spawnfile 0.1.3 → 0.1.5

package/dist/compiler/surfaces.d.ts

@@ -1,21 +1,11 @@
-import { DocsBlock, McpServer, Secret, SharedSurface, SkillReference } from "../manifest/index.js";
+import { DocsBlock, McpServer, Secret, SkillReference } from "../manifest/index.js";
 import { StringMap } from "../shared/index.js";
-import { ResolvedDocument, ResolvedSkill } from "./types.js";
+import { ResolvedDocument, ResolvedPackage, ResolvedSkill } from "./types.js";
 export declare const mergeSkills: (sharedSkills?: SkillReference[], localSkills?: SkillReference[]) => SkillReference[];
 export declare const mergeResolvedSkills: (sharedSkills?: ResolvedSkill[], localSkills?: ResolvedSkill[]) => ResolvedSkill[];
+export declare const mergePackages: (sharedPackages?: ResolvedPackage[], localPackages?: ResolvedPackage[]) => ResolvedPackage[];
 export declare const mergeMcpServers: (sharedServers?: McpServer[], localServers?: McpServer[]) => McpServer[];
 export declare const mergeSecrets: (sharedSecrets?: Secret[], localSecrets?: Secret[]) => Secret[];
 export declare const mergeEnv: (sharedEnv?: StringMap, localEnv?: StringMap) => StringMap;
 export declare const loadResolvedDocuments: (manifestPath: string, docs: DocsBlock | undefined) => Promise<ResolvedDocument[]>;
 export declare const loadResolvedSkills: (manifestPath: string, skills?: SkillReference[]) => Promise<ResolvedSkill[]>;
-export declare const mergeSharedSurface: (shared: SharedSurface | undefined, local: {
-    env: StringMap | undefined;
-    mcpServers: McpServer[] | undefined;
-    secrets: Secret[] | undefined;
-    skills: SkillReference[] | undefined;
-}) => {
-    env: StringMap;
-    mcpServers: McpServer[];
-    secrets: Secret[];
-    skills: SkillReference[];
-};

package/dist/compiler/surfaces.js

@@ -12,6 +12,7 @@ const mergeByKey = (sharedValues, localValues, getKey) => {
 };
 export const mergeSkills = (sharedSkills = [], localSkills = []) => mergeByKey(sharedSkills, localSkills, (skill) => skill.ref);
 export const mergeResolvedSkills = (sharedSkills = [], localSkills = []) => mergeByKey(sharedSkills, localSkills, (skill) => skill.ref);
+export const mergePackages = (sharedPackages = [], localPackages = []) => mergeByKey(sharedPackages, localPackages, (pkg) => `${pkg.manager}::${pkg.name}`);
 export const mergeMcpServers = (sharedServers = [], localServers = []) => mergeByKey(sharedServers, localServers, (server) => server.name);
 export const mergeSecrets = (sharedSecrets = [], localSecrets = []) => mergeByKey(sharedSecrets, localSecrets, (secret) => secret.name);
 export const mergeEnv = (sharedEnv = {}, localEnv = {}) => ({
@@ -51,9 +52,3 @@ export const loadResolvedSkills = async (manifestPath, skills = []) => Promise.a
         sourcePath
     };
 }));
-export const mergeSharedSurface = (shared, local) => ({
-    env: mergeEnv(shared?.env, local.env),
-    mcpServers: mergeMcpServers(shared?.mcp_servers, local.mcpServers),
-    secrets: mergeSecrets(shared?.secrets, local.secrets),
-    skills: mergeSkills(shared?.skills, local.skills)
-});

package/dist/compiler/syncProjectAuth.js

@@ -3,43 +3,82 @@ import { readUtf8File } from "../filesystem/index.js";
 import { SpawnfileError } from "../shared/index.js";
 import { listAgentSurfaceSecretNames } from "./agentSurfaces.js";
 import { buildCompilePlan } from "./buildCompilePlan.js";
+import { listMoltnetNetworkSecretNames } from "./compilePlanHelpers.js";
 import { listExecutionModelSecretNames, resolveExecutionModelAuthMethods } from "./modelEnv.js";
 const resolveAuthRequirements = async (inputPath) => {
     const plan = await buildCompilePlan(inputPath);
     const methods = new Set();
-    const envNames = new Set();
+    const optionalEnvNames = new Set();
+    const requiredEnvNames = new Set();
+    const addProjectSecret = (secret) => {
+        if (secret.required) {
+            requiredEnvNames.add(secret.name);
+            optionalEnvNames.delete(secret.name);
+        }
+        else if (!requiredEnvNames.has(secret.name)) {
+            optionalEnvNames.add(secret.name);
+        }
+    };
     for (const node of plan.nodes) {
         if (node.value.kind !== "agent") {
+            for (const secret of node.value.shared.secrets) {
+                addProjectSecret(secret);
+            }
+            for (const server of node.value.shared.mcpServers) {
+                if (server.auth?.secret) {
+                    addProjectSecret({ name: server.auth.secret, required: true });
+                }
+            }
+            for (const secretName of listMoltnetNetworkSecretNames([node])) {
+                addProjectSecret({ name: secretName, required: true });
+            }
             continue;
         }
+        for (const secret of node.value.secrets) {
+            addProjectSecret(secret);
+        }
+        for (const server of node.value.mcpServers) {
+            if (server.auth?.secret) {
+                addProjectSecret({ name: server.auth.secret, required: true });
+            }
+        }
         for (const method of Object.values(resolveExecutionModelAuthMethods(node.value.execution))) {
             methods.add(method);
         }
         for (const envName of listExecutionModelSecretNames(node.value.execution)) {
-            envNames.add(envName);
+            requiredEnvNames.add(envName);
+            optionalEnvNames.delete(envName);
         }
         for (const envName of listAgentSurfaceSecretNames(node.value.surfaces)) {
-            envNames.add(envName);
+            requiredEnvNames.add(envName);
+            optionalEnvNames.delete(envName);
         }
     }
-    return { envNames, methods };
+    return { methods, optionalEnvNames, requiredEnvNames };
+};
+const readEnvFile = async (envFilePath) => envFilePath ? parseEnvFile(await readUtf8File(envFilePath)) : {};
+const resolveEnvValue = (envName, fileEnv) => {
+    const processValue = process.env[envName];
+    if (typeof processValue === "string" && processValue.length > 0) {
+        return processValue;
+    }
+    const fileValue = fileEnv[envName];
+    if (typeof fileValue === "string" && fileValue.length > 0) {
+        return fileValue;
+    }
+    return null;
 };
-const resolveRequiredEnv = async (envNames, envFilePath) => {
-    if (envNames.size === 0) {
+const resolveRequiredEnv = async (requiredEnvNames, optionalEnvNames, envFilePath) => {
+    if (requiredEnvNames.size === 0 && optionalEnvNames.size === 0) {
         return {};
     }
-    const fileEnv = envFilePath ? parseEnvFile(await readUtf8File(envFilePath)) : {};
+    const fileEnv = await readEnvFile(envFilePath);
     const resolvedEnv = {};
     const missingEnv = [];
-    for (const envName of [...envNames].sort()) {
-        const processValue = process.env[envName];
-        if (typeof processValue === "string" && processValue.length > 0) {
-            resolvedEnv[envName] = processValue;
-            continue;
-        }
-        const fileValue = fileEnv[envName];
-        if (typeof fileValue === "string" && fileValue.length > 0) {
-            resolvedEnv[envName] = fileValue;
+    for (const envName of [...requiredEnvNames].sort()) {
+        const value = resolveEnvValue(envName, fileEnv);
+        if (value !== null) {
+            resolvedEnv[envName] = value;
             continue;
         }
         missingEnv.push(envName);
@@ -47,10 +86,19 @@ const resolveRequiredEnv = async (envNames, envFilePath) => {
     if (missingEnv.length > 0) {
         throw new SpawnfileError("validation_error", `Missing required auth env: ${missingEnv.join(", ")}`);
     }
+    for (const envName of [...optionalEnvNames].sort()) {
+        if (requiredEnvNames.has(envName)) {
+            continue;
+        }
+        const value = resolveEnvValue(envName, fileEnv);
+        if (value !== null) {
+            resolvedEnv[envName] = value;
+        }
+    }
     return resolvedEnv;
 };
 export const syncProjectAuth = async (inputPath, options) => {
-    const { envNames, methods } = await resolveAuthRequirements(inputPath);
+    const { methods, optionalEnvNames, requiredEnvNames } = await resolveAuthRequirements(inputPath);
     await ensureAuthProfile(options.profileName);
     if (methods.has("codex")) {
         await importCodexAuth(options.profileName, options.codexDirectory);
@@ -58,8 +106,8 @@ export const syncProjectAuth = async (inputPath, options) => {
     if (methods.has("claude-code")) {
         await importClaudeCodeAuth(options.profileName, options.claudeCodeDirectory);
     }
-    if (envNames.size > 0) {
-        await setAuthProfileEnv(options.profileName, await resolveRequiredEnv(envNames, options.envFilePath));
+    if (requiredEnvNames.size > 0 || optionalEnvNames.size > 0) {
+        await setAuthProfileEnv(options.profileName, await resolveRequiredEnv(requiredEnvNames, optionalEnvNames, options.envFilePath));
     }
     return requireAuthProfile(options.profileName);
 };

package/dist/compiler/types.d.ts

@@ -1,5 +1,6 @@
-import { ExecutionBlock, McpServer, ModelEndpoint, Secret } from "../manifest/index.js";
+import { AgentSchedule, ExecutionBlock, McpServer, ModelEndpoint, Secret, TeamNetworkServer } from "../manifest/index.js";
 import { ModelAuthMethod, StringMap } from "../shared/index.js";
+import type { ResolvedWorkspaceResource } from "./workspaceResources.js";
 export interface ResolvedDocument {
     content: string;
     role: string;
@@ -12,6 +13,13 @@ export interface ResolvedSkill {
     requiresMcp: string[];
     sourcePath: string;
 }
+export interface ResolvedPackage {
+    id: string;
+    manager: string;
+    name: string;
+    scope?: string;
+    version?: string;
+}
 export interface ResolvedRuntime {
     name: string;
     options: Record<string, unknown>;
@@ -104,6 +112,7 @@ export interface ResolvedAgentSurfaces {
 export interface ResolvedTeamNetworkRoom {
     id: string;
     members: string[];
+    name?: string;
 }
 export interface ResolvedTeamNetwork {
     expose?: boolean;
@@ -111,6 +120,7 @@ export interface ResolvedTeamNetwork {
     name: string;
     provider: "moltnet";
     rooms: ResolvedTeamNetworkRoom[];
+    server?: TeamNetworkServer;
 }
 export interface EffectiveModelTarget {
     auth: {
@@ -140,14 +150,17 @@ export interface ResolvedAgentNode {
     kind: "agent";
     mcpServers: McpServer[];
     name: string;
+    packages?: ResolvedPackage[];
     policyMode: string | null;
     policyOnDegrade: string | null;
     runtime: ResolvedRuntime;
+    schedule?: AgentSchedule;
     secrets: Secret[];
     skills: ResolvedSkill[];
     source: string;
     surfaces?: ResolvedAgentSurfaces;
     subagents: ResolvedSubagentRef[];
+    workspaceResources?: ResolvedWorkspaceResource[];
 }
 export interface ResolvedTeamNode {
     description: string;
@@ -162,11 +175,13 @@ export interface ResolvedTeamNode {
     networks?: ResolvedTeamNetwork[];
     policyMode: string | null;
     policyOnDegrade: string | null;
+    workspaceResources?: ResolvedWorkspaceResource[];
     shared: {
         env: StringMap;
         mcpServers: McpServer[];
         secrets: Secret[];
         skills: ResolvedSkill[];
+        packages?: ResolvedPackage[];
     };
     source: string;
 }

package/dist/compiler/upProject.d.ts

@@ -0,0 +1,19 @@
+import { type BuildProjectResult, type DockerBuildRunner } from "./buildProject.js";
+import { type DockerRunRunner } from "./runProject.js";
+import { CompileProjectOptions } from "./compileProject.js";
+export interface UpProjectOptions extends CompileProjectOptions {
+    authProfile?: string;
+    buildRunner?: DockerBuildRunner;
+    containerName?: string;
+    detach?: boolean;
+    dockerCommand?: string;
+    envFilePath?: string;
+    imageTag?: string;
+    runRunner?: DockerRunRunner;
+}
+export interface UpProjectResult extends BuildProjectResult {
+    authProfileName: string | null;
+    containerName: string | null;
+    supportDirectory: string | null;
+}
+export declare const upProject: (inputPath: string, options?: UpProjectOptions) => Promise<UpProjectResult>;

package/dist/compiler/upProject.js

@@ -0,0 +1,37 @@
+import { removeDirectory } from "../filesystem/index.js";
+import { buildProject } from "./buildProject.js";
+import { createDockerRunInvocation, runDockerContainer } from "./runProject.js";
+import { requireAuthProfile } from "../auth/index.js";
+export const upProject = async (inputPath, options = {}) => {
+    const buildResult = await buildProject(inputPath, {
+        buildRunner: options.buildRunner,
+        clean: options.clean,
+        dockerCommand: options.dockerCommand,
+        imageTag: options.imageTag,
+        outputDirectory: options.outputDirectory
+    });
+    const authProfile = options.authProfile
+        ? await requireAuthProfile(options.authProfile)
+        : null;
+    const invocation = await createDockerRunInvocation(buildResult, buildResult.imageTag, {
+        authProfile,
+        containerName: options.containerName,
+        detach: options.detach,
+        dockerCommand: options.dockerCommand,
+        envFilePath: options.envFilePath
+    });
+    try {
+        await (options.runRunner ?? runDockerContainer)(invocation);
+    }
+    finally {
+        if (!invocation.detach) {
+            await removeDirectory(invocation.supportDirectory);
+        }
+    }
+    return {
+        ...buildResult,
+        authProfileName: authProfile?.name ?? null,
+        containerName: invocation.containerName,
+        supportDirectory: invocation.supportDirectory
+    };
+};

package/dist/compiler/view/buildOrganizationView.js

@@ -30,10 +30,15 @@ const buildTreeNetworkSummaries = (node) => {
         return [];
     }
     return (node.value.networks ?? []).map((network) => ({
-        expose: network.expose ?? false,
+        authMode: network.server?.auth.mode,
+        directMessages: network.server?.mode === "managed" ? network.server.direct_messages : undefined,
+        expose: network.server?.mode === "managed" ? network.server.human_ingress : undefined,
+        httpEnabled: network.server?.mode === "managed" ? network.server.human_ingress === true : false,
         id: network.id,
         name: network.name,
         provider: network.provider,
+        serverMode: network.server?.mode,
+        url: network.server?.url,
         rooms: network.rooms.map((room) => ({
             declaredMembers: [...room.members],
             id: room.id
@@ -101,10 +106,15 @@ const toNetworkMemberView = (membership) => ({
 });
 const createNetworkKey = (provider, networkId) => `${provider}::${networkId}`;
 const buildNetworkDeclaration = (teamNode, network, roomMemberships) => ({
+    authMode: network.server?.auth.mode,
     declaringTeamName: teamNode.name,
     declaringTeamSource: teamNode.source,
-    expose: network.expose ?? false,
+    directMessages: network.server?.mode === "managed" ? network.server.direct_messages : undefined,
+    expose: network.server?.mode === "managed" ? network.server.human_ingress : undefined,
+    httpEnabled: network.server?.mode === "managed" ? network.server.human_ingress === true : false,
     name: network.name,
+    serverMode: network.server?.mode,
+    url: network.server?.url,
     rooms: network.rooms.map((room) => {
         const members = roomMemberships
             .filter((membership) => membership.declaringTeamSource === teamNode.source
@@ -139,10 +149,15 @@ const buildNetworks = (plan) => {
                 declaringTeamName: declaration.declaringTeamName,
                 declaringTeamSource: declaration.declaringTeamSource,
                 declarations: [declaration],
+                authMode: declaration.authMode,
+                directMessages: declaration.directMessages,
                 expose: declaration.expose,
+                httpEnabled: declaration.httpEnabled,
                 id: network.id,
                 name: declaration.name,
                 provider: network.provider,
+                serverMode: declaration.serverMode,
+                url: declaration.url,
                 rooms: declaration.rooms
             });
         }
@@ -153,8 +168,13 @@ const buildNetworks = (plan) => {
         if (firstDeclaration) {
             network.declaringTeamName = firstDeclaration.declaringTeamName;
             network.declaringTeamSource = firstDeclaration.declaringTeamSource;
+            network.authMode = firstDeclaration.authMode;
+            network.directMessages = firstDeclaration.directMessages;
             network.expose = firstDeclaration.expose;
+            network.httpEnabled = firstDeclaration.httpEnabled;
             network.name = firstDeclaration.name;
+            network.serverMode = firstDeclaration.serverMode;
+            network.url = firstDeclaration.url;
             network.rooms = firstDeclaration.rooms;
         }
     }

package/dist/compiler/view/renderNetworks.js

@@ -40,19 +40,30 @@ const formatNetwork = (network, options) => {
 };
 const getDeclarations = (network) => network.declarations ?? [
     {
+        authMode: network.authMode,
         declaringTeamName: network.declaringTeamName,
         declaringTeamSource: network.declaringTeamSource,
+        directMessages: network.directMessages,
         expose: network.expose,
+        httpEnabled: network.httpEnabled,
         name: network.name,
-        rooms: network.rooms
+        rooms: network.rooms,
+        serverMode: network.serverMode,
+        url: network.url
     }
 ];
 const formatDeclaration = (network, declaration, options, projectRoot) => {
-    const exposed = declaration.expose ? " exposed" : "";
+    const metadata = [
+        declaration.serverMode ? `server=${declaration.serverMode}` : undefined,
+        declaration.url ? `url=${declaration.url}` : undefined,
+        declaration.authMode ? `auth=${declaration.authMode}` : undefined,
+        declaration.directMessages === false ? "dms=disabled" : undefined,
+        declaration.expose === true || declaration.httpEnabled ? "human_ingress" : undefined
+    ].filter((entry) => entry !== undefined);
     const source = options.paths
         ? formatSourceMeta("declared_source", declaration.declaringTeamSource, projectRoot)
         : "";
-    return `${network.id} "${declaration.name}" on ${declaration.declaringTeamName}${exposed}${source}`;
+    return `${network.id} "${declaration.name}" on ${declaration.declaringTeamName}${metadata.length > 0 ? ` ${metadata.join(" ")}` : ""}${source}`;
 };
 export const renderOrganizationNetworks = (view, options = {}) => {
     if (view.networks.length === 0) {

package/dist/compiler/view/renderTree.js

@@ -24,11 +24,17 @@ const formatEdgeLabel = (edge) => edge.relation === "subagent"
     : edge.label;
 const formatNetworkSummary = (network, options) => {
     const id = color(network.id, "36", options);
-    const exposed = network.expose ? " exposed" : "";
+    const metadata = [
+        network.serverMode ? `server=${network.serverMode}` : undefined,
+        network.url ? `url=${network.url}` : undefined,
+        network.authMode ? `auth=${network.authMode}` : undefined,
+        network.directMessages === false ? "dms=disabled" : undefined,
+        network.expose === true || network.httpEnabled ? "human_ingress" : undefined
+    ].filter((entry) => entry !== undefined);
     const rooms = network.rooms
         .map((room) => `${room.id} [${room.declaredMembers.join(", ")}]`)
         .join("; ");
-    return `network ${id} "${network.name}"${exposed}: ${rooms}`;
+    return `network ${id} "${network.name}"${metadata.length > 0 ? ` ${metadata.join(" ")}` : ""}: ${rooms}`;
 };
 const renderChildren = (node, options, projectRoot, prefix = "") => {
     const glyphs = options.ascii

package/dist/compiler/view/types.d.ts

@@ -17,10 +17,15 @@ export interface OrganizationTreeNetworkRoomSummary {
     id: string;
 }
 export interface OrganizationTreeNetworkSummary {
-    expose: boolean;
+    authMode?: "bearer" | "none" | "open";
+    directMessages?: boolean;
+    expose?: boolean;
+    httpEnabled?: boolean;
     id: string;
     name: string;
     provider: "moltnet";
+    serverMode?: "external" | "managed";
+    url?: string;
     rooms: OrganizationTreeNetworkRoomSummary[];
 }
 export interface OrganizationViewTreeEdge {
@@ -42,11 +47,16 @@ export interface OrganizationNetworkMemberView {
     representativePath?: string[];
 }
 export interface OrganizationNetworkDeclarationView {
+    authMode?: "bearer" | "none" | "open";
     declaringTeamName: string;
     declaringTeamSource: string;
-    expose: boolean;
+    directMessages?: boolean;
+    expose?: boolean;
+    httpEnabled?: boolean;
     name: string;
     rooms: OrganizationNetworkRoomView[];
+    serverMode?: "external" | "managed";
+    url?: string;
 }
 export interface OrganizationNetworkRoomView {
     declaredMembers: string[];
@@ -54,13 +64,18 @@ export interface OrganizationNetworkRoomView {
     members: OrganizationNetworkMemberView[];
 }
 export interface OrganizationNetworkView {
+    authMode?: "bearer" | "none" | "open";
     declaringTeamName: string;
     declaringTeamSource: string;
-    expose: boolean;
+    directMessages?: boolean;
+    expose?: boolean;
+    httpEnabled?: boolean;
     id: string;
     name: string;
     provider: "moltnet";
     rooms: OrganizationNetworkRoomView[];
+    serverMode?: "external" | "managed";
+    url?: string;
     declarations?: OrganizationNetworkDeclarationView[];
 }
 export interface OrganizationView {

package/dist/compiler/workspaceResources.d.ts

@@ -0,0 +1,34 @@
+import type { TeamWorkspaceResource } from "../manifest/index.js";
+export type WorkspaceResourceSharing = "per_agent" | "team";
+export interface WorkspaceResourceScope {
+    kind: "agent" | "team";
+    key: string;
+    name: string;
+}
+export type ResolvedWorkspaceResource = TeamWorkspaceResource & {
+    scope: WorkspaceResourceScope;
+    sharing: WorkspaceResourceSharing;
+};
+export interface WorkspaceResourcePlan {
+    backingPath: string;
+    branch?: string;
+    id: string;
+    kind: "git" | "volume";
+    linkPath: string;
+    mode: "mutable" | "readonly";
+    mount: string;
+    name?: string;
+    ref?: string;
+    sharing: WorkspaceResourceSharing;
+    tag?: string;
+    url?: string;
+}
+export declare const mergeWorkspaceResources: (inherited: ResolvedWorkspaceResource[] | undefined, local: TeamWorkspaceResource[] | undefined, ownerName: string, ownerScope: WorkspaceResourceScope) => ResolvedWorkspaceResource[];
+export declare const toWorkspaceResourcePlan: (resource: ResolvedWorkspaceResource, context: {
+    targetId: string;
+    workspacePath: string;
+}) => WorkspaceResourcePlan;
+export declare const mergeWorkspaceResourcePlans: (resources: ResolvedWorkspaceResource[], ownerName: string, context: {
+    targetId: string;
+    workspacePath: string;
+}) => WorkspaceResourcePlan[];

package/dist/compiler/workspaceResources.js

@@ -0,0 +1,120 @@
+import path from "node:path";
+import { SpawnfileError } from "../shared/index.js";
+import { createShortHash, slugify } from "./helpers.js";
+const normalizeMount = (value) => {
+    const trimmed = value.trim();
+    const workspaceRelative = trimmed.startsWith("${workspace}/")
+        ? `./${trimmed.slice("${workspace}/".length)}`
+        : trimmed;
+    const collapsed = workspaceRelative.replace(/\/+/g, "/");
+    if (collapsed.startsWith("./")) {
+        const relativePath = collapsed.slice(2).replace(/\/+$/u, "");
+        return `./${relativePath}`;
+    }
+    return collapsed.length > 1 ? collapsed.replace(/\/+$/u, "") : "/";
+};
+const normalizeResourceIdentity = (resource) => {
+    if (resource.kind === "git") {
+        return JSON.stringify({
+            branch: resource.branch?.trim() ?? "",
+            kind: "git",
+            mode: resource.mode,
+            mount: normalizeMount(resource.mount),
+            ref: resource.ref?.trim() ?? "",
+            sharing: resource.sharing,
+            tag: resource.tag?.trim() ?? "",
+            url: resource.url.trim()
+        });
+    }
+    return JSON.stringify({
+        kind: "volume",
+        mode: resource.mode,
+        mount: normalizeMount(resource.mount),
+        name: resource.name?.trim() ?? "",
+        scope: resource.sharing === "team" ? resource.scope.key : "",
+        sharing: resource.sharing
+    });
+};
+const mountsOverlap = (left, right) => left === right ||
+    left.startsWith(`${right}/`) ||
+    right.startsWith(`${left}/`);
+const resolveSharing = (resource) => resource.sharing ?? "per_agent";
+const toResolvedResource = (resource, scope) => ({
+    ...resource,
+    mount: normalizeMount(resource.mount),
+    scope,
+    sharing: resolveSharing(resource)
+});
+const createPathSegment = (value) => {
+    const slug = slugify(value);
+    const hash = createShortHash(value);
+    return slug ? `${slug}-${hash}` : hash;
+};
+const createScopeSegment = (scope) => `${scope.kind}-${createPathSegment(`${scope.name}:${scope.key}`)}`;
+const createResourceSegment = (resource) => createPathSegment(resource.kind === "volume" && resource.name ? resource.name : resource.id);
+const resolveLinkPath = (mount, workspacePath) => mount.startsWith("./")
+    ? path.posix.join(workspacePath, mount.slice(2))
+    : mount;
+const resolveBackingPath = (resource, targetId) => {
+    const resourceSegment = createResourceSegment(resource);
+    if (resource.sharing === "team") {
+        return path.posix.join("/var/lib/spawnfile/resources/teams", createScopeSegment(resource.scope), resourceSegment);
+    }
+    return path.posix.join("/var/lib/spawnfile/resources/instances", createPathSegment(targetId), resourceSegment);
+};
+export const mergeWorkspaceResources = (inherited = [], local = [], ownerName, ownerScope) => {
+    const merged = [];
+    const identityById = new Map();
+    const resources = [
+        ...inherited,
+        ...local.map((resource) => toResolvedResource(resource, ownerScope))
+    ];
+    for (const resource of resources) {
+        const mount = normalizeMount(resource.mount);
+        const identity = normalizeResourceIdentity(resource);
+        const existingIdentity = identityById.get(resource.id);
+        if (existingIdentity) {
+            if (existingIdentity !== identity) {
+                throw new SpawnfileError("validation_error", `Workspace resource ${resource.id} resolves differently for ${ownerName}`);
+            }
+            continue;
+        }
+        const overlapping = merged.find((candidate) => candidate.id !== resource.id &&
+            mountsOverlap(normalizeMount(candidate.mount), mount));
+        if (overlapping) {
+            throw new SpawnfileError("validation_error", `Workspace resources ${overlapping.id} and ${resource.id} use overlapping mounts for ${ownerName}`);
+        }
+        identityById.set(resource.id, identity);
+        merged.push({ ...resource, mount });
+    }
+    return merged.sort((left, right) => left.id.localeCompare(right.id));
+};
+export const toWorkspaceResourcePlan = (resource, context) => resource.kind === "git"
+    ? {
+        backingPath: resolveBackingPath(resource, context.targetId),
+        ...(resource.branch ? { branch: resource.branch } : {}),
+        id: resource.id,
+        kind: "git",
+        linkPath: resolveLinkPath(normalizeMount(resource.mount), context.workspacePath),
+        mode: resource.mode,
+        mount: normalizeMount(resource.mount),
+        ...(resource.ref ? { ref: resource.ref } : {}),
+        sharing: resource.sharing,
+        ...(resource.tag ? { tag: resource.tag } : {}),
+        url: resource.url
+    }
+    : {
+        backingPath: resolveBackingPath(resource, context.targetId),
+        id: resource.id,
+        kind: "volume",
+        linkPath: resolveLinkPath(normalizeMount(resource.mount), context.workspacePath),
+        mode: resource.mode,
+        mount: normalizeMount(resource.mount),
+        ...(resource.name ? { name: resource.name } : {}),
+        sharing: resource.sharing
+    };
+export const mergeWorkspaceResourcePlans = (resources, ownerName, context) => mergeWorkspaceResources(resources, [], ownerName, {
+    kind: "agent",
+    key: context.targetId,
+    name: context.targetId
+}).map((resource) => toWorkspaceResourcePlan(resource, context));