@alienplatform/platform-api 3.3.42 → 3.3.43

package/src/models/createsetuplinkrequest.ts

@@ -56,6 +56,14 @@ export type CreateSetupLinkRequest = {
    * Maximum number of deployments for newly created groups
    */
   maxDeployments?: number | undefined;
+  /**
+   * Vendor destination when leaving or completing setup. Must be an absolute HTTPS URL without userinfo (embedded credentials), at most 2048 characters. Null clears the destination; omit to keep it unchanged.
+   */
+  returnUrl?: string | null | undefined;
+  /**
+   * Vendor destination for expired, revoked or disabled setup links. This URL remains available for unusable links; the endpoint must authenticate the user before minting a new link. Must be an absolute HTTPS URL without userinfo (embedded credentials), at most 2048 characters. Null clears the destination; omit to keep it unchanged.
+   */
+  refreshUrl?: string | null | undefined;
   /**
    * Description for the API key
    */
@@ -118,6 +126,8 @@ export type CreateSetupLinkRequest$Outbound = {
   name: string;
   project: string;
   maxDeployments: number;
+  returnUrl?: string | null | undefined;
+  refreshUrl?: string | null | undefined;
   description?: string | undefined;
   expiresAt?: string | null | undefined;
   deploymentSetupConfig?: DeploymentSetupConfigInput$Outbound | undefined;
@@ -139,6 +149,8 @@ export const CreateSetupLinkRequest$outboundSchema: z.ZodType<
   name: z.string(),
   project: z.string(),
   maxDeployments: z.int().default(100),
+  returnUrl: z.nullable(z.string()).optional(),
+  refreshUrl: z.nullable(z.string()).optional(),
   description: z.string().optional(),
   expiresAt: z.nullable(z.date().transform(v => v.toISOString())).optional(),
   deploymentSetupConfig: DeploymentSetupConfigInput$outboundSchema.optional(),

package/src/models/deletedeploymentrequest.ts

@@ -7,6 +7,8 @@ import { ClosedEnum } from "../types/enums.js";
 
 export const DeleteDeploymentRequestAction = {
   Cleanup: "cleanup",
+  Retain: "retain",
+  Erase: "erase",
   Detach: "detach",
   Forget: "forget",
 } as const;

package/src/models/deletedeploymentresponse.ts

@@ -10,6 +10,8 @@ import { SDKValidationError } from "./errors/sdkvalidationerror.js";
 
 export const DeleteDeploymentResponseAction = {
   Cleanup: "cleanup",
+  Retain: "retain",
+  Erase: "erase",
   Detach: "detach",
   Forget: "forget",
 } as const;

package/src/models/deployment.ts

@@ -14,6 +14,8 @@ import {
   DeploymentBasePlatform$inboundSchema,
   DeploymentCredentialRetryUnion,
   DeploymentCredentialRetryUnion$inboundSchema,
+  DeploymentDeletionPolicy,
+  DeploymentDeletionPolicy$inboundSchema,
   DeploymentDeployerSecret,
   DeploymentDeployerSecret$inboundSchema,
   DeploymentEnvironmentInfoUnion,
@@ -28,17 +30,17 @@ import {
   DeploymentStackState$inboundSchema,
   DeploymentStatus,
   DeploymentStatus$inboundSchema,
-} from "./deploymentpendingpreparedstackdefaultstringlist.js";
+} from "./deploymentpendingpreparedstacktypestringlist.js";
 import {
   DeploymentPendingPreparedStackUnion,
   DeploymentPendingPreparedStackUnion$inboundSchema,
-  DeploymentPreparedStackApprovalPlugins,
-  DeploymentPreparedStackApprovalPlugins$inboundSchema,
   DeploymentPreparedStackCustom,
   DeploymentPreparedStackCustom$inboundSchema,
   DeploymentPreparedStackInput,
   DeploymentPreparedStackInput$inboundSchema,
-} from "./deploymentpreparedstackapprovalplugins.js";
+  DeploymentPreparedStackPluginsDecision,
+  DeploymentPreparedStackPluginsDecision$inboundSchema,
+} from "./deploymentpreparedstackpluginsdecision.js";
 import {
   DeploymentPurpose,
   DeploymentPurpose$inboundSchema,
@@ -57,6 +59,20 @@ import {
   ReportedOperation$inboundSchema,
 } from "./reportedoperation.js";
 
+export type DeploymentPreparedStackApprovalPlugins = {
+  /**
+   * Whether matching operations run without approval.
+   */
+  decision: DeploymentPreparedStackPluginsDecision;
+  /**
+   * Highest risk tier (`read-only`, `mutating`, `destructive`) a wildcard
+   *
+   * @remarks
+   * access request for these operations may cover.
+   */
+  maxRisk?: string | null | undefined;
+};
+
 /**
  * Whether matching operations run without approval.
  */
@@ -1360,6 +1376,14 @@ export type DeploymentPreparedStackResources = {
    * The total dependencies are: resource.get_dependencies() + this list
    */
   dependencies: Array<DeploymentPreparedStackDependency>;
+  /**
+   * Authored purpose, displayed as plain text. Does not affect resource configuration.
+   */
+  description?: string | null | undefined;
+  /**
+   * Optional human-readable name. The stable resource ID is the display fallback.
+   */
+  displayName?: string | null | undefined;
   /**
    * Id of the boolean stack input that decides whether this resource is
    *
@@ -1584,6 +1608,13 @@ export type DeploymentRuntimeMetadata = {
    * Bounded credential retry state shared by all deployment drivers.
    */
   credentialRetry?: DeploymentCredentialRetryUnion | null | undefined;
+  /**
+   * Explicit disposition of durable data when deleting a deployment.
+   *
+   * @remarks
+   * Missing values from older checkpoints always preserve data.
+   */
+  deletionPolicy?: DeploymentDeletionPolicy | undefined;
   /**
    * Whether each vault-native deployer secret is in the customer's secret
    *
@@ -1652,6 +1683,29 @@ export type DeploymentRuntimeMetadata = {
    * every reconcile tick.
    */
   registryAccessGranted?: boolean | undefined;
+  /**
+   * Start of the bounded wait for retained data's expiry controls to disable.
+   *
+   * @remarks
+   * Cleared on confirmation, explicit retry, or returning to normal execution.
+   */
+  retainedDataProtectionStartedAt?: Date | null | undefined;
+  /**
+   * UTC API-confirmation time for the matching data protection digest.
+   *
+   * @remarks
+   * Provider propagation must be qualified separately before final retention.
+   */
+  retainedStorageProtectionConfirmedAt?: Date | null | undefined;
+  /**
+   * Digest of the installed data inventory whose runtime public-access and
+   *
+   * @remarks
+   * expiry configuration was protected before cleanup. The serialized field
+   * name is retained for compatibility. This is not a
+   * receipt for effective expiry propagation or privileged setup teardown.
+   */
+  retainedStorageProtectionHash?: string | null | undefined;
   /**
    * What a direct setup created for resources it does not own, keyed by resource id. Setup
    *
@@ -1664,6 +1718,14 @@ export type DeploymentRuntimeMetadata = {
     | string
     | null
     | undefined;
+  /**
+   * Credential revocation completed before resource teardown. A delete retry
+   *
+   * @remarks
+   * can use this receipt after the vault or its binding is gone. Secret sync
+   * clears it before a deployment can write runtime credentials again.
+   */
+  vaultCredentialsRevoked?: boolean | undefined;
 };
 
 /**
@@ -1844,7 +1906,7 @@ export type Deployment = {
    */
   stackSettings: DeploymentStackSettings;
   /**
-   * State of infrastructure components managed by this deployment
+   * Raw engine state for installers and the CLI to resume, update, and destroy deployments. UIs should read resources[] for resource status and errors.
    */
   stackState?: DeploymentStackState | null | undefined;
   /**
@@ -1941,6 +2003,26 @@ export type Deployment = {
   customerKeyUnavailable?: boolean | undefined;
 };
 
+/** @internal */
+export const DeploymentPreparedStackApprovalPlugins$inboundSchema: z.ZodType<
+  DeploymentPreparedStackApprovalPlugins,
+  unknown
+> = z.object({
+  decision: DeploymentPreparedStackPluginsDecision$inboundSchema,
+  maxRisk: z.nullable(z.string()).optional(),
+});
+
+export function deploymentPreparedStackApprovalPluginsFromJSON(
+  jsonString: string,
+): SafeParseResult<DeploymentPreparedStackApprovalPlugins, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackApprovalPlugins$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentPreparedStackApprovalPlugins' from JSON`,
+  );
+}
+
 /** @internal */
 export const DeploymentPreparedStackApprovalPluginsEnum$inboundSchema:
   z.ZodEnum<typeof DeploymentPreparedStackApprovalPluginsEnum> = z.enum(
@@ -1950,7 +2032,7 @@ export const DeploymentPreparedStackApprovalPluginsEnum$inboundSchema:
 /** @internal */
 export const DeploymentPreparedStackPluginsApprovalUnion$inboundSchema:
   z.ZodType<DeploymentPreparedStackPluginsApprovalUnion, unknown> = z.union([
-    DeploymentPreparedStackApprovalPlugins$inboundSchema,
+    z.lazy(() => DeploymentPreparedStackApprovalPlugins$inboundSchema),
     DeploymentPreparedStackApprovalPluginsEnum$inboundSchema,
   ]);
 
@@ -2075,7 +2157,7 @@ export const DeploymentPreparedStackPlugins$inboundSchema: z.ZodType<
   approval: z.record(
     z.string(),
     z.union([
-      DeploymentPreparedStackApprovalPlugins$inboundSchema,
+      z.lazy(() => DeploymentPreparedStackApprovalPlugins$inboundSchema),
       DeploymentPreparedStackApprovalPluginsEnum$inboundSchema,
     ]),
   ).optional(),
@@ -3961,6 +4043,8 @@ export const DeploymentPreparedStackResources$inboundSchema: z.ZodType<
   dependencies: z.array(
     z.lazy(() => DeploymentPreparedStackDependency$inboundSchema),
   ),
+  description: z.nullable(z.string()).optional(),
+  displayName: z.nullable(z.string()).optional(),
   enabledWhen: z.nullable(z.string()).optional(),
   lifecycle: DeploymentPreparedStackLifecycle$inboundSchema,
   remoteAccess: z.boolean().optional(),
@@ -4191,6 +4275,7 @@ export const DeploymentRuntimeMetadata$inboundSchema: z.ZodType<
   automaticSetup: z.boolean().optional(),
   credentialRetry: z.nullable(DeploymentCredentialRetryUnion$inboundSchema)
     .optional(),
+  deletionPolicy: DeploymentDeletionPolicy$inboundSchema.optional(),
   deployerSecrets: z.array(DeploymentDeployerSecret$inboundSchema).optional(),
   directSetupRevision: z.nullable(z.string()).optional(),
   initialSetupAuthority: DeploymentInitialSetupAuthority$inboundSchema
@@ -4209,6 +4294,13 @@ export const DeploymentRuntimeMetadata$inboundSchema: z.ZodType<
     z.union([z.lazy(() => DeploymentRegistryAccess$inboundSchema), z.string()]),
   ).optional(),
   registryAccessGranted: z.boolean().optional(),
+  retainedDataProtectionStartedAt: z.nullable(
+    z.iso.datetime({ offset: true }).transform(v => new Date(v)),
+  ).optional(),
+  retainedStorageProtectionConfirmedAt: z.nullable(
+    z.iso.datetime({ offset: true }).transform(v => new Date(v)),
+  ).optional(),
+  retainedStorageProtectionHash: z.nullable(z.string()).optional(),
   setupScaffolding: z.record(
     z.string(),
     z.lazy(() => DeploymentSetupScaffolding$inboundSchema),
@@ -4219,6 +4311,7 @@ export const DeploymentRuntimeMetadata$inboundSchema: z.ZodType<
       z.string(),
     ]),
   ).optional(),
+  vaultCredentialsRevoked: z.boolean().optional(),
 });
 
 export function deploymentRuntimeMetadataFromJSON(

package/src/models/deploymentconnectioninfo.ts

@@ -72,6 +72,8 @@ export const DeploymentConnectionInfoStatus = {
   DeleteFailed: "delete-failed",
   TeardownRequired: "teardown-required",
   TeardownFailed: "teardown-failed",
+  RetentionRequired: "retention-required",
+  Retained: "retained",
   Deleted: "deleted",
   Error: "error",
 } as const;

package/src/models/deploymentdetailresponse.ts

@@ -14,6 +14,8 @@ import {
   DeploymentDetailResponseBasePlatform$inboundSchema,
   DeploymentDetailResponseCredentialRetryUnion,
   DeploymentDetailResponseCredentialRetryUnion$inboundSchema,
+  DeploymentDetailResponseDeletionPolicy,
+  DeploymentDetailResponseDeletionPolicy$inboundSchema,
   DeploymentDetailResponseDeployerSecret,
   DeploymentDetailResponseDeployerSecret$inboundSchema,
   DeploymentDetailResponseEnvironmentInfoUnion,
@@ -28,17 +30,17 @@ import {
   DeploymentDetailResponseStackState$inboundSchema,
   DeploymentDetailResponseStatus,
   DeploymentDetailResponseStatus$inboundSchema,
-} from "./deploymentdetailresponsependingpreparedstackdefaultstringlist.js";
+} from "./deploymentdetailresponsependingpreparedstacktypestringlist.js";
 import {
   DeploymentDetailResponsePendingPreparedStackUnion,
   DeploymentDetailResponsePendingPreparedStackUnion$inboundSchema,
-  DeploymentDetailResponsePreparedStackApprovalPlugins,
-  DeploymentDetailResponsePreparedStackApprovalPlugins$inboundSchema,
   DeploymentDetailResponsePreparedStackCustom,
   DeploymentDetailResponsePreparedStackCustom$inboundSchema,
   DeploymentDetailResponsePreparedStackInput,
   DeploymentDetailResponsePreparedStackInput$inboundSchema,
-} from "./deploymentdetailresponsepreparedstackapprovalplugins.js";
+  DeploymentDetailResponsePreparedStackPluginsDecision,
+  DeploymentDetailResponsePreparedStackPluginsDecision$inboundSchema,
+} from "./deploymentdetailresponsepreparedstackpluginsdecision.js";
 import {
   DeploymentGroupInfo,
   DeploymentGroupInfo$inboundSchema,
@@ -67,6 +69,10 @@ import {
   DeploymentReleaseInfo,
   DeploymentReleaseInfo$inboundSchema,
 } from "./deploymentreleaseinfo.js";
+import {
+  DeploymentResource,
+  DeploymentResource$inboundSchema,
+} from "./deploymentresource.js";
 import {
   DeploymentUpdateOperationSummary,
   DeploymentUpdateOperationSummary$inboundSchema,
@@ -81,6 +87,20 @@ import {
   ReportedOperation$inboundSchema,
 } from "./reportedoperation.js";
 
+export type DeploymentDetailResponsePreparedStackApprovalPlugins = {
+  /**
+   * Whether matching operations run without approval.
+   */
+  decision: DeploymentDetailResponsePreparedStackPluginsDecision;
+  /**
+   * Highest risk tier (`read-only`, `mutating`, `destructive`) a wildcard
+   *
+   * @remarks
+   * access request for these operations may cover.
+   */
+  maxRisk?: string | null | undefined;
+};
+
 /**
  * Whether matching operations run without approval.
  */
@@ -1425,6 +1445,14 @@ export type DeploymentDetailResponsePreparedStackResources = {
    * The total dependencies are: resource.get_dependencies() + this list
    */
   dependencies: Array<DeploymentDetailResponsePreparedStackDependency>;
+  /**
+   * Authored purpose, displayed as plain text. Does not affect resource configuration.
+   */
+  description?: string | null | undefined;
+  /**
+   * Optional human-readable name. The stable resource ID is the display fallback.
+   */
+  displayName?: string | null | undefined;
   /**
    * Id of the boolean stack input that decides whether this resource is
    *
@@ -1662,6 +1690,13 @@ export type DeploymentDetailResponseRuntimeMetadata = {
     | DeploymentDetailResponseCredentialRetryUnion
     | null
     | undefined;
+  /**
+   * Explicit disposition of durable data when deleting a deployment.
+   *
+   * @remarks
+   * Missing values from older checkpoints always preserve data.
+   */
+  deletionPolicy?: DeploymentDetailResponseDeletionPolicy | undefined;
   /**
    * Whether each vault-native deployer secret is in the customer's secret
    *
@@ -1743,6 +1778,29 @@ export type DeploymentDetailResponseRuntimeMetadata = {
    * every reconcile tick.
    */
   registryAccessGranted?: boolean | undefined;
+  /**
+   * Start of the bounded wait for retained data's expiry controls to disable.
+   *
+   * @remarks
+   * Cleared on confirmation, explicit retry, or returning to normal execution.
+   */
+  retainedDataProtectionStartedAt?: Date | null | undefined;
+  /**
+   * UTC API-confirmation time for the matching data protection digest.
+   *
+   * @remarks
+   * Provider propagation must be qualified separately before final retention.
+   */
+  retainedStorageProtectionConfirmedAt?: Date | null | undefined;
+  /**
+   * Digest of the installed data inventory whose runtime public-access and
+   *
+   * @remarks
+   * expiry configuration was protected before cleanup. The serialized field
+   * name is retained for compatibility. This is not a
+   * receipt for effective expiry propagation or privileged setup teardown.
+   */
+  retainedStorageProtectionHash?: string | null | undefined;
   /**
    * What a direct setup created for resources it does not own, keyed by resource id. Setup
    *
@@ -1757,6 +1815,14 @@ export type DeploymentDetailResponseRuntimeMetadata = {
     | string
     | null
     | undefined;
+  /**
+   * Credential revocation completed before resource teardown. A delete retry
+   *
+   * @remarks
+   * can use this receipt after the vault or its binding is gone. Secret sync
+   * clears it before a deployment can write runtime credentials again.
+   */
+  vaultCredentialsRevoked?: boolean | undefined;
 };
 
 /**
@@ -1975,7 +2041,7 @@ export type DeploymentDetailResponse = {
    */
   stackSettings: DeploymentDetailResponseStackSettings;
   /**
-   * State of infrastructure components managed by this deployment
+   * Raw engine state for installers and the CLI to resume, update, and destroy deployments. UIs should read resources[] for resource status and errors.
    */
   stackState?: DeploymentDetailResponseStackState | null | undefined;
   /**
@@ -2070,6 +2136,10 @@ export type DeploymentDetailResponse = {
    * A customer encryption key is unavailable. Dependent resources are preserved until access returns.
    */
   customerKeyUnavailable?: boolean | undefined;
+  /**
+   * Resource observations ordered by ID; empty before registration. Older servers may omit this field. Retry limits are not reported by the engine.
+   */
+  resources?: Array<DeploymentResource> | undefined;
   /**
    * Time of the last accepted runtime checkpoint or heartbeat; absent before registration.
    */
@@ -2084,6 +2154,31 @@ export type DeploymentDetailResponse = {
   operatorSync?: OperatorSync | null | undefined;
 };
 
+/** @internal */
+export const DeploymentDetailResponsePreparedStackApprovalPlugins$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackApprovalPlugins, unknown> = z
+    .object({
+      decision:
+        DeploymentDetailResponsePreparedStackPluginsDecision$inboundSchema,
+      maxRisk: z.nullable(z.string()).optional(),
+    });
+
+export function deploymentDetailResponsePreparedStackApprovalPluginsFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackApprovalPlugins,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackApprovalPlugins$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackApprovalPlugins' from JSON`,
+  );
+}
+
 /** @internal */
 export const DeploymentDetailResponsePreparedStackApprovalPluginsEnum$inboundSchema:
   z.ZodEnum<typeof DeploymentDetailResponsePreparedStackApprovalPluginsEnum> = z
@@ -2095,7 +2190,9 @@ export const DeploymentDetailResponsePreparedStackPluginsApprovalUnion$inboundSc
     DeploymentDetailResponsePreparedStackPluginsApprovalUnion,
     unknown
   > = z.union([
-    DeploymentDetailResponsePreparedStackApprovalPlugins$inboundSchema,
+    z.lazy(() =>
+      DeploymentDetailResponsePreparedStackApprovalPlugins$inboundSchema
+    ),
     DeploymentDetailResponsePreparedStackApprovalPluginsEnum$inboundSchema,
   ]);
 
@@ -2222,7 +2319,9 @@ export const DeploymentDetailResponsePreparedStackPlugins$inboundSchema:
     approval: z.record(
       z.string(),
       z.union([
-        DeploymentDetailResponsePreparedStackApprovalPlugins$inboundSchema,
+        z.lazy(() =>
+          DeploymentDetailResponsePreparedStackApprovalPlugins$inboundSchema
+        ),
         DeploymentDetailResponsePreparedStackApprovalPluginsEnum$inboundSchema,
       ]),
     ).optional(),
@@ -4359,6 +4458,8 @@ export const DeploymentDetailResponsePreparedStackResources$inboundSchema:
       dependencies: z.array(z.lazy(() =>
         DeploymentDetailResponsePreparedStackDependency$inboundSchema
       )),
+      description: z.nullable(z.string()).optional(),
+      displayName: z.nullable(z.string()).optional(),
       enabledWhen: z.nullable(z.string()).optional(),
       lifecycle: DeploymentDetailResponsePreparedStackLifecycle$inboundSchema,
       remoteAccess: z.boolean().optional(),
@@ -4637,6 +4738,8 @@ export const DeploymentDetailResponseRuntimeMetadata$inboundSchema: z.ZodType<
   credentialRetry: z.nullable(
     DeploymentDetailResponseCredentialRetryUnion$inboundSchema,
   ).optional(),
+  deletionPolicy: DeploymentDetailResponseDeletionPolicy$inboundSchema
+    .optional(),
   deployerSecrets: z.array(DeploymentDetailResponseDeployerSecret$inboundSchema)
     .optional(),
   directSetupRevision: z.nullable(z.string()).optional(),
@@ -4662,6 +4765,13 @@ export const DeploymentDetailResponseRuntimeMetadata$inboundSchema: z.ZodType<
     ]),
   ).optional(),
   registryAccessGranted: z.boolean().optional(),
+  retainedDataProtectionStartedAt: z.nullable(
+    z.iso.datetime({ offset: true }).transform(v => new Date(v)),
+  ).optional(),
+  retainedStorageProtectionConfirmedAt: z.nullable(
+    z.iso.datetime({ offset: true }).transform(v => new Date(v)),
+  ).optional(),
+  retainedStorageProtectionHash: z.nullable(z.string()).optional(),
   setupScaffolding: z.record(
     z.string(),
     z.lazy(() => DeploymentDetailResponseSetupScaffolding$inboundSchema),
@@ -4674,6 +4784,7 @@ export const DeploymentDetailResponseRuntimeMetadata$inboundSchema: z.ZodType<
       z.string(),
     ]),
   ).optional(),
+  vaultCredentialsRevoked: z.boolean().optional(),
 });
 
 export function deploymentDetailResponseRuntimeMetadataFromJSON(
@@ -4839,6 +4950,7 @@ export const DeploymentDetailResponse$inboundSchema: z.ZodType<
   managerId: z.string(),
   workspaceId: z.string(),
   customerKeyUnavailable: z.boolean().optional(),
+  resources: z.array(DeploymentResource$inboundSchema).optional(),
   resourceObservedAt: z.nullable(
     z.iso.datetime({ offset: true }).transform(v => new Date(v)),
   ).optional(),