@alienplatform/platform-api 3.3.31 → 3.3.33

package/src/models/targetreleaseoperations.ts

@@ -1444,7 +1444,10 @@ export type DeploymentStateSetupScaffolding = {
  */
 export type DeploymentStateSetupUpdateAuthorization = {
   /**
-   * Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment.
+   * Setup resources and permissions digest (`Stack::setup_update_digest`) of the last
+   *
+   * @remarks
+   * successful deployment. The field name is retained for serialized compatibility.
    */
   baselineFrozenDigest: string;
   /**
@@ -1468,7 +1471,10 @@ export type DeploymentStateSetupUpdateAuthorization = {
    */
   setupTarget: string;
   /**
-   * Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared.
+   * Setup resources and permissions digest (`Stack::setup_update_digest`) of the stack
+   *
+   * @remarks
+   * the setup re-import prepared.
    */
   targetFrozenDigest: string;
 };
@@ -1485,6 +1491,13 @@ export type DeploymentStateSetupUpdateAuthorizationUnion =
  * Stores deployment state that needs to persist across step calls.
  */
 export type DeploymentStateRuntimeMetadata = {
+  /**
+   * Setup-owned grant to keep using the direct setup executor for updates.
+   *
+   * @remarks
+   * Runtime settings and release contents must never create or change this grant.
+   */
+  automaticSetup?: boolean | undefined;
   /**
    * Whether each vault-native deployer secret is in the customer's secret
    *
@@ -1521,9 +1534,10 @@ export type DeploymentStateRuntimeMetadata = {
    */
   lastSyncedSecretNames?: Array<string> | undefined;
   /**
-   * Release `pending_prepared_stack` was prepared from. The target can move
+   * Release the in-flight stack was prepared from: `pending_prepared_stack`
    *
    * @remarks
+   * during updates, or `prepared_stack` during local first startup. The target can move
    * to a newer release while that stack is still being applied; this tells
    * the update which release actually converged.
    */
@@ -1539,9 +1553,9 @@ export type DeploymentStateRuntimeMetadata = {
    * keyed by input id, recorded when the deployment is created or its
    * setup import registers.
    *
-   * A frozen gate's answer is fixed for the deployment's lifetime: the
-   * update path refuses input values that conflict with these, and a Live
-   * resource sharing such an input resolves the persisted answer forever.
+   * Manual installations keep these answers fixed. An installation with an
+   * ongoing-management grant refreshes them when preparing a release. Live
+   * resources sharing a gate use the same recorded answer as Frozen resources.
    */
   persistedGateAnswers?: { [k: string]: boolean } | undefined;
   preparedStack?: DeploymentStatePreparedStack | string | null | undefined;
@@ -7191,6 +7205,7 @@ export const DeploymentStateRuntimeMetadata$inboundSchema: z.ZodType<
   DeploymentStateRuntimeMetadata,
   unknown
 > = z.object({
+  automaticSetup: z.boolean().optional(),
   deployerSecrets: z.array(DeploymentStateDeployerSecret$inboundSchema)
     .optional(),
   directSetupRevision: z.nullable(z.string()).optional(),
@@ -7229,6 +7244,7 @@ export const DeploymentStateRuntimeMetadata$inboundSchema: z.ZodType<
 });
 /** @internal */
 export type DeploymentStateRuntimeMetadata$Outbound = {
+  automaticSetup?: boolean | undefined;
   deployerSecrets?: Array<DeploymentStateDeployerSecret$Outbound> | undefined;
   directSetupRevision?: string | null | undefined;
   initialSetupAuthority?: string | undefined;
@@ -7266,6 +7282,7 @@ export const DeploymentStateRuntimeMetadata$outboundSchema: z.ZodType<
   DeploymentStateRuntimeMetadata$Outbound,
   DeploymentStateRuntimeMetadata
 > = z.object({
+  automaticSetup: z.boolean().optional(),
   deployerSecrets: z.array(DeploymentStateDeployerSecret$outboundSchema)
     .optional(),
   directSetupRevision: z.nullable(z.string()).optional(),

package/src/models/updatedeploymentcomputerequest.ts

@@ -5,6 +5,27 @@
 import * as z from "zod/v4";
 import { remap as remap$ } from "../lib/primitives.js";
 
+/**
+ * Deployment-time resource allocation for a container. Omitted fields use release defaults.
+ */
+export type UpdateDeploymentComputeRequestContainers = {
+  /**
+   * CPU allocation in vCPUs.
+   */
+  cpu?: number | null | undefined;
+  /**
+   * Memory allocation, using binary units such as Mi or Gi.
+   */
+  memory?: string | null | undefined;
+  /**
+   * Persistent volume capacity per replica, in whole GiB. Omitted values
+   *
+   * @remarks
+   * use the release default. Existing volumes can only grow.
+   */
+  volumeSizeGib?: number | null | undefined;
+};
+
 /**
  * Failure-domain policy selected for a compute pool.
  */
@@ -102,6 +123,12 @@ export type UpdateDeploymentComputeRequestPoolsUnion =
  * provider machine type and selected machine counts.
  */
 export type UpdateDeploymentComputeRequestCompute = {
+  /**
+   * Per-replica resources selected within each container's declared ranges.
+   */
+  containers?:
+    | { [k: string]: UpdateDeploymentComputeRequestContainers }
+    | undefined;
   /**
    * Selected compute choices keyed by pool ID.
    */
@@ -118,8 +145,44 @@ export type UpdateDeploymentComputeRequestComputeUnion =
 
 export type UpdateDeploymentComputeRequest = {
   compute?: UpdateDeploymentComputeRequestCompute | string | null | undefined;
+  /**
+   * Provider quota identities whose preflight failures become visible warnings
+   *
+   * @remarks
+   * for this deployment. Checks still run; deploy-time provider limits still apply.
+   * Unknown identities are rejected. An empty list restores normal blocking.
+   */
+  quotaWarningOverrides?: Array<string> | undefined;
 };
 
+/** @internal */
+export type UpdateDeploymentComputeRequestContainers$Outbound = {
+  cpu?: number | null | undefined;
+  memory?: string | null | undefined;
+  volumeSizeGib?: number | null | undefined;
+};
+
+/** @internal */
+export const UpdateDeploymentComputeRequestContainers$outboundSchema: z.ZodType<
+  UpdateDeploymentComputeRequestContainers$Outbound,
+  UpdateDeploymentComputeRequestContainers
+> = z.object({
+  cpu: z.nullable(z.number()).optional(),
+  memory: z.nullable(z.string()).optional(),
+  volumeSizeGib: z.nullable(z.int()).optional(),
+});
+
+export function updateDeploymentComputeRequestContainersToJSON(
+  updateDeploymentComputeRequestContainers:
+    UpdateDeploymentComputeRequestContainers,
+): string {
+  return JSON.stringify(
+    UpdateDeploymentComputeRequestContainers$outboundSchema.parse(
+      updateDeploymentComputeRequestContainers,
+    ),
+  );
+}
+
 /** @internal */
 export type UpdateDeploymentComputeRequestFailureDomains2$Outbound = {
   selectedFailureDomains?: Array<string> | undefined;
@@ -346,6 +409,9 @@ export function updateDeploymentComputeRequestPoolsUnionToJSON(
 
 /** @internal */
 export type UpdateDeploymentComputeRequestCompute$Outbound = {
+  containers?: {
+    [k: string]: UpdateDeploymentComputeRequestContainers$Outbound;
+  } | undefined;
   pools?: {
     [k: string]:
       | UpdateDeploymentComputeRequestPoolsFixed$Outbound
@@ -358,6 +424,10 @@ export const UpdateDeploymentComputeRequestCompute$outboundSchema: z.ZodType<
   UpdateDeploymentComputeRequestCompute$Outbound,
   UpdateDeploymentComputeRequestCompute
 > = z.object({
+  containers: z.record(
+    z.string(),
+    z.lazy(() => UpdateDeploymentComputeRequestContainers$outboundSchema),
+  ).optional(),
   pools: z.record(
     z.string(),
     z.union([
@@ -410,6 +480,7 @@ export type UpdateDeploymentComputeRequest$Outbound = {
     | string
     | null
     | undefined;
+  quotaWarningOverrides?: Array<string> | undefined;
 };
 
 /** @internal */
@@ -423,6 +494,7 @@ export const UpdateDeploymentComputeRequest$outboundSchema: z.ZodType<
       z.string(),
     ]),
   ).optional(),
+  quotaWarningOverrides: z.array(z.string()).optional(),
 });
 
 export function updateDeploymentComputeRequestToJSON(

package/src/react-query/deploymentsUpdateCompute.ts

@@ -51,7 +51,7 @@ export type DeploymentsUpdateComputeMutationError =
   | SDKValidationError;
 
 /**
- * Update deployment-time compute pool selections and request reconciliation by the hosted manager.
+ * Update deployment-time compute selections or quota warning overrides and request reconciliation by the hosted manager.
  */
 export function useDeploymentsUpdateComputeMutation(
   options?: MutationHookOptions<

package/src/react-query/operationsGetPolicy.ts

@@ -54,6 +54,8 @@ export type OperationsGetPolicyQueryError =
 
 /**
  * Get a project's per-command approval policy. Mirrors what the operator enforces: `plugin/operation` / `plugin/*` / `*` patterns → auto | manual.
+ *
+ * @deprecated method: This will be removed in a future release, please migrate away from it as soon as possible.
  */
 export function useOperationsGetPolicy(
   request: operations.GetOperationsPolicyRequest,
@@ -75,6 +77,8 @@ export function useOperationsGetPolicy(
 
 /**
  * Get a project's per-command approval policy. Mirrors what the operator enforces: `plugin/operation` / `plugin/*` / `*` patterns → auto | manual.
+ *
+ * @deprecated method: This will be removed in a future release, please migrate away from it as soon as possible.
  */
 export function useOperationsGetPolicySuspense(
   request: operations.GetOperationsPolicyRequest,

package/src/react-query/operationsInvoke.ts

@@ -47,7 +47,7 @@ export type OperationsInvokeMutationError =
   | SDKValidationError;
 
 /**
- * Invoke a plugin operation against a deployment. Honors the project's per-command approval policy.
+ * Invoke a plugin operation against a deployment. Honors the approval rules the deployment's release declares in `operations()`.
  */
 export function useOperationsInvokeMutation(
   options?: MutationHookOptions<

package/src/react-query/operationsListPlugins.core.ts

@@ -43,7 +43,10 @@ export function buildOperationsListPluginsQuery(
   ) => Promise<OperationsListPluginsQueryData>;
 } {
   return {
-    queryKey: queryKeyOperationsListPlugins({ project: request.project }),
+    queryKey: queryKeyOperationsListPlugins({
+      project: request.project,
+      deployment: request.deployment,
+    }),
     queryFn: async function operationsListPluginsQueryFn(
       ctx,
     ): Promise<OperationsListPluginsQueryData> {
@@ -68,7 +71,7 @@ export function buildOperationsListPluginsQuery(
 }
 
 export function queryKeyOperationsListPlugins(
-  parameters: { project: string },
+  parameters: { project: string; deployment?: string | undefined },
 ): QueryKey {
   return [
     "@alienplatform/platform-api",

package/src/react-query/operationsListPlugins.ts

@@ -102,7 +102,9 @@ export function useOperationsListPluginsSuspense(
 
 export function setOperationsListPluginsData(
   client: QueryClient,
-  queryKeyBase: [parameters: { project: string }],
+  queryKeyBase: [
+    parameters: { project: string; deployment?: string | undefined },
+  ],
   data: OperationsListPluginsQueryData,
 ): OperationsListPluginsQueryData | undefined {
   const key = queryKeyOperationsListPlugins(...queryKeyBase);
@@ -112,7 +114,9 @@ export function setOperationsListPluginsData(
 
 export function invalidateOperationsListPlugins(
   client: QueryClient,
-  queryKeyBase: TupleToPrefixes<[parameters: { project: string }]>,
+  queryKeyBase: TupleToPrefixes<
+    [parameters: { project: string; deployment?: string | undefined }]
+  >,
   filters?: Omit<InvalidateQueryFilters, "queryKey" | "predicate" | "exact">,
 ): Promise<void> {
   return client.invalidateQueries({

package/src/react-query/operationsPublishPlugin.ts

@@ -50,7 +50,7 @@ export type OperationsPublishPluginMutationError =
   | SDKValidationError;
 
 /**
- * Register a custom operations plugin whose bundle ZIP has already been uploaded to S3 (see POST /plugins/upload-url). Replaces any existing plugin of the same name in that project. New custom plugins are enabled by default. Returns the cloud permission delta versus the previously enabled set.
+ * Register a version of a custom operations plugin whose bundle ZIP has already been uploaded to S3 (see POST /plugins/upload-url). Publishing changes no deployment: a release runs the version it declares in `operations()`.
  */
 export function useOperationsPublishPluginMutation(
   options?: MutationHookOptions<

package/src/react-query/operationsSetBuiltinPlugins.ts

@@ -23,15 +23,13 @@ import * as errors from "../models/errors/index.js";
 import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
 import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
 import * as models from "../models/index.js";
+import * as operations from "../models/operations/index.js";
 import { unwrapAsync } from "../types/fp.js";
 import { useAlienContext } from "./_context.js";
 import { MutationHookOptions } from "./_types.js";
 
 export type OperationsSetBuiltinPluginsMutationVariables = {
-  project: string;
-  setBuiltinOperationsPluginsRequest?:
-    | models.SetBuiltinOperationsPluginsRequest
-    | undefined;
+  request: operations.SetBuiltinOperationsPluginsRequest;
   options?: RequestOptions;
 };
 
@@ -51,6 +49,8 @@ export type OperationsSetBuiltinPluginsMutationError =
 
 /**
  * Replace the complete set of enabled built-in operations plugins for a project. Returns the cloud permission delta versus the previously enabled set.
+ *
+ * @deprecated method: This will be removed in a future release, please migrate away from it as soon as possible.
  */
 export function useOperationsSetBuiltinPluginsMutation(
   options?: MutationHookOptions<
@@ -86,8 +86,7 @@ export function buildOperationsSetBuiltinPluginsMutation(
   return {
     mutationKey: mutationKeyOperationsSetBuiltinPlugins(),
     mutationFn: function operationsSetBuiltinPluginsMutationFn({
-      project,
-      setBuiltinOperationsPluginsRequest,
+      request,
       options,
     }): Promise<OperationsSetBuiltinPluginsMutationData> {
       const mergedOptions = {
@@ -104,8 +103,7 @@ export function buildOperationsSetBuiltinPluginsMutation(
       };
       return unwrapAsync(operationsSetBuiltinPlugins(
         client$,
-        project,
-        setBuiltinOperationsPluginsRequest,
+        request,
         mergedOptions,
       ));
     },

package/src/react-query/operationsSetPluginEnabled.ts

@@ -49,6 +49,8 @@ export type OperationsSetPluginEnabledMutationError =
 
 /**
  * Enable or disable an operations plugin (builtin or custom) for a project. Only enabled plugins are distributed to Operators and can be invoked. Returns the cloud permission delta versus the previously enabled set. With `dryRun`, validates the change and returns the delta without saving it.
+ *
+ * @deprecated method: This will be removed in a future release, please migrate away from it as soon as possible.
  */
 export function useOperationsSetPluginEnabledMutation(
   options?: MutationHookOptions<

package/src/react-query/operationsUpdatePolicy.ts

@@ -23,15 +23,13 @@ import * as errors from "../models/errors/index.js";
 import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
 import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
 import * as models from "../models/index.js";
+import * as operations from "../models/operations/index.js";
 import { unwrapAsync } from "../types/fp.js";
 import { useAlienContext } from "./_context.js";
 import { MutationHookOptions } from "./_types.js";
 
 export type OperationsUpdatePolicyMutationVariables = {
-  project: string;
-  updateOperationsPolicyRequest?:
-    | models.UpdateOperationsPolicyRequest
-    | undefined;
+  request: operations.UpdateOperationsPolicyRequest;
   options?: RequestOptions;
 };
 
@@ -51,6 +49,8 @@ export type OperationsUpdatePolicyMutationError =
 
 /**
  * Replace a project's per-command approval policy (full rule set). Patterns are `plugin/operation`, `plugin/*`, or `*`; each maps to auto | manual.
+ *
+ * @deprecated method: This will be removed in a future release, please migrate away from it as soon as possible.
  */
 export function useOperationsUpdatePolicyMutation(
   options?: MutationHookOptions<
@@ -86,8 +86,7 @@ export function buildOperationsUpdatePolicyMutation(
   return {
     mutationKey: mutationKeyOperationsUpdatePolicy(),
     mutationFn: function operationsUpdatePolicyMutationFn({
-      project,
-      updateOperationsPolicyRequest,
+      request,
       options,
     }): Promise<OperationsUpdatePolicyMutationData> {
       const mergedOptions = {
@@ -104,8 +103,7 @@ export function buildOperationsUpdatePolicyMutation(
       };
       return unwrapAsync(operationsUpdatePolicy(
         client$,
-        project,
-        updateOperationsPolicyRequest,
+        request,
         mergedOptions,
       ));
     },

package/src/react-query/operatorManifestsRenderOperatorEcsCloudFormation.ts

@@ -51,7 +51,7 @@ export type OperatorManifestsRenderOperatorEcsCloudFormationMutationError =
  * Render a Remote Operator ECS Fargate CloudFormation installer
  *
  * @remarks
- * Renders a credential-free CloudFormation artifact that reuses a customer-owned ECS cluster and network; creates retained EFS identity storage unless an existing filesystem and access point are supplied; owns a task role compiled from the project's enabled operations; and uses a generated local command to hand one-time setup material directly to same-account, same-Region Secrets Manager. Sensitive S3 and SQS wildcard declarations fail closed unless the request supplies exact resource ceilings.
+ * Renders a credential-free CloudFormation artifact that reuses a customer-owned ECS cluster and network; creates retained EFS identity storage unless an existing filesystem and access point are supplied; owns a task role compiled from every built-in operation plugin; and uses a generated local command to hand one-time setup material directly to same-account, same-Region Secrets Manager. Sensitive S3 and SQS wildcard declarations fail closed unless the request supplies exact resource ceilings.
  */
 export function useOperatorManifestsRenderOperatorEcsCloudFormationMutation(
   options?: MutationHookOptions<

package/src/react-query/projectsAcceptRemoteOperatorPermissions.ts

@@ -50,7 +50,7 @@ export type ProjectsAcceptRemoteOperatorPermissionsMutationError =
  * Record that a Remote Operator installation's setup was re-applied
  *
  * @remarks
- * Records the permissions compiled from the currently enabled operations as the installation's installed permissions. Call it after re-applying the installation's Helm release, manifest, cloud access, or CloudFormation stack.
+ * Records the permissions compiled from every built-in operation plugin as the installation's installed permissions. Call it after re-applying the installation's Helm release, manifest, cloud access, or CloudFormation stack.
  */
 export function useProjectsAcceptRemoteOperatorPermissionsMutation(
   options?: MutationHookOptions<

package/src/react-query/projectsConfigureRemoteSandbox.ts

@@ -50,7 +50,7 @@ export type ProjectsConfigureRemoteSandboxMutationError =
   | SDKValidationError;
 
 /**
- * Enable a customer-owned sandbox a hosted caller can drive through Remote Bindings. Without a custom image it publishes to every cloud on Alien's default image, which the project then follows. A custom image publishes to AWS; a public one with a linux/amd64 variant also publishes to Azure, and to GCP once Alien has built its GCP image.
+ * Enable a customer-owned sandbox a hosted caller can drive through Remote Bindings. Without a custom image it publishes to every cloud on Alien's default image, which the project then follows. A custom image publishes to AWS; a public one with a linux/amd64 variant also publishes to Azure, and to GCP once Alien has built its GCP image; a private one publishes to Azure from its `azureImage` and to GCP from its `gcpImage`.
  */
 export function useProjectsConfigureRemoteSandboxMutation(
   options?: MutationHookOptions<

package/src/sdk/deployments.ts

@@ -327,7 +327,7 @@ export class Deployments extends ClientSDK {
   }
 
   /**
-   * Update deployment-time compute pool selections and request reconciliation by the hosted manager.
+   * Update deployment-time compute selections or quota warning overrides and request reconciliation by the hosted manager.
    */
   async updateCompute(
     id: string,

package/src/sdk/operations.ts

@@ -42,7 +42,7 @@ export class Operations extends ClientSDK {
   }
 
   /**
-   * Register a custom operations plugin whose bundle ZIP has already been uploaded to S3 (see POST /plugins/upload-url). Replaces any existing plugin of the same name in that project. New custom plugins are enabled by default. Returns the cloud permission delta versus the previously enabled set.
+   * Register a version of a custom operations plugin whose bundle ZIP has already been uploaded to S3 (see POST /plugins/upload-url). Publishing changes no deployment: a release runs the version it declares in `operations()`.
    */
   async publishPlugin(
     project: string,
@@ -59,24 +59,6 @@ export class Operations extends ClientSDK {
     ));
   }
 
-  /**
-   * Replace the complete set of enabled built-in operations plugins for a project. Returns the cloud permission delta versus the previously enabled set.
-   */
-  async setBuiltinPlugins(
-    project: string,
-    setBuiltinOperationsPluginsRequest?:
-      | models.SetBuiltinOperationsPluginsRequest
-      | undefined,
-    options?: RequestOptions,
-  ): Promise<models.SetBuiltinOperationsPluginsResponse> {
-    return unwrapAsync(operationsSetBuiltinPlugins(
-      this,
-      project,
-      setBuiltinOperationsPluginsRequest,
-      options,
-    ));
-  }
-
   /**
    * Get a presigned S3 URL to upload a custom operations plugin bundle ZIP. Upload the ZIP with a PUT to the returned url (sending the given Content-Type), then call POST /plugins to register it.
    */
@@ -96,53 +78,7 @@ export class Operations extends ClientSDK {
   }
 
   /**
-   * Enable or disable an operations plugin (builtin or custom) for a project. Only enabled plugins are distributed to Operators and can be invoked. Returns the cloud permission delta versus the previously enabled set. With `dryRun`, validates the change and returns the delta without saving it.
-   */
-  async setPluginEnabled(
-    request: operations.SetOperationsPluginEnabledRequest,
-    options?: RequestOptions,
-  ): Promise<models.SetOperationsPluginEnabledResponse> {
-    return unwrapAsync(operationsSetPluginEnabled(
-      this,
-      request,
-      options,
-    ));
-  }
-
-  /**
-   * Get a project's per-command approval policy. Mirrors what the operator enforces: `plugin/operation` / `plugin/*` / `*` patterns → auto | manual.
-   */
-  async getPolicy(
-    request: operations.GetOperationsPolicyRequest,
-    options?: RequestOptions,
-  ): Promise<models.OperationsPolicyResponse> {
-    return unwrapAsync(operationsGetPolicy(
-      this,
-      request,
-      options,
-    ));
-  }
-
-  /**
-   * Replace a project's per-command approval policy (full rule set). Patterns are `plugin/operation`, `plugin/*`, or `*`; each maps to auto | manual.
-   */
-  async updatePolicy(
-    project: string,
-    updateOperationsPolicyRequest?:
-      | models.UpdateOperationsPolicyRequest
-      | undefined,
-    options?: RequestOptions,
-  ): Promise<models.OperationsPolicyResponse> {
-    return unwrapAsync(operationsUpdatePolicy(
-      this,
-      project,
-      updateOperationsPolicyRequest,
-      options,
-    ));
-  }
-
-  /**
-   * Invoke a plugin operation against a deployment. Honors the project's per-command approval policy.
+   * Invoke a plugin operation against a deployment. Honors the approval rules the deployment's release declares in `operations()`.
    */
   async invoke(
     project: string,
@@ -320,4 +256,68 @@ export class Operations extends ClientSDK {
       options,
     ));
   }
+
+  /**
+   * Replace the complete set of enabled built-in operations plugins for a project. Returns the cloud permission delta versus the previously enabled set.
+   *
+   * @deprecated method: This will be removed in a future release, please migrate away from it as soon as possible.
+   */
+  async setBuiltinPlugins(
+    request: operations.SetBuiltinOperationsPluginsRequest,
+    options?: RequestOptions,
+  ): Promise<models.SetBuiltinOperationsPluginsResponse> {
+    return unwrapAsync(operationsSetBuiltinPlugins(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Enable or disable an operations plugin (builtin or custom) for a project. Only enabled plugins are distributed to Operators and can be invoked. Returns the cloud permission delta versus the previously enabled set. With `dryRun`, validates the change and returns the delta without saving it.
+   *
+   * @deprecated method: This will be removed in a future release, please migrate away from it as soon as possible.
+   */
+  async setPluginEnabled(
+    request: operations.SetOperationsPluginEnabledRequest,
+    options?: RequestOptions,
+  ): Promise<models.SetOperationsPluginEnabledResponse> {
+    return unwrapAsync(operationsSetPluginEnabled(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Get a project's per-command approval policy. Mirrors what the operator enforces: `plugin/operation` / `plugin/*` / `*` patterns → auto | manual.
+   *
+   * @deprecated method: This will be removed in a future release, please migrate away from it as soon as possible.
+   */
+  async getPolicy(
+    request: operations.GetOperationsPolicyRequest,
+    options?: RequestOptions,
+  ): Promise<models.OperationsPolicyResponse> {
+    return unwrapAsync(operationsGetPolicy(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Replace a project's per-command approval policy (full rule set). Patterns are `plugin/operation`, `plugin/*`, or `*`; each maps to auto | manual.
+   *
+   * @deprecated method: This will be removed in a future release, please migrate away from it as soon as possible.
+   */
+  async updatePolicy(
+    request: operations.UpdateOperationsPolicyRequest,
+    options?: RequestOptions,
+  ): Promise<models.OperationsPolicyResponse> {
+    return unwrapAsync(operationsUpdatePolicy(
+      this,
+      request,
+      options,
+    ));
+  }
 }

package/src/sdk/operatormanifests.ts

@@ -57,7 +57,7 @@ export class OperatorManifests extends ClientSDK {
    * Render a Remote Operator ECS Fargate CloudFormation installer
    *
    * @remarks
-   * Renders a credential-free CloudFormation artifact that reuses a customer-owned ECS cluster and network; creates retained EFS identity storage unless an existing filesystem and access point are supplied; owns a task role compiled from the project's enabled operations; and uses a generated local command to hand one-time setup material directly to same-account, same-Region Secrets Manager. Sensitive S3 and SQS wildcard declarations fail closed unless the request supplies exact resource ceilings.
+   * Renders a credential-free CloudFormation artifact that reuses a customer-owned ECS cluster and network; creates retained EFS identity storage unless an existing filesystem and access point are supplied; owns a task role compiled from every built-in operation plugin; and uses a generated local command to hand one-time setup material directly to same-account, same-Region Secrets Manager. Sensitive S3 and SQS wildcard declarations fail closed unless the request supplies exact resource ceilings.
    */
   async renderOperatorEcsCloudFormation(
     request?: models.RenderOperatorEcsCloudFormationRequest | undefined,

package/src/sdk/projects.ts

@@ -372,7 +372,7 @@ export class Projects extends ClientSDK {
   }
 
   /**
-   * Enable a customer-owned sandbox a hosted caller can drive through Remote Bindings. Without a custom image it publishes to every cloud on Alien's default image, which the project then follows. A custom image publishes to AWS; a public one with a linux/amd64 variant also publishes to Azure, and to GCP once Alien has built its GCP image.
+   * Enable a customer-owned sandbox a hosted caller can drive through Remote Bindings. Without a custom image it publishes to every cloud on Alien's default image, which the project then follows. A custom image publishes to AWS; a public one with a linux/amd64 variant also publishes to Azure, and to GCP once Alien has built its GCP image; a private one publishes to Azure from its `azureImage` and to GCP from its `gcpImage`.
    */
   async configureRemoteSandbox(
     idOrName: string,
@@ -449,7 +449,7 @@ export class Projects extends ClientSDK {
    * Record that a Remote Operator installation's setup was re-applied
    *
    * @remarks
-   * Records the permissions compiled from the currently enabled operations as the installation's installed permissions. Call it after re-applying the installation's Helm release, manifest, cloud access, or CloudFormation stack.
+   * Records the permissions compiled from every built-in operation plugin as the installation's installed permissions. Call it after re-applying the installation's Helm release, manifest, cloud access, or CloudFormation stack.
    */
   async acceptRemoteOperatorPermissions(
     request: operations.AcceptRemoteOperatorPermissionsRequest,