spawnfile 0.1.14 → 0.1.17

package/dist/compiler/organizationExternalParticipants.js

@@ -0,0 +1,176 @@
+import { SpawnfileError } from "../shared/index.js";
+import { assertOrganizationSegment, compareOrganizationIds, exactOrganizationStrings, organizationAgentPaths, organizationIdentityFail, requiredOrganizationIdentity, rootOrganizationTeam, } from "./organizationIdentityGraph.js";
+const actorTokenFor = (server, tokenId, memberId, observePolicy = "forbid") => {
+    const token = server.auth.tokens?.filter((entry) => entry.id === tokenId);
+    if (token?.length !== 1) {
+        organizationIdentityFail(`Moltnet actor token ${tokenId} must exist exactly once`);
+    }
+    const selected = requiredOrganizationIdentity(token?.[0], `Moltnet actor token ${tokenId} must exist exactly once`);
+    const validScopes = (observePolicy !== "require" && exactOrganizationStrings(selected.scopes, ["attach", "write"])) || (observePolicy !== "forbid"
+        && exactOrganizationStrings(selected.scopes, ["attach", "observe", "write"]));
+    if (!validScopes || !exactOrganizationStrings(selected.agents, [memberId])) {
+        organizationIdentityFail(`Moltnet actor token ${tokenId} has invalid scopes or agents for ${memberId}`);
+    }
+    return selected;
+};
+const isPairingAuthToken = (server, token) => token.agents === undefined
+    && exactOrganizationStrings(token.scopes, ["pair"])
+    && (server.pairings ?? []).filter((pairing) => pairing.id === token.id && pairing.token_secret === token.secret).length === 1;
+const isObserveOnlyConsoleToken = (token) => token.agents === undefined && exactOrganizationStrings(token.scopes, ["observe"]);
+const validateB31Networks = (plan) => {
+    const root = requiredOrganizationIdentity(rootOrganizationTeam(plan), "B31 root team is missing");
+    const services = requiredOrganizationIdentity(root.externalParticipants, "B31 participants are missing");
+    const networkIds = new Set(services.flatMap((service) => service.surfaces.moltnet.map((attachment) => attachment.network)));
+    for (const network of root.networks ?? []) {
+        if (!networkIds.has(network.id))
+            continue;
+        assertOrganizationSegment(network.id, "B31 network id");
+        if (network.server?.mode !== "managed" || network.server.auth.mode !== "bearer"
+            || network.server.direct_messages !== true) {
+            organizationIdentityFail(`B31 network ${network.id} requires managed bearer direct_messages`);
+        }
+        const server = requiredOrganizationIdentity(network.server, `B31 network ${network.id} requires a managed server`);
+        if (JSON.stringify(server.auth.client) !== JSON.stringify({ token_id: "operator" })) {
+            organizationIdentityFail(`B31 network ${network.id} requires auth.client token_id operator`);
+        }
+        const tokens = server.auth.tokens ?? [];
+        const operator = tokens.find((token) => token.id === "operator");
+        if (tokens.filter((token) => token.id === "operator").length !== 1 || !operator
+            || operator.agents !== undefined
+            || !exactOrganizationStrings(operator.scopes, ["admin", "observe", "write"])) {
+            organizationIdentityFail(`B31 network ${network.id} has invalid operator token`);
+        }
+        const resolvedOperator = requiredOrganizationIdentity(operator, `B31 network ${network.id} has invalid operator token`);
+        const usedTokenIds = new Set();
+        const usedEnvNames = new Set();
+        for (const token of tokens) {
+            assertOrganizationSegment(token.id, "Moltnet token id");
+            if (!/^[A-Z_][A-Z0-9_]{0,127}$/u.test(token.secret)) {
+                organizationIdentityFail(`invalid Moltnet token env name ${token.secret}`);
+            }
+            if (usedTokenIds.has(token.id) || usedEnvNames.has(token.secret)) {
+                organizationIdentityFail(`duplicate Moltnet token identity ${token.id}`);
+            }
+            usedTokenIds.add(token.id);
+            usedEnvNames.add(token.secret);
+            if (token.id !== "operator" && token.secret === resolvedOperator.secret) {
+                organizationIdentityFail("operator and actor token env identities must differ");
+            }
+        }
+    }
+    return networkIds;
+};
+export const validateB31MoltnetAuth = (plan) => {
+    const root = rootOrganizationTeam(plan);
+    if (!root?.externalParticipants?.length)
+        return;
+    const identity = requiredOrganizationIdentity(plan.organizationIdentity, "B31 organization identity is missing");
+    const paths = organizationAgentPaths(plan);
+    const networkIds = validateB31Networks(plan);
+    const selectedByNetwork = new Map();
+    const selectedActorKeys = new Set();
+    for (const member of identity.agentMembers) {
+        const source = [...paths.entries()].find(([, path]) => path.join(".") === member.memberId)?.[0];
+        const node = plan.nodes.find((entry) => entry.kind === "agent"
+            && entry.value.source === source);
+        const attachments = node?.value?.surfaces?.moltnet ?? [];
+        for (const attachment of attachments.filter((entry) => networkIds.has(entry.network))) {
+            const network = root.networks?.find((entry) => entry.id === attachment.network);
+            const selectedTokenId = requiredOrganizationIdentity(attachment.auth?.tokenId, `B31 agent ${member.memberId} must select auth.token_id`);
+            const actorKey = `${attachment.network}\u0000${member.memberId}`;
+            if (selectedActorKeys.has(actorKey)) {
+                organizationIdentityFail(`B31 actor ${member.memberId} selects more than one token on ${attachment.network}`);
+            }
+            selectedActorKeys.add(actorKey);
+            if (network?.server?.mode === "managed") {
+                const token = actorTokenFor(network.server, selectedTokenId, member.memberId, node?.runtimeName === "daimon" ? "require" : "forbid");
+                const selected = selectedByNetwork.get(attachment.network) ?? new Map();
+                const previous = selected.get(selectedTokenId);
+                if (previous) {
+                    organizationIdentityFail(`Moltnet actor token ${selectedTokenId} is shared by ${previous} and ${member.memberId}`);
+                }
+                selected.set(selectedTokenId, member.memberId);
+                selectedByNetwork.set(attachment.network, selected);
+                if (token.id === "operator") {
+                    organizationIdentityFail(`B31 actor ${member.memberId} must not use operator token`);
+                }
+            }
+        }
+    }
+    for (const service of root.externalParticipants) {
+        for (const attachment of service.surfaces.moltnet) {
+            const network = root.networks?.find((entry) => entry.id === attachment.network);
+            if (network?.server?.mode !== "managed")
+                continue;
+            const token = actorTokenFor(network.server, attachment.auth.token_id, service.id, "allow");
+            if (token.id === "operator") {
+                organizationIdentityFail(`B31 external participant ${service.id} must not use operator token`);
+            }
+            const selected = selectedByNetwork.get(attachment.network) ?? new Map();
+            const previous = selected.get(token.id);
+            if (previous)
+                organizationIdentityFail(`Moltnet actor token ${token.id} is shared by ${previous} and ${service.id}`);
+            selected.set(token.id, service.id);
+            selectedByNetwork.set(attachment.network, selected);
+        }
+    }
+    for (const network of root.networks ?? []) {
+        const selected = selectedByNetwork.get(network.id);
+        if (network.server?.mode !== "managed" || !selected)
+            continue;
+        for (const token of network.server.auth.tokens ?? []) {
+            if (token.id !== "operator" && !selected.has(token.id)
+                && !isPairingAuthToken(network.server, token)
+                && !isObserveOnlyConsoleToken(token)) {
+                organizationIdentityFail(`Moltnet actor token ${token.id} is not selected by exactly one actor`);
+            }
+        }
+    }
+};
+export const resolveMoltnetExternalParticipantIntents = (plan) => {
+    const identity = plan.organizationIdentity;
+    const root = rootOrganizationTeam(plan);
+    if (!identity || !root?.externalParticipants?.length)
+        return [];
+    const paths = organizationAgentPaths(plan);
+    const agents = new Map(identity.agentMembers.map((member) => [member.memberId, member]));
+    const networkIds = new Set((root.networks ?? []).map((network) => network.id));
+    const result = [];
+    for (const service of root.externalParticipants) {
+        const participant = identity.externalParticipants.find((entry) => entry.memberId === service.id);
+        if (!participant) {
+            throw new SpawnfileError("validation_error", `missing external participant identity: ${service.id}`);
+        }
+        for (const attachment of service.surfaces.moltnet) {
+            if (!networkIds.has(attachment.network)) {
+                organizationIdentityFail(`external participant ${service.id} references unknown network ${attachment.network}`);
+            }
+            const peers = [];
+            for (const [memberId, agent] of agents) {
+                const node = plan.nodes.find((entry) => entry.kind === "agent"
+                    && paths.get(entry.value.source)?.join(".") === memberId);
+                const authored = node?.value?.surfaces?.moltnet ?? [];
+                const eligible = authored.filter((entry) => entry.network === attachment.network && entry.dms?.enabled === true);
+                if (eligible.length > 1) {
+                    organizationIdentityFail(`duplicate eligible Moltnet peer for ${service.id}/${attachment.network}`);
+                }
+                if (eligible.length === 1)
+                    peers.push(agent.memberId);
+            }
+            if (new Set(peers).size !== peers.length) {
+                organizationIdentityFail(`duplicate eligible Moltnet peer for ${service.id}/${attachment.network}`);
+            }
+            if (peers.length === 0) {
+                organizationIdentityFail(`external participant ${service.id}/${attachment.network} has no eligible direct-message peers`);
+            }
+            peers.sort(compareOrganizationIds);
+            const network = root.networks?.find((entry) => entry.id === attachment.network);
+            const token = network?.server?.mode === "managed"
+                ? actorTokenFor(network.server, attachment.auth.token_id, service.id, "allow")
+                : undefined;
+            result.push({ participant, networkId: attachment.network, tokenId: attachment.auth.token_id,
+                tokenEnv: token?.secret ?? "", directMessagePeers: peers });
+        }
+    }
+    return result;
+};

package/dist/compiler/organizationIdentity.d.ts

@@ -1,10 +1,6 @@
-import type { CompilePlan, MoltnetExternalParticipantIntent } from "./types.js";
-export declare const ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE = "^[a-z][a-z0-9-]{0,62}$";
-export declare const ORGANIZATION_MEMBER_ID_PATTERN_SOURCE = "^[a-z][a-z0-9-]{0,62}(\\.[a-z][a-z0-9-]{0,62}){0,7}$";
-export declare const MAX_ORGANIZATION_MEMBER_DEPTH = 8;
-export declare const MAX_ORGANIZATION_MEMBER_ID_BYTES = 255;
-export declare const MAX_ORGANIZATION_AGENT_MEMBERS = 128;
-export declare const MAX_EXTERNAL_PARTICIPANTS = 32;
+import type { CompilePlan } from "./types.js";
+export { MAX_EXTERNAL_PARTICIPANTS, MAX_ORGANIZATION_AGENT_MEMBERS, MAX_ORGANIZATION_MEMBER_DEPTH, MAX_ORGANIZATION_MEMBER_ID_BYTES, ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE, ORGANIZATION_MEMBER_ID_PATTERN_SOURCE, } from "./organizationIdentityGraph.js";
+export { resolveMoltnetExternalParticipantIntents, validateB31MoltnetAuth, } from "./organizationExternalParticipants.js";
 export interface ResolvedOrganizationAgentMember {
     readonly authoredMemberKey: string;
     readonly kind: "agent";
@@ -23,5 +19,3 @@ export interface ResolvedOrganizationIdentity {
 }
 export declare const resolveCanonicalAgentMemberId: (plan: CompilePlan, agentSource: string) => string | undefined;
 export declare const resolveOrganizationIdentity: (plan: CompilePlan) => ResolvedOrganizationIdentity | undefined;
-export declare const validateB31MoltnetAuth: (plan: CompilePlan) => void;
-export declare const resolveMoltnetExternalParticipantIntents: (plan: CompilePlan) => MoltnetExternalParticipantIntent[];

package/dist/compiler/organizationIdentity.js

@@ -1,297 +1,64 @@
-import { SpawnfileError } from "../shared/index.js";
-export const ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE = "^[a-z][a-z0-9-]{0,62}$";
-export const ORGANIZATION_MEMBER_ID_PATTERN_SOURCE = "^[a-z][a-z0-9-]{0,62}(\\.[a-z][a-z0-9-]{0,62}){0,7}$";
-export const MAX_ORGANIZATION_MEMBER_DEPTH = 8;
-export const MAX_ORGANIZATION_MEMBER_ID_BYTES = 255;
-export const MAX_ORGANIZATION_AGENT_MEMBERS = 128;
-export const MAX_EXTERNAL_PARTICIPANTS = 32;
-const segment = new RegExp(ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE, "u");
+import { assertOrganizationSegment, compareOrganizationIds, freezeOrganizationIdentity, MAX_EXTERNAL_PARTICIPANTS, MAX_ORGANIZATION_AGENT_MEMBERS, MAX_ORGANIZATION_MEMBER_DEPTH, MAX_ORGANIZATION_MEMBER_ID_BYTES, ORGANIZATION_MEMBER_ID_PATTERN_SOURCE, organizationAgentPaths, organizationIdentityFail, rootOrganizationTeam, } from "./organizationIdentityGraph.js";
+export { MAX_EXTERNAL_PARTICIPANTS, MAX_ORGANIZATION_AGENT_MEMBERS, MAX_ORGANIZATION_MEMBER_DEPTH, MAX_ORGANIZATION_MEMBER_ID_BYTES, ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE, ORGANIZATION_MEMBER_ID_PATTERN_SOURCE, } from "./organizationIdentityGraph.js";
+export { resolveMoltnetExternalParticipantIntents, validateB31MoltnetAuth, } from "./organizationExternalParticipants.js";
 const memberIdPattern = new RegExp(ORGANIZATION_MEMBER_ID_PATTERN_SOURCE, "u");
-const fail = (message) => { throw new SpawnfileError("validation_error", message); };
-const required = (value, message) => value == null ? fail(message) : value;
-const assertSegment = (value, label) => {
-    if (!segment.test(value))
-        fail(`${label} must match ${ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE}`);
-};
-const freeze = (value) => {
-    if (value && typeof value === "object") {
-        Object.freeze(value);
-        for (const child of Object.values(value))
-            freeze(child);
-    }
-    return value;
-};
-const byAscii = (left, right) => left < right ? -1 : left > right ? 1 : 0;
-const exact = (actual, expected) => actual?.length === expected.length && actual.every((value, index) => value === expected[index]);
-const teamNodes = (plan) => new Map(plan.nodes.filter((node) => node.kind === "team").map((node) => [node.value.source, node.value]));
-const rootTeam = (plan) => {
-    const node = plan.nodes.find((entry) => entry.id === plan.root || entry.value.source === plan.root);
-    return node?.value.kind === "team" ? node.value : undefined;
-};
-const pathsToAgents = (plan) => {
-    const teams = teamNodes(plan);
-    const edges = plan.edges.filter((edge) => edge.kind === "team_member");
-    const paths = new Map();
-    const teamPaths = new Map();
-    const visitedNodeIds = new Set();
-    const walk = (source, prefix, seen) => {
-        if (seen.has(source))
-            fail(`organization member graph cycle at ${source}`);
-        const team = teams.get(source);
-        if (!team)
-            return;
-        const priorTeamPath = teamPaths.get(source);
-        if (priorTeamPath)
-            fail(`team is reached through multiple organization paths: ${source}`);
-        teamPaths.set(source, prefix);
-        const node = plan.nodes.find((entry) => entry.value.source === source);
-        if (!node || node.kind !== "team")
-            return fail(`organization graph references missing team ${source}`);
-        const resolvedNode = node;
-        visitedNodeIds.add(resolvedNode.id);
-        const outgoing = edges
-            .filter((entry) => entry.from === resolvedNode.id)
-            .sort((left, right) => byAscii(left.label, right.label));
-        const memberSlots = new Set(team.members.map((member) => member.id));
-        if (memberSlots.size !== team.members.length || outgoing.length !== team.members.length) {
-            fail(`organization graph cardinality mismatch for team ${team.name}`);
-        }
-        const localSlots = new Set();
-        for (const edge of outgoing) {
-            if (localSlots.has(edge.label))
-                fail(`duplicate organization member slot: ${edge.label}`);
-            localSlots.add(edge.label);
-            assertSegment(edge.label, "organization member slot");
-            const next = [...prefix, edge.label];
-            if (next.length > MAX_ORGANIZATION_MEMBER_DEPTH)
-                fail("organization member depth exceeds 8");
-            const child = plan.nodes.find((node) => node.id === edge.to);
-            if (!child)
-                throw new SpawnfileError("validation_error", `organization graph references missing node ${edge.to}`);
-            const resolvedChild = child;
-            const member = team.members.find((entry) => entry.id === edge.label);
-            if (!member || member.kind !== resolvedChild.kind || member.nodeSource !== resolvedChild.value.source) {
-                fail(`organization graph member edge mismatch: ${edge.label}`);
-            }
-            if (resolvedChild.kind === "agent") {
-                const previous = paths.get(resolvedChild.value.source);
-                if (previous)
-                    fail(`agent source is reached through multiple organization paths: ${resolvedChild.value.source}`);
-                paths.set(resolvedChild.value.source, next);
-                visitedNodeIds.add(resolvedChild.id);
-            }
-            else
-                walk(resolvedChild.value.source, next, new Set([...seen, source]));
-        }
-    };
-    walk(plan.root, [], new Set());
-    const rootNode = plan.nodes.find((node) => node.value.source === plan.root);
-    const organizationNodeIds = new Set(rootNode ? [rootNode.id] : []);
-    for (const edge of edges) {
-        organizationNodeIds.add(edge.from);
-        organizationNodeIds.add(edge.to);
-    }
-    const extra = plan.nodes.find((node) => organizationNodeIds.has(node.id) && !visitedNodeIds.has(node.id));
-    if (extra)
-        fail(`unreachable organization graph node: ${extra.id}`);
-    return paths;
-};
 export const resolveCanonicalAgentMemberId = (plan, agentSource) => {
-    const identity = plan.organizationIdentity;
-    if (!identity)
+    if (!plan.organizationIdentity)
         return undefined;
-    const path = pathsToAgents(plan).get(agentSource);
-    return path?.join(".");
+    return organizationAgentPaths(plan).get(agentSource)?.join(".");
 };
 export const resolveOrganizationIdentity = (plan) => {
-    const root = rootTeam(plan);
-    const declaredTeams = plan.nodes.filter((node) => node.kind === "team" && node.value.externalParticipants !== undefined);
+    const root = rootOrganizationTeam(plan);
+    const declaredTeams = plan.nodes.filter((node) => node.kind === "team"
+        && (node.value.externalParticipants?.length ?? 0) > 0);
     if (declaredTeams.some((node) => node.value.source !== root?.source)) {
-        fail("external_participants may only be declared on the root team");
+        organizationIdentityFail("external_participants may only be declared on the root team");
     }
-    if (!root?.externalParticipants)
+    if (!root)
         return undefined;
-    const paths = pathsToAgents(plan);
+    const paths = organizationAgentPaths(plan);
     const agents = [];
     const agentIds = new Set();
     for (const node of plan.nodes.filter((entry) => entry.kind === "agent")) {
         const path = paths.get(node.value.source);
         if (!path)
             continue;
-        if (path.length > MAX_ORGANIZATION_MEMBER_DEPTH)
-            fail("organization member depth exceeds 8");
-        path.forEach((part) => assertSegment(part, "organization member slot"));
+        if (path.length > MAX_ORGANIZATION_MEMBER_DEPTH) {
+            organizationIdentityFail("organization member depth exceeds 8");
+        }
+        path.forEach((part) => assertOrganizationSegment(part, "organization member slot"));
         const memberId = path.join(".");
-        if (!memberIdPattern.test(memberId) || Buffer.byteLength(memberId, "ascii") > MAX_ORGANIZATION_MEMBER_ID_BYTES)
-            fail(`invalid organization member id: ${memberId}`);
+        if (!memberIdPattern.test(memberId)
+            || Buffer.byteLength(memberId, "ascii") > MAX_ORGANIZATION_MEMBER_ID_BYTES) {
+            organizationIdentityFail(`invalid organization member id: ${memberId}`);
+        }
         if (agentIds.has(memberId))
-            fail(`duplicate organization member id: ${memberId}`);
+            organizationIdentityFail(`duplicate organization member id: ${memberId}`);
         agentIds.add(memberId);
         agents.push({ authoredMemberKey: path.at(-1), kind: "agent", memberId, principalId: `agent:${memberId}` });
     }
-    if (agents.length > MAX_ORGANIZATION_AGENT_MEMBERS)
-        fail("organization has too many agent members");
+    if (agents.length > MAX_ORGANIZATION_AGENT_MEMBERS) {
+        organizationIdentityFail("organization has too many agent members");
+    }
     const seen = new Set();
-    const externalParticipants = root.externalParticipants.map((service) => {
-        assertSegment(service.id, "external participant id");
+    const externalParticipants = (root.externalParticipants ?? []).map((service) => {
+        assertOrganizationSegment(service.id, "external participant id");
         if (seen.has(service.id))
-            fail(`organization member collision: ${service.id}`);
+            organizationIdentityFail(`organization member collision: ${service.id}`);
         seen.add(service.id);
-        return { authoredParticipantKey: service.id, kind: "service", memberId: service.id, principalId: `system:${service.id}` };
+        return { authoredParticipantKey: service.id, kind: "service",
+            memberId: service.id, principalId: `system:${service.id}` };
     });
-    for (const agent of agents)
+    for (const agent of agents) {
         if (seen.has(agent.memberId))
-            fail(`organization member collision: ${agent.memberId}`);
-    if (externalParticipants.length > MAX_EXTERNAL_PARTICIPANTS)
-        fail("too many external participants");
-    const result = { agentMembers: agents.sort((a, b) => byAscii(a.memberId, b.memberId)), externalParticipants: externalParticipants.sort((a, b) => byAscii(a.memberId, b.memberId)) };
-    return freeze(structuredClone(result));
-};
-const actorTokenFor = (server, tokenId, memberId, allowObserve = false) => {
-    const token = server.auth.tokens?.filter((entry) => entry.id === tokenId);
-    if (token?.length !== 1)
-        fail(`Moltnet actor token ${tokenId} must exist exactly once`);
-    const selected = required(token?.[0], `Moltnet actor token ${tokenId} must exist exactly once`);
-    const validScopes = exact(selected.scopes, ["attach", "write"])
-        || allowObserve && exact(selected.scopes, ["attach", "observe", "write"]);
-    if (!validScopes || !exact(selected.agents, [memberId])) {
-        fail(`Moltnet actor token ${tokenId} has invalid scopes or agents for ${memberId}`);
+            organizationIdentityFail(`organization member collision: ${agent.memberId}`);
     }
-    return selected;
-};
-export const validateB31MoltnetAuth = (plan) => {
-    const root = rootTeam(plan);
-    if (!root?.externalParticipants)
-        return;
-    const identity = plan.organizationIdentity;
-    const resolvedIdentity = required(identity, "B31 organization identity is missing");
-    const paths = pathsToAgents(plan);
-    const agentBySource = new Map(resolvedIdentity.agentMembers.map((member) => {
-        const source = [...paths.entries()].find(([, path]) => path.join(".") === member.memberId)?.[0];
-        return [source, member];
-    }));
-    const networkIds = new Set(root.externalParticipants.flatMap((service) => service.surfaces.moltnet.map((attachment) => attachment.network)));
-    for (const network of root.networks ?? []) {
-        if (!root.externalParticipants.some((service) => service.surfaces.moltnet.some((attachment) => attachment.network === network.id)))
-            continue;
-        assertSegment(network.id, "B31 network id");
-        if (network.server?.mode !== "managed" || network.server.auth.mode !== "bearer" || network.server.direct_messages !== true) {
-            fail(`B31 network ${network.id} requires managed bearer direct_messages`);
-        }
-        const server = network.server;
-        const managedServer = required(server, `B31 network ${network.id} requires a managed server`);
-        if (JSON.stringify(managedServer.auth.client) !== JSON.stringify({ token_id: "operator" })) {
-            fail(`B31 network ${network.id} requires auth.client token_id operator`);
-        }
-        const tokens = managedServer.auth.tokens ?? [];
-        const operator = tokens.find((token) => token.id === "operator");
-        if (tokens.filter((token) => token.id === "operator").length !== 1 || !operator || operator.agents !== undefined || !exact(operator.scopes, ["admin", "observe", "write"])) {
-            fail(`B31 network ${network.id} has invalid operator token`);
-        }
-        const operatorSecret = operator?.secret;
-        const usedTokenIds = new Set();
-        const usedEnvNames = new Set();
-        for (const token of tokens) {
-            assertSegment(token.id, "Moltnet token id");
-            if (!/^[A-Z_][A-Z0-9_]{0,127}$/u.test(token.secret))
-                fail(`invalid Moltnet token env name ${token.secret}`);
-            if (usedTokenIds.has(token.id) || usedEnvNames.has(token.secret))
-                fail(`duplicate Moltnet token identity ${token.id}`);
-            usedTokenIds.add(token.id);
-            usedEnvNames.add(token.secret);
-            if (token.id !== "operator" && token.secret === operatorSecret)
-                fail("operator and actor token env identities must differ");
-        }
-    }
-    const selectedByNetwork = new Map();
-    const selectedActorKeys = new Set();
-    for (const member of resolvedIdentity.agentMembers) {
-        const source = [...agentBySource.entries()].find(([, value]) => value.memberId === member.memberId)?.[0];
-        const node = plan.nodes.find((entry) => entry.kind === "agent" && entry.value.source === source);
-        const attachments = node?.value?.surfaces?.moltnet ?? [];
-        for (const attachment of attachments.filter((entry) => networkIds.has(entry.network))) {
-            const network = root.networks?.find((entry) => entry.id === attachment.network);
-            const selectedTokenId = required(attachment.auth?.tokenId, `B31 agent ${member.memberId} must select auth.token_id`);
-            const actorKey = `${attachment.network}\u0000${member.memberId}`;
-            if (selectedActorKeys.has(actorKey))
-                fail(`B31 actor ${member.memberId} selects more than one token on ${attachment.network}`);
-            selectedActorKeys.add(actorKey);
-            if (network?.server?.mode === "managed") {
-                const token = actorTokenFor(network.server, selectedTokenId, member.memberId);
-                const selected = selectedByNetwork.get(attachment.network) ?? new Map();
-                const previous = selected.get(selectedTokenId);
-                if (previous)
-                    fail(`Moltnet actor token ${selectedTokenId} is shared by ${previous} and ${member.memberId}`);
-                selected.set(selectedTokenId, member.memberId);
-                selectedByNetwork.set(attachment.network, selected);
-                if (token.id === "operator")
-                    fail(`B31 actor ${member.memberId} must not use operator token`);
-            }
-        }
-    }
-    for (const service of root.externalParticipants) {
-        for (const attachment of service.surfaces.moltnet) {
-            const network = root.networks?.find((entry) => entry.id === attachment.network);
-            if (network?.server?.mode !== "managed")
-                continue;
-            const token = actorTokenFor(network.server, attachment.auth.token_id, service.id, true);
-            if (token.id === "operator")
-                fail(`B31 external participant ${service.id} must not use operator token`);
-            const selected = selectedByNetwork.get(attachment.network) ?? new Map();
-            const previous = selected.get(token.id);
-            if (previous)
-                fail(`Moltnet actor token ${token.id} is shared by ${previous} and ${service.id}`);
-            selected.set(token.id, service.id);
-            selectedByNetwork.set(attachment.network, selected);
-        }
-    }
-    for (const network of root.networks ?? []) {
-        const selected = selectedByNetwork.get(network.id);
-        if (network.server?.mode === "managed" && selected) {
-            for (const token of network.server.auth.tokens ?? []) {
-                if (token.id !== "operator" && !selected.has(token.id)) {
-                    fail(`Moltnet actor token ${token.id} is not selected by exactly one actor`);
-                }
-            }
-        }
+    if (externalParticipants.length > MAX_EXTERNAL_PARTICIPANTS) {
+        organizationIdentityFail("too many external participants");
     }
-};
-export const resolveMoltnetExternalParticipantIntents = (plan) => {
-    const identity = plan.organizationIdentity;
-    const root = rootTeam(plan);
-    if (!identity || !root?.externalParticipants)
-        return [];
-    const paths = pathsToAgents(plan);
-    const agents = new Map(identity.agentMembers.map((member) => [member.memberId, member]));
-    const networkIds = new Set((root.networks ?? []).map((network) => network.id));
-    const result = [];
-    for (const service of root.externalParticipants) {
-        const participant = identity.externalParticipants.find((entry) => entry.memberId === service.id);
-        if (!participant)
-            throw new SpawnfileError("validation_error", `missing external participant identity: ${service.id}`);
-        const resolvedParticipant = participant;
-        for (const attachment of service.surfaces.moltnet) {
-            if (!networkIds.has(attachment.network))
-                fail(`external participant ${service.id} references unknown network ${attachment.network}`);
-            const peers = [];
-            for (const [memberId, agent] of agents) {
-                const node = plan.nodes.find((entry) => entry.kind === "agent" && paths.get(entry.value.source)?.join(".") === memberId);
-                const authored = node?.value?.surfaces?.moltnet ?? [];
-                const eligible = authored.filter((entry) => entry.network === attachment.network && entry.dms?.enabled === true);
-                if (eligible.length > 1)
-                    fail(`duplicate eligible Moltnet peer for ${service.id}/${attachment.network}`);
-                if (eligible.length === 1)
-                    peers.push(agent.memberId);
-            }
-            if (new Set(peers).size !== peers.length)
-                fail(`duplicate eligible Moltnet peer for ${service.id}/${attachment.network}`);
-            if (peers.length === 0)
-                fail(`external participant ${service.id}/${attachment.network} has no eligible direct-message peers`);
-            peers.sort(byAscii);
-            const network = root.networks?.find((entry) => entry.id === attachment.network);
-            const token = network?.server?.mode === "managed" ? actorTokenFor(network.server, attachment.auth.token_id, service.id, true) : undefined;
-            result.push({ participant: resolvedParticipant, networkId: attachment.network, tokenId: attachment.auth.token_id, tokenEnv: token?.secret ?? "", directMessagePeers: peers });
-        }
-    }
-    return result;
+    const result = {
+        agentMembers: agents.sort((a, b) => compareOrganizationIds(a.memberId, b.memberId)),
+        externalParticipants: externalParticipants.sort((a, b) => compareOrganizationIds(a.memberId, b.memberId)),
+    };
+    return freezeOrganizationIdentity(structuredClone(result));
 };

package/dist/compiler/organizationIdentityGraph.d.ts

@@ -0,0 +1,15 @@
+import type { CompilePlan, ResolvedTeamNode } from "./types.js";
+export declare const ORGANIZATION_ID_SEGMENT_PATTERN_SOURCE = "^[a-z][a-z0-9-]{0,62}$";
+export declare const ORGANIZATION_MEMBER_ID_PATTERN_SOURCE = "^[a-z][a-z0-9-]{0,62}(\\.[a-z][a-z0-9-]{0,62}){0,7}$";
+export declare const MAX_ORGANIZATION_MEMBER_DEPTH = 8;
+export declare const MAX_ORGANIZATION_MEMBER_ID_BYTES = 255;
+export declare const MAX_ORGANIZATION_AGENT_MEMBERS = 128;
+export declare const MAX_EXTERNAL_PARTICIPANTS = 32;
+export declare const organizationIdentityFail: (message: string) => never;
+export declare const requiredOrganizationIdentity: <T>(value: T, message: string) => NonNullable<T>;
+export declare const assertOrganizationSegment: (value: string, label: string) => void;
+export declare const freezeOrganizationIdentity: <T>(value: T) => T;
+export declare const compareOrganizationIds: (left: string, right: string) => number;
+export declare const exactOrganizationStrings: (actual: readonly string[] | undefined, expected: readonly string[]) => boolean;
+export declare const rootOrganizationTeam: (plan: CompilePlan) => ResolvedTeamNode | undefined;
+export declare const organizationAgentPaths: (plan: CompilePlan) => Map<string, string[]>;