@sequenceholdings/managed-functions 0.4.0 → 0.4.2

package/dist/orm.js

@@ -20,11 +20,13 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/orm.ts
 var orm_exports = {};
 __export(orm_exports, {
+  FUNCTION_CALLER_DATA_TOKEN_HEADER: () => FUNCTION_CALLER_DATA_TOKEN_HEADER,
   FunctionOrmError: () => FunctionOrmError,
   ORM_JSON_SCALARS_HEADER: () => ORM_JSON_SCALARS_HEADER,
   ORM_LOSSLESS_JSON_SCALARS: () => ORM_LOSSLESS_JSON_SCALARS,
   OrmClientError: () => OrmClientError,
   OrmOperationError: () => OrmOperationError,
+  createFunctionCallerOrmExecutor: () => createFunctionCallerOrmExecutor,
   createFunctionOrmExecutor: () => createFunctionOrmExecutor,
   createFunctionServiceOrmExecutor: () => createFunctionServiceOrmExecutor
 });
@@ -82,12 +84,48 @@ function readOperationResponse({
   }
   return payload.data;
 }
+function readOperationResponseWithReceipt({
+  ok,
+  status,
+  body,
+  expectedSourceGeneration
+}) {
+  const data = readOperationResponse({ ok, status, body });
+  const extensions = isRecord(body) && isRecord(body.extensions) ? body.extensions : null;
+  const sourceGeneration = extensions?.sourceGeneration;
+  if (typeof sourceGeneration !== "string" || !/^[a-f0-9]{64}$/.test(sourceGeneration) || expectedSourceGeneration !== void 0 && expectedSourceGeneration !== sourceGeneration) {
+    throw new OrmOperationError("Source generation unavailable", status, "OBJECT_UNAVAILABLE");
+  }
+  return { data, sourceGeneration };
+}
 var BUILTIN_SQL_READ_HASH = "sha256:a50c477c952a5e0fe68ed158a4530e4aab573c09bcbb1a8ac454dc88a39a6258";
 function validateIdempotencyKey(key) {
   if (key !== void 0 && !/^[A-Za-z0-9._:-]{1,128}$/.test(key)) {
     throw new OrmClientError("idempotencyKey must be 1\u2013128 letters, digits, dots, underscores, colons or hyphens");
   }
 }
+function validateExpectedSourceGeneration(value) {
+  if (value !== void 0 && (typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value))) {
+    throw new OrmClientError("expectedSourceGeneration must be a lowercase 64-character hexadecimal receipt");
+  }
+}
+function createReadReceiptOperationResolver({ operations }) {
+  const hashesByName = /* @__PURE__ */ new Map();
+  const readHashes = /* @__PURE__ */ new Set([BUILTIN_SQL_READ_HASH]);
+  const mutationHashes = /* @__PURE__ */ new Set();
+  for (const [name, entry] of operations) {
+    hashesByName.set(name, entry.hash);
+    if (entry.kind === "query" && /^sha256:[a-f0-9]{64}$/.test(entry.hash)) readHashes.add(entry.hash);
+    if (entry.kind === "mutation") mutationHashes.add(entry.hash);
+  }
+  return ({ selector, hashOnly = false }) => {
+    const hash = selector.startsWith("sha256:") ? selector : hashOnly ? void 0 : hashesByName.get(selector);
+    if (!hash || !readHashes.has(hash) || mutationHashes.has(hash)) {
+      throw new OrmClientError("read receipts require a registered query or the built-in SQL read");
+    }
+    return hash;
+  };
+}
 var operationHash = /^sha256:[a-f0-9]{64}$/;
 function readManifestHashes(manifest) {
   if (!isRecord(manifest) || typeof manifest.schemaHash !== "string" || !manifest.schemaHash || !isRecord(manifest.operations)) {
@@ -98,35 +136,51 @@ function readManifestHashes(manifest) {
     if (!/^[_A-Za-z][_0-9A-Za-z]*$/.test(name) || !isRecord(entry) || typeof entry.hash !== "string" || !operationHash.test(entry.hash) || entry.kind !== "query" && entry.kind !== "mutation") {
       throw new OrmClientError(`invalid operations manifest entry "${name}" \u2014 regenerate the manifest`);
     }
-    hashes.set(name, entry.hash);
+    hashes.set(name, { hash: entry.hash, kind: entry.kind });
   }
   return hashes;
 }
 function createOperationExecutorWithTransport({ namespace, manifest, transport }) {
   if (typeof namespace !== "string" || !NAMESPACE_PATTERN.test(namespace)) throw new OrmClientError("invalid ORM namespace \u2014 expected a lowercase identifier of at most 41 characters");
   const hashes = manifest === void 0 ? /* @__PURE__ */ new Map() : readManifestHashes(manifest);
-  const knownHashes = new Set(hashes.values());
-  async function execute(op, variables = {}, options = {}) {
+  const knownHashes = new Set([...hashes.values()].map((entry) => entry.hash));
+  const resolveReceiptOperation = createReadReceiptOperationResolver({ operations: hashes });
+  async function request({ op, variables, options, requireReadReceipt = false }) {
     validateIdempotencyKey(options.idempotencyKey);
+    validateExpectedSourceGeneration(options.expectedSourceGeneration);
     if (typeof op !== "string" && op.namespace !== namespace) throw new OrmClientError("operation belongs to a different namespace");
     const selector = typeof op === "string" ? op : op.hash;
-    const hash = selector === BUILTIN_SQL_READ_HASH ? selector : hashes.get(selector) ?? (knownHashes.has(selector) ? selector : void 0);
+    const hash = requireReadReceipt ? resolveReceiptOperation({ selector, hashOnly: typeof op !== "string" }) : selector === BUILTIN_SQL_READ_HASH ? selector : hashes.get(selector)?.hash ?? (knownHashes.has(selector) ? selector : void 0);
     if (!hash) throw new OrmClientError(`unknown operation "${op}" \u2014 not in the manifest (${hashes.size} known). Re-run seq-studio orm generate.`);
     if (!isRecord(variables)) throw new OrmClientError("operation variables must be an object");
     const response = await transport({
       namespace,
       op: hash,
       variables,
-      ...options.idempotencyKey === void 0 ? {} : { idempotencyKey: options.idempotencyKey }
+      ...options.idempotencyKey === void 0 ? {} : { idempotencyKey: options.idempotencyKey },
+      ...options.expectedSourceGeneration === void 0 ? {} : { expectedSourceGeneration: options.expectedSourceGeneration }
     });
     if (!response || typeof response.ok !== "boolean" || !Number.isInteger(response.status) || response.status < 100 || response.status > 599 || response.ok !== (response.status >= 200 && response.status < 300)) {
       throw new OrmOperationError("malformed transport response", null, null);
     }
-    return readOperationResponse(response);
+    return response;
+  }
+  async function execute(op, variables = {}, options = {}) {
+    const executionOptions = { ...options };
+    const response = await request({ op, variables, options: executionOptions });
+    return executionOptions.expectedSourceGeneration === void 0 ? readOperationResponse(response) : readOperationResponseWithReceipt({ ...response, expectedSourceGeneration: executionOptions.expectedSourceGeneration }).data;
+  }
+  async function executeWithReadReceipt(op, variables = {}, options = {}) {
+    const executionOptions = { ...options };
+    const response = await request({ op, variables, options: executionOptions, requireReadReceipt: true });
+    return readOperationResponseWithReceipt({ ...response, expectedSourceGeneration: executionOptions.expectedSourceGeneration });
   }
-  return { execute, sql: (variables) => execute(BUILTIN_SQL_READ_HASH, variables) };
+  return { execute, executeWithReadReceipt, sql: (variables) => execute(BUILTIN_SQL_READ_HASH, variables) };
 }
 
+// src/orm-contract.ts
+var FUNCTION_CALLER_DATA_TOKEN_HEADER = "x-sequence-caller-data-token";
+
 // src/orm.ts
 var FunctionOrmError = class extends Error {
   constructor(code, message) {
@@ -168,12 +222,12 @@ function invocationClaims({ token }) {
   } catch {
     throw invalidContext();
   }
-  if (!record(claims) || typeof claims.sub !== "string" || !claims.sub || typeof claims.functionId !== "string" || !claims.functionId || typeof claims.invocationId !== "string" || !claims.invocationId || typeof claims.exp !== "number" || !Number.isSafeInteger(claims.exp) || claims.origin !== void 0 && claims.origin !== "function") throw invalidContext();
-  return { sub: claims.sub, exp: claims.exp, assertedBy: claims.assertedBy };
+  if (!record(claims) || typeof claims.sub !== "string" || !claims.sub || typeof claims.functionId !== "string" || !claims.functionId || typeof claims.invocationId !== "string" || !claims.invocationId || typeof claims.exp !== "number" || !Number.isSafeInteger(claims.exp) || claims.origin !== void 0 && claims.origin !== "function" || claims.executionMode !== void 0 && claims.executionMode !== "caller" && claims.executionMode !== "attached") throw invalidContext();
+  return { sub: claims.sub, exp: claims.exp, assertedBy: claims.assertedBy, executionMode: claims.executionMode };
 }
 function callerExpiry({ token }) {
   const claims = invocationClaims({ token });
-  if (claims.sub.startsWith("service-account|") || claims.sub.endsWith("@clients") || claims.assertedBy != null) {
+  if (claims.sub.startsWith("service-account|") || claims.sub.endsWith("@clients") || claims.assertedBy != null || claims.executionMode === "attached") {
     throw new FunctionOrmError(
       "UNSUPPORTED_CALLER",
       "This ORM helper requires a direct human invocation. For system-runner (Lattice) invocations, use createFunctionServiceOrmExecutor to act as the function's attached service account."
@@ -183,7 +237,7 @@ function callerExpiry({ token }) {
 }
 function serviceExpiry({ token }) {
   const claims = invocationClaims({ token });
-  if (!claims.sub.startsWith("service-account|") || typeof claims.assertedBy !== "string" || !claims.assertedBy) {
+  if (!claims.sub.startsWith("service-account|") || typeof claims.assertedBy !== "string" || !claims.assertedBy || claims.executionMode === "caller") {
     throw new FunctionOrmError(
       "UNSUPPORTED_CALLER",
       "The service data token does not name the function's attached service account."
@@ -191,6 +245,17 @@ function serviceExpiry({ token }) {
   }
   return claims.exp;
 }
+function explicitCallerExpiry({ token }) {
+  const claims = invocationClaims({ token });
+  const platformAccount = /^service-account\|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(claims.sub);
+  if (claims.executionMode !== "caller" || claims.sub.endsWith("@clients") || claims.sub.startsWith("service-account|") && !platformAccount) {
+    throw new FunctionOrmError(
+      "UNSUPPORTED_CALLER",
+      "Caller ORM access requires a platform-delivered caller credential for the actual human or platform service account. It never uses the attached service identity or the run initiator."
+    );
+  }
+  return claims.exp;
+}
 function requireUnexpired({ expiresAt }) {
   if (expiresAt <= Math.floor(Date.now() / 1e3)) {
     throw new FunctionOrmError(
@@ -236,7 +301,7 @@ function createExecutor({
   return createOperationExecutorWithTransport({
     namespace,
     manifest,
-    transport: async ({ namespace: targetNamespace, op, variables, idempotencyKey }) => {
+    transport: async ({ namespace: targetNamespace, op, variables, idempotencyKey, expectedSourceGeneration }) => {
       requireUnexpired({ expiresAt });
       const response = await fetchImpl(`${origin}/_data/v2/${targetNamespace}`, {
         method: "POST",
@@ -245,7 +310,7 @@ function createExecutor({
           [header]: token,
           ...jsonScalars ? { [ORM_JSON_SCALARS_HEADER]: jsonScalars } : {}
         },
-        body: JSON.stringify({ op, variables, idempotencyKey }),
+        body: JSON.stringify({ op, variables, idempotencyKey, expectedSourceGeneration }),
         redirect: "error"
       });
       const body = await response.json().catch(() => null);
@@ -273,6 +338,19 @@ function createFunctionOrmExecutor({
   });
   return createExecutor({ ...options, fetchImpl, token, header: ORM_DATA_TOKEN_HEADER, expiresAt: callerExpiry({ token }) });
 }
+function createFunctionCallerOrmExecutor({
+  request,
+  fetchImpl = globalThis.fetch,
+  ...options
+}) {
+  trustedOrigin({ baseUrl: options.baseUrl });
+  const token = readToken({
+    request,
+    header: FUNCTION_CALLER_DATA_TOKEN_HEADER,
+    missing: "Caller ORM access is unavailable. Invoke through a platform runtime supporting caller delegation, as a human or an explicit platform service account."
+  });
+  return createExecutor({ ...options, fetchImpl, token, header: ORM_DATA_TOKEN_HEADER, expiresAt: explicitCallerExpiry({ token }) });
+}
 function createFunctionServiceOrmExecutor({
   request,
   fetchImpl = globalThis.fetch,
@@ -288,11 +366,13 @@ function createFunctionServiceOrmExecutor({
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  FUNCTION_CALLER_DATA_TOKEN_HEADER,
   FunctionOrmError,
   ORM_JSON_SCALARS_HEADER,
   ORM_LOSSLESS_JSON_SCALARS,
   OrmClientError,
   OrmOperationError,
+  createFunctionCallerOrmExecutor,
   createFunctionOrmExecutor,
   createFunctionServiceOrmExecutor
 });

package/dist/preflight-abrigo.d.ts

@@ -0,0 +1,10 @@
+import { type CapabilityTooling, type ManagedFunctionCapabilities, type PreflightIssue, type PreflightManifest } from './capabilities';
+export declare function checkAbrigo({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues }: {
+    manifest: PreflightManifest;
+    capabilities: ManagedFunctionCapabilities | null;
+    tooling: CapabilityTooling;
+    cliVersion: string;
+    sdkVersion: string | null;
+    checkDeployment: boolean;
+    issues: PreflightIssue[];
+}): void;

package/dist/preflight-abrigo.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAbrigo = checkAbrigo;
+const capabilities_1 = require("./capabilities");
+const preflight_issue_1 = require("./preflight-issue");
+const abrigo_contract_1 = require("./abrigo-contract");
+const sdk_range_1 = require("./sdk-range");
+function checkAbrigo({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues }) {
+    const abrigo = manifest.capabilities?.abrigo;
+    if (abrigo === undefined)
+        return;
+    const deployed = capabilities?.features.abrigo_read;
+    const feature = deployed ?? capabilities_1.MANAGED_FUNCTION_CAPABILITIES.features.abrigo_read;
+    const details = { limit: feature.limit, tooling, requiredCli: feature.min_cli, requiredSdk: feature.min_sdk, cliVersion, sdkVersion };
+    const parsed = abrigo_contract_1.functionAbrigoReadScopesSchema.safeParse(abrigo);
+    if (!parsed.success) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({ ...details, field: 'capabilities.abrigo', problem: (0, capabilities_1.formatValidationDetail)(parsed.error.issues) }));
+        return;
+    }
+    if (checkDeployment && deployed?.supported !== true) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({ ...details, field: feature.field, problem: 'caller-scoped Abrigo reads are not supported by this deployment' }));
+        return;
+    }
+    if ((0, capabilities_1.versionIsOlder)(cliVersion, feature.min_cli) || !sdkVersion || !(0, sdk_range_1.sdkSpecAllowsOnlyAtOrAbove)(sdkVersion, feature.min_sdk))
+        issues.push((0, preflight_issue_1.createPreflightIssue)({ ...details, field: feature.field, problem: 'declare compatible tooling for caller-scoped Abrigo reads' }));
+}

package/dist/preflight-agents.d.ts

@@ -0,0 +1,10 @@
+import { type CapabilityTooling, type ManagedFunctionCapabilities, type PreflightIssue, type PreflightManifest } from './capabilities';
+export declare function checkAgents({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues }: {
+    manifest: PreflightManifest;
+    capabilities: ManagedFunctionCapabilities | null;
+    tooling: CapabilityTooling;
+    cliVersion: string;
+    sdkVersion: string | null;
+    checkDeployment: boolean;
+    issues: PreflightIssue[];
+}): void;

package/dist/preflight-agents.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAgents = checkAgents;
+const capabilities_1 = require("./capabilities");
+const preflight_issue_1 = require("./preflight-issue");
+const agents_contract_1 = require("./agents-contract");
+const sdk_range_1 = require("./sdk-range");
+function checkAgents({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues }) {
+    const agents = manifest.capabilities?.agents;
+    if (agents === undefined)
+        return;
+    const parsed = agents_contract_1.functionAgentReadScopesSchema.safeParse(agents);
+    const keys = parsed.success && parsed.data.read === undefined ? [] : ['agents_read'];
+    if (parsed.success && parsed.data.evidence !== undefined)
+        keys.push('agents_evidence_verify');
+    for (const key of keys) {
+        const deployed = capabilities?.features[key];
+        const feature = deployed ?? capabilities_1.MANAGED_FUNCTION_CAPABILITIES.features[key];
+        const details = {
+            limit: feature.limit,
+            tooling,
+            requiredCli: feature.min_cli,
+            requiredSdk: feature.min_sdk,
+            cliVersion,
+            sdkVersion,
+        };
+        if (!parsed.success) {
+            issues.push((0, preflight_issue_1.createPreflightIssue)({
+                ...details,
+                field: 'capabilities.agents',
+                problem: (0, capabilities_1.formatValidationDetail)(parsed.error.issues),
+            }));
+            return;
+        }
+        if (checkDeployment && deployed?.supported !== true) {
+            issues.push((0, preflight_issue_1.createPreflightIssue)({
+                ...details,
+                field: feature.field,
+                problem: 'the declared agent capability is not supported by this deployment',
+            }));
+            continue;
+        }
+        if ((0, capabilities_1.versionIsOlder)(cliVersion, feature.min_cli) || (sdkVersion && (0, sdk_range_1.sdkConstraintIsOlder)(sdkVersion, feature.min_sdk))) {
+            issues.push((0, preflight_issue_1.createPreflightIssue)({
+                ...details,
+                field: feature.field,
+                problem: 'the installed tooling does not support the declared agent capability',
+            }));
+        }
+    }
+}

package/dist/preflight-directory.d.ts

@@ -0,0 +1,10 @@
+import { type CapabilityTooling, type ManagedFunctionCapabilities, type PreflightIssue, type PreflightManifest } from './capabilities';
+export declare function checkDirectory({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues, }: {
+    manifest: PreflightManifest;
+    capabilities: ManagedFunctionCapabilities | null;
+    tooling: CapabilityTooling;
+    cliVersion: string;
+    sdkVersion: string | null;
+    checkDeployment: boolean;
+    issues: PreflightIssue[];
+}): void;

package/dist/preflight-directory.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkDirectory = checkDirectory;
+const capabilities_1 = require("./capabilities");
+const preflight_issue_1 = require("./preflight-issue");
+const directory_config_1 = require("./directory-config");
+const sdk_range_1 = require("./sdk-range");
+function checkDirectory({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues, }) {
+    const directory = manifest.capabilities?.directory;
+    if (directory === undefined)
+        return;
+    const deployed = capabilities?.features.directory_members;
+    const feature = deployed ?? capabilities_1.MANAGED_FUNCTION_CAPABILITIES.features.directory_members;
+    const details = {
+        limit: feature.limit, tooling, requiredCli: feature.min_cli,
+        requiredSdk: feature.min_sdk, cliVersion, sdkVersion,
+    };
+    const parsed = directory_config_1.directoryScopesSchema.safeParse(directory);
+    if (!parsed.success) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({
+            ...details, field: 'capabilities.directory', problem: (0, capabilities_1.formatValidationDetail)(parsed.error.issues),
+        }));
+        return;
+    }
+    if (checkDeployment && deployed?.supported !== true) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({
+            ...details, field: feature.field, problem: 'group-member directory reads are not supported by this deployment',
+        }));
+        return;
+    }
+    if ((0, capabilities_1.versionIsOlder)(cliVersion, feature.min_cli) || (sdkVersion && (0, sdk_range_1.sdkConstraintIsOlder)(sdkVersion, feature.min_sdk))) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({
+            ...details, field: feature.field, problem: 'the installed tooling does not support managed function group-member directory reads',
+        }));
+    }
+}

package/dist/preflight-immutable-release.d.ts

@@ -0,0 +1,10 @@
+import { type CapabilityTooling, type ManagedFunctionCapabilities, type PreflightIssue, type PreflightManifest } from './capabilities';
+export declare function checkImmutableRelease({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues, }: {
+    manifest: PreflightManifest;
+    capabilities: ManagedFunctionCapabilities | null;
+    tooling: CapabilityTooling;
+    cliVersion: string;
+    sdkVersion: string | null;
+    checkDeployment: boolean;
+    issues: PreflightIssue[];
+}): void;

package/dist/preflight-immutable-release.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkImmutableRelease = checkImmutableRelease;
+const capabilities_1 = require("./capabilities");
+const preflight_issue_1 = require("./preflight-issue");
+const immutable_release_contract_1 = require("./immutable-release-contract");
+const sdk_range_1 = require("./sdk-range");
+function checkImmutableRelease({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues, }) {
+    const declaration = manifest.function?.immutable_release;
+    if (declaration === undefined || declaration === false)
+        return;
+    const deployed = capabilities?.features.immutable_release;
+    const feature = deployed ?? capabilities_1.MANAGED_FUNCTION_CAPABILITIES.features.immutable_release;
+    const details = {
+        field: 'function.immutable_release', limit: feature.limit, tooling,
+        requiredCli: feature.min_cli, requiredSdk: feature.min_sdk, cliVersion, sdkVersion,
+    };
+    if (!immutable_release_contract_1.functionImmutableReleaseSchema.safeParse(declaration).success) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({ ...details, problem: 'must be a boolean' }));
+        return;
+    }
+    if (checkDeployment && deployed?.supported !== true) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({ ...details,
+            problem: 'Immutable function releases are not supported by this deployment',
+        }));
+        return;
+    }
+    if ((0, capabilities_1.versionIsOlder)(cliVersion, feature.min_cli) ||
+        (sdkVersion && (0, sdk_range_1.sdkConstraintIsOlder)(sdkVersion, feature.min_sdk))) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({ ...details,
+            problem: 'the installed tooling does not support immutable function releases',
+        }));
+    }
+}

package/dist/preflight-invocation.d.ts

@@ -0,0 +1,10 @@
+import { type CapabilityTooling, type ManagedFunctionCapabilities, type PreflightIssue, type PreflightManifest } from './capabilities';
+export declare function checkInvocationIdentity({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues, }: {
+    manifest: PreflightManifest;
+    capabilities: ManagedFunctionCapabilities | null;
+    tooling: CapabilityTooling;
+    cliVersion: string;
+    sdkVersion: string | null;
+    checkDeployment: boolean;
+    issues: PreflightIssue[];
+}): void;

package/dist/preflight-invocation.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkInvocationIdentity = checkInvocationIdentity;
+const capabilities_1 = require("./capabilities");
+const invocation_contract_1 = require("./invocation-contract");
+const preflight_issue_1 = require("./preflight-issue");
+const sdk_range_1 = require("./sdk-range");
+function checkInvocationIdentity({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues, }) {
+    const invocation = manifest.capabilities?.invocation;
+    if (invocation === undefined)
+        return;
+    const deployed = capabilities?.features.invocation_identity;
+    const feature = deployed ?? capabilities_1.MANAGED_FUNCTION_CAPABILITIES.features.invocation_identity;
+    const details = {
+        limit: feature.limit, tooling, requiredCli: feature.min_cli,
+        requiredSdk: feature.min_sdk, cliVersion, sdkVersion,
+    };
+    const parsed = invocation_contract_1.functionInvocationIdentityCapabilitySchema.safeParse(invocation);
+    if (!parsed.success) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({
+            ...details, field: 'capabilities.invocation',
+            problem: (0, capabilities_1.formatValidationDetail)(parsed.error.issues),
+        }));
+        return;
+    }
+    if (checkDeployment && deployed?.supported !== true) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({
+            ...details, field: feature.field,
+            problem: 'Invocation identity reads are not supported by this deployment',
+        }));
+        return;
+    }
+    if ((0, capabilities_1.versionIsOlder)(cliVersion, feature.min_cli) ||
+        (sdkVersion && (0, sdk_range_1.sdkConstraintIsOlder)(sdkVersion, feature.min_sdk))) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({
+            ...details, field: feature.field,
+            problem: 'the installed tooling does not support managed function invocation identity reads',
+        }));
+    }
+}

package/dist/preflight-lattice.d.ts

@@ -0,0 +1,10 @@
+import { type CapabilityTooling, type ManagedFunctionCapabilities, type PreflightIssue, type PreflightManifest } from './capabilities';
+export declare function checkLatticeContext({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues, }: {
+    manifest: PreflightManifest;
+    capabilities: ManagedFunctionCapabilities | null;
+    tooling: CapabilityTooling;
+    cliVersion: string;
+    sdkVersion: string | null;
+    checkDeployment: boolean;
+    issues: PreflightIssue[];
+}): void;

package/dist/preflight-lattice.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkLatticeContext = checkLatticeContext;
+const capabilities_1 = require("./capabilities");
+const lattice_capability_1 = require("./lattice-capability");
+const preflight_issue_1 = require("./preflight-issue");
+const sdk_range_1 = require("./sdk-range");
+function checkLatticeContext({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues, }) {
+    const lattice = manifest.capabilities?.lattice;
+    if (lattice === undefined)
+        return;
+    const deployed = capabilities?.features.lattice_context;
+    const feature = deployed ?? capabilities_1.MANAGED_FUNCTION_CAPABILITIES.features.lattice_context;
+    const details = {
+        limit: feature.limit, tooling, requiredCli: feature.min_cli,
+        requiredSdk: feature.min_sdk, cliVersion, sdkVersion,
+    };
+    const parsed = lattice_capability_1.functionLatticeContextCapabilitySchema.safeParse(lattice);
+    if (!parsed.success) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({
+            ...details, field: 'capabilities.lattice',
+            problem: (0, capabilities_1.formatValidationDetail)(parsed.error.issues),
+        }));
+        return;
+    }
+    if (checkDeployment && deployed?.supported !== true) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({
+            ...details, field: feature.field,
+            problem: 'Lattice execution context reads are not supported by this deployment',
+        }));
+        return;
+    }
+    if ((0, capabilities_1.versionIsOlder)(cliVersion, feature.min_cli) ||
+        (sdkVersion && (0, sdk_range_1.sdkConstraintIsOlder)(sdkVersion, feature.min_sdk))) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({
+            ...details, field: feature.field,
+            problem: 'the installed tooling does not support managed function Lattice context reads',
+        }));
+    }
+}

package/dist/preflight-monitoring.d.ts

@@ -0,0 +1,10 @@
+import { type CapabilityTooling, type ManagedFunctionCapabilities, type PreflightIssue, type PreflightManifest } from './capabilities';
+export declare function checkMonitoring({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues, }: {
+    manifest: PreflightManifest;
+    capabilities: ManagedFunctionCapabilities | null;
+    tooling: CapabilityTooling;
+    cliVersion: string;
+    sdkVersion: string | null;
+    checkDeployment: boolean;
+    issues: PreflightIssue[];
+}): void;

package/dist/preflight-monitoring.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkMonitoring = checkMonitoring;
+const capabilities_1 = require("./capabilities");
+const preflight_issue_1 = require("./preflight-issue");
+const monitoring_contract_1 = require("./monitoring-contract");
+const sdk_range_1 = require("./sdk-range");
+function checkMonitoring({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues, }) {
+    const monitoring = manifest.capabilities?.monitoring;
+    if (monitoring === undefined)
+        return;
+    const deployedFeature = capabilities?.features.monitoring_deliveries;
+    const feature = deployedFeature ?? capabilities_1.MANAGED_FUNCTION_CAPABILITIES.features.monitoring_deliveries;
+    const details = {
+        limit: feature.limit,
+        tooling,
+        requiredCli: feature.min_cli,
+        requiredSdk: feature.min_sdk,
+        cliVersion,
+        sdkVersion,
+    };
+    const parsed = monitoring_contract_1.functionMonitoringScopesSchema.safeParse(monitoring);
+    if (!parsed.success) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({
+            ...details,
+            field: 'capabilities.monitoring',
+            problem: (0, capabilities_1.formatValidationDetail)(parsed.error.issues),
+        }));
+        return;
+    }
+    if (checkDeployment && deployedFeature?.supported !== true) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({
+            ...details,
+            field: feature.field,
+            problem: 'monitoring deliveries are not supported by this deployment',
+        }));
+        return;
+    }
+    if ((0, capabilities_1.versionIsOlder)(cliVersion, feature.min_cli) || (sdkVersion && (0, sdk_range_1.sdkConstraintIsOlder)(sdkVersion, feature.min_sdk))) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({
+            ...details,
+            field: feature.field,
+            problem: 'the installed tooling does not support managed function monitoring deliveries',
+        }));
+    }
+}

package/dist/preflight-service-directory.d.ts

@@ -0,0 +1,10 @@
+import { type CapabilityTooling, type ManagedFunctionCapabilities, type PreflightIssue, type PreflightManifest } from './capabilities';
+export declare function checkDirectory({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues }: {
+    manifest: PreflightManifest;
+    capabilities: ManagedFunctionCapabilities | null;
+    tooling: CapabilityTooling;
+    cliVersion: string;
+    sdkVersion: string | null;
+    checkDeployment: boolean;
+    issues: PreflightIssue[];
+}): void;

package/dist/preflight-service-directory.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkDirectory = checkDirectory;
+const capabilities_1 = require("./capabilities");
+const preflight_issue_1 = require("./preflight-issue");
+const directory_contract_1 = require("./directory-contract");
+const sdk_range_1 = require("./sdk-range");
+function checkDirectory({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues }) {
+    const directory = manifest.capabilities?.directory;
+    if (directory === undefined)
+        return;
+    const deployed = capabilities?.features.directory_resolve;
+    const feature = deployed ?? capabilities_1.MANAGED_FUNCTION_CAPABILITIES.features.directory_resolve;
+    const details = { limit: feature.limit, tooling, requiredCli: feature.min_cli, requiredSdk: feature.min_sdk, cliVersion, sdkVersion };
+    const parsed = directory_contract_1.functionDirectoryScopesSchema.safeParse(directory);
+    if (!parsed.success) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({ ...details, field: 'capabilities.directory', problem: (0, capabilities_1.formatValidationDetail)(parsed.error.issues) }));
+        return;
+    }
+    if (checkDeployment && deployed?.supported !== true) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({ ...details, field: feature.field, problem: 'exact directory resolution is not supported by this deployment' }));
+        return;
+    }
+    if ((0, capabilities_1.versionIsOlder)(cliVersion, feature.min_cli) || (sdkVersion && (0, sdk_range_1.sdkConstraintIsOlder)(sdkVersion, feature.min_sdk)))
+        issues.push((0, preflight_issue_1.createPreflightIssue)({ ...details, field: feature.field, problem: 'the installed tooling does not support managed function directory resolution' }));
+}

package/dist/preflight-workflows.d.ts

@@ -0,0 +1,10 @@
+import { type CapabilityTooling, type ManagedFunctionCapabilities, type PreflightIssue, type PreflightManifest } from './capabilities';
+export declare function checkWorkflows({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues, }: {
+    manifest: PreflightManifest;
+    capabilities: ManagedFunctionCapabilities | null;
+    tooling: CapabilityTooling;
+    cliVersion: string;
+    sdkVersion: string | null;
+    checkDeployment: boolean;
+    issues: PreflightIssue[];
+}): void;