@sequenceholdings/managed-functions 0.4.0 → 0.4.2

package/dist/preflight-workflows.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkWorkflows = checkWorkflows;
+const capabilities_1 = require("./capabilities");
+const preflight_issue_1 = require("./preflight-issue");
+const sdk_range_1 = require("./sdk-range");
+const workflow_scopes_contract_1 = require("./workflow-scopes-contract");
+function checkWorkflows({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues, }) {
+    const workflows = manifest.capabilities?.workflows;
+    if (workflows === undefined)
+        return;
+    const parsed = workflow_scopes_contract_1.functionWorkflowScopesSchema.safeParse(workflows);
+    if (!parsed.success) {
+        const feature = capabilities_1.MANAGED_FUNCTION_CAPABILITIES.features.workflows_read;
+        issues.push((0, preflight_issue_1.createPreflightIssue)({
+            limit: feature.limit, tooling, requiredCli: feature.min_cli, requiredSdk: feature.min_sdk, cliVersion, sdkVersion,
+            field: 'capabilities.workflows', problem: (0, capabilities_1.formatValidationDetail)(parsed.error.issues),
+        }));
+        return;
+    }
+    const keys = [];
+    if (parsed.data.read !== undefined)
+        keys.push('workflows_read');
+    if (parsed.data.evidence !== undefined)
+        keys.push('workflows_evidence_verify');
+    for (const key of keys) {
+        const deployed = capabilities?.features[key];
+        const feature = deployed ?? capabilities_1.MANAGED_FUNCTION_CAPABILITIES.features[key];
+        const details = { limit: feature.limit, tooling, requiredCli: feature.min_cli, requiredSdk: feature.min_sdk, cliVersion, sdkVersion };
+        if (checkDeployment && deployed?.supported !== true) {
+            issues.push((0, preflight_issue_1.createPreflightIssue)({ ...details, field: feature.field, problem: 'the declared workflow capability is not supported by this deployment' }));
+            continue;
+        }
+        if ((0, capabilities_1.versionIsOlder)(cliVersion, feature.min_cli) || (sdkVersion && (0, sdk_range_1.sdkConstraintIsOlder)(sdkVersion, feature.min_sdk))) {
+            issues.push((0, preflight_issue_1.createPreflightIssue)({ ...details, field: feature.field, problem: 'the installed tooling does not support the declared workflow capability' }));
+        }
+    }
+}

package/dist/preflight.js

@@ -5,6 +5,22 @@ const capabilities_1 = require("./capabilities");
 const sdk_range_1 = require("./sdk-range");
 const preflight_issue_1 = require("./preflight-issue");
 const preflight_processes_1 = require("./preflight-processes");
+const preflight_lattice_1 = require("./preflight-lattice");
+const lattice_capability_1 = require("./lattice-capability");
+const preflight_invocation_1 = require("./preflight-invocation");
+const preflight_immutable_release_1 = require("./preflight-immutable-release");
+const invocation_contract_1 = require("./invocation-contract");
+const preflight_agents_1 = require("./preflight-agents");
+const agents_contract_1 = require("./agents-contract");
+const preflight_workflows_1 = require("./preflight-workflows");
+const workflow_scopes_contract_1 = require("./workflow-scopes-contract");
+const preflight_monitoring_1 = require("./preflight-monitoring");
+const preflight_service_directory_1 = require("./preflight-service-directory");
+const preflight_directory_1 = require("./preflight-directory");
+const directory_manifest_1 = require("./directory-manifest");
+const preflight_abrigo_1 = require("./preflight-abrigo");
+const abrigo_contract_1 = require("./abrigo-contract");
+const monitoring_contract_1 = require("./monitoring-contract");
 const processes_contract_1 = require("./processes-contract");
 const WORKLOAD_FIELDS = [
     'memory_mb',
@@ -19,8 +35,16 @@ function preflightManagedFunction({ manifest, limits, capabilities, cliVersion,
     const tooling = capabilities?.tooling ?? capabilities_1.MANAGED_FUNCTION_CAPABILITIES.tooling;
     const issues = [];
     checkWorkload({ manifest, limits, tooling, cliVersion, sdkVersion, issues });
+    (0, preflight_immutable_release_1.checkImmutableRelease)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
     checkPostgres({ manifest, capabilities, tooling, cliVersion, sdkVersion, issues });
     (0, preflight_processes_1.checkProcesses)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
+    (0, preflight_lattice_1.checkLatticeContext)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
+    (0, preflight_invocation_1.checkInvocationIdentity)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
+    (0, preflight_agents_1.checkAgents)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
+    (0, preflight_workflows_1.checkWorkflows)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
+    (0, preflight_monitoring_1.checkMonitoring)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
+    checkDirectoryDeclarations({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
+    (0, preflight_abrigo_1.checkAbrigo)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
     checkHeaders({ manifest, capabilities, tooling, cliVersion, sdkVersion, issues });
     checkSdkTimeout({ manifest, limits, capabilities, tooling, cliVersion, sdkVersion, issues });
     return issues;
@@ -122,7 +146,14 @@ function needsWideHeaders(manifest) {
     const hasData = !!data && Object.keys(data).length > 0;
     const hasStorage = !!storage && typeof storage === 'object' && Object.keys(storage).length > 0;
     const hasProcesses = processes_contract_1.functionProcessReadScopesSchema.safeParse(manifest.capabilities?.processes).success;
-    return hasData || hasStorage || hasProcesses;
+    const hasAgents = agents_contract_1.functionAgentReadScopesSchema.safeParse(manifest.capabilities?.agents).success;
+    const hasWorkflows = workflow_scopes_contract_1.functionWorkflowScopesSchema.safeParse(manifest.capabilities?.workflows).success;
+    const hasMonitoring = monitoring_contract_1.functionMonitoringScopesSchema.safeParse(manifest.capabilities?.monitoring).success;
+    const hasLattice = (0, lattice_capability_1.readFunctionLatticeContextCapability)(manifest);
+    const hasInvocation = (0, invocation_contract_1.readFunctionInvocationIdentityCapability)(manifest);
+    const hasDirectory = directory_manifest_1.functionDirectoryManifestSchema.safeParse(manifest.capabilities?.directory).success;
+    const hasAbrigo = abrigo_contract_1.functionAbrigoReadScopesSchema.safeParse(manifest.capabilities?.abrigo).success;
+    return hasData || hasStorage || hasProcesses || hasMonitoring || hasAgents || hasWorkflows || hasLattice || hasInvocation || hasDirectory || hasAbrigo;
 }
 function checkHeaders({ manifest, capabilities, tooling, cliVersion, sdkVersion, issues, }) {
     const feature = capabilities?.features.http_headers;
@@ -133,7 +164,7 @@ function checkHeaders({ manifest, capabilities, tooling, cliVersion, sdkVersion,
         return;
     issues.push((0, preflight_issue_1.createPreflightIssue)({
         field: feature.field,
-        problem: `invocation headers for capabilities.data, capabilities.storage, or capabilities.processes exceed ${feature.max_bytes} bytes and will fail with HTTP 431`,
+        problem: `invocation headers for capability credentials, including capabilities.data, capabilities.storage, capabilities.processes, capabilities.lattice, capabilities.invocation and capabilities.directory, exceed ${feature.max_bytes} bytes and will fail with HTTP 431`,
         limit: feature.limit,
         tooling,
         requiredCli: feature.min_cli,
@@ -163,3 +194,20 @@ function checkSdkTimeout({ manifest, limits, capabilities, tooling, cliVersion,
         sdkVersion,
     }));
 }
+function checkDirectoryDeclarations(args) {
+    const directory = args.manifest.capabilities?.directory;
+    if (directory === undefined)
+        return;
+    const parsed = directory_manifest_1.functionDirectoryManifestSchema.safeParse(directory);
+    if (!parsed.success) {
+        args.issues.push((0, preflight_issue_1.createPreflightIssue)({ field: 'capabilities.directory', problem: (0, capabilities_1.formatValidationDetail)(parsed.error.issues),
+            limit: 'concrete groups and/or exact tenant resolution scopes', tooling: args.tooling,
+            requiredCli: args.tooling.cli.min, requiredSdk: args.tooling.sdk.min, cliVersion: args.cliVersion, sdkVersion: args.sdkVersion }));
+        return;
+    }
+    const scoped = (directory) => ({ ...args, manifest: { ...args.manifest, capabilities: { ...args.manifest.capabilities, directory } } });
+    if (parsed.data.groups)
+        (0, preflight_directory_1.checkDirectory)(scoped({ groups: parsed.data.groups }));
+    if (parsed.data.resolve)
+        (0, preflight_service_directory_1.checkDirectory)(scoped({ resolve: parsed.data.resolve }));
+}

package/dist/processes-contract.d.ts

@@ -55,6 +55,21 @@ export declare const functionProcessRunsPageQuerySchema: z.ZodObject<{
     archived: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 export type FunctionProcessRunQuery = z.infer<typeof functionProcessRunQuerySchema>;
+export declare const functionProcessCompletedAgentReferenceQuerySchema: z.ZodObject<{
+    process: z.ZodString;
+    runId: z.ZodString;
+    nodeId: z.ZodString;
+}, z.core.$strict>;
+export type FunctionProcessCompletedAgentReferenceQuery = z.infer<typeof functionProcessCompletedAgentReferenceQuerySchema>;
+export declare const functionProcessCompletedAgentReferenceSchema: z.ZodObject<{
+    stepId: z.ZodString;
+    attempt: z.ZodNumber;
+    agentId: z.ZodString;
+    agentRunId: z.ZodString;
+    threadId: z.ZodString;
+    recoveryProof: z.ZodString;
+}, z.core.$strict>;
+export type FunctionProcessCompletedAgentReference = z.infer<typeof functionProcessCompletedAgentReferenceSchema>;
 export type FunctionProcessRunsPageQuery = z.infer<typeof functionProcessRunsPageQuerySchema>;
 export declare const functionProcessRunsPageSchema: z.ZodObject<{
     runs: z.ZodArray<z.ZodObject<{
@@ -80,6 +95,11 @@ export declare const functionProcessReadRequestSchema: z.ZodDiscriminatedUnion<[
     process: z.ZodString;
     runId: z.ZodString;
     operation: z.ZodLiteral<"getRun">;
+}, z.core.$strict>, z.ZodObject<{
+    process: z.ZodString;
+    runId: z.ZodString;
+    nodeId: z.ZodString;
+    operation: z.ZodLiteral<"getCompletedAgentReference">;
 }, z.core.$strict>, z.ZodObject<{
     process: z.ZodString;
     statuses: z.ZodOptional<z.ZodArray<z.ZodEnum<{

package/dist/processes-contract.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FunctionProcessReadError = exports.functionProcessReadRequestSchema = exports.functionProcessRunsPageSchema = exports.functionProcessRunsPageQuerySchema = exports.functionProcessRunQuerySchema = exports.functionProcessRunSummarySchema = exports.functionProcessRunStatusSchema = exports.functionProcessReadScopesSchema = exports.FUNCTION_PROCESS_READ_PATH = exports.FUNCTION_PROCESS_TOKEN_HEADER = void 0;
+exports.FunctionProcessReadError = exports.functionProcessReadRequestSchema = exports.functionProcessRunsPageSchema = exports.functionProcessCompletedAgentReferenceSchema = exports.functionProcessCompletedAgentReferenceQuerySchema = exports.functionProcessRunsPageQuerySchema = exports.functionProcessRunQuerySchema = exports.functionProcessRunSummarySchema = exports.functionProcessRunStatusSchema = exports.functionProcessReadScopesSchema = exports.FUNCTION_PROCESS_READ_PATH = exports.FUNCTION_PROCESS_TOKEN_HEADER = void 0;
 exports.readFunctionProcessScopes = readFunctionProcessScopes;
 const zod_1 = require("zod");
 exports.FUNCTION_PROCESS_TOKEN_HEADER = 'x-sequence-process-service-token';
@@ -66,12 +66,19 @@ exports.functionProcessRunsPageQuerySchema = zod_1.z.strictObject({
     cursor: zod_1.z.string().min(1).max(8192).optional(),
     archived: zod_1.z.boolean().optional(),
 });
+exports.functionProcessCompletedAgentReferenceQuerySchema = exports.functionProcessRunQuerySchema.extend({ nodeId: entityId });
+exports.functionProcessCompletedAgentReferenceSchema = zod_1.z.strictObject({
+    stepId: entityId, attempt: zod_1.z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+    agentId: entityId, agentRunId: entityId, threadId: entityId,
+    recoveryProof: zod_1.z.string().min(1).max(16_384),
+});
 exports.functionProcessRunsPageSchema = zod_1.z.object({
     runs: zod_1.z.array(exports.functionProcessRunSummarySchema).max(500),
     nextCursor: zod_1.z.string().nullable(),
 });
 exports.functionProcessReadRequestSchema = zod_1.z.discriminatedUnion('operation', [
     exports.functionProcessRunQuerySchema.extend({ operation: zod_1.z.literal('getRun') }),
+    exports.functionProcessCompletedAgentReferenceQuerySchema.extend({ operation: zod_1.z.literal('getCompletedAgentReference') }),
     exports.functionProcessRunsPageQuerySchema.extend({
         operation: zod_1.z.literal('listRunsPage'),
     }),

package/dist/processes.d.ts

@@ -1,13 +1,9 @@
-import { type FunctionProcessRunQuery, type FunctionProcessRunSummary, type FunctionProcessRunsPage, type FunctionProcessRunsPageQuery } from './processes-contract';
+import { type FunctionProcessCompletedAgentReference, type FunctionProcessCompletedAgentReferenceQuery, type FunctionProcessRunQuery, type FunctionProcessRunSummary, type FunctionProcessRunsPage, type FunctionProcessRunsPageQuery } from './processes-contract';
+import { type FunctionInvocationClientOptions } from './invocation-client';
 export * from './processes-contract';
-export interface FunctionServiceProcessesOptions {
-    request: {
-        headers: Pick<Headers, 'get'> | Readonly<Record<string, string | readonly string[] | undefined>>;
-    };
-    baseUrl: string;
-    fetchImpl?: typeof globalThis.fetch;
-}
+export type FunctionServiceProcessesOptions = FunctionInvocationClientOptions;
 export interface FunctionServiceProcessesClient {
+    getCompletedAgentReference(query: FunctionProcessCompletedAgentReferenceQuery): Promise<FunctionProcessCompletedAgentReference>;
     getRun(query: FunctionProcessRunQuery): Promise<FunctionProcessRunSummary>;
     listRunsPage(query: FunctionProcessRunsPageQuery): Promise<FunctionProcessRunsPage>;
 }

package/dist/processes.js

@@ -17,100 +17,69 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createFunctionServiceProcessesClient = createFunctionServiceProcessesClient;
 const zod_1 = require("zod");
 const processes_contract_1 = require("./processes-contract");
+const invocation_client_1 = require("./invocation-client");
+const agents_contract_1 = require("./agents-contract");
 __exportStar(require("./processes-contract"), exports);
-const invalidContext = () => new processes_contract_1.FunctionProcessReadError(401, 'invalid_context', 'This invocation has no valid process-read credential');
-function readCredential({ request, }) {
+function readAgentCredential({ request }) {
     const { headers } = request;
-    const matches = typeof headers.get === 'function'
-        ? [headers.get(processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER)]
-        : Object.entries(headers)
-            .filter(([name]) => name.toLowerCase() === processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER)
-            .map(([, value]) => value);
+    const matches = typeof headers.get === 'function' ? [headers.get(agents_contract_1.FUNCTION_AGENT_TOKEN_HEADER)]
+        : Object.entries(headers).filter(([name]) => name.toLowerCase() === agents_contract_1.FUNCTION_AGENT_TOKEN_HEADER).map(([, value]) => value);
     const token = matches[0];
-    if (matches.length !== 1 ||
-        typeof token !== 'string' ||
-        token.length > 16_384)
-        throw invalidContext();
-    const envelope = /^([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]{43})$/.exec(token);
-    if (!envelope?.[1])
-        throw invalidContext();
+    const denied = () => new processes_contract_1.FunctionProcessReadError(401, 'invalid_context', 'Completed-agent reference lookup requires an agent-read credential');
+    if (matches.length !== 1 || typeof token !== 'string' || token.length > 16_384)
+        throw denied();
+    const body = /^([A-Za-z0-9_-]+)\.[A-Za-z0-9_-]{43}$/.exec(token)?.[1];
+    if (!body)
+        throw denied();
     let value;
     try {
-        value = JSON.parse(Buffer.from(envelope[1], 'base64url').toString('utf8'));
+        value = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
     }
     catch {
-        throw invalidContext();
+        throw denied();
     }
-    const parsed = zod_1.z
-        .object({
-        audience: zod_1.z.literal('atlas-managed-function-process-read'),
-        sub: zod_1.z.string().startsWith('service-account|'),
-        functionId: zod_1.z.string().min(1),
-        invocationId: zod_1.z.string().min(1),
-        exp: zod_1.z.number().int(),
-    })
-        .safeParse(value);
-    if (!parsed.success)
-        throw invalidContext();
-    return { token, expiresAt: parsed.data.exp };
-}
-function origin(baseUrl) {
-    let url;
-    try {
-        url = new URL(baseUrl);
-    }
-    catch {
-        throw new processes_contract_1.FunctionProcessReadError(400, 'invalid_configuration', 'Configure a trusted Atlas origin');
-    }
-    const loopback = url.protocol === 'http:' &&
-        ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
-    if ((!loopback && url.protocol !== 'https:') ||
-        url.username ||
-        url.password ||
-        url.pathname !== '/' ||
-        url.search ||
-        url.hash) {
-        throw new processes_contract_1.FunctionProcessReadError(400, 'invalid_configuration', 'Configure an HTTPS Atlas origin without credentials, path, query or fragment');
-    }
-    return url.origin;
+    const claims = zod_1.z.object({ audience: zod_1.z.literal('atlas-managed-function-agent-read'), sub: zod_1.z.string().startsWith('service-account|'), functionId: zod_1.z.string().min(1), invocationId: zod_1.z.string().min(1), exp: zod_1.z.number().int() }).safeParse(value);
+    if (!claims.success)
+        throw denied();
+    return { token, expiresAt: claims.data.exp };
 }
+const invalidContext = () => new processes_contract_1.FunctionProcessReadError(401, 'invalid_context', 'This invocation has no valid process-read credential');
 function createFunctionServiceProcessesClient({ request, baseUrl, fetchImpl = globalThis.fetch, }) {
-    const url = `${origin(baseUrl)}${processes_contract_1.FUNCTION_PROCESS_READ_PATH}`;
-    const { token, expiresAt } = readCredential({ request });
-    async function read({ body, schema, }) {
-        if (expiresAt <= Date.now() / 1000)
-            throw new processes_contract_1.FunctionProcessReadError(401, 'expired_context', 'The process-read credential expired; start a new invocation');
-        const parsed = processes_contract_1.functionProcessReadRequestSchema.parse(body);
-        const response = await fetchImpl(url, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                [processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER]: token,
-            },
-            body: JSON.stringify(parsed),
-            redirect: 'error',
-            signal: AbortSignal.timeout(30_000),
-        });
-        const result = await response.json().catch(() => null);
-        if (!response.ok) {
-            const error = zod_1.z
-                .object({
-                code: zod_1.z.string().max(128).optional(),
-                detail: zod_1.z.string().max(2000).optional(),
-            })
-                .safeParse(result);
-            throw new processes_contract_1.FunctionProcessReadError(response.status, error.success
-                ? (error.data.code ?? 'process_read_failed')
-                : 'process_read_failed', error.success
-                ? (error.data.detail ?? 'Process read failed')
-                : 'Process read failed');
-        }
-        const validated = schema.safeParse(result);
-        if (!validated.success)
-            throw new processes_contract_1.FunctionProcessReadError(502, 'malformed_response', 'Atlas returned an invalid process-read response');
-        return validated.data;
-    }
+    const credential = (0, invocation_client_1.readInvocationCredential)({
+        request,
+        header: processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER,
+        maxBytes: 16_384,
+        invalidContext,
+        claimsSchema: zod_1.z.object({
+            audience: zod_1.z.literal('atlas-managed-function-process-read'),
+            sub: zod_1.z.string().startsWith('service-account|'),
+            functionId: zod_1.z.string().min(1),
+            invocationId: zod_1.z.string().min(1),
+            exp: zod_1.z.number().int(),
+        }),
+    });
+    const transport = (0, invocation_client_1.createInvocationReadTransport)({
+        baseUrl,
+        fetchImpl,
+        path: processes_contract_1.FUNCTION_PROCESS_READ_PATH,
+        header: processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER,
+        credential,
+        timeoutMs: 30_000,
+        error: (status, code, message) => new processes_contract_1.FunctionProcessReadError(status, code, message),
+        failure: { code: 'process_read_failed', message: 'Process read failed' },
+    });
+    const read = ({ body, schema }) => transport({ body: processes_contract_1.functionProcessReadRequestSchema.parse(body), schema });
     return {
+        async getCompletedAgentReference(query) {
+            const agent = readAgentCredential({ request });
+            const readReference = (0, invocation_client_1.createInvocationReadTransport)({
+                baseUrl, fetchImpl, path: processes_contract_1.FUNCTION_PROCESS_READ_PATH, header: processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER,
+                credential, additionalCredentials: [{ header: agents_contract_1.FUNCTION_AGENT_TOKEN_HEADER, credential: agent }],
+                timeoutMs: 30_000, error: (status, code, message) => new processes_contract_1.FunctionProcessReadError(status, code, message),
+                failure: { code: 'process_read_failed', message: 'Process read failed' },
+            });
+            return readReference({ body: processes_contract_1.functionProcessReadRequestSchema.parse({ ...query, operation: 'getCompletedAgentReference' }), schema: processes_contract_1.functionProcessCompletedAgentReferenceSchema });
+        },
         async getRun(query) {
             const run = await read({
                 body: { ...query, operation: 'getRun' },