@sequenceholdings/managed-functions 0.4.1 → 0.4.2

package/dist/preflight.js

@@ -5,8 +5,22 @@ const capabilities_1 = require("./capabilities");
 const sdk_range_1 = require("./sdk-range");
 const preflight_issue_1 = require("./preflight-issue");
 const preflight_processes_1 = require("./preflight-processes");
+const preflight_lattice_1 = require("./preflight-lattice");
+const lattice_capability_1 = require("./lattice-capability");
+const preflight_invocation_1 = require("./preflight-invocation");
+const preflight_immutable_release_1 = require("./preflight-immutable-release");
+const invocation_contract_1 = require("./invocation-contract");
+const preflight_agents_1 = require("./preflight-agents");
+const agents_contract_1 = require("./agents-contract");
+const preflight_workflows_1 = require("./preflight-workflows");
+const workflow_scopes_contract_1 = require("./workflow-scopes-contract");
+const preflight_monitoring_1 = require("./preflight-monitoring");
+const preflight_service_directory_1 = require("./preflight-service-directory");
 const preflight_directory_1 = require("./preflight-directory");
-const directory_config_1 = require("./directory-config");
+const directory_manifest_1 = require("./directory-manifest");
+const preflight_abrigo_1 = require("./preflight-abrigo");
+const abrigo_contract_1 = require("./abrigo-contract");
+const monitoring_contract_1 = require("./monitoring-contract");
 const processes_contract_1 = require("./processes-contract");
 const WORKLOAD_FIELDS = [
     'memory_mb',
@@ -21,9 +35,16 @@ function preflightManagedFunction({ manifest, limits, capabilities, cliVersion,
     const tooling = capabilities?.tooling ?? capabilities_1.MANAGED_FUNCTION_CAPABILITIES.tooling;
     const issues = [];
     checkWorkload({ manifest, limits, tooling, cliVersion, sdkVersion, issues });
+    (0, preflight_immutable_release_1.checkImmutableRelease)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
     checkPostgres({ manifest, capabilities, tooling, cliVersion, sdkVersion, issues });
     (0, preflight_processes_1.checkProcesses)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
-    (0, preflight_directory_1.checkDirectory)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
+    (0, preflight_lattice_1.checkLatticeContext)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
+    (0, preflight_invocation_1.checkInvocationIdentity)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
+    (0, preflight_agents_1.checkAgents)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
+    (0, preflight_workflows_1.checkWorkflows)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
+    (0, preflight_monitoring_1.checkMonitoring)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
+    checkDirectoryDeclarations({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
+    (0, preflight_abrigo_1.checkAbrigo)({ manifest, capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues });
     checkHeaders({ manifest, capabilities, tooling, cliVersion, sdkVersion, issues });
     checkSdkTimeout({ manifest, limits, capabilities, tooling, cliVersion, sdkVersion, issues });
     return issues;
@@ -125,8 +146,14 @@ function needsWideHeaders(manifest) {
     const hasData = !!data && Object.keys(data).length > 0;
     const hasStorage = !!storage && typeof storage === 'object' && Object.keys(storage).length > 0;
     const hasProcesses = processes_contract_1.functionProcessReadScopesSchema.safeParse(manifest.capabilities?.processes).success;
-    const hasDirectory = directory_config_1.directoryScopesSchema.safeParse(manifest.capabilities?.directory).success;
-    return hasData || hasStorage || hasProcesses || hasDirectory;
+    const hasAgents = agents_contract_1.functionAgentReadScopesSchema.safeParse(manifest.capabilities?.agents).success;
+    const hasWorkflows = workflow_scopes_contract_1.functionWorkflowScopesSchema.safeParse(manifest.capabilities?.workflows).success;
+    const hasMonitoring = monitoring_contract_1.functionMonitoringScopesSchema.safeParse(manifest.capabilities?.monitoring).success;
+    const hasLattice = (0, lattice_capability_1.readFunctionLatticeContextCapability)(manifest);
+    const hasInvocation = (0, invocation_contract_1.readFunctionInvocationIdentityCapability)(manifest);
+    const hasDirectory = directory_manifest_1.functionDirectoryManifestSchema.safeParse(manifest.capabilities?.directory).success;
+    const hasAbrigo = abrigo_contract_1.functionAbrigoReadScopesSchema.safeParse(manifest.capabilities?.abrigo).success;
+    return hasData || hasStorage || hasProcesses || hasMonitoring || hasAgents || hasWorkflows || hasLattice || hasInvocation || hasDirectory || hasAbrigo;
 }
 function checkHeaders({ manifest, capabilities, tooling, cliVersion, sdkVersion, issues, }) {
     const feature = capabilities?.features.http_headers;
@@ -137,7 +164,7 @@ function checkHeaders({ manifest, capabilities, tooling, cliVersion, sdkVersion,
         return;
     issues.push((0, preflight_issue_1.createPreflightIssue)({
         field: feature.field,
-        problem: `invocation headers for capabilities.data, capabilities.storage, capabilities.processes, or capabilities.directory exceed ${feature.max_bytes} bytes and will fail with HTTP 431`,
+        problem: `invocation headers for capability credentials, including capabilities.data, capabilities.storage, capabilities.processes, capabilities.lattice, capabilities.invocation and capabilities.directory, exceed ${feature.max_bytes} bytes and will fail with HTTP 431`,
         limit: feature.limit,
         tooling,
         requiredCli: feature.min_cli,
@@ -167,3 +194,20 @@ function checkSdkTimeout({ manifest, limits, capabilities, tooling, cliVersion,
         sdkVersion,
     }));
 }
+function checkDirectoryDeclarations(args) {
+    const directory = args.manifest.capabilities?.directory;
+    if (directory === undefined)
+        return;
+    const parsed = directory_manifest_1.functionDirectoryManifestSchema.safeParse(directory);
+    if (!parsed.success) {
+        args.issues.push((0, preflight_issue_1.createPreflightIssue)({ field: 'capabilities.directory', problem: (0, capabilities_1.formatValidationDetail)(parsed.error.issues),
+            limit: 'concrete groups and/or exact tenant resolution scopes', tooling: args.tooling,
+            requiredCli: args.tooling.cli.min, requiredSdk: args.tooling.sdk.min, cliVersion: args.cliVersion, sdkVersion: args.sdkVersion }));
+        return;
+    }
+    const scoped = (directory) => ({ ...args, manifest: { ...args.manifest, capabilities: { ...args.manifest.capabilities, directory } } });
+    if (parsed.data.groups)
+        (0, preflight_directory_1.checkDirectory)(scoped({ groups: parsed.data.groups }));
+    if (parsed.data.resolve)
+        (0, preflight_service_directory_1.checkDirectory)(scoped({ resolve: parsed.data.resolve }));
+}

package/dist/processes-contract.d.ts

@@ -55,6 +55,21 @@ export declare const functionProcessRunsPageQuerySchema: z.ZodObject<{
     archived: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 export type FunctionProcessRunQuery = z.infer<typeof functionProcessRunQuerySchema>;
+export declare const functionProcessCompletedAgentReferenceQuerySchema: z.ZodObject<{
+    process: z.ZodString;
+    runId: z.ZodString;
+    nodeId: z.ZodString;
+}, z.core.$strict>;
+export type FunctionProcessCompletedAgentReferenceQuery = z.infer<typeof functionProcessCompletedAgentReferenceQuerySchema>;
+export declare const functionProcessCompletedAgentReferenceSchema: z.ZodObject<{
+    stepId: z.ZodString;
+    attempt: z.ZodNumber;
+    agentId: z.ZodString;
+    agentRunId: z.ZodString;
+    threadId: z.ZodString;
+    recoveryProof: z.ZodString;
+}, z.core.$strict>;
+export type FunctionProcessCompletedAgentReference = z.infer<typeof functionProcessCompletedAgentReferenceSchema>;
 export type FunctionProcessRunsPageQuery = z.infer<typeof functionProcessRunsPageQuerySchema>;
 export declare const functionProcessRunsPageSchema: z.ZodObject<{
     runs: z.ZodArray<z.ZodObject<{
@@ -80,6 +95,11 @@ export declare const functionProcessReadRequestSchema: z.ZodDiscriminatedUnion<[
     process: z.ZodString;
     runId: z.ZodString;
     operation: z.ZodLiteral<"getRun">;
+}, z.core.$strict>, z.ZodObject<{
+    process: z.ZodString;
+    runId: z.ZodString;
+    nodeId: z.ZodString;
+    operation: z.ZodLiteral<"getCompletedAgentReference">;
 }, z.core.$strict>, z.ZodObject<{
     process: z.ZodString;
     statuses: z.ZodOptional<z.ZodArray<z.ZodEnum<{

package/dist/processes-contract.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FunctionProcessReadError = exports.functionProcessReadRequestSchema = exports.functionProcessRunsPageSchema = exports.functionProcessRunsPageQuerySchema = exports.functionProcessRunQuerySchema = exports.functionProcessRunSummarySchema = exports.functionProcessRunStatusSchema = exports.functionProcessReadScopesSchema = exports.FUNCTION_PROCESS_READ_PATH = exports.FUNCTION_PROCESS_TOKEN_HEADER = void 0;
+exports.FunctionProcessReadError = exports.functionProcessReadRequestSchema = exports.functionProcessRunsPageSchema = exports.functionProcessCompletedAgentReferenceSchema = exports.functionProcessCompletedAgentReferenceQuerySchema = exports.functionProcessRunsPageQuerySchema = exports.functionProcessRunQuerySchema = exports.functionProcessRunSummarySchema = exports.functionProcessRunStatusSchema = exports.functionProcessReadScopesSchema = exports.FUNCTION_PROCESS_READ_PATH = exports.FUNCTION_PROCESS_TOKEN_HEADER = void 0;
 exports.readFunctionProcessScopes = readFunctionProcessScopes;
 const zod_1 = require("zod");
 exports.FUNCTION_PROCESS_TOKEN_HEADER = 'x-sequence-process-service-token';
@@ -66,12 +66,19 @@ exports.functionProcessRunsPageQuerySchema = zod_1.z.strictObject({
     cursor: zod_1.z.string().min(1).max(8192).optional(),
     archived: zod_1.z.boolean().optional(),
 });
+exports.functionProcessCompletedAgentReferenceQuerySchema = exports.functionProcessRunQuerySchema.extend({ nodeId: entityId });
+exports.functionProcessCompletedAgentReferenceSchema = zod_1.z.strictObject({
+    stepId: entityId, attempt: zod_1.z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+    agentId: entityId, agentRunId: entityId, threadId: entityId,
+    recoveryProof: zod_1.z.string().min(1).max(16_384),
+});
 exports.functionProcessRunsPageSchema = zod_1.z.object({
     runs: zod_1.z.array(exports.functionProcessRunSummarySchema).max(500),
     nextCursor: zod_1.z.string().nullable(),
 });
 exports.functionProcessReadRequestSchema = zod_1.z.discriminatedUnion('operation', [
     exports.functionProcessRunQuerySchema.extend({ operation: zod_1.z.literal('getRun') }),
+    exports.functionProcessCompletedAgentReferenceQuerySchema.extend({ operation: zod_1.z.literal('getCompletedAgentReference') }),
     exports.functionProcessRunsPageQuerySchema.extend({
         operation: zod_1.z.literal('listRunsPage'),
     }),

package/dist/processes.d.ts

@@ -1,8 +1,9 @@
-import { type FunctionProcessRunQuery, type FunctionProcessRunSummary, type FunctionProcessRunsPage, type FunctionProcessRunsPageQuery } from './processes-contract';
+import { type FunctionProcessCompletedAgentReference, type FunctionProcessCompletedAgentReferenceQuery, type FunctionProcessRunQuery, type FunctionProcessRunSummary, type FunctionProcessRunsPage, type FunctionProcessRunsPageQuery } from './processes-contract';
 import { type FunctionInvocationClientOptions } from './invocation-client';
 export * from './processes-contract';
 export type FunctionServiceProcessesOptions = FunctionInvocationClientOptions;
 export interface FunctionServiceProcessesClient {
+    getCompletedAgentReference(query: FunctionProcessCompletedAgentReferenceQuery): Promise<FunctionProcessCompletedAgentReference>;
     getRun(query: FunctionProcessRunQuery): Promise<FunctionProcessRunSummary>;
     listRunsPage(query: FunctionProcessRunsPageQuery): Promise<FunctionProcessRunsPage>;
 }

package/dist/processes.js

@@ -18,7 +18,31 @@ exports.createFunctionServiceProcessesClient = createFunctionServiceProcessesCli
 const zod_1 = require("zod");
 const processes_contract_1 = require("./processes-contract");
 const invocation_client_1 = require("./invocation-client");
+const agents_contract_1 = require("./agents-contract");
 __exportStar(require("./processes-contract"), exports);
+function readAgentCredential({ request }) {
+    const { headers } = request;
+    const matches = typeof headers.get === 'function' ? [headers.get(agents_contract_1.FUNCTION_AGENT_TOKEN_HEADER)]
+        : Object.entries(headers).filter(([name]) => name.toLowerCase() === agents_contract_1.FUNCTION_AGENT_TOKEN_HEADER).map(([, value]) => value);
+    const token = matches[0];
+    const denied = () => new processes_contract_1.FunctionProcessReadError(401, 'invalid_context', 'Completed-agent reference lookup requires an agent-read credential');
+    if (matches.length !== 1 || typeof token !== 'string' || token.length > 16_384)
+        throw denied();
+    const body = /^([A-Za-z0-9_-]+)\.[A-Za-z0-9_-]{43}$/.exec(token)?.[1];
+    if (!body)
+        throw denied();
+    let value;
+    try {
+        value = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
+    }
+    catch {
+        throw denied();
+    }
+    const claims = zod_1.z.object({ audience: zod_1.z.literal('atlas-managed-function-agent-read'), sub: zod_1.z.string().startsWith('service-account|'), functionId: zod_1.z.string().min(1), invocationId: zod_1.z.string().min(1), exp: zod_1.z.number().int() }).safeParse(value);
+    if (!claims.success)
+        throw denied();
+    return { token, expiresAt: claims.data.exp };
+}
 const invalidContext = () => new processes_contract_1.FunctionProcessReadError(401, 'invalid_context', 'This invocation has no valid process-read credential');
 function createFunctionServiceProcessesClient({ request, baseUrl, fetchImpl = globalThis.fetch, }) {
     const credential = (0, invocation_client_1.readInvocationCredential)({
@@ -46,6 +70,16 @@ function createFunctionServiceProcessesClient({ request, baseUrl, fetchImpl = gl
     });
     const read = ({ body, schema }) => transport({ body: processes_contract_1.functionProcessReadRequestSchema.parse(body), schema });
     return {
+        async getCompletedAgentReference(query) {
+            const agent = readAgentCredential({ request });
+            const readReference = (0, invocation_client_1.createInvocationReadTransport)({
+                baseUrl, fetchImpl, path: processes_contract_1.FUNCTION_PROCESS_READ_PATH, header: processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER,
+                credential, additionalCredentials: [{ header: agents_contract_1.FUNCTION_AGENT_TOKEN_HEADER, credential: agent }],
+                timeoutMs: 30_000, error: (status, code, message) => new processes_contract_1.FunctionProcessReadError(status, code, message),
+                failure: { code: 'process_read_failed', message: 'Process read failed' },
+            });
+            return readReference({ body: processes_contract_1.functionProcessReadRequestSchema.parse({ ...query, operation: 'getCompletedAgentReference' }), schema: processes_contract_1.functionProcessCompletedAgentReferenceSchema });
+        },
         async getRun(query) {
             const run = await read({
                 body: { ...query, operation: 'getRun' },