@sequenceholdings/managed-functions 0.4.0 → 0.4.2

package/dist/lattice-provenance.js

@@ -0,0 +1,167 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFunctionLatticeClient = createFunctionLatticeClient;
+const zod_1 = require("zod");
+const lattice_provenance_contract_1 = require("./lattice-provenance-contract");
+__exportStar(require("./lattice-provenance-contract"), exports);
+const tokenClaimsSchema = zod_1.z.object({
+    audience: zod_1.z.literal('atlas-managed-function-lattice-execution'),
+    functionId: zod_1.z.string().min(1).max(255),
+    versionId: zod_1.z.string().min(1).max(255),
+    invocationId: zod_1.z.string().min(1).max(255),
+    org: zod_1.z.string().min(1).max(255),
+    runId: zod_1.z.string().min(1).max(255),
+    processId: zod_1.z.string().min(1).max(255),
+    processVersion: zod_1.z.string().min(1).max(255),
+    bundleHash: zod_1.z.string().min(1).max(255),
+    stepId: zod_1.z.string().min(1).max(255),
+    nodeId: zod_1.z.string().min(1).max(255),
+    stepAttempt: zod_1.z.number().int().positive(),
+    serviceAccountId: zod_1.z.string().min(1).max(255),
+    callerSub: zod_1.z.string().min(1).max(512), callerKind: zod_1.z.string().min(1).max(64), callerAuthenticationMethod: zod_1.z.string().min(1).max(64),
+    exp: zod_1.z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+});
+const invalidContext = () => new lattice_provenance_contract_1.FunctionLatticeContextError(401, 'invalid_context', 'This invocation has no valid Lattice execution credential');
+function readCredential({ request, }) {
+    const { headers } = request;
+    const matches = typeof headers.get === 'function'
+        ? [headers.get(lattice_provenance_contract_1.FUNCTION_LATTICE_EXECUTION_TOKEN_HEADER)]
+        : Object.entries(headers)
+            .filter(([name]) => name.toLowerCase() === lattice_provenance_contract_1.FUNCTION_LATTICE_EXECUTION_TOKEN_HEADER)
+            .map(([, value]) => value);
+    const token = matches[0];
+    if (matches.length !== 1 || typeof token !== 'string' || token.length > 16_384)
+        throw invalidContext();
+    const envelope = /^([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]{43})$/.exec(token);
+    if (!envelope?.[1])
+        throw invalidContext();
+    let value;
+    try {
+        const decoded = Buffer.from(envelope[1], 'base64url');
+        if (decoded.toString('base64url') !== envelope[1])
+            throw invalidContext();
+        value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(decoded));
+    }
+    catch {
+        throw invalidContext();
+    }
+    const parsed = tokenClaimsSchema.safeParse(value);
+    if (!parsed.success)
+        throw invalidContext();
+    return { token, claims: parsed.data };
+}
+function trustedOrigin(baseUrl) {
+    const invalid = () => new lattice_provenance_contract_1.FunctionLatticeContextError(400, 'invalid_configuration', 'Configure a trusted HTTPS Atlas origin without credentials, path, query or fragment');
+    let url;
+    try {
+        url = new URL(baseUrl);
+    }
+    catch {
+        throw invalid();
+    }
+    const loopback = url.protocol === 'http:' &&
+        ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if ((!loopback && url.protocol !== 'https:') || url.username || url.password ||
+        url.pathname !== '/' || url.search || url.hash)
+        throw invalid();
+    return url.origin;
+}
+function matchesExecution({ execution, claims, }) {
+    return execution.receiver.functionId === claims.functionId &&
+        execution.receiver.versionId === claims.versionId &&
+        execution.receiver.invocationId === claims.invocationId &&
+        execution.receiverFunctionOrgId === claims.org &&
+        execution.run.id === claims.runId && execution.run.processId === claims.processId &&
+        execution.run.processVersion === claims.processVersion && execution.run.bundleHash === claims.bundleHash &&
+        execution.step.id === claims.stepId && execution.step.nodeId === claims.nodeId &&
+        execution.step.attempt === claims.stepAttempt && execution.receiver.invoker.sub === claims.callerSub &&
+        execution.receiver.invoker.kind === claims.callerKind && execution.receiver.invoker.authenticationMethod === claims.callerAuthenticationMethod &&
+        execution.receiver.attachedServiceAccountSub === `service-account|${claims.serviceAccountId}`;
+}
+function validateHumanSelection({ completion, query, }) {
+    if (completion.human.nodeId !== query.nodeId ||
+        (query.stepId !== undefined && completion.human.stepId !== query.stepId) ||
+        (query.ancestorNodeId !== undefined && completion.human.ancestor?.nodeId !== query.ancestorNodeId))
+        throw new lattice_provenance_contract_1.FunctionLatticeContextError(502, 'malformed_response', 'Atlas returned a different completed human step');
+}
+function createFunctionLatticeClient({ request, baseUrl, fetchImpl = globalThis.fetch, }) {
+    const url = `${trustedOrigin(baseUrl)}${lattice_provenance_contract_1.FUNCTION_LATTICE_CONTEXT_PATH}`;
+    const { token, claims } = readCredential({ request });
+    async function read({ body, schema, executions, }) {
+        if (claims.exp <= Date.now() / 1000)
+            throw new lattice_provenance_contract_1.FunctionLatticeContextError(401, 'expired_context', 'The execution credential expired; start a new invocation');
+        const parsed = lattice_provenance_contract_1.functionLatticeContextRequestSchema.safeParse(body);
+        if (!parsed.success)
+            throw new lattice_provenance_contract_1.FunctionLatticeContextError(400, 'invalid_request', 'Select a valid Lattice context operation and human step');
+        let response;
+        try {
+            response = await fetchImpl(url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    [lattice_provenance_contract_1.FUNCTION_LATTICE_EXECUTION_TOKEN_HEADER]: token,
+                },
+                body: JSON.stringify(parsed.data),
+                redirect: 'error',
+                signal: AbortSignal.timeout(30_000),
+            });
+        }
+        catch {
+            throw new lattice_provenance_contract_1.FunctionLatticeContextError(502, 'context_request_failed', 'The Lattice context request failed');
+        }
+        if (response.redirected || (response.status >= 300 && response.status < 400))
+            throw new lattice_provenance_contract_1.FunctionLatticeContextError(502, 'redirect_refused', 'The Lattice context request must not redirect');
+        const result = await response.json().catch(() => null);
+        if (!response.ok) {
+            const error = zod_1.z.object({ code: zod_1.z.string().min(1).max(128), detail: zod_1.z.string().min(1).max(2000) }).safeParse(result);
+            throw new lattice_provenance_contract_1.FunctionLatticeContextError(response.status, error.success ? error.data.code : 'context_read_failed', error.success ? error.data.detail : 'Lattice context read failed');
+        }
+        const validated = schema.safeParse(result);
+        if (!validated.success || executions(validated.data).some((execution) => !matchesExecution({ execution, claims })))
+            throw new lattice_provenance_contract_1.FunctionLatticeContextError(502, 'malformed_response', 'Atlas returned an invalid Lattice context response');
+        return validated.data;
+    }
+    return {
+        getExecutionContext() {
+            return read({ body: { operation: 'getExecutionContext' }, schema: lattice_provenance_contract_1.functionLatticeExecutionContextSchema, executions: (value) => [value] });
+        },
+        async getHumanCompletion(query) {
+            const completion = await read({
+                body: { ...query, operation: 'getHumanCompletion' },
+                schema: lattice_provenance_contract_1.functionLatticeHumanCompletionSchema,
+                executions: (value) => [value],
+            });
+            validateHumanSelection({ completion, query });
+            return completion;
+        },
+        async getHumanCompletions(query) {
+            const page = await read({
+                body: { ...query, operation: 'getHumanCompletions' },
+                schema: lattice_provenance_contract_1.functionLatticeHumanCompletionsPageSchema,
+                executions: (value) => value.completions,
+            });
+            page.completions.forEach((completion) => validateHumanSelection({ completion, query }));
+            return page;
+        },
+        async getParallelSnapshot(query) {
+            const snapshot = await read({ body: { ...query, operation: 'getParallelSnapshot' }, schema: lattice_provenance_contract_1.functionLatticeParallelSnapshotSchema, executions: (value) => [value] });
+            if (snapshot.parallel.nodeId !== query.nodeId || snapshot.parallel.ancestor.nodeId !== query.ancestorNodeId)
+                throw new lattice_provenance_contract_1.FunctionLatticeContextError(502, 'malformed_response', 'Atlas returned a different causal parallel execution');
+            return snapshot;
+        },
+    };
+}

package/dist/monitoring-annotations.d.ts

@@ -0,0 +1,53 @@
+import { z } from 'zod';
+export type MonitoringJson = string | number | boolean | null | MonitoringJson[] | {
+    [key: string]: MonitoringJson;
+};
+export declare const functionMonitoringAnnotationSchema: z.ZodObject<{
+    sourceType: z.ZodString;
+    sourceRef: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+    generatingSubject: z.ZodObject<{
+        subjectId: z.ZodString;
+        subjectKind: z.ZodEnum<{
+            workflow: "workflow";
+            agent: "agent";
+        }>;
+    }, z.core.$strict>;
+    occurredAt: z.ZodISODateTime;
+    summary: z.ZodNullable<z.ZodString>;
+    metrics: z.ZodCustom<MonitoringJson, MonitoringJson>;
+    conversationFindings: z.ZodArray<z.ZodObject<{
+        type: z.ZodString;
+        description: z.ZodString;
+        excerpt: z.ZodString;
+        severity: z.ZodEnum<{
+            high: "high";
+            medium: "medium";
+            low: "low";
+        }>;
+    }, z.core.$strict>>;
+    classifications: z.ZodArray<z.ZodObject<{
+        matchedBucketSlug: z.ZodNullable<z.ZodString>;
+        newBucketProposal: z.ZodNullable<z.ZodObject<{
+            name: z.ZodString;
+            description: z.ZodString;
+            severity: z.ZodEnum<{
+                critical: "critical";
+                high: "high";
+                medium: "medium";
+                low: "low";
+            }>;
+            category: z.ZodString;
+        }, z.core.$strict>>;
+        excerpt: z.ZodString;
+        inputTags: z.ZodArray<z.ZodObject<{
+            type: z.ZodString;
+            value: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    coarseFallbacks: z.ZodArray<z.ZodObject<{
+        bucketSlug: z.ZodString;
+        excerpt: z.ZodString;
+        coarseCategory: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type FunctionMonitoringAnnotation = z.infer<typeof functionMonitoringAnnotationSchema>;

package/dist/monitoring-annotations.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.functionMonitoringAnnotationSchema = void 0;
+const zod_1 = require("zod");
+function boundedJson(value, depth = 0) {
+    if (depth > 6)
+        return false;
+    if (value === null || typeof value === 'boolean')
+        return true;
+    if (typeof value === 'number')
+        return Number.isFinite(value);
+    if (typeof value === 'string')
+        return value.length <= 50_000;
+    if (Array.isArray(value)) {
+        if (Object.getPrototypeOf(value) !== Array.prototype || value.length > 100 || Object.getOwnPropertyNames(value).length !== value.length + 1 || Object.getOwnPropertySymbols(value).length > 0)
+            return false;
+        for (let index = 0; index < value.length; index++) {
+            const entry = Object.getOwnPropertyDescriptor(value, String(index));
+            if (!entry?.enumerable || !('value' in entry) || !boundedJson(entry.value, depth + 1))
+                return false;
+        }
+        return true;
+    }
+    if (typeof value !== 'object')
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    if ((prototype !== Object.prototype && prototype !== null) || Object.getOwnPropertySymbols(value).length > 0)
+        return false;
+    const entries = Object.entries(Object.getOwnPropertyDescriptors(value));
+    return entries.length <= 64 && entries.every(([key, entry]) => key.length <= 128 && entry.enumerable && 'value' in entry && boundedJson(entry.value, depth + 1));
+}
+const json = zod_1.z.custom(value => boundedJson(value) && Buffer.byteLength(JSON.stringify(value), 'utf8') <= 100_000, 'Expected bounded JSON metrics');
+const text = zod_1.z.string().max(50_000);
+const id = zod_1.z.string().min(1).max(512);
+const severity = zod_1.z.enum(['critical', 'high', 'medium', 'low']);
+const inputTag = zod_1.z.strictObject({ type: zod_1.z.string().min(1).max(128), value: zod_1.z.string().max(8_000) });
+exports.functionMonitoringAnnotationSchema = zod_1.z.strictObject({
+    sourceType: id,
+    sourceRef: zod_1.z.record(zod_1.z.string().min(1).max(128), zod_1.z.union([zod_1.z.string().max(8_000), zod_1.z.number().finite()])).refine(ref => Object.keys(ref).length > 0 && Object.keys(ref).length <= 64, 'Source references must be bounded and nonempty'),
+    generatingSubject: zod_1.z.strictObject({ subjectId: id, subjectKind: zod_1.z.enum(['agent', 'workflow']) }),
+    occurredAt: zod_1.z.iso.datetime({ offset: true }),
+    summary: text.nullable(),
+    metrics: json,
+    conversationFindings: zod_1.z.array(zod_1.z.strictObject({ type: id, description: text, excerpt: text, severity: zod_1.z.enum(['high', 'medium', 'low']) })).max(100),
+    classifications: zod_1.z.array(zod_1.z.strictObject({
+        matchedBucketSlug: id.nullable(),
+        newBucketProposal: zod_1.z.strictObject({ name: id, description: text, severity, category: id }).nullable(),
+        excerpt: text, inputTags: zod_1.z.array(inputTag).max(64),
+    }).refine(classification => (classification.matchedBucketSlug === null) !== (classification.newBucketProposal === null), 'Name exactly one matched bucket or proposal')).max(100),
+    coarseFallbacks: zod_1.z.array(zod_1.z.strictObject({ bucketSlug: id, excerpt: text, coarseCategory: id })).max(100),
+}).superRefine((annotation, context) => {
+    if (Buffer.byteLength(JSON.stringify(annotation), 'utf8') > 256 * 1024)
+        context.addIssue({ code: 'custom', message: 'Monitoring annotations exceed the size limit' });
+});