@sequenceholdings/studio-cli 0.1.9

package/dist/functions/egress-preview.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Terminal preview lines for manifest egress — mirrors `buildSecretPreviewLines`
+ * in secret-reconcile.ts.
+ */
+/**
+ * One-line summary for `functions build` (matches the secrets line).
+ * `entries` is the full allowlist — hostnames and IP/CIDR ranges.
+ */
+export declare function formatEgressSummary(entries: readonly string[]): string;
+/**
+ * Multi-line egress section for the deploy confirmation preview.
+ * `entries` is the full allowlist — hostnames and IP/CIDR ranges.
+ *
+ * @param log  The LOG prefix string (e.g. '[seq-studio]').
+ */
+export declare function buildEgressPreviewLines(log: string, entries: readonly string[]): string[];
+/**
+ * Post-deploy hint printed once a version goes live with egress declared.
+ * SWP host rules and (especially) per-function VPC routes for IP entries are
+ * not instantaneous — a fetch attempted immediately after "is live" can still
+ * be denied until the network plane catches up. Observed in practice: a
+ * fresh IP route still denying 3m+ after creation (GCP route propagation is
+ * eventually consistent with no hard SLO).
+ */
+export declare function egressPropagationNote(log: string): string;
+/** `functions show` — active manifest egress allowlist from the API. */
+export declare function printFunctionEgressHosts({ log, hosts, ipRanges, egressEnforced, }: {
+    log: string;
+    hosts: readonly string[];
+    ipRanges?: readonly string[];
+    egressEnforced: boolean;
+}): void;

package/dist/functions/egress-preview.js

@@ -0,0 +1,54 @@
+/**
+ * Terminal preview lines for manifest egress — mirrors `buildSecretPreviewLines`
+ * in secret-reconcile.ts.
+ */
+/**
+ * One-line summary for `functions build` (matches the secrets line).
+ * `entries` is the full allowlist — hostnames and IP/CIDR ranges.
+ */
+export function formatEgressSummary(entries) {
+    return entries.length > 0 ? entries.join(', ') : '(none declared)';
+}
+/**
+ * Multi-line egress section for the deploy confirmation preview.
+ * `entries` is the full allowlist — hostnames and IP/CIDR ranges.
+ *
+ * @param log  The LOG prefix string (e.g. '[seq-studio]').
+ */
+export function buildEgressPreviewLines(log, entries) {
+    if (entries.length === 0) {
+        return [`${log}   egress:         (none declared)`];
+    }
+    const lines = [`${log}   egress:`];
+    for (const entry of entries) {
+        lines.push(`${log}     - ${entry}`);
+    }
+    return lines;
+}
+/**
+ * Post-deploy hint printed once a version goes live with egress declared.
+ * SWP host rules and (especially) per-function VPC routes for IP entries are
+ * not instantaneous — a fetch attempted immediately after "is live" can still
+ * be denied until the network plane catches up. Observed in practice: a
+ * fresh IP route still denying 3m+ after creation (GCP route propagation is
+ * eventually consistent with no hard SLO).
+ */
+export function egressPropagationNote(log) {
+    return `${log}   note: egress allowlist — new updates may take a few minutes to propagate`;
+}
+/** `functions show` — active manifest egress allowlist from the API. */
+export function printFunctionEgressHosts({ log, hosts, ipRanges = [], egressEnforced, }) {
+    console.log(`${log} egress allowlist:`);
+    if (hosts.length === 0 && ipRanges.length === 0) {
+        console.log(egressEnforced
+            ? '    (none — outbound denied for deployed revisions under network lockdown)'
+            : '    (none declared)');
+        return;
+    }
+    for (const host of hosts) {
+        console.log(`    ${host}`);
+    }
+    for (const cidr of ipRanges) {
+        console.log(`    ${cidr}  (direct IP)`);
+    }
+}

package/dist/functions/lockfile-origin.d.ts

@@ -0,0 +1,16 @@
+/**
+ * CLI-side mirror of
+ * atlas/src/server/services/managed-functions/lockfile-origin.ts — same
+ * "keep the two in sync" pattern as the duplicated manifest schema. The CLI
+ * only needs classification (to warn at pre-flight); the deploy decision and
+ * server-side resolution live in the atlas module.
+ *
+ * `npm`         -> a resolution pins `registry.npmjs.org` (wins even when a
+ *                  Chainguard pin is also present — matches the worker, which
+ *                  re-resolves any npm-pinned lockfile rather than frozen-
+ *                  installing npm tarballs verbatim).
+ * `chainguard`  -> a resolution pins `libraries.cgr.dev` and none pin npm.
+ * `unknown`     -> no explicit tarball pins (plain npm-default lockfile) or unparseable.
+ */
+export type LockfileOrigin = 'chainguard' | 'npm' | 'unknown';
+export declare function classifyLockfileOrigin(lockfileText: string): LockfileOrigin;

package/dist/functions/lockfile-origin.js

@@ -0,0 +1,45 @@
+import { load as parseYaml } from 'js-yaml';
+const CHAINGUARD_TARBALL_HOST = 'libraries.cgr.dev';
+const NPM_TARBALL_HOST = 'registry.npmjs.org';
+export function classifyLockfileOrigin(lockfileText) {
+    let parsed;
+    try {
+        const doc = parseYaml(lockfileText);
+        if (!doc || typeof doc !== 'object')
+            return 'unknown';
+        parsed = doc;
+    }
+    catch {
+        return 'unknown';
+    }
+    const packages = parsed.packages;
+    if (!packages || typeof packages !== 'object')
+        return 'unknown';
+    let sawChainguard = false;
+    let sawNpm = false;
+    for (const entry of Object.values(packages)) {
+        const tarball = entry?.resolution?.tarball;
+        if (typeof tarball !== 'string')
+            continue;
+        // Exact host comparison (not substring) — kept in lockstep with the worker.
+        let host;
+        try {
+            host = new URL(tarball).host.toLowerCase();
+        }
+        catch {
+            continue;
+        }
+        if (host === NPM_TARBALL_HOST)
+            sawNpm = true;
+        else if (host === CHAINGUARD_TARBALL_HOST)
+            sawChainguard = true;
+    }
+    // npm wins over Chainguard when both appear — kept in lockstep with the
+    // worker (atlas/.../lockfile-origin.ts), where a mixed lockfile must
+    // re-resolve rather than frozen-install its npm-pinned tarballs.
+    if (sawNpm)
+        return 'npm';
+    if (sawChainguard)
+        return 'chainguard';
+    return 'unknown';
+}

package/dist/functions/manifest.d.ts

@@ -0,0 +1,89 @@
+import { z } from 'zod';
+/**
+ * CLI-side mirror of the server manifest schema at
+ * atlas/src/server/services/managed-functions/manifest.ts — same pattern
+ * as artifact-studio's duplicated manifest. Keep the two in sync.
+ */
+export declare const MF_MANIFEST_FILENAME = "managed-function.yml";
+/**
+ * CLI-side copy of the server's egress entry validation (see
+ * atlas/src/server/services/managed-functions/egress.ts). Returns the
+ * failure reason, or null when the entry is valid.
+ */
+export declare function egressEntryError(input: string): string | null;
+export declare function egressIpError(input: string): string | null;
+/**
+ * CLI-side copy of the server's normalizeEgressHost validation (see
+ * atlas/src/server/services/managed-functions/egress.ts) so authors get the
+ * same rejection locally at `functions deploy` time instead of a server 400.
+ * Returns the failure reason, or null when the entry is a valid egress host.
+ */
+export declare function egressHostError(input: string): string | null;
+export declare const MAX_EGRESS_IP_RANGES = 16;
+/**
+ * Normalized, deduped, sorted egress hosts from a validated manifest egress
+ * list — mirrors `manifestEgressHosts` on the server so CLI output matches
+ * what the deploy pipeline enforces.
+ */
+export declare function manifestEgressHosts(entries: readonly string[]): string[];
+/**
+ * Normalized, deduped, sorted egress IP/CIDR ranges from a validated manifest
+ * egress list — mirrors `manifestEgressIpRanges` on the server so CLI output
+ * matches the per-function routes the deploy pipeline creates.
+ */
+export declare function manifestEgressIpRanges(entries: readonly string[]): string[];
+/**
+ * CLI-side copy of the server's SWP sessionMatcher budget check: the whole
+ * egress list compiles into ONE proxy rule matcher (2048-char GCP cap).
+ * Deduped after normalization — the rule builder compiles the deduped host
+ * set, so aliases of one host cost one matcher clause. IP/CIDR entries
+ * bypass the matcher and are capped separately (per-function route count).
+ */
+export declare function egressBudgetError(entries: string[]): string | null;
+export declare const managedFunctionManifestSchema: z.ZodObject<{
+    schema_version: z.ZodDefault<z.ZodLiteral<1>>;
+    function: z.ZodObject<{
+        id: z.ZodString;
+        title: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    runtime: z.ZodDefault<z.ZodLiteral<"nodejs20">>;
+    entrypoint: z.ZodDefault<z.ZodString>;
+    limits: z.ZodDefault<z.ZodObject<{
+        memory_mb: z.ZodDefault<z.ZodNumber>;
+        timeout_seconds: z.ZodDefault<z.ZodNumber>;
+        max_instances: z.ZodDefault<z.ZodNumber>;
+        invoke_rate_per_minute: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+    secrets: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    egress: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    input_schema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    output_schema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    capabilities: z.ZodDefault<z.ZodObject<{
+        roles: z.ZodOptional<z.ZodObject<{
+            definitions: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+                description: z.ZodOptional<z.ZodString>;
+                default: z.ZodDefault<z.ZodBoolean>;
+                inherits: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                grants: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>>;
+            capabilities: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+                description: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>>;
+        uses: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        gates: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            requires: z.ZodString;
+            when: z.ZodOptional<z.ZodObject<{
+                field: z.ZodString;
+                equals: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>>;
+        data: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+            tables: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            actions: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            query: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ManagedFunctionManifest = z.infer<typeof managedFunctionManifestSchema>;