@alienplatform/core 3.3.26 → 3.3.27

package/dist/index.js

@@ -35,6 +35,7 @@ const DeploymentStatusSchema = z$2.enum([
 	"initial-setup-failed",
 	"provisioning",
 	"waiting-for-machines",
+	"waiting-for-secrets",
 	"provisioning-failed",
 	"running",
 	"refresh-failed",
@@ -3686,7 +3687,7 @@ const ComputeClusterHeartbeatDataSchema = z$2.union([
 * Do not edit manually.
 */
 /**
-* @description ComputeCluster resource for running long-running container workloads.\n\nA ComputeCluster provides the setup-owned machine boundary for containers.\nAlien may manage the worker fleet inside that boundary when setup grants\n`compute-cluster/management`.\n\n## Architecture\n\n- **Setup** creates cloud resources: ASGs/MIGs/VMSSs, IAM roles, security groups\n- **Alien** manages allowed fleet operations: machine count and runtime\n  machine image rollout\n- A node agent runs on each machine from the selected runtime image channel\n\n## Example\n\n```rust\nuse alien_core::{CapacityGroup, ComputeCluster, MachineProfile};\n\nlet cluster = ComputeCluster::new(\"compute\".to_string())\n    .capacity_group(CapacityGroup {\n        group_id: \"general\".to_string(),\n        instance_type: None,\n        profile: Some(MachineProfile {\n            cpu: \"4.0\".to_string(),\n            memory_bytes: 16 * 1024 * 1024 * 1024,\n            ephemeral_storage_bytes: 20 * 1024 * 1024 * 1024,\n            architecture: None,\n            gpu: None,\n        }),\n        min_size: 1,\n        max_size: 5,\n        scale_policy: None,\n        nested_virtualization: None,\n    })\n    .build();\n```
+* @description ComputeCluster resource for running long-running container workloads.\n\nA ComputeCluster provides the setup-owned machine boundary for containers.\nAlien may manage the worker fleet inside that boundary when setup grants\n`compute-cluster/management`.\n\n## Architecture\n\n- **Setup** creates cloud resources: ASGs/MIGs/VMSSs, IAM roles, security groups\n- **Alien** manages allowed fleet operations: machine count, runtime\n  machine image rollout and, on AWS, the machine type within one CPU architecture\n- A node agent runs on each machine from the selected runtime image channel\n\n## Example\n\n```rust\nuse alien_core::{CapacityGroup, ComputeCluster, MachineProfile};\n\nlet cluster = ComputeCluster::new(\"compute\".to_string())\n    .capacity_group(CapacityGroup {\n        group_id: \"general\".to_string(),\n        instance_type: None,\n        profile: Some(MachineProfile {\n            cpu: \"4.0\".to_string(),\n            memory_bytes: 16 * 1024 * 1024 * 1024,\n            ephemeral_storage_bytes: 20 * 1024 * 1024 * 1024,\n            architecture: None,\n            gpu: None,\n        }),\n        min_size: 1,\n        max_size: 5,\n        scale_policy: None,\n        nested_virtualization: None,\n    })\n    .build();\n```
 */
 const ComputeClusterSchema = z$2.object({
 	get "capacityGroups"() {
@@ -3697,7 +3698,7 @@ const ComputeClusterSchema = z$2.object({
 	"failureDomainSpread": z$2.optional(z$2.object({}).catchall(z$2.int().min(0)).describe("Requested failure-domain spread keyed by capacity group.\nEmpty preserves the existing aggregate layout.")),
 	"id": z$2.string().describe("Unique identifier for the container cluster.\nMust contain only alphanumeric characters, hyphens, and underscores."),
 	"selectedFailureDomains": z$2.optional(z$2.object({}).catchall(z$2.array(z$2.string())).describe("Concrete provider failure domains selected during setup, keyed by capacity group.\nEmpty preserves the existing aggregate layout when no spread policy is configured."))
-}).describe("ComputeCluster resource for running long-running container workloads.\n\nA ComputeCluster provides the setup-owned machine boundary for containers.\nAlien may manage the worker fleet inside that boundary when setup grants\n`compute-cluster/management`.\n\n## Architecture\n\n- **Setup** creates cloud resources: ASGs/MIGs/VMSSs, IAM roles, security groups\n- **Alien** manages allowed fleet operations: machine count and runtime\n  machine image rollout\n- A node agent runs on each machine from the selected runtime image channel\n\n## Example\n\n```rust\nuse alien_core::{CapacityGroup, ComputeCluster, MachineProfile};\n\nlet cluster = ComputeCluster::new(\"compute\".to_string())\n    .capacity_group(CapacityGroup {\n        group_id: \"general\".to_string(),\n        instance_type: None,\n        profile: Some(MachineProfile {\n            cpu: \"4.0\".to_string(),\n            memory_bytes: 16 * 1024 * 1024 * 1024,\n            ephemeral_storage_bytes: 20 * 1024 * 1024 * 1024,\n            architecture: None,\n            gpu: None,\n        }),\n        min_size: 1,\n        max_size: 5,\n        scale_policy: None,\n        nested_virtualization: None,\n    })\n    .build();\n```");
+}).describe("ComputeCluster resource for running long-running container workloads.\n\nA ComputeCluster provides the setup-owned machine boundary for containers.\nAlien may manage the worker fleet inside that boundary when setup grants\n`compute-cluster/management`.\n\n## Architecture\n\n- **Setup** creates cloud resources: ASGs/MIGs/VMSSs, IAM roles, security groups\n- **Alien** manages allowed fleet operations: machine count, runtime\n  machine image rollout and, on AWS, the machine type within one CPU architecture\n- A node agent runs on each machine from the selected runtime image channel\n\n## Example\n\n```rust\nuse alien_core::{CapacityGroup, ComputeCluster, MachineProfile};\n\nlet cluster = ComputeCluster::new(\"compute\".to_string())\n    .capacity_group(CapacityGroup {\n        group_id: \"general\".to_string(),\n        instance_type: None,\n        profile: Some(MachineProfile {\n            cpu: \"4.0\".to_string(),\n            memory_bytes: 16 * 1024 * 1024 * 1024,\n            ephemeral_storage_bytes: 20 * 1024 * 1024 * 1024,\n            architecture: None,\n            gpu: None,\n        }),\n        min_size: 1,\n        max_size: 5,\n        scale_policy: None,\n        nested_virtualization: None,\n    })\n    .build();\n```");
 //#endregion
 //#region src/generated/zod/failure-domain-selection-schema.ts
 /**
@@ -4263,6 +4264,16 @@ const ContainerSecuritySchema = z$2.object({
 	"runAsUser": z$2.int().describe("Numeric UID for the container process.")
 }).describe("Container process identity and filesystem security.");
 //#endregion
+//#region src/generated/zod/container-tunnel-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description A container port reachable from the control plane through the manager.\n\nRequests to `/v1/deployments/{deployment}/tunnels/{container}/...` on the\nmanager are forwarded to this port over the operator\'s outbound\nconnection, so the control plane can call the service without any inbound\nnetwork path into the deployment.
+*/
+const ContainerTunnelSchema = z$2.object({ "port": z$2.int().min(0).describe("Container port that serves HTTP. Must be one of the container's ports.") }).describe("A container port reachable from the control plane through the manager.\n\nRequests to `/v1/deployments/{deployment}/tunnels/{container}/...` on the\nmanager are forwarded to this port over the operator's outbound\nconnection, so the control plane can call the service without any inbound\nnetwork path into the deployment.");
+//#endregion
 //#region src/generated/zod/health-check-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -4410,7 +4421,10 @@ const ContainerSchema = z$2.object({
 		return z$2.union([ContainerSecuritySchema, z$2.null()]).optional();
 	},
 	"stateful": z$2.optional(z$2.boolean().describe("Whether container is stateful (gets stable ordinals, optional persistent volumes)")),
-	"stopGracePeriodSeconds": z$2.int().min(1).max(86400).describe("Grace period in seconds for stopping replicas during updates, drains, and deletes.\n\nWhen omitted, the runtime backend applies its default. Valid values are\n1 second through 24 hours.").nullish()
+	"stopGracePeriodSeconds": z$2.int().min(1).max(86400).describe("Grace period in seconds for stopping replicas during updates, drains, and deletes.\n\nWhen omitted, the runtime backend applies its default. Valid values are\n1 second through 24 hours.").nullish(),
+	get "tunnel"() {
+		return z$2.union([ContainerTunnelSchema, z$2.null()]).optional();
+	}
 }).describe("Container resource for running long-running container workloads.\n\nA Container defines a deployable unit that runs on a ComputeCluster.\nThe managed container backend handles scheduling replicas across machines,\nautoscaling based on various metrics, and service discovery.\n\n## Example\n\n```rust\nuse alien_core::{Container, ContainerCode, ResourceSpec, ContainerAutoscaling, PublicEndpoint, ExposeProtocol};\n\nlet container = Container::new(\"api\".to_string())\n    .cluster(\"compute\".to_string())\n    .code(ContainerCode::Image {\n        image: \"myapp:latest\".to_string(),\n    })\n    .cpu(ResourceSpec { min: \"0.5\".to_string(), desired: \"1\".to_string() })\n    .memory(ResourceSpec { min: \"512Mi\".to_string(), desired: \"1Gi\".to_string() })\n    .port(8080)\n    .public_endpoint(PublicEndpoint {\n        name: \"api\".to_string(),\n        port: 8080,\n        protocol: ExposeProtocol::Http,\n        host_label: None,\n        wildcard_subdomains: false,\n    })\n    .autoscaling(ContainerAutoscaling {\n        min: 2,\n        desired: 3,\n        max: 10,\n        target_cpu_percent: Some(70.0),\n        target_memory_percent: None,\n        target_http_in_flight_per_replica: Some(100),\n        max_http_p95_latency_ms: None,\n    })\n    .permissions(\"container-execution\".to_string())\n    .build();\n```");
 //#endregion
 //#region src/generated/zod/create-command-request-schema.ts
@@ -4757,6 +4771,75 @@ const DaemonSchema = z$2.object({
 	"stopGracePeriodSeconds": z$2.int().min(1).max(86400).describe("Grace period in seconds for stopping daemon instances during updates, drains, and deletes.\n\nWhen omitted, the runtime backend applies its default. Valid values are\n1 second through 24 hours.").nullish()
 });
 //#endregion
+//#region src/generated/zod/deployer-secret-store-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description The secret store a deployer writes a vault-native secret into.
+*/
+const DeployerSecretStoreSchema = z$2.enum([
+	"aws-parameter-store",
+	"gcp-secret-manager",
+	"azure-key-vault",
+	"kubernetes-secret",
+	"local-vault"
+]).describe("The secret store a deployer writes a vault-native secret into.");
+//#endregion
+//#region src/generated/zod/deployer-secret-location-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Where a deployer writes a vault-native secret.
+*/
+const DeployerSecretLocationSchema = z$2.object({
+	"cliCommand": z$2.string().describe("Command that writes the value, with `<VALUE>` in place of the secret."),
+	"consoleUrl": z$2.string().describe("Cloud console page where the secret is created, when the store has one.").nullish(),
+	"name": z$2.string().describe("Full name of the secret in that store."),
+	get "store"() {
+		return DeployerSecretStoreSchema.describe("The secret store a deployer writes a vault-native secret into.");
+	},
+	"vaultName": z$2.string().describe("The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project.").nullish()
+}).describe("Where a deployer writes a vault-native secret.");
+//#endregion
+//#region src/generated/zod/deployer-secret-status-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value.
+*/
+const DeployerSecretStatusSchema = z$2.enum([
+	"present",
+	"missing",
+	"invalid"
+]).describe("Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value.");
+//#endregion
+//#region src/generated/zod/deployer-secret-report-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description The state of one deployer secret slot, reported with the deployment.
+*/
+const DeployerSecretReportSchema = z$2.object({
+	"inputId": z$2.string().describe("Stack input id."),
+	"label": z$2.string().describe("The input's label."),
+	get "location"() {
+		return DeployerSecretLocationSchema.describe("Where a deployer writes a vault-native secret.");
+	},
+	"message": z$2.string().describe("Why the slot is invalid.").nullish(),
+	"required": z$2.boolean().describe("Whether the workload cannot start without it."),
+	get "status"() {
+		return DeployerSecretStatusSchema.describe("Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value.");
+	}
+}).describe("The state of one deployer secret slot, reported with the deployment.");
+//#endregion
 //#region src/generated/zod/deployment-model-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -4938,6 +5021,16 @@ const EmailSchema = z$2.object({
 	}
 }).describe("Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change.\n\nAlien activates the provisioned receipt rule set as part of setup. Because\nSES permits only one active receipt rule set per AWS account and region, an\nAWS stack may contain only one email resource with inbound delivery. The\nresource requires exclusive ownership of SES receiving in its account and\nregion: setup refuses to replace an active rule set it does not own. Choose\nan unused region when the account already receives email through SES. SES email\nreceiving is available only in a subset of AWS regions; deploying `inbound`\nto an unsupported region fails during setup.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.");
 //#endregion
+//#region src/generated/zod/endpoint-access-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Reachability of the deployment\'s public endpoints, fixed at setup.
+*/
+const EndpointAccessSchema = z$2.enum(["internet", "private"]).describe("Reachability of the deployment's public endpoints, fixed at setup.");
+//#endregion
 //#region src/generated/zod/response-handling-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -7180,7 +7273,7 @@ const SandboxEgressSchema = z$2.union([
 * @description How long a sandbox may live and when it is paused.\n\nDeclaration-time ceilings, not per-request values: every sandbox created through this\ndeclaration\'s binding is held to them, whatever a caller asks for at runtime.
 */
 const SandboxLifecyclePolicySchema = z$2.object({
-	"idlePauseSeconds": z$2.int().min(0).describe("Idle period after which the sandbox is paused, where the platform supports it").nullish(),
+	"idlePauseSeconds": z$2.int().min(0).describe("Idle period after which the sandbox is paused, where the platform supports it.\n\nStored state written before the rename calls this `idleSuspendSeconds`.").nullish(),
 	"maxLifetimeSeconds": z$2.int().min(0).describe("Wall-clock ceiling on a single sandbox, after which the platform terminates it.\n\nOptional because not every backend has the primitive: Kubernetes has\n`activeDeadlineSeconds` and AWS `maximumDurationInSeconds`, while neither Azure nor Local\nexpose one, so declaring a ceiling there is refused at plan time rather than accepted and\nnever applied. AWS caps it at 8 hours.").nullish()
 }).describe("How long a sandbox may live and when it is paused.\n\nDeclaration-time ceilings, not per-request values: every sandbox created through this\ndeclaration's binding is held to them, whatever a caller asks for at runtime.");
 //#endregion
@@ -7204,6 +7297,16 @@ z$2.object({
 	"parentName": z$2.string().describe("Name of the durable parent that sandboxes are created inside")
 }).describe("Outputs generated by a successfully provisioned Sandbox parent.");
 //#endregion
+//#region src/generated/zod/sandbox-privileged-supervisor-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Opt-in supervisor-owned network enforcement. Caller requests cannot change this identity.
+*/
+const SandboxPrivilegedSupervisorSchema = z$2.object({ "commandUid": z$2.int().min(0).describe("Nonzero numeric uid and primary gid for every command, including the image entrypoint.") }).describe("Opt-in supervisor-owned network enforcement. Caller requests cannot change this identity.");
+//#endregion
 //#region src/generated/zod/sandbox-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -7227,7 +7330,10 @@ const SandboxSchema = z$2.object({
 		return z$2.union([SandboxLimitsSchema, z$2.null()]).optional();
 	},
 	"previewPorts": z$2.optional(z$2.array(z$2.int().min(0)).describe("Ports eligible for a preview capability. An application reaches its sandbox through the\nprovider, so it cannot widen its own ingress at runtime; a holder of a remote binding's\ncredentials is bounded by no port condition, which is why a remote sandbox declares none.")),
-	"privateBaseImage": z$2.string().describe("Private ECR base image an AWS build pulls; `code.image` names only the S3 bundle, so this is\nwhat the cross-account grant opens. Live only: the grant needs the customer account,\nwhich registration reports. Absent means the base image is pulled anonymously.").nullish()
+	"privateBaseImage": z$2.string().describe("Private ECR base image an AWS build pulls; `code.image` names only the S3 bundle, so this is\nwhat the cross-account grant opens. Live only: the grant needs the customer account,\nwhich registration reports. Absent means the base image is pulled anonymously.").nullish(),
+	get "privilegedSupervisor"() {
+		return z$2.union([SandboxPrivilegedSupervisorSchema, z$2.null()]).optional();
+	}
 }).describe("An isolated environment for running untrusted code, created at runtime.");
 //#endregion
 //#region src/generated/zod/scheduled-event-schema.ts
@@ -7310,6 +7416,9 @@ const StackSettingsSchema = z$2.object({
 	get "domains"() {
 		return z$2.union([DomainSettingsSchema, z$2.null()]).optional();
 	},
+	get "endpointAccess"() {
+		return EndpointAccessSchema.describe("Reachability of the deployment's public endpoints, fixed at setup.").optional();
+	},
 	"externalBindings": z$2.object({}).describe("External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms.").nullish(),
 	get "heartbeats"() {
 		return HeartbeatsModeSchema.describe("How heartbeat health checks are handled.").optional();
@@ -7423,6 +7532,16 @@ const StackInputEnvironmentMappingSchema = z$2.object({
 	}
 }).describe("How a resolved stack input is injected into runtime environment variables.");
 //#endregion
+//#region src/generated/zod/stack-input-generate-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Asks Alien to generate a secret input\'s value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment\'s input values are first resolved, and then kept\nwith the deployment\'s other input values.
+*/
+const StackInputGenerateSchema = z$2.object({ "length": z$2.int().min(0).describe("Number of characters to generate.") }).describe("Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values.");
+//#endregion
 //#region src/generated/zod/stack-input-kind-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -7487,6 +7606,9 @@ const StackInputDefinitionSchema = z$2.object({
 	get "env"() {
 		return z$2.array(StackInputEnvironmentMappingSchema.describe("How a resolved stack input is injected into runtime environment variables.")).describe("Runtime env-var mappings for v1 input resolution.").optional();
 	},
+	get "generate"() {
+		return z$2.union([StackInputGenerateSchema, z$2.null()]).optional();
+	},
 	"id": z$2.string().describe("Stable input ID used by CLI/API calls."),
 	get "kind"() {
 		return StackInputKindSchema.describe("Primitive stack input kind.");
@@ -8973,6 +9095,23 @@ var Container = class extends ResourceBuilder {
 		return this;
 	}
 	/**
+	* Makes an HTTP port reachable from your control plane through the manager.
+	*
+	* Requests to `https://<manager>/v1/deployments/<deployment>/tunnels/<container>/...`
+	* are forwarded to this port over the Operator's outbound connection. Nothing
+	* is exposed on the deployment's network, and the environment needs no
+	* inbound access. Available on Kubernetes deployments.
+	*
+	* @param port Port that serves HTTP. Added to the container's ports if missing.
+	* @returns The Container builder instance.
+	*/
+	tunnel(port) {
+		if (!this._config.ports) this._config.ports = [];
+		if (!this._config.ports.some((p) => p.port === port)) this._config.ports.push({ port });
+		this._config.tunnel = { port };
+		return this;
+	}
+	/**
 	* Sets environment variables for the container.
 	* @param vars Key-value pairs of environment variables.
 	* @returns The Container builder instance.
@@ -9493,6 +9632,10 @@ function getResourceOutputs(params) {
 }
 //#endregion
 //#region src/input.ts
+/** Shortest value Alien generates for a secret input. */
+const STACK_INPUT_GENERATE_MIN_LENGTH = 16;
+/** Longest value Alien generates for a secret input. */
+const STACK_INPUT_GENERATE_MAX_LENGTH = 256;
 const stackInputDraftSymbol = Symbol("alien.stackInputDraft");
 const stackInputDefinitionsSymbol = Symbol("alien.stackInputDefinitions");
 function inputs(drafts) {
@@ -9516,6 +9659,7 @@ function inputs(drafts) {
 			default: toDefaultValue(draft.kind, draft.options.default),
 			platforms: draft.options.platforms ? [...draft.options.platforms] : void 0,
 			validation: Object.keys(draft.validation).length > 0 ? draft.validation : void 0,
+			generate: draft.generate ? { length: draft.generate.length } : void 0,
 			env: normalizeEnv(draft.options.env)
 		});
 	}
@@ -9529,12 +9673,21 @@ function getStackInputDefinitions(value) {
 	if (Array.isArray(value)) return [...value];
 	return [...value[stackInputDefinitionsSymbol]];
 }
-function defineInput(kind, options, validation = {}) {
+/**
+* Whether the deployer may provide this secret input, which makes it
+* vault-native: its value lives only in the deployer's own secret store. When
+* the developer may also provide it, a developer value keeps the regular path.
+*/
+function isDeployerSecretInput(input) {
+	return input.kind === "secret" && input.providedBy.includes("deployer");
+}
+function defineInput(kind, options, validation = {}, generate) {
 	return {
 		[stackInputDraftSymbol]: true,
 		kind,
 		options,
-		validation
+		validation,
+		generate
 	};
 }
 function defineStringInput(options) {
@@ -9551,7 +9704,7 @@ function defineSecretInput(options) {
 		maxLength: options.maxLength,
 		pattern: options.pattern,
 		format: options.format
-	});
+	}, options.generate);
 }
 function defineNumberInput(options) {
 	return defineInput("number", options, {
@@ -9624,11 +9777,24 @@ function validateDraft(id, draft) {
 	if (!draft.options.label.trim()) throw new Error(`Stack input '${id}' must include a label`);
 	if (draft.options.required && !draft.options.description.trim()) throw new Error(`Stack input '${id}' must include a description when required is true`);
 	validateValidation(id, draft.kind, draft.validation);
+	if (draft.generate !== void 0) validateGenerate(id, draft);
 	for (const mapping of normalizeEnv(draft.options.env)) {
 		validateEnvName(id, mapping.name);
 		if (mapping.targetResources?.length === 0) throw new Error(`Stack input '${id}' env mapping '${mapping.name}' cannot use an empty targetResources list`);
 	}
 }
+function validateGenerate(id, draft) {
+	const length = draft.generate?.length;
+	if (draft.kind !== "secret") throw new Error(`Stack input '${id}' generate is only supported on secret inputs`);
+	if (draft.options.default !== void 0) throw new Error(`Stack input '${id}' generate cannot be combined with a default`);
+	const providedBy = normalizeArray(draft.options.providedBy);
+	if (providedBy.length !== 1 || providedBy[0] !== "developer") throw new Error(`Stack input '${id}' generated inputs must be providedBy "developer" only; Alien supplies the value, so the deployer is never asked for it`);
+	if (length === void 0 || !Number.isInteger(length) || length < 16 || length > 256) throw new Error(`Stack input '${id}' generate.length must be an integer between 16 and 256`);
+	if (draft.validation.pattern !== void 0 || draft.validation.format !== void 0) throw new Error(`Stack input '${id}' generate cannot be combined with pattern or format; generated values are alphanumeric`);
+	const minLength = draft.validation.minLength ?? void 0;
+	const maxLength = draft.validation.maxLength ?? void 0;
+	if (minLength !== void 0 && length < minLength || maxLength !== void 0 && length > maxLength) throw new Error(`Stack input '${id}' generate.length ${length} is outside the input's minLength/maxLength`);
+}
 function validateInputId(id) {
 	if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(id)) throw new Error(`Stack input '${id}' id must start with a letter or underscore and contain only letters, digits, and underscores`);
 	if (!/[a-z]/.test(id)) throw new Error(`Stack input '${id}' id must not be all-caps env-var style`);
@@ -9889,8 +10055,7 @@ var Queue = class extends ResourceBuilder {
 *
 * Capabilities are not uniform. Call `capabilities()` on the binding and branch, or handle the
 * typed error — an unsupported capability never silently succeeds. Notably GCP cannot
-* reconnect to a sandbox (its id is scoped to one Cloud Run instance), only Azure
-* restricts egress to a hostname allowlist, no platform can snapshot a sandbox, and only AWS
+* reconnect to a sandbox (its id is scoped to one Cloud Run instance), Azure matches egress hostnames and AWS can pin their IPv4 addresses with privilegedSupervisor, no platform can snapshot a sandbox, and only AWS
 * and Local run a command under a different identity than the process supervising it. Elsewhere the
 * command shares the supervisor's user, so it can read the supervisor's environment and
 * signal it, and the container is the isolation boundary.
@@ -9937,6 +10102,11 @@ var Sandbox = class extends ResourceBuilder {
 		this._config.egress = egress;
 		return this;
 	}
+	/** Fixes the unprivileged command identity and lets Alien's supervisor enforce egress. */
+	privilegedSupervisor(supervisor) {
+		this._config.privilegedSupervisor = supervisor;
+		return this;
+	}
 	/**
 	* Sets the sandbox lifetime ceiling and idle behaviour.
 	*/
@@ -10589,6 +10759,6 @@ function validateOcu(field, value, allowZero) {
 //#region src/index.ts
 const experimental = { AwsOpenSearch };
 //#endregion
-export { AI, AgentStatusSchema, AiSchema as AiConfigSchema, AlienError, AlienErrorSchema as AlienErrorOptionsSchema, AlienEventSchema, ArtifactRegistry, ArtifactRegistrySchema as ArtifactRegistryConfigSchema, ArtifactRegistryHeartbeatDataSchema, ArtifactRegistryHeartbeatStatusSchema, AwsArtifactRegistryImportDataSchema, AwsBuildImportDataSchema, AwsCodeBuildHeartbeatDataSchema, AwsComputeClusterHeartbeatDataSchema, AwsComputeClusterImportDataSchema, AwsDynamoDbKeySchemaElementSchema, AwsDynamoDbKvHeartbeatDataSchema, AwsEcrArtifactRegistryHeartbeatDataSchema, AwsEcrRepositoryHeartbeatDataSchema, AwsIamRoleServiceAccountHeartbeatDataSchema, AwsKvImportDataSchema, AwsLambdaWorkerHeartbeatDataSchema, AwsNetworkImportDataSchema, AwsParameterStoreVaultHeartbeatDataSchema, AwsQueueImportDataSchema, AwsRemoteStackManagementHeartbeatDataSchema, AwsRemoteStackManagementImportDataSchema, AwsS3StorageHeartbeatDataSchema, AwsServiceAccountImportDataSchema, AwsSqsQueueHeartbeatDataSchema, AwsStorageImportDataSchema, AwsVaultImportDataSchema, AwsVpcNetworkHeartbeatDataSchema, AwsWorkerImportDataSchema, AzureArtifactRegistryImportDataSchema, AzureBlobStorageHeartbeatDataSchema, AzureBuildImportDataSchema, AzureComputeClusterHeartbeatDataSchema, AzureComputeClusterImportDataSchema, AzureContainerAppsBuildHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatStatusSchema, AzureContainerAppsEnvironmentImportDataSchema, AzureContainerAppsEnvironmentWorkloadProfileSchema, AzureContainerAppsWorkerHeartbeatDataSchema, AzureContainerRegistryHeartbeatDataSchema, AzureKeyVaultHeartbeatDataSchema, AzureKvImportDataSchema, AzureManagedIdentityServiceAccountHeartbeatDataSchema, AzureNetworkImportDataSchema, AzureQueueImportDataSchema, AzureRemoteStackManagementHeartbeatDataSchema, AzureRemoteStackManagementImportDataSchema, AzureResourceGroupHeartbeatDataSchema, AzureResourceGroupHeartbeatStatusSchema, AzureResourceGroupImportDataSchema, AzureResourceProviderActivationHeartbeatDataSchema, AzureServiceAccountImportDataSchema, AzureServiceActivationImportDataSchema, AzureServiceBusNamespaceHeartbeatDataSchema, AzureServiceBusNamespaceImportDataSchema, AzureServiceBusQueueHeartbeatDataSchema, AzureStorageAccountEndpointsSchema, AzureStorageAccountHeartbeatDataSchema, AzureStorageAccountImportDataSchema, AzureStorageImportDataSchema, AzureTableKvHeartbeatDataSchema, AzureVaultImportDataSchema, AzureVnetNetworkHeartbeatDataSchema, AzureWorkerImportDataSchema, BindingNotFoundError, BodySpecSchema, Build, BuildConfigSchema, BuildHeartbeatDataSchema, BuildHeartbeatStatusSchema, BuildOutputsSchema, BuildStatusSchema, CapacityGroupScalePolicySchema, CapacityGroupSchema, CommandDeliveryModeSchema, CommandResponseSchema, CommandStateSchema, CommandStatusResponseSchema, CommandTargetSchema, CommandTargetTypeSchema, ComputeCapacityGroupStatusSchema, ComputeCapacityRecommendationSchema, ComputeChoiceRangeSchema, ComputeCluster, ComputeClusterSchema as ComputeClusterConfigSchema, ComputeClusterHeartbeatDataSchema, ComputeClusterHeartbeatStatusSchema, ComputePoolSelectionSchema, ComputeSettingsSchema, ComputeTypeSchema, Container, ContainerAutoscalingSchema, ContainerCodeSchema, ContainerSchema as ContainerConfigSchema, ContainerHeartbeatDataSchema, ContainerImageIdentitySchema, ContainerPortSchema, CreateCommandRequestSchema, CreateCommandResponseSchema, Daemon, DaemonCodeSchema, DaemonSchema as DaemonConfigSchema, DaemonHeartbeatDataSchema, DaemonOutputsSchema, DeploymentModelSchema, DevResourceInfoSchema, DevStatusSchema, DevStatusStateSchema, Email, EmailSchema as EmailConfigSchema, EnvelopeSchema, EventChangeSchema, EventStateSchema, ExposeProtocolSchema, FailureDomainSelectionSchema, GcpArtifactRegistryHeartbeatDataSchema, GcpArtifactRegistryImportDataSchema, GcpBuildImportDataSchema, GcpCloudBuildHeartbeatDataSchema, GcpCloudRunWorkerHeartbeatDataSchema, GcpCloudStorageHeartbeatDataSchema, GcpComputeClusterHeartbeatDataSchema, GcpComputeClusterImportDataSchema, GcpFirestoreKvHeartbeatDataSchema, GcpKvImportDataSchema, GcpNetworkImportDataSchema, GcpPubSubQueueHeartbeatDataSchema, GcpQueueImportDataSchema, GcpRemoteStackManagementHeartbeatDataSchema, GcpRemoteStackManagementImportDataSchema, GcpSecretManagerVaultHeartbeatDataSchema, GcpServiceAccountHeartbeatDataSchema, GcpServiceAccountImportDataSchema, GcpServiceActivationImportDataSchema, GcpServiceUsageActivationHeartbeatDataSchema, GcpStorageImportDataSchema, GcpVaultImportDataSchema, GcpVpcNetworkHeartbeatDataSchema, GcpWorkerImportDataSchema, HeartbeatBackendSchema, HeartbeatIssueSeveritySchema, HeartbeatsModeSchema, HorizonContainerHeartbeatDataSchema, HttpMethodSchema, InvalidBindingConfigError, Key, KeySchema as KeyConfigSchema, KubernetesBuildHeartbeatDataSchema, KubernetesClusterNodeStatusSchema, KubernetesContainerHeartbeatDataSchema, KubernetesDaemonHeartbeatDataSchema, KubernetesEventInvolvedObjectSchema, KubernetesEventSnapshotSchema, KubernetesEventSourceSchema, KubernetesNodeConditionStatusSchema, KubernetesNodeResourcesSchema, KubernetesNodeUsageSchema, KubernetesPodRuntimeUnitStatusSchema, KubernetesSecretVaultHeartbeatDataSchema, KubernetesWorkerHeartbeatDataSchema, Kv, KvSchema as KvConfigSchema, KvHeartbeatDataSchema, KvHeartbeatStatusSchema, LeaseInfoSchema, LeaseRequestSchema, LeaseResponseSchema, LocalArtifactRegistryHeartbeatDataSchema, LocalComputeClusterHeartbeatDataSchema, LocalContainerHeartbeatDataSchema, LocalDaemonHeartbeatDataSchema, LocalKvHeartbeatDataSchema, LocalQueueHeartbeatDataSchema, LocalRuntimeEventSnapshotSchema, LocalRuntimeEventSubjectSchema, LocalRuntimeUnitKindSchema, LocalRuntimeUnitStatusSchema, LocalServiceAccountHeartbeatDataSchema, LocalStorageHeartbeatDataSchema, LocalVaultHeartbeatDataSchema, LocalWorkerHeartbeatDataSchema, MachineProfileSchema, ManagedRuntimeEventInvolvedObjectSchema, ManagedRuntimeEventSnapshotSchema, ManagedRuntimeEventSourceSchema, ManagedRuntimeUnitStatusSchema, MessagePayloadSchema, MetricSampleSchema, NetworkHeartbeatDataSchema, NetworkHeartbeatStatusSchema, ObservedApplicationImageSchema, ObservedApplicationReportSchema, ObservedApplicationSourceSchema, ObservedCountsSchema, ObservedHealthSchema, ObservedInventoryBatchSchema, ObservedResourceSampleSchema, OperatorImageReportSchema, OperatorImageSourceSchema, PermissionSetSchema, PlatformSchema, Postgres, PostgresSchema as PostgresConfigSchema, PresignedRequestBackendSchema, PresignedRequestSchema, ProviderFleetStatusSchema, ProviderLifecycleStateSchema, PublicEndpointSchema, PublicEndpointTargetSettingsSchema, Queue, QueueSchema as QueueConfigSchema, QueueHeartbeatDataSchema, QueueHeartbeatStatusSchema, QueueMessageSchema, ReadinessProbeSchema, ReleaseRequestSchema, RemoteStackManagementHeartbeatDataSchema, RemoteStackManagementHeartbeatStatusSchema, Resource, ResourceHeartbeatDataSchema, ResourceHeartbeatSchema, ResourceLifecycleSchema, ResourceNotFoundError, ResourceOutputsParseError, ResourceRefSchema, ResourceSchemaMapping, ResourceStatusSchema, ResourceTypeSchema, ResponseHandlingSchema, Sandbox, SandboxSchema as SandboxConfigSchema, ScheduledEventSchema, ServiceAccount, ServiceAccountSchema as ServiceAccountConfigSchema, ServiceAccountHeartbeatDataSchema, ServiceAccountHeartbeatStatusSchema, ServiceAccountOutputsSchema, ServiceActivationHeartbeatDataSchema, ServiceActivationHeartbeatStatusSchema, Stack, StackInputDefaultValueSchema, StackInputDefinitionSchema, StackInputEnvironmentMappingSchema, StackInputEnvironmentVariableTypeSchema, StackInputKindSchema, StackInputProviderSchema, StackInputValidationSchema, StackResourceStateSchema, StackSchema, StackSettingsSchema, StackStateSchema, StackStatusSchema, Storage, StorageSchema as StorageConfigSchema, StorageEventSchema, StorageEventTypeSchema, StorageEventsSchema, StorageHeartbeatDataSchema, StorageHeartbeatStatusSchema, StorageUploadSchema, SubmitResponseRequestSchema, TelemetryModeSchema, TraceContextSchema, UnexpectedResourceTypeError, UpdatesModeSchema, UploadCompleteRequestSchema, UploadCompleteResponseSchema, Vault, VaultSchema as VaultConfigSchema, VaultHeartbeatDataSchema, VaultHeartbeatStatusSchema, Worker, WorkerSchema as WorkerConfigSchema, WorkerHeartbeatDataSchema, WorkerOutputsSchema, WorkerPublicEndpointSchema, WorkerTriggerSchema, WorkloadHeartbeatStatusSchema, WorkloadReplicaStatusSchema, defineBooleanInput as boolean, defineError, defineEnumInput as enum, experimental, getResourceOutputs, getStackInputDefinitions, inputs, defineIntegerInput as integer, defineNumberInput as number, defineSecretInput as secret, defineStringInput as string, defineStringListInput as stringList };
+export { AI, AgentStatusSchema, AiSchema as AiConfigSchema, AlienError, AlienErrorSchema as AlienErrorOptionsSchema, AlienEventSchema, ArtifactRegistry, ArtifactRegistrySchema as ArtifactRegistryConfigSchema, ArtifactRegistryHeartbeatDataSchema, ArtifactRegistryHeartbeatStatusSchema, AwsArtifactRegistryImportDataSchema, AwsBuildImportDataSchema, AwsCodeBuildHeartbeatDataSchema, AwsComputeClusterHeartbeatDataSchema, AwsComputeClusterImportDataSchema, AwsDynamoDbKeySchemaElementSchema, AwsDynamoDbKvHeartbeatDataSchema, AwsEcrArtifactRegistryHeartbeatDataSchema, AwsEcrRepositoryHeartbeatDataSchema, AwsIamRoleServiceAccountHeartbeatDataSchema, AwsKvImportDataSchema, AwsLambdaWorkerHeartbeatDataSchema, AwsNetworkImportDataSchema, AwsParameterStoreVaultHeartbeatDataSchema, AwsQueueImportDataSchema, AwsRemoteStackManagementHeartbeatDataSchema, AwsRemoteStackManagementImportDataSchema, AwsS3StorageHeartbeatDataSchema, AwsServiceAccountImportDataSchema, AwsSqsQueueHeartbeatDataSchema, AwsStorageImportDataSchema, AwsVaultImportDataSchema, AwsVpcNetworkHeartbeatDataSchema, AwsWorkerImportDataSchema, AzureArtifactRegistryImportDataSchema, AzureBlobStorageHeartbeatDataSchema, AzureBuildImportDataSchema, AzureComputeClusterHeartbeatDataSchema, AzureComputeClusterImportDataSchema, AzureContainerAppsBuildHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatStatusSchema, AzureContainerAppsEnvironmentImportDataSchema, AzureContainerAppsEnvironmentWorkloadProfileSchema, AzureContainerAppsWorkerHeartbeatDataSchema, AzureContainerRegistryHeartbeatDataSchema, AzureKeyVaultHeartbeatDataSchema, AzureKvImportDataSchema, AzureManagedIdentityServiceAccountHeartbeatDataSchema, AzureNetworkImportDataSchema, AzureQueueImportDataSchema, AzureRemoteStackManagementHeartbeatDataSchema, AzureRemoteStackManagementImportDataSchema, AzureResourceGroupHeartbeatDataSchema, AzureResourceGroupHeartbeatStatusSchema, AzureResourceGroupImportDataSchema, AzureResourceProviderActivationHeartbeatDataSchema, AzureServiceAccountImportDataSchema, AzureServiceActivationImportDataSchema, AzureServiceBusNamespaceHeartbeatDataSchema, AzureServiceBusNamespaceImportDataSchema, AzureServiceBusQueueHeartbeatDataSchema, AzureStorageAccountEndpointsSchema, AzureStorageAccountHeartbeatDataSchema, AzureStorageAccountImportDataSchema, AzureStorageImportDataSchema, AzureTableKvHeartbeatDataSchema, AzureVaultImportDataSchema, AzureVnetNetworkHeartbeatDataSchema, AzureWorkerImportDataSchema, BindingNotFoundError, BodySpecSchema, Build, BuildConfigSchema, BuildHeartbeatDataSchema, BuildHeartbeatStatusSchema, BuildOutputsSchema, BuildStatusSchema, CapacityGroupScalePolicySchema, CapacityGroupSchema, CommandDeliveryModeSchema, CommandResponseSchema, CommandStateSchema, CommandStatusResponseSchema, CommandTargetSchema, CommandTargetTypeSchema, ComputeCapacityGroupStatusSchema, ComputeCapacityRecommendationSchema, ComputeChoiceRangeSchema, ComputeCluster, ComputeClusterSchema as ComputeClusterConfigSchema, ComputeClusterHeartbeatDataSchema, ComputeClusterHeartbeatStatusSchema, ComputePoolSelectionSchema, ComputeSettingsSchema, ComputeTypeSchema, Container, ContainerAutoscalingSchema, ContainerCodeSchema, ContainerSchema as ContainerConfigSchema, ContainerHeartbeatDataSchema, ContainerImageIdentitySchema, ContainerPortSchema, CreateCommandRequestSchema, CreateCommandResponseSchema, Daemon, DaemonCodeSchema, DaemonSchema as DaemonConfigSchema, DaemonHeartbeatDataSchema, DaemonOutputsSchema, DeployerSecretLocationSchema, DeployerSecretReportSchema, DeployerSecretStatusSchema, DeployerSecretStoreSchema, DeploymentModelSchema, DevResourceInfoSchema, DevStatusSchema, DevStatusStateSchema, Email, EmailSchema as EmailConfigSchema, EndpointAccessSchema, EnvelopeSchema, EventChangeSchema, EventStateSchema, ExposeProtocolSchema, FailureDomainSelectionSchema, GcpArtifactRegistryHeartbeatDataSchema, GcpArtifactRegistryImportDataSchema, GcpBuildImportDataSchema, GcpCloudBuildHeartbeatDataSchema, GcpCloudRunWorkerHeartbeatDataSchema, GcpCloudStorageHeartbeatDataSchema, GcpComputeClusterHeartbeatDataSchema, GcpComputeClusterImportDataSchema, GcpFirestoreKvHeartbeatDataSchema, GcpKvImportDataSchema, GcpNetworkImportDataSchema, GcpPubSubQueueHeartbeatDataSchema, GcpQueueImportDataSchema, GcpRemoteStackManagementHeartbeatDataSchema, GcpRemoteStackManagementImportDataSchema, GcpSecretManagerVaultHeartbeatDataSchema, GcpServiceAccountHeartbeatDataSchema, GcpServiceAccountImportDataSchema, GcpServiceActivationImportDataSchema, GcpServiceUsageActivationHeartbeatDataSchema, GcpStorageImportDataSchema, GcpVaultImportDataSchema, GcpVpcNetworkHeartbeatDataSchema, GcpWorkerImportDataSchema, HeartbeatBackendSchema, HeartbeatIssueSeveritySchema, HeartbeatsModeSchema, HorizonContainerHeartbeatDataSchema, HttpMethodSchema, InvalidBindingConfigError, Key, KeySchema as KeyConfigSchema, KubernetesBuildHeartbeatDataSchema, KubernetesClusterNodeStatusSchema, KubernetesContainerHeartbeatDataSchema, KubernetesDaemonHeartbeatDataSchema, KubernetesEventInvolvedObjectSchema, KubernetesEventSnapshotSchema, KubernetesEventSourceSchema, KubernetesNodeConditionStatusSchema, KubernetesNodeResourcesSchema, KubernetesNodeUsageSchema, KubernetesPodRuntimeUnitStatusSchema, KubernetesSecretVaultHeartbeatDataSchema, KubernetesWorkerHeartbeatDataSchema, Kv, KvSchema as KvConfigSchema, KvHeartbeatDataSchema, KvHeartbeatStatusSchema, LeaseInfoSchema, LeaseRequestSchema, LeaseResponseSchema, LocalArtifactRegistryHeartbeatDataSchema, LocalComputeClusterHeartbeatDataSchema, LocalContainerHeartbeatDataSchema, LocalDaemonHeartbeatDataSchema, LocalKvHeartbeatDataSchema, LocalQueueHeartbeatDataSchema, LocalRuntimeEventSnapshotSchema, LocalRuntimeEventSubjectSchema, LocalRuntimeUnitKindSchema, LocalRuntimeUnitStatusSchema, LocalServiceAccountHeartbeatDataSchema, LocalStorageHeartbeatDataSchema, LocalVaultHeartbeatDataSchema, LocalWorkerHeartbeatDataSchema, MachineProfileSchema, ManagedRuntimeEventInvolvedObjectSchema, ManagedRuntimeEventSnapshotSchema, ManagedRuntimeEventSourceSchema, ManagedRuntimeUnitStatusSchema, MessagePayloadSchema, MetricSampleSchema, NetworkHeartbeatDataSchema, NetworkHeartbeatStatusSchema, ObservedApplicationImageSchema, ObservedApplicationReportSchema, ObservedApplicationSourceSchema, ObservedCountsSchema, ObservedHealthSchema, ObservedInventoryBatchSchema, ObservedResourceSampleSchema, OperatorImageReportSchema, OperatorImageSourceSchema, PermissionSetSchema, PlatformSchema, Postgres, PostgresSchema as PostgresConfigSchema, PresignedRequestBackendSchema, PresignedRequestSchema, ProviderFleetStatusSchema, ProviderLifecycleStateSchema, PublicEndpointSchema, PublicEndpointTargetSettingsSchema, Queue, QueueSchema as QueueConfigSchema, QueueHeartbeatDataSchema, QueueHeartbeatStatusSchema, QueueMessageSchema, ReadinessProbeSchema, ReleaseRequestSchema, RemoteStackManagementHeartbeatDataSchema, RemoteStackManagementHeartbeatStatusSchema, Resource, ResourceHeartbeatDataSchema, ResourceHeartbeatSchema, ResourceLifecycleSchema, ResourceNotFoundError, ResourceOutputsParseError, ResourceRefSchema, ResourceSchemaMapping, ResourceStatusSchema, ResourceTypeSchema, ResponseHandlingSchema, STACK_INPUT_GENERATE_MAX_LENGTH, STACK_INPUT_GENERATE_MIN_LENGTH, Sandbox, SandboxSchema as SandboxConfigSchema, ScheduledEventSchema, ServiceAccount, ServiceAccountSchema as ServiceAccountConfigSchema, ServiceAccountHeartbeatDataSchema, ServiceAccountHeartbeatStatusSchema, ServiceAccountOutputsSchema, ServiceActivationHeartbeatDataSchema, ServiceActivationHeartbeatStatusSchema, Stack, StackInputDefaultValueSchema, StackInputDefinitionSchema, StackInputEnvironmentMappingSchema, StackInputEnvironmentVariableTypeSchema, StackInputKindSchema, StackInputProviderSchema, StackInputValidationSchema, StackResourceStateSchema, StackSchema, StackSettingsSchema, StackStateSchema, StackStatusSchema, Storage, StorageSchema as StorageConfigSchema, StorageEventSchema, StorageEventTypeSchema, StorageEventsSchema, StorageHeartbeatDataSchema, StorageHeartbeatStatusSchema, StorageUploadSchema, SubmitResponseRequestSchema, TelemetryModeSchema, TraceContextSchema, UnexpectedResourceTypeError, UpdatesModeSchema, UploadCompleteRequestSchema, UploadCompleteResponseSchema, Vault, VaultSchema as VaultConfigSchema, VaultHeartbeatDataSchema, VaultHeartbeatStatusSchema, Worker, WorkerSchema as WorkerConfigSchema, WorkerHeartbeatDataSchema, WorkerOutputsSchema, WorkerPublicEndpointSchema, WorkerTriggerSchema, WorkloadHeartbeatStatusSchema, WorkloadReplicaStatusSchema, defineBooleanInput as boolean, defineError, defineEnumInput as enum, experimental, getResourceOutputs, getStackInputDefinitions, inputs, defineIntegerInput as integer, isDeployerSecretInput, defineNumberInput as number, defineSecretInput as secret, defineStringInput as string, defineStringListInput as stringList };
 
 //# sourceMappingURL=index.js.map