@sequenceholdings/managed-functions 0.4.1 → 0.4.2

package/dist/capabilities.js

@@ -4,6 +4,7 @@ exports.MANAGED_FUNCTION_CAPABILITIES = exports.MANAGED_FUNCTION_SDK_PACKAGE = e
 exports.versionIsOlder = versionIsOlder;
 exports.sdkVersionLowerBound = sdkVersionLowerBound;
 exports.sdkVersionFromPackageJson = sdkVersionFromPackageJson;
+exports.sdkSpecFromPackageJson = sdkSpecFromPackageJson;
 exports.isPostgresEgress = isPostgresEgress;
 exports.formatValidationDetail = formatValidationDetail;
 const sdk_range_1 = require("./sdk-range");
@@ -16,11 +17,59 @@ exports.MANAGED_FUNCTION_CAPABILITIES = {
     },
     features: {
         directory_members: {
-            field: 'capabilities.directory.groups',
-            supported: true,
+            field: 'capabilities.directory.groups', supported: true,
             limit: '1 to 16 concrete groups; resolve 1 to 50 selected active members per call',
-            min_cli: '0.5.2',
-            min_sdk: '0.4.1',
+            min_cli: '0.5.2', min_sdk: '0.4.1',
+        },
+        abrigo_read: {
+            field: 'capabilities.abrigo.read', supported: true,
+            limit: 'eleven fixed human reads: eight integration reads and three workflow-scoped document-review reads; pages 1 to 100 with 1 to 500 rows; 1 MiB JSON responses',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
+        immutable_release: {
+            field: 'function.immutable_release', supported: true,
+            limit: 'a fresh function identity whose runtime cannot be redeployed after first activation',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
+        invocation_identity: {
+            field: 'capabilities.invocation.identity', supported: true,
+            limit: 'verified receiver and actual caller for this exact active invocation only',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
+        directory_resolve: {
+            field: 'capabilities.directory.resolve', supported: true,
+            limit: '1 to 16 exact tenant scopes; at most 50 exact active human principal lookups',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
+        lattice_context: {
+            field: 'capabilities.lattice.context', supported: true,
+            limit: 'verified context and causal human completion for the receiving Lattice step only',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
+        agents_read: {
+            field: 'capabilities.agents.read', supported: true,
+            limit: '1 to 64 exact agent ids; completed owned or verified upstream responses only',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
+        agents_evidence_verify: {
+            field: 'capabilities.agents.evidence', supported: true,
+            limit: '1 to 64 exact agent ids; verify bounded supplied historical source evidence only',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
+        workflows_read: {
+            field: 'capabilities.workflows.read', supported: true,
+            limit: '1 to 64 exact workflow ids; completed owned root outputs only',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
+        workflows_evidence_verify: {
+            field: 'capabilities.workflows.evidence', supported: true,
+            limit: '1 to 64 exact workflow ids; verify bounded supplied historical root-output evidence only',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
+        },
+        monitoring_deliveries: {
+            field: 'capabilities.monitoring.producers', supported: true,
+            limit: '1 to 16 producer namespaces; immutable publish and receipt lookup',
+            min_cli: '0.5.5', min_sdk: '0.4.2',
         },
         processes_read: {
             field: 'capabilities.processes.read',
@@ -76,6 +125,9 @@ function sdkVersionLowerBound(spec) {
     return (0, sdk_range_1.concreteOrStaleSdkSpec)(spec, minimum);
 }
 function sdkVersionFromPackageJson(raw) {
+    return sdkVersionLowerBound(sdkSpecFromPackageJson(raw) ?? undefined);
+}
+function sdkSpecFromPackageJson(raw) {
     let parsed;
     try {
         parsed = JSON.parse(raw);
@@ -87,7 +139,8 @@ function sdkVersionFromPackageJson(raw) {
         return null;
     const dependencies = Reflect.get(parsed, 'dependencies');
     const devDependencies = Reflect.get(parsed, 'devDependencies');
-    return sdkVersionLowerBound(dependencySpec(dependencies) ?? dependencySpec(devDependencies));
+    const spec = dependencySpec(dependencies) ?? dependencySpec(devDependencies);
+    return spec?.trim() || null;
 }
 function dependencySpec(block) {
     if (!block || typeof block !== 'object')

package/dist/config.d.ts

@@ -1,10 +1,25 @@
 export { DIRECTORY_TOKEN_HEADER, directoryGroupIdSchema, directoryScopesSchema, directoryMembersInput, directoryMembersResponse, readDirectoryGroups } from './directory-config';
-export { FUNCTION_PROCESS_TOKEN_HEADER, FUNCTION_PROCESS_READ_PATH, functionProcessReadScopesSchema, readFunctionProcessScopes, functionProcessReadRequestSchema, functionProcessRunSummarySchema } from './processes-contract';
+export { functionDirectoryManifestSchema } from './directory-manifest';
+export { functionLatticeContextCapabilitySchema, readFunctionLatticeContextCapability } from './lattice-capability';
+export * from './invocation-contract';
+export { FUNCTION_PROCESS_TOKEN_HEADER, FUNCTION_PROCESS_READ_PATH, functionProcessReadScopesSchema, readFunctionProcessScopes, functionProcessReadRequestSchema, functionProcessRunSummarySchema, functionProcessCompletedAgentReferenceSchema, functionProcessCompletedAgentReferenceQuerySchema } from './processes-contract';
+export { FUNCTION_AGENT_TOKEN_HEADER, FUNCTION_AGENT_READ_PATH, functionAgentReadScopesSchema, readFunctionAgentScopes, functionAgentReadRequestSchema, functionAgentCompletedRunQuerySchema, functionAgentCompletedRunSchema } from './agents-contract';
+export * from './agent-source-evidence-contract';
+export * from './workflow-source-contract';
+export { functionWorkflowScopesSchema, readFunctionWorkflowScopes, readFunctionWorkflowEvidenceScopes } from './workflow-scopes-contract';
+export type { FunctionWorkflowScopes } from './workflow-scopes-contract';
+export * from './monitoring-events';
+export * from './monitoring-contract';
+export * from './monitoring-annotations';
+export { FUNCTION_CALLER_DATA_TOKEN_HEADER } from './orm-contract';
+export { FUNCTION_DIRECTORY_TOKEN_HEADER, FUNCTION_DIRECTORY_RESOLVE_PATH, functionDirectoryScopesSchema, readFunctionDirectoryScopes, directoryPrincipalResolveRequestSchema, directoryPrincipalResolutionSchema } from './directory-contract';
+export * from './abrigo-contract';
 export { shouldReportAtlasHttp } from './http-tracing';
+export { functionImmutableReleaseSchema, readFunctionImmutableRelease } from './immutable-release-contract';
 import { z } from 'zod';
 export { MANAGED_FUNCTION_LIMITS, MF_LIMITS_CAPS, MF_LIMITS_DEFAULTS, managedFunctionWorkloadLimitsSchema } from './limits';
 export type { ManagedFunctionLimitCatalog } from './limits';
-export { MANAGED_FUNCTION_CAPABILITIES, MANAGED_FUNCTION_CLI_PACKAGE, MANAGED_FUNCTION_SDK_PACKAGE, formatValidationDetail, isPostgresEgress, sdkVersionFromPackageJson, sdkVersionLowerBound, versionIsOlder, } from './capabilities';
+export { MANAGED_FUNCTION_CAPABILITIES, MANAGED_FUNCTION_CLI_PACKAGE, MANAGED_FUNCTION_SDK_PACKAGE, formatValidationDetail, isPostgresEgress, sdkVersionFromPackageJson, sdkSpecFromPackageJson, sdkVersionLowerBound, versionIsOlder, } from './capabilities';
 export type { DeployedPolicy, ManagedFunctionCapabilities, PreflightIssue, PreflightManifest, } from './capabilities';
 export { parseDeployedPolicy } from './deployed-policy';
 export { preflightManagedFunction } from './preflight';

package/dist/config.js

@@ -1,6 +1,21 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.cacheManifestSchema = exports.CACHE_MAX_TTL_SECONDS = exports.preflightManagedFunction = exports.parseDeployedPolicy = exports.versionIsOlder = exports.sdkVersionLowerBound = exports.sdkVersionFromPackageJson = exports.isPostgresEgress = exports.formatValidationDetail = exports.MANAGED_FUNCTION_SDK_PACKAGE = exports.MANAGED_FUNCTION_CLI_PACKAGE = exports.MANAGED_FUNCTION_CAPABILITIES = exports.managedFunctionWorkloadLimitsSchema = exports.MF_LIMITS_DEFAULTS = exports.MF_LIMITS_CAPS = exports.MANAGED_FUNCTION_LIMITS = exports.shouldReportAtlasHttp = exports.functionProcessRunSummarySchema = exports.functionProcessReadRequestSchema = exports.readFunctionProcessScopes = exports.functionProcessReadScopesSchema = exports.FUNCTION_PROCESS_READ_PATH = exports.FUNCTION_PROCESS_TOKEN_HEADER = exports.readDirectoryGroups = exports.directoryMembersResponse = exports.directoryMembersInput = exports.directoryScopesSchema = exports.directoryGroupIdSchema = exports.DIRECTORY_TOKEN_HEADER = void 0;
+exports.versionIsOlder = exports.sdkVersionLowerBound = exports.sdkSpecFromPackageJson = exports.sdkVersionFromPackageJson = exports.isPostgresEgress = exports.formatValidationDetail = exports.MANAGED_FUNCTION_SDK_PACKAGE = exports.MANAGED_FUNCTION_CLI_PACKAGE = exports.MANAGED_FUNCTION_CAPABILITIES = exports.managedFunctionWorkloadLimitsSchema = exports.MF_LIMITS_DEFAULTS = exports.MF_LIMITS_CAPS = exports.MANAGED_FUNCTION_LIMITS = exports.readFunctionImmutableRelease = exports.functionImmutableReleaseSchema = exports.shouldReportAtlasHttp = exports.directoryPrincipalResolutionSchema = exports.directoryPrincipalResolveRequestSchema = exports.readFunctionDirectoryScopes = exports.functionDirectoryScopesSchema = exports.FUNCTION_DIRECTORY_RESOLVE_PATH = exports.FUNCTION_DIRECTORY_TOKEN_HEADER = exports.FUNCTION_CALLER_DATA_TOKEN_HEADER = exports.readFunctionWorkflowEvidenceScopes = exports.readFunctionWorkflowScopes = exports.functionWorkflowScopesSchema = exports.functionAgentCompletedRunSchema = exports.functionAgentCompletedRunQuerySchema = exports.functionAgentReadRequestSchema = exports.readFunctionAgentScopes = exports.functionAgentReadScopesSchema = exports.FUNCTION_AGENT_READ_PATH = exports.FUNCTION_AGENT_TOKEN_HEADER = exports.functionProcessCompletedAgentReferenceQuerySchema = exports.functionProcessCompletedAgentReferenceSchema = exports.functionProcessRunSummarySchema = exports.functionProcessReadRequestSchema = exports.readFunctionProcessScopes = exports.functionProcessReadScopesSchema = exports.FUNCTION_PROCESS_READ_PATH = exports.FUNCTION_PROCESS_TOKEN_HEADER = exports.readFunctionLatticeContextCapability = exports.functionLatticeContextCapabilitySchema = exports.functionDirectoryManifestSchema = exports.readDirectoryGroups = exports.directoryMembersResponse = exports.directoryMembersInput = exports.directoryScopesSchema = exports.directoryGroupIdSchema = exports.DIRECTORY_TOKEN_HEADER = void 0;
+exports.cacheManifestSchema = exports.CACHE_MAX_TTL_SECONDS = exports.preflightManagedFunction = exports.parseDeployedPolicy = void 0;
 exports.readCacheConfiguration = readCacheConfiguration;
 var directory_config_1 = require("./directory-config");
 Object.defineProperty(exports, "DIRECTORY_TOKEN_HEADER", { enumerable: true, get: function () { return directory_config_1.DIRECTORY_TOKEN_HEADER; } });
@@ -9,6 +24,12 @@ Object.defineProperty(exports, "directoryScopesSchema", { enumerable: true, get:
 Object.defineProperty(exports, "directoryMembersInput", { enumerable: true, get: function () { return directory_config_1.directoryMembersInput; } });
 Object.defineProperty(exports, "directoryMembersResponse", { enumerable: true, get: function () { return directory_config_1.directoryMembersResponse; } });
 Object.defineProperty(exports, "readDirectoryGroups", { enumerable: true, get: function () { return directory_config_1.readDirectoryGroups; } });
+var directory_manifest_1 = require("./directory-manifest");
+Object.defineProperty(exports, "functionDirectoryManifestSchema", { enumerable: true, get: function () { return directory_manifest_1.functionDirectoryManifestSchema; } });
+var lattice_capability_1 = require("./lattice-capability");
+Object.defineProperty(exports, "functionLatticeContextCapabilitySchema", { enumerable: true, get: function () { return lattice_capability_1.functionLatticeContextCapabilitySchema; } });
+Object.defineProperty(exports, "readFunctionLatticeContextCapability", { enumerable: true, get: function () { return lattice_capability_1.readFunctionLatticeContextCapability; } });
+__exportStar(require("./invocation-contract"), exports);
 var processes_contract_1 = require("./processes-contract");
 Object.defineProperty(exports, "FUNCTION_PROCESS_TOKEN_HEADER", { enumerable: true, get: function () { return processes_contract_1.FUNCTION_PROCESS_TOKEN_HEADER; } });
 Object.defineProperty(exports, "FUNCTION_PROCESS_READ_PATH", { enumerable: true, get: function () { return processes_contract_1.FUNCTION_PROCESS_READ_PATH; } });
@@ -16,8 +37,40 @@ Object.defineProperty(exports, "functionProcessReadScopesSchema", { enumerable:
 Object.defineProperty(exports, "readFunctionProcessScopes", { enumerable: true, get: function () { return processes_contract_1.readFunctionProcessScopes; } });
 Object.defineProperty(exports, "functionProcessReadRequestSchema", { enumerable: true, get: function () { return processes_contract_1.functionProcessReadRequestSchema; } });
 Object.defineProperty(exports, "functionProcessRunSummarySchema", { enumerable: true, get: function () { return processes_contract_1.functionProcessRunSummarySchema; } });
+Object.defineProperty(exports, "functionProcessCompletedAgentReferenceSchema", { enumerable: true, get: function () { return processes_contract_1.functionProcessCompletedAgentReferenceSchema; } });
+Object.defineProperty(exports, "functionProcessCompletedAgentReferenceQuerySchema", { enumerable: true, get: function () { return processes_contract_1.functionProcessCompletedAgentReferenceQuerySchema; } });
+var agents_contract_1 = require("./agents-contract");
+Object.defineProperty(exports, "FUNCTION_AGENT_TOKEN_HEADER", { enumerable: true, get: function () { return agents_contract_1.FUNCTION_AGENT_TOKEN_HEADER; } });
+Object.defineProperty(exports, "FUNCTION_AGENT_READ_PATH", { enumerable: true, get: function () { return agents_contract_1.FUNCTION_AGENT_READ_PATH; } });
+Object.defineProperty(exports, "functionAgentReadScopesSchema", { enumerable: true, get: function () { return agents_contract_1.functionAgentReadScopesSchema; } });
+Object.defineProperty(exports, "readFunctionAgentScopes", { enumerable: true, get: function () { return agents_contract_1.readFunctionAgentScopes; } });
+Object.defineProperty(exports, "functionAgentReadRequestSchema", { enumerable: true, get: function () { return agents_contract_1.functionAgentReadRequestSchema; } });
+Object.defineProperty(exports, "functionAgentCompletedRunQuerySchema", { enumerable: true, get: function () { return agents_contract_1.functionAgentCompletedRunQuerySchema; } });
+Object.defineProperty(exports, "functionAgentCompletedRunSchema", { enumerable: true, get: function () { return agents_contract_1.functionAgentCompletedRunSchema; } });
+__exportStar(require("./agent-source-evidence-contract"), exports);
+__exportStar(require("./workflow-source-contract"), exports);
+var workflow_scopes_contract_1 = require("./workflow-scopes-contract");
+Object.defineProperty(exports, "functionWorkflowScopesSchema", { enumerable: true, get: function () { return workflow_scopes_contract_1.functionWorkflowScopesSchema; } });
+Object.defineProperty(exports, "readFunctionWorkflowScopes", { enumerable: true, get: function () { return workflow_scopes_contract_1.readFunctionWorkflowScopes; } });
+Object.defineProperty(exports, "readFunctionWorkflowEvidenceScopes", { enumerable: true, get: function () { return workflow_scopes_contract_1.readFunctionWorkflowEvidenceScopes; } });
+__exportStar(require("./monitoring-events"), exports);
+__exportStar(require("./monitoring-contract"), exports);
+__exportStar(require("./monitoring-annotations"), exports);
+var orm_contract_1 = require("./orm-contract");
+Object.defineProperty(exports, "FUNCTION_CALLER_DATA_TOKEN_HEADER", { enumerable: true, get: function () { return orm_contract_1.FUNCTION_CALLER_DATA_TOKEN_HEADER; } });
+var directory_contract_1 = require("./directory-contract");
+Object.defineProperty(exports, "FUNCTION_DIRECTORY_TOKEN_HEADER", { enumerable: true, get: function () { return directory_contract_1.FUNCTION_DIRECTORY_TOKEN_HEADER; } });
+Object.defineProperty(exports, "FUNCTION_DIRECTORY_RESOLVE_PATH", { enumerable: true, get: function () { return directory_contract_1.FUNCTION_DIRECTORY_RESOLVE_PATH; } });
+Object.defineProperty(exports, "functionDirectoryScopesSchema", { enumerable: true, get: function () { return directory_contract_1.functionDirectoryScopesSchema; } });
+Object.defineProperty(exports, "readFunctionDirectoryScopes", { enumerable: true, get: function () { return directory_contract_1.readFunctionDirectoryScopes; } });
+Object.defineProperty(exports, "directoryPrincipalResolveRequestSchema", { enumerable: true, get: function () { return directory_contract_1.directoryPrincipalResolveRequestSchema; } });
+Object.defineProperty(exports, "directoryPrincipalResolutionSchema", { enumerable: true, get: function () { return directory_contract_1.directoryPrincipalResolutionSchema; } });
+__exportStar(require("./abrigo-contract"), exports);
 var http_tracing_1 = require("./http-tracing");
 Object.defineProperty(exports, "shouldReportAtlasHttp", { enumerable: true, get: function () { return http_tracing_1.shouldReportAtlasHttp; } });
+var immutable_release_contract_1 = require("./immutable-release-contract");
+Object.defineProperty(exports, "functionImmutableReleaseSchema", { enumerable: true, get: function () { return immutable_release_contract_1.functionImmutableReleaseSchema; } });
+Object.defineProperty(exports, "readFunctionImmutableRelease", { enumerable: true, get: function () { return immutable_release_contract_1.readFunctionImmutableRelease; } });
 const zod_1 = require("zod");
 const limits_1 = require("./limits");
 var limits_2 = require("./limits");
@@ -32,6 +85,7 @@ Object.defineProperty(exports, "MANAGED_FUNCTION_SDK_PACKAGE", { enumerable: tru
 Object.defineProperty(exports, "formatValidationDetail", { enumerable: true, get: function () { return capabilities_1.formatValidationDetail; } });
 Object.defineProperty(exports, "isPostgresEgress", { enumerable: true, get: function () { return capabilities_1.isPostgresEgress; } });
 Object.defineProperty(exports, "sdkVersionFromPackageJson", { enumerable: true, get: function () { return capabilities_1.sdkVersionFromPackageJson; } });
+Object.defineProperty(exports, "sdkSpecFromPackageJson", { enumerable: true, get: function () { return capabilities_1.sdkSpecFromPackageJson; } });
 Object.defineProperty(exports, "sdkVersionLowerBound", { enumerable: true, get: function () { return capabilities_1.sdkVersionLowerBound; } });
 Object.defineProperty(exports, "versionIsOlder", { enumerable: true, get: function () { return capabilities_1.versionIsOlder; } });
 var deployed_policy_1 = require("./deployed-policy");

package/dist/deployed-policy.js

@@ -38,15 +38,35 @@ function normalizeCapabilities(value) {
     return {
         tooling: value.tooling,
         features: {
+            immutable_release: normalizeImmutableRelease(features.immutable_release),
+            invocation_identity: normalizeInvocationIdentity(features.invocation_identity),
+            directory_members: normalizeDirectoryMembers(features.directory_members),
+            directory_resolve: normalizeDirectory(features.directory_resolve),
+            abrigo_read: normalizeAbrigo(features.abrigo_read),
+            lattice_context: normalizeLatticeContext(features.lattice_context),
             postgres_egress: normalizePostgres(features.postgres_egress),
             http_headers: normalizeHeaders(features.http_headers),
             invoke_timeout: normalizeTimeout(features.invoke_timeout),
             processes_read: normalizeProcesses(features.processes_read),
-            directory_members: normalizeDirectory(features.directory_members),
+            agents_read: normalizeAgents(features.agents_read),
+            agents_evidence_verify: normalizeAgentEvidence(features.agents_evidence_verify),
+            workflows_read: normalizeWorkflowRead(features.workflows_read),
+            workflows_evidence_verify: normalizeWorkflowEvidence(features.workflows_evidence_verify),
+            monitoring_deliveries: normalizeMonitoring(features.monitoring_deliveries),
         },
     };
 }
-function normalizeDirectory(value) {
+function normalizeImmutableRelease(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
+        return undefined;
+    if (typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return {
+        field: typeof value.field === 'string' ? value.field : 'function.immutable_release',
+        supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk,
+    };
+}
+function normalizeDirectoryMembers(value) {
     if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
         return undefined;
     if (typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
@@ -59,6 +79,46 @@ function normalizeDirectory(value) {
         min_sdk: value.min_sdk,
     };
 }
+function normalizeDirectory(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string' || typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return { field: typeof value.field === 'string' ? value.field : 'capabilities.directory.resolve', supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk };
+}
+function normalizeAbrigo(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string' || typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return { field: typeof value.field === 'string' ? value.field : 'capabilities.abrigo.read', supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk };
+}
+function normalizeInvocationIdentity(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
+        return undefined;
+    if (typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return {
+        field: typeof value.field === 'string' ? value.field : 'capabilities.invocation.identity',
+        supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk,
+    };
+}
+function normalizeLatticeContext(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
+        return undefined;
+    if (typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return {
+        field: typeof value.field === 'string' ? value.field : 'capabilities.lattice.context',
+        supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk,
+    };
+}
+function normalizeMonitoring(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
+        return undefined;
+    if (typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return {
+        field: typeof value.field === 'string' ? value.field : 'capabilities.monitoring.producers',
+        supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk,
+    };
+}
 function normalizeProcesses(value) {
     if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
         return undefined;
@@ -72,6 +132,34 @@ function normalizeProcesses(value) {
         min_sdk: value.min_sdk,
     };
 }
+function normalizeAgents(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
+        return undefined;
+    if (typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return { field: typeof value.field === 'string' ? value.field : 'capabilities.agents.read', supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk };
+}
+function normalizeAgentEvidence(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
+        return undefined;
+    if (typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return { field: typeof value.field === 'string' ? value.field : 'capabilities.agents.evidence', supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk };
+}
+function normalizeWorkflowRead(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
+        return undefined;
+    if (typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return { field: typeof value.field === 'string' ? value.field : 'capabilities.workflows.read', supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk };
+}
+function normalizeWorkflowEvidence(value) {
+    if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
+        return undefined;
+    if (typeof value.min_cli !== 'string' || typeof value.min_sdk !== 'string')
+        return undefined;
+    return { field: typeof value.field === 'string' ? value.field : 'capabilities.workflows.evidence', supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk };
+}
 function normalizePostgres(value) {
     if (!value || typeof value.supported !== 'boolean' || typeof value.limit !== 'string')
         return undefined;

package/dist/directory-config.js

@@ -17,6 +17,6 @@ exports.directoryMembersResponse = zod_1.z.object({ members: zod_1.z.array(zod_1
         id: zod_1.z.string(), sub: identity, name: zod_1.z.string(), email: zod_1.z.string(), deactivated: zod_1.z.literal(false),
     }).strict()).max(50) }).strict();
 function readDirectoryGroups(manifest) {
-    const parsed = zod_1.z.object({ capabilities: zod_1.z.object({ directory: exports.directoryScopesSchema.optional() }).optional() }).safeParse(manifest);
+    const parsed = zod_1.z.object({ capabilities: zod_1.z.object({ directory: zod_1.z.object({ groups: exports.directoryScopesSchema.shape.groups.optional() }).optional() }).optional() }).safeParse(manifest);
     return parsed.success ? parsed.data.capabilities?.directory?.groups ?? [] : [];
 }

package/dist/directory-contract.d.ts

@@ -0,0 +1,68 @@
+import { z } from 'zod';
+export declare const FUNCTION_DIRECTORY_TOKEN_HEADER = "x-sequence-directory-service-token";
+export declare const FUNCTION_DIRECTORY_RESOLVE_PATH = "/api/managed-functions/directory/resolve";
+export declare const DIRECTORY_PRINCIPALS_PER_REQUEST = 50;
+export declare const directoryTenantSchema: z.ZodString;
+export declare const directoryPrincipalLookupSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"email">;
+    value: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"sub">;
+    value: z.ZodString;
+}, z.core.$strict>], "type">;
+export type DirectoryPrincipalLookup = z.infer<typeof directoryPrincipalLookupSchema>;
+export declare const directoryPrincipalResolveRequestSchema: z.ZodObject<{
+    tenant: z.ZodString;
+    lookups: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"email">;
+        value: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"sub">;
+        value: z.ZodString;
+    }, z.core.$strict>], "type">>;
+}, z.core.$strict>;
+export type DirectoryPrincipalResolveRequest = z.infer<typeof directoryPrincipalResolveRequestSchema>;
+export declare const directoryResolvedPrincipalSchema: z.ZodObject<{
+    lookup: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"email">;
+        value: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"sub">;
+        value: z.ZodString;
+    }, z.core.$strict>], "type">;
+    sub: z.ZodString;
+    email: z.ZodUnion<readonly [z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>, z.ZodLiteral<"">]>;
+    name: z.ZodString;
+}, z.core.$strict>;
+export declare const directoryPrincipalResolutionSchema: z.ZodObject<{
+    resolved: z.ZodArray<z.ZodObject<{
+        lookup: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"email">;
+            value: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"sub">;
+            value: z.ZodString;
+        }, z.core.$strict>], "type">;
+        sub: z.ZodString;
+        email: z.ZodUnion<readonly [z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>, z.ZodLiteral<"">]>;
+        name: z.ZodString;
+    }, z.core.$strict>>;
+    unresolved: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"email">;
+        value: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"sub">;
+        value: z.ZodString;
+    }, z.core.$strict>], "type">>;
+}, z.core.$strict>;
+export type DirectoryPrincipalResolution = z.infer<typeof directoryPrincipalResolutionSchema>;
+export declare const functionDirectoryScopesSchema: z.ZodObject<{
+    resolve: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export declare function readFunctionDirectoryScopes(manifest: unknown): string[];
+export declare class DirectoryPrincipalResolveError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly name = "DirectoryPrincipalResolveError";
+    constructor(status: number, code: string, message: string);
+}

package/dist/directory-contract.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DirectoryPrincipalResolveError = exports.functionDirectoryScopesSchema = exports.directoryPrincipalResolutionSchema = exports.directoryResolvedPrincipalSchema = exports.directoryPrincipalResolveRequestSchema = exports.directoryPrincipalLookupSchema = exports.directoryTenantSchema = exports.DIRECTORY_PRINCIPALS_PER_REQUEST = exports.FUNCTION_DIRECTORY_RESOLVE_PATH = exports.FUNCTION_DIRECTORY_TOKEN_HEADER = void 0;
+exports.readFunctionDirectoryScopes = readFunctionDirectoryScopes;
+const zod_1 = require("zod");
+exports.FUNCTION_DIRECTORY_TOKEN_HEADER = 'x-sequence-directory-service-token';
+exports.FUNCTION_DIRECTORY_RESOLVE_PATH = '/api/managed-functions/directory/resolve';
+exports.DIRECTORY_PRINCIPALS_PER_REQUEST = 50;
+exports.directoryTenantSchema = zod_1.z.string().min(1).max(32).regex(/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/);
+const subject = zod_1.z.string().min(3).max(255).regex(/^[^\s:#]+\|[^\s:#]+$/);
+const email = zod_1.z.email().max(255).transform((value) => value.trim().toLowerCase());
+exports.directoryPrincipalLookupSchema = zod_1.z.discriminatedUnion('type', [
+    zod_1.z.strictObject({ type: zod_1.z.literal('email'), value: email }),
+    zod_1.z.strictObject({ type: zod_1.z.literal('sub'), value: subject }),
+]);
+exports.directoryPrincipalResolveRequestSchema = zod_1.z.strictObject({
+    tenant: exports.directoryTenantSchema,
+    lookups: zod_1.z.array(exports.directoryPrincipalLookupSchema).min(1).max(exports.DIRECTORY_PRINCIPALS_PER_REQUEST)
+        .refine((values) => new Set(values.map((value) => `${value.type}:${value.value}`)).size === values.length, 'Lookups must be distinct'),
+});
+exports.directoryResolvedPrincipalSchema = zod_1.z.strictObject({
+    lookup: exports.directoryPrincipalLookupSchema,
+    sub: subject.refine((value) => !value.startsWith('service-account|') && !value.startsWith('managed-function|') && !value.endsWith('@clients') && value !== 'google-apps|sequence.agent@seqholdings.com', 'Only human directory principals can resolve'),
+    email: zod_1.z.union([email, zod_1.z.literal('')]),
+    name: zod_1.z.string().max(255),
+});
+exports.directoryPrincipalResolutionSchema = zod_1.z.strictObject({
+    resolved: zod_1.z.array(exports.directoryResolvedPrincipalSchema).max(exports.DIRECTORY_PRINCIPALS_PER_REQUEST),
+    unresolved: zod_1.z.array(exports.directoryPrincipalLookupSchema).max(exports.DIRECTORY_PRINCIPALS_PER_REQUEST),
+});
+exports.functionDirectoryScopesSchema = zod_1.z.strictObject({
+    resolve: zod_1.z.array(exports.directoryTenantSchema).min(1).max(16)
+        .refine((values) => new Set(values).size === values.length, 'Tenant scopes must be distinct'),
+});
+function readFunctionDirectoryScopes(manifest) {
+    if (typeof manifest !== 'object' || manifest === null)
+        return [];
+    const capabilities = Reflect.get(manifest, 'capabilities');
+    if (typeof capabilities !== 'object' || capabilities === null)
+        return [];
+    const directory = Reflect.get(capabilities, 'directory');
+    if (typeof directory !== 'object' || directory === null)
+        return [];
+    const resolve = Reflect.get(directory, 'resolve');
+    return resolve === undefined ? [] : exports.functionDirectoryScopesSchema.parse({ resolve }).resolve;
+}
+class DirectoryPrincipalResolveError extends Error {
+    status;
+    code;
+    name = 'DirectoryPrincipalResolveError';
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+exports.DirectoryPrincipalResolveError = DirectoryPrincipalResolveError;

package/dist/directory-manifest.d.ts

@@ -0,0 +1,5 @@
+import { z } from 'zod';
+export declare const functionDirectoryManifestSchema: z.ZodObject<{
+    groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    resolve: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;

package/dist/directory-manifest.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.functionDirectoryManifestSchema = void 0;
+const zod_1 = require("zod");
+const directory_config_1 = require("./directory-config");
+const directory_contract_1 = require("./directory-contract");
+exports.functionDirectoryManifestSchema = zod_1.z.strictObject({
+    groups: directory_config_1.directoryScopesSchema.shape.groups.optional(),
+    resolve: directory_contract_1.functionDirectoryScopesSchema.shape.resolve.optional(),
+}).refine((value) => value.groups !== undefined || value.resolve !== undefined, 'Declare directory groups, tenant resolution scopes, or both');

package/dist/http-tracing.js

@@ -20,5 +20,8 @@ function shouldReportAtlasHttp(pathname, method) {
     if (method === 'POST' &&
         /^\/api\/lattice\/(runs|processes\/[^/]+\/runs)\/?$/.test(pathname))
         return false;
+    if (method === 'POST' &&
+        /^\/api\/external-systems\/call\/?$/.test(pathname))
+        return false;
     return true;
 }

package/dist/immutable-release-contract.d.ts

@@ -0,0 +1,3 @@
+import { z } from 'zod';
+export declare const functionImmutableReleaseSchema: z.ZodBoolean;
+export declare function readFunctionImmutableRelease(manifest: unknown): boolean;

package/dist/immutable-release-contract.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.functionImmutableReleaseSchema = void 0;
+exports.readFunctionImmutableRelease = readFunctionImmutableRelease;
+const zod_1 = require("zod");
+exports.functionImmutableReleaseSchema = zod_1.z.boolean();
+function readFunctionImmutableRelease(manifest) {
+    if (typeof manifest !== 'object' || manifest === null)
+        return false;
+    const fn = Reflect.get(manifest, 'function');
+    return typeof fn === 'object' && fn !== null && Reflect.get(fn, 'immutable_release') === true;
+}

package/dist/index.d.ts

@@ -1,8 +1,42 @@
 export { createFunctionDirectoryClient, FunctionDirectoryReadError } from './directory';
 export type { FunctionDirectoryClient, FunctionDirectoryOptions, FunctionDirectoryMembers, FunctionDirectoryMembersQuery } from './directory';
 export type { FunctionInvocationClientOptions } from './invocation-client';
+export { functionLatticeContextCapabilitySchema, readFunctionLatticeContextCapability } from './lattice-capability';
+export { createFunctionLatticeClient } from './lattice-provenance';
+export { functionLatticeParallelSnapshotSchema, functionLatticeParallelSnapshotQuerySchema } from './lattice-provenance-contract';
+export type { FunctionLatticeParallelSnapshot, FunctionLatticeParallelSnapshotQuery } from './lattice-provenance-contract';
+export { functionLatticeStartProvenanceSchema } from './lattice-provenance-contract';
+export type { FunctionLatticeStartProvenance } from './lattice-provenance-contract';
+export * from './invocation-contract';
+export * from './abrigo';
+export { createFunctionInvocationClient } from './invocation';
+export type { FunctionInvocationClient } from './invocation';
+export { FUNCTION_LATTICE_CONTEXT_PATH, FUNCTION_LATTICE_EXECUTION_TOKEN_HEADER, FunctionLatticeContextError, functionLatticeContextRequestSchema, functionLatticeExecutionContextSchema, functionLatticeHumanCompletionQuerySchema, functionLatticeHumanCompletionSchema } from './lattice-provenance-contract';
+export type { FunctionLatticeClient, FunctionLatticeClientOptions } from './lattice-provenance';
+export { functionLatticeHumanCompletionsQuerySchema, functionLatticeHumanCompletionsPageSchema } from './lattice-provenance-contract';
+export type { FunctionLatticeHumanCompletionsQuery, FunctionLatticeHumanCompletionsPage } from './lattice-provenance-contract';
+export type { FunctionLatticeContextRequest, FunctionLatticeExecutionContext, FunctionLatticeHumanCompletion, FunctionLatticeHumanCompletionQuery } from './lattice-provenance-contract';
 export { createFunctionServiceProcessesClient, FunctionProcessReadError } from './processes';
-export type { FunctionServiceProcessesClient, FunctionServiceProcessesOptions, FunctionProcessRunQuery, FunctionProcessRunSummary, FunctionProcessRunStatus, FunctionProcessRunsPage, FunctionProcessRunsPageQuery, FunctionProcessReadRequest } from './processes';
+export { createFunctionServiceAgentsClient, FunctionAgentReadError } from './agents';
+export { createFunctionAgentEvidenceClient } from './agent-evidence';
+export { createFunctionServiceWorkflowsClient, createFunctionWorkflowEvidenceClient } from './workflow-source';
+export type { FunctionServiceWorkflowsClient, FunctionServiceWorkflowsOptions, FunctionWorkflowEvidenceClient, FunctionWorkflowSourceEvidenceInput } from './workflow-source';
+export * from './workflow-source-contract';
+export type { FunctionAgentEvidenceClient, FunctionAgentSourceEvidenceInput, FunctionAgentConversationEvidenceInput } from './agent-evidence';
+export type { FunctionAgentSourceEvidenceCapture, FunctionAgentSourceEvidenceClaims, FunctionAgentSourceEvidenceVerification, FunctionAgentConversationResponse, FunctionAgentConversationEvidenceResponse, FunctionAgentConversationEvidenceCapture, FunctionAgentSourceExecution } from './agent-source-evidence-contract';
+export { functionAgentSourceResponseSchema, functionAgentSourceEvidenceRequestSchema, functionAgentSourceEvidenceCaptureSchema, functionAgentConversationEvidenceResponseSchema, functionAgentConversationEvidenceCaptureSchema, functionAgentConversationEvidenceRequestSchema, functionAgentSourceExecutionSchema } from './agent-source-evidence-contract';
+export { functionSourceJobAdmissionSchema } from './agent-source-evidence-contract';
+export type { FunctionSourceJobAdmission } from './agent-source-evidence-contract';
+export type { FunctionServiceAgentsClient, FunctionServiceAgentsOptions, FunctionAgentCompletedRunQuery, FunctionAgentCompletedRun } from './agents';
+export { createFunctionServiceMonitoringClient } from './monitoring';
+export { FunctionMonitoringError, monitoringPayloadHash } from './monitoring-contract';
+export { monitoringEventsSchema, monitoringPublishSchema } from './monitoring-contract';
+export { functionMonitoringAnnotationSchema } from './monitoring-annotations';
+export type { MonitoringDeltaEvent, MonitoringPublish, MonitoringDeliveryKey, MonitoringDeliveryReceipt } from './monitoring-contract';
+export type { MonitoringCatalogQuery, MonitoringBucketCatalog } from './monitoring-contract';
+export type { FunctionMonitoringAnnotation, MonitoringJson } from './monitoring-annotations';
+export type { FunctionServiceMonitoringClient, FunctionServiceMonitoringOptions } from './monitoring';
+export type { FunctionServiceProcessesClient, FunctionServiceProcessesOptions, FunctionProcessRunQuery, FunctionProcessRunSummary, FunctionProcessRunStatus, FunctionProcessRunsPage, FunctionProcessRunsPageQuery, FunctionProcessReadRequest, FunctionProcessCompletedAgentReferenceQuery, FunctionProcessCompletedAgentReference } from './processes';
 export { installFunctionTracing, runWithFunctionTracing } from './tracing';
 export { createFunctionStorageClient } from './storage';
 import { type CacheManager } from "./cache";
@@ -16,3 +50,5 @@ export interface ManagedFunctionContext {
 export declare function createManagedFunctionContext({ env, }?: {
     env?: NodeJS.ProcessEnv;
 }): ManagedFunctionContext;
+export * from './directory-contract';
+export { createFunctionServiceDirectoryClient, type FunctionServiceDirectoryOptions, type FunctionServiceDirectoryClient } from './service-directory';