@sequenceholdings/managed-functions 0.2.0 → 0.3.1

package/dist/runtime.cjs

@@ -26837,7 +26837,7 @@ var require_contracts = __commonJS({
   "../storage/dist/contracts.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.storageErrorSchema = exports2.storageAccessSchema = exports2.updateStorageAccessSchema = exports2.storagePrincipalSchema = exports2.uploadSessionSchema = exports2.completeUploadSchema = exports2.startUploadSchema = exports2.storageChecksum = exports2.updateNodeSchema = exports2.createFolderSchema = exports2.listStorageSchema = exports2.storagePage = exports2.listStorageOperationsSchema = exports2.storageOperationScope = exports2.operationSchema = exports2.versionSchema = exports2.nodeSchema = exports2.workspaceSchema = exports2.workspaceManifestSchema = exports2.storageMetadata = exports2.storagePath = exports2.storageName = exports2.storageLifecycle = exports2.storageRole = exports2.storageId = void 0;
+    exports2.storageErrorSchema = exports2.storageAccessSchema = exports2.updateStorageAccessSchema = exports2.storagePrincipalSchema = exports2.reconcileUploadsResultSchema = exports2.reconcileUploadsSchema = exports2.uploadListSchema = exports2.uploadLimitsSchema = exports2.uploadListItemSchema = exports2.uploadSessionSchema = exports2.startUploadBatchSchema = exports2.completeUploadSchema = exports2.startUploadSchema = exports2.storageChecksum = exports2.STORAGE_IMPORT_CONCURRENCY_MAX = exports2.STORAGE_IMPORT_CONCURRENCY_DEFAULT = exports2.STORAGE_UPLOAD_BATCH_LIMIT = exports2.STORAGE_PENDING_UPLOADS_PER_WORKSPACE = exports2.STORAGE_PENDING_UPLOADS_PER_PRINCIPAL = exports2.updateNodeSchema = exports2.createFolderSchema = exports2.listStorageSchema = exports2.storagePage = exports2.listStorageOperationsSchema = exports2.storageOperationScope = exports2.operationSchema = exports2.versionSchema = exports2.nodeSchema = exports2.workspaceSchema = exports2.workspaceManifestSchema = exports2.storageMetadata = exports2.storagePath = exports2.storageName = exports2.storageLifecycle = exports2.storageRole = exports2.storageId = void 0;
     var zod_12 = require_zod();
     var paths_js_1 = require_paths();
     exports2.storageId = zod_12.z.uuid();
@@ -26956,6 +26956,11 @@ var require_contracts = __commonJS({
       parentId: exports2.storageId.nullable().optional(),
       metadata: exports2.storageMetadata.optional()
     });
+    exports2.STORAGE_PENDING_UPLOADS_PER_PRINCIPAL = 20;
+    exports2.STORAGE_PENDING_UPLOADS_PER_WORKSPACE = 100;
+    exports2.STORAGE_UPLOAD_BATCH_LIMIT = exports2.STORAGE_PENDING_UPLOADS_PER_PRINCIPAL;
+    exports2.STORAGE_IMPORT_CONCURRENCY_DEFAULT = 8;
+    exports2.STORAGE_IMPORT_CONCURRENCY_MAX = 16;
     exports2.storageChecksum = zod_12.z.string().regex(/^[A-Za-z0-9+/]{6}==$/);
     exports2.startUploadSchema = zod_12.z.strictObject({
       parentId: exports2.storageId.nullable().default(null),
@@ -26978,6 +26983,9 @@ var require_contracts = __commonJS({
        */
       crc32c: exports2.storageChecksum.optional()
     });
+    exports2.startUploadBatchSchema = zod_12.z.strictObject({
+      items: zod_12.z.array(exports2.startUploadSchema).min(1).max(exports2.STORAGE_UPLOAD_BATCH_LIMIT)
+    });
     exports2.uploadSessionSchema = zod_12.z.object({
       id: exports2.storageId,
       fileId: exports2.storageId,
@@ -26987,6 +26995,37 @@ var require_contracts = __commonJS({
       versionId: exports2.storageId.nullable(),
       maxBytes: zod_12.z.number().int()
     });
+    exports2.uploadListItemSchema = zod_12.z.object({
+      id: exports2.storageId,
+      fileId: exports2.storageId,
+      name: zod_12.z.string(),
+      state: zod_12.z.enum(["pending", "complete", "aborted"]),
+      expiresAt: zod_12.z.string(),
+      maxBytes: zod_12.z.number().int(),
+      expectedSize: zod_12.z.number().int().nullable(),
+      versionId: exports2.storageId.nullable()
+    });
+    exports2.uploadLimitsSchema = zod_12.z.object({
+      perPrincipal: zod_12.z.number().int(),
+      perWorkspace: zod_12.z.number().int()
+    });
+    exports2.uploadListSchema = zod_12.z.object({
+      items: zod_12.z.array(exports2.uploadListItemSchema),
+      limits: exports2.uploadLimitsSchema
+    });
+    exports2.reconcileUploadsSchema = zod_12.z.strictObject({
+      /** Abort sessions whose bytes never arrived. Terminal mismatches are already released. */
+      abortIncomplete: zod_12.z.boolean().default(false)
+    });
+    var reconcileEntrySchema = exports2.uploadListItemSchema.extend({
+      code: zod_12.z.string(),
+      message: zod_12.z.string()
+    });
+    exports2.reconcileUploadsResultSchema = zod_12.z.object({
+      completed: zod_12.z.array(reconcileEntrySchema),
+      aborted: zod_12.z.array(reconcileEntrySchema),
+      pending: zod_12.z.array(reconcileEntrySchema)
+    });
     exports2.storagePrincipalSchema = zod_12.z.strictObject({
       type: zod_12.z.enum(["user", "group", "organization", "service_account"]),
       id: zod_12.z.string().min(1).max(255),
@@ -27182,7 +27221,7 @@ var require_transfer = __commonJS({
       const fetcher = options.fetch ?? globalThis.fetch;
       const total = source instanceof Blob ? source.size : size;
       if (total !== void 0 && (!Number.isSafeInteger(total) || total < 0 || total > maxBytes))
-        throw new StorageTransferError("Upload exceeds its reserved size");
+        throw new StorageTransferError(`Upload source is ${total} bytes, above the ${maxBytes}-byte reservation`);
       let chunkBytes = options.chunkBytes ?? 8 * 1024 * 1024;
       if (chunkBytes < 262144 || chunkBytes > 32 * 1024 * 1024 || chunkBytes % 262144)
         throw new StorageTransferError("Invalid upload chunk size");
@@ -27226,7 +27265,7 @@ var require_transfer = __commonJS({
       }
       let offset = initial.offset;
       if (offset > maxBytes || total !== void 0 && offset > total)
-        throw new StorageTransferError("Upload offset exceeds the source size");
+        throw new StorageTransferError(`Upload session offset is ${offset} bytes, past the source${total === void 0 ? "" : ` of ${total} bytes`} and the ${maxBytes}-byte reservation`);
       options.onProgress?.(offset);
       const hash = new crc32c_js_1.Crc32c();
       const iterable = chunks(source, chunkBytes, offset, hash, options.signal);
@@ -27241,7 +27280,7 @@ var require_transfer = __commonJS({
           if (total === void 0 && end > maxBytes)
             throw new StorageTransferError(`Upload stream exceeds its ${maxBytes}-byte reservation; declare \`size\` when starting the upload to send a larger file`);
           if (end > maxBytes || total !== void 0 && (end > total || last && end !== total))
-            throw new StorageTransferError("Upload source does not match its reserved size");
+            throw new StorageTransferError(`Upload source does not match its reserved size: session offset ${offset} bytes, read ${end} bytes, reservation ${maxBytes} bytes${total === void 0 ? "" : `, declared ${total} bytes`}`);
           const length = total ?? (last ? end : "*");
           let acknowledged = offset;
           for (let attempt = 0; ; attempt++) {
@@ -27390,7 +27429,16 @@ var require_client = __commonJS({
       return {
         capabilities: () => replayable("GET", "/capabilities", zod_12.z.object({
           canProvision: zod_12.z.boolean(),
-          uploadMethods: zod_12.z.array(zod_12.z.string())
+          uploadMethods: zod_12.z.array(zod_12.z.string()),
+          pendingUploads: zod_12.z.object({
+            perPrincipal: zod_12.z.number().int(),
+            perWorkspace: zod_12.z.number().int()
+          }),
+          uploadBatchLimit: zod_12.z.number().int(),
+          importConcurrency: zod_12.z.object({
+            default: zod_12.z.number().int(),
+            max: zod_12.z.number().int()
+          })
         })),
         list: (options = {}) => replayable("GET", `/workspaces${query({ ...options })}`, (0, contracts_js_1.storagePage)(contracts_js_1.workspaceSchema)),
         shared: (options = {}) => replayable("GET", `/shared${query({ ...options })}`, (0, contracts_js_1.storagePage)(contracts_js_1.nodeSchema)),
@@ -27419,6 +27467,21 @@ var require_client = __commonJS({
             // Abort is idempotent: an aborted session stays aborted, and a completed
             // one deterministically rejects, so a replay cannot change the outcome.
             abort: (id2) => replayable("DELETE", session(id2), contracts_js_1.uploadSessionSchema),
+            startBatch: (items) => send({
+              method: "POST",
+              path: `${root}/uploads/batch`,
+              schema: zod_12.z.object({ items: zod_12.z.array(contracts_js_1.uploadSessionSchema) }),
+              body: contracts_js_1.startUploadBatchSchema.parse({ items }),
+              retryable: (error) => isRetryableConflict(error) || isUnacknowledged(error)
+            }),
+            list: () => replayable("GET", `${root}/uploads`, contracts_js_1.uploadListSchema),
+            reconcile: (input = {}) => send({
+              method: "POST",
+              path: `${root}/uploads/reconcile`,
+              schema: contracts_js_1.reconcileUploadsResultSchema,
+              body: contracts_js_1.reconcileUploadsSchema.parse(input),
+              retryable: isRetryableConflict
+            }),
             async resume(id2, source, options = {}) {
               const current = await upload.get(id2);
               if (current.state === "complete")
@@ -27647,12 +27710,18 @@ var require_limits = __commonJS({
       },
       workload: {
         memory_mb: { min: 128, max: 2048, default: 256, unit: "MiB per instance" },
-        timeout_seconds: { min: 1, max: 540, default: 60, unit: "seconds" },
+        timeout_seconds: { min: 1, max: 3600, default: 60, unit: "seconds" },
         min_instances: { min: 0, max: 10, default: 1, scope: "Cannot exceed max_instances; warm instances incur idle charges" },
         max_instances: { min: 2, max: 10, default: 3, scope: "Autoscaling ceiling; must allow at least two instances, and GCP may temporarily exceed it" },
         invoke_rate_per_minute: { min: 1, max: 600, default: 60, window_seconds: 60, scope: "Per function across all Atlas replicas in the environment; Redis-backed fixed window. Redis unavailability rejects invocations (503); key loss resets the window" },
         max_request_bytes: { max: 1024 * 1024, unit: "bytes", configurable: false },
-        max_response_bytes: { max: 4 * 1024 * 1024, unit: "bytes", configurable: false },
+        max_response_bytes: {
+          min: 1,
+          max: 256 * 1024 * 1024,
+          default: 4 * 1024 * 1024,
+          unit: "bytes",
+          configurable: true
+        },
         cpu: {
           configurable: true,
           default: "auto",
@@ -27696,6 +27765,7 @@ var require_limits = __commonJS({
       ]).default(workload.cpu.default),
       concurrency: integerLimit(workload.concurrency),
       timeout_seconds: integerLimit(workload.timeout_seconds),
+      max_response_bytes: integerLimit(workload.max_response_bytes),
       min_instances: integerLimit(workload.min_instances),
       max_instances: integerLimit(workload.max_instances),
       invoke_rate_per_minute: integerLimit(workload.invoke_rate_per_minute)
@@ -27741,17 +27811,531 @@ var require_limits = __commonJS({
       maxInstances: workload.max_instances.default,
       invokeRatePerMinute: workload.invoke_rate_per_minute.default,
       maxRequestBytes: workload.max_request_bytes.max,
-      maxResponseBytes: workload.max_response_bytes.max
+      maxResponseBytes: workload.max_response_bytes.default
     };
   }
 });
 
+// dist/sdk-range.js
+var require_sdk_range = __commonJS({
+  "dist/sdk-range.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.concreteOrStaleSdkSpec = concreteOrStaleSdkSpec;
+    exports2.sdkConstraintIsOlder = sdkConstraintIsOlder;
+    function parseSemver(raw) {
+      const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(raw.trim());
+      if (!match)
+        return null;
+      return [Number(match[1]), Number(match[2]), Number(match[3])];
+    }
+    function compare(left, right) {
+      for (let index = 0; index < 3; index += 1) {
+        const diff = left[index] - right[index];
+        if (diff !== 0)
+          return diff;
+      }
+      return 0;
+    }
+    function caretCeiling(version) {
+      const [major2, minor, patch] = version;
+      if (major2 > 0)
+        return [major2 + 1, 0, 0];
+      if (minor > 0)
+        return [major2, minor + 1, 0];
+      return [major2, minor, patch + 1];
+    }
+    function openBounds() {
+      return { min: [0, 0, 0], minInclusive: true, max: null, maxInclusive: false };
+    }
+    function raiseFloor(bounds, version, inclusive) {
+      const diff = compare(version, bounds.min);
+      if (diff > 0 || diff === 0 && bounds.minInclusive && !inclusive) {
+        bounds.min = version;
+        bounds.minInclusive = inclusive;
+      }
+    }
+    function lowerCeiling(bounds, version, inclusive) {
+      if (!bounds.max) {
+        bounds.max = version;
+        bounds.maxInclusive = inclusive;
+        return;
+      }
+      const diff = compare(version, bounds.max);
+      if (diff < 0 || diff === 0 && bounds.maxInclusive && !inclusive) {
+        bounds.max = version;
+        bounds.maxInclusive = inclusive;
+      }
+    }
+    function applyComparator(bounds, token) {
+      const match = /^(>=|<=|>|<|\^|~|=)?v?(\d+\.\d+\.\d+)$/.exec(token);
+      if (!match)
+        return false;
+      const version = parseSemver(match[2]);
+      if (!version)
+        return false;
+      const operator = match[1] ?? "=";
+      if (operator === "=") {
+        raiseFloor(bounds, version, true);
+        lowerCeiling(bounds, version, true);
+      } else if (operator === ">" || operator === ">=") {
+        raiseFloor(bounds, version, operator === ">=");
+      } else if (operator === "<" || operator === "<=") {
+        lowerCeiling(bounds, version, operator === "<=");
+      } else if (operator === "^") {
+        raiseFloor(bounds, version, true);
+        lowerCeiling(bounds, caretCeiling(version), false);
+      } else if (operator === "~") {
+        raiseFloor(bounds, version, true);
+        lowerCeiling(bounds, [version[0], version[1] + 1, 0], false);
+      } else {
+        return false;
+      }
+      return true;
+    }
+    function clauseBounds(clause) {
+      const hyphen = /^v?(\d+\.\d+\.\d+)\s+-\s+v?(\d+\.\d+\.\d+)$/.exec(clause.trim());
+      if (hyphen) {
+        const low = parseSemver(hyphen[1]);
+        const high = parseSemver(hyphen[2]);
+        if (!low || !high)
+          return null;
+        const bounds2 = openBounds();
+        raiseFloor(bounds2, low, true);
+        lowerCeiling(bounds2, high, true);
+        return bounds2;
+      }
+      const bounds = openBounds();
+      for (const token of clause.trim().split(/\s+/)) {
+        if (token.length === 0)
+          continue;
+        if (!applyComparator(bounds, token))
+          return null;
+      }
+      return bounds;
+    }
+    function clauseIsEntirelyOlder(clause, minimum) {
+      const bounds = clauseBounds(clause);
+      if (!bounds)
+        return null;
+      if (!bounds.max)
+        return false;
+      if (compare(bounds.min, bounds.max) > 0)
+        return true;
+      const diff = compare(bounds.max, minimum);
+      if (diff < 0)
+        return true;
+      return diff === 0 && !bounds.maxInclusive;
+    }
+    function concreteOrStaleSdkSpec(spec, minimum) {
+      if (!spec)
+        return null;
+      const trimmed = spec.trim();
+      if (trimmed === "" || trimmed === "*" || trimmed === "latest" || trimmed.startsWith("workspace:")) {
+        return null;
+      }
+      const exact = /^=?v?(\d+\.\d+\.\d+)$/.exec(trimmed);
+      if (exact)
+        return exact[1] ?? null;
+      const target = parseSemver(minimum);
+      if (!target)
+        return null;
+      const alternatives = trimmed.split("||").map((part) => part.trim()).filter((part) => part.length > 0);
+      if (alternatives.length === 0)
+        return null;
+      for (const alternative of alternatives) {
+        const older = clauseIsEntirelyOlder(alternative, target);
+        if (older !== true)
+          return null;
+      }
+      return trimmed;
+    }
+    function sdkConstraintIsOlder(declared, minimum) {
+      if (/^v?\d+\.\d+\.\d+$/.test(declared)) {
+        const installed = parseSemver(declared);
+        const required = parseSemver(minimum);
+        if (!installed || !required)
+          return false;
+        return compare(installed, required) < 0;
+      }
+      return concreteOrStaleSdkSpec(declared, minimum) === declared;
+    }
+  }
+});
+
+// dist/capabilities.js
+var require_capabilities = __commonJS({
+  "dist/capabilities.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.MANAGED_FUNCTION_CAPABILITIES = exports2.MANAGED_FUNCTION_SDK_PACKAGE = exports2.MANAGED_FUNCTION_CLI_PACKAGE = void 0;
+    exports2.versionIsOlder = versionIsOlder;
+    exports2.sdkVersionLowerBound = sdkVersionLowerBound;
+    exports2.sdkVersionFromPackageJson = sdkVersionFromPackageJson;
+    exports2.isPostgresEgress = isPostgresEgress;
+    exports2.formatValidationDetail = formatValidationDetail;
+    var sdk_range_1 = require_sdk_range();
+    exports2.MANAGED_FUNCTION_CLI_PACKAGE = "@sequenceholdings/studio-cli";
+    exports2.MANAGED_FUNCTION_SDK_PACKAGE = "@sequenceholdings/managed-functions";
+    exports2.MANAGED_FUNCTION_CAPABILITIES = {
+      tooling: {
+        cli: { package: exports2.MANAGED_FUNCTION_CLI_PACKAGE, min: "0.4.0" },
+        sdk: { package: exports2.MANAGED_FUNCTION_SDK_PACKAGE, min: "0.3.0" }
+      },
+      features: {
+        postgres_egress: {
+          field: "egress",
+          supported: true,
+          limit: "a credentials-free postgres:// or postgresql:// URL on port 5432 with sslmode=verify-full",
+          min_cli: "0.4.0",
+          min_sdk: "0.3.0"
+        },
+        http_headers: {
+          field: "invocation.headers",
+          max_bytes: 32 * 1024,
+          limit: "32768 bytes (16384 bytes is Node's default and returns HTTP 431)",
+          min_cli: "0.4.0",
+          min_sdk: "0.3.0"
+        },
+        invoke_timeout: {
+          field: "limits.timeout_seconds",
+          max_seconds: 3600,
+          legacy_sdk_max_seconds: 300,
+          limit: "1 to 3600 seconds; SDK clients older than the minimum stop at 300 seconds",
+          min_cli: "0.4.0",
+          min_sdk: "0.3.0"
+        }
+      }
+    };
+    function versionIsOlder(installed, required) {
+      const parse = (value) => value.replace(/^v/, "").split("-")[0].split(".").map((part) => {
+        const parsed = Number.parseInt(part, 10);
+        return Number.isFinite(parsed) ? parsed : 0;
+      });
+      const left = parse(installed);
+      const right = parse(required);
+      for (let index = 0; index < 3; index += 1) {
+        const diff = (left[index] ?? 0) - (right[index] ?? 0);
+        if (diff !== 0)
+          return diff < 0;
+      }
+      return false;
+    }
+    function sdkVersionLowerBound(spec) {
+      return (0, sdk_range_1.concreteOrStaleSdkSpec)(spec, exports2.MANAGED_FUNCTION_CAPABILITIES.features.invoke_timeout.min_sdk);
+    }
+    function sdkVersionFromPackageJson(raw) {
+      let parsed;
+      try {
+        parsed = JSON.parse(raw);
+      } catch {
+        return null;
+      }
+      if (!parsed || typeof parsed !== "object")
+        return null;
+      const dependencies = Reflect.get(parsed, "dependencies");
+      const devDependencies = Reflect.get(parsed, "devDependencies");
+      return sdkVersionLowerBound(dependencySpec(dependencies) ?? dependencySpec(devDependencies));
+    }
+    function dependencySpec(block) {
+      if (!block || typeof block !== "object")
+        return void 0;
+      const value = Reflect.get(block, exports2.MANAGED_FUNCTION_SDK_PACKAGE);
+      return typeof value === "string" ? value : void 0;
+    }
+    function isPostgresEgress(entry) {
+      return /^postgres(ql)?:/i.test(entry.trim());
+    }
+    function formatValidationDetail(issues) {
+      const shown = issues.slice(0, 8).map((issue) => {
+        const path = (issue.path ?? []).map((part) => String(part)).filter((part) => part.length > 0).join(".");
+        const message = issue.message?.trim() || "invalid";
+        return path ? `${path}: ${message}` : message;
+      });
+      if (shown.length === 0)
+        return "Validation error";
+      const extra = issues.length > shown.length ? ` (+${issues.length - shown.length} more)` : "";
+      return `Validation error: ${shown.join("; ")}${extra}`;
+    }
+  }
+});
+
+// dist/deployed-policy.js
+var require_deployed_policy = __commonJS({
+  "dist/deployed-policy.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.parseDeployedPolicy = parseDeployedPolicy;
+    function isLimitCatalog(value) {
+      if (!value || typeof value !== "object")
+        return false;
+      const workload = Reflect.get(value, "workload");
+      return !!workload && typeof workload === "object";
+    }
+    function isCapabilities(value) {
+      if (!value || typeof value !== "object")
+        return false;
+      const tooling = Reflect.get(value, "tooling");
+      const features = Reflect.get(value, "features");
+      if (!tooling || typeof tooling !== "object" || !features || typeof features !== "object")
+        return false;
+      const cli = Reflect.get(tooling, "cli");
+      const sdk = Reflect.get(tooling, "sdk");
+      return hasPackageMin(cli) && hasPackageMin(sdk);
+    }
+    function hasPackageMin(value) {
+      if (!value || typeof value !== "object")
+        return false;
+      return typeof Reflect.get(value, "package") === "string" && typeof Reflect.get(value, "min") === "string";
+    }
+    function parseDeployedPolicy(body) {
+      if (!body || typeof body !== "object")
+        return { limits: null, capabilities: null };
+      const limits = Reflect.get(body, "limits");
+      const capabilities = Reflect.get(body, "capabilities");
+      return {
+        limits: isLimitCatalog(limits) ? limits : null,
+        capabilities: isCapabilities(capabilities) ? normalizeCapabilities(capabilities) : null
+      };
+    }
+    function normalizeCapabilities(value) {
+      const features = value.features;
+      return {
+        tooling: value.tooling,
+        features: {
+          postgres_egress: normalizePostgres(features.postgres_egress),
+          http_headers: normalizeHeaders(features.http_headers),
+          invoke_timeout: normalizeTimeout(features.invoke_timeout)
+        }
+      };
+    }
+    function normalizePostgres(value) {
+      if (!value || typeof value.supported !== "boolean" || typeof value.limit !== "string")
+        return void 0;
+      if (typeof value.min_cli !== "string" || typeof value.min_sdk !== "string")
+        return void 0;
+      return {
+        field: typeof value.field === "string" ? value.field : "egress",
+        supported: value.supported,
+        limit: value.limit,
+        min_cli: value.min_cli,
+        min_sdk: value.min_sdk
+      };
+    }
+    function normalizeHeaders(value) {
+      if (!value || typeof value.max_bytes !== "number" || typeof value.limit !== "string")
+        return void 0;
+      if (typeof value.min_cli !== "string" || typeof value.min_sdk !== "string")
+        return void 0;
+      return {
+        field: typeof value.field === "string" ? value.field : "invocation.headers",
+        max_bytes: value.max_bytes,
+        limit: value.limit,
+        min_cli: value.min_cli,
+        min_sdk: value.min_sdk
+      };
+    }
+    function normalizeTimeout(value) {
+      if (!value || typeof value.limit !== "string")
+        return void 0;
+      if (typeof value.max_seconds !== "number" || typeof value.legacy_sdk_max_seconds !== "number")
+        return void 0;
+      if (typeof value.min_cli !== "string" || typeof value.min_sdk !== "string")
+        return void 0;
+      return {
+        field: typeof value.field === "string" ? value.field : "limits.timeout_seconds",
+        max_seconds: value.max_seconds,
+        legacy_sdk_max_seconds: value.legacy_sdk_max_seconds,
+        limit: value.limit,
+        min_cli: value.min_cli,
+        min_sdk: value.min_sdk
+      };
+    }
+  }
+});
+
+// dist/preflight.js
+var require_preflight = __commonJS({
+  "dist/preflight.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.preflightManagedFunction = preflightManagedFunction;
+    var capabilities_1 = require_capabilities();
+    var sdk_range_1 = require_sdk_range();
+    var WORKLOAD_FIELDS = [
+      "memory_mb",
+      "timeout_seconds",
+      "min_instances",
+      "max_instances",
+      "invoke_rate_per_minute",
+      "max_response_bytes",
+      "concurrency"
+    ];
+    function preflightManagedFunction({ manifest, limits, capabilities, cliVersion, sdkVersion }) {
+      const tooling = capabilities?.tooling ?? capabilities_1.MANAGED_FUNCTION_CAPABILITIES.tooling;
+      const issues = [];
+      checkWorkload({ manifest, limits, tooling, cliVersion, sdkVersion, issues });
+      checkPostgres({ manifest, capabilities, tooling, cliVersion, sdkVersion, issues });
+      checkHeaders({ manifest, capabilities, tooling, cliVersion, sdkVersion, issues });
+      checkSdkTimeout({ manifest, limits, capabilities, tooling, cliVersion, sdkVersion, issues });
+      return issues;
+    }
+    function issue({ field, problem, limit, tooling, requiredCli, requiredSdk, cliVersion, sdkVersion }) {
+      const installedSdk = sdkVersion ?? "not declared";
+      return {
+        field,
+        limit,
+        requiredCli,
+        requiredSdk,
+        message: `${field}: ${problem} Supported limit: ${limit}. Requires ${tooling.cli.package} >= ${requiredCli} (installed ${cliVersion}) and ${tooling.sdk.package} >= ${requiredSdk} (installed ${installedSdk}).`
+      };
+    }
+    function numericCap(entry) {
+      if (!entry || typeof entry !== "object")
+        return null;
+      const min = Reflect.get(entry, "min");
+      const max = Reflect.get(entry, "max");
+      const unit = Reflect.get(entry, "unit");
+      if (typeof min !== "number" || typeof max !== "number")
+        return null;
+      return { min, max, unit: typeof unit === "string" ? unit : void 0 };
+    }
+    function checkWorkload({ manifest, limits, tooling, cliVersion, sdkVersion, issues }) {
+      const workload = limits?.workload;
+      if (!workload)
+        return;
+      const declared = manifest.limits;
+      if (!declared)
+        return;
+      for (const name of WORKLOAD_FIELDS) {
+        const value = declared[name];
+        if (typeof value !== "number")
+          continue;
+        const cap = numericCap(workload[name]);
+        if (!cap)
+          continue;
+        if (Number.isInteger(value) && value >= cap.min && value <= cap.max)
+          continue;
+        const unit = cap.unit ? ` ${cap.unit}` : "";
+        issues.push(issue({
+          field: `limits.${name}`,
+          problem: `${value} is outside the range this deployment enforces`,
+          limit: `${cap.min} to ${cap.max}${unit}`,
+          tooling,
+          requiredCli: tooling.cli.min,
+          requiredSdk: tooling.sdk.min,
+          cliVersion,
+          sdkVersion
+        }));
+      }
+      const cpu = declared.cpu;
+      const cpuCap = numericCap(workload.cpu);
+      if (cpu === void 0 || cpu === "auto" || !cpuCap)
+        return;
+      if (typeof cpu === "number" && Number.isInteger(cpu) && cpu >= cpuCap.min && cpu <= cpuCap.max)
+        return;
+      issues.push(issue({
+        field: "limits.cpu",
+        problem: `${String(cpu)} is outside the range this deployment enforces`,
+        limit: `${cpuCap.min} to ${cpuCap.max}, or auto`,
+        tooling,
+        requiredCli: tooling.cli.min,
+        requiredSdk: tooling.sdk.min,
+        cliVersion,
+        sdkVersion
+      }));
+    }
+    function checkPostgres({ manifest, capabilities, tooling, cliVersion, sdkVersion, issues }) {
+      const feature = capabilities?.features.postgres_egress;
+      if (!feature)
+        return;
+      const entries = manifest.egress ?? [];
+      entries.forEach((entry, index) => {
+        if (!(0, capabilities_1.isPostgresEgress)(entry))
+          return;
+        const field = `egress[${index}]`;
+        if (!feature.supported) {
+          issues.push(issue({
+            field,
+            problem: "PostgreSQL egress is not supported by this deployment",
+            limit: "hostnames, http(s) URLs, and public IPv4 CIDRs",
+            tooling,
+            requiredCli: feature.min_cli,
+            requiredSdk: feature.min_sdk,
+            cliVersion,
+            sdkVersion
+          }));
+          return;
+        }
+        if ((0, capabilities_1.versionIsOlder)(cliVersion, feature.min_cli)) {
+          issues.push(issue({
+            field,
+            problem: "this CLI rejects PostgreSQL egress that this deployment supports",
+            limit: feature.limit,
+            tooling,
+            requiredCli: feature.min_cli,
+            requiredSdk: feature.min_sdk,
+            cliVersion,
+            sdkVersion
+          }));
+        }
+      });
+    }
+    function needsWideHeaders(manifest) {
+      const data = manifest.capabilities?.data;
+      const storage = manifest.capabilities?.storage;
+      const hasData = !!data && Object.keys(data).length > 0;
+      const hasStorage = !!storage && typeof storage === "object" && Object.keys(storage).length > 0;
+      return hasData || hasStorage;
+    }
+    function checkHeaders({ manifest, capabilities, tooling, cliVersion, sdkVersion, issues }) {
+      const feature = capabilities?.features.http_headers;
+      if (!feature || !needsWideHeaders(manifest))
+        return;
+      const supported = capabilities_1.MANAGED_FUNCTION_CAPABILITIES.features.http_headers.max_bytes;
+      if (feature.max_bytes >= supported)
+        return;
+      issues.push(issue({
+        field: feature.field,
+        problem: `invocation headers for capabilities.data or capabilities.storage exceed ${feature.max_bytes} bytes and will fail with HTTP 431`,
+        limit: feature.limit,
+        tooling,
+        requiredCli: feature.min_cli,
+        requiredSdk: feature.min_sdk,
+        cliVersion,
+        sdkVersion
+      }));
+    }
+    function checkSdkTimeout({ manifest, limits, capabilities, tooling, cliVersion, sdkVersion, issues }) {
+      const timeout = manifest.limits?.timeout_seconds;
+      if (typeof timeout !== "number" || !sdkVersion)
+        return;
+      const feature = capabilities?.features.invoke_timeout ?? capabilities_1.MANAGED_FUNCTION_CAPABILITIES.features.invoke_timeout;
+      if (!(0, sdk_range_1.sdkConstraintIsOlder)(sdkVersion, feature.min_sdk))
+        return;
+      if (timeout <= feature.legacy_sdk_max_seconds)
+        return;
+      const platformMax = numericCap(limits?.workload?.timeout_seconds)?.max ?? feature.max_seconds;
+      issues.push(issue({
+        field: feature.field,
+        problem: `${timeout} seconds exceeds the installed SDK's ${feature.legacy_sdk_max_seconds} second client cap, behind the platform limit of ${platformMax} seconds`,
+        limit: feature.limit,
+        tooling,
+        requiredCli: feature.min_cli,
+        requiredSdk: feature.min_sdk,
+        cliVersion,
+        sdkVersion
+      }));
+    }
+  }
+});
+
 // dist/config.js
 var require_config2 = __commonJS({
   "dist/config.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.cacheManifestSchema = exports2.CACHE_MAX_TTL_SECONDS = exports2.managedFunctionWorkloadLimitsSchema = exports2.MF_LIMITS_DEFAULTS = exports2.MF_LIMITS_CAPS = exports2.MANAGED_FUNCTION_LIMITS = exports2.shouldReportAtlasHttp = void 0;
+    exports2.cacheManifestSchema = exports2.CACHE_MAX_TTL_SECONDS = exports2.preflightManagedFunction = exports2.parseDeployedPolicy = exports2.versionIsOlder = exports2.sdkVersionLowerBound = exports2.sdkVersionFromPackageJson = exports2.isPostgresEgress = exports2.formatValidationDetail = exports2.MANAGED_FUNCTION_SDK_PACKAGE = exports2.MANAGED_FUNCTION_CLI_PACKAGE = exports2.MANAGED_FUNCTION_CAPABILITIES = exports2.managedFunctionWorkloadLimitsSchema = exports2.MF_LIMITS_DEFAULTS = exports2.MF_LIMITS_CAPS = exports2.MANAGED_FUNCTION_LIMITS = exports2.shouldReportAtlasHttp = void 0;
     exports2.readCacheConfiguration = readCacheConfiguration;
     var http_tracing_1 = require_http_tracing();
     Object.defineProperty(exports2, "shouldReportAtlasHttp", { enumerable: true, get: function() {
@@ -27772,6 +28356,39 @@ var require_config2 = __commonJS({
     Object.defineProperty(exports2, "managedFunctionWorkloadLimitsSchema", { enumerable: true, get: function() {
       return limits_2.managedFunctionWorkloadLimitsSchema;
     } });
+    var capabilities_1 = require_capabilities();
+    Object.defineProperty(exports2, "MANAGED_FUNCTION_CAPABILITIES", { enumerable: true, get: function() {
+      return capabilities_1.MANAGED_FUNCTION_CAPABILITIES;
+    } });
+    Object.defineProperty(exports2, "MANAGED_FUNCTION_CLI_PACKAGE", { enumerable: true, get: function() {
+      return capabilities_1.MANAGED_FUNCTION_CLI_PACKAGE;
+    } });
+    Object.defineProperty(exports2, "MANAGED_FUNCTION_SDK_PACKAGE", { enumerable: true, get: function() {
+      return capabilities_1.MANAGED_FUNCTION_SDK_PACKAGE;
+    } });
+    Object.defineProperty(exports2, "formatValidationDetail", { enumerable: true, get: function() {
+      return capabilities_1.formatValidationDetail;
+    } });
+    Object.defineProperty(exports2, "isPostgresEgress", { enumerable: true, get: function() {
+      return capabilities_1.isPostgresEgress;
+    } });
+    Object.defineProperty(exports2, "sdkVersionFromPackageJson", { enumerable: true, get: function() {
+      return capabilities_1.sdkVersionFromPackageJson;
+    } });
+    Object.defineProperty(exports2, "sdkVersionLowerBound", { enumerable: true, get: function() {
+      return capabilities_1.sdkVersionLowerBound;
+    } });
+    Object.defineProperty(exports2, "versionIsOlder", { enumerable: true, get: function() {
+      return capabilities_1.versionIsOlder;
+    } });
+    var deployed_policy_1 = require_deployed_policy();
+    Object.defineProperty(exports2, "parseDeployedPolicy", { enumerable: true, get: function() {
+      return deployed_policy_1.parseDeployedPolicy;
+    } });
+    var preflight_1 = require_preflight();
+    Object.defineProperty(exports2, "preflightManagedFunction", { enumerable: true, get: function() {
+      return preflight_1.preflightManagedFunction;
+    } });
     var limits = limits_1.MANAGED_FUNCTION_LIMITS.cache;
     exports2.CACHE_MAX_TTL_SECONDS = limits.default_ttl_seconds.max;
     exports2.cacheManifestSchema = zod_12.z.object({