@sequenceholdings/managed-functions 0.4.0 → 0.4.2

package/dist/immutable-release-contract.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.functionImmutableReleaseSchema = void 0;
+exports.readFunctionImmutableRelease = readFunctionImmutableRelease;
+const zod_1 = require("zod");
+exports.functionImmutableReleaseSchema = zod_1.z.boolean();
+function readFunctionImmutableRelease(manifest) {
+    if (typeof manifest !== 'object' || manifest === null)
+        return false;
+    const fn = Reflect.get(manifest, 'function');
+    return typeof fn === 'object' && fn !== null && Reflect.get(fn, 'immutable_release') === true;
+}

package/dist/index.d.ts

@@ -1,5 +1,42 @@
+export { createFunctionDirectoryClient, FunctionDirectoryReadError } from './directory';
+export type { FunctionDirectoryClient, FunctionDirectoryOptions, FunctionDirectoryMembers, FunctionDirectoryMembersQuery } from './directory';
+export type { FunctionInvocationClientOptions } from './invocation-client';
+export { functionLatticeContextCapabilitySchema, readFunctionLatticeContextCapability } from './lattice-capability';
+export { createFunctionLatticeClient } from './lattice-provenance';
+export { functionLatticeParallelSnapshotSchema, functionLatticeParallelSnapshotQuerySchema } from './lattice-provenance-contract';
+export type { FunctionLatticeParallelSnapshot, FunctionLatticeParallelSnapshotQuery } from './lattice-provenance-contract';
+export { functionLatticeStartProvenanceSchema } from './lattice-provenance-contract';
+export type { FunctionLatticeStartProvenance } from './lattice-provenance-contract';
+export * from './invocation-contract';
+export * from './abrigo';
+export { createFunctionInvocationClient } from './invocation';
+export type { FunctionInvocationClient } from './invocation';
+export { FUNCTION_LATTICE_CONTEXT_PATH, FUNCTION_LATTICE_EXECUTION_TOKEN_HEADER, FunctionLatticeContextError, functionLatticeContextRequestSchema, functionLatticeExecutionContextSchema, functionLatticeHumanCompletionQuerySchema, functionLatticeHumanCompletionSchema } from './lattice-provenance-contract';
+export type { FunctionLatticeClient, FunctionLatticeClientOptions } from './lattice-provenance';
+export { functionLatticeHumanCompletionsQuerySchema, functionLatticeHumanCompletionsPageSchema } from './lattice-provenance-contract';
+export type { FunctionLatticeHumanCompletionsQuery, FunctionLatticeHumanCompletionsPage } from './lattice-provenance-contract';
+export type { FunctionLatticeContextRequest, FunctionLatticeExecutionContext, FunctionLatticeHumanCompletion, FunctionLatticeHumanCompletionQuery } from './lattice-provenance-contract';
 export { createFunctionServiceProcessesClient, FunctionProcessReadError } from './processes';
-export type { FunctionServiceProcessesClient, FunctionServiceProcessesOptions, FunctionProcessRunQuery, FunctionProcessRunSummary, FunctionProcessRunStatus, FunctionProcessRunsPage, FunctionProcessRunsPageQuery, FunctionProcessReadRequest } from './processes';
+export { createFunctionServiceAgentsClient, FunctionAgentReadError } from './agents';
+export { createFunctionAgentEvidenceClient } from './agent-evidence';
+export { createFunctionServiceWorkflowsClient, createFunctionWorkflowEvidenceClient } from './workflow-source';
+export type { FunctionServiceWorkflowsClient, FunctionServiceWorkflowsOptions, FunctionWorkflowEvidenceClient, FunctionWorkflowSourceEvidenceInput } from './workflow-source';
+export * from './workflow-source-contract';
+export type { FunctionAgentEvidenceClient, FunctionAgentSourceEvidenceInput, FunctionAgentConversationEvidenceInput } from './agent-evidence';
+export type { FunctionAgentSourceEvidenceCapture, FunctionAgentSourceEvidenceClaims, FunctionAgentSourceEvidenceVerification, FunctionAgentConversationResponse, FunctionAgentConversationEvidenceResponse, FunctionAgentConversationEvidenceCapture, FunctionAgentSourceExecution } from './agent-source-evidence-contract';
+export { functionAgentSourceResponseSchema, functionAgentSourceEvidenceRequestSchema, functionAgentSourceEvidenceCaptureSchema, functionAgentConversationEvidenceResponseSchema, functionAgentConversationEvidenceCaptureSchema, functionAgentConversationEvidenceRequestSchema, functionAgentSourceExecutionSchema } from './agent-source-evidence-contract';
+export { functionSourceJobAdmissionSchema } from './agent-source-evidence-contract';
+export type { FunctionSourceJobAdmission } from './agent-source-evidence-contract';
+export type { FunctionServiceAgentsClient, FunctionServiceAgentsOptions, FunctionAgentCompletedRunQuery, FunctionAgentCompletedRun } from './agents';
+export { createFunctionServiceMonitoringClient } from './monitoring';
+export { FunctionMonitoringError, monitoringPayloadHash } from './monitoring-contract';
+export { monitoringEventsSchema, monitoringPublishSchema } from './monitoring-contract';
+export { functionMonitoringAnnotationSchema } from './monitoring-annotations';
+export type { MonitoringDeltaEvent, MonitoringPublish, MonitoringDeliveryKey, MonitoringDeliveryReceipt } from './monitoring-contract';
+export type { MonitoringCatalogQuery, MonitoringBucketCatalog } from './monitoring-contract';
+export type { FunctionMonitoringAnnotation, MonitoringJson } from './monitoring-annotations';
+export type { FunctionServiceMonitoringClient, FunctionServiceMonitoringOptions } from './monitoring';
+export type { FunctionServiceProcessesClient, FunctionServiceProcessesOptions, FunctionProcessRunQuery, FunctionProcessRunSummary, FunctionProcessRunStatus, FunctionProcessRunsPage, FunctionProcessRunsPageQuery, FunctionProcessReadRequest, FunctionProcessCompletedAgentReferenceQuery, FunctionProcessCompletedAgentReference } from './processes';
 export { installFunctionTracing, runWithFunctionTracing } from './tracing';
 export { createFunctionStorageClient } from './storage';
 import { type CacheManager } from "./cache";
@@ -13,3 +50,5 @@ export interface ManagedFunctionContext {
 export declare function createManagedFunctionContext({ env, }?: {
     env?: NodeJS.ProcessEnv;
 }): ManagedFunctionContext;
+export * from './directory-contract';
+export { createFunctionServiceDirectoryClient, type FunctionServiceDirectoryOptions, type FunctionServiceDirectoryClient } from './service-directory';

package/dist/index.js

@@ -1,10 +1,81 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.readCacheConfiguration = exports.cacheManifestSchema = exports.createCacheManager = exports.CacheError = exports.createFunctionStorageClient = exports.runWithFunctionTracing = exports.installFunctionTracing = exports.FunctionProcessReadError = exports.createFunctionServiceProcessesClient = void 0;
+exports.createFunctionServiceDirectoryClient = exports.readCacheConfiguration = exports.cacheManifestSchema = exports.createCacheManager = exports.CacheError = exports.createFunctionStorageClient = exports.runWithFunctionTracing = exports.installFunctionTracing = exports.functionMonitoringAnnotationSchema = exports.monitoringPublishSchema = exports.monitoringEventsSchema = exports.monitoringPayloadHash = exports.FunctionMonitoringError = exports.createFunctionServiceMonitoringClient = exports.functionSourceJobAdmissionSchema = exports.functionAgentSourceExecutionSchema = exports.functionAgentConversationEvidenceRequestSchema = exports.functionAgentConversationEvidenceCaptureSchema = exports.functionAgentConversationEvidenceResponseSchema = exports.functionAgentSourceEvidenceCaptureSchema = exports.functionAgentSourceEvidenceRequestSchema = exports.functionAgentSourceResponseSchema = exports.createFunctionWorkflowEvidenceClient = exports.createFunctionServiceWorkflowsClient = exports.createFunctionAgentEvidenceClient = exports.FunctionAgentReadError = exports.createFunctionServiceAgentsClient = exports.FunctionProcessReadError = exports.createFunctionServiceProcessesClient = exports.functionLatticeHumanCompletionsPageSchema = exports.functionLatticeHumanCompletionsQuerySchema = exports.functionLatticeHumanCompletionSchema = exports.functionLatticeHumanCompletionQuerySchema = exports.functionLatticeExecutionContextSchema = exports.functionLatticeContextRequestSchema = exports.FunctionLatticeContextError = exports.FUNCTION_LATTICE_EXECUTION_TOKEN_HEADER = exports.FUNCTION_LATTICE_CONTEXT_PATH = exports.createFunctionInvocationClient = exports.functionLatticeStartProvenanceSchema = exports.functionLatticeParallelSnapshotQuerySchema = exports.functionLatticeParallelSnapshotSchema = exports.createFunctionLatticeClient = exports.readFunctionLatticeContextCapability = exports.functionLatticeContextCapabilitySchema = exports.FunctionDirectoryReadError = exports.createFunctionDirectoryClient = void 0;
 exports.createManagedFunctionContext = createManagedFunctionContext;
+var directory_1 = require("./directory");
+Object.defineProperty(exports, "createFunctionDirectoryClient", { enumerable: true, get: function () { return directory_1.createFunctionDirectoryClient; } });
+Object.defineProperty(exports, "FunctionDirectoryReadError", { enumerable: true, get: function () { return directory_1.FunctionDirectoryReadError; } });
+var lattice_capability_1 = require("./lattice-capability");
+Object.defineProperty(exports, "functionLatticeContextCapabilitySchema", { enumerable: true, get: function () { return lattice_capability_1.functionLatticeContextCapabilitySchema; } });
+Object.defineProperty(exports, "readFunctionLatticeContextCapability", { enumerable: true, get: function () { return lattice_capability_1.readFunctionLatticeContextCapability; } });
+var lattice_provenance_1 = require("./lattice-provenance");
+Object.defineProperty(exports, "createFunctionLatticeClient", { enumerable: true, get: function () { return lattice_provenance_1.createFunctionLatticeClient; } });
+var lattice_provenance_contract_1 = require("./lattice-provenance-contract");
+Object.defineProperty(exports, "functionLatticeParallelSnapshotSchema", { enumerable: true, get: function () { return lattice_provenance_contract_1.functionLatticeParallelSnapshotSchema; } });
+Object.defineProperty(exports, "functionLatticeParallelSnapshotQuerySchema", { enumerable: true, get: function () { return lattice_provenance_contract_1.functionLatticeParallelSnapshotQuerySchema; } });
+var lattice_provenance_contract_2 = require("./lattice-provenance-contract");
+Object.defineProperty(exports, "functionLatticeStartProvenanceSchema", { enumerable: true, get: function () { return lattice_provenance_contract_2.functionLatticeStartProvenanceSchema; } });
+__exportStar(require("./invocation-contract"), exports);
+__exportStar(require("./abrigo"), exports);
+var invocation_1 = require("./invocation");
+Object.defineProperty(exports, "createFunctionInvocationClient", { enumerable: true, get: function () { return invocation_1.createFunctionInvocationClient; } });
+var lattice_provenance_contract_3 = require("./lattice-provenance-contract");
+Object.defineProperty(exports, "FUNCTION_LATTICE_CONTEXT_PATH", { enumerable: true, get: function () { return lattice_provenance_contract_3.FUNCTION_LATTICE_CONTEXT_PATH; } });
+Object.defineProperty(exports, "FUNCTION_LATTICE_EXECUTION_TOKEN_HEADER", { enumerable: true, get: function () { return lattice_provenance_contract_3.FUNCTION_LATTICE_EXECUTION_TOKEN_HEADER; } });
+Object.defineProperty(exports, "FunctionLatticeContextError", { enumerable: true, get: function () { return lattice_provenance_contract_3.FunctionLatticeContextError; } });
+Object.defineProperty(exports, "functionLatticeContextRequestSchema", { enumerable: true, get: function () { return lattice_provenance_contract_3.functionLatticeContextRequestSchema; } });
+Object.defineProperty(exports, "functionLatticeExecutionContextSchema", { enumerable: true, get: function () { return lattice_provenance_contract_3.functionLatticeExecutionContextSchema; } });
+Object.defineProperty(exports, "functionLatticeHumanCompletionQuerySchema", { enumerable: true, get: function () { return lattice_provenance_contract_3.functionLatticeHumanCompletionQuerySchema; } });
+Object.defineProperty(exports, "functionLatticeHumanCompletionSchema", { enumerable: true, get: function () { return lattice_provenance_contract_3.functionLatticeHumanCompletionSchema; } });
+var lattice_provenance_contract_4 = require("./lattice-provenance-contract");
+Object.defineProperty(exports, "functionLatticeHumanCompletionsQuerySchema", { enumerable: true, get: function () { return lattice_provenance_contract_4.functionLatticeHumanCompletionsQuerySchema; } });
+Object.defineProperty(exports, "functionLatticeHumanCompletionsPageSchema", { enumerable: true, get: function () { return lattice_provenance_contract_4.functionLatticeHumanCompletionsPageSchema; } });
 var processes_1 = require("./processes");
 Object.defineProperty(exports, "createFunctionServiceProcessesClient", { enumerable: true, get: function () { return processes_1.createFunctionServiceProcessesClient; } });
 Object.defineProperty(exports, "FunctionProcessReadError", { enumerable: true, get: function () { return processes_1.FunctionProcessReadError; } });
+var agents_1 = require("./agents");
+Object.defineProperty(exports, "createFunctionServiceAgentsClient", { enumerable: true, get: function () { return agents_1.createFunctionServiceAgentsClient; } });
+Object.defineProperty(exports, "FunctionAgentReadError", { enumerable: true, get: function () { return agents_1.FunctionAgentReadError; } });
+var agent_evidence_1 = require("./agent-evidence");
+Object.defineProperty(exports, "createFunctionAgentEvidenceClient", { enumerable: true, get: function () { return agent_evidence_1.createFunctionAgentEvidenceClient; } });
+var workflow_source_1 = require("./workflow-source");
+Object.defineProperty(exports, "createFunctionServiceWorkflowsClient", { enumerable: true, get: function () { return workflow_source_1.createFunctionServiceWorkflowsClient; } });
+Object.defineProperty(exports, "createFunctionWorkflowEvidenceClient", { enumerable: true, get: function () { return workflow_source_1.createFunctionWorkflowEvidenceClient; } });
+__exportStar(require("./workflow-source-contract"), exports);
+var agent_source_evidence_contract_1 = require("./agent-source-evidence-contract");
+Object.defineProperty(exports, "functionAgentSourceResponseSchema", { enumerable: true, get: function () { return agent_source_evidence_contract_1.functionAgentSourceResponseSchema; } });
+Object.defineProperty(exports, "functionAgentSourceEvidenceRequestSchema", { enumerable: true, get: function () { return agent_source_evidence_contract_1.functionAgentSourceEvidenceRequestSchema; } });
+Object.defineProperty(exports, "functionAgentSourceEvidenceCaptureSchema", { enumerable: true, get: function () { return agent_source_evidence_contract_1.functionAgentSourceEvidenceCaptureSchema; } });
+Object.defineProperty(exports, "functionAgentConversationEvidenceResponseSchema", { enumerable: true, get: function () { return agent_source_evidence_contract_1.functionAgentConversationEvidenceResponseSchema; } });
+Object.defineProperty(exports, "functionAgentConversationEvidenceCaptureSchema", { enumerable: true, get: function () { return agent_source_evidence_contract_1.functionAgentConversationEvidenceCaptureSchema; } });
+Object.defineProperty(exports, "functionAgentConversationEvidenceRequestSchema", { enumerable: true, get: function () { return agent_source_evidence_contract_1.functionAgentConversationEvidenceRequestSchema; } });
+Object.defineProperty(exports, "functionAgentSourceExecutionSchema", { enumerable: true, get: function () { return agent_source_evidence_contract_1.functionAgentSourceExecutionSchema; } });
+var agent_source_evidence_contract_2 = require("./agent-source-evidence-contract");
+Object.defineProperty(exports, "functionSourceJobAdmissionSchema", { enumerable: true, get: function () { return agent_source_evidence_contract_2.functionSourceJobAdmissionSchema; } });
+var monitoring_1 = require("./monitoring");
+Object.defineProperty(exports, "createFunctionServiceMonitoringClient", { enumerable: true, get: function () { return monitoring_1.createFunctionServiceMonitoringClient; } });
+var monitoring_contract_1 = require("./monitoring-contract");
+Object.defineProperty(exports, "FunctionMonitoringError", { enumerable: true, get: function () { return monitoring_contract_1.FunctionMonitoringError; } });
+Object.defineProperty(exports, "monitoringPayloadHash", { enumerable: true, get: function () { return monitoring_contract_1.monitoringPayloadHash; } });
+var monitoring_contract_2 = require("./monitoring-contract");
+Object.defineProperty(exports, "monitoringEventsSchema", { enumerable: true, get: function () { return monitoring_contract_2.monitoringEventsSchema; } });
+Object.defineProperty(exports, "monitoringPublishSchema", { enumerable: true, get: function () { return monitoring_contract_2.monitoringPublishSchema; } });
+var monitoring_annotations_1 = require("./monitoring-annotations");
+Object.defineProperty(exports, "functionMonitoringAnnotationSchema", { enumerable: true, get: function () { return monitoring_annotations_1.functionMonitoringAnnotationSchema; } });
 var tracing_1 = require("./tracing");
 Object.defineProperty(exports, "installFunctionTracing", { enumerable: true, get: function () { return tracing_1.installFunctionTracing; } });
 Object.defineProperty(exports, "runWithFunctionTracing", { enumerable: true, get: function () { return tracing_1.runWithFunctionTracing; } });
@@ -65,3 +136,6 @@ function lazyValkeyStore(connection, local) {
         delete: async (key) => (await client()).delete(key),
     };
 }
+__exportStar(require("./directory-contract"), exports);
+var service_directory_1 = require("./service-directory");
+Object.defineProperty(exports, "createFunctionServiceDirectoryClient", { enumerable: true, get: function () { return service_directory_1.createFunctionServiceDirectoryClient; } });

package/dist/invocation-client.d.ts

@@ -0,0 +1,45 @@
+import { z } from 'zod';
+export interface FunctionInvocationClientOptions {
+    request: {
+        headers: Pick<Headers, 'get'> | Readonly<Record<string, string | readonly string[] | undefined>>;
+    };
+    baseUrl: string;
+    fetchImpl?: typeof globalThis.fetch;
+}
+type ClientErrorFactory = (status: number, code: string, message: string) => Error;
+export declare function readInvocationCredential<T extends {
+    exp: number;
+}>({ request, header, maxBytes, claimsSchema, invalidContext, }: Pick<FunctionInvocationClientOptions, 'request'> & {
+    header: string;
+    maxBytes: number;
+    claimsSchema: z.ZodType<T>;
+    invalidContext: () => Error;
+}): {
+    token: string;
+    expiresAt: number;
+};
+export declare function createInvocationReadTransport({ baseUrl, fetchImpl, path, header, credential, additionalCredentials, timeoutMs, error, failure, }: Pick<FunctionInvocationClientOptions, 'baseUrl' | 'fetchImpl'> & {
+    path: string;
+    header: string;
+    credential: {
+        token: string;
+        expiresAt: number;
+    };
+    additionalCredentials?: readonly {
+        header: string;
+        credential: {
+            token: string;
+            expiresAt: number;
+        };
+    }[];
+    timeoutMs: number;
+    error: ClientErrorFactory;
+    failure: {
+        code: string;
+        message: string;
+    };
+}): <T>({ body, schema, }: {
+    body: unknown;
+    schema: z.ZodType<T>;
+}) => Promise<T>;
+export {};

package/dist/invocation-client.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readInvocationCredential = readInvocationCredential;
+exports.createInvocationReadTransport = createInvocationReadTransport;
+const zod_1 = require("zod");
+function readInvocationCredential({ request, header, maxBytes, claimsSchema, invalidContext, }) {
+    const { headers } = request;
+    const matches = typeof headers.get === 'function'
+        ? [headers.get(header)]
+        : Object.entries(headers)
+            .filter(([name]) => name.toLowerCase() === header)
+            .map(([, value]) => value);
+    const token = matches[0];
+    if (matches.length !== 1 ||
+        typeof token !== 'string' ||
+        token.length > maxBytes)
+        throw invalidContext();
+    const envelope = /^([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]{43})$/.exec(token);
+    if (!envelope?.[1])
+        throw invalidContext();
+    let value;
+    try {
+        value = JSON.parse(Buffer.from(envelope[1], 'base64url').toString('utf8'));
+    }
+    catch {
+        throw invalidContext();
+    }
+    const parsed = claimsSchema.safeParse(value);
+    if (!parsed.success)
+        throw invalidContext();
+    return { token, expiresAt: parsed.data.exp };
+}
+function trustedOrigin({ baseUrl, error, }) {
+    let url;
+    try {
+        url = new URL(baseUrl);
+    }
+    catch {
+        throw error(400, 'invalid_configuration', 'Configure a trusted Atlas origin');
+    }
+    const loopback = url.protocol === 'http:' &&
+        ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if ((!loopback && url.protocol !== 'https:') ||
+        url.username ||
+        url.password ||
+        url.pathname !== '/' ||
+        url.search ||
+        url.hash) {
+        throw error(400, 'invalid_configuration', 'Configure an HTTPS Atlas origin without credentials, path, query or fragment');
+    }
+    return url.origin;
+}
+const errorResponseSchema = zod_1.z.object({
+    code: zod_1.z.string().max(128).optional(),
+    detail: zod_1.z.string().max(2000).optional(),
+});
+function createInvocationReadTransport({ baseUrl, fetchImpl = globalThis.fetch, path, header, credential, additionalCredentials = [], timeoutMs, error, failure, }) {
+    const url = `${trustedOrigin({ baseUrl, error })}${path}`;
+    const credentials = [{ header, credential }, ...additionalCredentials];
+    const names = credentials.map((value) => value.header.toLowerCase());
+    if (new Set(names).size !== names.length || names.includes('content-type')) {
+        throw error(400, 'invalid_configuration', 'Credential headers must be distinct');
+    }
+    return async function read({ body, schema, }) {
+        if (credentials.some((value) => value.credential.expiresAt <= Date.now() / 1000)) {
+            throw error(401, 'expired_context', 'The invocation credential expired; start a new invocation');
+        }
+        const response = await fetchImpl(url, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                ...Object.fromEntries(credentials.map((value) => [value.header, value.credential.token])),
+            },
+            body: JSON.stringify(body),
+            redirect: 'error',
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        const result = await response.json().catch(() => null);
+        if (!response.ok) {
+            const parsed = errorResponseSchema.safeParse(result);
+            throw error(response.status, parsed.success ? (parsed.data.code ?? failure.code) : failure.code, parsed.success
+                ? (parsed.data.detail ?? failure.message)
+                : failure.message);
+        }
+        const validated = schema.safeParse(result);
+        if (!validated.success)
+            throw error(502, 'malformed_response', 'Atlas returned an invalid capability response');
+        return validated.data;
+    };
+}

package/dist/invocation-contract.d.ts

@@ -0,0 +1,36 @@
+import { z } from 'zod';
+export declare const FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER = "x-sequence-invocation-identity-token";
+export declare const FUNCTION_INVOCATION_CONTEXT_PATH = "/api/managed-functions/invocation/context";
+export declare const functionInvocationIdentityCapabilitySchema: z.ZodObject<{
+    identity: z.ZodLiteral<true>;
+}, z.core.$strict>;
+export declare function readFunctionInvocationIdentityCapability(manifest: unknown): boolean;
+export declare const functionInvocationContextRequestSchema: z.ZodObject<{
+    operation: z.ZodLiteral<"getInvocationContext">;
+}, z.core.$strict>;
+export type FunctionInvocationContextRequest = z.infer<typeof functionInvocationContextRequestSchema>;
+export declare const functionInvocationContextSchema: z.ZodObject<{
+    receiver: z.ZodObject<{
+        functionId: z.ZodString;
+        versionId: z.ZodString;
+        invocationId: z.ZodString;
+        orgId: z.ZodString;
+        serviceAccountId: z.ZodString;
+        serviceAccountSub: z.ZodString;
+    }, z.core.$strict>;
+    caller: z.ZodObject<{
+        kind: z.ZodEnum<{
+            human: "human";
+            service_account: "service_account";
+            system: "system";
+        }>;
+        sub: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type FunctionInvocationContext = z.infer<typeof functionInvocationContextSchema>;
+export declare class FunctionInvocationContextError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly name = "FunctionInvocationContextError";
+    constructor(status: number, code: string, message: string);
+}

package/dist/invocation-contract.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FunctionInvocationContextError = exports.functionInvocationContextSchema = exports.functionInvocationContextRequestSchema = exports.functionInvocationIdentityCapabilitySchema = exports.FUNCTION_INVOCATION_CONTEXT_PATH = exports.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER = void 0;
+exports.readFunctionInvocationIdentityCapability = readFunctionInvocationIdentityCapability;
+const zod_1 = require("zod");
+exports.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER = 'x-sequence-invocation-identity-token';
+exports.FUNCTION_INVOCATION_CONTEXT_PATH = '/api/managed-functions/invocation/context';
+const identifier = zod_1.z.string().min(1).max(255);
+const principal = zod_1.z.string().min(1).max(512);
+exports.functionInvocationIdentityCapabilitySchema = zod_1.z.strictObject({
+    identity: zod_1.z.literal(true),
+});
+function readFunctionInvocationIdentityCapability(manifest) {
+    if (typeof manifest !== 'object' || manifest === null)
+        return false;
+    const capabilities = Reflect.get(manifest, 'capabilities');
+    if (typeof capabilities !== 'object' || capabilities === null)
+        return false;
+    return exports.functionInvocationIdentityCapabilitySchema.safeParse(Reflect.get(capabilities, 'invocation')).success;
+}
+exports.functionInvocationContextRequestSchema = zod_1.z.strictObject({
+    operation: zod_1.z.literal('getInvocationContext'),
+});
+exports.functionInvocationContextSchema = zod_1.z.strictObject({
+    receiver: zod_1.z.strictObject({
+        functionId: identifier,
+        versionId: identifier,
+        invocationId: identifier,
+        orgId: identifier,
+        serviceAccountId: identifier,
+        serviceAccountSub: principal,
+    }).refine((value) => value.serviceAccountSub === `service-account|${value.serviceAccountId}`, 'The receiver subject must identify the attached service account'),
+    caller: zod_1.z.strictObject({
+        kind: zod_1.z.enum(['human', 'service_account', 'system']),
+        sub: principal,
+    }),
+});
+class FunctionInvocationContextError extends Error {
+    status;
+    code;
+    name = 'FunctionInvocationContextError';
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+exports.FunctionInvocationContextError = FunctionInvocationContextError;

package/dist/invocation.d.ts

@@ -0,0 +1,8 @@
+import { type FunctionInvocationContext } from './invocation-contract';
+export * from './invocation-contract';
+import type { FunctionInvocationClientOptions } from './invocation-client';
+export type { FunctionInvocationClientOptions } from './invocation-client';
+export interface FunctionInvocationClient {
+    getInvocationContext(): Promise<FunctionInvocationContext>;
+}
+export declare function createFunctionInvocationClient({ request, baseUrl, fetchImpl, }: FunctionInvocationClientOptions): FunctionInvocationClient;

package/dist/invocation.js

@@ -0,0 +1,134 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFunctionInvocationClient = createFunctionInvocationClient;
+const zod_1 = require("zod");
+const invocation_contract_1 = require("./invocation-contract");
+__exportStar(require("./invocation-contract"), exports);
+const identifier = zod_1.z.string().min(1).max(255);
+const principal = zod_1.z.string().min(1).max(512);
+const tokenClaimsSchema = zod_1.z.strictObject({
+    audience: zod_1.z.literal('atlas-managed-function-invocation-identity'),
+    environment: zod_1.z.string().min(1).max(4096),
+    functionId: identifier,
+    versionId: identifier,
+    invocationId: identifier,
+    serviceAccountId: identifier,
+    org: identifier,
+    callerKind: zod_1.z.enum(['human', 'service_account', 'system']),
+    callerSub: principal,
+    callerAuthenticationMethod: identifier,
+    exp: zod_1.z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+});
+const errorSchema = zod_1.z.strictObject({
+    code: zod_1.z.string().min(1).max(128).regex(/^[a-z][a-z0-9_]*$/),
+    detail: zod_1.z.string().min(1).max(2000),
+});
+const invalidContext = () => new invocation_contract_1.FunctionInvocationContextError(401, 'invalid_context', 'This invocation has no valid identity credential');
+function readCredential({ request }) {
+    const { headers } = request;
+    const matches = typeof headers.get === 'function'
+        ? [headers.get(invocation_contract_1.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER)]
+        : Object.entries(headers)
+            .filter(([name]) => name.toLowerCase() === invocation_contract_1.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER)
+            .map(([, value]) => value);
+    const token = matches[0];
+    if (matches.length !== 1 || typeof token !== 'string' || token.length > 16_384)
+        throw invalidContext();
+    const envelope = /^([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]{43})$/.exec(token);
+    if (!envelope?.[1])
+        throw invalidContext();
+    let value;
+    try {
+        const decoded = Buffer.from(envelope[1], 'base64url');
+        if (decoded.toString('base64url') !== envelope[1])
+            throw invalidContext();
+        value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(decoded));
+    }
+    catch {
+        throw invalidContext();
+    }
+    const parsed = tokenClaimsSchema.safeParse(value);
+    if (!parsed.success)
+        throw invalidContext();
+    return { token, claims: parsed.data };
+}
+function trustedOrigin(baseUrl) {
+    const invalid = () => new invocation_contract_1.FunctionInvocationContextError(400, 'invalid_configuration', 'Configure a trusted HTTPS Atlas origin without credentials, path, query or fragment');
+    let url;
+    try {
+        url = new URL(baseUrl);
+    }
+    catch {
+        throw invalid();
+    }
+    const loopback = url.protocol === 'http:' &&
+        ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if ((!loopback && url.protocol !== 'https:') || url.username || url.password ||
+        url.pathname !== '/' || url.search || url.hash)
+        throw invalid();
+    return url.origin;
+}
+function requireFresh(claims) {
+    if (claims.exp <= Date.now() / 1000)
+        throw new invocation_contract_1.FunctionInvocationContextError(401, 'expired_context', 'The identity credential expired; start a new invocation');
+}
+function matchesInvocation({ context, claims, }) {
+    const { receiver, caller } = context;
+    return receiver.functionId === claims.functionId &&
+        receiver.versionId === claims.versionId &&
+        receiver.invocationId === claims.invocationId &&
+        receiver.orgId === claims.org &&
+        receiver.serviceAccountId === claims.serviceAccountId &&
+        caller.kind === claims.callerKind && caller.sub === claims.callerSub;
+}
+function createFunctionInvocationClient({ request, baseUrl, fetchImpl = globalThis.fetch, }) {
+    const url = `${trustedOrigin(baseUrl)}${invocation_contract_1.FUNCTION_INVOCATION_CONTEXT_PATH}`;
+    const { token, claims } = readCredential({ request });
+    return {
+        async getInvocationContext() {
+            requireFresh(claims);
+            let response;
+            try {
+                response = await fetchImpl(url, {
+                    method: 'POST',
+                    headers: {
+                        'content-type': 'application/json',
+                        [invocation_contract_1.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER]: token,
+                    },
+                    body: JSON.stringify(invocation_contract_1.functionInvocationContextRequestSchema.parse({ operation: 'getInvocationContext' })),
+                    redirect: 'error', signal: AbortSignal.timeout(30_000),
+                });
+            }
+            catch {
+                throw new invocation_contract_1.FunctionInvocationContextError(502, 'context_request_failed', 'The invocation context request failed');
+            }
+            if (response.redirected || (response.status >= 300 && response.status < 400))
+                throw new invocation_contract_1.FunctionInvocationContextError(502, 'redirect_refused', 'The invocation context request must not redirect');
+            const result = await response.json().catch(() => null);
+            if (!response.ok) {
+                const error = errorSchema.safeParse(result);
+                throw new invocation_contract_1.FunctionInvocationContextError(response.status, error.success ? error.data.code : 'context_read_failed', error.success && !error.data.detail.includes(token)
+                    ? error.data.detail : 'Invocation context read failed');
+            }
+            requireFresh(claims);
+            const parsed = invocation_contract_1.functionInvocationContextSchema.safeParse(result);
+            if (!parsed.success || !matchesInvocation({ context: parsed.data, claims }))
+                throw new invocation_contract_1.FunctionInvocationContextError(502, 'malformed_response', 'Atlas returned an invalid invocation context response');
+            return parsed.data;
+        },
+    };
+}

package/dist/lattice-capability.d.ts

@@ -0,0 +1,5 @@
+import { z } from 'zod';
+export declare const functionLatticeContextCapabilitySchema: z.ZodObject<{
+    context: z.ZodLiteral<true>;
+}, z.core.$strict>;
+export declare function readFunctionLatticeContextCapability(manifest: unknown): boolean;

package/dist/lattice-capability.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.functionLatticeContextCapabilitySchema = void 0;
+exports.readFunctionLatticeContextCapability = readFunctionLatticeContextCapability;
+const zod_1 = require("zod");
+exports.functionLatticeContextCapabilitySchema = zod_1.z.strictObject({
+    context: zod_1.z.literal(true),
+});
+function readFunctionLatticeContextCapability(manifest) {
+    if (typeof manifest !== 'object' || manifest === null)
+        return false;
+    const capabilities = Reflect.get(manifest, 'capabilities');
+    if (typeof capabilities !== 'object' || capabilities === null)
+        return false;
+    return exports.functionLatticeContextCapabilitySchema.safeParse(Reflect.get(capabilities, 'lattice')).success;
+}