@sequenceholdings/managed-functions 0.4.1 → 0.4.2

package/dist/index.js

@@ -1,13 +1,81 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.readCacheConfiguration = exports.cacheManifestSchema = exports.createCacheManager = exports.CacheError = exports.createFunctionStorageClient = exports.runWithFunctionTracing = exports.installFunctionTracing = exports.FunctionProcessReadError = exports.createFunctionServiceProcessesClient = exports.FunctionDirectoryReadError = exports.createFunctionDirectoryClient = void 0;
+exports.createFunctionServiceDirectoryClient = exports.readCacheConfiguration = exports.cacheManifestSchema = exports.createCacheManager = exports.CacheError = exports.createFunctionStorageClient = exports.runWithFunctionTracing = exports.installFunctionTracing = exports.functionMonitoringAnnotationSchema = exports.monitoringPublishSchema = exports.monitoringEventsSchema = exports.monitoringPayloadHash = exports.FunctionMonitoringError = exports.createFunctionServiceMonitoringClient = exports.functionSourceJobAdmissionSchema = exports.functionAgentSourceExecutionSchema = exports.functionAgentConversationEvidenceRequestSchema = exports.functionAgentConversationEvidenceCaptureSchema = exports.functionAgentConversationEvidenceResponseSchema = exports.functionAgentSourceEvidenceCaptureSchema = exports.functionAgentSourceEvidenceRequestSchema = exports.functionAgentSourceResponseSchema = exports.createFunctionWorkflowEvidenceClient = exports.createFunctionServiceWorkflowsClient = exports.createFunctionAgentEvidenceClient = exports.FunctionAgentReadError = exports.createFunctionServiceAgentsClient = exports.FunctionProcessReadError = exports.createFunctionServiceProcessesClient = exports.functionLatticeHumanCompletionsPageSchema = exports.functionLatticeHumanCompletionsQuerySchema = exports.functionLatticeHumanCompletionSchema = exports.functionLatticeHumanCompletionQuerySchema = exports.functionLatticeExecutionContextSchema = exports.functionLatticeContextRequestSchema = exports.FunctionLatticeContextError = exports.FUNCTION_LATTICE_EXECUTION_TOKEN_HEADER = exports.FUNCTION_LATTICE_CONTEXT_PATH = exports.createFunctionInvocationClient = exports.functionLatticeStartProvenanceSchema = exports.functionLatticeParallelSnapshotQuerySchema = exports.functionLatticeParallelSnapshotSchema = exports.createFunctionLatticeClient = exports.readFunctionLatticeContextCapability = exports.functionLatticeContextCapabilitySchema = exports.FunctionDirectoryReadError = exports.createFunctionDirectoryClient = void 0;
 exports.createManagedFunctionContext = createManagedFunctionContext;
 var directory_1 = require("./directory");
 Object.defineProperty(exports, "createFunctionDirectoryClient", { enumerable: true, get: function () { return directory_1.createFunctionDirectoryClient; } });
 Object.defineProperty(exports, "FunctionDirectoryReadError", { enumerable: true, get: function () { return directory_1.FunctionDirectoryReadError; } });
+var lattice_capability_1 = require("./lattice-capability");
+Object.defineProperty(exports, "functionLatticeContextCapabilitySchema", { enumerable: true, get: function () { return lattice_capability_1.functionLatticeContextCapabilitySchema; } });
+Object.defineProperty(exports, "readFunctionLatticeContextCapability", { enumerable: true, get: function () { return lattice_capability_1.readFunctionLatticeContextCapability; } });
+var lattice_provenance_1 = require("./lattice-provenance");
+Object.defineProperty(exports, "createFunctionLatticeClient", { enumerable: true, get: function () { return lattice_provenance_1.createFunctionLatticeClient; } });
+var lattice_provenance_contract_1 = require("./lattice-provenance-contract");
+Object.defineProperty(exports, "functionLatticeParallelSnapshotSchema", { enumerable: true, get: function () { return lattice_provenance_contract_1.functionLatticeParallelSnapshotSchema; } });
+Object.defineProperty(exports, "functionLatticeParallelSnapshotQuerySchema", { enumerable: true, get: function () { return lattice_provenance_contract_1.functionLatticeParallelSnapshotQuerySchema; } });
+var lattice_provenance_contract_2 = require("./lattice-provenance-contract");
+Object.defineProperty(exports, "functionLatticeStartProvenanceSchema", { enumerable: true, get: function () { return lattice_provenance_contract_2.functionLatticeStartProvenanceSchema; } });
+__exportStar(require("./invocation-contract"), exports);
+__exportStar(require("./abrigo"), exports);
+var invocation_1 = require("./invocation");
+Object.defineProperty(exports, "createFunctionInvocationClient", { enumerable: true, get: function () { return invocation_1.createFunctionInvocationClient; } });
+var lattice_provenance_contract_3 = require("./lattice-provenance-contract");
+Object.defineProperty(exports, "FUNCTION_LATTICE_CONTEXT_PATH", { enumerable: true, get: function () { return lattice_provenance_contract_3.FUNCTION_LATTICE_CONTEXT_PATH; } });
+Object.defineProperty(exports, "FUNCTION_LATTICE_EXECUTION_TOKEN_HEADER", { enumerable: true, get: function () { return lattice_provenance_contract_3.FUNCTION_LATTICE_EXECUTION_TOKEN_HEADER; } });
+Object.defineProperty(exports, "FunctionLatticeContextError", { enumerable: true, get: function () { return lattice_provenance_contract_3.FunctionLatticeContextError; } });
+Object.defineProperty(exports, "functionLatticeContextRequestSchema", { enumerable: true, get: function () { return lattice_provenance_contract_3.functionLatticeContextRequestSchema; } });
+Object.defineProperty(exports, "functionLatticeExecutionContextSchema", { enumerable: true, get: function () { return lattice_provenance_contract_3.functionLatticeExecutionContextSchema; } });
+Object.defineProperty(exports, "functionLatticeHumanCompletionQuerySchema", { enumerable: true, get: function () { return lattice_provenance_contract_3.functionLatticeHumanCompletionQuerySchema; } });
+Object.defineProperty(exports, "functionLatticeHumanCompletionSchema", { enumerable: true, get: function () { return lattice_provenance_contract_3.functionLatticeHumanCompletionSchema; } });
+var lattice_provenance_contract_4 = require("./lattice-provenance-contract");
+Object.defineProperty(exports, "functionLatticeHumanCompletionsQuerySchema", { enumerable: true, get: function () { return lattice_provenance_contract_4.functionLatticeHumanCompletionsQuerySchema; } });
+Object.defineProperty(exports, "functionLatticeHumanCompletionsPageSchema", { enumerable: true, get: function () { return lattice_provenance_contract_4.functionLatticeHumanCompletionsPageSchema; } });
 var processes_1 = require("./processes");
 Object.defineProperty(exports, "createFunctionServiceProcessesClient", { enumerable: true, get: function () { return processes_1.createFunctionServiceProcessesClient; } });
 Object.defineProperty(exports, "FunctionProcessReadError", { enumerable: true, get: function () { return processes_1.FunctionProcessReadError; } });
+var agents_1 = require("./agents");
+Object.defineProperty(exports, "createFunctionServiceAgentsClient", { enumerable: true, get: function () { return agents_1.createFunctionServiceAgentsClient; } });
+Object.defineProperty(exports, "FunctionAgentReadError", { enumerable: true, get: function () { return agents_1.FunctionAgentReadError; } });
+var agent_evidence_1 = require("./agent-evidence");
+Object.defineProperty(exports, "createFunctionAgentEvidenceClient", { enumerable: true, get: function () { return agent_evidence_1.createFunctionAgentEvidenceClient; } });
+var workflow_source_1 = require("./workflow-source");
+Object.defineProperty(exports, "createFunctionServiceWorkflowsClient", { enumerable: true, get: function () { return workflow_source_1.createFunctionServiceWorkflowsClient; } });
+Object.defineProperty(exports, "createFunctionWorkflowEvidenceClient", { enumerable: true, get: function () { return workflow_source_1.createFunctionWorkflowEvidenceClient; } });
+__exportStar(require("./workflow-source-contract"), exports);
+var agent_source_evidence_contract_1 = require("./agent-source-evidence-contract");
+Object.defineProperty(exports, "functionAgentSourceResponseSchema", { enumerable: true, get: function () { return agent_source_evidence_contract_1.functionAgentSourceResponseSchema; } });
+Object.defineProperty(exports, "functionAgentSourceEvidenceRequestSchema", { enumerable: true, get: function () { return agent_source_evidence_contract_1.functionAgentSourceEvidenceRequestSchema; } });
+Object.defineProperty(exports, "functionAgentSourceEvidenceCaptureSchema", { enumerable: true, get: function () { return agent_source_evidence_contract_1.functionAgentSourceEvidenceCaptureSchema; } });
+Object.defineProperty(exports, "functionAgentConversationEvidenceResponseSchema", { enumerable: true, get: function () { return agent_source_evidence_contract_1.functionAgentConversationEvidenceResponseSchema; } });
+Object.defineProperty(exports, "functionAgentConversationEvidenceCaptureSchema", { enumerable: true, get: function () { return agent_source_evidence_contract_1.functionAgentConversationEvidenceCaptureSchema; } });
+Object.defineProperty(exports, "functionAgentConversationEvidenceRequestSchema", { enumerable: true, get: function () { return agent_source_evidence_contract_1.functionAgentConversationEvidenceRequestSchema; } });
+Object.defineProperty(exports, "functionAgentSourceExecutionSchema", { enumerable: true, get: function () { return agent_source_evidence_contract_1.functionAgentSourceExecutionSchema; } });
+var agent_source_evidence_contract_2 = require("./agent-source-evidence-contract");
+Object.defineProperty(exports, "functionSourceJobAdmissionSchema", { enumerable: true, get: function () { return agent_source_evidence_contract_2.functionSourceJobAdmissionSchema; } });
+var monitoring_1 = require("./monitoring");
+Object.defineProperty(exports, "createFunctionServiceMonitoringClient", { enumerable: true, get: function () { return monitoring_1.createFunctionServiceMonitoringClient; } });
+var monitoring_contract_1 = require("./monitoring-contract");
+Object.defineProperty(exports, "FunctionMonitoringError", { enumerable: true, get: function () { return monitoring_contract_1.FunctionMonitoringError; } });
+Object.defineProperty(exports, "monitoringPayloadHash", { enumerable: true, get: function () { return monitoring_contract_1.monitoringPayloadHash; } });
+var monitoring_contract_2 = require("./monitoring-contract");
+Object.defineProperty(exports, "monitoringEventsSchema", { enumerable: true, get: function () { return monitoring_contract_2.monitoringEventsSchema; } });
+Object.defineProperty(exports, "monitoringPublishSchema", { enumerable: true, get: function () { return monitoring_contract_2.monitoringPublishSchema; } });
+var monitoring_annotations_1 = require("./monitoring-annotations");
+Object.defineProperty(exports, "functionMonitoringAnnotationSchema", { enumerable: true, get: function () { return monitoring_annotations_1.functionMonitoringAnnotationSchema; } });
 var tracing_1 = require("./tracing");
 Object.defineProperty(exports, "installFunctionTracing", { enumerable: true, get: function () { return tracing_1.installFunctionTracing; } });
 Object.defineProperty(exports, "runWithFunctionTracing", { enumerable: true, get: function () { return tracing_1.runWithFunctionTracing; } });
@@ -68,3 +136,6 @@ function lazyValkeyStore(connection, local) {
         delete: async (key) => (await client()).delete(key),
     };
 }
+__exportStar(require("./directory-contract"), exports);
+var service_directory_1 = require("./service-directory");
+Object.defineProperty(exports, "createFunctionServiceDirectoryClient", { enumerable: true, get: function () { return service_directory_1.createFunctionServiceDirectoryClient; } });

package/dist/invocation-client.d.ts

@@ -18,13 +18,20 @@ export declare function readInvocationCredential<T extends {
     token: string;
     expiresAt: number;
 };
-export declare function createInvocationReadTransport({ baseUrl, fetchImpl, path, header, credential, timeoutMs, error, failure, }: Pick<FunctionInvocationClientOptions, 'baseUrl' | 'fetchImpl'> & {
+export declare function createInvocationReadTransport({ baseUrl, fetchImpl, path, header, credential, additionalCredentials, timeoutMs, error, failure, }: Pick<FunctionInvocationClientOptions, 'baseUrl' | 'fetchImpl'> & {
     path: string;
     header: string;
     credential: {
         token: string;
         expiresAt: number;
     };
+    additionalCredentials?: readonly {
+        header: string;
+        credential: {
+            token: string;
+            expiresAt: number;
+        };
+    }[];
     timeoutMs: number;
     error: ClientErrorFactory;
     failure: {

package/dist/invocation-client.js

@@ -54,17 +54,22 @@ const errorResponseSchema = zod_1.z.object({
     code: zod_1.z.string().max(128).optional(),
     detail: zod_1.z.string().max(2000).optional(),
 });
-function createInvocationReadTransport({ baseUrl, fetchImpl = globalThis.fetch, path, header, credential, timeoutMs, error, failure, }) {
+function createInvocationReadTransport({ baseUrl, fetchImpl = globalThis.fetch, path, header, credential, additionalCredentials = [], timeoutMs, error, failure, }) {
     const url = `${trustedOrigin({ baseUrl, error })}${path}`;
+    const credentials = [{ header, credential }, ...additionalCredentials];
+    const names = credentials.map((value) => value.header.toLowerCase());
+    if (new Set(names).size !== names.length || names.includes('content-type')) {
+        throw error(400, 'invalid_configuration', 'Credential headers must be distinct');
+    }
     return async function read({ body, schema, }) {
-        if (credential.expiresAt <= Date.now() / 1000) {
+        if (credentials.some((value) => value.credential.expiresAt <= Date.now() / 1000)) {
             throw error(401, 'expired_context', 'The invocation credential expired; start a new invocation');
         }
         const response = await fetchImpl(url, {
             method: 'POST',
             headers: {
                 'content-type': 'application/json',
-                [header]: credential.token,
+                ...Object.fromEntries(credentials.map((value) => [value.header, value.credential.token])),
             },
             body: JSON.stringify(body),
             redirect: 'error',

package/dist/invocation-contract.d.ts

@@ -0,0 +1,36 @@
+import { z } from 'zod';
+export declare const FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER = "x-sequence-invocation-identity-token";
+export declare const FUNCTION_INVOCATION_CONTEXT_PATH = "/api/managed-functions/invocation/context";
+export declare const functionInvocationIdentityCapabilitySchema: z.ZodObject<{
+    identity: z.ZodLiteral<true>;
+}, z.core.$strict>;
+export declare function readFunctionInvocationIdentityCapability(manifest: unknown): boolean;
+export declare const functionInvocationContextRequestSchema: z.ZodObject<{
+    operation: z.ZodLiteral<"getInvocationContext">;
+}, z.core.$strict>;
+export type FunctionInvocationContextRequest = z.infer<typeof functionInvocationContextRequestSchema>;
+export declare const functionInvocationContextSchema: z.ZodObject<{
+    receiver: z.ZodObject<{
+        functionId: z.ZodString;
+        versionId: z.ZodString;
+        invocationId: z.ZodString;
+        orgId: z.ZodString;
+        serviceAccountId: z.ZodString;
+        serviceAccountSub: z.ZodString;
+    }, z.core.$strict>;
+    caller: z.ZodObject<{
+        kind: z.ZodEnum<{
+            human: "human";
+            service_account: "service_account";
+            system: "system";
+        }>;
+        sub: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type FunctionInvocationContext = z.infer<typeof functionInvocationContextSchema>;
+export declare class FunctionInvocationContextError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly name = "FunctionInvocationContextError";
+    constructor(status: number, code: string, message: string);
+}

package/dist/invocation-contract.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FunctionInvocationContextError = exports.functionInvocationContextSchema = exports.functionInvocationContextRequestSchema = exports.functionInvocationIdentityCapabilitySchema = exports.FUNCTION_INVOCATION_CONTEXT_PATH = exports.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER = void 0;
+exports.readFunctionInvocationIdentityCapability = readFunctionInvocationIdentityCapability;
+const zod_1 = require("zod");
+exports.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER = 'x-sequence-invocation-identity-token';
+exports.FUNCTION_INVOCATION_CONTEXT_PATH = '/api/managed-functions/invocation/context';
+const identifier = zod_1.z.string().min(1).max(255);
+const principal = zod_1.z.string().min(1).max(512);
+exports.functionInvocationIdentityCapabilitySchema = zod_1.z.strictObject({
+    identity: zod_1.z.literal(true),
+});
+function readFunctionInvocationIdentityCapability(manifest) {
+    if (typeof manifest !== 'object' || manifest === null)
+        return false;
+    const capabilities = Reflect.get(manifest, 'capabilities');
+    if (typeof capabilities !== 'object' || capabilities === null)
+        return false;
+    return exports.functionInvocationIdentityCapabilitySchema.safeParse(Reflect.get(capabilities, 'invocation')).success;
+}
+exports.functionInvocationContextRequestSchema = zod_1.z.strictObject({
+    operation: zod_1.z.literal('getInvocationContext'),
+});
+exports.functionInvocationContextSchema = zod_1.z.strictObject({
+    receiver: zod_1.z.strictObject({
+        functionId: identifier,
+        versionId: identifier,
+        invocationId: identifier,
+        orgId: identifier,
+        serviceAccountId: identifier,
+        serviceAccountSub: principal,
+    }).refine((value) => value.serviceAccountSub === `service-account|${value.serviceAccountId}`, 'The receiver subject must identify the attached service account'),
+    caller: zod_1.z.strictObject({
+        kind: zod_1.z.enum(['human', 'service_account', 'system']),
+        sub: principal,
+    }),
+});
+class FunctionInvocationContextError extends Error {
+    status;
+    code;
+    name = 'FunctionInvocationContextError';
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+exports.FunctionInvocationContextError = FunctionInvocationContextError;

package/dist/invocation.d.ts

@@ -0,0 +1,8 @@
+import { type FunctionInvocationContext } from './invocation-contract';
+export * from './invocation-contract';
+import type { FunctionInvocationClientOptions } from './invocation-client';
+export type { FunctionInvocationClientOptions } from './invocation-client';
+export interface FunctionInvocationClient {
+    getInvocationContext(): Promise<FunctionInvocationContext>;
+}
+export declare function createFunctionInvocationClient({ request, baseUrl, fetchImpl, }: FunctionInvocationClientOptions): FunctionInvocationClient;

package/dist/invocation.js

@@ -0,0 +1,134 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFunctionInvocationClient = createFunctionInvocationClient;
+const zod_1 = require("zod");
+const invocation_contract_1 = require("./invocation-contract");
+__exportStar(require("./invocation-contract"), exports);
+const identifier = zod_1.z.string().min(1).max(255);
+const principal = zod_1.z.string().min(1).max(512);
+const tokenClaimsSchema = zod_1.z.strictObject({
+    audience: zod_1.z.literal('atlas-managed-function-invocation-identity'),
+    environment: zod_1.z.string().min(1).max(4096),
+    functionId: identifier,
+    versionId: identifier,
+    invocationId: identifier,
+    serviceAccountId: identifier,
+    org: identifier,
+    callerKind: zod_1.z.enum(['human', 'service_account', 'system']),
+    callerSub: principal,
+    callerAuthenticationMethod: identifier,
+    exp: zod_1.z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+});
+const errorSchema = zod_1.z.strictObject({
+    code: zod_1.z.string().min(1).max(128).regex(/^[a-z][a-z0-9_]*$/),
+    detail: zod_1.z.string().min(1).max(2000),
+});
+const invalidContext = () => new invocation_contract_1.FunctionInvocationContextError(401, 'invalid_context', 'This invocation has no valid identity credential');
+function readCredential({ request }) {
+    const { headers } = request;
+    const matches = typeof headers.get === 'function'
+        ? [headers.get(invocation_contract_1.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER)]
+        : Object.entries(headers)
+            .filter(([name]) => name.toLowerCase() === invocation_contract_1.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER)
+            .map(([, value]) => value);
+    const token = matches[0];
+    if (matches.length !== 1 || typeof token !== 'string' || token.length > 16_384)
+        throw invalidContext();
+    const envelope = /^([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]{43})$/.exec(token);
+    if (!envelope?.[1])
+        throw invalidContext();
+    let value;
+    try {
+        const decoded = Buffer.from(envelope[1], 'base64url');
+        if (decoded.toString('base64url') !== envelope[1])
+            throw invalidContext();
+        value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(decoded));
+    }
+    catch {
+        throw invalidContext();
+    }
+    const parsed = tokenClaimsSchema.safeParse(value);
+    if (!parsed.success)
+        throw invalidContext();
+    return { token, claims: parsed.data };
+}
+function trustedOrigin(baseUrl) {
+    const invalid = () => new invocation_contract_1.FunctionInvocationContextError(400, 'invalid_configuration', 'Configure a trusted HTTPS Atlas origin without credentials, path, query or fragment');
+    let url;
+    try {
+        url = new URL(baseUrl);
+    }
+    catch {
+        throw invalid();
+    }
+    const loopback = url.protocol === 'http:' &&
+        ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if ((!loopback && url.protocol !== 'https:') || url.username || url.password ||
+        url.pathname !== '/' || url.search || url.hash)
+        throw invalid();
+    return url.origin;
+}
+function requireFresh(claims) {
+    if (claims.exp <= Date.now() / 1000)
+        throw new invocation_contract_1.FunctionInvocationContextError(401, 'expired_context', 'The identity credential expired; start a new invocation');
+}
+function matchesInvocation({ context, claims, }) {
+    const { receiver, caller } = context;
+    return receiver.functionId === claims.functionId &&
+        receiver.versionId === claims.versionId &&
+        receiver.invocationId === claims.invocationId &&
+        receiver.orgId === claims.org &&
+        receiver.serviceAccountId === claims.serviceAccountId &&
+        caller.kind === claims.callerKind && caller.sub === claims.callerSub;
+}
+function createFunctionInvocationClient({ request, baseUrl, fetchImpl = globalThis.fetch, }) {
+    const url = `${trustedOrigin(baseUrl)}${invocation_contract_1.FUNCTION_INVOCATION_CONTEXT_PATH}`;
+    const { token, claims } = readCredential({ request });
+    return {
+        async getInvocationContext() {
+            requireFresh(claims);
+            let response;
+            try {
+                response = await fetchImpl(url, {
+                    method: 'POST',
+                    headers: {
+                        'content-type': 'application/json',
+                        [invocation_contract_1.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER]: token,
+                    },
+                    body: JSON.stringify(invocation_contract_1.functionInvocationContextRequestSchema.parse({ operation: 'getInvocationContext' })),
+                    redirect: 'error', signal: AbortSignal.timeout(30_000),
+                });
+            }
+            catch {
+                throw new invocation_contract_1.FunctionInvocationContextError(502, 'context_request_failed', 'The invocation context request failed');
+            }
+            if (response.redirected || (response.status >= 300 && response.status < 400))
+                throw new invocation_contract_1.FunctionInvocationContextError(502, 'redirect_refused', 'The invocation context request must not redirect');
+            const result = await response.json().catch(() => null);
+            if (!response.ok) {
+                const error = errorSchema.safeParse(result);
+                throw new invocation_contract_1.FunctionInvocationContextError(response.status, error.success ? error.data.code : 'context_read_failed', error.success && !error.data.detail.includes(token)
+                    ? error.data.detail : 'Invocation context read failed');
+            }
+            requireFresh(claims);
+            const parsed = invocation_contract_1.functionInvocationContextSchema.safeParse(result);
+            if (!parsed.success || !matchesInvocation({ context: parsed.data, claims }))
+                throw new invocation_contract_1.FunctionInvocationContextError(502, 'malformed_response', 'Atlas returned an invalid invocation context response');
+            return parsed.data;
+        },
+    };
+}

package/dist/lattice-capability.d.ts

@@ -0,0 +1,5 @@
+import { z } from 'zod';
+export declare const functionLatticeContextCapabilitySchema: z.ZodObject<{
+    context: z.ZodLiteral<true>;
+}, z.core.$strict>;
+export declare function readFunctionLatticeContextCapability(manifest: unknown): boolean;

package/dist/lattice-capability.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.functionLatticeContextCapabilitySchema = void 0;
+exports.readFunctionLatticeContextCapability = readFunctionLatticeContextCapability;
+const zod_1 = require("zod");
+exports.functionLatticeContextCapabilitySchema = zod_1.z.strictObject({
+    context: zod_1.z.literal(true),
+});
+function readFunctionLatticeContextCapability(manifest) {
+    if (typeof manifest !== 'object' || manifest === null)
+        return false;
+    const capabilities = Reflect.get(manifest, 'capabilities');
+    if (typeof capabilities !== 'object' || capabilities === null)
+        return false;
+    return exports.functionLatticeContextCapabilitySchema.safeParse(Reflect.get(capabilities, 'lattice')).success;
+}