@alienplatform/core 3.3.24 → 3.3.26

package/dist/index.js

@@ -1803,10 +1803,12 @@ const AwsPermissionEffectSchema = z$2.enum(["Allow", "Deny"]);
 const BindingConfigurationAwsBindingSpecSchema = z$2.object({
 	"resource": z$2.optional(z$2.object({
 		"condition": z$2.object({}).catchall(z$2.object({}).catchall(z$2.string())).describe("Optional condition for additional filtering (rare)").nullish(),
+		"notResources": z$2.optional(z$2.array(z$2.string()).describe("ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else.")),
 		"resources": z$2.array(z$2.string()).describe("Resource ARNs to bind to")
 	}).describe("AWS-specific binding specification")),
 	"stack": z$2.optional(z$2.object({
 		"condition": z$2.object({}).catchall(z$2.object({}).catchall(z$2.string())).describe("Optional condition for additional filtering (rare)").nullish(),
+		"notResources": z$2.optional(z$2.array(z$2.string()).describe("ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else.")),
 		"resources": z$2.array(z$2.string()).describe("Resource ARNs to bind to")
 	}).describe("AWS-specific binding specification"))
 }).describe("Generic binding configuration for permissions");
@@ -3691,6 +3693,7 @@ const ComputeClusterSchema = z$2.object({
 		return z$2.array(CapacityGroupSchema.describe("Capacity group definition.\n\nA capacity group represents machines with identical hardware profiles.\nEach group becomes a separate Auto Scaling Group (AWS), Managed Instance Group (GCP),\nor VM Scale Set (Azure).")).describe("Capacity groups defining the machine pools for this cluster.\nEach group becomes a separate ASG/MIG/VMSS.");
 	},
 	"containerCidr": z$2.string().describe("Container CIDR block for internal container networking.\nAuto-generated as \"10.244.0.0/16\" if not specified.\nEach machine gets a /24 subnet from this range.").nullish(),
+	"dynamicContainerPool": z$2.string().describe("Pool reserved for containers created after a deployment is installed.\nIf absent, the runtime uses the `general` pool when it exists.").nullish(),
 	"failureDomainSpread": z$2.optional(z$2.object({}).catchall(z$2.int().min(0)).describe("Requested failure-domain spread keyed by capacity group.\nEmpty preserves the existing aggregate layout.")),
 	"id": z$2.string().describe("Unique identifier for the container cluster.\nMust contain only alphanumeric characters, hyphens, and underscores."),
 	"selectedFailureDomains": z$2.optional(z$2.object({}).catchall(z$2.array(z$2.string())).describe("Concrete provider failure domains selected during setup, keyed by capacity group.\nEmpty preserves the existing aggregate layout when no spread policy is configured."))
@@ -3884,6 +3887,20 @@ const HorizonContainerHeartbeatDataSchema = z$2.object({
 	}
 });
 //#endregion
+//#region src/generated/zod/container-image-identity-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Image a running container reports.
+*/
+const ContainerImageIdentitySchema = z$2.object({
+	"digest": z$2.string().describe("Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one.").nullish(),
+	"image": z$2.string().describe("Image reference reported by the container runtime."),
+	"name": z$2.string().describe("Container name.")
+}).describe("Image a running container reports.");
+//#endregion
 //#region src/generated/zod/kubernetes-owner-reference-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -3902,6 +3919,9 @@ const KubernetesOwnerReferenceSchema = z$2.object({
 * Do not edit manually.
 */
 const KubernetesPodRuntimeUnitStatusSchema = z$2.object({
+	get "containers"() {
+		return z$2.array(ContainerImageIdentitySchema.describe("Image a running container reports.")).optional();
+	},
 	get "cpu"() {
 		return z$2.union([MetricSampleSchema, z$2.null()]).optional();
 	},
@@ -4216,6 +4236,33 @@ const ContainerOutputsSchema = z$2.object({
 */
 const ContainerPortSchema = z$2.object({ "port": z$2.int().min(0).describe("Port number") }).describe("Container port configuration.");
 //#endregion
+//#region src/generated/zod/container-security-profile-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Security profile shared by container runtimes.
+*/
+const ContainerSecurityProfileSchema = z$2.enum(["restricted"]).describe("Security profile shared by container runtimes.");
+//#endregion
+//#region src/generated/zod/container-security-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Container process identity and filesystem security.
+*/
+const ContainerSecuritySchema = z$2.object({
+	get "profile"() {
+		return ContainerSecurityProfileSchema.describe("Security profile shared by container runtimes.");
+	},
+	"readOnlyRootFilesystem": z$2.boolean().describe("Mount the root filesystem read-only."),
+	"runAsGroup": z$2.int().describe("Numeric GID for the container process."),
+	"runAsUser": z$2.int().describe("Numeric UID for the container process.")
+}).describe("Container process identity and filesystem security.");
+//#endregion
 //#region src/generated/zod/health-check-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -4232,6 +4279,32 @@ const HealthCheckSchema = z$2.object({
 	"timeoutSeconds": z$2.optional(z$2.int().min(0).describe("Request timeout in seconds (1-5)"))
 }).describe("HTTP health check configuration.");
 //#endregion
+//#region src/generated/zod/kubernetes-http-probe-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description HTTP probe used by Kubernetes for workload liveness or readiness.
+*/
+const KubernetesHttpProbeSchema = z$2.object({
+	"path": z$2.string().describe("Absolute HTTP path served by the container."),
+	"port": z$2.int().min(0).describe("Container port to check.")
+}).describe("HTTP probe used by Kubernetes for workload liveness or readiness.");
+//#endregion
+//#region src/generated/zod/kubernetes-secret-mount-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Mounts an existing, setup-owned Kubernetes Secret into a Container pod.\nThe Secret must exist in the deployment namespace before the workload starts.
+*/
+const KubernetesSecretMountSchema = z$2.object({
+	"mountPath": z$2.string().describe("Directory where Kubernetes mounts the Secret's keys as read-only files."),
+	"secretName": z$2.string().describe("Name of the existing Secret in the deployment namespace.")
+}).describe("Mounts an existing, setup-owned Kubernetes Secret into a Container pod.\nThe Secret must exist in the deployment namespace before the workload starts.");
+//#endregion
 //#region src/generated/zod/persistent-storage-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -4306,6 +4379,15 @@ const ContainerSchema = z$2.object({
 		return z$2.union([HealthCheckSchema, z$2.null()]).optional();
 	},
 	"id": z$2.string().describe("Unique identifier for the container.\nMust be DNS-compatible: lowercase alphanumeric with hyphens."),
+	get "kubernetesLivenessProbe"() {
+		return z$2.union([KubernetesHttpProbeSchema, z$2.null()]).optional();
+	},
+	get "kubernetesReadinessProbe"() {
+		return z$2.union([KubernetesHttpProbeSchema, z$2.null()]).optional();
+	},
+	get "kubernetesSecretMounts"() {
+		return z$2.array(KubernetesSecretMountSchema.describe("Mounts an existing, setup-owned Kubernetes Secret into a Container pod.\nThe Secret must exist in the deployment namespace before the workload starts.")).describe("Existing Kubernetes Secrets mounted as read-only directories.").optional();
+	},
 	get "links"() {
 		return z$2.array(ResourceRefSchema.describe("Reference to a resource by its stable id and resource type.")).describe("Resource links (dependencies)");
 	},
@@ -4324,6 +4406,9 @@ const ContainerSchema = z$2.object({
 		return z$2.array(PublicEndpointSchema.describe("Public endpoint configuration for port-backed workload resources.")).describe("Public endpoints exposed by the container.").optional();
 	},
 	"replicas": z$2.int().min(0).describe("Fixed replica count (for stateful containers or stateless without autoscaling)").nullish(),
+	get "security"() {
+		return z$2.union([ContainerSecuritySchema, z$2.null()]).optional();
+	},
 	"stateful": z$2.optional(z$2.boolean().describe("Whether container is stateful (gets stable ordinals, optional persistent volumes)")),
 	"stopGracePeriodSeconds": z$2.int().min(1).max(86400).describe("Grace period in seconds for stopping replicas during updates, drains, and deletes.\n\nWhen omitted, the runtime backend applies its default. Valid values are\n1 second through 24 hours.").nullish()
 }).describe("Container resource for running long-running container workloads.\n\nA Container defines a deployable unit that runs on a ComputeCluster.\nThe managed container backend handles scheduling replicas across machines,\nautoscaling based on various metrics, and service discovery.\n\n## Example\n\n```rust\nuse alien_core::{Container, ContainerCode, ResourceSpec, ContainerAutoscaling, PublicEndpoint, ExposeProtocol};\n\nlet container = Container::new(\"api\".to_string())\n    .cluster(\"compute\".to_string())\n    .code(ContainerCode::Image {\n        image: \"myapp:latest\".to_string(),\n    })\n    .cpu(ResourceSpec { min: \"0.5\".to_string(), desired: \"1\".to_string() })\n    .memory(ResourceSpec { min: \"512Mi\".to_string(), desired: \"1Gi\".to_string() })\n    .port(8080)\n    .public_endpoint(PublicEndpoint {\n        name: \"api\".to_string(),\n        port: 8080,\n        protocol: ExposeProtocol::Http,\n        host_label: None,\n        wildcard_subdomains: false,\n    })\n    .autoscaling(ContainerAutoscaling {\n        min: 2,\n        desired: 3,\n        max: 10,\n        target_cpu_percent: Some(70.0),\n        target_memory_percent: None,\n        target_http_in_flight_per_replica: Some(100),\n        max_http_p95_latency_ms: None,\n    })\n    .permissions(\"container-execution\".to_string())\n    .build();\n```");
@@ -4750,6 +4835,36 @@ const DomainSettingsSchema = z$2.object({
 	}
 }).describe("Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains.");
 //#endregion
+//#region src/generated/zod/dynamic-container-health-check-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+const DynamicContainerHealthCheckSchema = z$2.object({
+	"path": z$2.string(),
+	"port": z$2.int().min(0)
+});
+//#endregion
+//#region src/generated/zod/dynamic-container-status-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+const DynamicContainerStatusSchema = z$2.enum([
+	"pending",
+	"running",
+	"failing",
+	"stopped"
+]);
+z$2.object({
+	"generation": z$2.int().min(0),
+	"message": z$2.string().nullish(),
+	"name": z$2.string(),
+	get "status"() {
+		return DynamicContainerStatusSchema;
+	}
+}).describe("What the Operator observed after applying one target generation.");
+//#endregion
 //#region src/generated/zod/email-dkim-token-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -6331,6 +6446,52 @@ const NetworkSettingsSchema = z$2.union([
 	})
 ]).describe("Network configuration for the stack.\n\nControls how VPC/VNet networking is provisioned. Users configure this in\n`StackSettings`; the Network resource itself is auto-generated by preflights.\n\n## Egress policy\n\nContainer cluster VMs are configured for egress based on the mode:\n\n- `UseDefault` → VMs get ephemeral public IPs (no NAT is provisioned)\n- `Create` → VMs use private IPs; Alien provisions a NAT gateway for outbound access\n- `ByoVpc*` / `ByoVnet*` → no public IPs assigned; customer manages egress\n\nFor production workloads, use `Create`. For fast dev/test iteration, `UseDefault` is\nsufficient. For environments with existing VPCs, use the appropriate `ByoVpc*` variant.");
 //#endregion
+//#region src/generated/zod/observed-application-image-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description A container image running in one observed application workload.
+*/
+const ObservedApplicationImageSchema = z$2.object({
+	"container": z$2.string().describe("Container name within the workload."),
+	"digest": z$2.string().describe("Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one.").nullish(),
+	"image": z$2.string().describe("Image reference reported by the container runtime."),
+	"workload": z$2.string().describe("Inventory identity of the workload, matching the `rawIdentity` of its\nobserved resource sample (for example `apps/v1:Deployment:shop:api`).")
+}).describe("A container image running in one observed application workload.");
+//#endregion
+//#region src/generated/zod/observed-application-source-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Where the Operator read the application identity from.
+*/
+const ObservedApplicationSourceSchema = z$2.enum(["kubernetes"]).describe("Where the Operator read the application identity from.");
+//#endregion
+//#region src/generated/zod/observed-application-report-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Application release the Operator observes running in its environment.\n\nThis identifies the customer\'s application, not the Operator: the\nOperator\'s own image is reported separately as [`OperatorImageReport`].
+*/
+const ObservedApplicationReportSchema = z$2.object({
+	"chartName": z$2.string().describe("Helm chart name from the workloads' `helm.sh/chart` label. Present only\nwhen every labelled workload names the same chart.").nullish(),
+	"chartVersion": z$2.string().describe("Helm chart version from the same label.").nullish(),
+	"complete": z$2.boolean().describe("Whether every workload kind could be listed. When `false`, the chart\nand images describe only the workloads the Operator could read."),
+	get "images"() {
+		return z$2.array(ObservedApplicationImageSchema.describe("A container image running in one observed application workload.")).describe("Distinct container images running in the observed workloads.").optional();
+	},
+	"observedAt": z$2.iso.datetime().describe("When the workloads were read."),
+	get "source"() {
+		return ObservedApplicationSourceSchema.describe("Where the Operator read the application identity from.");
+	}
+}).describe("Application release the Operator observes running in its environment.\n\nThis identifies the customer's application, not the Operator: the\nOperator's own image is reported separately as [`OperatorImageReport`].");
+//#endregion
 //#region src/generated/zod/raw-heartbeat-snippet-format-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -6376,6 +6537,9 @@ const ObservedResourceSampleSchema = z$2.object({
 	get "health"() {
 		return ObservedHealthSchema;
 	},
+	get "images"() {
+		return z$2.array(ContainerImageIdentitySchema.describe("Image a running container reports.")).describe("Distinct container images the resource's running instances report, when\nthe provider exposes them.").optional();
+	},
 	"labels": z$2.optional(z$2.object({}).catchall(z$2.string())),
 	get "lifecycle"() {
 		return ProviderLifecycleStateSchema;
@@ -6942,7 +7106,7 @@ const ResourceHeartbeatSchema = z$2.object({
 });
 z$2.object({
 	"domainEgressRules": z$2.boolean().describe("Egress can be restricted to a hostname allowlist"),
-	"egressDeny": z$2.boolean().describe("Whether a declared `deny` is actually enforced, rather than accepted and dropped"),
+	"egressDeny": z$2.boolean().describe("Whether a declared `deny` is actually enforced, rather than accepted and dropped.\nIt covers routed traffic; the `deny` mode says where DNS still resolves."),
 	"enforcedLimits": z$2.boolean().describe("The platform enforces the declared cpu, memory and disk ceilings"),
 	"files": z$2.boolean().describe("Files can be moved in and out of a sandbox"),
 	"jobs": z$2.boolean().describe("A command can be started, polled and cancelled across separate calls, so it outlives the\none that started it. False where nothing inside the sandbox owns the process in between."),
@@ -6980,7 +7144,7 @@ z$2.enum([
 * @description Specifies where the sandbox\'s root filesystem comes from.
 */
 const SandboxCodeSchema = z$2.union([z$2.object({
-	"image": z$2.string().describe("Image reference (e.g. `ubuntu:24.04`, `ghcr.io/myorg/sandbox:latest`).\n\nTwo backends narrow it in opposite directions: AWS wants an `s3://` bundle, Azure a\nbare catalog name such as `ubuntu`. Each refuses the other's shape while planning."),
+	"image": z$2.string().describe("Image reference (e.g. `ubuntu:24.04`, `ghcr.io/myorg/sandbox:latest`). AWS wants an\n`s3://` bundle; Azure takes a catalog name such as `ubuntu` or an amd64 registry\nimage, told apart by syntax. Each refuses what it cannot take while planning."),
 	"type": z$2.enum(["image"])
 }), z$2.object({
 	"src": z$2.string().describe("The source directory to build from"),
@@ -7351,6 +7515,8 @@ z$2.union([z$2.object({ "external": z$2.string().describe("Reference to another
 * @description A bag of resources, unaware of any cloud.
 */
 const StackSchema = z$2.object({
+	"dynamicContainerImageResources": z$2.optional(z$2.array(z$2.string()).describe("Released Container resources whose image repositories are approved for\ncontainers created after installation.")),
+	"dynamicContainerRepositories": z$2.optional(z$2.array(z$2.string()).describe("Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest.")),
 	"id": z$2.string().describe("Unique identifier for the stack"),
 	get "inputs"() {
 		return z$2.array(StackInputDefinitionSchema.describe("Stack input definition serialized into a release stack.")).describe("Input definitions required before setup or deployment can proceed.").optional();
@@ -7474,6 +7640,22 @@ const StorageSchema = z$2.object({
 * @description Request to submit a command response (from deployment)
 */
 const SubmitResponseRequestSchema = z$2.lazy(() => CommandResponseSchema).describe("Command response from deployment").describe("Request to submit a command response (from deployment)");
+z$2.object({
+	"cpu": z$2.string(),
+	"deleted": z$2.boolean(),
+	"env": z$2.optional(z$2.object({}).catchall(z$2.string())),
+	"generation": z$2.int().min(0),
+	get "healthCheck"() {
+		return z$2.union([DynamicContainerHealthCheckSchema, z$2.null()]).optional();
+	},
+	"image": z$2.string(),
+	"memory": z$2.string(),
+	"name": z$2.string(),
+	"ports": z$2.array(z$2.int().min(0)),
+	"replicas": z$2.int().min(0),
+	"secretEnv": z$2.optional(z$2.object({}).catchall(z$2.string())),
+	"suspendedReason": z$2.string().describe("Stop an installed workload when its release no longer admits the image.").nullish()
+}).describe("One release-independent container the Operator should run in its namespace.\nThe manager sends the complete set on every sync. An empty set removes\ncontainers previously owned by this deployment.");
 z$2.object({
 	get "bundles"() {
 		return z$2.array(OperationsBundleDownloadSchema.describe("One bundle the Operator needs to download to reach `targetBundleHash`.\nThe manager mints a short-lived presigned GET URL per bundle — the\nOperator never holds real cloud storage credentials, mirroring the OCI\nregistry proxy's credential-injection pattern.")).describe("Presigned downloads for every bundle in the target set. The Operator\nfetches only the ones it doesn't already have loaded at the right\nversion; already-loaded bundles are harmless to re-download.").optional();
@@ -8468,6 +8650,16 @@ const BindingNotFoundError = defineError({
 *
 * Application source declares portable pool requirements. Provider machine
 * names are selected later through deployment settings.
+*
+* On Kubernetes, declare the same Frozen resource to describe logical pools in
+* the deployment namespace. Alien verifies namespace access and pool references,
+* then applies architecture constraints to static and dynamic container Pods.
+* Source builds use one architecture per stack. Workers and pools without an
+* explicit architecture inherit that build constraint for Pod scheduling.
+* It creates no nodes. Hardware sizes, machine counts, autoscaling, and requested
+* failure-domain spread remain the cluster administrator's responsibility.
+* Provider instance types, selected zones, custom container CIDRs, GPU, and
+* nested virtualization requirements are unsupported and fail validation.
 */
 var ComputeCluster = class {
 	_config = { capacityGroups: [] };
@@ -8482,6 +8674,9 @@ var ComputeCluster = class {
 		return "compute-cluster";
 	}
 	pool(groupId, config) {
+		if (config.dynamicContainers) {
+			if (this._config.dynamicContainerPool !== void 0) throw new Error("Only one compute pool may accept dynamic containers");
+		}
 		if (config.failureDomainSpread !== void 0 && (!Number.isInteger(config.failureDomainSpread) || config.failureDomainSpread < 1 || config.failureDomainSpread > 255)) throw new Error("Compute pool failureDomainSpread must be an integer from 1 to 255");
 		const { minSize, maxSize } = selectedScaleBounds(config.scale);
 		this._config.capacityGroups.push({
@@ -8496,6 +8691,7 @@ var ComputeCluster = class {
 			this._config.failureDomainSpread ??= {};
 			this._config.failureDomainSpread[groupId] = config.failureDomainSpread;
 		}
+		if (config.dynamicContainers) this._config.dynamicContainerPool = groupId;
 		return this;
 	}
 	/**
@@ -8511,6 +8707,7 @@ var ComputeCluster = class {
 	* Builds and validates the cluster configuration.
 	*/
 	build() {
+		if (this._config.dynamicContainerPool !== void 0 && !this._config.capacityGroups?.some((group) => group.groupId === this._config.dynamicContainerPool)) throw new Error("Dynamic container pool must be declared in the compute cluster");
 		return new Resource({
 			type: "compute-cluster",
 			...ComputeClusterSchema.parse(this._config)
@@ -8587,6 +8784,7 @@ var Container = class extends ResourceBuilder {
 		ports: [],
 		publicEndpoints: [],
 		environment: {},
+		kubernetesSecretMounts: [],
 		stateful: false
 	};
 	/**
@@ -8646,18 +8844,19 @@ var Container = class extends ResourceBuilder {
 	/**
 	* Sets the memory resources for the container.
 	*
-	* Format: "<number>Mi" or "<number>Gi"
+	* Use a size string to set the same request and limit, or a ResourceSpec
+	* to set them separately on Kubernetes.
 	*
-	* Example: "512Mi", "2Gi", "16Gi"
+	* Examples: `.memory("512Mi")`, `.memory({ min: "128Mi", desired: "512Mi" })`
 	*
-	* @param size Memory size string.
+	* @param value Memory size string or ResourceSpec with min/desired.
 	* @returns The Container builder instance.
 	*/
-	memory(size) {
-		this._config.memory = {
-			min: size,
-			desired: size
-		};
+	memory(value) {
+		this._config.memory = typeof value === "string" ? {
+			min: value,
+			desired: value
+		} : value;
 		return this;
 	}
 	/**
@@ -8811,6 +9010,27 @@ var Container = class extends ResourceBuilder {
 		this._config.stateful = true;
 		return this;
 	}
+	/** Mounts an existing Secret from the deployment's Kubernetes namespace. */
+	kubernetesSecretMount(mount) {
+		this._config.kubernetesSecretMounts ??= [];
+		this._config.kubernetesSecretMounts.push(mount);
+		return this;
+	}
+	/** Restarts a pod when this Kubernetes HTTP liveness probe fails. */
+	kubernetesLivenessProbe(probe) {
+		this._config.kubernetesLivenessProbe = probe;
+		return this;
+	}
+	/** Excludes a pod from Service endpoints until this Kubernetes HTTP readiness probe passes. */
+	kubernetesReadinessProbe(probe) {
+		this._config.kubernetesReadinessProbe = probe;
+		return this;
+	}
+	/** Sets a portable container security profile and process identity. */
+	security(settings) {
+		this._config.security = settings;
+		return this;
+	}
 	/**
 	* Requests GPU resources.
 	* @param config GPU configuration with type and count.
@@ -9847,6 +10067,12 @@ var ServiceAccount = class {
 };
 //#endregion
 //#region src/stack.ts
+function isRepositoryName(repository) {
+	const [authority = "", ...path] = repository.split("/");
+	if (path.length === 0 || path.some((part) => !/^[a-z0-9]+(?:[._-]+[a-z0-9]+)*$/.test(part))) return false;
+	const [host = "", port, ...extra] = authority.split(":");
+	return extra.length === 0 && (port === void 0 || /^[0-9]+$/.test(port)) && host.split(".").every((label) => /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label));
+}
 /**
 * Represents a collection of cloud resources that are managed together.
 * Stacks are the top-level organizational unit in an Alien application.
@@ -9907,6 +10133,18 @@ var Stack = class {
 		this._config.inputs = getStackInputDefinitions(inputs);
 		return this;
 	}
+	/** Approve exact OCI image repositories for containers created after installation. */
+	dynamicContainerRepositories(repositories) {
+		if (repositories.length === 0 || repositories.length > 16 || new Set(repositories).size !== repositories.length || repositories.some((repository) => !isRepositoryName(repository))) throw new Error("Dynamic container repositories must be 1–16 distinct, fully qualified OCI repositories");
+		this._config.dynamicContainerRepositories = repositories;
+		return this;
+	}
+	/** Approve the repositories of Container images shipped in this release. */
+	dynamicContainerImageResources(resourceIds) {
+		if (resourceIds.length === 0 || new Set(resourceIds).size !== resourceIds.length) throw new Error("Dynamic container image resource IDs must be distinct and non-empty");
+		this._config.dynamicContainerImageResources = resourceIds;
+		return this;
+	}
 	/**
 	* Gets the stack ID without building/validating the stack.
 	* @returns The stack ID.
@@ -9920,6 +10158,7 @@ var Stack = class {
 	* @throws Error if the stack configuration is invalid.
 	*/
 	build() {
+		for (const resourceId of this._config.dynamicContainerImageResources ?? []) if (this._config.resources?.[resourceId]?.config.type !== "container") throw new Error(`Dynamic container image resource '${resourceId}' must be a declared Container`);
 		return StackSchema.parse(this._config);
 	}
 };
@@ -10350,6 +10589,6 @@ function validateOcu(field, value, allowZero) {
 //#region src/index.ts
 const experimental = { AwsOpenSearch };
 //#endregion
-export { AI, AgentStatusSchema, AiSchema as AiConfigSchema, AlienError, AlienErrorSchema as AlienErrorOptionsSchema, AlienEventSchema, ArtifactRegistry, ArtifactRegistrySchema as ArtifactRegistryConfigSchema, ArtifactRegistryHeartbeatDataSchema, ArtifactRegistryHeartbeatStatusSchema, AwsArtifactRegistryImportDataSchema, AwsBuildImportDataSchema, AwsCodeBuildHeartbeatDataSchema, AwsComputeClusterHeartbeatDataSchema, AwsComputeClusterImportDataSchema, AwsDynamoDbKeySchemaElementSchema, AwsDynamoDbKvHeartbeatDataSchema, AwsEcrArtifactRegistryHeartbeatDataSchema, AwsEcrRepositoryHeartbeatDataSchema, AwsIamRoleServiceAccountHeartbeatDataSchema, AwsKvImportDataSchema, AwsLambdaWorkerHeartbeatDataSchema, AwsNetworkImportDataSchema, AwsParameterStoreVaultHeartbeatDataSchema, AwsQueueImportDataSchema, AwsRemoteStackManagementHeartbeatDataSchema, AwsRemoteStackManagementImportDataSchema, AwsS3StorageHeartbeatDataSchema, AwsServiceAccountImportDataSchema, AwsSqsQueueHeartbeatDataSchema, AwsStorageImportDataSchema, AwsVaultImportDataSchema, AwsVpcNetworkHeartbeatDataSchema, AwsWorkerImportDataSchema, AzureArtifactRegistryImportDataSchema, AzureBlobStorageHeartbeatDataSchema, AzureBuildImportDataSchema, AzureComputeClusterHeartbeatDataSchema, AzureComputeClusterImportDataSchema, AzureContainerAppsBuildHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatStatusSchema, AzureContainerAppsEnvironmentImportDataSchema, AzureContainerAppsEnvironmentWorkloadProfileSchema, AzureContainerAppsWorkerHeartbeatDataSchema, AzureContainerRegistryHeartbeatDataSchema, AzureKeyVaultHeartbeatDataSchema, AzureKvImportDataSchema, AzureManagedIdentityServiceAccountHeartbeatDataSchema, AzureNetworkImportDataSchema, AzureQueueImportDataSchema, AzureRemoteStackManagementHeartbeatDataSchema, AzureRemoteStackManagementImportDataSchema, AzureResourceGroupHeartbeatDataSchema, AzureResourceGroupHeartbeatStatusSchema, AzureResourceGroupImportDataSchema, AzureResourceProviderActivationHeartbeatDataSchema, AzureServiceAccountImportDataSchema, AzureServiceActivationImportDataSchema, AzureServiceBusNamespaceHeartbeatDataSchema, AzureServiceBusNamespaceImportDataSchema, AzureServiceBusQueueHeartbeatDataSchema, AzureStorageAccountEndpointsSchema, AzureStorageAccountHeartbeatDataSchema, AzureStorageAccountImportDataSchema, AzureStorageImportDataSchema, AzureTableKvHeartbeatDataSchema, AzureVaultImportDataSchema, AzureVnetNetworkHeartbeatDataSchema, AzureWorkerImportDataSchema, BindingNotFoundError, BodySpecSchema, Build, BuildConfigSchema, BuildHeartbeatDataSchema, BuildHeartbeatStatusSchema, BuildOutputsSchema, BuildStatusSchema, CapacityGroupScalePolicySchema, CapacityGroupSchema, CommandDeliveryModeSchema, CommandResponseSchema, CommandStateSchema, CommandStatusResponseSchema, CommandTargetSchema, CommandTargetTypeSchema, ComputeCapacityGroupStatusSchema, ComputeCapacityRecommendationSchema, ComputeChoiceRangeSchema, ComputeCluster, ComputeClusterSchema as ComputeClusterConfigSchema, ComputeClusterHeartbeatDataSchema, ComputeClusterHeartbeatStatusSchema, ComputePoolSelectionSchema, ComputeSettingsSchema, ComputeTypeSchema, Container, ContainerAutoscalingSchema, ContainerCodeSchema, ContainerSchema as ContainerConfigSchema, ContainerHeartbeatDataSchema, ContainerPortSchema, CreateCommandRequestSchema, CreateCommandResponseSchema, Daemon, DaemonCodeSchema, DaemonSchema as DaemonConfigSchema, DaemonHeartbeatDataSchema, DaemonOutputsSchema, DeploymentModelSchema, DevResourceInfoSchema, DevStatusSchema, DevStatusStateSchema, Email, EmailSchema as EmailConfigSchema, EnvelopeSchema, EventChangeSchema, EventStateSchema, ExposeProtocolSchema, FailureDomainSelectionSchema, GcpArtifactRegistryHeartbeatDataSchema, GcpArtifactRegistryImportDataSchema, GcpBuildImportDataSchema, GcpCloudBuildHeartbeatDataSchema, GcpCloudRunWorkerHeartbeatDataSchema, GcpCloudStorageHeartbeatDataSchema, GcpComputeClusterHeartbeatDataSchema, GcpComputeClusterImportDataSchema, GcpFirestoreKvHeartbeatDataSchema, GcpKvImportDataSchema, GcpNetworkImportDataSchema, GcpPubSubQueueHeartbeatDataSchema, GcpQueueImportDataSchema, GcpRemoteStackManagementHeartbeatDataSchema, GcpRemoteStackManagementImportDataSchema, GcpSecretManagerVaultHeartbeatDataSchema, GcpServiceAccountHeartbeatDataSchema, GcpServiceAccountImportDataSchema, GcpServiceActivationImportDataSchema, GcpServiceUsageActivationHeartbeatDataSchema, GcpStorageImportDataSchema, GcpVaultImportDataSchema, GcpVpcNetworkHeartbeatDataSchema, GcpWorkerImportDataSchema, HeartbeatBackendSchema, HeartbeatIssueSeveritySchema, HeartbeatsModeSchema, HorizonContainerHeartbeatDataSchema, HttpMethodSchema, InvalidBindingConfigError, Key, KeySchema as KeyConfigSchema, KubernetesBuildHeartbeatDataSchema, KubernetesClusterNodeStatusSchema, KubernetesContainerHeartbeatDataSchema, KubernetesDaemonHeartbeatDataSchema, KubernetesEventInvolvedObjectSchema, KubernetesEventSnapshotSchema, KubernetesEventSourceSchema, KubernetesNodeConditionStatusSchema, KubernetesNodeResourcesSchema, KubernetesNodeUsageSchema, KubernetesPodRuntimeUnitStatusSchema, KubernetesSecretVaultHeartbeatDataSchema, KubernetesWorkerHeartbeatDataSchema, Kv, KvSchema as KvConfigSchema, KvHeartbeatDataSchema, KvHeartbeatStatusSchema, LeaseInfoSchema, LeaseRequestSchema, LeaseResponseSchema, LocalArtifactRegistryHeartbeatDataSchema, LocalComputeClusterHeartbeatDataSchema, LocalContainerHeartbeatDataSchema, LocalDaemonHeartbeatDataSchema, LocalKvHeartbeatDataSchema, LocalQueueHeartbeatDataSchema, LocalRuntimeEventSnapshotSchema, LocalRuntimeEventSubjectSchema, LocalRuntimeUnitKindSchema, LocalRuntimeUnitStatusSchema, LocalServiceAccountHeartbeatDataSchema, LocalStorageHeartbeatDataSchema, LocalVaultHeartbeatDataSchema, LocalWorkerHeartbeatDataSchema, MachineProfileSchema, ManagedRuntimeEventInvolvedObjectSchema, ManagedRuntimeEventSnapshotSchema, ManagedRuntimeEventSourceSchema, ManagedRuntimeUnitStatusSchema, MessagePayloadSchema, MetricSampleSchema, NetworkHeartbeatDataSchema, NetworkHeartbeatStatusSchema, ObservedCountsSchema, ObservedHealthSchema, ObservedInventoryBatchSchema, ObservedResourceSampleSchema, OperatorImageReportSchema, OperatorImageSourceSchema, PermissionSetSchema, PlatformSchema, Postgres, PostgresSchema as PostgresConfigSchema, PresignedRequestBackendSchema, PresignedRequestSchema, ProviderFleetStatusSchema, ProviderLifecycleStateSchema, PublicEndpointSchema, PublicEndpointTargetSettingsSchema, Queue, QueueSchema as QueueConfigSchema, QueueHeartbeatDataSchema, QueueHeartbeatStatusSchema, QueueMessageSchema, ReadinessProbeSchema, ReleaseRequestSchema, RemoteStackManagementHeartbeatDataSchema, RemoteStackManagementHeartbeatStatusSchema, Resource, ResourceHeartbeatDataSchema, ResourceHeartbeatSchema, ResourceLifecycleSchema, ResourceNotFoundError, ResourceOutputsParseError, ResourceRefSchema, ResourceSchemaMapping, ResourceStatusSchema, ResourceTypeSchema, ResponseHandlingSchema, Sandbox, SandboxSchema as SandboxConfigSchema, ScheduledEventSchema, ServiceAccount, ServiceAccountSchema as ServiceAccountConfigSchema, ServiceAccountHeartbeatDataSchema, ServiceAccountHeartbeatStatusSchema, ServiceAccountOutputsSchema, ServiceActivationHeartbeatDataSchema, ServiceActivationHeartbeatStatusSchema, Stack, StackInputDefaultValueSchema, StackInputDefinitionSchema, StackInputEnvironmentMappingSchema, StackInputEnvironmentVariableTypeSchema, StackInputKindSchema, StackInputProviderSchema, StackInputValidationSchema, StackResourceStateSchema, StackSchema, StackSettingsSchema, StackStateSchema, StackStatusSchema, Storage, StorageSchema as StorageConfigSchema, StorageEventSchema, StorageEventTypeSchema, StorageEventsSchema, StorageHeartbeatDataSchema, StorageHeartbeatStatusSchema, StorageUploadSchema, SubmitResponseRequestSchema, TelemetryModeSchema, TraceContextSchema, UnexpectedResourceTypeError, UpdatesModeSchema, UploadCompleteRequestSchema, UploadCompleteResponseSchema, Vault, VaultSchema as VaultConfigSchema, VaultHeartbeatDataSchema, VaultHeartbeatStatusSchema, Worker, WorkerSchema as WorkerConfigSchema, WorkerHeartbeatDataSchema, WorkerOutputsSchema, WorkerPublicEndpointSchema, WorkerTriggerSchema, WorkloadHeartbeatStatusSchema, WorkloadReplicaStatusSchema, defineBooleanInput as boolean, defineError, defineEnumInput as enum, experimental, getResourceOutputs, getStackInputDefinitions, inputs, defineIntegerInput as integer, defineNumberInput as number, defineSecretInput as secret, defineStringInput as string, defineStringListInput as stringList };
+export { AI, AgentStatusSchema, AiSchema as AiConfigSchema, AlienError, AlienErrorSchema as AlienErrorOptionsSchema, AlienEventSchema, ArtifactRegistry, ArtifactRegistrySchema as ArtifactRegistryConfigSchema, ArtifactRegistryHeartbeatDataSchema, ArtifactRegistryHeartbeatStatusSchema, AwsArtifactRegistryImportDataSchema, AwsBuildImportDataSchema, AwsCodeBuildHeartbeatDataSchema, AwsComputeClusterHeartbeatDataSchema, AwsComputeClusterImportDataSchema, AwsDynamoDbKeySchemaElementSchema, AwsDynamoDbKvHeartbeatDataSchema, AwsEcrArtifactRegistryHeartbeatDataSchema, AwsEcrRepositoryHeartbeatDataSchema, AwsIamRoleServiceAccountHeartbeatDataSchema, AwsKvImportDataSchema, AwsLambdaWorkerHeartbeatDataSchema, AwsNetworkImportDataSchema, AwsParameterStoreVaultHeartbeatDataSchema, AwsQueueImportDataSchema, AwsRemoteStackManagementHeartbeatDataSchema, AwsRemoteStackManagementImportDataSchema, AwsS3StorageHeartbeatDataSchema, AwsServiceAccountImportDataSchema, AwsSqsQueueHeartbeatDataSchema, AwsStorageImportDataSchema, AwsVaultImportDataSchema, AwsVpcNetworkHeartbeatDataSchema, AwsWorkerImportDataSchema, AzureArtifactRegistryImportDataSchema, AzureBlobStorageHeartbeatDataSchema, AzureBuildImportDataSchema, AzureComputeClusterHeartbeatDataSchema, AzureComputeClusterImportDataSchema, AzureContainerAppsBuildHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatStatusSchema, AzureContainerAppsEnvironmentImportDataSchema, AzureContainerAppsEnvironmentWorkloadProfileSchema, AzureContainerAppsWorkerHeartbeatDataSchema, AzureContainerRegistryHeartbeatDataSchema, AzureKeyVaultHeartbeatDataSchema, AzureKvImportDataSchema, AzureManagedIdentityServiceAccountHeartbeatDataSchema, AzureNetworkImportDataSchema, AzureQueueImportDataSchema, AzureRemoteStackManagementHeartbeatDataSchema, AzureRemoteStackManagementImportDataSchema, AzureResourceGroupHeartbeatDataSchema, AzureResourceGroupHeartbeatStatusSchema, AzureResourceGroupImportDataSchema, AzureResourceProviderActivationHeartbeatDataSchema, AzureServiceAccountImportDataSchema, AzureServiceActivationImportDataSchema, AzureServiceBusNamespaceHeartbeatDataSchema, AzureServiceBusNamespaceImportDataSchema, AzureServiceBusQueueHeartbeatDataSchema, AzureStorageAccountEndpointsSchema, AzureStorageAccountHeartbeatDataSchema, AzureStorageAccountImportDataSchema, AzureStorageImportDataSchema, AzureTableKvHeartbeatDataSchema, AzureVaultImportDataSchema, AzureVnetNetworkHeartbeatDataSchema, AzureWorkerImportDataSchema, BindingNotFoundError, BodySpecSchema, Build, BuildConfigSchema, BuildHeartbeatDataSchema, BuildHeartbeatStatusSchema, BuildOutputsSchema, BuildStatusSchema, CapacityGroupScalePolicySchema, CapacityGroupSchema, CommandDeliveryModeSchema, CommandResponseSchema, CommandStateSchema, CommandStatusResponseSchema, CommandTargetSchema, CommandTargetTypeSchema, ComputeCapacityGroupStatusSchema, ComputeCapacityRecommendationSchema, ComputeChoiceRangeSchema, ComputeCluster, ComputeClusterSchema as ComputeClusterConfigSchema, ComputeClusterHeartbeatDataSchema, ComputeClusterHeartbeatStatusSchema, ComputePoolSelectionSchema, ComputeSettingsSchema, ComputeTypeSchema, Container, ContainerAutoscalingSchema, ContainerCodeSchema, ContainerSchema as ContainerConfigSchema, ContainerHeartbeatDataSchema, ContainerImageIdentitySchema, ContainerPortSchema, CreateCommandRequestSchema, CreateCommandResponseSchema, Daemon, DaemonCodeSchema, DaemonSchema as DaemonConfigSchema, DaemonHeartbeatDataSchema, DaemonOutputsSchema, DeploymentModelSchema, DevResourceInfoSchema, DevStatusSchema, DevStatusStateSchema, Email, EmailSchema as EmailConfigSchema, EnvelopeSchema, EventChangeSchema, EventStateSchema, ExposeProtocolSchema, FailureDomainSelectionSchema, GcpArtifactRegistryHeartbeatDataSchema, GcpArtifactRegistryImportDataSchema, GcpBuildImportDataSchema, GcpCloudBuildHeartbeatDataSchema, GcpCloudRunWorkerHeartbeatDataSchema, GcpCloudStorageHeartbeatDataSchema, GcpComputeClusterHeartbeatDataSchema, GcpComputeClusterImportDataSchema, GcpFirestoreKvHeartbeatDataSchema, GcpKvImportDataSchema, GcpNetworkImportDataSchema, GcpPubSubQueueHeartbeatDataSchema, GcpQueueImportDataSchema, GcpRemoteStackManagementHeartbeatDataSchema, GcpRemoteStackManagementImportDataSchema, GcpSecretManagerVaultHeartbeatDataSchema, GcpServiceAccountHeartbeatDataSchema, GcpServiceAccountImportDataSchema, GcpServiceActivationImportDataSchema, GcpServiceUsageActivationHeartbeatDataSchema, GcpStorageImportDataSchema, GcpVaultImportDataSchema, GcpVpcNetworkHeartbeatDataSchema, GcpWorkerImportDataSchema, HeartbeatBackendSchema, HeartbeatIssueSeveritySchema, HeartbeatsModeSchema, HorizonContainerHeartbeatDataSchema, HttpMethodSchema, InvalidBindingConfigError, Key, KeySchema as KeyConfigSchema, KubernetesBuildHeartbeatDataSchema, KubernetesClusterNodeStatusSchema, KubernetesContainerHeartbeatDataSchema, KubernetesDaemonHeartbeatDataSchema, KubernetesEventInvolvedObjectSchema, KubernetesEventSnapshotSchema, KubernetesEventSourceSchema, KubernetesNodeConditionStatusSchema, KubernetesNodeResourcesSchema, KubernetesNodeUsageSchema, KubernetesPodRuntimeUnitStatusSchema, KubernetesSecretVaultHeartbeatDataSchema, KubernetesWorkerHeartbeatDataSchema, Kv, KvSchema as KvConfigSchema, KvHeartbeatDataSchema, KvHeartbeatStatusSchema, LeaseInfoSchema, LeaseRequestSchema, LeaseResponseSchema, LocalArtifactRegistryHeartbeatDataSchema, LocalComputeClusterHeartbeatDataSchema, LocalContainerHeartbeatDataSchema, LocalDaemonHeartbeatDataSchema, LocalKvHeartbeatDataSchema, LocalQueueHeartbeatDataSchema, LocalRuntimeEventSnapshotSchema, LocalRuntimeEventSubjectSchema, LocalRuntimeUnitKindSchema, LocalRuntimeUnitStatusSchema, LocalServiceAccountHeartbeatDataSchema, LocalStorageHeartbeatDataSchema, LocalVaultHeartbeatDataSchema, LocalWorkerHeartbeatDataSchema, MachineProfileSchema, ManagedRuntimeEventInvolvedObjectSchema, ManagedRuntimeEventSnapshotSchema, ManagedRuntimeEventSourceSchema, ManagedRuntimeUnitStatusSchema, MessagePayloadSchema, MetricSampleSchema, NetworkHeartbeatDataSchema, NetworkHeartbeatStatusSchema, ObservedApplicationImageSchema, ObservedApplicationReportSchema, ObservedApplicationSourceSchema, ObservedCountsSchema, ObservedHealthSchema, ObservedInventoryBatchSchema, ObservedResourceSampleSchema, OperatorImageReportSchema, OperatorImageSourceSchema, PermissionSetSchema, PlatformSchema, Postgres, PostgresSchema as PostgresConfigSchema, PresignedRequestBackendSchema, PresignedRequestSchema, ProviderFleetStatusSchema, ProviderLifecycleStateSchema, PublicEndpointSchema, PublicEndpointTargetSettingsSchema, Queue, QueueSchema as QueueConfigSchema, QueueHeartbeatDataSchema, QueueHeartbeatStatusSchema, QueueMessageSchema, ReadinessProbeSchema, ReleaseRequestSchema, RemoteStackManagementHeartbeatDataSchema, RemoteStackManagementHeartbeatStatusSchema, Resource, ResourceHeartbeatDataSchema, ResourceHeartbeatSchema, ResourceLifecycleSchema, ResourceNotFoundError, ResourceOutputsParseError, ResourceRefSchema, ResourceSchemaMapping, ResourceStatusSchema, ResourceTypeSchema, ResponseHandlingSchema, Sandbox, SandboxSchema as SandboxConfigSchema, ScheduledEventSchema, ServiceAccount, ServiceAccountSchema as ServiceAccountConfigSchema, ServiceAccountHeartbeatDataSchema, ServiceAccountHeartbeatStatusSchema, ServiceAccountOutputsSchema, ServiceActivationHeartbeatDataSchema, ServiceActivationHeartbeatStatusSchema, Stack, StackInputDefaultValueSchema, StackInputDefinitionSchema, StackInputEnvironmentMappingSchema, StackInputEnvironmentVariableTypeSchema, StackInputKindSchema, StackInputProviderSchema, StackInputValidationSchema, StackResourceStateSchema, StackSchema, StackSettingsSchema, StackStateSchema, StackStatusSchema, Storage, StorageSchema as StorageConfigSchema, StorageEventSchema, StorageEventTypeSchema, StorageEventsSchema, StorageHeartbeatDataSchema, StorageHeartbeatStatusSchema, StorageUploadSchema, SubmitResponseRequestSchema, TelemetryModeSchema, TraceContextSchema, UnexpectedResourceTypeError, UpdatesModeSchema, UploadCompleteRequestSchema, UploadCompleteResponseSchema, Vault, VaultSchema as VaultConfigSchema, VaultHeartbeatDataSchema, VaultHeartbeatStatusSchema, Worker, WorkerSchema as WorkerConfigSchema, WorkerHeartbeatDataSchema, WorkerOutputsSchema, WorkerPublicEndpointSchema, WorkerTriggerSchema, WorkloadHeartbeatStatusSchema, WorkloadReplicaStatusSchema, defineBooleanInput as boolean, defineError, defineEnumInput as enum, experimental, getResourceOutputs, getStackInputDefinitions, inputs, defineIntegerInput as integer, defineNumberInput as number, defineSecretInput as secret, defineStringInput as string, defineStringListInput as stringList };
 
 //# sourceMappingURL=index.js.map