@sequenceholdings/managed-functions 0.4.0 → 0.4.2

package/dist/capabilities.js

@@ -4,6 +4,7 @@ exports.MANAGED_FUNCTION_CAPABILITIES = exports.MANAGED_FUNCTION_SDK_PACKAGE = e
 exports.versionIsOlder = versionIsOlder;
 exports.sdkVersionLowerBound = sdkVersionLowerBound;
 exports.sdkVersionFromPackageJson = sdkVersionFromPackageJson;
+exports.sdkSpecFromPackageJson = sdkSpecFromPackageJson;
 exports.isPostgresEgress = isPostgresEgress;
 exports.formatValidationDetail = formatValidationDetail;
 const sdk_range_1 = require("./sdk-range");
@@ -15,6 +16,61 @@ exports.MANAGED_FUNCTION_CAPABILITIES = {
         sdk: { package: exports.MANAGED_FUNCTION_SDK_PACKAGE, min: '0.3.0' },
     },
     features: {
+        directory_members: {
+            field: 'capabilities.directory.groups', supported: true,
+            limit: '1 to 16 concrete groups; resolve 1 to 50 selected active members per call',
+            min_cli: '0.5.2', min_sdk: '0.4.1',
+        },
+        abrigo_read: {
+            field: 'capabilities.abrigo.read', supported: true,
+            limit: 'eleven fixed human reads: eight integration reads and three workflow-scoped document-review reads; pages 1 to 100 with 1 to 500 rows; 1 MiB JSON responses',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
+        immutable_release: {
+            field: 'function.immutable_release', supported: true,
+            limit: 'a fresh function identity whose runtime cannot be redeployed after first activation',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
+        invocation_identity: {
+            field: 'capabilities.invocation.identity', supported: true,
+            limit: 'verified receiver and actual caller for this exact active invocation only',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
+        directory_resolve: {
+            field: 'capabilities.directory.resolve', supported: true,
+            limit: '1 to 16 exact tenant scopes; at most 50 exact active human principal lookups',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
+        lattice_context: {
+            field: 'capabilities.lattice.context', supported: true,
+            limit: 'verified context and causal human completion for the receiving Lattice step only',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
+        agents_read: {
+            field: 'capabilities.agents.read', supported: true,
+            limit: '1 to 64 exact agent ids; completed owned or verified upstream responses only',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
+        agents_evidence_verify: {
+            field: 'capabilities.agents.evidence', supported: true,
+            limit: '1 to 64 exact agent ids; verify bounded supplied historical source evidence only',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
+        workflows_read: {
+            field: 'capabilities.workflows.read', supported: true,
+            limit: '1 to 64 exact workflow ids; completed owned root outputs only',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
+        workflows_evidence_verify: {
+            field: 'capabilities.workflows.evidence', supported: true,
+            limit: '1 to 64 exact workflow ids; verify bounded supplied historical root-output evidence only',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
+        monitoring_deliveries: {
+            field: 'capabilities.monitoring.producers', supported: true,
+            limit: '1 to 16 producer namespaces; immutable publish and receipt lookup',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
         processes_read: {
             field: 'capabilities.processes.read',
             supported: true,
@@ -69,6 +125,9 @@ function sdkVersionLowerBound(spec) {
     return (0, sdk_range_1.concreteOrStaleSdkSpec)(spec, minimum);
 }
 function sdkVersionFromPackageJson(raw) {
+    return sdkVersionLowerBound(sdkSpecFromPackageJson(raw) ?? undefined);
+}
+function sdkSpecFromPackageJson(raw) {
     let parsed;
     try {
         parsed = JSON.parse(raw);
@@ -80,7 +139,8 @@ function sdkVersionFromPackageJson(raw) {
         return null;
     const dependencies = Reflect.get(parsed, 'dependencies');
     const devDependencies = Reflect.get(parsed, 'devDependencies');
-    return sdkVersionLowerBound(dependencySpec(dependencies) ?? dependencySpec(devDependencies));
+    const spec = dependencySpec(dependencies) ?? dependencySpec(devDependencies);
+    return spec?.trim() || null;
 }
 function dependencySpec(block) {
     if (!block || typeof block !== 'object')

package/dist/config.d.ts

@@ -1,9 +1,25 @@
-export { FUNCTION_PROCESS_TOKEN_HEADER, FUNCTION_PROCESS_READ_PATH, functionProcessReadScopesSchema, readFunctionProcessScopes, functionProcessReadRequestSchema, functionProcessRunSummarySchema } from './processes-contract';
+export { DIRECTORY_TOKEN_HEADER, directoryGroupIdSchema, directoryScopesSchema, directoryMembersInput, directoryMembersResponse, readDirectoryGroups } from './directory-config';
+export { functionDirectoryManifestSchema } from './directory-manifest';
+export { functionLatticeContextCapabilitySchema, readFunctionLatticeContextCapability } from './lattice-capability';
+export * from './invocation-contract';
+export { FUNCTION_PROCESS_TOKEN_HEADER, FUNCTION_PROCESS_READ_PATH, functionProcessReadScopesSchema, readFunctionProcessScopes, functionProcessReadRequestSchema, functionProcessRunSummarySchema, functionProcessCompletedAgentReferenceSchema, functionProcessCompletedAgentReferenceQuerySchema } from './processes-contract';
+export { FUNCTION_AGENT_TOKEN_HEADER, FUNCTION_AGENT_READ_PATH, functionAgentReadScopesSchema, readFunctionAgentScopes, functionAgentReadRequestSchema, functionAgentCompletedRunQuerySchema, functionAgentCompletedRunSchema } from './agents-contract';
+export * from './agent-source-evidence-contract';
+export * from './workflow-source-contract';
+export { functionWorkflowScopesSchema, readFunctionWorkflowScopes, readFunctionWorkflowEvidenceScopes } from './workflow-scopes-contract';
+export type { FunctionWorkflowScopes } from './workflow-scopes-contract';
+export * from './monitoring-events';
+export * from './monitoring-contract';
+export * from './monitoring-annotations';
+export { FUNCTION_CALLER_DATA_TOKEN_HEADER } from './orm-contract';
+export { FUNCTION_DIRECTORY_TOKEN_HEADER, FUNCTION_DIRECTORY_RESOLVE_PATH, functionDirectoryScopesSchema, readFunctionDirectoryScopes, directoryPrincipalResolveRequestSchema, directoryPrincipalResolutionSchema } from './directory-contract';
+export * from './abrigo-contract';
 export { shouldReportAtlasHttp } from './http-tracing';
+export { functionImmutableReleaseSchema, readFunctionImmutableRelease } from './immutable-release-contract';
 import { z } from 'zod';
 export { MANAGED_FUNCTION_LIMITS, MF_LIMITS_CAPS, MF_LIMITS_DEFAULTS, managedFunctionWorkloadLimitsSchema } from './limits';
 export type { ManagedFunctionLimitCatalog } from './limits';
-export { MANAGED_FUNCTION_CAPABILITIES, MANAGED_FUNCTION_CLI_PACKAGE, MANAGED_FUNCTION_SDK_PACKAGE, formatValidationDetail, isPostgresEgress, sdkVersionFromPackageJson, sdkVersionLowerBound, versionIsOlder, } from './capabilities';
+export { MANAGED_FUNCTION_CAPABILITIES, MANAGED_FUNCTION_CLI_PACKAGE, MANAGED_FUNCTION_SDK_PACKAGE, formatValidationDetail, isPostgresEgress, sdkVersionFromPackageJson, sdkSpecFromPackageJson, sdkVersionLowerBound, versionIsOlder, } from './capabilities';
 export type { DeployedPolicy, ManagedFunctionCapabilities, PreflightIssue, PreflightManifest, } from './capabilities';
 export { parseDeployedPolicy } from './deployed-policy';
 export { preflightManagedFunction } from './preflight';

package/dist/config.js

@@ -1,7 +1,35 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.cacheManifestSchema = exports.CACHE_MAX_TTL_SECONDS = exports.preflightManagedFunction = exports.parseDeployedPolicy = exports.versionIsOlder = exports.sdkVersionLowerBound = exports.sdkVersionFromPackageJson = exports.isPostgresEgress = exports.formatValidationDetail = exports.MANAGED_FUNCTION_SDK_PACKAGE = exports.MANAGED_FUNCTION_CLI_PACKAGE = exports.MANAGED_FUNCTION_CAPABILITIES = exports.managedFunctionWorkloadLimitsSchema = exports.MF_LIMITS_DEFAULTS = exports.MF_LIMITS_CAPS = exports.MANAGED_FUNCTION_LIMITS = exports.shouldReportAtlasHttp = exports.functionProcessRunSummarySchema = exports.functionProcessReadRequestSchema = exports.readFunctionProcessScopes = exports.functionProcessReadScopesSchema = exports.FUNCTION_PROCESS_READ_PATH = exports.FUNCTION_PROCESS_TOKEN_HEADER = void 0;
+exports.versionIsOlder = exports.sdkVersionLowerBound = exports.sdkSpecFromPackageJson = exports.sdkVersionFromPackageJson = exports.isPostgresEgress = exports.formatValidationDetail = exports.MANAGED_FUNCTION_SDK_PACKAGE = exports.MANAGED_FUNCTION_CLI_PACKAGE = exports.MANAGED_FUNCTION_CAPABILITIES = exports.managedFunctionWorkloadLimitsSchema = exports.MF_LIMITS_DEFAULTS = exports.MF_LIMITS_CAPS = exports.MANAGED_FUNCTION_LIMITS = exports.readFunctionImmutableRelease = exports.functionImmutableReleaseSchema = exports.shouldReportAtlasHttp = exports.directoryPrincipalResolutionSchema = exports.directoryPrincipalResolveRequestSchema = exports.readFunctionDirectoryScopes = exports.functionDirectoryScopesSchema = exports.FUNCTION_DIRECTORY_RESOLVE_PATH = exports.FUNCTION_DIRECTORY_TOKEN_HEADER = exports.FUNCTION_CALLER_DATA_TOKEN_HEADER = exports.readFunctionWorkflowEvidenceScopes = exports.readFunctionWorkflowScopes = exports.functionWorkflowScopesSchema = exports.functionAgentCompletedRunSchema = exports.functionAgentCompletedRunQuerySchema = exports.functionAgentReadRequestSchema = exports.readFunctionAgentScopes = exports.functionAgentReadScopesSchema = exports.FUNCTION_AGENT_READ_PATH = exports.FUNCTION_AGENT_TOKEN_HEADER = exports.functionProcessCompletedAgentReferenceQuerySchema = exports.functionProcessCompletedAgentReferenceSchema = exports.functionProcessRunSummarySchema = exports.functionProcessReadRequestSchema = exports.readFunctionProcessScopes = exports.functionProcessReadScopesSchema = exports.FUNCTION_PROCESS_READ_PATH = exports.FUNCTION_PROCESS_TOKEN_HEADER = exports.readFunctionLatticeContextCapability = exports.functionLatticeContextCapabilitySchema = exports.functionDirectoryManifestSchema = exports.readDirectoryGroups = exports.directoryMembersResponse = exports.directoryMembersInput = exports.directoryScopesSchema = exports.directoryGroupIdSchema = exports.DIRECTORY_TOKEN_HEADER = void 0;
+exports.cacheManifestSchema = exports.CACHE_MAX_TTL_SECONDS = exports.preflightManagedFunction = exports.parseDeployedPolicy = void 0;
 exports.readCacheConfiguration = readCacheConfiguration;
+var directory_config_1 = require("./directory-config");
+Object.defineProperty(exports, "DIRECTORY_TOKEN_HEADER", { enumerable: true, get: function () { return directory_config_1.DIRECTORY_TOKEN_HEADER; } });
+Object.defineProperty(exports, "directoryGroupIdSchema", { enumerable: true, get: function () { return directory_config_1.directoryGroupIdSchema; } });
+Object.defineProperty(exports, "directoryScopesSchema", { enumerable: true, get: function () { return directory_config_1.directoryScopesSchema; } });
+Object.defineProperty(exports, "directoryMembersInput", { enumerable: true, get: function () { return directory_config_1.directoryMembersInput; } });
+Object.defineProperty(exports, "directoryMembersResponse", { enumerable: true, get: function () { return directory_config_1.directoryMembersResponse; } });
+Object.defineProperty(exports, "readDirectoryGroups", { enumerable: true, get: function () { return directory_config_1.readDirectoryGroups; } });
+var directory_manifest_1 = require("./directory-manifest");
+Object.defineProperty(exports, "functionDirectoryManifestSchema", { enumerable: true, get: function () { return directory_manifest_1.functionDirectoryManifestSchema; } });
+var lattice_capability_1 = require("./lattice-capability");
+Object.defineProperty(exports, "functionLatticeContextCapabilitySchema", { enumerable: true, get: function () { return lattice_capability_1.functionLatticeContextCapabilitySchema; } });
+Object.defineProperty(exports, "readFunctionLatticeContextCapability", { enumerable: true, get: function () { return lattice_capability_1.readFunctionLatticeContextCapability; } });
+__exportStar(require("./invocation-contract"), exports);
 var processes_contract_1 = require("./processes-contract");
 Object.defineProperty(exports, "FUNCTION_PROCESS_TOKEN_HEADER", { enumerable: true, get: function () { return processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER; } });
 Object.defineProperty(exports, "FUNCTION_PROCESS_READ_PATH", { enumerable: true, get: function () { return processes_contract_1.FUNCTION_PROCESS_READ_PATH; } });
@@ -9,8 +37,40 @@ Object.defineProperty(exports, "functionProcessReadScopesSchema", { enumerable:
 Object.defineProperty(exports, "readFunctionProcessScopes", { enumerable: true, get: function () { return processes_contract_1.readFunctionProcessScopes; } });
 Object.defineProperty(exports, "functionProcessReadRequestSchema", { enumerable: true, get: function () { return processes_contract_1.functionProcessReadRequestSchema; } });
 Object.defineProperty(exports, "functionProcessRunSummarySchema", { enumerable: true, get: function () { return processes_contract_1.functionProcessRunSummarySchema; } });
+Object.defineProperty(exports, "functionProcessCompletedAgentReferenceSchema", { enumerable: true, get: function () { return processes_contract_1.functionProcessCompletedAgentReferenceSchema; } });
+Object.defineProperty(exports, "functionProcessCompletedAgentReferenceQuerySchema", { enumerable: true, get: function () { return processes_contract_1.functionProcessCompletedAgentReferenceQuerySchema; } });
+var agents_contract_1 = require("./agents-contract");
+Object.defineProperty(exports, "FUNCTION_AGENT_TOKEN_HEADER", { enumerable: true, get: function () { return agents_contract_1.FUNCTION_AGENT_TOKEN_HEADER; } });
+Object.defineProperty(exports, "FUNCTION_AGENT_READ_PATH", { enumerable: true, get: function () { return agents_contract_1.FUNCTION_AGENT_READ_PATH; } });
+Object.defineProperty(exports, "functionAgentReadScopesSchema", { enumerable: true, get: function () { return agents_contract_1.functionAgentReadScopesSchema; } });
+Object.defineProperty(exports, "readFunctionAgentScopes", { enumerable: true, get: function () { return agents_contract_1.readFunctionAgentScopes; } });
+Object.defineProperty(exports, "functionAgentReadRequestSchema", { enumerable: true, get: function () { return agents_contract_1.functionAgentReadRequestSchema; } });
+Object.defineProperty(exports, "functionAgentCompletedRunQuerySchema", { enumerable: true, get: function () { return agents_contract_1.functionAgentCompletedRunQuerySchema; } });
+Object.defineProperty(exports, "functionAgentCompletedRunSchema", { enumerable: true, get: function () { return agents_contract_1.functionAgentCompletedRunSchema; } });
+__exportStar(require("./agent-source-evidence-contract"), exports);
+__exportStar(require("./workflow-source-contract"), exports);
+var workflow_scopes_contract_1 = require("./workflow-scopes-contract");
+Object.defineProperty(exports, "functionWorkflowScopesSchema", { enumerable: true, get: function () { return workflow_scopes_contract_1.functionWorkflowScopesSchema; } });
+Object.defineProperty(exports, "readFunctionWorkflowScopes", { enumerable: true, get: function () { return workflow_scopes_contract_1.readFunctionWorkflowScopes; } });
+Object.defineProperty(exports, "readFunctionWorkflowEvidenceScopes", { enumerable: true, get: function () { return workflow_scopes_contract_1.readFunctionWorkflowEvidenceScopes; } });
+__exportStar(require("./monitoring-events"), exports);
+__exportStar(require("./monitoring-contract"), exports);
+__exportStar(require("./monitoring-annotations"), exports);
+var orm_contract_1 = require("./orm-contract");
+Object.defineProperty(exports, "FUNCTION_CALLER_DATA_TOKEN_HEADER", { enumerable: true, get: function () { return orm_contract_1.FUNCTION_CALLER_DATA_TOKEN_HEADER; } });
+var directory_contract_1 = require("./directory-contract");
+Object.defineProperty(exports, "FUNCTION_DIRECTORY_TOKEN_HEADER", { enumerable: true, get: function () { return directory_contract_1.FUNCTION_DIRECTORY_TOKEN_HEADER; } });
+Object.defineProperty(exports, "FUNCTION_DIRECTORY_RESOLVE_PATH", { enumerable: true, get: function () { return directory_contract_1.FUNCTION_DIRECTORY_RESOLVE_PATH; } });
+Object.defineProperty(exports, "functionDirectoryScopesSchema", { enumerable: true, get: function () { return directory_contract_1.functionDirectoryScopesSchema; } });
+Object.defineProperty(exports, "readFunctionDirectoryScopes", { enumerable: true, get: function () { return directory_contract_1.readFunctionDirectoryScopes; } });
+Object.defineProperty(exports, "directoryPrincipalResolveRequestSchema", { enumerable: true, get: function () { return directory_contract_1.directoryPrincipalResolveRequestSchema; } });
+Object.defineProperty(exports, "directoryPrincipalResolutionSchema", { enumerable: true, get: function () { return directory_contract_1.directoryPrincipalResolutionSchema; } });
+__exportStar(require("./abrigo-contract"), exports);
 var http_tracing_1 = require("./http-tracing");
 Object.defineProperty(exports, "shouldReportAtlasHttp", { enumerable: true, get: function () { return http_tracing_1.shouldReportAtlasHttp; } });
+var immutable_release_contract_1 = require("./immutable-release-contract");
+Object.defineProperty(exports, "functionImmutableReleaseSchema", { enumerable: true, get: function () { return immutable_release_contract_1.functionImmutableReleaseSchema; } });
+Object.defineProperty(exports, "readFunctionImmutableRelease", { enumerable: true, get: function () { return immutable_release_contract_1.readFunctionImmutableRelease; } });
 const zod_1 = require("zod");
 const limits_1 = require("./limits");
 var limits_2 = require("./limits");
@@ -25,6 +85,7 @@ Object.defineProperty(exports, "MANAGED_FUNCTION_SDK_PACKAGE", { enumerable: tru
 Object.defineProperty(exports, "formatValidationDetail", { enumerable: true, get: function () { return capabilities_1.formatValidationDetail; } });
 Object.defineProperty(exports, "isPostgresEgress", { enumerable: true, get: function () { return capabilities_1.isPostgresEgress; } });
 Object.defineProperty(exports, "sdkVersionFromPackageJson", { enumerable: true, get: function () { return capabilities_1.sdkVersionFromPackageJson; } });
+Object.defineProperty(exports, "sdkSpecFromPackageJson", { enumerable: true, get: function () { return capabilities_1.sdkSpecFromPackageJson; } });
 Object.defineProperty(exports, "sdkVersionLowerBound", { enumerable: true, get: function () { return capabilities_1.sdkVersionLowerBound; } });
 Object.defineProperty(exports, "versionIsOlder", { enumerable: true, get: function () { return capabilities_1.versionIsOlder; } });
 var deployed_policy_1 = require("./deployed-policy");

package/dist/deployed-policy.js

@@ -38,13 +38,87 @@ function normalizeCapabilities(value) {
     return {
         tooling: value.tooling,
         features: {
+            immutable_release: normalizeImmutableRelease(features.immutable_release),
+            invocation_identity: normalizeInvocationIdentity(features.invocation_identity),
+            directory_members: normalizeDirectoryMembers(features.directory_members),
+            directory_resolve: normalizeDirectory(features.directory_resolve),
+            abrigo_read: normalizeAbrigo(features.abrigo_read),
+            lattice_context: normalizeLatticeContext(features.lattice_context),
             postgres_egress: normalizePostgres(features.postgres_egress),
             http_headers: normalizeHeaders(features.http_headers),
             invoke_timeout: normalizeTimeout(features.invoke_timeout),
             processes_read: normalizeProcesses(features.processes_read),
+            agents_read: normalizeAgents(features.agents_read),
+            agents_evidence_verify: normalizeAgentEvidence(features.agents_evidence_verify),
+            workflows_read: normalizeWorkflowRead(features.workflows_read),
+            workflows_evidence_verify: normalizeWorkflowEvidence(features.workflows_evidence_verify),
+            monitoring_deliveries: normalizeMonitoring(features.monitoring_deliveries),
         },
     };
 }
+function normalizeImmutableRelease(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
+        return undefined;
+    if (typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return {
+        field: typeof value.field === 'string' ? value.field : 'function.immutable_release',
+        supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk,
+    };
+}
+function normalizeDirectoryMembers(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
+        return undefined;
+    if (typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return {
+        field: typeof value.field === 'string' ? value.field : 'capabilities.directory.groups',
+        supported: value.supported,
+        limit: value.limit,
+        min_cli: value.min_cli,
+        min_sdk: value.min_sdk,
+    };
+}
+function normalizeDirectory(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string' || typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return { field: typeof value.field === 'string' ? value.field : 'capabilities.directory.resolve', supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk };
+}
+function normalizeAbrigo(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string' || typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return { field: typeof value.field === 'string' ? value.field : 'capabilities.abrigo.read', supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk };
+}
+function normalizeInvocationIdentity(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
+        return undefined;
+    if (typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return {
+        field: typeof value.field === 'string' ? value.field : 'capabilities.invocation.identity',
+        supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk,
+    };
+}
+function normalizeLatticeContext(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
+        return undefined;
+    if (typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return {
+        field: typeof value.field === 'string' ? value.field : 'capabilities.lattice.context',
+        supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk,
+    };
+}
+function normalizeMonitoring(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
+        return undefined;
+    if (typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return {
+        field: typeof value.field === 'string' ? value.field : 'capabilities.monitoring.producers',
+        supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk,
+    };
+}
 function normalizeProcesses(value) {
     if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
         return undefined;
@@ -58,6 +132,34 @@ function normalizeProcesses(value) {
         min_sdk: value.min_sdk,
     };
 }
+function normalizeAgents(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
+        return undefined;
+    if (typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return { field: typeof value.field === 'string' ? value.field : 'capabilities.agents.read', supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk };
+}
+function normalizeAgentEvidence(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
+        return undefined;
+    if (typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return { field: typeof value.field === 'string' ? value.field : 'capabilities.agents.evidence', supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk };
+}
+function normalizeWorkflowRead(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
+        return undefined;
+    if (typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return { field: typeof value.field === 'string' ? value.field : 'capabilities.workflows.read', supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk };
+}
+function normalizeWorkflowEvidence(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
+        return undefined;
+    if (typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return { field: typeof value.field === 'string' ? value.field : 'capabilities.workflows.evidence', supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk };
+}
 function normalizePostgres(value) {
     if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
         return undefined;

package/dist/directory-config.d.ts

@@ -0,0 +1,23 @@
+import { z } from 'zod';
+export declare const DIRECTORY_TOKEN_HEADER = "x-sequence-directory-token";
+export declare const directoryGroupIdSchema: z.ZodString;
+export declare const directoryScopesSchema: z.ZodObject<{
+    groups: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export declare const directoryMembersInput: z.ZodUnion<readonly [z.ZodObject<{
+    groupId: z.ZodString;
+    userIds: z.ZodArray<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    groupId: z.ZodString;
+    subs: z.ZodArray<z.ZodString>;
+}, z.core.$strict>]>;
+export declare const directoryMembersResponse: z.ZodObject<{
+    members: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        sub: z.ZodString;
+        name: z.ZodString;
+        email: z.ZodString;
+        deactivated: z.ZodLiteral<false>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare function readDirectoryGroups(manifest: unknown): string[];

package/dist/directory-config.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.directoryMembersResponse = exports.directoryMembersInput = exports.directoryScopesSchema = exports.directoryGroupIdSchema = exports.DIRECTORY_TOKEN_HEADER = void 0;
+exports.readDirectoryGroups = readDirectoryGroups;
+const zod_1 = require("zod");
+exports.DIRECTORY_TOKEN_HEADER = 'x-sequence-directory-token';
+exports.directoryGroupIdSchema = zod_1.z.string().regex(/^(?:[a-f0-9]{24}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})$/i);
+exports.directoryScopesSchema = zod_1.z.object({
+    groups: zod_1.z.array(exports.directoryGroupIdSchema).min(1).max(16),
+}).strict();
+const identity = zod_1.z.string().min(1).max(256).regex(/^[^\x00-\x1f\x7f]+$/);
+exports.directoryMembersInput = zod_1.z.union([
+    zod_1.z.object({ groupId: exports.directoryGroupIdSchema, userIds: zod_1.z.array(identity).min(1).max(50) }).strict(),
+    zod_1.z.object({ groupId: exports.directoryGroupIdSchema, subs: zod_1.z.array(identity).min(1).max(50) }).strict(),
+]);
+exports.directoryMembersResponse = zod_1.z.object({ members: zod_1.z.array(zod_1.z.object({
+        id: zod_1.z.string(), sub: identity, name: zod_1.z.string(), email: zod_1.z.string(), deactivated: zod_1.z.literal(false),
+    }).strict()).max(50) }).strict();
+function readDirectoryGroups(manifest) {
+    const parsed = zod_1.z.object({ capabilities: zod_1.z.object({ directory: zod_1.z.object({ groups: exports.directoryScopesSchema.shape.groups.optional() }).optional() }).optional() }).safeParse(manifest);
+    return parsed.success ? parsed.data.capabilities?.directory?.groups ?? [] : [];
+}

package/dist/directory-contract.d.ts

@@ -0,0 +1,68 @@
+import { z } from 'zod';
+export declare const FUNCTION_DIRECTORY_TOKEN_HEADER = "x-sequence-directory-service-token";
+export declare const FUNCTION_DIRECTORY_RESOLVE_PATH = "/api/managed-functions/directory/resolve";
+export declare const DIRECTORY_PRINCIPALS_PER_REQUEST = 50;
+export declare const directoryTenantSchema: z.ZodString;
+export declare const directoryPrincipalLookupSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"email">;
+    value: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"sub">;
+    value: z.ZodString;
+}, z.core.$strict>], "type">;
+export type DirectoryPrincipalLookup = z.infer<typeof directoryPrincipalLookupSchema>;
+export declare const directoryPrincipalResolveRequestSchema: z.ZodObject<{
+    tenant: z.ZodString;
+    lookups: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"email">;
+        value: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"sub">;
+        value: z.ZodString;
+    }, z.core.$strict>], "type">>;
+}, z.core.$strict>;
+export type DirectoryPrincipalResolveRequest = z.infer<typeof directoryPrincipalResolveRequestSchema>;
+export declare const directoryResolvedPrincipalSchema: z.ZodObject<{
+    lookup: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"email">;
+        value: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"sub">;
+        value: z.ZodString;
+    }, z.core.$strict>], "type">;
+    sub: z.ZodString;
+    email: z.ZodUnion<readonly [z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>, z.ZodLiteral<"">]>;
+    name: z.ZodString;
+}, z.core.$strict>;
+export declare const directoryPrincipalResolutionSchema: z.ZodObject<{
+    resolved: z.ZodArray<z.ZodObject<{
+        lookup: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"email">;
+            value: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"sub">;
+            value: z.ZodString;
+        }, z.core.$strict>], "type">;
+        sub: z.ZodString;
+        email: z.ZodUnion<readonly [z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>, z.ZodLiteral<"">]>;
+        name: z.ZodString;
+    }, z.core.$strict>>;
+    unresolved: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"email">;
+        value: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"sub">;
+        value: z.ZodString;
+    }, z.core.$strict>], "type">>;
+}, z.core.$strict>;
+export type DirectoryPrincipalResolution = z.infer<typeof directoryPrincipalResolutionSchema>;
+export declare const functionDirectoryScopesSchema: z.ZodObject<{
+    resolve: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export declare function readFunctionDirectoryScopes(manifest: unknown): string[];
+export declare class DirectoryPrincipalResolveError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly name = "DirectoryPrincipalResolveError";
+    constructor(status: number, code: string, message: string);
+}

package/dist/directory-contract.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DirectoryPrincipalResolveError = exports.functionDirectoryScopesSchema = exports.directoryPrincipalResolutionSchema = exports.directoryResolvedPrincipalSchema = exports.directoryPrincipalResolveRequestSchema = exports.directoryPrincipalLookupSchema = exports.directoryTenantSchema = exports.DIRECTORY_PRINCIPALS_PER_REQUEST = exports.FUNCTION_DIRECTORY_RESOLVE_PATH = exports.FUNCTION_DIRECTORY_TOKEN_HEADER = void 0;
+exports.readFunctionDirectoryScopes = readFunctionDirectoryScopes;
+const zod_1 = require("zod");
+exports.FUNCTION_DIRECTORY_TOKEN_HEADER = 'x-sequence-directory-service-token';
+exports.FUNCTION_DIRECTORY_RESOLVE_PATH = '/api/managed-functions/directory/resolve';
+exports.DIRECTORY_PRINCIPALS_PER_REQUEST = 50;
+exports.directoryTenantSchema = zod_1.z.string().min(1).max(32).regex(/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/);
+const subject = zod_1.z.string().min(3).max(255).regex(/^[^\s:#]+\|[^\s:#]+$/);
+const email = zod_1.z.email().max(255).transform((value) => value.trim().toLowerCase());
+exports.directoryPrincipalLookupSchema = zod_1.z.discriminatedUnion('type', [
+    zod_1.z.strictObject({ type: zod_1.z.literal('email'), value: email }),
+    zod_1.z.strictObject({ type: zod_1.z.literal('sub'), value: subject }),
+]);
+exports.directoryPrincipalResolveRequestSchema = zod_1.z.strictObject({
+    tenant: exports.directoryTenantSchema,
+    lookups: zod_1.z.array(exports.directoryPrincipalLookupSchema).min(1).max(exports.DIRECTORY_PRINCIPALS_PER_REQUEST)
+        .refine((values) => new Set(values.map((value) => `${value.type}:${value.value}`)).size === values.length, 'Lookups must be distinct'),
+});
+exports.directoryResolvedPrincipalSchema = zod_1.z.strictObject({
+    lookup: exports.directoryPrincipalLookupSchema,
+    sub: subject.refine((value) => !value.startsWith('service-account|') && !value.startsWith('managed-function|') && !value.endsWith('@clients') && value !== 'google-apps|sequence.agent@seqholdings.com', 'Only human directory principals can resolve'),
+    email: zod_1.z.union([email, zod_1.z.literal('')]),
+    name: zod_1.z.string().max(255),
+});
+exports.directoryPrincipalResolutionSchema = zod_1.z.strictObject({
+    resolved: zod_1.z.array(exports.directoryResolvedPrincipalSchema).max(exports.DIRECTORY_PRINCIPALS_PER_REQUEST),
+    unresolved: zod_1.z.array(exports.directoryPrincipalLookupSchema).max(exports.DIRECTORY_PRINCIPALS_PER_REQUEST),
+});
+exports.functionDirectoryScopesSchema = zod_1.z.strictObject({
+    resolve: zod_1.z.array(exports.directoryTenantSchema).min(1).max(16)
+        .refine((values) => new Set(values).size === values.length, 'Tenant scopes must be distinct'),
+});
+function readFunctionDirectoryScopes(manifest) {
+    if (typeof manifest !== 'object' || manifest === null)
+        return [];
+    const capabilities = Reflect.get(manifest, 'capabilities');
+    if (typeof capabilities !== 'object' || capabilities === null)
+        return [];
+    const directory = Reflect.get(capabilities, 'directory');
+    if (typeof directory !== 'object' || directory === null)
+        return [];
+    const resolve = Reflect.get(directory, 'resolve');
+    return resolve === undefined ? [] : exports.functionDirectoryScopesSchema.parse({ resolve }).resolve;
+}
+class DirectoryPrincipalResolveError extends Error {
+    status;
+    code;
+    name = 'DirectoryPrincipalResolveError';
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+exports.DirectoryPrincipalResolveError = DirectoryPrincipalResolveError;

package/dist/directory-manifest.d.ts

@@ -0,0 +1,5 @@
+import { z } from 'zod';
+export declare const functionDirectoryManifestSchema: z.ZodObject<{
+    groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    resolve: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;

package/dist/directory-manifest.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.functionDirectoryManifestSchema = void 0;
+const zod_1 = require("zod");
+const directory_config_1 = require("./directory-config");
+const directory_contract_1 = require("./directory-contract");
+exports.functionDirectoryManifestSchema = zod_1.z.strictObject({
+    groups: directory_config_1.directoryScopesSchema.shape.groups.optional(),
+    resolve: directory_contract_1.functionDirectoryScopesSchema.shape.resolve.optional(),
+}).refine((value) => value.groups !== undefined || value.resolve !== undefined, 'Declare directory groups, tenant resolution scopes, or both');

package/dist/directory.d.ts

@@ -0,0 +1,15 @@
+import { z } from 'zod';
+import { directoryMembersInput, directoryMembersResponse } from './directory-config';
+import { type FunctionInvocationClientOptions } from './invocation-client';
+export type FunctionDirectoryOptions = FunctionInvocationClientOptions;
+export type FunctionDirectoryMembersQuery = z.infer<typeof directoryMembersInput>;
+export type FunctionDirectoryMembers = z.infer<typeof directoryMembersResponse>;
+export interface FunctionDirectoryClient {
+    resolveMembers(input: FunctionDirectoryMembersQuery): Promise<FunctionDirectoryMembers>;
+}
+export declare class FunctionDirectoryReadError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+export declare function createFunctionDirectoryClient({ request, baseUrl, fetchImpl, }: FunctionDirectoryOptions): FunctionDirectoryClient;

package/dist/directory.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FunctionDirectoryReadError = void 0;
+exports.createFunctionDirectoryClient = createFunctionDirectoryClient;
+const zod_1 = require("zod");
+const directory_config_1 = require("./directory-config");
+const invocation_client_1 = require("./invocation-client");
+class FunctionDirectoryReadError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'FunctionDirectoryReadError';
+    }
+}
+exports.FunctionDirectoryReadError = FunctionDirectoryReadError;
+function createFunctionDirectoryClient({ request, baseUrl, fetchImpl, }) {
+    const credential = (0, invocation_client_1.readInvocationCredential)({
+        request,
+        header: directory_config_1.DIRECTORY_TOKEN_HEADER,
+        maxBytes: 8192,
+        invalidContext: () => new FunctionDirectoryReadError(401, 'invalid_context', 'This invocation has no valid directory-read credential'),
+        claimsSchema: zod_1.z.object({
+            audience: zod_1.z.literal('atlas-function-group-directory-v1'),
+            sub: zod_1.z
+                .string()
+                .min(1)
+                .max(256)
+                .refine((sub) => sub.includes('|') &&
+                !sub.startsWith('service-account|') &&
+                !sub.endsWith('@clients')),
+            functionId: zod_1.z.string().min(1),
+            invocationId: zod_1.z.string().min(1),
+            exp: zod_1.z.number().int(),
+        }),
+    });
+    const read = (0, invocation_client_1.createInvocationReadTransport)({
+        baseUrl,
+        fetchImpl,
+        path: '/api/managed-functions/directory/members',
+        header: directory_config_1.DIRECTORY_TOKEN_HEADER,
+        credential,
+        timeoutMs: 10_000,
+        error: (status, code, message) => new FunctionDirectoryReadError(status, code, message),
+        failure: {
+            code: 'directory_read_failed',
+            message: 'Directory read failed',
+        },
+    });
+    return {
+        async resolveMembers(input) {
+            const body = directory_config_1.directoryMembersInput.parse(input);
+            const result = await read({ body, schema: directory_config_1.directoryMembersResponse });
+            const selectors = new Set('userIds' in body ? body.userIds : body.subs);
+            const returned = result.members.map((member) => 'userIds' in body ? member.id : member.sub);
+            if (new Set(returned).size !== returned.length ||
+                returned.some((value) => !selectors.has(value))) {
+                throw new FunctionDirectoryReadError(502, 'malformed_response', 'Atlas returned duplicate or unrequested directory members');
+            }
+            return result;
+        },
+    };
+}

package/dist/http-tracing.js

@@ -20,5 +20,8 @@ function shouldReportAtlasHttp(pathname, method) {
     if (method === 'POST' &&
         /^\/api\/lattice\/(runs|processes\/[^/]+\/runs)\/?$/.test(pathname))
         return false;
+    if (method === 'POST' &&
+        /^\/api\/external-systems\/call\/?$/.test(pathname))
+        return false;
     return true;
 }

package/dist/immutable-release-contract.d.ts

@@ -0,0 +1,3 @@
+import { z } from 'zod';
+export declare const functionImmutableReleaseSchema: z.ZodBoolean;
+export declare function readFunctionImmutableRelease(manifest: unknown): boolean;