth.client) {
-        if (!value.auth.client.token_id) {
-            context.addIssue({
-                code: z.ZodIssueCode.custom,
-                message: "managed open auth requires auth.client.token_id"
-            });
-        }
-        if (value.auth.client.token_env || value.auth.client.token_path) {
-            context.addIssue({
-                code: z.ZodIssueCode.custom,
-                message: "managed open auth client token source must be token_id"
-            });
-        }
-        if (value.auth.client.token_id && !value.auth.tokens?.some((token) => token.id === value.auth.client?.token_id)) {
-            context.addIssue({ code: z.ZodIssueCode.custom, message: `managed open auth references unknown token: ${value.auth.client.token_id}` });
-        }
-    }
-});
-const teamNetworkExternalServerSchema = z
-    .object({
-    auth: teamNetworkAuthSchema,
-    mode: z.literal("external"),
-    url: z.string().trim().min(1)
-})
-    .strict()
-    .superRefine((value, context) => {
-    if (value.auth.tokens && value.auth.tokens.length > 0) {
-        context.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "external server does not accept auth.tokens"
-        });
-    }
-    if (value.auth.mode === "none" && value.auth.client) {
-        context.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "auth.mode none must not declare client"
-        });
-    }
-    if (!value.auth.client) {
-        return;
-    }
-    if (value.auth.client.token_id) {
-        context.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "auth.client.token_id is only valid for managed servers"
-        });
-    }
-    if (value.auth.mode === "open" && value.auth.client.static_token !== true) {
-        context.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "open auth with auth.client requires static_token: true"
-        });
-    }
-    if (value.auth.mode === "open" &&
-        countTruthy([value.auth.client.token_env, value.auth.client.token_path]) !== 1) {
-        context.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "external open auth requires token_env or token_path"
-        });
-    }
-    if (value.auth.mode === "bearer" && value.auth.client) {
-        const sourceCount = countTruthy([
-            value.auth.client.token_id,
-            value.auth.client.token_env,
-            value.auth.client.token_path
-        ]);
-        if (sourceCount !== 1 || !value.auth.client.token_env && !value.auth.client.token_path) {
-            context.addIssue({
-                code: z.ZodIssueCode.custom,
-                message: "external bearer auth requires exactly one external token source"
-            });
-        }
-    }
-});
-const teamNetworkServerSchema = z.discriminatedUnion("mode", [
-    teamNetworkManagedServerSchema,
-    teamNetworkExternalServerSchema
-]);
 const teamNetworkRoomSchema = z
     .object({
+    federation: teamNetworkRoomFederationSchema.optional(),
     id: z.string().trim().min(1),
     members: z.array(z.string().trim().min(1)),
     name: z.string().trim().min(1).optional(),
@@ -331,7 +18,7 @@ export const teamNetworkSchema = z
     name: z.string().trim().min(1).optional(),
     provider: z.literal("moltnet"),
     rooms: z.array(teamNetworkRoomSchema).min(1),
-    server: teamNetworkServerSchema
+    server: teamNetworkServerSchema.optional()
 })
     .strict()
     .superRefine((value, context) => {
@@ -343,3 +30,20 @@ export const teamNetworkSchema = z
         });
     }
 });
+export const isDeclaredPairedRemoteRoomMember = (network, room, memberId) => {
+    const separator = memberId.indexOf(":");
+    if (separator <= 0 || separator === memberId.length - 1) {
+        return false;
+    }
+    const remoteNetworkId = memberId.slice(0, separator).trim();
+    const remoteAgentId = memberId.slice(separator + 1).trim();
+    if (!remoteNetworkId || !remoteAgentId || network.server?.mode !== "managed") {
+        return false;
+    }
+    const pairing = network.server.pairings?.find((candidate) => candidate.remote_network_id === remoteNetworkId);
+    if (!pairing) {
+        return false;
+    }
+    return room.federation === "all"
+        || (Array.isArray(room.federation) && room.federation.includes(pairing.id));
+};