@sequenceholdings/managed-functions 0.3.5 → 0.4.1

package/dist/preflight.js

@@ -5,6 +5,8 @@ const capabilities_1 = require("./capabilities");
 const sdk_range_1 = require("./sdk-range");
 const preflight_issue_1 = require("./preflight-issue");
 const preflight_processes_1 = require("./preflight-processes");
+const preflight_directory_1 = require("./preflight-directory");
+const directory_config_1 = require("./directory-config");
 const processes_contract_1 = require("./processes-contract");
 const WORKLOAD_FIELDS = [
     'memory_mb',
@@ -21,6 +23,7 @@ function preflightManagedFunction({ manifest, limits, capabilities, cliVersion,
     checkWorkload({ manifest, limits, tooling, cliVersion, sdkVersion, issues });
     checkPostgres({ manifest, capabilities, tooling, cliVersion, sdkVersion, issues });
     (0, preflight_processes_1.checkProcesses)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
+    (0, preflight_directory_1.checkDirectory)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
     checkHeaders({ manifest, capabilities, tooling, cliVersion, sdkVersion, issues });
     checkSdkTimeout({ manifest, limits, capabilities, tooling, cliVersion, sdkVersion, issues });
     return issues;
@@ -122,7 +125,8 @@ function needsWideHeaders(manifest) {
     const hasData = !!data && Object.keys(data).length > 0;
     const hasStorage = !!storage && typeof storage === 'object' && Object.keys(storage).length > 0;
     const hasProcesses = processes_contract_1.functionProcessReadScopesSchema.safeParse(manifest.capabilities?.processes).success;
-    return hasData || hasStorage || hasProcesses;
+    const hasDirectory = directory_config_1.directoryScopesSchema.safeParse(manifest.capabilities?.directory).success;
+    return hasData || hasStorage || hasProcesses || hasDirectory;
 }
 function checkHeaders({ manifest, capabilities, tooling, cliVersion, sdkVersion, issues, }) {
     const feature = capabilities?.features.http_headers;
@@ -133,7 +137,7 @@ function checkHeaders({ manifest, capabilities, tooling, cliVersion, sdkVersion,
         return;
     issues.push((0, preflight_issue_1.createPreflightIssue)({
         field: feature.field,
-        problem: `invocation headers for capabilities.data, capabilities.storage, or capabilities.processes exceed ${feature.max_bytes} bytes and will fail with HTTP 431`,
+        problem: `invocation headers for capabilities.data, capabilities.storage, capabilities.processes, or capabilities.directory exceed ${feature.max_bytes} bytes and will fail with HTTP 431`,
         limit: feature.limit,
         tooling,
         requiredCli: feature.min_cli,

package/dist/processes.d.ts

@@ -1,12 +1,7 @@
 import { type FunctionProcessRunQuery, type FunctionProcessRunSummary, type FunctionProcessRunsPage, type FunctionProcessRunsPageQuery } from './processes-contract';
+import { type FunctionInvocationClientOptions } from './invocation-client';
 export * from './processes-contract';
-export interface FunctionServiceProcessesOptions {
-    request: {
-        headers: Pick<Headers, 'get'> | Readonly<Record<string, string | readonly string[] | undefined>>;
-    };
-    baseUrl: string;
-    fetchImpl?: typeof globalThis.fetch;
-}
+export type FunctionServiceProcessesOptions = FunctionInvocationClientOptions;
 export interface FunctionServiceProcessesClient {
     getRun(query: FunctionProcessRunQuery): Promise<FunctionProcessRunSummary>;
     listRunsPage(query: FunctionProcessRunsPageQuery): Promise<FunctionProcessRunsPage>;

package/dist/processes.js

@@ -17,99 +17,34 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createFunctionServiceProcessesClient = createFunctionServiceProcessesClient;
 const zod_1 = require("zod");
 const processes_contract_1 = require("./processes-contract");
+const invocation_client_1 = require("./invocation-client");
 __exportStar(require("./processes-contract"), exports);
 const invalidContext = () => new processes_contract_1.FunctionProcessReadError(401, 'invalid_context', 'This invocation has no valid process-read credential');
-function readCredential({ request, }) {
-    const { headers } = request;
-    const matches = typeof headers.get === 'function'
-        ? [headers.get(processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER)]
-        : Object.entries(headers)
-            .filter(([name]) => name.toLowerCase() === processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER)
-            .map(([, value]) => value);
-    const token = matches[0];
-    if (matches.length !== 1 ||
-        typeof token !== 'string' ||
-        token.length > 16_384)
-        throw invalidContext();
-    const envelope = /^([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]{43})$/.exec(token);
-    if (!envelope?.[1])
-        throw invalidContext();
-    let value;
-    try {
-        value = JSON.parse(Buffer.from(envelope[1], 'base64url').toString('utf8'));
-    }
-    catch {
-        throw invalidContext();
-    }
-    const parsed = zod_1.z
-        .object({
-        audience: zod_1.z.literal('atlas-managed-function-process-read'),
-        sub: zod_1.z.string().startsWith('service-account|'),
-        functionId: zod_1.z.string().min(1),
-        invocationId: zod_1.z.string().min(1),
-        exp: zod_1.z.number().int(),
-    })
-        .safeParse(value);
-    if (!parsed.success)
-        throw invalidContext();
-    return { token, expiresAt: parsed.data.exp };
-}
-function origin(baseUrl) {
-    let url;
-    try {
-        url = new URL(baseUrl);
-    }
-    catch {
-        throw new processes_contract_1.FunctionProcessReadError(400, 'invalid_configuration', 'Configure a trusted Atlas origin');
-    }
-    const loopback = url.protocol === 'http:' &&
-        ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
-    if ((!loopback && url.protocol !== 'https:') ||
-        url.username ||
-        url.password ||
-        url.pathname !== '/' ||
-        url.search ||
-        url.hash) {
-        throw new processes_contract_1.FunctionProcessReadError(400, 'invalid_configuration', 'Configure an HTTPS Atlas origin without credentials, path, query or fragment');
-    }
-    return url.origin;
-}
 function createFunctionServiceProcessesClient({ request, baseUrl, fetchImpl = globalThis.fetch, }) {
-    const url = `${origin(baseUrl)}${processes_contract_1.FUNCTION_PROCESS_READ_PATH}`;
-    const { token, expiresAt } = readCredential({ request });
-    async function read({ body, schema, }) {
-        if (expiresAt <= Date.now() / 1000)
-            throw new processes_contract_1.FunctionProcessReadError(401, 'expired_context', 'The process-read credential expired; start a new invocation');
-        const parsed = processes_contract_1.functionProcessReadRequestSchema.parse(body);
-        const response = await fetchImpl(url, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                [processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER]: token,
-            },
-            body: JSON.stringify(parsed),
-            redirect: 'error',
-            signal: AbortSignal.timeout(30_000),
-        });
-        const result = await response.json().catch(() => null);
-        if (!response.ok) {
-            const error = zod_1.z
-                .object({
-                code: zod_1.z.string().max(128).optional(),
-                detail: zod_1.z.string().max(2000).optional(),
-            })
-                .safeParse(result);
-            throw new processes_contract_1.FunctionProcessReadError(response.status, error.success
-                ? (error.data.code ?? 'process_read_failed')
-                : 'process_read_failed', error.success
-                ? (error.data.detail ?? 'Process read failed')
-                : 'Process read failed');
-        }
-        const validated = schema.safeParse(result);
-        if (!validated.success)
-            throw new processes_contract_1.FunctionProcessReadError(502, 'malformed_response', 'Atlas returned an invalid process-read response');
-        return validated.data;
-    }
+    const credential = (0, invocation_client_1.readInvocationCredential)({
+        request,
+        header: processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER,
+        maxBytes: 16_384,
+        invalidContext,
+        claimsSchema: zod_1.z.object({
+            audience: zod_1.z.literal('atlas-managed-function-process-read'),
+            sub: zod_1.z.string().startsWith('service-account|'),
+            functionId: zod_1.z.string().min(1),
+            invocationId: zod_1.z.string().min(1),
+            exp: zod_1.z.number().int(),
+        }),
+    });
+    const transport = (0, invocation_client_1.createInvocationReadTransport)({
+        baseUrl,
+        fetchImpl,
+        path: processes_contract_1.FUNCTION_PROCESS_READ_PATH,
+        header: processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER,
+        credential,
+        timeoutMs: 30_000,
+        error: (status, code, message) => new processes_contract_1.FunctionProcessReadError(status, code, message),
+        failure: { code: 'process_read_failed', message: 'Process read failed' },
+    });
+    const read = ({ body, schema }) => transport({ body: processes_contract_1.functionProcessReadRequestSchema.parse(body), schema });
     return {
         async getRun(query) {
             const run = await read({

package/dist/runtime.cjs

@@ -16908,6 +16908,177 @@ var require_zod = __commonJS({
   }
 });
 
+// dist/directory-config.js
+var require_directory_config = __commonJS({
+  "dist/directory-config.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.directoryMembersResponse = exports2.directoryMembersInput = exports2.directoryScopesSchema = exports2.directoryGroupIdSchema = exports2.DIRECTORY_TOKEN_HEADER = void 0;
+    exports2.readDirectoryGroups = readDirectoryGroups;
+    var zod_12 = require_zod();
+    exports2.DIRECTORY_TOKEN_HEADER = "x-sequence-directory-token";
+    exports2.directoryGroupIdSchema = zod_12.z.string().regex(/^(?:[a-f0-9]{24}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})$/i);
+    exports2.directoryScopesSchema = zod_12.z.object({
+      groups: zod_12.z.array(exports2.directoryGroupIdSchema).min(1).max(16)
+    }).strict();
+    var identity = zod_12.z.string().min(1).max(256).regex(/^[^\x00-\x1f\x7f]+$/);
+    exports2.directoryMembersInput = zod_12.z.union([
+      zod_12.z.object({ groupId: exports2.directoryGroupIdSchema, userIds: zod_12.z.array(identity).min(1).max(50) }).strict(),
+      zod_12.z.object({ groupId: exports2.directoryGroupIdSchema, subs: zod_12.z.array(identity).min(1).max(50) }).strict()
+    ]);
+    exports2.directoryMembersResponse = zod_12.z.object({ members: zod_12.z.array(zod_12.z.object({
+      id: zod_12.z.string(),
+      sub: identity,
+      name: zod_12.z.string(),
+      email: zod_12.z.string(),
+      deactivated: zod_12.z.literal(false)
+    }).strict()).max(50) }).strict();
+    function readDirectoryGroups(manifest) {
+      const parsed = zod_12.z.object({ capabilities: zod_12.z.object({ directory: exports2.directoryScopesSchema.optional() }).optional() }).safeParse(manifest);
+      return parsed.success ? parsed.data.capabilities?.directory?.groups ?? [] : [];
+    }
+  }
+});
+
+// dist/invocation-client.js
+var require_invocation_client = __commonJS({
+  "dist/invocation-client.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.readInvocationCredential = readInvocationCredential;
+    exports2.createInvocationReadTransport = createInvocationReadTransport;
+    var zod_12 = require_zod();
+    function readInvocationCredential({ request, header, maxBytes, claimsSchema, invalidContext }) {
+      const { headers } = request;
+      const matches = typeof headers.get === "function" ? [headers.get(header)] : Object.entries(headers).filter(([name]) => name.toLowerCase() === header).map(([, value2]) => value2);
+      const token = matches[0];
+      if (matches.length !== 1 || typeof token !== "string" || token.length > maxBytes)
+        throw invalidContext();
+      const envelope = /^([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]{43})$/.exec(token);
+      if (!envelope?.[1])
+        throw invalidContext();
+      let value;
+      try {
+        value = JSON.parse(Buffer.from(envelope[1], "base64url").toString("utf8"));
+      } catch {
+        throw invalidContext();
+      }
+      const parsed = claimsSchema.safeParse(value);
+      if (!parsed.success)
+        throw invalidContext();
+      return { token, expiresAt: parsed.data.exp };
+    }
+    function trustedOrigin({ baseUrl, error }) {
+      let url;
+      try {
+        url = new URL(baseUrl);
+      } catch {
+        throw error(400, "invalid_configuration", "Configure a trusted Atlas origin");
+      }
+      const loopback = url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+      if (!loopback && url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+        throw error(400, "invalid_configuration", "Configure an HTTPS Atlas origin without credentials, path, query or fragment");
+      }
+      return url.origin;
+    }
+    var errorResponseSchema = zod_12.z.object({
+      code: zod_12.z.string().max(128).optional(),
+      detail: zod_12.z.string().max(2e3).optional()
+    });
+    function createInvocationReadTransport({ baseUrl, fetchImpl = globalThis.fetch, path, header, credential, timeoutMs, error, failure }) {
+      const url = `${trustedOrigin({ baseUrl, error })}${path}`;
+      return async function read({ body, schema }) {
+        if (credential.expiresAt <= Date.now() / 1e3) {
+          throw error(401, "expired_context", "The invocation credential expired; start a new invocation");
+        }
+        const response = await fetchImpl(url, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            [header]: credential.token
+          },
+          body: JSON.stringify(body),
+          redirect: "error",
+          signal: AbortSignal.timeout(timeoutMs)
+        });
+        const result = await response.json().catch(() => null);
+        if (!response.ok) {
+          const parsed = errorResponseSchema.safeParse(result);
+          throw error(response.status, parsed.success ? parsed.data.code ?? failure.code : failure.code, parsed.success ? parsed.data.detail ?? failure.message : failure.message);
+        }
+        const validated = schema.safeParse(result);
+        if (!validated.success)
+          throw error(502, "malformed_response", "Atlas returned an invalid capability response");
+        return validated.data;
+      };
+    }
+  }
+});
+
+// dist/directory.js
+var require_directory = __commonJS({
+  "dist/directory.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.FunctionDirectoryReadError = void 0;
+    exports2.createFunctionDirectoryClient = createFunctionDirectoryClient;
+    var zod_12 = require_zod();
+    var directory_config_1 = require_directory_config();
+    var invocation_client_1 = require_invocation_client();
+    var FunctionDirectoryReadError = class extends Error {
+      status;
+      code;
+      constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = "FunctionDirectoryReadError";
+      }
+    };
+    exports2.FunctionDirectoryReadError = FunctionDirectoryReadError;
+    function createFunctionDirectoryClient({ request, baseUrl, fetchImpl }) {
+      const credential = (0, invocation_client_1.readInvocationCredential)({
+        request,
+        header: directory_config_1.DIRECTORY_TOKEN_HEADER,
+        maxBytes: 8192,
+        invalidContext: () => new FunctionDirectoryReadError(401, "invalid_context", "This invocation has no valid directory-read credential"),
+        claimsSchema: zod_12.z.object({
+          audience: zod_12.z.literal("atlas-function-group-directory-v1"),
+          sub: zod_12.z.string().min(1).max(256).refine((sub) => sub.includes("|") && !sub.startsWith("service-account|") && !sub.endsWith("@clients")),
+          functionId: zod_12.z.string().min(1),
+          invocationId: zod_12.z.string().min(1),
+          exp: zod_12.z.number().int()
+        })
+      });
+      const read = (0, invocation_client_1.createInvocationReadTransport)({
+        baseUrl,
+        fetchImpl,
+        path: "/api/managed-functions/directory/members",
+        header: directory_config_1.DIRECTORY_TOKEN_HEADER,
+        credential,
+        timeoutMs: 1e4,
+        error: (status, code, message) => new FunctionDirectoryReadError(status, code, message),
+        failure: {
+          code: "directory_read_failed",
+          message: "Directory read failed"
+        }
+      });
+      return {
+        async resolveMembers(input) {
+          const body = directory_config_1.directoryMembersInput.parse(input);
+          const result = await read({ body, schema: directory_config_1.directoryMembersResponse });
+          const selectors = new Set("userIds" in body ? body.userIds : body.subs);
+          const returned = result.members.map((member) => "userIds" in body ? member.id : member.sub);
+          if (new Set(returned).size !== returned.length || returned.some((value) => !selectors.has(value))) {
+            throw new FunctionDirectoryReadError(502, "malformed_response", "Atlas returned duplicate or unrequested directory members");
+          }
+          return result;
+        }
+      };
+    }
+  }
+});
+
 // dist/processes-contract.js
 var require_processes_contract = __commonJS({
   "dist/processes-contract.js"(exports2) {
@@ -17015,77 +17186,34 @@ var require_processes = __commonJS({
     exports2.createFunctionServiceProcessesClient = createFunctionServiceProcessesClient;
     var zod_12 = require_zod();
     var processes_contract_1 = require_processes_contract();
+    var invocation_client_1 = require_invocation_client();
     __exportStar(require_processes_contract(), exports2);
     var invalidContext = () => new processes_contract_1.FunctionProcessReadError(401, "invalid_context", "This invocation has no valid process-read credential");
-    function readCredential({ request }) {
-      const { headers } = request;
-      const matches = typeof headers.get === "function" ? [headers.get(processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER)] : Object.entries(headers).filter(([name]) => name.toLowerCase() === processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER).map(([, value2]) => value2);
-      const token = matches[0];
-      if (matches.length !== 1 || typeof token !== "string" || token.length > 16384)
-        throw invalidContext();
-      const envelope = /^([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]{43})$/.exec(token);
-      if (!envelope?.[1])
-        throw invalidContext();
-      let value;
-      try {
-        value = JSON.parse(Buffer.from(envelope[1], "base64url").toString("utf8"));
-      } catch {
-        throw invalidContext();
-      }
-      const parsed = zod_12.z.object({
-        audience: zod_12.z.literal("atlas-managed-function-process-read"),
-        sub: zod_12.z.string().startsWith("service-account|"),
-        functionId: zod_12.z.string().min(1),
-        invocationId: zod_12.z.string().min(1),
-        exp: zod_12.z.number().int()
-      }).safeParse(value);
-      if (!parsed.success)
-        throw invalidContext();
-      return { token, expiresAt: parsed.data.exp };
-    }
-    function origin(baseUrl) {
-      let url;
-      try {
-        url = new URL(baseUrl);
-      } catch {
-        throw new processes_contract_1.FunctionProcessReadError(400, "invalid_configuration", "Configure a trusted Atlas origin");
-      }
-      const loopback = url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
-      if (!loopback && url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
-        throw new processes_contract_1.FunctionProcessReadError(400, "invalid_configuration", "Configure an HTTPS Atlas origin without credentials, path, query or fragment");
-      }
-      return url.origin;
-    }
     function createFunctionServiceProcessesClient({ request, baseUrl, fetchImpl = globalThis.fetch }) {
-      const url = `${origin(baseUrl)}${processes_contract_1.FUNCTION_PROCESS_READ_PATH}`;
-      const { token, expiresAt } = readCredential({ request });
-      async function read({ body, schema }) {
-        if (expiresAt <= Date.now() / 1e3)
-          throw new processes_contract_1.FunctionProcessReadError(401, "expired_context", "The process-read credential expired; start a new invocation");
-        const parsed = processes_contract_1.functionProcessReadRequestSchema.parse(body);
-        const response = await fetchImpl(url, {
-          method: "POST",
-          headers: {
-            "content-type": "application/json",
-            [processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER]: token
-          },
-          body: JSON.stringify(parsed),
-          redirect: "error",
-          signal: AbortSignal.timeout(3e4)
-        });
-        const result = await response.json().catch(() => null);
-        if (!response.ok) {
-          const error = zod_12.z.object({
-            code: zod_12.z.string().max(128).optional(),
-            detail: zod_12.z.string().max(2e3).optional()
-          }).safeParse(result);
-          throw new processes_contract_1.FunctionProcessReadError(response.status, error.success ? error.data.code ?? "process_read_failed" : "process_read_failed", error.success ? error.data.detail ?? "Process read failed" : "Process read failed");
-        }
-        const validated = schema.safeParse(result);
-        if (!validated.success)
-          throw new processes_contract_1.FunctionProcessReadError(502, "malformed_response", "Atlas returned an invalid process-read response");
-        return validated.data;
-      }
+      const credential = (0, invocation_client_1.readInvocationCredential)({
+        request,
+        header: processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER,
+        maxBytes: 16384,
+        invalidContext,
+        claimsSchema: zod_12.z.object({
+          audience: zod_12.z.literal("atlas-managed-function-process-read"),
+          sub: zod_12.z.string().startsWith("service-account|"),
+          functionId: zod_12.z.string().min(1),
+          invocationId: zod_12.z.string().min(1),
+          exp: zod_12.z.number().int()
+        })
+      });
+      const transport = (0, invocation_client_1.createInvocationReadTransport)({
+        baseUrl,
+        fetchImpl,
+        path: processes_contract_1.FUNCTION_PROCESS_READ_PATH,
+        header: processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER,
+        credential,
+        timeoutMs: 3e4,
+        error: (status, code, message) => new processes_contract_1.FunctionProcessReadError(status, code, message),
+        failure: { code: "process_read_failed", message: "Process read failed" }
+      });
+      const read = ({ body, schema }) => transport({ body: processes_contract_1.functionProcessReadRequestSchema.parse(body), schema });
       return {
         async getRun(query) {
           const run = await read({
@@ -28185,6 +28313,13 @@ var require_capabilities = __commonJS({
         sdk: { package: exports2.MANAGED_FUNCTION_SDK_PACKAGE, min: "0.3.0" }
       },
       features: {
+        directory_members: {
+          field: "capabilities.directory.groups",
+          supported: true,
+          limit: "1 to 16 concrete groups; resolve 1 to 50 selected active members per call",
+          min_cli: "0.5.2",
+          min_sdk: "0.4.1"
+        },
         processes_read: {
           field: "capabilities.processes.read",
           supported: true,
@@ -28316,10 +28451,24 @@ var require_deployed_policy = __commonJS({
           postgres_egress: normalizePostgres(features.postgres_egress),
           http_headers: normalizeHeaders(features.http_headers),
           invoke_timeout: normalizeTimeout(features.invoke_timeout),
-          processes_read: normalizeProcesses(features.processes_read)
+          processes_read: normalizeProcesses(features.processes_read),
+          directory_members: normalizeDirectory(features.directory_members)
         }
       };
     }
+    function normalizeDirectory(value) {
+      if (!value || typeof value.supported !== "boolean" || typeof value.limit !== "string")
+        return void 0;
+      if (typeof value.min_cli !== "string" || typeof value.min_sdk !== "string")
+        return void 0;
+      return {
+        field: typeof value.field === "string" ? value.field : "capabilities.directory.groups",
+        supported: value.supported,
+        limit: value.limit,
+        min_cli: value.min_cli,
+        min_sdk: value.min_sdk
+      };
+    }
     function normalizeProcesses(value) {
       if (!value || typeof value.supported !== "boolean" || typeof value.limit !== "string")
         return void 0;
@@ -28449,6 +28598,58 @@ var require_preflight_processes = __commonJS({
   }
 });
 
+// dist/preflight-directory.js
+var require_preflight_directory = __commonJS({
+  "dist/preflight-directory.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.checkDirectory = checkDirectory;
+    var capabilities_1 = require_capabilities();
+    var preflight_issue_1 = require_preflight_issue();
+    var directory_config_1 = require_directory_config();
+    var sdk_range_1 = require_sdk_range();
+    function checkDirectory({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues }) {
+      const directory = manifest.capabilities?.directory;
+      if (directory === void 0)
+        return;
+      const deployed = capabilities?.features.directory_members;
+      const feature = deployed ?? capabilities_1.MANAGED_FUNCTION_CAPABILITIES.features.directory_members;
+      const details = {
+        limit: feature.limit,
+        tooling,
+        requiredCli: feature.min_cli,
+        requiredSdk: feature.min_sdk,
+        cliVersion,
+        sdkVersion
+      };
+      const parsed = directory_config_1.directoryScopesSchema.safeParse(directory);
+      if (!parsed.success) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({
+          ...details,
+          field: "capabilities.directory",
+          problem: (0, capabilities_1.formatValidationDetail)(parsed.error.issues)
+        }));
+        return;
+      }
+      if (checkDeployment && deployed?.supported !== true) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({
+          ...details,
+          field: feature.field,
+          problem: "group-member directory reads are not supported by this deployment"
+        }));
+        return;
+      }
+      if ((0, capabilities_1.versionIsOlder)(cliVersion, feature.min_cli) || sdkVersion && (0, sdk_range_1.sdkConstraintIsOlder)(sdkVersion, feature.min_sdk)) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({
+          ...details,
+          field: feature.field,
+          problem: "the installed tooling does not support managed function group-member directory reads"
+        }));
+      }
+    }
+  }
+});
+
 // dist/preflight.js
 var require_preflight = __commonJS({
   "dist/preflight.js"(exports2) {
@@ -28459,6 +28660,8 @@ var require_preflight = __commonJS({
     var sdk_range_1 = require_sdk_range();
     var preflight_issue_1 = require_preflight_issue();
     var preflight_processes_1 = require_preflight_processes();
+    var preflight_directory_1 = require_preflight_directory();
+    var directory_config_1 = require_directory_config();
     var processes_contract_1 = require_processes_contract();
     var WORKLOAD_FIELDS = [
       "memory_mb",
@@ -28475,6 +28678,7 @@ var require_preflight = __commonJS({
       checkWorkload({ manifest, limits, tooling, cliVersion, sdkVersion, issues });
       checkPostgres({ manifest, capabilities, tooling, cliVersion, sdkVersion, issues });
       (0, preflight_processes_1.checkProcesses)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
+      (0, preflight_directory_1.checkDirectory)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
       checkHeaders({ manifest, capabilities, tooling, cliVersion, sdkVersion, issues });
       checkSdkTimeout({ manifest, limits, capabilities, tooling, cliVersion, sdkVersion, issues });
       return issues;
@@ -28576,7 +28780,8 @@ var require_preflight = __commonJS({
       const hasData = !!data && Object.keys(data).length > 0;
       const hasStorage = !!storage && typeof storage === "object" && Object.keys(storage).length > 0;
       const hasProcesses = processes_contract_1.functionProcessReadScopesSchema.safeParse(manifest.capabilities?.processes).success;
-      return hasData || hasStorage || hasProcesses;
+      const hasDirectory = directory_config_1.directoryScopesSchema.safeParse(manifest.capabilities?.directory).success;
+      return hasData || hasStorage || hasProcesses || hasDirectory;
     }
     function checkHeaders({ manifest, capabilities, tooling, cliVersion, sdkVersion, issues }) {
       const feature = capabilities?.features.http_headers;
@@ -28587,7 +28792,7 @@ var require_preflight = __commonJS({
         return;
       issues.push((0, preflight_issue_1.createPreflightIssue)({
         field: feature.field,
-        problem: `invocation headers for capabilities.data, capabilities.storage, or capabilities.processes exceed ${feature.max_bytes} bytes and will fail with HTTP 431`,
+        problem: `invocation headers for capabilities.data, capabilities.storage, capabilities.processes, or capabilities.directory exceed ${feature.max_bytes} bytes and will fail with HTTP 431`,
         limit: feature.limit,
         tooling,
         requiredCli: feature.min_cli,
@@ -28625,8 +28830,27 @@ var require_config2 = __commonJS({
   "dist/config.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.cacheManifestSchema = exports2.CACHE_MAX_TTL_SECONDS = exports2.preflightManagedFunction = exports2.parseDeployedPolicy = exports2.versionIsOlder = exports2.sdkVersionLowerBound = exports2.sdkVersionFromPackageJson = exports2.isPostgresEgress = exports2.formatValidationDetail = exports2.MANAGED_FUNCTION_SDK_PACKAGE = exports2.MANAGED_FUNCTION_CLI_PACKAGE = exports2.MANAGED_FUNCTION_CAPABILITIES = exports2.managedFunctionWorkloadLimitsSchema = exports2.MF_LIMITS_DEFAULTS = exports2.MF_LIMITS_CAPS = exports2.MANAGED_FUNCTION_LIMITS = exports2.shouldReportAtlasHttp = exports2.functionProcessRunSummarySchema = exports2.functionProcessReadRequestSchema = exports2.readFunctionProcessScopes = exports2.functionProcessReadScopesSchema = exports2.FUNCTION_PROCESS_READ_PATH = exports2.FUNCTION_PROCESS_TOKEN_HEADER = void 0;
+    exports2.cacheManifestSchema = exports2.CACHE_MAX_TTL_SECONDS = exports2.preflightManagedFunction = exports2.parseDeployedPolicy = exports2.versionIsOlder = exports2.sdkVersionLowerBound = exports2.sdkVersionFromPackageJson = exports2.isPostgresEgress = exports2.formatValidationDetail = exports2.MANAGED_FUNCTION_SDK_PACKAGE = exports2.MANAGED_FUNCTION_CLI_PACKAGE = exports2.MANAGED_FUNCTION_CAPABILITIES = exports2.managedFunctionWorkloadLimitsSchema = exports2.MF_LIMITS_DEFAULTS = exports2.MF_LIMITS_CAPS = exports2.MANAGED_FUNCTION_LIMITS = exports2.shouldReportAtlasHttp = exports2.functionProcessRunSummarySchema = exports2.functionProcessReadRequestSchema = exports2.readFunctionProcessScopes = exports2.functionProcessReadScopesSchema = exports2.FUNCTION_PROCESS_READ_PATH = exports2.FUNCTION_PROCESS_TOKEN_HEADER = exports2.readDirectoryGroups = exports2.directoryMembersResponse = exports2.directoryMembersInput = exports2.directoryScopesSchema = exports2.directoryGroupIdSchema = exports2.DIRECTORY_TOKEN_HEADER = void 0;
     exports2.readCacheConfiguration = readCacheConfiguration;
+    var directory_config_1 = require_directory_config();
+    Object.defineProperty(exports2, "DIRECTORY_TOKEN_HEADER", { enumerable: true, get: function() {
+      return directory_config_1.DIRECTORY_TOKEN_HEADER;
+    } });
+    Object.defineProperty(exports2, "directoryGroupIdSchema", { enumerable: true, get: function() {
+      return directory_config_1.directoryGroupIdSchema;
+    } });
+    Object.defineProperty(exports2, "directoryScopesSchema", { enumerable: true, get: function() {
+      return directory_config_1.directoryScopesSchema;
+    } });
+    Object.defineProperty(exports2, "directoryMembersInput", { enumerable: true, get: function() {
+      return directory_config_1.directoryMembersInput;
+    } });
+    Object.defineProperty(exports2, "directoryMembersResponse", { enumerable: true, get: function() {
+      return directory_config_1.directoryMembersResponse;
+    } });
+    Object.defineProperty(exports2, "readDirectoryGroups", { enumerable: true, get: function() {
+      return directory_config_1.readDirectoryGroups;
+    } });
     var processes_contract_1 = require_processes_contract();
     Object.defineProperty(exports2, "FUNCTION_PROCESS_TOKEN_HEADER", { enumerable: true, get: function() {
       return processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER;
@@ -56959,8 +57183,15 @@ var require_valkey = __commonJS({
 
 // dist/index.js
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.readCacheConfiguration = exports.cacheManifestSchema = exports.createCacheManager = exports.CacheError = exports.createFunctionStorageClient = exports.runWithFunctionTracing = exports.installFunctionTracing = exports.FunctionProcessReadError = exports.createFunctionServiceProcessesClient = void 0;
+exports.readCacheConfiguration = exports.cacheManifestSchema = exports.createCacheManager = exports.CacheError = exports.createFunctionStorageClient = exports.runWithFunctionTracing = exports.installFunctionTracing = exports.FunctionProcessReadError = exports.createFunctionServiceProcessesClient = exports.FunctionDirectoryReadError = exports.createFunctionDirectoryClient = void 0;
 exports.createManagedFunctionContext = createManagedFunctionContext;
+var directory_1 = require_directory();
+Object.defineProperty(exports, "createFunctionDirectoryClient", { enumerable: true, get: function() {
+  return directory_1.createFunctionDirectoryClient;
+} });
+Object.defineProperty(exports, "FunctionDirectoryReadError", { enumerable: true, get: function() {
+  return directory_1.FunctionDirectoryReadError;
+} });
 var processes_1 = require_processes();
 Object.defineProperty(exports, "createFunctionServiceProcessesClient", { enumerable: true, get: function() {
   return processes_1.createFunctionServiceProcessesClient;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sequenceholdings/managed-functions",
-  "version": "0.3.5",
+  "version": "0.4.1",
   "description": "Managed Function context and opt-in cache runtime",
   "license": "UNLICENSED",
   "main": "./dist/index.js",
@@ -48,7 +48,7 @@
     "vitest": "^4.1.11",
     "esbuild": "^0.25.0",
     "tsup": "^8.3.0",
-    "@sequenceholdings/orm": "2.5.0"
+    "@sequenceholdings/orm": "2.6.1"
   },
   "engines": {
     "node": ">=20"