@sequenceholdings/managed-functions 0.4.2 → 0.4.4

package/dist/runtime.cjs

@@ -17111,7 +17111,7 @@ var require_lattice_provenance_contract = __commonJS({
   "dist/lattice-provenance-contract.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.FunctionLatticeContextError = exports2.functionLatticeParallelSnapshotSchema = exports2.functionLatticeHumanCompletionsPageSchema = exports2.functionLatticeHumanCompletionSchema = exports2.functionLatticeExecutionContextSchema = exports2.functionLatticeContextRequestSchema = exports2.functionLatticeParallelSnapshotQuerySchema = exports2.functionLatticeHumanCompletionsQuerySchema = exports2.functionLatticeHumanCompletionQuerySchema = exports2.functionLatticeStartProvenanceSchema = exports2.FUNCTION_LATTICE_CONTEXT_PATH = exports2.FUNCTION_LATTICE_EXECUTION_TOKEN_HEADER = void 0;
+    exports2.FunctionLatticeContextError = exports2.functionLatticeParallelSnapshotSchema = exports2.functionLatticeHumanCompletionsPageSchema = exports2.functionLatticeHumanCompletionSchema = exports2.functionLatticeExecutionContextSchema = exports2.functionLatticeRunCreatorAccessSchema = exports2.functionLatticeContextRequestSchema = exports2.functionLatticeParallelSnapshotQuerySchema = exports2.functionLatticeHumanCompletionsQuerySchema = exports2.functionLatticeHumanCompletionQuerySchema = exports2.functionLatticeStartProvenanceSchema = exports2.FUNCTION_LATTICE_CONTEXT_PATH = exports2.FUNCTION_LATTICE_EXECUTION_TOKEN_HEADER = void 0;
     var zod_12 = require_zod();
     exports2.FUNCTION_LATTICE_EXECUTION_TOKEN_HEADER = "x-sequence-lattice-execution-token";
     exports2.FUNCTION_LATTICE_CONTEXT_PATH = "/api/managed-functions/lattice/context";
@@ -17150,6 +17150,7 @@ var require_lattice_provenance_contract = __commonJS({
     exports2.functionLatticeParallelSnapshotQuerySchema = zod_12.z.strictObject({ nodeId: identifier, ancestorNodeId: identifier });
     exports2.functionLatticeContextRequestSchema = zod_12.z.discriminatedUnion("operation", [
       zod_12.z.strictObject({ operation: zod_12.z.literal("getExecutionContext") }),
+      zod_12.z.strictObject({ operation: zod_12.z.literal("getRunCreatorAccess") }),
       exports2.functionLatticeHumanCompletionQuerySchema.extend({
         operation: zod_12.z.literal("getHumanCompletion")
       }),
@@ -17183,6 +17184,14 @@ var require_lattice_provenance_contract = __commonJS({
         attachedServiceAccountSub: principal
       })
     });
+    exports2.functionLatticeRunCreatorAccessSchema = executionIdentity.extend({
+      creator: zod_12.z.strictObject({
+        sub: principal,
+        tenant: zod_12.z.string().min(1).max(64).nullable(),
+        platformOperator: zod_12.z.boolean()
+      }).nullable(),
+      observedAt: zod_12.z.iso.datetime({ offset: true })
+    });
     exports2.functionLatticeExecutionContextSchema = executionIdentity.extend({
       input: zod_12.z.unknown(),
       ctxSnapshot: zod_12.z.object({
@@ -17401,6 +17410,9 @@ var require_lattice_provenance = __commonJS({
         getExecutionContext() {
           return read({ body: { operation: "getExecutionContext" }, schema: lattice_provenance_contract_12.functionLatticeExecutionContextSchema, executions: (value) => [value] });
         },
+        getRunCreatorAccess() {
+          return read({ body: { operation: "getRunCreatorAccess" }, schema: lattice_provenance_contract_12.functionLatticeRunCreatorAccessSchema, executions: (value) => [value] });
+        },
         async getHumanCompletion(query) {
           const completion = await read({
             body: { ...query, operation: "getHumanCompletion" },
@@ -17435,7 +17447,7 @@ var require_invocation_contract = __commonJS({
   "dist/invocation-contract.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.FunctionInvocationContextError = exports2.functionInvocationContextSchema = exports2.functionInvocationContextRequestSchema = exports2.functionInvocationIdentityCapabilitySchema = exports2.FUNCTION_INVOCATION_CONTEXT_PATH = exports2.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER = void 0;
+    exports2.functionInvocationCapabilitiesSchema = exports2.FunctionInvocationContextError = exports2.functionInvocationContextSchema = exports2.functionInvocationContextRequestSchema = exports2.functionInvocationIdentityCapabilitySchema = exports2.FUNCTION_INVOCATION_CONTEXT_PATH = exports2.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER = void 0;
     exports2.readFunctionInvocationIdentityCapability = readFunctionInvocationIdentityCapability;
     var zod_12 = require_zod();
     exports2.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER = "x-sequence-invocation-identity-token";
@@ -17443,7 +17455,8 @@ var require_invocation_contract = __commonJS({
     var identifier = zod_12.z.string().min(1).max(255);
     var principal = zod_12.z.string().min(1).max(512);
     exports2.functionInvocationIdentityCapabilitySchema = zod_12.z.strictObject({
-      identity: zod_12.z.literal(true)
+      identity: zod_12.z.literal(true),
+      caller_capabilities: zod_12.z.literal(true).optional()
     });
     function readFunctionInvocationIdentityCapability(manifest) {
       if (typeof manifest !== "object" || manifest === null)
@@ -17453,9 +17466,10 @@ var require_invocation_contract = __commonJS({
         return false;
       return exports2.functionInvocationIdentityCapabilitySchema.safeParse(Reflect.get(capabilities, "invocation")).success;
     }
-    exports2.functionInvocationContextRequestSchema = zod_12.z.strictObject({
-      operation: zod_12.z.literal("getInvocationContext")
-    });
+    exports2.functionInvocationContextRequestSchema = zod_12.z.discriminatedUnion("operation", [
+      zod_12.z.strictObject({ operation: zod_12.z.literal("getInvocationContext") }),
+      zod_12.z.strictObject({ operation: zod_12.z.literal("getCallerCapabilities") })
+    ]);
     exports2.functionInvocationContextSchema = zod_12.z.strictObject({
       receiver: zod_12.z.strictObject({
         functionId: identifier,
@@ -17481,6 +17495,9 @@ var require_invocation_contract = __commonJS({
       }
     };
     exports2.FunctionInvocationContextError = FunctionInvocationContextError;
+    exports2.functionInvocationCapabilitiesSchema = exports2.functionInvocationContextSchema.extend({
+      capabilities: zod_12.z.array(zod_12.z.string().min(1).max(140).regex(/^[a-z0-9][a-z0-9/_.:-]*$/)).max(256)
+    }).refine((value) => new Set(value.capabilities).size === value.capabilities.length, "Capabilities must be unique");
   }
 });
 
@@ -17833,37 +17850,39 @@ var require_invocation = __commonJS({
     function createFunctionInvocationClient({ request, baseUrl, fetchImpl = globalThis.fetch }) {
       const url = `${trustedOrigin(baseUrl)}${invocation_contract_1.FUNCTION_INVOCATION_CONTEXT_PATH}`;
       const { token, claims } = readCredential({ request });
-      return {
-        async getInvocationContext() {
-          requireFresh(claims);
-          let response;
-          try {
-            response = await fetchImpl(url, {
-              method: "POST",
-              headers: {
-                "content-type": "application/json",
-                [invocation_contract_1.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER]: token
-              },
-              body: JSON.stringify(invocation_contract_1.functionInvocationContextRequestSchema.parse({ operation: "getInvocationContext" })),
-              redirect: "error",
-              signal: AbortSignal.timeout(3e4)
-            });
-          } catch {
-            throw new invocation_contract_1.FunctionInvocationContextError(502, "context_request_failed", "The invocation context request failed");
-          }
-          if (response.redirected || response.status >= 300 && response.status < 400)
-            throw new invocation_contract_1.FunctionInvocationContextError(502, "redirect_refused", "The invocation context request must not redirect");
-          const result = await response.json().catch(() => null);
-          if (!response.ok) {
-            const error = errorSchema.safeParse(result);
-            throw new invocation_contract_1.FunctionInvocationContextError(response.status, error.success ? error.data.code : "context_read_failed", error.success && !error.data.detail.includes(token) ? error.data.detail : "Invocation context read failed");
-          }
-          requireFresh(claims);
-          const parsed = invocation_contract_1.functionInvocationContextSchema.safeParse(result);
-          if (!parsed.success || !matchesInvocation({ context: parsed.data, claims }))
-            throw new invocation_contract_1.FunctionInvocationContextError(502, "malformed_response", "Atlas returned an invalid invocation context response");
-          return parsed.data;
+      async function read(operation, schema) {
+        requireFresh(claims);
+        let response;
+        try {
+          response = await fetchImpl(url, {
+            method: "POST",
+            headers: {
+              "content-type": "application/json",
+              [invocation_contract_1.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER]: token
+            },
+            body: JSON.stringify(invocation_contract_1.functionInvocationContextRequestSchema.parse({ operation })),
+            redirect: "error",
+            signal: AbortSignal.timeout(3e4)
+          });
+        } catch {
+          throw new invocation_contract_1.FunctionInvocationContextError(502, "context_request_failed", "The invocation context request failed");
         }
+        if (response.redirected || response.status >= 300 && response.status < 400)
+          throw new invocation_contract_1.FunctionInvocationContextError(502, "redirect_refused", "The invocation context request must not redirect");
+        const result = await response.json().catch(() => null);
+        if (!response.ok) {
+          const error = errorSchema.safeParse(result);
+          throw new invocation_contract_1.FunctionInvocationContextError(response.status, error.success ? error.data.code : "context_read_failed", error.success && !error.data.detail.includes(token) ? error.data.detail : "Invocation context read failed");
+        }
+        requireFresh(claims);
+        const parsed = schema.safeParse(result);
+        if (!parsed.success || !matchesInvocation({ context: parsed.data, claims }))
+          throw new invocation_contract_1.FunctionInvocationContextError(502, "malformed_response", "Atlas returned an invalid invocation context response");
+        return parsed.data;
+      }
+      return {
+        getInvocationContext: () => read("getInvocationContext", invocation_contract_1.functionInvocationContextSchema),
+        getCallerCapabilities: () => read("getCallerCapabilities", invocation_contract_1.functionInvocationCapabilitiesSchema)
       };
     }
   }
@@ -17874,7 +17893,7 @@ var require_processes_contract = __commonJS({
   "dist/processes-contract.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.FunctionProcessReadError = exports2.functionProcessReadRequestSchema = exports2.functionProcessRunsPageSchema = exports2.functionProcessCompletedAgentReferenceSchema = exports2.functionProcessCompletedAgentReferenceQuerySchema = exports2.functionProcessRunsPageQuerySchema = exports2.functionProcessRunQuerySchema = exports2.functionProcessRunSummarySchema = exports2.functionProcessRunStatusSchema = exports2.functionProcessReadScopesSchema = exports2.FUNCTION_PROCESS_READ_PATH = exports2.FUNCTION_PROCESS_TOKEN_HEADER = void 0;
+    exports2.FunctionProcessReadError = exports2.functionProcessReadRequestSchema = exports2.functionProcessRunsPageSchema = exports2.functionProcessCompletedAgentReferenceSchema = exports2.functionProcessCompletedAgentReferenceQuerySchema = exports2.functionProcessCompletedNodeSchema = exports2.functionProcessCompletedNodeQuerySchema = exports2.functionProcessRunsPageQuerySchema = exports2.functionProcessRunQuerySchema = exports2.functionProcessRunSummarySchema = exports2.functionProcessRunStatusSchema = exports2.functionProcessReadScopesSchema = exports2.FUNCTION_PROCESS_READ_PATH = exports2.FUNCTION_PROCESS_TOKEN_HEADER = void 0;
     exports2.readFunctionProcessScopes = readFunctionProcessScopes;
     var zod_12 = require_zod();
     exports2.FUNCTION_PROCESS_TOKEN_HEADER = "x-sequence-process-service-token";
@@ -17928,6 +17947,15 @@ var require_processes_contract = __commonJS({
       cursor: zod_12.z.string().min(1).max(8192).optional(),
       archived: zod_12.z.boolean().optional()
     });
+    exports2.functionProcessCompletedNodeQuerySchema = exports2.functionProcessRunQuerySchema.extend({ nodeId: entityId });
+    exports2.functionProcessCompletedNodeSchema = zod_12.z.strictObject({
+      runId: entityId,
+      processId,
+      processVersion: entityId,
+      nodeId: entityId,
+      stepId: entityId,
+      completedAt: zod_12.z.iso.datetime({ offset: true })
+    });
     exports2.functionProcessCompletedAgentReferenceQuerySchema = exports2.functionProcessRunQuerySchema.extend({ nodeId: entityId });
     exports2.functionProcessCompletedAgentReferenceSchema = zod_12.z.strictObject({
       stepId: entityId,
@@ -17943,6 +17971,7 @@ var require_processes_contract = __commonJS({
     });
     exports2.functionProcessReadRequestSchema = zod_12.z.discriminatedUnion("operation", [
       exports2.functionProcessRunQuerySchema.extend({ operation: zod_12.z.literal("getRun") }),
+      exports2.functionProcessCompletedNodeQuerySchema.extend({ operation: zod_12.z.literal("getCompletedNode") }),
       exports2.functionProcessCompletedAgentReferenceQuerySchema.extend({ operation: zod_12.z.literal("getCompletedAgentReference") }),
       exports2.functionProcessRunsPageQuerySchema.extend({
         operation: zod_12.z.literal("listRunsPage")
@@ -18109,6 +18138,12 @@ var require_processes = __commonJS({
       });
       const read = ({ body, schema }) => transport({ body: processes_contract_1.functionProcessReadRequestSchema.parse(body), schema });
       return {
+        async getCompletedNode(query) {
+          const proof = await read({ body: { ...query, operation: "getCompletedNode" }, schema: processes_contract_1.functionProcessCompletedNodeSchema });
+          if (proof.runId !== query.runId || proof.processId !== query.process || proof.nodeId !== query.nodeId)
+            throw new processes_contract_1.FunctionProcessReadError(502, "malformed_response", "Atlas returned a different completed node");
+          return proof;
+        },
         async getCompletedAgentReference(query) {
           const agent = readAgentCredential({ request });
           const readReference = (0, invocation_client_1.createInvocationReadTransport)({
@@ -18871,8 +18906,8 @@ var require_monitoring_contract = __commonJS({
     var monitoring_annotations_12 = require_monitoring_annotations();
     exports2.FUNCTION_MONITORING_TOKEN_HEADER = "x-sequence-monitoring-service-token";
     exports2.FUNCTION_MONITORING_DELIVERIES_PATH = "/api/managed-functions/monitoring/deliveries";
-    exports2.MONITORING_PRODUCER_CAPABILITY = "emit_monitoring";
-    exports2.MONITORING_CATALOG_CAPABILITY = "read_monitoring_catalog";
+    exports2.MONITORING_PRODUCER_CAPABILITY = "emit-monitoring";
+    exports2.MONITORING_CATALOG_CAPABILITY = "read-monitoring-catalog";
     exports2.MAX_MONITORING_DELIVERY_BYTES = 512 * 1024;
     var producer = zod_12.z.string().min(1).max(41).regex(/^[a-z][a-z0-9_]{0,40}$/);
     exports2.functionMonitoringScopesSchema = zod_12.z.strictObject({
@@ -29268,9 +29303,12 @@ var require_transfer = __commonJS({
       }
     };
     exports2.StorageTransferError = StorageTransferError;
+    var BUCKET_HOST = /^[a-z0-9][a-z0-9_-]{1,61}[a-z0-9]\.storage\.googleapis\.com$/;
     function checkedUploadUrl(value) {
       const url = new URL(value);
-      if (url.protocol !== "https:" || url.hostname !== "storage.googleapis.com" || !url.pathname.startsWith("/upload/") || !url.searchParams.has("upload_id") || url.port || url.username || url.password) {
+      const jsonSession = url.hostname === "storage.googleapis.com" && url.pathname.startsWith("/upload/");
+      const bucketHostSession = BUCKET_HOST.test(url.hostname) && url.pathname !== "/";
+      if (url.protocol !== "https:" || !(jsonSession || bucketHostSession) || !url.searchParams.has("upload_id") || url.port || url.username || url.password) {
         throw new StorageTransferError("Invalid storage upload destination");
       }
       return url.href;
@@ -29899,19 +29937,50 @@ var require_directory_contract = __commonJS({
   }
 });
 
+// dist/directory-roster-contract.js
+var require_directory_roster_contract = __commonJS({
+  "dist/directory-roster-contract.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.directoryRosterPageSchema = exports2.directoryRosterQuerySchema = exports2.functionDirectoryRostersSchema = exports2.FUNCTION_DIRECTORY_ROSTER_PATH = void 0;
+    exports2.readFunctionDirectoryRosterGroups = readFunctionDirectoryRosterGroups;
+    var zod_12 = require_zod();
+    var directory_config_1 = require_directory_config();
+    var directory_contract_1 = require_directory_contract();
+    exports2.FUNCTION_DIRECTORY_ROSTER_PATH = "/api/managed-functions/directory/roster";
+    exports2.functionDirectoryRostersSchema = zod_12.z.array(directory_config_1.directoryGroupIdSchema).min(1).max(16).refine((groups) => new Set(groups).size === groups.length, "Roster groups must be distinct");
+    exports2.directoryRosterQuerySchema = zod_12.z.object({
+      tenant: directory_contract_1.directoryTenantSchema,
+      groupId: directory_config_1.directoryGroupIdSchema,
+      limit: zod_12.z.number().int().min(1).max(50).default(50),
+      cursor: zod_12.z.string().max(2048).optional()
+    }).strict();
+    exports2.directoryRosterPageSchema = zod_12.z.object({
+      members: zod_12.z.array(zod_12.z.object({ id: zod_12.z.string(), sub: zod_12.z.string(), name: zod_12.z.string(), email: zod_12.z.string(), deactivated: zod_12.z.literal(false) }).strict()).max(50),
+      nextCursor: zod_12.z.string().nullable()
+    }).strict();
+    function readFunctionDirectoryRosterGroups(manifest) {
+      const parsed = zod_12.z.object({ capabilities: zod_12.z.object({ directory: zod_12.z.object({ rosters: exports2.functionDirectoryRostersSchema.optional() }).optional() }).optional() }).safeParse(manifest);
+      return parsed.success ? parsed.data.capabilities?.directory?.rosters ?? [] : [];
+    }
+  }
+});
+
 // dist/directory-manifest.js
 var require_directory_manifest = __commonJS({
   "dist/directory-manifest.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.functionDirectoryManifestSchema = void 0;
+    var directory_roster_contract_1 = require_directory_roster_contract();
     var zod_12 = require_zod();
     var directory_config_1 = require_directory_config();
     var directory_contract_1 = require_directory_contract();
     exports2.functionDirectoryManifestSchema = zod_12.z.strictObject({
+      rosters: directory_roster_contract_1.functionDirectoryRostersSchema.optional(),
       groups: directory_config_1.directoryScopesSchema.shape.groups.optional(),
       resolve: directory_contract_1.functionDirectoryScopesSchema.shape.resolve.optional()
-    }).refine((value) => value.groups !== void 0 || value.resolve !== void 0, "Declare directory groups, tenant resolution scopes, or both");
+    }).refine((value) => value.groups !== void 0 || value.resolve !== void 0, "Declare directory groups, tenant resolution scopes, or both").refine((value) => value.rosters === void 0 || value.resolve !== void 0, "Service rosters also require directory resolve tenant scopes");
   }
 });
 
@@ -30287,6 +30356,7 @@ var require_capabilities = __commonJS({
         sdk: { package: exports2.MANAGED_FUNCTION_SDK_PACKAGE, min: "0.3.0" }
       },
       features: {
+        directory_rosters: { field: "capabilities.directory.rosters", supported: true, limit: "1 to 16 explicit groups; up to 50 active tenant members per page; directory Reader and group membership required", min_cli: "0.6.6", min_sdk: "0.4.4" },
         directory_members: {
           field: "capabilities.directory.groups",
           supported: true,
@@ -30308,6 +30378,13 @@ var require_capabilities = __commonJS({
           min_cli: "0.5.5",
           min_sdk: "0.4.2"
         },
+        invocation_caller_capabilities: {
+          field: "capabilities.invocation.caller_capabilities",
+          supported: true,
+          limit: "current human caller capabilities declared by this exact active receiver; at most 256 pins",
+          min_cli: "0.6.6",
+          min_sdk: "0.4.4"
+        },
         invocation_identity: {
           field: "capabilities.invocation.identity",
           supported: true,
@@ -30498,8 +30575,10 @@ var require_deployed_policy = __commonJS({
         features: {
           immutable_release: normalizeImmutableRelease(features.immutable_release),
           invocation_identity: normalizeInvocationIdentity(features.invocation_identity),
+          invocation_caller_capabilities: normalizeInvocationIdentity(features.invocation_caller_capabilities, "capabilities.invocation.caller_capabilities"),
           directory_members: normalizeDirectoryMembers(features.directory_members),
           directory_resolve: normalizeDirectory(features.directory_resolve),
+          directory_rosters: normalizeRosters(features.directory_rosters),
           abrigo_read: normalizeAbrigo(features.abrigo_read),
           lattice_context: normalizeLatticeContext(features.lattice_context),
           postgres_egress: normalizePostgres(features.postgres_egress),
@@ -30550,13 +30629,13 @@ var require_deployed_policy = __commonJS({
         return void 0;
       return { field: typeof value.field === "string" ? value.field : "capabilities.abrigo.read", supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk };
     }
-    function normalizeInvocationIdentity(value) {
+    function normalizeInvocationIdentity(value, defaultField = "capabilities.invocation.identity") {
       if (!value || typeof value.supported !== "boolean" || typeof value.limit !== "string")
         return void 0;
       if (typeof value.min_cli !== "string" || typeof value.min_sdk !== "string")
         return void 0;
       return {
-        field: typeof value.field === "string" ? value.field : "capabilities.invocation.identity",
+        field: typeof value.field === "string" ? value.field : defaultField,
         supported: value.supported,
         limit: value.limit,
         min_cli: value.min_cli,
@@ -30672,6 +30751,11 @@ var require_deployed_policy = __commonJS({
         min_sdk: value.min_sdk
       };
     }
+    function normalizeRosters(value) {
+      if (!value || typeof value.supported !== "boolean" || typeof value.limit !== "string" || typeof value.min_cli !== "string" || typeof value.min_sdk !== "string")
+        return void 0;
+      return { field: typeof value.field === "string" ? value.field : "capabilities.directory.rosters", supported: value.supported, limit: value.limit, min_cli: value.min_cli, min_sdk: value.min_sdk };
+    }
   }
 });
 
@@ -30694,6 +30778,29 @@ var require_preflight_issue = __commonJS({
   }
 });
 
+// dist/preflight-service-directory-roster.js
+var require_preflight_service_directory_roster = __commonJS({
+  "dist/preflight-service-directory-roster.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.checkDirectoryRosters = checkDirectoryRosters;
+    var capabilities_1 = require_capabilities();
+    var preflight_issue_1 = require_preflight_issue();
+    var sdk_range_1 = require_sdk_range();
+    function checkDirectoryRosters({ capabilities, tooling, cliVersion, sdkVersion, checkDeployment, issues }) {
+      const deployed = capabilities?.features.directory_rosters;
+      const feature = deployed ?? capabilities_1.MANAGED_FUNCTION_CAPABILITIES.features.directory_rosters;
+      const details = { field: feature.field, limit: feature.limit, tooling, requiredCli: feature.min_cli, requiredSdk: feature.min_sdk, cliVersion, sdkVersion };
+      if (checkDeployment && deployed?.supported !== true) {
+        issues.push((0, preflight_issue_1.createPreflightIssue)({ ...details, problem: "scoped service group rosters are not supported by this deployment" }));
+        return;
+      }
+      if ((0, capabilities_1.versionIsOlder)(cliVersion, feature.min_cli) || sdkVersion && (0, sdk_range_1.sdkConstraintIsOlder)(sdkVersion, feature.min_sdk))
+        issues.push((0, preflight_issue_1.createPreflightIssue)({ ...details, problem: "the installed tooling does not support scoped service group rosters" }));
+    }
+  }
+});
+
 // dist/preflight-processes.js
 var require_preflight_processes = __commonJS({
   "dist/preflight-processes.js"(exports2) {
@@ -30831,6 +30938,22 @@ var require_preflight_invocation = __commonJS({
         }));
         return;
       }
+      if (parsed.data.caller_capabilities) {
+        const observed = capabilities?.features.invocation_caller_capabilities;
+        const required = capabilities_1.MANAGED_FUNCTION_CAPABILITIES.features.invocation_caller_capabilities;
+        if (checkDeployment && observed?.supported !== true || (0, capabilities_1.versionIsOlder)(cliVersion, required.min_cli) || !sdkVersion || (0, sdk_range_1.sdkConstraintIsOlder)(sdkVersion, required.min_sdk)) {
+          issues.push((0, preflight_issue_1.createPreflightIssue)({
+            limit: required.limit,
+            tooling,
+            requiredCli: required.min_cli,
+            requiredSdk: required.min_sdk,
+            cliVersion,
+            sdkVersion,
+            field: required.field,
+            problem: "Current caller capability reads require deployed support and compatible tooling"
+          }));
+        }
+      }
       if (checkDeployment && deployed?.supported !== true) {
         issues.push((0, preflight_issue_1.createPreflightIssue)({
           ...details,
@@ -31177,6 +31300,7 @@ var require_preflight = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.preflightManagedFunction = preflightManagedFunction;
+    var preflight_service_directory_roster_1 = require_preflight_service_directory_roster();
     var capabilities_1 = require_capabilities();
     var sdk_range_1 = require_sdk_range();
     var preflight_issue_1 = require_preflight_issue();
@@ -31389,6 +31513,8 @@ var require_preflight = __commonJS({
         return;
       }
       const scoped = (directory2) => ({ ...args, manifest: { ...args.manifest, capabilities: { ...args.manifest.capabilities, directory: directory2 } } });
+      if (parsed.data.rosters)
+        (0, preflight_service_directory_roster_1.checkDirectoryRosters)(args);
       if (parsed.data.groups)
         (0, preflight_directory_1.checkDirectory)(scoped({ groups: parsed.data.groups }));
       if (parsed.data.resolve)
@@ -31418,8 +31544,8 @@ var require_config2 = __commonJS({
       for (var p in m2) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding2(exports3, m2, p);
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.versionIsOlder = exports2.sdkVersionLowerBound = exports2.sdkSpecFromPackageJson = exports2.sdkVersionFromPackageJson = exports2.isPostgresEgress = exports2.formatValidationDetail = exports2.MANAGED_FUNCTION_SDK_PACKAGE = exports2.MANAGED_FUNCTION_CLI_PACKAGE = exports2.MANAGED_FUNCTION_CAPABILITIES = exports2.managedFunctionWorkloadLimitsSchema = exports2.MF_LIMITS_DEFAULTS = exports2.MF_LIMITS_CAPS = exports2.MANAGED_FUNCTION_LIMITS = exports2.readFunctionImmutableRelease = exports2.functionImmutableReleaseSchema = exports2.shouldReportAtlasHttp = exports2.directoryPrincipalResolutionSchema = exports2.directoryPrincipalResolveRequestSchema = exports2.readFunctionDirectoryScopes = exports2.functionDirectoryScopesSchema = exports2.FUNCTION_DIRECTORY_RESOLVE_PATH = exports2.FUNCTION_DIRECTORY_TOKEN_HEADER = exports2.FUNCTION_CALLER_DATA_TOKEN_HEADER = exports2.readFunctionWorkflowEvidenceScopes = exports2.readFunctionWorkflowScopes = exports2.functionWorkflowScopesSchema = exports2.functionAgentCompletedRunSchema = exports2.functionAgentCompletedRunQuerySchema = exports2.functionAgentReadRequestSchema = exports2.readFunctionAgentScopes = exports2.functionAgentReadScopesSchema = exports2.FUNCTION_AGENT_READ_PATH = exports2.FUNCTION_AGENT_TOKEN_HEADER = exports2.functionProcessCompletedAgentReferenceQuerySchema = exports2.functionProcessCompletedAgentReferenceSchema = exports2.functionProcessRunSummarySchema = exports2.functionProcessReadRequestSchema = exports2.readFunctionProcessScopes = exports2.functionProcessReadScopesSchema = exports2.FUNCTION_PROCESS_READ_PATH = exports2.FUNCTION_PROCESS_TOKEN_HEADER = exports2.readFunctionLatticeContextCapability = exports2.functionLatticeContextCapabilitySchema = exports2.functionDirectoryManifestSchema = exports2.readDirectoryGroups = exports2.directoryMembersResponse = exports2.directoryMembersInput = exports2.directoryScopesSchema = exports2.directoryGroupIdSchema = exports2.DIRECTORY_TOKEN_HEADER = void 0;
-    exports2.cacheManifestSchema = exports2.CACHE_MAX_TTL_SECONDS = exports2.preflightManagedFunction = exports2.parseDeployedPolicy = void 0;
+    exports2.sdkSpecFromPackageJson = exports2.sdkVersionFromPackageJson = exports2.isPostgresEgress = exports2.formatValidationDetail = exports2.MANAGED_FUNCTION_SDK_PACKAGE = exports2.MANAGED_FUNCTION_CLI_PACKAGE = exports2.MANAGED_FUNCTION_CAPABILITIES = exports2.managedFunctionWorkloadLimitsSchema = exports2.MF_LIMITS_DEFAULTS = exports2.MF_LIMITS_CAPS = exports2.MANAGED_FUNCTION_LIMITS = exports2.readFunctionImmutableRelease = exports2.functionImmutableReleaseSchema = exports2.shouldReportAtlasHttp = exports2.directoryPrincipalResolutionSchema = exports2.directoryPrincipalResolveRequestSchema = exports2.readFunctionDirectoryScopes = exports2.functionDirectoryScopesSchema = exports2.FUNCTION_DIRECTORY_RESOLVE_PATH = exports2.FUNCTION_DIRECTORY_TOKEN_HEADER = exports2.FUNCTION_CALLER_DATA_TOKEN_HEADER = exports2.readFunctionWorkflowEvidenceScopes = exports2.readFunctionWorkflowScopes = exports2.functionWorkflowScopesSchema = exports2.functionAgentCompletedRunSchema = exports2.functionAgentCompletedRunQuerySchema = exports2.functionAgentReadRequestSchema = exports2.readFunctionAgentScopes = exports2.functionAgentReadScopesSchema = exports2.FUNCTION_AGENT_READ_PATH = exports2.FUNCTION_AGENT_TOKEN_HEADER = exports2.functionProcessCompletedNodeQuerySchema = exports2.functionProcessCompletedNodeSchema = exports2.functionProcessCompletedAgentReferenceQuerySchema = exports2.functionProcessCompletedAgentReferenceSchema = exports2.functionProcessRunSummarySchema = exports2.functionProcessReadRequestSchema = exports2.readFunctionProcessScopes = exports2.functionProcessReadScopesSchema = exports2.FUNCTION_PROCESS_READ_PATH = exports2.FUNCTION_PROCESS_TOKEN_HEADER = exports2.readFunctionLatticeContextCapability = exports2.functionLatticeContextCapabilitySchema = exports2.functionDirectoryManifestSchema = exports2.readDirectoryGroups = exports2.directoryMembersResponse = exports2.directoryMembersInput = exports2.directoryScopesSchema = exports2.directoryGroupIdSchema = exports2.DIRECTORY_TOKEN_HEADER = void 0;
+    exports2.cacheManifestSchema = exports2.CACHE_MAX_TTL_SECONDS = exports2.preflightManagedFunction = exports2.parseDeployedPolicy = exports2.versionIsOlder = exports2.sdkVersionLowerBound = void 0;
     exports2.readCacheConfiguration = readCacheConfiguration;
     var directory_config_1 = require_directory_config();
     Object.defineProperty(exports2, "DIRECTORY_TOKEN_HEADER", { enumerable: true, get: function() {
@@ -31477,6 +31603,12 @@ var require_config2 = __commonJS({
     Object.defineProperty(exports2, "functionProcessCompletedAgentReferenceQuerySchema", { enumerable: true, get: function() {
       return processes_contract_1.functionProcessCompletedAgentReferenceQuerySchema;
     } });
+    Object.defineProperty(exports2, "functionProcessCompletedNodeSchema", { enumerable: true, get: function() {
+      return processes_contract_1.functionProcessCompletedNodeSchema;
+    } });
+    Object.defineProperty(exports2, "functionProcessCompletedNodeQuerySchema", { enumerable: true, get: function() {
+      return processes_contract_1.functionProcessCompletedNodeQuerySchema;
+    } });
     var agents_contract_1 = require_agents_contract();
     Object.defineProperty(exports2, "FUNCTION_AGENT_TOKEN_HEADER", { enumerable: true, get: function() {
       return agents_contract_1.FUNCTION_AGENT_TOKEN_HEADER;
@@ -31612,6 +31744,7 @@ var require_config2 = __commonJS({
       const cache = typeof manifest === "object" && manifest !== null ? Reflect.get(manifest, "cache") : void 0;
       return exports2.cacheManifestSchema.parse(cache ?? {});
     }
+    __exportStar2(require_directory_roster_contract(), exports2);
   }
 });
 
@@ -59859,12 +59992,44 @@ var require_valkey = __commonJS({
   }
 });
 
+// dist/service-directory-roster.js
+var require_service_directory_roster = __commonJS({
+  "dist/service-directory-roster.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.createServiceRosterReader = createServiceRosterReader;
+    var zod_12 = require_zod();
+    var directory_contract_1 = require_directory_contract();
+    var directory_roster_contract_1 = require_directory_roster_contract();
+    function createServiceRosterReader({ origin, token, expiresAt, fetchImpl }) {
+      return async (input) => {
+        if (expiresAt <= Date.now() / 1e3)
+          throw new directory_contract_1.DirectoryPrincipalResolveError(401, "expired_context", "The directory credential expired; start a new invocation");
+        const query = directory_roster_contract_1.directoryRosterQuerySchema.safeParse(input);
+        if (!query.success)
+          throw new directory_contract_1.DirectoryPrincipalResolveError(400, "invalid_request", "Invalid group roster request");
+        const response = await fetchImpl(`${origin}${directory_roster_contract_1.FUNCTION_DIRECTORY_ROSTER_PATH}`, { method: "POST", headers: { "content-type": "application/json", [directory_contract_1.FUNCTION_DIRECTORY_TOKEN_HEADER]: token }, body: JSON.stringify(query.data), redirect: "error", signal: AbortSignal.timeout(3e4) });
+        const body = await response.json().catch(() => null);
+        if (!response.ok) {
+          const error = zod_12.z.object({ code: zod_12.z.string().max(128).optional(), detail: zod_12.z.string().max(2e3).optional() }).safeParse(body);
+          throw new directory_contract_1.DirectoryPrincipalResolveError(response.status, error.success ? error.data.code ?? "directory_roster_failed" : "directory_roster_failed", error.success ? error.data.detail ?? "Group roster read failed" : "Group roster read failed");
+        }
+        const result = directory_roster_contract_1.directoryRosterPageSchema.safeParse(body);
+        if (!result.success || result.data.members.length > query.data.limit || new Set(result.data.members.map((member) => member.id)).size !== result.data.members.length)
+          throw new directory_contract_1.DirectoryPrincipalResolveError(502, "malformed_response", "Atlas returned an invalid group roster");
+        return result.data;
+      };
+    }
+  }
+});
+
 // dist/service-directory.js
 var require_service_directory = __commonJS({
   "dist/service-directory.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.createFunctionServiceDirectoryClient = createFunctionServiceDirectoryClient;
+    var service_directory_roster_1 = require_service_directory_roster();
     var zod_12 = require_zod();
     var directory_contract_1 = require_directory_contract();
     function credential({ request }) {
@@ -59911,6 +60076,7 @@ var require_service_directory = __commonJS({
       const url = `${origin(baseUrl)}${directory_contract_1.FUNCTION_DIRECTORY_RESOLVE_PATH}`;
       const { token, expiresAt } = credential({ request });
       return {
+        listGroupMembers: (0, service_directory_roster_1.createServiceRosterReader)({ origin: origin(baseUrl), token, expiresAt, fetchImpl }),
         async resolve(input) {
           if (expiresAt <= Date.now() / 1e3)
             throw new directory_contract_1.DirectoryPrincipalResolveError(401, "expired_context", "The directory credential expired; start a new invocation");
@@ -59951,7 +60117,7 @@ var __exportStar = exports && exports.__exportStar || function(m2, exports2) {
   for (var p in m2) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports2, p)) __createBinding(exports2, m2, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createFunctionServiceDirectoryClient = exports.readCacheConfiguration = exports.cacheManifestSchema = exports.createCacheManager = exports.CacheError = exports.createFunctionStorageClient = exports.runWithFunctionTracing = exports.installFunctionTracing = exports.functionMonitoringAnnotationSchema = exports.monitoringPublishSchema = exports.monitoringEventsSchema = exports.monitoringPayloadHash = exports.FunctionMonitoringError = exports.createFunctionServiceMonitoringClient = exports.functionSourceJobAdmissionSchema = exports.functionAgentSourceExecutionSchema = exports.functionAgentConversationEvidenceRequestSchema = exports.functionAgentConversationEvidenceCaptureSchema = exports.functionAgentConversationEvidenceResponseSchema = exports.functionAgentSourceEvidenceCaptureSchema = exports.functionAgentSourceEvidenceRequestSchema = exports.functionAgentSourceResponseSchema = exports.createFunctionWorkflowEvidenceClient = exports.createFunctionServiceWorkflowsClient = exports.createFunctionAgentEvidenceClient = exports.FunctionAgentReadError = exports.createFunctionServiceAgentsClient = exports.FunctionProcessReadError = exports.createFunctionServiceProcessesClient = exports.functionLatticeHumanCompletionsPageSchema = exports.functionLatticeHumanCompletionsQuerySchema = exports.functionLatticeHumanCompletionSchema = exports.functionLatticeHumanCompletionQuerySchema = exports.functionLatticeExecutionContextSchema = exports.functionLatticeContextRequestSchema = exports.FunctionLatticeContextError = exports.FUNCTION_LATTICE_EXECUTION_TOKEN_HEADER = exports.FUNCTION_LATTICE_CONTEXT_PATH = exports.createFunctionInvocationClient = exports.functionLatticeStartProvenanceSchema = exports.functionLatticeParallelSnapshotQuerySchema = exports.functionLatticeParallelSnapshotSchema = exports.createFunctionLatticeClient = exports.readFunctionLatticeContextCapability = exports.functionLatticeContextCapabilitySchema = exports.FunctionDirectoryReadError = exports.createFunctionDirectoryClient = void 0;
+exports.functionLatticeRunCreatorAccessSchema = exports.createFunctionServiceDirectoryClient = exports.readCacheConfiguration = exports.cacheManifestSchema = exports.createCacheManager = exports.CacheError = exports.createFunctionStorageClient = exports.runWithFunctionTracing = exports.installFunctionTracing = exports.functionMonitoringAnnotationSchema = exports.monitoringPublishSchema = exports.monitoringEventsSchema = exports.monitoringPayloadHash = exports.FunctionMonitoringError = exports.createFunctionServiceMonitoringClient = exports.functionSourceJobAdmissionSchema = exports.functionAgentSourceExecutionSchema = exports.functionAgentConversationEvidenceRequestSchema = exports.functionAgentConversationEvidenceCaptureSchema = exports.functionAgentConversationEvidenceResponseSchema = exports.functionAgentSourceEvidenceCaptureSchema = exports.functionAgentSourceEvidenceRequestSchema = exports.functionAgentSourceResponseSchema = exports.createFunctionWorkflowEvidenceClient = exports.createFunctionServiceWorkflowsClient = exports.createFunctionAgentEvidenceClient = exports.FunctionAgentReadError = exports.createFunctionServiceAgentsClient = exports.FunctionProcessReadError = exports.createFunctionServiceProcessesClient = exports.functionLatticeHumanCompletionsPageSchema = exports.functionLatticeHumanCompletionsQuerySchema = exports.functionLatticeHumanCompletionSchema = exports.functionLatticeHumanCompletionQuerySchema = exports.functionLatticeExecutionContextSchema = exports.functionLatticeContextRequestSchema = exports.FunctionLatticeContextError = exports.FUNCTION_LATTICE_EXECUTION_TOKEN_HEADER = exports.FUNCTION_LATTICE_CONTEXT_PATH = exports.createFunctionInvocationClient = exports.functionLatticeStartProvenanceSchema = exports.functionLatticeParallelSnapshotQuerySchema = exports.functionLatticeParallelSnapshotSchema = exports.createFunctionLatticeClient = exports.readFunctionLatticeContextCapability = exports.functionLatticeContextCapabilitySchema = exports.FunctionDirectoryReadError = exports.createFunctionDirectoryClient = void 0;
 exports.createManagedFunctionContext = createManagedFunctionContext;
 var directory_1 = require_directory();
 Object.defineProperty(exports, "createFunctionDirectoryClient", { enumerable: true, get: function() {
@@ -60158,6 +60324,11 @@ var service_directory_1 = require_service_directory();
 Object.defineProperty(exports, "createFunctionServiceDirectoryClient", { enumerable: true, get: function() {
   return service_directory_1.createFunctionServiceDirectoryClient;
 } });
+__exportStar(require_directory_roster_contract(), exports);
+var lattice_provenance_contract_5 = require_lattice_provenance_contract();
+Object.defineProperty(exports, "functionLatticeRunCreatorAccessSchema", { enumerable: true, get: function() {
+  return lattice_provenance_contract_5.functionLatticeRunCreatorAccessSchema;
+} });
 /*! Bundled license information:
 
 web-streams-polyfill/dist/ponyfill.es2018.js:

package/dist/service-directory-roster.d.ts

@@ -0,0 +1,7 @@
+import { type DirectoryRosterQuery, type DirectoryRosterPage } from './directory-roster-contract';
+export declare function createServiceRosterReader({ origin, token, expiresAt, fetchImpl }: {
+    origin: string;
+    token: string;
+    expiresAt: number;
+    fetchImpl: typeof fetch;
+}): (input: DirectoryRosterQuery) => Promise<DirectoryRosterPage>;

package/dist/service-directory-roster.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createServiceRosterReader = createServiceRosterReader;
+const zod_1 = require("zod");
+const directory_contract_1 = require("./directory-contract");
+const directory_roster_contract_1 = require("./directory-roster-contract");
+function createServiceRosterReader({ origin, token, expiresAt, fetchImpl }) {
+    return async (input) => {
+        if (expiresAt <= Date.now() / 1000)
+            throw new directory_contract_1.DirectoryPrincipalResolveError(401, 'expired_context', 'The directory credential expired; start a new invocation');
+        const query = directory_roster_contract_1.directoryRosterQuerySchema.safeParse(input);
+        if (!query.success)
+            throw new directory_contract_1.DirectoryPrincipalResolveError(400, 'invalid_request', 'Invalid group roster request');
+        const response = await fetchImpl(`${origin}${directory_roster_contract_1.FUNCTION_DIRECTORY_ROSTER_PATH}`, { method: 'POST', headers: { 'content-type': 'application/json', [directory_contract_1.FUNCTION_DIRECTORY_TOKEN_HEADER]: token }, body: JSON.stringify(query.data), redirect: 'error', signal: AbortSignal.timeout(30_000) });
+        const body = await response.json().catch(() => null);
+        if (!response.ok) {
+            const error = zod_1.z.object({ code: zod_1.z.string().max(128).optional(), detail: zod_1.z.string().max(2000).optional() }).safeParse(body);
+            throw new directory_contract_1.DirectoryPrincipalResolveError(response.status, error.success ? error.data.code ?? 'directory_roster_failed' : 'directory_roster_failed', error.success ? error.data.detail ?? 'Group roster read failed' : 'Group roster read failed');
+        }
+        const result = directory_roster_contract_1.directoryRosterPageSchema.safeParse(body);
+        if (!result.success || result.data.members.length > query.data.limit || new Set(result.data.members.map(member => member.id)).size !== result.data.members.length)
+            throw new directory_contract_1.DirectoryPrincipalResolveError(502, 'malformed_response', 'Atlas returned an invalid group roster');
+        return result.data;
+    };
+}

package/dist/service-directory.d.ts

@@ -1,3 +1,4 @@
+import type { DirectoryRosterQuery, DirectoryRosterPage } from './directory-roster-contract';
 import { type DirectoryPrincipalResolveRequest, type DirectoryPrincipalResolution } from './directory-contract';
 export interface FunctionServiceDirectoryOptions {
     request: {
@@ -7,6 +8,7 @@ export interface FunctionServiceDirectoryOptions {
     fetchImpl?: typeof globalThis.fetch;
 }
 export interface FunctionServiceDirectoryClient {
+    listGroupMembers(input: DirectoryRosterQuery): Promise<DirectoryRosterPage>;
     resolve(input: DirectoryPrincipalResolveRequest): Promise<DirectoryPrincipalResolution>;
 }
 export declare function createFunctionServiceDirectoryClient({ request, baseUrl, fetchImpl }: FunctionServiceDirectoryOptions): FunctionServiceDirectoryClient;

package/dist/service-directory.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createFunctionServiceDirectoryClient = createFunctionServiceDirectoryClient;
+const service_directory_roster_1 = require("./service-directory-roster");
 const zod_1 = require("zod");
 const directory_contract_1 = require("./directory-contract");
 function credential({ request }) {
@@ -51,6 +52,7 @@ function createFunctionServiceDirectoryClient({ request, baseUrl, fetchImpl = gl
     const url = `${origin(baseUrl)}${directory_contract_1.FUNCTION_DIRECTORY_RESOLVE_PATH}`;
     const { token, expiresAt } = credential({ request });
     return {
+        listGroupMembers: (0, service_directory_roster_1.createServiceRosterReader)({ origin: origin(baseUrl), token, expiresAt, fetchImpl }),
         async resolve(input) {
             if (expiresAt <= Date.now() / 1000)
                 throw new directory_contract_1.DirectoryPrincipalResolveError(401, 'expired_context', 'The directory credential expired; start a new invocation');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sequenceholdings/managed-functions",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Managed Function context and opt-in cache runtime",
   "license": "UNLICENSED",
   "main": "./dist/index.js",
@@ -40,7 +40,7 @@
     "zod": "^4.1.13",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/sdk-trace-base": "^2.5.1",
-    "@sequenceholdings/storage": "0.1.1"
+    "@sequenceholdings/storage": "0.1.2"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
@@ -48,7 +48,7 @@
     "vitest": "^4.1.11",
     "esbuild": "^0.25.0",
     "tsup": "^8.3.0",
-    "@sequenceholdings/orm": "2.6.2"
+    "@sequenceholdings/orm": "2.7.0"
   },
   "engines": {
     "node": ">=20"