npm - @alienplatform/platform-api - Versions diffs - 3.3.40 → 3.3.42-dev.6e3a661b219b3886d55014b3cef8af0ecdcc65fe - Mend

@alienplatform/platform-api 3.3.40 → 3.3.42-dev.6e3a661b219b3886d55014b3cef8af0ecdcc65fe

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1213) hide show

package/README.md CHANGED Viewed

@@ -175,10 +175,18 @@ run();
 * [getWorkspaceInviteLink](docs/sdks/alien/README.md#getworkspaceinvitelink)
 * [createWorkspaceInviteLink](docs/sdks/alien/README.md#createworkspaceinvitelink)
 * [revokeWorkspaceInviteLink](docs/sdks/alien/README.md#revokeworkspaceinvitelink)
+* [prepareDeploymentInstallation](docs/sdks/alien/README.md#preparedeploymentinstallation)
+* [getDeploymentPreparation](docs/sdks/alien/README.md#getdeploymentpreparation)
+* [getInstallationDeployment](docs/sdks/alien/README.md#getinstallationdeployment)
+* [resumeDeploymentInstallation](docs/sdks/alien/README.md#resumedeploymentinstallation)
+* [requestDeploymentCheck](docs/sdks/alien/README.md#requestdeploymentcheck)
+* [getDeploymentMetricsHistory](docs/sdks/alien/README.md#getdeploymentmetricshistory) - Metrics Horizon reported for each replica, from the deployment's heartbeats in [from, to): the latest sample per replica per bucket, with empty buckets as null. Kept for 30 days, best effort.
 * [getDeploymentCredentialRotation](docs/sdks/alien/README.md#getdeploymentcredentialrotation)
 * [prepareDeploymentCredentialRotation](docs/sdks/alien/README.md#preparedeploymentcredentialrotation)
 * [cancelDeploymentCredentialRotation](docs/sdks/alien/README.md#canceldeploymentcredentialrotation)
 * [getDeploymentCredentialRotationValues](docs/sdks/alien/README.md#getdeploymentcredentialrotationvalues)
+* [claimAwsXksStoreRetirement](docs/sdks/alien/README.md#claimawsxksstoreretirement)
+* [completeAwsXksStoreRetirement](docs/sdks/alien/README.md#completeawsxksstoreretirement)
 * [listAwsVirtualKeys](docs/sdks/alien/README.md#listawsvirtualkeys)
 * [createAwsVirtualKey](docs/sdks/alien/README.md#createawsvirtualkey)
 * [rotateAwsVirtualKeyCredential](docs/sdks/alien/README.md#rotateawsvirtualkeycredential)
@@ -187,6 +195,10 @@ run();
 * [decommissionAwsVirtualKey](docs/sdks/alien/README.md#decommissionawsvirtualkey)
 * [getAwsVirtualKey](docs/sdks/alien/README.md#getawsvirtualkey)
 * [continueAwsVirtualKey](docs/sdks/alien/README.md#continueawsvirtualkey)
+* [listAwsKeySetupCleanup](docs/sdks/alien/README.md#listawskeysetupcleanup)
+* [acceptAwsKeySetup](docs/sdks/alien/README.md#acceptawskeysetup)
+* [acceptTerraformKeySetup](docs/sdks/alien/README.md#acceptterraformkeysetup)
+* [getTerraformKeySetupOperation](docs/sdks/alien/README.md#getterraformkeysetupoperation)
 ### [AgentSessions](docs/sdks/agentsessions/README.md)
@@ -210,8 +222,8 @@ run();
 ### [Billing](docs/sdks/billing/README.md)
-* [listAuditLog](docs/sdks/billing/README.md#listauditlog) - List billing activity entries for the current workspace.
 * [getEntitlements](docs/sdks/billing/README.md#getentitlements) - Get the workspace billing entitlements used for product feature gates. Autumn is the source of truth; the response is served through the workspace billing read model with stale-cache fallback.
+* [sync](docs/sdks/billing/README.md#sync) - Refresh the workspace billing entitlements from Autumn now, for example right after checkout, instead of waiting for Autumn's billing webhook. Workspace admins only. Calls within a few seconds share one refresh.
 ### [CloudRegions](docs/sdks/cloudregions/README.md)
@@ -269,6 +281,7 @@ run();
 * [deleteDeploymentGroup](docs/sdks/deploymentgroups/README.md#deletedeploymentgroup) - Delete deployment group
 * [setDeploymentGroupExternalId](docs/sdks/deploymentgroups/README.md#setdeploymentgroupexternalid) - Set or clear a deployment group's external ID
 * [createToken](docs/sdks/deploymentgroups/README.md#createtoken) - Create deployment group token
+* [getDeploymentGroupManagementExternalId](docs/sdks/deploymentgroups/README.md#getdeploymentgroupmanagementexternalid) - Get the AWS ExternalId for this deployment group
 * [createFirstPartyDeploymentSession](docs/sdks/deploymentgroups/README.md#createfirstpartydeploymentsession) - Create first-party deployment session
 * [getExternalAIBinding](docs/sdks/deploymentgroups/README.md#getexternalaibinding) - Get external AI connection state
 * [putExternalAIBinding](docs/sdks/deploymentgroups/README.md#putexternalaibinding) - Connect or rotate an external AI provider key
@@ -280,7 +293,7 @@ run();
 * [move](docs/sdks/deployments/README.md#move) - Reassign a deployment to another group within its project
 * [list](docs/sdks/deployments/README.md#list) - Retrieve all deployments.
-* [create](docs/sdks/deployments/README.md#create) - Create a new deployment. Deployment group tokens automatically use their group. Workspace/project tokens must provide deploymentGroupId.
+* [create](docs/sdks/deployments/README.md#create) - Create a new deployment. Deployment group tokens automatically use their group. Workspace/project tokens must provide deploymentGroupId or deploymentGroupExternalId. Pending installation retries keep the originally reserved release and CloudFormation stack name, even after a new release is published. Other installation options must remain unchanged.
 * [getStats](docs/sdks/deployments/README.md#getstats) - Get aggregated deployment statistics. Returns total count and breakdown by status.
 * [listFilterEnvironments](docs/sdks/deployments/README.md#listfilterenvironments) - List distinct effective environments used by deployments. Used for filter dropdowns.
 * [listFilterDeploymentGroups](docs/sdks/deployments/README.md#listfilterdeploymentgroups) - List deployment groups with deployment counts. Used for filter dropdowns.
@@ -289,6 +302,7 @@ run();
 * [getInfo](docs/sdks/deployments/README.md#getinfo) - Get deployment connection information including command endpoint and resource URLs.
 * [import](docs/sdks/deployments/README.md#import) - Import a deployment from resolved setup infrastructure such as CloudFormation, Terraform, or Helm.
 * [setFirstPartyDeploymentInputs](docs/sdks/deployments/README.md#setfirstpartydeploymentinputs) - Store operator-provided input values on a first-party deployment session token so CLI/local deploys apply them.
+* [reportDeploymentSetupProgress](docs/sdks/deployments/README.md#reportdeploymentsetupprogress) - Record that a reserved CloudFormation setup started its stack, or that AWS rolled the stack back before it registered. Called by the template's DeploymentSetupStarted resource with the reservation's deployment credential.
 * [createSetupRegistrationOperation](docs/sdks/deployments/README.md#createsetupregistrationoperation) - Start a durable setup registration operation for CloudFormation, Terraform, or Helm.
 * [getSetupRegistrationOperation](docs/sdks/deployments/README.md#getsetupregistrationoperation) - Get setup registration operation status.
 * [delete](docs/sdks/deployments/README.md#delete) - Delete, detach, or forget a deployment by ID.
@@ -298,7 +312,7 @@ run();
 * [retry](docs/sdks/deployments/README.md#retry) - Retry a failed deployment operation. Uses alien-infra's retry mechanisms to resume from exact failure point.
 * [getInputs](docs/sdks/deployments/README.md#getinputs) - Get the active input definitions and current non-secret values for a deployment.
 * [updateInputs](docs/sdks/deployments/README.md#updateinputs) - Update runtime stack inputs, rebuild their environment-variable mappings, and request a deployment update when runtime configuration changes.
-* [updateCompute](docs/sdks/deployments/README.md#updatecompute) - Update deployment-time compute pool selections and request reconciliation by the hosted manager.
+* [updateCompute](docs/sdks/deployments/README.md#updatecompute) - Update deployment-time compute selections or quota warning overrides and request reconciliation by the hosted manager.
 * [updateEnvironmentVariables](docs/sdks/deployments/README.md#updateenvironmentvariables) - Replace a deployment's advanced environment variables. Stack-input-backed variables are write-only through the input endpoint. If the deployment is running and not locked, the status will be changed to update-pending to trigger a deployment.
 * [createToken](docs/sdks/deployments/README.md#createtoken) - Create a deployment token (deployment-scoped API key). The deployment must exist before creating a token.
 * [listMachines](docs/sdks/deployments/README.md#listmachines)
@@ -385,10 +399,6 @@ run();
 * [getAccessRequestActivity](docs/sdks/operations/README.md#getaccessrequestactivity) - The operation commands and debug sessions an access request authorized, with each command's verification outcome. Authorized like getAccessRequest.
 * [revokeAccessRequest](docs/sdks/operations/README.md#revokeaccessrequest) - Revoke a pending, queued or customer-approved access request. The principal that created the request, or any workspace member or administrator who can read its project, may revoke it. Commands the grant authorized that have not been dispatched are failed; dispatched commands finish. Linked debug sessions are stopped and refuse their next request. Revoking an already revoked request returns it unchanged.
 * [getAccessRequest](docs/sdks/operations/README.md#getaccessrequest) - Get an access request by id.
-* [~~setBuiltinPlugins~~](docs/sdks/operations/README.md#setbuiltinplugins) - Replace the complete set of enabled built-in operations plugins for a project. Returns the cloud permission delta versus the previously enabled set. :warning: **Deprecated**
-* [~~setPluginEnabled~~](docs/sdks/operations/README.md#setpluginenabled) - Enable or disable an operations plugin (builtin or custom) for a project. Only enabled plugins are distributed to Operators and can be invoked. Returns the cloud permission delta versus the previously enabled set. With `dryRun`, validates the change and returns the delta without saving it. :warning: **Deprecated**
-* [~~getPolicy~~](docs/sdks/operations/README.md#getpolicy) - Get a project's per-command approval policy. Mirrors what the operator enforces: `plugin/operation` / `plugin/*` / `*` patterns → auto | manual. :warning: **Deprecated**
-* [~~updatePolicy~~](docs/sdks/operations/README.md#updatepolicy) - Replace a project's per-command approval policy (full rule set). Patterns are `plugin/operation`, `plugin/*`, or `*`; each maps to auto | manual. :warning: **Deprecated**
 ### [OperatorManifests](docs/sdks/operatormanifests/README.md)
@@ -428,7 +438,7 @@ run();
 * [configureKeys](docs/sdks/projects/README.md#configurekeys) - Enable customer-owned application encryption without requiring an application Release.
 * [configureBuckets](docs/sdks/projects/README.md#configurebuckets) - Enable buckets without requiring a project Release.
 * [configureRegistry](docs/sdks/projects/README.md#configureregistry) - Enable customer-owned container registries without requiring an application Release.
-* [configureRemoteSandbox](docs/sdks/projects/README.md#configureremotesandbox) - Enable a customer-owned sandbox a hosted caller can drive through Remote Bindings. Without a custom image it publishes to every cloud on Alien's default image, which the project then follows. A custom image publishes to AWS; a public one with a linux/amd64 variant also publishes to Azure, and to GCP once Alien has built its GCP image.
+* [configureRemoteSandbox](docs/sdks/projects/README.md#configureremotesandbox) - Enable a customer-owned sandbox a hosted caller can drive through Remote Bindings. Without a custom image it publishes to every cloud on Alien's default image, which the project then follows. A custom image publishes to AWS; a public one with a linux/amd64 variant also publishes to Azure, and to GCP once Alien has built its GCP image; a private one publishes to Azure from its `azureImage` and to GCP from its `gcpImage`.
 * [ensureSandboxBaseImageRepository](docs/sdks/projects/README.md#ensuresandboxbaseimagerepository) - Ensure the project's private image repository exists and return where to push a private sandbox base image. Name the pushed image as the remote sandbox base image afterwards.
 * [getCapabilityOverview](docs/sdks/projects/README.md#getcapabilityoverview) - Get safe, server-derived capability status for a Project.
 * [getRemoteOperatorSummary](docs/sdks/projects/README.md#getremoteoperatorsummary) - Get the authoritative Remote Operator project summary
@@ -448,10 +458,11 @@ run();
 * [list](docs/sdks/releases/README.md#list) - Retrieve all releases.
 * [create](docs/sdks/releases/README.md#create) - Create a new release.
-* [listBranches](docs/sdks/releases/README.md#listbranches) - List distinct git branches across releases. Used for filter dropdowns.
-* [listAuthors](docs/sdks/releases/README.md#listauthors) - List distinct commit authors across releases. Used for filter dropdowns.
+* [listBranches](docs/sdks/releases/README.md#listbranches) - List distinct git branches across releases. Used for filter dropdowns. Empty for deployment and deployment-group tokens.
+* [listAuthors](docs/sdks/releases/README.md#listauthors) - List distinct commit authors across releases. Used for filter dropdowns. Empty for deployment and deployment-group tokens.
 * [get](docs/sdks/releases/README.md#get) - Retrieve a release by ID.
 * [listDeployments](docs/sdks/releases/README.md#listdeployments) - List the project's deployments with their rollout state relative to this release.
+* [listChannelImpact](docs/sdks/releases/README.md#listchannelimpact) - List the project's release channels with what each runs now and what promoting this release to it would change.
 * [promote](docs/sdks/releases/README.md#promote)
 ### [RemoteBindings](docs/sdks/remotebindings/README.md)
@@ -485,6 +496,7 @@ run();
 * [list](docs/sdks/sync/README.md#list) - List full deployment records for manager operational loops. This endpoint is intentionally separate from the public deployments list, which returns lightweight UI rows.
 * [context](docs/sdks/sync/README.md#context) - Get computed deployment state and configuration for a manager-side operation without acquiring the deployment reconciliation lock.
+* [managementExternalId](docs/sdks/sync/README.md#managementexternalid) - Get the AWS sts:ExternalId the deployment's management and remote-bindings roles trust. Only the manager runtime assigned to the deployment can read it.
 * [acquire](docs/sdks/sync/README.md#acquire) - Acquire a batch of deployments for processing. Used by Manager to atomically lock deployments matching filters. Each deployment in the batch must be released after processing.
 * [reconcile](docs/sdks/sync/README.md#reconcile) - Reconcile deployment state. Push model requests that include a session verify lock ownership. Pull model state reports are accepted as authz-gated agent progress even when they carry an agent-sync session. Accepts full DeploymentState after step() execution.
 * [renew](docs/sdks/sync/README.md#renew)
@@ -501,12 +513,25 @@ run();
 * [syncGitNamespaces](docs/sdks/user/README.md#syncgitnamespaces) - Sync git namespaces from the provider. For GitHub, this fetches all app installations accessible to the user.
 * [listGitNamespaceRepositories](docs/sdks/user/README.md#listgitnamespacerepositories) - List repositories accessible through a git namespace (GitHub installation).
+### [Webhooks](docs/sdks/webhooks/README.md)
+* [listWebhookEndpoints](docs/sdks/webhooks/README.md#listwebhookendpoints)
+* [createWebhookEndpoint](docs/sdks/webhooks/README.md#createwebhookendpoint) - Create an endpoint. Invalid delivery-service configuration returns 400 with the validation reason.
+* [getWebhookEndpoint](docs/sdks/webhooks/README.md#getwebhookendpoint)
+* [updateWebhookEndpoint](docs/sdks/webhooks/README.md#updatewebhookendpoint)
+* [deleteWebhookEndpoint](docs/sdks/webhooks/README.md#deletewebhookendpoint) - Delete an endpoint idempotently. An endpoint that is already absent returns success. Deleting the last workspace endpoint stops capturing new webhook events.
+* [getWebhookSigningSecret](docs/sdks/webhooks/README.md#getwebhooksigningsecret)
+* [rotateWebhookSigningSecret](docs/sdks/webhooks/README.md#rotatewebhooksigningsecret)
+* [listWebhookDeliveries](docs/sdks/webhooks/README.md#listwebhookdeliveries)
+* [retryWebhookDelivery](docs/sdks/webhooks/README.md#retrywebhookdelivery)
+* [testWebhookEndpoint](docs/sdks/webhooks/README.md#testwebhookendpoint)
 ### [Workspaces](docs/sdks/workspaces/README.md)
 * [list](docs/sdks/workspaces/README.md#list) - Retrieve all workspaces.
 * [get](docs/sdks/workspaces/README.md#get) - Retrieve a workspace by ID.
 * [update](docs/sdks/workspaces/README.md#update) - Update a workspace.
-* [delete](docs/sdks/workspaces/README.md#delete) - Delete a workspace. The workspace must have no projects.
+* [delete](docs/sdks/workspaces/README.md#delete) - Delete a workspace. The workspace must have no projects and must not be on pay as you go or a contract.
 * [listMembers](docs/sdks/workspaces/README.md#listmembers) - List all members of a workspace.
 * [addMember](docs/sdks/workspaces/README.md#addmember) - Add a member to a workspace by email. The user must already have an account.
 * [updateMember](docs/sdks/workspaces/README.md#updatemember) - Update a workspace member's role.
@@ -532,6 +557,8 @@ To read more about standalone functions, check [FUNCTIONS.md](./FUNCTIONS.md).
 <summary>Available standalone functions</summary>
+- [`acceptAwsKeySetup`](docs/sdks/alien/README.md#acceptawskeysetup)
+- [`acceptTerraformKeySetup`](docs/sdks/alien/README.md#acceptterraformkeysetup)
 - [`acceptWorkspaceInvitation`](docs/sdks/alien/README.md#acceptworkspaceinvitation)
 - [`agentSessionsEvents`](docs/sdks/agentsessions/README.md#events) - Incrementally read a session's event log (steps, tool calls, report deltas, approvals, status transitions). Pass the previous response's `latestSeq` as `after` to fetch only new events.
 - [`agentSessionsGet`](docs/sdks/agentsessions/README.md#get) - Retrieve one ai-agent monitor session by id.
@@ -545,8 +572,9 @@ To read more about standalone functions, check [FUNCTIONS.md](./FUNCTIONS.md).
 - [`apiKeysUpdate`](docs/sdks/apikeys/README.md#update) - Update an API key (enable/disable, change description).
 - [`authWhoami`](docs/sdks/auth/README.md#whoami) - Get the current authenticated principal (user or service account). Works with both session cookies and API keys.
 - [`billingGetEntitlements`](docs/sdks/billing/README.md#getentitlements) - Get the workspace billing entitlements used for product feature gates. Autumn is the source of truth; the response is served through the workspace billing read model with stale-cache fallback.
-- [`billingListAuditLog`](docs/sdks/billing/README.md#listauditlog) - List billing activity entries for the current workspace.
+- [`billingSync`](docs/sdks/billing/README.md#sync) - Refresh the workspace billing entitlements from Autumn now, for example right after checkout, instead of waiting for Autumn's billing webhook. Workspace admins only. Calls within a few seconds share one refresh.
 - [`cancelDeploymentCredentialRotation`](docs/sdks/alien/README.md#canceldeploymentcredentialrotation)
+- [`claimAwsXksStoreRetirement`](docs/sdks/alien/README.md#claimawsxksstoreretirement)
 - [`cloudRegionsGet`](docs/sdks/cloudregions/README.md#get) - Get cloud regions supported by this Alien environment.
 - [`commandsBootstrap`](docs/sdks/commands/README.md#bootstrap) - Resolve a deployment's current manager and mint a five-minute command capability. Sender tokens can dispatch and observe commands only for this deployment. Receiver tokens can lease and complete commands only for the resolved Container or Daemon target.
 - [`commandsComplete`](docs/sdks/commands/README.md#complete) - Atomically transition a command to a terminal state (SUCCEEDED, FAILED, or EXPIRED) unless it is already terminal. Returns whether the transition was applied.
@@ -559,6 +587,7 @@ To read more about standalone functions, check [FUNCTIONS.md](./FUNCTIONS.md).
 - [`commandsListNames`](docs/sdks/commands/README.md#listnames) - List distinct command names. Use for filter dropdowns in the dashboard.
 - [`commandsResolveTarget`](docs/sdks/commands/README.md#resolvetarget) - Resolve which resource a command for this deployment would be addressed to, and how it would be delivered. Fails when the deployment has no command-capable resources, or more than one and no explicit target was named.
 - [`commandsUpdate`](docs/sdks/commands/README.md#update) - Update command state. Called by manager when command is dispatched or completes.
+- [`completeAwsXksStoreRetirement`](docs/sdks/alien/README.md#completeawsxksstoreretirement)
 - [`containerRegistryApplyContainerRegistryManagerSnapshot`](docs/sdks/containerregistry/README.md#applycontainerregistrymanagersnapshot)
 - [`containerRegistryCreateContainerRegistryCredential`](docs/sdks/containerregistry/README.md#createcontainerregistrycredential)
 - [`containerRegistryCreateContainerRegistryRepository`](docs/sdks/containerregistry/README.md#createcontainerregistryrepository)
@@ -589,6 +618,7 @@ To read more about standalone functions, check [FUNCTIONS.md](./FUNCTIONS.md).
 - [`deploymentGroupsEnsureDeploymentGroupByName`](docs/sdks/deploymentgroups/README.md#ensuredeploymentgroupbyname) - Get or create a deployment group by project and name
 - [`deploymentGroupsGetDeploymentGroup`](docs/sdks/deploymentgroups/README.md#getdeploymentgroup) - Get deployment group details
 - [`deploymentGroupsGetDeploymentGroupByExternalId`](docs/sdks/deploymentgroups/README.md#getdeploymentgroupbyexternalid) - Get a deployment group by project and external ID
+- [`deploymentGroupsGetDeploymentGroupManagementExternalId`](docs/sdks/deploymentgroups/README.md#getdeploymentgroupmanagementexternalid) - Get the AWS ExternalId for this deployment group
 - [`deploymentGroupsGetExternalAIBinding`](docs/sdks/deploymentgroups/README.md#getexternalaibinding) - Get external AI connection state
 - [`deploymentGroupsGetExternalAIModelCheck`](docs/sdks/deploymentgroups/README.md#getexternalaimodelcheck) - Get an external model access check
 - [`deploymentGroupsListDeploymentGroups`](docs/sdks/deploymentgroups/README.md#listdeploymentgroups) - List deployment groups
@@ -598,7 +628,7 @@ To read more about standalone functions, check [FUNCTIONS.md](./FUNCTIONS.md).
 - [`deploymentPlanCompute`](docs/sdks/deployment/README.md#plancompute) - Plan deployment compute for the active release before stack preparation. The response contains recommended machine and scale choices for cloud compute pools.
 - [`deploymentPrepareStack`](docs/sdks/deployment/README.md#preparestack) - Prepare the active release stack for a deployment portal setup session. The response contains the generated stack shape plus setup compatibility metadata.
 - [`deploymentsCancelVolumeRestore`](docs/sdks/deployments/README.md#cancelvolumerestore) - Cancel a pending volume restore. Use it when a restore keeps failing: the deployment stops attempting it. A restore whose volume was already swapped still finishes. Allowed in any deployment status, including update-failed.
-- [`deploymentsCreate`](docs/sdks/deployments/README.md#create) - Create a new deployment. Deployment group tokens automatically use their group. Workspace/project tokens must provide deploymentGroupId.
+- [`deploymentsCreate`](docs/sdks/deployments/README.md#create) - Create a new deployment. Deployment group tokens automatically use their group. Workspace/project tokens must provide deploymentGroupId or deploymentGroupExternalId. Pending installation retries keep the originally reserved release and CloudFormation stack name, even after a new release is published. Other installation options must remain unchanged.
 - [`deploymentsCreateSetupRegistrationOperation`](docs/sdks/deployments/README.md#createsetupregistrationoperation) - Start a durable setup registration operation for CloudFormation, Terraform, or Helm.
 - [`deploymentsCreateToken`](docs/sdks/deployments/README.md#createtoken) - Create a deployment token (deployment-scoped API key). The deployment must exist before creating a token.
 - [`deploymentsDelete`](docs/sdks/deployments/README.md#delete) - Delete, detach, or forget a deployment by ID.
@@ -617,11 +647,12 @@ To read more about standalone functions, check [FUNCTIONS.md](./FUNCTIONS.md).
 - [`deploymentsMove`](docs/sdks/deployments/README.md#move) - Reassign a deployment to another group within its project
 - [`deploymentsPinRelease`](docs/sdks/deployments/README.md#pinrelease) - Pin or unpin a running or runtime-failed deployment. Running deployments start an update; failed deployments retry toward the selected release.
 - [`deploymentsRedeploy`](docs/sdks/deployments/README.md#redeploy) - Redeploy a running deployment with the same release and fresh environment variables. Sets status to update-pending.
+- [`deploymentsReportDeploymentSetupProgress`](docs/sdks/deployments/README.md#reportdeploymentsetupprogress) - Record that a reserved CloudFormation setup started its stack, or that AWS rolled the stack back before it registered. Called by the template's DeploymentSetupStarted resource with the reservation's deployment credential.
 - [`deploymentsRestoreVolume`](docs/sdks/deployments/README.md#restorevolume) - Replace one replica's persistent volume with a new volume made from a snapshot. The deployment must be running (an update may already be queued or in progress). The replica is stopped while its volume is swapped, and the replaced volume is snapshotted before it is deleted.
 - [`deploymentsRetry`](docs/sdks/deployments/README.md#retry) - Retry a failed deployment operation. Uses alien-infra's retry mechanisms to resume from exact failure point.
 - [`deploymentsSetFirstPartyDeploymentInputs`](docs/sdks/deployments/README.md#setfirstpartydeploymentinputs) - Store operator-provided input values on a first-party deployment session token so CLI/local deploys apply them.
 - [`deploymentsSetReleaseChannel`](docs/sdks/deployments/README.md#setreleasechannel)
-- [`deploymentsUpdateCompute`](docs/sdks/deployments/README.md#updatecompute) - Update deployment-time compute pool selections and request reconciliation by the hosted manager.
+- [`deploymentsUpdateCompute`](docs/sdks/deployments/README.md#updatecompute) - Update deployment-time compute selections or quota warning overrides and request reconciliation by the hosted manager.
 - [`deploymentsUpdateEnvironmentVariables`](docs/sdks/deployments/README.md#updateenvironmentvariables) - Replace a deployment's advanced environment variables. Stack-input-backed variables are write-only through the input endpoint. If the deployment is running and not locked, the status will be changed to update-pending to trigger a deployment.
 - [`deploymentsUpdateInputs`](docs/sdks/deployments/README.md#updateinputs) - Update runtime stack inputs, rebuild their environment-variable mappings, and request a deployment update when runtime configuration changes.
 - [`domainsCreate`](docs/sdks/domains/README.md#create) - Create a workspace domain and optional initial endpoints.
@@ -642,13 +673,18 @@ To read more about standalone functions, check [FUNCTIONS.md](./FUNCTIONS.md).
 - [`getAwsVirtualKey`](docs/sdks/alien/README.md#getawsvirtualkey)
 - [`getDeploymentCredentialRotation`](docs/sdks/alien/README.md#getdeploymentcredentialrotation)
 - [`getDeploymentCredentialRotationValues`](docs/sdks/alien/README.md#getdeploymentcredentialrotationvalues)
+- [`getDeploymentMetricsHistory`](docs/sdks/alien/README.md#getdeploymentmetricshistory) - Metrics Horizon reported for each replica, from the deployment's heartbeats in [from, to): the latest sample per replica per bucket, with empty buckets as null. Kept for 30 days, best effort.
+- [`getDeploymentPreparation`](docs/sdks/alien/README.md#getdeploymentpreparation)
+- [`getInstallationDeployment`](docs/sdks/alien/README.md#getinstallationdeployment)
 - [`getLogExportDeliveryConfig`](docs/sdks/alien/README.md#getlogexportdeliveryconfig)
 - [`getPendingWorkspaceInvitation`](docs/sdks/alien/README.md#getpendingworkspaceinvitation)
 - [`getProjectLogExport`](docs/sdks/alien/README.md#getprojectlogexport)
+- [`getTerraformKeySetupOperation`](docs/sdks/alien/README.md#getterraformkeysetupoperation)
 - [`getWorkspaceInvitationPreview`](docs/sdks/alien/README.md#getworkspaceinvitationpreview)
 - [`getWorkspaceInviteLink`](docs/sdks/alien/README.md#getworkspaceinvitelink)
 - [`incidentsGet`](docs/sdks/incidents/README.md#get) - Get an authorized incident without Slack transport metadata.
 - [`incidentsList`](docs/sdks/incidents/README.md#list) - List authorized incidents without Slack transport metadata.
+- [`listAwsKeySetupCleanup`](docs/sdks/alien/README.md#listawskeysetupcleanup)
 - [`listAwsVirtualKeys`](docs/sdks/alien/README.md#listawsvirtualkeys)
 - [`listWorkspaceInvitations`](docs/sdks/alien/README.md#listworkspaceinvitations)
 - [`machinesCancelMachineDrain`](docs/sdks/machines/README.md#cancelmachinedrain)
@@ -700,6 +736,7 @@ To read more about standalone functions, check [FUNCTIONS.md](./FUNCTIONS.md).
 - [`packagesList`](docs/sdks/packages/README.md#list) - List packages with optional filters. Returns packages ordered by creation date (newest first).
 - [`packagesRebuild`](docs/sdks/packages/README.md#rebuild) - Rebuild packages for a project. This will cancel any pending packages and create new ones with auto-incremented versions.
 - [`prepareDeploymentCredentialRotation`](docs/sdks/alien/README.md#preparedeploymentcredentialrotation)
+- [`prepareDeploymentInstallation`](docs/sdks/alien/README.md#preparedeploymentinstallation)
 - [`projectsAcceptRemoteOperatorImage`](docs/sdks/projects/README.md#acceptremoteoperatorimage) - Accept a reported image for a Remote Operator installation
 - [`projectsAcceptRemoteOperatorPermissions`](docs/sdks/projects/README.md#acceptremoteoperatorpermissions) - Record that a Remote Operator installation's setup was re-applied
 - [`projectsConfigureAiProviderHeaders`](docs/sdks/projects/README.md#configureaiproviderheaders) - Replace the static headers added to AI requests for each provider.
@@ -708,7 +745,7 @@ To read more about standalone functions, check [FUNCTIONS.md](./FUNCTIONS.md).
 - [`projectsConfigureKeys`](docs/sdks/projects/README.md#configurekeys) - Enable customer-owned application encryption without requiring an application Release.
 - [`projectsConfigureModels`](docs/sdks/projects/README.md#configuremodels) - Configure customer-owned model providers without requiring an application Release.
 - [`projectsConfigureRegistry`](docs/sdks/projects/README.md#configureregistry) - Enable customer-owned container registries without requiring an application Release.
-- [`projectsConfigureRemoteSandbox`](docs/sdks/projects/README.md#configureremotesandbox) - Enable a customer-owned sandbox a hosted caller can drive through Remote Bindings. Without a custom image it publishes to every cloud on Alien's default image, which the project then follows. A custom image publishes to AWS; a public one with a linux/amd64 variant also publishes to Azure, and to GCP once Alien has built its GCP image.
+- [`projectsConfigureRemoteSandbox`](docs/sdks/projects/README.md#configureremotesandbox) - Enable a customer-owned sandbox a hosted caller can drive through Remote Bindings. Without a custom image it publishes to every cloud on Alien's default image, which the project then follows. A custom image publishes to AWS; a public one with a linux/amd64 variant also publishes to Azure, and to GCP once Alien has built its GCP image; a private one publishes to Azure from its `azureImage` and to GCP from its `gcpImage`.
 - [`projectsConfigureSource`](docs/sdks/projects/README.md#configuresource) - Connect a GitHub repository or Alien template to an existing project.
 - [`projectsCreate`](docs/sdks/projects/README.md#create) - Create a new project.
 - [`projectsCreateFromTemplate`](docs/sdks/projects/README.md#createfromtemplate) - Create a project by forking alienplatform/alien into your namespace.
@@ -737,12 +774,14 @@ To read more about standalone functions, check [FUNCTIONS.md](./FUNCTIONS.md).
 - [`releasesCreate`](docs/sdks/releases/README.md#create) - Create a new release.
 - [`releasesGet`](docs/sdks/releases/README.md#get) - Retrieve a release by ID.
 - [`releasesList`](docs/sdks/releases/README.md#list) - Retrieve all releases.
-- [`releasesListAuthors`](docs/sdks/releases/README.md#listauthors) - List distinct commit authors across releases. Used for filter dropdowns.
-- [`releasesListBranches`](docs/sdks/releases/README.md#listbranches) - List distinct git branches across releases. Used for filter dropdowns.
+- [`releasesListAuthors`](docs/sdks/releases/README.md#listauthors) - List distinct commit authors across releases. Used for filter dropdowns. Empty for deployment and deployment-group tokens.
+- [`releasesListBranches`](docs/sdks/releases/README.md#listbranches) - List distinct git branches across releases. Used for filter dropdowns. Empty for deployment and deployment-group tokens.
+- [`releasesListChannelImpact`](docs/sdks/releases/README.md#listchannelimpact) - List the project's release channels with what each runs now and what promoting this release to it would change.
 - [`releasesListDeployments`](docs/sdks/releases/README.md#listdeployments) - List the project's deployments with their rollout state relative to this release.
 - [`releasesPromote`](docs/sdks/releases/README.md#promote)
 - [`remoteBindingsCreateExternalAccess`](docs/sdks/remotebindings/README.md#createexternalaccess) - Create short-lived Remote Bindings access for a external resource
 - [`reportLogExportDelivery`](docs/sdks/alien/README.md#reportlogexportdelivery)
+- [`requestDeploymentCheck`](docs/sdks/alien/README.md#requestdeploymentcheck)
 - [`resendWorkspaceInvitation`](docs/sdks/alien/README.md#resendworkspaceinvitation)
 - [`resolveResolve`](docs/sdks/resolve/README.md#resolve) - Resolve manager for a project and platform
 - [`resourcesGetDeploymentDetail`](docs/sdks/resources/README.md#getdeploymentdetail)
@@ -750,6 +789,7 @@ To read more about standalone functions, check [FUNCTIONS.md](./FUNCTIONS.md).
 - [`resourcesListInventory`](docs/sdks/resources/README.md#listinventory)
 - [`resourcesListOverview`](docs/sdks/resources/README.md#listoverview)
 - [`restoreAwsVirtualKey`](docs/sdks/alien/README.md#restoreawsvirtualkey)
+- [`resumeDeploymentInstallation`](docs/sdks/alien/README.md#resumedeploymentinstallation)
 - [`revokeWorkspaceInvitation`](docs/sdks/alien/README.md#revokeworkspaceinvitation)
 - [`revokeWorkspaceInviteLink`](docs/sdks/alien/README.md#revokeworkspaceinvitelink)
 - [`rotateAwsVirtualKeyCredential`](docs/sdks/alien/README.md#rotateawsvirtualkeycredential)
@@ -762,6 +802,7 @@ To read more about standalone functions, check [FUNCTIONS.md](./FUNCTIONS.md).
 - [`syncAcquire`](docs/sdks/sync/README.md#acquire) - Acquire a batch of deployments for processing. Used by Manager to atomically lock deployments matching filters. Each deployment in the batch must be released after processing.
 - [`syncContext`](docs/sdks/sync/README.md#context) - Get computed deployment state and configuration for a manager-side operation without acquiring the deployment reconciliation lock.
 - [`syncList`](docs/sdks/sync/README.md#list) - List full deployment records for manager operational loops. This endpoint is intentionally separate from the public deployments list, which returns lightweight UI rows.
+- [`syncManagementExternalId`](docs/sdks/sync/README.md#managementexternalid) - Get the AWS sts:ExternalId the deployment's management and remote-bindings roles trust. Only the manager runtime assigned to the deployment can read it.
 - [`syncReconcile`](docs/sdks/sync/README.md#reconcile) - Reconcile deployment state. Push model requests that include a session verify lock ownership. Pull model state reports are accepted as authz-gated agent progress even when they carry an agent-sync session. Accepts full DeploymentState after step() execution.
 - [`syncRelease`](docs/sdks/sync/README.md#release) - Release a deployment lock. Must be called after processing an acquired deployment, even if processing failed. This is critical to avoid deadlocks.
 - [`syncRenew`](docs/sdks/sync/README.md#renew)
@@ -775,8 +816,18 @@ To read more about standalone functions, check [FUNCTIONS.md](./FUNCTIONS.md).
 - [`userListMemberships`](docs/sdks/user/README.md#listmemberships) - List all workspaces the current user has access to.
 - [`userSyncGitNamespaces`](docs/sdks/user/README.md#syncgitnamespaces) - Sync git namespaces from the provider. For GitHub, this fetches all app installations accessible to the user.
 - [`userUpdateProfile`](docs/sdks/user/README.md#updateprofile) - Update the current user's profile (display name).
+- [`webhooksCreateWebhookEndpoint`](docs/sdks/webhooks/README.md#createwebhookendpoint) - Create an endpoint. Invalid delivery-service configuration returns 400 with the validation reason.
+- [`webhooksDeleteWebhookEndpoint`](docs/sdks/webhooks/README.md#deletewebhookendpoint) - Delete an endpoint idempotently. An endpoint that is already absent returns success. Deleting the last workspace endpoint stops capturing new webhook events.
+- [`webhooksGetWebhookEndpoint`](docs/sdks/webhooks/README.md#getwebhookendpoint)
+- [`webhooksGetWebhookSigningSecret`](docs/sdks/webhooks/README.md#getwebhooksigningsecret)
+- [`webhooksListWebhookDeliveries`](docs/sdks/webhooks/README.md#listwebhookdeliveries)
+- [`webhooksListWebhookEndpoints`](docs/sdks/webhooks/README.md#listwebhookendpoints)
+- [`webhooksRetryWebhookDelivery`](docs/sdks/webhooks/README.md#retrywebhookdelivery)
+- [`webhooksRotateWebhookSigningSecret`](docs/sdks/webhooks/README.md#rotatewebhooksigningsecret)
+- [`webhooksTestWebhookEndpoint`](docs/sdks/webhooks/README.md#testwebhookendpoint)
+- [`webhooksUpdateWebhookEndpoint`](docs/sdks/webhooks/README.md#updatewebhookendpoint)
 - [`workspacesAddMember`](docs/sdks/workspaces/README.md#addmember) - Add a member to a workspace by email. The user must already have an account.
-- [`workspacesDelete`](docs/sdks/workspaces/README.md#delete) - Delete a workspace. The workspace must have no projects.
+- [`workspacesDelete`](docs/sdks/workspaces/README.md#delete) - Delete a workspace. The workspace must have no projects and must not be on pay as you go or a contract.
 - [`workspacesGet`](docs/sdks/workspaces/README.md#get) - Retrieve a workspace by ID.
 - [`workspacesGetSettings`](docs/sdks/workspaces/README.md#getsettings) - Read the ai-agent settings for a workspace. Returns defaults (`enabled: true`) when the workspace has never customized them.
 - [`workspacesList`](docs/sdks/workspaces/README.md#list) - Retrieve all workspaces.
@@ -785,10 +836,6 @@ To read more about standalone functions, check [FUNCTIONS.md](./FUNCTIONS.md).
 - [`workspacesUpdate`](docs/sdks/workspaces/README.md#update) - Update a workspace.
 - [`workspacesUpdateMember`](docs/sdks/workspaces/README.md#updatemember) - Update a workspace member's role.
 - [`workspacesUpdateSettings`](docs/sdks/workspaces/README.md#updatesettings) - Update the ai-agent settings for a workspace. Supports `enabled` (`false` turns the ai-agent off so incoming triggers are rejected before any session runs).
-- ~~[`operationsGetPolicy`](docs/sdks/operations/README.md#getpolicy)~~ - Get a project's per-command approval policy. Mirrors what the operator enforces: `plugin/operation` / `plugin/*` / `*` patterns → auto | manual. :warning: **Deprecated**
-- ~~[`operationsSetBuiltinPlugins`](docs/sdks/operations/README.md#setbuiltinplugins)~~ - Replace the complete set of enabled built-in operations plugins for a project. Returns the cloud permission delta versus the previously enabled set. :warning: **Deprecated**
-- ~~[`operationsSetPluginEnabled`](docs/sdks/operations/README.md#setpluginenabled)~~ - Enable or disable an operations plugin (builtin or custom) for a project. Only enabled plugins are distributed to Operators and can be invoked. Returns the cloud permission delta versus the previously enabled set. With `dryRun`, validates the change and returns the delta without saving it. :warning: **Deprecated**
-- ~~[`operationsUpdatePolicy`](docs/sdks/operations/README.md#updatepolicy)~~ - Replace a project's per-command approval policy (full rule set). Patterns are `plugin/operation`, `plugin/*`, or `*`; each maps to auto | manual. :warning: **Deprecated**
 </details>
 <!-- End Standalone functions [standalone-funcs] -->
@@ -815,6 +862,8 @@ To learn about this feature and how to get started, check
 <summary>Available React hooks</summary>
+- [`useAcceptAwsKeySetupMutation`](docs/sdks/alien/README.md#acceptawskeysetup)
+- [`useAcceptTerraformKeySetupMutation`](docs/sdks/alien/README.md#acceptterraformkeysetup)
 - [`useAcceptWorkspaceInvitationMutation`](docs/sdks/alien/README.md#acceptworkspaceinvitation)
 - [`useAgentSessionsEvents`](docs/sdks/agentsessions/README.md#events) - Incrementally read a session's event log (steps, tool calls, report deltas, approvals, status transitions). Pass the previous response's `latestSeq` as `after` to fetch only new events.
 - [`useAgentSessionsGet`](docs/sdks/agentsessions/README.md#get) - Retrieve one ai-agent monitor session by id.
@@ -828,8 +877,9 @@ To learn about this feature and how to get started, check
 - [`useApiKeysUpdateMutation`](docs/sdks/apikeys/README.md#update) - Update an API key (enable/disable, change description).
 - [`useAuthWhoami`](docs/sdks/auth/README.md#whoami) - Get the current authenticated principal (user or service account). Works with both session cookies and API keys.
 - [`useBillingGetEntitlements`](docs/sdks/billing/README.md#getentitlements) - Get the workspace billing entitlements used for product feature gates. Autumn is the source of truth; the response is served through the workspace billing read model with stale-cache fallback.
-- [`useBillingListAuditLog`](docs/sdks/billing/README.md#listauditlog) - List billing activity entries for the current workspace.
+- [`useBillingSyncMutation`](docs/sdks/billing/README.md#sync) - Refresh the workspace billing entitlements from Autumn now, for example right after checkout, instead of waiting for Autumn's billing webhook. Workspace admins only. Calls within a few seconds share one refresh.
 - [`useCancelDeploymentCredentialRotationMutation`](docs/sdks/alien/README.md#canceldeploymentcredentialrotation)
+- [`useClaimAwsXksStoreRetirementMutation`](docs/sdks/alien/README.md#claimawsxksstoreretirement)
 - [`useCloudRegionsGet`](docs/sdks/cloudregions/README.md#get) - Get cloud regions supported by this Alien environment.
 - [`useCommandsBootstrapMutation`](docs/sdks/commands/README.md#bootstrap) - Resolve a deployment's current manager and mint a five-minute command capability. Sender tokens can dispatch and observe commands only for this deployment. Receiver tokens can lease and complete commands only for the resolved Container or Daemon target.
 - [`useCommandsCompleteMutation`](docs/sdks/commands/README.md#complete) - Atomically transition a command to a terminal state (SUCCEEDED, FAILED, or EXPIRED) unless it is already terminal. Returns whether the transition was applied.
@@ -842,6 +892,7 @@ To learn about this feature and how to get started, check
 - [`useCommandsListNames`](docs/sdks/commands/README.md#listnames) - List distinct command names. Use for filter dropdowns in the dashboard.
 - [`useCommandsResolveTarget`](docs/sdks/commands/README.md#resolvetarget) - Resolve which resource a command for this deployment would be addressed to, and how it would be delivered. Fails when the deployment has no command-capable resources, or more than one and no explicit target was named.
 - [`useCommandsUpdateMutation`](docs/sdks/commands/README.md#update) - Update command state. Called by manager when command is dispatched or completes.
+- [`useCompleteAwsXksStoreRetirementMutation`](docs/sdks/alien/README.md#completeawsxksstoreretirement)
 - [`useContainerRegistryApplyContainerRegistryManagerSnapshotMutation`](docs/sdks/containerregistry/README.md#applycontainerregistrymanagersnapshot)
 - [`useContainerRegistryCreateContainerRegistryCredentialMutation`](docs/sdks/containerregistry/README.md#createcontainerregistrycredential)
 - [`useContainerRegistryCreateContainerRegistryRepositoryMutation`](docs/sdks/containerregistry/README.md#createcontainerregistryrepository)
@@ -872,6 +923,7 @@ To learn about this feature and how to get started, check
 - [`useDeploymentGroupsEnsureDeploymentGroupByNameMutation`](docs/sdks/deploymentgroups/README.md#ensuredeploymentgroupbyname) - Get or create a deployment group by project and name
 - [`useDeploymentGroupsGetDeploymentGroup`](docs/sdks/deploymentgroups/README.md#getdeploymentgroup) - Get deployment group details
 - [`useDeploymentGroupsGetDeploymentGroupByExternalId`](docs/sdks/deploymentgroups/README.md#getdeploymentgroupbyexternalid) - Get a deployment group by project and external ID
+- [`useDeploymentGroupsGetDeploymentGroupManagementExternalId`](docs/sdks/deploymentgroups/README.md#getdeploymentgroupmanagementexternalid) - Get the AWS ExternalId for this deployment group
 - [`useDeploymentGroupsGetExternalAIBinding`](docs/sdks/deploymentgroups/README.md#getexternalaibinding) - Get external AI connection state
 - [`useDeploymentGroupsGetExternalAIModelCheck`](docs/sdks/deploymentgroups/README.md#getexternalaimodelcheck) - Get an external model access check
 - [`useDeploymentGroupsListDeploymentGroups`](docs/sdks/deploymentgroups/README.md#listdeploymentgroups) - List deployment groups
@@ -881,7 +933,7 @@ To learn about this feature and how to get started, check
 - [`useDeploymentPlanComputeMutation`](docs/sdks/deployment/README.md#plancompute) - Plan deployment compute for the active release before stack preparation. The response contains recommended machine and scale choices for cloud compute pools.
 - [`useDeploymentPrepareStackMutation`](docs/sdks/deployment/README.md#preparestack) - Prepare the active release stack for a deployment portal setup session. The response contains the generated stack shape plus setup compatibility metadata.
 - [`useDeploymentsCancelVolumeRestoreMutation`](docs/sdks/deployments/README.md#cancelvolumerestore) - Cancel a pending volume restore. Use it when a restore keeps failing: the deployment stops attempting it. A restore whose volume was already swapped still finishes. Allowed in any deployment status, including update-failed.
-- [`useDeploymentsCreateMutation`](docs/sdks/deployments/README.md#create) - Create a new deployment. Deployment group tokens automatically use their group. Workspace/project tokens must provide deploymentGroupId.
+- [`useDeploymentsCreateMutation`](docs/sdks/deployments/README.md#create) - Create a new deployment. Deployment group tokens automatically use their group. Workspace/project tokens must provide deploymentGroupId or deploymentGroupExternalId. Pending installation retries keep the originally reserved release and CloudFormation stack name, even after a new release is published. Other installation options must remain unchanged.
 - [`useDeploymentsCreateSetupRegistrationOperationMutation`](docs/sdks/deployments/README.md#createsetupregistrationoperation) - Start a durable setup registration operation for CloudFormation, Terraform, or Helm.
 - [`useDeploymentsCreateTokenMutation`](docs/sdks/deployments/README.md#createtoken) - Create a deployment token (deployment-scoped API key). The deployment must exist before creating a token.
 - [`useDeploymentsDeleteMutation`](docs/sdks/deployments/README.md#delete) - Delete, detach, or forget a deployment by ID.
@@ -900,11 +952,12 @@ To learn about this feature and how to get started, check
 - [`useDeploymentsMoveMutation`](docs/sdks/deployments/README.md#move) - Reassign a deployment to another group within its project
 - [`useDeploymentsPinReleaseMutation`](docs/sdks/deployments/README.md#pinrelease) - Pin or unpin a running or runtime-failed deployment. Running deployments start an update; failed deployments retry toward the selected release.
 - [`useDeploymentsRedeployMutation`](docs/sdks/deployments/README.md#redeploy) - Redeploy a running deployment with the same release and fresh environment variables. Sets status to update-pending.
+- [`useDeploymentsReportDeploymentSetupProgressMutation`](docs/sdks/deployments/README.md#reportdeploymentsetupprogress) - Record that a reserved CloudFormation setup started its stack, or that AWS rolled the stack back before it registered. Called by the template's DeploymentSetupStarted resource with the reservation's deployment credential.
 - [`useDeploymentsRestoreVolumeMutation`](docs/sdks/deployments/README.md#restorevolume) - Replace one replica's persistent volume with a new volume made from a snapshot. The deployment must be running (an update may already be queued or in progress). The replica is stopped while its volume is swapped, and the replaced volume is snapshotted before it is deleted.
 - [`useDeploymentsRetryMutation`](docs/sdks/deployments/README.md#retry) - Retry a failed deployment operation. Uses alien-infra's retry mechanisms to resume from exact failure point.
 - [`useDeploymentsSetFirstPartyDeploymentInputsMutation`](docs/sdks/deployments/README.md#setfirstpartydeploymentinputs) - Store operator-provided input values on a first-party deployment session token so CLI/local deploys apply them.
 - [`useDeploymentsSetReleaseChannelMutation`](docs/sdks/deployments/README.md#setreleasechannel)
-- [`useDeploymentsUpdateComputeMutation`](docs/sdks/deployments/README.md#updatecompute) - Update deployment-time compute pool selections and request reconciliation by the hosted manager.
+- [`useDeploymentsUpdateComputeMutation`](docs/sdks/deployments/README.md#updatecompute) - Update deployment-time compute selections or quota warning overrides and request reconciliation by the hosted manager.
 - [`useDeploymentsUpdateEnvironmentVariablesMutation`](docs/sdks/deployments/README.md#updateenvironmentvariables) - Replace a deployment's advanced environment variables. Stack-input-backed variables are write-only through the input endpoint. If the deployment is running and not locked, the status will be changed to update-pending to trigger a deployment.
 - [`useDeploymentsUpdateInputsMutation`](docs/sdks/deployments/README.md#updateinputs) - Update runtime stack inputs, rebuild their environment-variable mappings, and request a deployment update when runtime configuration changes.
 - [`useDomainsCreateEndpointMutation`](docs/sdks/domains/README.md#createendpoint) - Create an endpoint under a workspace domain.
@@ -925,13 +978,18 @@ To learn about this feature and how to get started, check
 - [`useGetAwsVirtualKey`](docs/sdks/alien/README.md#getawsvirtualkey)
 - [`useGetDeploymentCredentialRotation`](docs/sdks/alien/README.md#getdeploymentcredentialrotation)
 - [`useGetDeploymentCredentialRotationValuesMutation`](docs/sdks/alien/README.md#getdeploymentcredentialrotationvalues)
+- [`useGetDeploymentMetricsHistory`](docs/sdks/alien/README.md#getdeploymentmetricshistory) - Metrics Horizon reported for each replica, from the deployment's heartbeats in [from, to): the latest sample per replica per bucket, with empty buckets as null. Kept for 30 days, best effort.
+- [`useGetDeploymentPreparation`](docs/sdks/alien/README.md#getdeploymentpreparation)
+- [`useGetInstallationDeployment`](docs/sdks/alien/README.md#getinstallationdeployment)
 - [`useGetLogExportDeliveryConfig`](docs/sdks/alien/README.md#getlogexportdeliveryconfig)
 - [`useGetPendingWorkspaceInvitation`](docs/sdks/alien/README.md#getpendingworkspaceinvitation)
 - [`useGetProjectLogExport`](docs/sdks/alien/README.md#getprojectlogexport)
+- [`useGetTerraformKeySetupOperation`](docs/sdks/alien/README.md#getterraformkeysetupoperation)
 - [`useGetWorkspaceInvitationPreview`](docs/sdks/alien/README.md#getworkspaceinvitationpreview)
 - [`useGetWorkspaceInviteLink`](docs/sdks/alien/README.md#getworkspaceinvitelink)
 - [`useIncidentsGet`](docs/sdks/incidents/README.md#get) - Get an authorized incident without Slack transport metadata.
 - [`useIncidentsList`](docs/sdks/incidents/README.md#list) - List authorized incidents without Slack transport metadata.
+- [`useListAwsKeySetupCleanup`](docs/sdks/alien/README.md#listawskeysetupcleanup)
 - [`useListAwsVirtualKeys`](docs/sdks/alien/README.md#listawsvirtualkeys)
 - [`useListWorkspaceInvitations`](docs/sdks/alien/README.md#listworkspaceinvitations)
 - [`useMachinesCancelMachineDrainMutation`](docs/sdks/machines/README.md#cancelmachinedrain)
@@ -983,6 +1041,7 @@ To learn about this feature and how to get started, check
 - [`usePackagesList`](docs/sdks/packages/README.md#list) - List packages with optional filters. Returns packages ordered by creation date (newest first).
 - [`usePackagesRebuildMutation`](docs/sdks/packages/README.md#rebuild) - Rebuild packages for a project. This will cancel any pending packages and create new ones with auto-incremented versions.
 - [`usePrepareDeploymentCredentialRotationMutation`](docs/sdks/alien/README.md#preparedeploymentcredentialrotation)
+- [`usePrepareDeploymentInstallationMutation`](docs/sdks/alien/README.md#preparedeploymentinstallation)
 - [`useProjectsAcceptRemoteOperatorImageMutation`](docs/sdks/projects/README.md#acceptremoteoperatorimage) - Accept a reported image for a Remote Operator installation
 - [`useProjectsAcceptRemoteOperatorPermissionsMutation`](docs/sdks/projects/README.md#acceptremoteoperatorpermissions) - Record that a Remote Operator installation's setup was re-applied
 - [`useProjectsConfigureAiProviderHeadersMutation`](docs/sdks/projects/README.md#configureaiproviderheaders) - Replace the static headers added to AI requests for each provider.
@@ -991,7 +1050,7 @@ To learn about this feature and how to get started, check
 - [`useProjectsConfigureKeysMutation`](docs/sdks/projects/README.md#configurekeys) - Enable customer-owned application encryption without requiring an application Release.
 - [`useProjectsConfigureModelsMutation`](docs/sdks/projects/README.md#configuremodels) - Configure customer-owned model providers without requiring an application Release.
 - [`useProjectsConfigureRegistryMutation`](docs/sdks/projects/README.md#configureregistry) - Enable customer-owned container registries without requiring an application Release.
-- [`useProjectsConfigureRemoteSandboxMutation`](docs/sdks/projects/README.md#configureremotesandbox) - Enable a customer-owned sandbox a hosted caller can drive through Remote Bindings. Without a custom image it publishes to every cloud on Alien's default image, which the project then follows. A custom image publishes to AWS; a public one with a linux/amd64 variant also publishes to Azure, and to GCP once Alien has built its GCP image.
+- [`useProjectsConfigureRemoteSandboxMutation`](docs/sdks/projects/README.md#configureremotesandbox) - Enable a customer-owned sandbox a hosted caller can drive through Remote Bindings. Without a custom image it publishes to every cloud on Alien's default image, which the project then follows. A custom image publishes to AWS; a public one with a linux/amd64 variant also publishes to Azure, and to GCP once Alien has built its GCP image; a private one publishes to Azure from its `azureImage` and to GCP from its `gcpImage`.
 - [`useProjectsConfigureSourceMutation`](docs/sdks/projects/README.md#configuresource) - Connect a GitHub repository or Alien template to an existing project.
 - [`useProjectsCreateFromTemplateMutation`](docs/sdks/projects/README.md#createfromtemplate) - Create a project by forking alienplatform/alien into your namespace.
 - [`useProjectsCreateMutation`](docs/sdks/projects/README.md#create) - Create a new project.
@@ -1020,12 +1079,14 @@ To learn about this feature and how to get started, check
 - [`useReleasesCreateMutation`](docs/sdks/releases/README.md#create) - Create a new release.
 - [`useReleasesGet`](docs/sdks/releases/README.md#get) - Retrieve a release by ID.
 - [`useReleasesList`](docs/sdks/releases/README.md#list) - Retrieve all releases.
-- [`useReleasesListAuthors`](docs/sdks/releases/README.md#listauthors) - List distinct commit authors across releases. Used for filter dropdowns.
-- [`useReleasesListBranches`](docs/sdks/releases/README.md#listbranches) - List distinct git branches across releases. Used for filter dropdowns.
+- [`useReleasesListAuthors`](docs/sdks/releases/README.md#listauthors) - List distinct commit authors across releases. Used for filter dropdowns. Empty for deployment and deployment-group tokens.
+- [`useReleasesListBranches`](docs/sdks/releases/README.md#listbranches) - List distinct git branches across releases. Used for filter dropdowns. Empty for deployment and deployment-group tokens.
+- [`useReleasesListChannelImpact`](docs/sdks/releases/README.md#listchannelimpact) - List the project's release channels with what each runs now and what promoting this release to it would change.
 - [`useReleasesListDeployments`](docs/sdks/releases/README.md#listdeployments) - List the project's deployments with their rollout state relative to this release.
 - [`useReleasesPromoteMutation`](docs/sdks/releases/README.md#promote)
 - [`useRemoteBindingsCreateExternalAccessMutation`](docs/sdks/remotebindings/README.md#createexternalaccess) - Create short-lived Remote Bindings access for a external resource
 - [`useReportLogExportDeliveryMutation`](docs/sdks/alien/README.md#reportlogexportdelivery)
+- [`useRequestDeploymentCheckMutation`](docs/sdks/alien/README.md#requestdeploymentcheck)
 - [`useResendWorkspaceInvitationMutation`](docs/sdks/alien/README.md#resendworkspaceinvitation)
 - [`useResolveResolve`](docs/sdks/resolve/README.md#resolve) - Resolve manager for a project and platform
 - [`useResourcesGetDeploymentDetail`](docs/sdks/resources/README.md#getdeploymentdetail)
@@ -1033,6 +1094,7 @@ To learn about this feature and how to get started, check
 - [`useResourcesListInventory`](docs/sdks/resources/README.md#listinventory)
 - [`useResourcesListOverview`](docs/sdks/resources/README.md#listoverview)
 - [`useRestoreAwsVirtualKeyMutation`](docs/sdks/alien/README.md#restoreawsvirtualkey)
+- [`useResumeDeploymentInstallationMutation`](docs/sdks/alien/README.md#resumedeploymentinstallation)
 - [`useRevokeWorkspaceInvitationMutation`](docs/sdks/alien/README.md#revokeworkspaceinvitation)
 - [`useRevokeWorkspaceInviteLinkMutation`](docs/sdks/alien/README.md#revokeworkspaceinvitelink)
 - [`useRotateAwsVirtualKeyCredentialMutation`](docs/sdks/alien/README.md#rotateawsvirtualkeycredential)
@@ -1045,6 +1107,7 @@ To learn about this feature and how to get started, check
 - [`useSyncAcquireMutation`](docs/sdks/sync/README.md#acquire) - Acquire a batch of deployments for processing. Used by Manager to atomically lock deployments matching filters. Each deployment in the batch must be released after processing.
 - [`useSyncContextMutation`](docs/sdks/sync/README.md#context) - Get computed deployment state and configuration for a manager-side operation without acquiring the deployment reconciliation lock.
 - [`useSyncListMutation`](docs/sdks/sync/README.md#list) - List full deployment records for manager operational loops. This endpoint is intentionally separate from the public deployments list, which returns lightweight UI rows.
+- [`useSyncManagementExternalIdMutation`](docs/sdks/sync/README.md#managementexternalid) - Get the AWS sts:ExternalId the deployment's management and remote-bindings roles trust. Only the manager runtime assigned to the deployment can read it.
 - [`useSyncReconcileMutation`](docs/sdks/sync/README.md#reconcile) - Reconcile deployment state. Push model requests that include a session verify lock ownership. Pull model state reports are accepted as authz-gated agent progress even when they carry an agent-sync session. Accepts full DeploymentState after step() execution.
 - [`useSyncReleaseMutation`](docs/sdks/sync/README.md#release) - Release a deployment lock. Must be called after processing an acquired deployment, even if processing failed. This is critical to avoid deadlocks.
 - [`useSyncRenewMutation`](docs/sdks/sync/README.md#renew)
@@ -1058,8 +1121,18 @@ To learn about this feature and how to get started, check
 - [`useUserListMemberships`](docs/sdks/user/README.md#listmemberships) - List all workspaces the current user has access to.
 - [`useUserSyncGitNamespacesMutation`](docs/sdks/user/README.md#syncgitnamespaces) - Sync git namespaces from the provider. For GitHub, this fetches all app installations accessible to the user.
 - [`useUserUpdateProfileMutation`](docs/sdks/user/README.md#updateprofile) - Update the current user's profile (display name).
+- [`useWebhooksCreateWebhookEndpointMutation`](docs/sdks/webhooks/README.md#createwebhookendpoint) - Create an endpoint. Invalid delivery-service configuration returns 400 with the validation reason.
+- [`useWebhooksDeleteWebhookEndpointMutation`](docs/sdks/webhooks/README.md#deletewebhookendpoint) - Delete an endpoint idempotently. An endpoint that is already absent returns success. Deleting the last workspace endpoint stops capturing new webhook events.
+- [`useWebhooksGetWebhookEndpoint`](docs/sdks/webhooks/README.md#getwebhookendpoint)
+- [`useWebhooksGetWebhookSigningSecret`](docs/sdks/webhooks/README.md#getwebhooksigningsecret)
+- [`useWebhooksListWebhookDeliveries`](docs/sdks/webhooks/README.md#listwebhookdeliveries)
+- [`useWebhooksListWebhookEndpoints`](docs/sdks/webhooks/README.md#listwebhookendpoints)
+- [`useWebhooksRetryWebhookDeliveryMutation`](docs/sdks/webhooks/README.md#retrywebhookdelivery)
+- [`useWebhooksRotateWebhookSigningSecretMutation`](docs/sdks/webhooks/README.md#rotatewebhooksigningsecret)
+- [`useWebhooksTestWebhookEndpointMutation`](docs/sdks/webhooks/README.md#testwebhookendpoint)
+- [`useWebhooksUpdateWebhookEndpointMutation`](docs/sdks/webhooks/README.md#updatewebhookendpoint)
 - [`useWorkspacesAddMemberMutation`](docs/sdks/workspaces/README.md#addmember) - Add a member to a workspace by email. The user must already have an account.
-- [`useWorkspacesDeleteMutation`](docs/sdks/workspaces/README.md#delete) - Delete a workspace. The workspace must have no projects.
+- [`useWorkspacesDeleteMutation`](docs/sdks/workspaces/README.md#delete) - Delete a workspace. The workspace must have no projects and must not be on pay as you go or a contract.
 - [`useWorkspacesGet`](docs/sdks/workspaces/README.md#get) - Retrieve a workspace by ID.
 - [`useWorkspacesGetSettings`](docs/sdks/workspaces/README.md#getsettings) - Read the ai-agent settings for a workspace. Returns defaults (`enabled: true`) when the workspace has never customized them.
 - [`useWorkspacesList`](docs/sdks/workspaces/README.md#list) - Retrieve all workspaces.
@@ -1068,10 +1141,6 @@ To learn about this feature and how to get started, check
 - [`useWorkspacesUpdateMemberMutation`](docs/sdks/workspaces/README.md#updatemember) - Update a workspace member's role.
 - [`useWorkspacesUpdateMutation`](docs/sdks/workspaces/README.md#update) - Update a workspace.
 - [`useWorkspacesUpdateSettingsMutation`](docs/sdks/workspaces/README.md#updatesettings) - Update the ai-agent settings for a workspace. Supports `enabled` (`false` turns the ai-agent off so incoming triggers are rejected before any session runs).
-- ~~[`useOperationsGetPolicy`](docs/sdks/operations/README.md#getpolicy)~~ - Get a project's per-command approval policy. Mirrors what the operator enforces: `plugin/operation` / `plugin/*` / `*` patterns → auto | manual. :warning: **Deprecated**
-- ~~[`useOperationsSetBuiltinPluginsMutation`](docs/sdks/operations/README.md#setbuiltinplugins)~~ - Replace the complete set of enabled built-in operations plugins for a project. Returns the cloud permission delta versus the previously enabled set. :warning: **Deprecated**
-- ~~[`useOperationsSetPluginEnabledMutation`](docs/sdks/operations/README.md#setpluginenabled)~~ - Enable or disable an operations plugin (builtin or custom) for a project. Only enabled plugins are distributed to Operators and can be invoked. Returns the cloud permission delta versus the previously enabled set. With `dryRun`, validates the change and returns the delta without saving it. :warning: **Deprecated**
-- ~~[`useOperationsUpdatePolicyMutation`](docs/sdks/operations/README.md#updatepolicy)~~ - Replace a project's per-command approval policy (full rule set). Patterns are `plugin/operation`, `plugin/*`, or `*`; each maps to auto | manual. :warning: **Deprecated**
 </details>
 <!-- End React hooks with TanStack Query [react-query] -->

package/esm/funcs/acceptAwsKeySetup.d.ts ADDED Viewed

@@ -0,0 +1,12 @@
+import { AlienCore } from "../core.js";
+import { RequestOptions } from "../lib/sdks.js";
+import { AlienError } from "../models/errors/alienerror.js";
+import { ConnectionError, InvalidRequestError, RequestAbortedError, RequestTimeoutError, UnexpectedClientError } from "../models/errors/httpclienterrors.js";
+import * as errors from "../models/errors/index.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import * as operations from "../models/operations/index.js";
+import { APIPromise } from "../types/async.js";
+import { Result } from "../types/fp.js";
+export declare function acceptAwsKeySetup(client: AlienCore, request?: operations.AcceptAwsKeySetupRequest | undefined, options?: RequestOptions): APIPromise<Result<operations.AcceptAwsKeySetupResponse | undefined, errors.APIError | AlienError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError>>;
+//# sourceMappingURL=acceptAwsKeySetup.d.ts.map

package/esm/funcs/acceptAwsKeySetup.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"acceptAwsKeySetup.d.ts","sourceRoot":"","sources":["../../src/funcs/acceptAwsKeySetup.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAMvC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAW,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,SAAS,EACjB,OAAO,CAAC,EAAE,UAAU,CAAC,wBAAwB,GAAG,SAAS,EACzD,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CACX,MAAM,CACJ,UAAU,CAAC,yBAAyB,GAAG,SAAS,EAC9C,MAAM,CAAC,QAAQ,GACf,UAAU,GACV,uBAAuB,GACvB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,CACrB,CACF,CAMA"}

package/esm/funcs/acceptAwsKeySetup.js ADDED Viewed

@@ -0,0 +1,79 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+import { encodeJSON } from "../lib/encodings.js";
+import { matchStatusCode } from "../lib/http.js";
+import * as M from "../lib/matchers.js";
+import { compactMap } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+import { extractSecurity, resolveGlobalSecurity } from "../lib/security.js";
+import { pathToFunc } from "../lib/url.js";
+import * as errors from "../models/errors/index.js";
+import * as operations from "../models/operations/index.js";
+import { APIPromise } from "../types/async.js";
+export function acceptAwsKeySetup(client, request, options) {
+    return new APIPromise($do(client, request, options));
+}
+async function $do(client, request, options) {
+    const parsed = safeParse(request, (value) => operations.AcceptAwsKeySetupRequest$outboundSchema.optional().parse(value), "Input validation failed");
+    if (!parsed.ok) {
+        return [parsed, { status: "invalid" }];
+    }
+    const payload = parsed.value;
+    const body = payload === undefined
+        ? null
+        : encodeJSON("body", payload, { explode: true });
+    const path = pathToFunc("/v1/aws-key-setups")();
+    const headers = new Headers(compactMap({
+        "Content-Type": "application/json",
+        Accept: "application/json",
+    }));
+    const secConfig = await extractSecurity(client._options.apiKey);
+    const securityInput = secConfig == null ? {} : { apiKey: secConfig };
+    const requestSecurity = resolveGlobalSecurity(securityInput);
+    const context = {
+        options: client._options,
+        baseURL: options?.serverURL ?? client._baseURL ?? "",
+        operationID: "acceptAwsKeySetup",
+        oAuth2Scopes: null,
+        resolvedSecurity: requestSecurity,
+        securitySource: client._options.apiKey,
+        retryConfig: options?.retries
+            || client._options.retryConfig
+            || { strategy: "none" },
+        retryCodes: options?.retryCodes || ["429", "500", "502", "503", "504"],
+    };
+    const requestRes = client._createRequest(context, {
+        security: requestSecurity,
+        method: "POST",
+        baseURL: options?.serverURL,
+        path: path,
+        headers: headers,
+        body: body,
+        userAgent: client._options.userAgent,
+        timeoutMs: options?.timeoutMs || client._options.timeoutMs || -1,
+    }, options);
+    if (!requestRes.ok) {
+        return [requestRes, { status: "invalid" }];
+    }
+    const req = requestRes.value;
+    const doResult = await client._do(req, {
+        context,
+        isErrorStatusCode: (statusCode) => matchStatusCode({ status: statusCode }, ["4XX", "5XX"]),
+        retryConfig: context.retryConfig,
+        retryCodes: context.retryCodes,
+    });
+    if (!doResult.ok) {
+        return [doResult, { status: "request-error", request: req }];
+    }
+    const response = doResult.value;
+    const responseFields = {
+        HttpMeta: { Response: response, Request: req },
+    };
+    const [result] = await M.match(M.json(202, operations.AcceptAwsKeySetupResponse$inboundSchema.optional()), M.nil(204, operations.AcceptAwsKeySetupResponse$inboundSchema.optional()), M.jsonErr([400, 401, 403, 404, 409, 422], errors.APIError$inboundSchema), M.jsonErr(500, errors.APIError$inboundSchema), M.fail("4XX"), M.fail("5XX"))(response, req, { extraFields: responseFields });
+    if (!result.ok) {
+        return [result, { status: "complete", request: req, response }];
+    }
+    return [result, { status: "complete", request: req, response }];
+}
+//# sourceMappingURL=acceptAwsKeySetup.js.map