@alienplatform/platform-api 3.3.18 → 3.3.20

package/src/models/operations/updateproject.ts

@@ -6,22 +6,24 @@ import * as z from "zod/v4";
 import { remap as remap$ } from "../../lib/primitives.js";
 import * as models from "../index.js";
 
+export type UpdateProjectGlobals = {
+  /**
+   * Workspace name. Platform API keys already select a workspace; other authentication methods can configure it once on the SDK client.
+   */
+  workspace?: string | undefined;
+};
+
 export type UpdateProjectRequest = {
   /**
    * Project ID or name.
    */
   idOrName: string;
-  /**
-   * Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.
-   */
-  workspace?: string | undefined;
   updateProject?: models.UpdateProject | undefined;
 };
 
 /** @internal */
 export type UpdateProjectRequest$Outbound = {
   idOrName: string;
-  workspace?: string | undefined;
   UpdateProject?: models.UpdateProject$Outbound | undefined;
 };
 
@@ -31,7 +33,6 @@ export const UpdateProjectRequest$outboundSchema: z.ZodType<
   UpdateProjectRequest
 > = z.object({
   idOrName: z.string(),
-  workspace: z.string().optional(),
   updateProject: models.UpdateProject$outboundSchema.optional(),
 }).transform((v) => {
   return remap$(v, {

package/src/models/operations/updateprojectgcpoauthprovider.ts

@@ -6,15 +6,18 @@ import * as z from "zod/v4";
 import { remap as remap$ } from "../../lib/primitives.js";
 import * as models from "../index.js";
 
+export type UpdateProjectGcpOAuthProviderGlobals = {
+  /**
+   * Workspace name. Platform API keys already select a workspace; other authentication methods can configure it once on the SDK client.
+   */
+  workspace?: string | undefined;
+};
+
 export type UpdateProjectGcpOAuthProviderRequest = {
   /**
    * Project ID or name.
    */
   idOrName: string;
-  /**
-   * Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.
-   */
-  workspace?: string | undefined;
   updateProjectGcpOAuthProvider?:
     | models.UpdateProjectGcpOAuthProvider
     | undefined;
@@ -23,7 +26,6 @@ export type UpdateProjectGcpOAuthProviderRequest = {
 /** @internal */
 export type UpdateProjectGcpOAuthProviderRequest$Outbound = {
   idOrName: string;
-  workspace?: string | undefined;
   UpdateProjectGcpOAuthProvider?:
     | models.UpdateProjectGcpOAuthProvider$Outbound
     | undefined;
@@ -35,7 +37,6 @@ export const UpdateProjectGcpOAuthProviderRequest$outboundSchema: z.ZodType<
   UpdateProjectGcpOAuthProviderRequest
 > = z.object({
   idOrName: z.string(),
-  workspace: z.string().optional(),
   updateProjectGcpOAuthProvider: models
     .UpdateProjectGcpOAuthProvider$outboundSchema.optional(),
 }).transform((v) => {

package/src/models/operations/updateworkspace.ts

@@ -5,6 +5,13 @@
 import * as z from "zod/v4";
 import { remap as remap$ } from "../../lib/primitives.js";
 
+export type UpdateWorkspaceGlobals = {
+  /**
+   * Workspace name. Platform API keys already select a workspace; other authentication methods can configure it once on the SDK client.
+   */
+  workspace?: string | undefined;
+};
+
 export type UpdateWorkspaceRequestBody = {
   logoUrl?: string | null | undefined;
 };
@@ -14,10 +21,6 @@ export type UpdateWorkspaceRequest = {
    * Unique identifier for the workspace.
    */
   id: string;
-  /**
-   * Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.
-   */
-  workspace?: string | undefined;
   requestBody?: UpdateWorkspaceRequestBody | undefined;
 };
 
@@ -45,7 +48,6 @@ export function updateWorkspaceRequestBodyToJSON(
 /** @internal */
 export type UpdateWorkspaceRequest$Outbound = {
   id: string;
-  workspace?: string | undefined;
   RequestBody?: UpdateWorkspaceRequestBody$Outbound | undefined;
 };
 
@@ -55,7 +57,6 @@ export const UpdateWorkspaceRequest$outboundSchema: z.ZodType<
   UpdateWorkspaceRequest
 > = z.object({
   id: z.string(),
-  workspace: z.string().optional(),
   requestBody: z.lazy(() => UpdateWorkspaceRequestBody$outboundSchema)
     .optional(),
 }).transform((v) => {

package/src/models/operations/updateworkspacemember.ts

@@ -6,6 +6,13 @@ import * as z from "zod/v4";
 import { remap as remap$ } from "../../lib/primitives.js";
 import * as models from "../index.js";
 
+export type UpdateWorkspaceMemberGlobals = {
+  /**
+   * Workspace name. Platform API keys already select a workspace; other authentication methods can configure it once on the SDK client.
+   */
+  workspace?: string | undefined;
+};
+
 export type UpdateWorkspaceMemberRequestBody = {
   role: models.WorkspaceRole;
 };
@@ -16,10 +23,6 @@ export type UpdateWorkspaceMemberRequest = {
    */
   id: string;
   userId: string;
-  /**
-   * Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.
-   */
-  workspace?: string | undefined;
   requestBody?: UpdateWorkspaceMemberRequestBody | undefined;
 };
 
@@ -50,7 +53,6 @@ export function updateWorkspaceMemberRequestBodyToJSON(
 export type UpdateWorkspaceMemberRequest$Outbound = {
   id: string;
   userId: string;
-  workspace?: string | undefined;
   RequestBody?: UpdateWorkspaceMemberRequestBody$Outbound | undefined;
 };
 
@@ -61,7 +63,6 @@ export const UpdateWorkspaceMemberRequest$outboundSchema: z.ZodType<
 > = z.object({
   id: z.string(),
   userId: z.string(),
-  workspace: z.string().optional(),
   requestBody: z.lazy(() => UpdateWorkspaceMemberRequestBody$outboundSchema)
     .optional(),
 }).transform((v) => {

package/src/models/operations/updateworkspacesettings.ts

@@ -6,15 +6,18 @@ import * as z from "zod/v4";
 import { remap as remap$ } from "../../lib/primitives.js";
 import * as models from "../index.js";
 
+export type UpdateWorkspaceSettingsGlobals = {
+  /**
+   * Workspace name. Platform API keys already select a workspace; other authentication methods can configure it once on the SDK client.
+   */
+  workspace?: string | undefined;
+};
+
 export type UpdateWorkspaceSettingsRequest = {
   /**
    * Unique identifier for the workspace.
    */
   id: string;
-  /**
-   * Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.
-   */
-  workspace?: string | undefined;
   updateWorkspaceSettingsRequest?:
     | models.UpdateWorkspaceSettingsRequest
     | undefined;
@@ -23,7 +26,6 @@ export type UpdateWorkspaceSettingsRequest = {
 /** @internal */
 export type UpdateWorkspaceSettingsRequest$Outbound = {
   id: string;
-  workspace?: string | undefined;
   UpdateWorkspaceSettingsRequest?:
     | models.UpdateWorkspaceSettingsRequest$Outbound
     | undefined;
@@ -35,7 +37,6 @@ export const UpdateWorkspaceSettingsRequest$outboundSchema: z.ZodType<
   UpdateWorkspaceSettingsRequest
 > = z.object({
   id: z.string(),
-  workspace: z.string().optional(),
   updateWorkspaceSettingsRequest: models
     .UpdateWorkspaceSettingsRequest$outboundSchema.optional(),
 }).transform((v) => {

package/src/models/operations/verifycontainerregistry.ts

@@ -8,15 +8,18 @@ import { ClosedEnum } from "../../types/enums.js";
 import { Result as SafeParseResult } from "../../types/fp.js";
 import { SDKValidationError } from "../errors/sdkvalidationerror.js";
 
+export type VerifyContainerRegistryGlobals = {
+  /**
+   * Workspace name. Platform API keys already select a workspace; other authentication methods can configure it once on the SDK client.
+   */
+  workspace?: string | undefined;
+};
+
 export type VerifyContainerRegistryRequest = {
   /**
    * Unique identifier for the deployment group.
    */
   id: string;
-  /**
-   * Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.
-   */
-  workspace?: string | undefined;
 };
 
 export const VerifyContainerRegistryStatus = {
@@ -56,7 +59,6 @@ export type VerifyContainerRegistryResponse = {
 /** @internal */
 export type VerifyContainerRegistryRequest$Outbound = {
   id: string;
-  workspace?: string | undefined;
 };
 
 /** @internal */
@@ -65,7 +67,6 @@ export const VerifyContainerRegistryRequest$outboundSchema: z.ZodType<
   VerifyContainerRegistryRequest
 > = z.object({
   id: z.string(),
-  workspace: z.string().optional(),
 });
 
 export function verifyContainerRegistryRequestToJSON(

package/src/models/operations/verifyoperationcheck.ts

@@ -0,0 +1,54 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v4";
+import { remap as remap$ } from "../../lib/primitives.js";
+import * as models from "../index.js";
+
+export type VerifyOperationCheckGlobals = {
+  /**
+   * Workspace name. Platform API keys already select a workspace; other authentication methods can configure it once on the SDK client.
+   */
+  workspace?: string | undefined;
+};
+
+export type VerifyOperationCheckRequest = {
+  /**
+   * Filter by project ID or name.
+   */
+  project: string;
+  verifyOperationCheckRequest?: models.VerifyOperationCheckRequest | undefined;
+};
+
+/** @internal */
+export type VerifyOperationCheckRequest$Outbound = {
+  project: string;
+  VerifyOperationCheckRequest?:
+    | models.VerifyOperationCheckRequest$Outbound
+    | undefined;
+};
+
+/** @internal */
+export const VerifyOperationCheckRequest$outboundSchema: z.ZodType<
+  VerifyOperationCheckRequest$Outbound,
+  VerifyOperationCheckRequest
+> = z.object({
+  project: z.string(),
+  verifyOperationCheckRequest: models.VerifyOperationCheckRequest$outboundSchema
+    .optional(),
+}).transform((v) => {
+  return remap$(v, {
+    verifyOperationCheckRequest: "VerifyOperationCheckRequest",
+  });
+});
+
+export function verifyOperationCheckRequestToJSON(
+  verifyOperationCheckRequest: VerifyOperationCheckRequest,
+): string {
+  return JSON.stringify(
+    VerifyOperationCheckRequest$outboundSchema.parse(
+      verifyOperationCheckRequest,
+    ),
+  );
+}

package/src/models/operations/whoami.ts

@@ -4,25 +4,23 @@
 
 import * as z from "zod/v4";
 
-export type WhoamiRequest = {
+export type WhoamiGlobals = {
   /**
-   * Workspace to resolve the principal in. Required for user credentials because a user's role is per-workspace. Service accounts carry their workspace in the credential and may omit it.
+   * Workspace name. Platform API keys already select a workspace; other authentication methods can configure it once on the SDK client.
    */
   workspace?: string | undefined;
 };
 
+export type WhoamiRequest = {};
+
 /** @internal */
-export type WhoamiRequest$Outbound = {
-  workspace?: string | undefined;
-};
+export type WhoamiRequest$Outbound = {};
 
 /** @internal */
 export const WhoamiRequest$outboundSchema: z.ZodType<
   WhoamiRequest$Outbound,
   WhoamiRequest
-> = z.object({
-  workspace: z.string().optional(),
-});
+> = z.object({});
 
 export function whoamiRequestToJSON(whoamiRequest: WhoamiRequest): string {
   return JSON.stringify(WhoamiRequest$outboundSchema.parse(whoamiRequest));

package/src/models/operationspolicyrule.ts

@@ -22,6 +22,21 @@ export type OperationsPolicyRuleDecision = ClosedEnum<
   typeof OperationsPolicyRuleDecision
 >;
 
+/**
+ * For a wildcard pattern (`plugin/*` or `*`) only: the highest risk tier a WILDCARD ACCESS REQUEST against this pattern may cover. Null/absent means no wildcard grant above read-only is allowed for this pattern — write and destructive wildcards require an explicit rule setting this field. Ignored for exact `plugin/operation` rules (a named operation's risk is already its own declared tier) and for the auto/manual invoke decision itself.
+ */
+export const OperationsPolicyRuleMaxRisk = {
+  ReadOnly: "read-only",
+  Mutating: "mutating",
+  Destructive: "destructive",
+} as const;
+/**
+ * For a wildcard pattern (`plugin/*` or `*`) only: the highest risk tier a WILDCARD ACCESS REQUEST against this pattern may cover. Null/absent means no wildcard grant above read-only is allowed for this pattern — write and destructive wildcards require an explicit rule setting this field. Ignored for exact `plugin/operation` rules (a named operation's risk is already its own declared tier) and for the auto/manual invoke decision itself.
+ */
+export type OperationsPolicyRuleMaxRisk = ClosedEnum<
+  typeof OperationsPolicyRuleMaxRisk
+>;
+
 export type OperationsPolicyRule = {
   /**
    * `plugin/operation`, `plugin/*`, or `*`.
@@ -31,6 +46,10 @@ export type OperationsPolicyRule = {
    * auto: run immediately. manual: needs customer approval before running.
    */
   decision: OperationsPolicyRuleDecision;
+  /**
+   * For a wildcard pattern (`plugin/*` or `*`) only: the highest risk tier a WILDCARD ACCESS REQUEST against this pattern may cover. Null/absent means no wildcard grant above read-only is allowed for this pattern — write and destructive wildcards require an explicit rule setting this field. Ignored for exact `plugin/operation` rules (a named operation's risk is already its own declared tier) and for the auto/manual invoke decision itself.
+   */
+  maxRisk?: OperationsPolicyRuleMaxRisk | null | undefined;
 };
 
 /** @internal */
@@ -42,6 +61,15 @@ export const OperationsPolicyRuleDecision$outboundSchema: z.ZodEnum<
   typeof OperationsPolicyRuleDecision
 > = OperationsPolicyRuleDecision$inboundSchema;
 
+/** @internal */
+export const OperationsPolicyRuleMaxRisk$inboundSchema: z.ZodEnum<
+  typeof OperationsPolicyRuleMaxRisk
+> = z.enum(OperationsPolicyRuleMaxRisk);
+/** @internal */
+export const OperationsPolicyRuleMaxRisk$outboundSchema: z.ZodEnum<
+  typeof OperationsPolicyRuleMaxRisk
+> = OperationsPolicyRuleMaxRisk$inboundSchema;
+
 /** @internal */
 export const OperationsPolicyRule$inboundSchema: z.ZodType<
   OperationsPolicyRule,
@@ -49,11 +77,13 @@ export const OperationsPolicyRule$inboundSchema: z.ZodType<
 > = z.object({
   pattern: z.string(),
   decision: OperationsPolicyRuleDecision$inboundSchema,
+  maxRisk: z.nullable(OperationsPolicyRuleMaxRisk$inboundSchema).optional(),
 });
 /** @internal */
 export type OperationsPolicyRule$Outbound = {
   pattern: string;
   decision: string;
+  maxRisk?: string | null | undefined;
 };
 
 /** @internal */
@@ -63,6 +93,7 @@ export const OperationsPolicyRule$outboundSchema: z.ZodType<
 > = z.object({
   pattern: z.string(),
   decision: OperationsPolicyRuleDecision$outboundSchema,
+  maxRisk: z.nullable(OperationsPolicyRuleMaxRisk$outboundSchema).optional(),
 });
 
 export function operationsPolicyRuleToJSON(

package/src/models/package.ts

@@ -20,6 +20,7 @@ export const PackageTypeEnum = {
   Cloudformation: "cloudformation",
   Helm: "helm",
   OperatorImage: "operator-image",
+  SandboxBundle: "sandbox-bundle",
   Terraform: "terraform",
 } as const;
 /**
@@ -57,6 +58,40 @@ export type ConfigTerraform = {
   type: "terraform";
 };
 
+/**
+ * Configuration for a sandbox bundle package.
+ *
+ * @remarks
+ *
+ * The bundle is a zip holding one Dockerfile that layers the published Alien sandbox agent
+ * onto the vendor's base image; everything the builder writes is derived from these fields.
+ */
+export type ConfigSandboxBundle = {
+  /**
+   * Full reference of the published sandbox agent image copied into the bundle.
+   */
+  agentImage: string;
+  /**
+   * The base container image the sandbox filesystem starts from. A release-pushed image
+   *
+   * @remarks
+   * arrives resolved onto the private registry template with its {region} token intact.
+   */
+  baseImage: string;
+  /**
+   * Object key the bundle is written under in every regional bundle store.
+   */
+  objectKey: string;
+  /**
+   * Regions whose bundle store must receive this bundle. Part of the build input hash,
+   *
+   * @remarks
+   * so a newly supported region re-mints the bundle instead of silently missing it.
+   */
+  supportedAwsRegions?: Array<string> | undefined;
+  type: "sandbox-bundle";
+};
+
 /**
  * Branding configuration for the Operator image.
  */
@@ -170,6 +205,7 @@ export type Config =
   | ConfigCloudformation
   | ConfigHelm
   | ConfigOperatorImage
+  | ConfigSandboxBundle
   | ConfigTerraform;
 
 /**
@@ -288,6 +324,43 @@ export type OutputsTerraform = {
   type: OutputsTypeTerraform;
 };
 
+export const OutputsTypeSandboxBundle = {
+  SandboxBundle: "sandbox-bundle",
+} as const;
+export type OutputsTypeSandboxBundle = ClosedEnum<
+  typeof OutputsTypeSandboxBundle
+>;
+
+/**
+ * Outputs from a sandbox bundle package build.
+ */
+export type OutputsSandboxBundle = {
+  /**
+   * Bundle URI with the {region} token in the bucket, resolved by the deploy-time emitters.
+   */
+  bundleUriTemplate: string;
+  /**
+   * Object key the bundle was written under in every regional bundle store.
+   */
+  objectKey: string;
+  /**
+   * Regions whose bundle store received this bundle.
+   */
+  regions: Array<string>;
+  /**
+   * SHA256 checksum of the region-neutral bundle zip; a region-templated base image makes
+   *
+   * @remarks
+   * each regional object differ from it only in the rendered region.
+   */
+  sha256: string;
+  /**
+   * Region-neutral bundle zip size in bytes.
+   */
+  size: number;
+  type: OutputsTypeSandboxBundle;
+};
+
 /**
  * Information about a single CloudFormation template package for one target.
  */
@@ -454,6 +527,7 @@ export type OutputsCli = {
  * Package outputs (only when status is 'ready')
  */
 export type PackageOutputsUnion =
+  | OutputsSandboxBundle
   | OutputsCli
   | OutputsOperatorImage
   | OutputsHelm
@@ -518,11 +592,13 @@ export type Package = {
     | ConfigCloudformation
     | ConfigHelm
     | ConfigOperatorImage
+    | ConfigSandboxBundle
     | ConfigTerraform;
   /**
    * Package outputs (only when status is 'ready')
    */
   outputs?:
+    | OutputsSandboxBundle
     | OutputsCli
     | OutputsOperatorImage
     | OutputsHelm
@@ -590,6 +666,28 @@ export function configTerraformFromJSON(
   );
 }
 
+/** @internal */
+export const ConfigSandboxBundle$inboundSchema: z.ZodType<
+  ConfigSandboxBundle,
+  unknown
+> = z.object({
+  agentImage: z.string(),
+  baseImage: z.string(),
+  objectKey: z.string(),
+  supportedAwsRegions: z.array(z.string()).optional(),
+  type: z.literal("sandbox-bundle"),
+});
+
+export function configSandboxBundleFromJSON(
+  jsonString: string,
+): SafeParseResult<ConfigSandboxBundle, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => ConfigSandboxBundle$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'ConfigSandboxBundle' from JSON`,
+  );
+}
+
 /** @internal */
 export const ConfigOperatorImage$inboundSchema: z.ZodType<
   ConfigOperatorImage,
@@ -680,6 +778,7 @@ export const Config$inboundSchema: z.ZodType<Config, unknown> = z.union([
   z.lazy(() => ConfigCloudformation$inboundSchema),
   z.lazy(() => ConfigHelm$inboundSchema),
   z.lazy(() => ConfigOperatorImage$inboundSchema),
+  z.lazy(() => ConfigSandboxBundle$inboundSchema),
   z.lazy(() => ConfigTerraform$inboundSchema),
 ]);
 
@@ -802,6 +901,34 @@ export function outputsTerraformFromJSON(
   );
 }
 
+/** @internal */
+export const OutputsTypeSandboxBundle$inboundSchema: z.ZodEnum<
+  typeof OutputsTypeSandboxBundle
+> = z.enum(OutputsTypeSandboxBundle);
+
+/** @internal */
+export const OutputsSandboxBundle$inboundSchema: z.ZodType<
+  OutputsSandboxBundle,
+  unknown
+> = z.object({
+  bundleUriTemplate: z.string(),
+  objectKey: z.string(),
+  regions: z.array(z.string()),
+  sha256: z.string(),
+  size: z.int(),
+  type: OutputsTypeSandboxBundle$inboundSchema,
+});
+
+export function outputsSandboxBundleFromJSON(
+  jsonString: string,
+): SafeParseResult<OutputsSandboxBundle, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => OutputsSandboxBundle$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'OutputsSandboxBundle' from JSON`,
+  );
+}
+
 /** @internal */
 export const PackageTargets$inboundSchema: z.ZodType<PackageTargets, unknown> =
   z.object({
@@ -965,6 +1092,7 @@ export const PackageOutputsUnion$inboundSchema: z.ZodType<
   PackageOutputsUnion,
   unknown
 > = z.union([
+  z.lazy(() => OutputsSandboxBundle$inboundSchema),
   z.lazy(() => OutputsCli$inboundSchema),
   z.lazy(() => OutputsOperatorImage$inboundSchema),
   z.lazy(() => OutputsHelm$inboundSchema),
@@ -1004,10 +1132,12 @@ export const Package$inboundSchema: z.ZodType<Package, unknown> = z.object({
     z.lazy(() => ConfigCloudformation$inboundSchema),
     z.lazy(() => ConfigHelm$inboundSchema),
     z.lazy(() => ConfigOperatorImage$inboundSchema),
+    z.lazy(() => ConfigSandboxBundle$inboundSchema),
     z.lazy(() => ConfigTerraform$inboundSchema),
   ]),
   outputs: z.nullable(
     z.union([
+      z.lazy(() => OutputsSandboxBundle$inboundSchema),
       z.lazy(() => OutputsCli$inboundSchema),
       z.lazy(() => OutputsOperatorImage$inboundSchema),
       z.lazy(() => OutputsHelm$inboundSchema),