@alienplatform/manager-api 1.14.0 → 1.15.0-dev.e74fae6cd01b61e77a285276f264b5480977f41a

package/src/models/index.ts

@@ -10,16 +10,21 @@ export * from "./agentsyncresponse.js";
 export * from "./alienerror.js";
 export * from "./artifactregistryheartbeatdata.js";
 export * from "./artifactregistryheartbeatstatus.js";
+export * from "./awscredentials.js";
 export * from "./awscustomcertificateconfig.js";
 export * from "./awsdynamodbkeyschemaelement.js";
 export * from "./awsecrrepositoryheartbeatdata.js";
+export * from "./awsserviceoverrides.js";
+export * from "./awswebidentityconfig.js";
 export * from "./azurecontainerappsenvironmentheartbeatdata.js";
 export * from "./azurecontainerappsenvironmentheartbeatstatus.js";
 export * from "./azurecontainerappsenvironmentworkloadprofile.js";
+export * from "./azurecredentials.js";
 export * from "./azurecustomcertificateconfig.js";
 export * from "./azureresourcegroupheartbeatdata.js";
 export * from "./azureresourcegroupheartbeatstatus.js";
 export * from "./azureservicebusnamespaceheartbeatdata.js";
+export * from "./azureserviceoverrides.js";
 export * from "./azurestorageaccountendpoints.js";
 export * from "./azurestorageaccountheartbeatdata.js";
 export * from "./baseresource.js";
@@ -27,11 +32,14 @@ export * from "./baseresourceoutputs.js";
 export * from "./bodyspec.js";
 export * from "./buildheartbeatdata.js";
 export * from "./buildheartbeatstatus.js";
+export * from "./clientconfigunion.js";
 export * from "./commandpayloadresponse.js";
 export * from "./commandresponse.js";
 export * from "./commandsinfo.js";
 export * from "./commandstate.js";
 export * from "./commandstatusresponse.js";
+export * from "./commandtarget.js";
+export * from "./commandtargettype.js";
 export * from "./computecapacityblocker.js";
 export * from "./computecapacityblockercategory.js";
 export * from "./computecapacitygroupstatus.js";
@@ -65,7 +73,10 @@ export * from "./domainsettings.js";
 export * from "./envelope.js";
 export * from "./environmentvariable.js";
 export * from "./environmentvariabletype.js";
+export * from "./gcpcredentials.js";
 export * from "./gcpcustomcertificateconfig.js";
+export * from "./gcpimpersonationconfig.js";
+export * from "./gcpserviceoverrides.js";
 export * from "./gitmetadata.js";
 export * from "./gitmetadataresponse.js";
 export * from "./healthresponse.js";
@@ -81,6 +92,7 @@ export * from "./initialdesiredrelease.js";
 export * from "./initializerequest.js";
 export * from "./initializeresponse.js";
 export * from "./kubernetescertificatemode.js";
+export * from "./kubernetesclientconfig.js";
 export * from "./kubernetescloudreference.js";
 export * from "./kubernetesclusterheartbeatdata.js";
 export * from "./kubernetesclusternodestatus.js";
@@ -124,6 +136,8 @@ export * from "./managedruntimeunitstatus.js";
 export * from "./managementconfig.js";
 export * from "./metricsample.js";
 export * from "./metricunit.js";
+export * from "./mintcredentialsrequest.js";
+export * from "./mintcredentialsresponse.js";
 export * from "./networkheartbeatdata.js";
 export * from "./networkheartbeatstatus.js";
 export * from "./networksettings.js";
@@ -178,6 +192,7 @@ export * from "./storageheartbeatstatus.js";
 export * from "./storageupload.js";
 export * from "./storepayloadrequest.js";
 export * from "./telemetrymode.js";
+export * from "./tracecontext.js";
 export * from "./updatesmode.js";
 export * from "./uploadcompleterequest.js";
 export * from "./uploadcompleteresponse.js";

package/src/models/kubernetesclientconfig.ts

@@ -0,0 +1,220 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v4";
+import { remap as remap$ } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+import { Result as SafeParseResult } from "../types/fp.js";
+import { SDKValidationError } from "./errors/sdkvalidationerror.js";
+
+/**
+ * Manual configuration with explicit values
+ */
+export type KubernetesClientConfigManual = {
+  /**
+   * Additional headers to include in requests
+   */
+  additionalHeaders: { [k: string]: string };
+  /**
+   * The cluster certificate authority data (base64 encoded)
+   */
+  certificateAuthorityData?: string | null | undefined;
+  /**
+   * Client certificate data (base64 encoded) for mutual TLS
+   */
+  clientCertificateData?: string | null | undefined;
+  /**
+   * Client key data (base64 encoded) for mutual TLS
+   */
+  clientKeyData?: string | null | undefined;
+  /**
+   * Skip TLS verification (insecure)
+   */
+  insecureSkipTlsVerify?: boolean | null | undefined;
+  mode: "manual";
+  /**
+   * The namespace to operate in
+   */
+  namespace?: string | null | undefined;
+  /**
+   * Password for basic authentication
+   */
+  password?: string | null | undefined;
+  /**
+   * The Kubernetes cluster server URL
+   */
+  serverUrl: string;
+  /**
+   * Bearer token for authentication
+   */
+  token?: string | null | undefined;
+  /**
+   * Username for basic authentication
+   */
+  username?: string | null | undefined;
+};
+
+/**
+ * Use kubeconfig file for configuration
+ */
+export type KubernetesClientConfigKubeconfig = {
+  /**
+   * Additional headers to include in requests
+   */
+  additionalHeaders?: { [k: string]: string } | null | undefined;
+  /**
+   * Cluster name to use (optional, defaults to context's cluster)
+   */
+  cluster?: string | null | undefined;
+  /**
+   * Context name to use (optional, defaults to current-context)
+   */
+  context?: string | null | undefined;
+  /**
+   * Path to kubeconfig file (optional, defaults to standard locations)
+   */
+  kubeconfigPath?: string | null | undefined;
+  mode: "kubeconfig";
+  /**
+   * The namespace to operate in
+   */
+  namespace?: string | null | undefined;
+  /**
+   * User name to use (optional, defaults to context's user)
+   */
+  user?: string | null | undefined;
+};
+
+/**
+ * Use in-cluster configuration (service account tokens, etc.)
+ */
+export type KubernetesClientConfigInCluster = {
+  /**
+   * Additional headers to include in requests
+   */
+  additionalHeaders?: { [k: string]: string } | null | undefined;
+  mode: "inCluster";
+  /**
+   * The namespace to operate in
+   */
+  namespace?: string | null | undefined;
+};
+
+/**
+ * Configuration mode for Kubernetes access
+ */
+export type KubernetesClientConfig =
+  | KubernetesClientConfigInCluster
+  | KubernetesClientConfigKubeconfig
+  | KubernetesClientConfigManual;
+
+/** @internal */
+export const KubernetesClientConfigManual$inboundSchema: z.ZodType<
+  KubernetesClientConfigManual,
+  unknown
+> = z.object({
+  additional_headers: z.record(z.string(), z.string()),
+  certificate_authority_data: z.nullable(z.string()).optional(),
+  client_certificate_data: z.nullable(z.string()).optional(),
+  client_key_data: z.nullable(z.string()).optional(),
+  insecure_skip_tls_verify: z.nullable(z.boolean()).optional(),
+  mode: z.literal("manual"),
+  namespace: z.nullable(z.string()).optional(),
+  password: z.nullable(z.string()).optional(),
+  server_url: z.string(),
+  token: z.nullable(z.string()).optional(),
+  username: z.nullable(z.string()).optional(),
+}).transform((v) => {
+  return remap$(v, {
+    "additional_headers": "additionalHeaders",
+    "certificate_authority_data": "certificateAuthorityData",
+    "client_certificate_data": "clientCertificateData",
+    "client_key_data": "clientKeyData",
+    "insecure_skip_tls_verify": "insecureSkipTlsVerify",
+    "server_url": "serverUrl",
+  });
+});
+
+export function kubernetesClientConfigManualFromJSON(
+  jsonString: string,
+): SafeParseResult<KubernetesClientConfigManual, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => KubernetesClientConfigManual$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'KubernetesClientConfigManual' from JSON`,
+  );
+}
+
+/** @internal */
+export const KubernetesClientConfigKubeconfig$inboundSchema: z.ZodType<
+  KubernetesClientConfigKubeconfig,
+  unknown
+> = z.object({
+  additional_headers: z.nullable(z.record(z.string(), z.string())).optional(),
+  cluster: z.nullable(z.string()).optional(),
+  context: z.nullable(z.string()).optional(),
+  kubeconfig_path: z.nullable(z.string()).optional(),
+  mode: z.literal("kubeconfig"),
+  namespace: z.nullable(z.string()).optional(),
+  user: z.nullable(z.string()).optional(),
+}).transform((v) => {
+  return remap$(v, {
+    "additional_headers": "additionalHeaders",
+    "kubeconfig_path": "kubeconfigPath",
+  });
+});
+
+export function kubernetesClientConfigKubeconfigFromJSON(
+  jsonString: string,
+): SafeParseResult<KubernetesClientConfigKubeconfig, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => KubernetesClientConfigKubeconfig$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'KubernetesClientConfigKubeconfig' from JSON`,
+  );
+}
+
+/** @internal */
+export const KubernetesClientConfigInCluster$inboundSchema: z.ZodType<
+  KubernetesClientConfigInCluster,
+  unknown
+> = z.object({
+  additional_headers: z.nullable(z.record(z.string(), z.string())).optional(),
+  mode: z.literal("inCluster"),
+  namespace: z.nullable(z.string()).optional(),
+}).transform((v) => {
+  return remap$(v, {
+    "additional_headers": "additionalHeaders",
+  });
+});
+
+export function kubernetesClientConfigInClusterFromJSON(
+  jsonString: string,
+): SafeParseResult<KubernetesClientConfigInCluster, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => KubernetesClientConfigInCluster$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'KubernetesClientConfigInCluster' from JSON`,
+  );
+}
+
+/** @internal */
+export const KubernetesClientConfig$inboundSchema: z.ZodType<
+  KubernetesClientConfig,
+  unknown
+> = z.union([
+  z.lazy(() => KubernetesClientConfigInCluster$inboundSchema),
+  z.lazy(() => KubernetesClientConfigKubeconfig$inboundSchema),
+  z.lazy(() => KubernetesClientConfigManual$inboundSchema),
+]);
+
+export function kubernetesClientConfigFromJSON(
+  jsonString: string,
+): SafeParseResult<KubernetesClientConfig, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => KubernetesClientConfig$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'KubernetesClientConfig' from JSON`,
+  );
+}

package/src/models/leaserequest.ts

@@ -3,6 +3,11 @@
  */
 
 import * as z from "zod/v4";
+import {
+  CommandTarget,
+  CommandTarget$Outbound,
+  CommandTarget$outboundSchema,
+} from "./commandtarget.js";
 
 /**
  * Request for acquiring leases
@@ -20,6 +25,10 @@ export type LeaseRequest = {
    * Maximum number of leases to acquire
    */
   maxLeases?: number | undefined;
+  /**
+   * Identifies the specific resource a command is addressed to.
+   */
+  target: CommandTarget;
 };
 
 /** @internal */
@@ -27,6 +36,7 @@ export type LeaseRequest$Outbound = {
   deploymentId: string;
   leaseSeconds?: number | undefined;
   maxLeases?: number | undefined;
+  target: CommandTarget$Outbound;
 };
 
 /** @internal */
@@ -37,6 +47,7 @@ export const LeaseRequest$outboundSchema: z.ZodType<
   deploymentId: z.string(),
   leaseSeconds: z.int().optional(),
   maxLeases: z.int().optional(),
+  target: CommandTarget$outboundSchema,
 });
 
 export function leaseRequestToJSON(leaseRequest: LeaseRequest): string {

package/src/models/mintcredentialsrequest.ts

@@ -0,0 +1,70 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v4";
+
+/**
+ * Request body for `POST /v1/credentials/mint`.
+ *
+ * @remarks
+ *
+ * `deny_unknown_fields` so clients cannot smuggle in resolver internals
+ * (platform, stack state, etc.) — the server derives everything from the
+ * authenticated deployment.
+ */
+export type MintCredentialsRequest = {
+  /**
+   * Service-account binding to impersonate on the target platform.
+   */
+  bindingName: string;
+  /**
+   * Deployment to mint credentials for. The caller's bearer token must be
+   *
+   * @remarks
+   * this deployment's token (or a workspace-admin token).
+   */
+  deploymentId: string;
+  /**
+   * Requested lifetime in seconds. Clamped to
+   *
+   * @remarks
+   * `[MIN_DURATION_SECONDS, MAX_DURATION_SECONDS]`; defaults to
+   * `DEFAULT_DURATION_SECONDS` when omitted.
+   */
+  durationSeconds?: number | null | undefined;
+  /**
+   * Current-release compute resource requesting the credentials. The
+   *
+   * @remarks
+   * resource must depend on `bindingName` as a service-account resource.
+   */
+  resourceId: string;
+};
+
+/** @internal */
+export type MintCredentialsRequest$Outbound = {
+  bindingName: string;
+  deploymentId: string;
+  durationSeconds?: number | null | undefined;
+  resourceId: string;
+};
+
+/** @internal */
+export const MintCredentialsRequest$outboundSchema: z.ZodType<
+  MintCredentialsRequest$Outbound,
+  MintCredentialsRequest
+> = z.object({
+  bindingName: z.string(),
+  deploymentId: z.string(),
+  durationSeconds: z.nullable(z.int()).optional(),
+  resourceId: z.string(),
+});
+
+export function mintCredentialsRequestToJSON(
+  mintCredentialsRequest: MintCredentialsRequest,
+): string {
+  return JSON.stringify(
+    MintCredentialsRequest$outboundSchema.parse(mintCredentialsRequest),
+  );
+}

package/src/models/mintcredentialsresponse.ts

@@ -0,0 +1,62 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v4";
+import { safeParse } from "../lib/schemas.js";
+import { Result as SafeParseResult } from "../types/fp.js";
+import {
+  ClientConfigUnion,
+  ClientConfigUnion$inboundSchema,
+} from "./clientconfigunion.js";
+import { SDKValidationError } from "./errors/sdkvalidationerror.js";
+
+/**
+ * Response body for `POST /v1/credentials/mint`.
+ */
+export type MintCredentialsResponse = {
+  /**
+   * Configuration for different cloud platform clients
+   */
+  clientConfig: ClientConfigUnion;
+  /**
+   * Credential expiry as an RFC3339 timestamp (now + clamped duration).
+   *
+   * @remarks
+   *
+   * This is server-computed (`now + clamped duration`), not read back from
+   * the provider — for lazily-resolved configs (e.g. GCP, where the
+   * resolver doesn't always round-trip an authoritative expiry) it is
+   * nominal rather than provider truth. Treat it as a refresh hint: fetch
+   * new credentials at or before this time, don't rely on it to prove the
+   * underlying credential is still valid at that exact instant.
+   */
+  expiresAt: string;
+  /**
+   * Human-readable identity the credentials act as (role ARN, SA email,
+   *
+   * @remarks
+   * managed-identity client id, or `platform:account` for the local path).
+   */
+  principal: string;
+};
+
+/** @internal */
+export const MintCredentialsResponse$inboundSchema: z.ZodType<
+  MintCredentialsResponse,
+  unknown
+> = z.object({
+  clientConfig: ClientConfigUnion$inboundSchema,
+  expiresAt: z.string(),
+  principal: z.string(),
+});
+
+export function mintCredentialsResponseFromJSON(
+  jsonString: string,
+): SafeParseResult<MintCredentialsResponse, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => MintCredentialsResponse$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'MintCredentialsResponse' from JSON`,
+  );
+}

package/src/models/resolvecredentialsresponse.ts

@@ -5,10 +5,17 @@
 import * as z from "zod/v4";
 import { safeParse } from "../lib/schemas.js";
 import { Result as SafeParseResult } from "../types/fp.js";
+import {
+  ClientConfigUnion,
+  ClientConfigUnion$inboundSchema,
+} from "./clientconfigunion.js";
 import { SDKValidationError } from "./errors/sdkvalidationerror.js";
 
 export type ResolveCredentialsResponse = {
-  clientConfig: any;
+  /**
+   * Configuration for different cloud platform clients
+   */
+  clientConfig: ClientConfigUnion;
 };
 
 /** @internal */
@@ -16,7 +23,7 @@ export const ResolveCredentialsResponse$inboundSchema: z.ZodType<
   ResolveCredentialsResponse,
   unknown
 > = z.object({
-  clientConfig: z.any(),
+  clientConfig: ClientConfigUnion$inboundSchema,
 });
 
 export function resolveCredentialsResponseFromJSON(

package/src/models/resourceref.ts

@@ -8,10 +8,7 @@ import { Result as SafeParseResult } from "../types/fp.js";
 import { SDKValidationError } from "./errors/sdkvalidationerror.js";
 
 /**
- * New ResourceRef that works with any resource type.
- *
- * @remarks
- * This can eventually replace the enum-based ResourceRef for full extensibility.
+ * Reference to a resource by its stable id and resource type.
  */
 export type ResourceRef = {
   id: string;

package/src/models/tracecontext.ts

@@ -0,0 +1,44 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v4";
+import { safeParse } from "../lib/schemas.js";
+import { Result as SafeParseResult } from "../types/fp.js";
+import { SDKValidationError } from "./errors/sdkvalidationerror.js";
+
+/**
+ * W3C Trace Context propagated with a command lease.
+ *
+ * @remarks
+ *
+ * The values are kept in their standard wire form so receivers can attach
+ * them to handler telemetry without inventing separate trace/span fields.
+ */
+export type TraceContext = {
+  /**
+   * W3C `traceparent` header value.
+   */
+  traceparent: string;
+  /**
+   * Optional W3C `tracestate` header value.
+   */
+  tracestate?: string | null | undefined;
+};
+
+/** @internal */
+export const TraceContext$inboundSchema: z.ZodType<TraceContext, unknown> = z
+  .object({
+    traceparent: z.string(),
+    tracestate: z.nullable(z.string()).optional(),
+  });
+
+export function traceContextFromJSON(
+  jsonString: string,
+): SafeParseResult<TraceContext, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => TraceContext$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'TraceContext' from JSON`,
+  );
+}

package/src/sdk/credentials.ts

@@ -2,12 +2,24 @@
  * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
  */
 
+import { credentialsMintCredentials } from "../funcs/credentialsMintCredentials.js";
 import { credentialsResolveCredentials } from "../funcs/credentialsResolveCredentials.js";
 import { ClientSDK, RequestOptions } from "../lib/sdks.js";
 import * as models from "../models/index.js";
 import { unwrapAsync } from "../types/fp.js";
 
 export class Credentials extends ClientSDK {
+  async mintCredentials(
+    request: models.MintCredentialsRequest,
+    options?: RequestOptions,
+  ): Promise<models.MintCredentialsResponse> {
+    return unwrapAsync(credentialsMintCredentials(
+      this,
+      request,
+      options,
+    ));
+  }
+
   async resolveCredentials(
     request: models.ResolveCredentialsRequest,
     options?: RequestOptions,

package/src/sdk/sdk.ts

@@ -30,6 +30,11 @@ export class AlienManager extends ClientSDK {
     return (this._leases ??= new Leases(this._options));
   }
 
+  private _credentials?: Credentials;
+  get credentials(): Credentials {
+    return (this._credentials ??= new Credentials(this._options));
+  }
+
   private _deploymentGroups?: DeploymentGroups;
   get deploymentGroups(): DeploymentGroups {
     return (this._deploymentGroups ??= new DeploymentGroups(this._options));
@@ -50,11 +55,6 @@ export class AlienManager extends ClientSDK {
     return (this._releases ??= new Releases(this._options));
   }
 
-  private _credentials?: Credentials;
-  get credentials(): Credentials {
-    return (this._credentials ??= new Credentials(this._options));
-  }
-
   private _stackImport?: StackImport;
   get stackImport(): StackImport {
     return (this._stackImport ??= new StackImport(this._options));

package/src/types/async.ts

@@ -21,16 +21,17 @@ export type APICall =
 
 export class APIPromise<T> implements Promise<T> {
   readonly #promise: Promise<[T, APICall]>;
-  readonly #unwrapped: Promise<T>;
+  #unwrapped: Promise<T> | null;
 
   readonly [Symbol.toStringTag] = "APIPromise";
 
   constructor(p: [T, APICall] | Promise<[T, APICall]>) {
     this.#promise = p instanceof Promise ? p : Promise.resolve(p);
-    this.#unwrapped =
-      p instanceof Promise
-        ? this.#promise.then(([value]) => value)
-        : Promise.resolve(p[0]);
+    this.#unwrapped = p instanceof Promise ? null : Promise.resolve(p[0]);
+  }
+
+  #getUnwrapped(): Promise<T> {
+    return (this.#unwrapped ??= this.#promise.then(([value]) => value));
   }
 
   then<TResult1 = T, TResult2 = never>(
@@ -55,11 +56,11 @@ export class APIPromise<T> implements Promise<T> {
       | null
       | undefined,
   ): Promise<T | TResult> {
-    return this.#unwrapped.catch(onrejected);
+    return this.#getUnwrapped().catch(onrejected);
   }
 
   finally(onfinally?: (() => void) | null | undefined): Promise<T> {
-    return this.#unwrapped.finally(onfinally);
+    return this.#getUnwrapped().finally(onfinally);
   }
 
   $inspect(): Promise<[T, APICall]> {

package/.devcontainer/devcontainer.json

@@ -1,45 +0,0 @@
-// For format details, see https://aka.ms/devcontainer.json. For config options, see the
-// README at: https://github.com/devcontainers/images/tree/main/src/typescript-node
-{
-    "name": "TypeScript",
-    "image": "mcr.microsoft.com/devcontainers/typescript-node:1-20-bullseye",
-    // Features to add to the dev container. More info: https://containers.dev/features.
-    // "features": {},
-    // Use 'forwardPorts' to make a list of ports inside the container available locally.
-    // "forwardPorts": [],
-    // Use 'postCreateCommand' to run commands after the container is created.
-    "postCreateCommand": "sudo chmod +x ./.devcontainer/setup.sh && ./.devcontainer/setup.sh",
-    "customizations": {
-        "vscode": {
-            "extensions": [
-                "ms-vscode.vscode-typescript-tslint-plugin",
-                "esbenp.prettier-vscode",
-                "github.vscode-pull-request-github"
-            ],
-            "settings": {
-                "files.eol": "\n",
-                "editor.formatOnSave": true,
-                "typescript.tsc.autoDetect": "on",
-                "typescript.updateImportsOnFileMove.enabled": "always",
-                "typescript.preferences.importModuleSpecifier": "relative",
-                "[typescript]": {
-                    "editor.codeActionsOnSave": {
-                        "source.organizeImports": true
-                    }
-                },
-                "[typescriptreact]": {
-                    "editor.codeActionsOnSave": {
-                        "source.organizeImports": true
-                    }
-                }
-            }
-        },
-        "codespaces": {
-            "openFiles": [
-                ".devcontainer/README.md"
-            ]
-        }
-    }
-    // Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
-    // "remoteUser": "root"
-}