@alienplatform/sdk 2.0.1 → 2.1.0

package/dist/dist.js

@@ -5119,6 +5119,43 @@ const AwsDynamoDbKvHeartbeatDataSchema = object({
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
+/**
+* @description A single Easy-DKIM CNAME record.
+*/
+const AwsEmailDkimTokenImportDataSchema = object({
+	"name": string().describe("CNAME record host name."),
+	"value": string().describe("CNAME record value.")
+}).describe("A single Easy-DKIM CNAME record.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Per-domain import payload for an AWS Email resource.
+*/
+const AwsEmailDomainImportDataSchema = object({ get "dkimTokens"() {
+	return array(AwsEmailDkimTokenImportDataSchema.describe("A single Easy-DKIM CNAME record.")).describe("Easy-DKIM CNAME tokens (three per domain). The domain is verified by\nSES once these records exist in its DNS configuration.");
+} }).describe("Per-domain import payload for an AWS Email resource.");
+object({
+	"configurationSet": string().describe("SES configuration set name (used when sending)."),
+	"domains": object({}).catchall(lazy(() => AwsEmailDomainImportDataSchema).describe("Per-domain import payload for an AWS Email resource.")).describe("Per-seed-domain DNS data, keyed by mail domain."),
+	"ruleSetName": string().describe("SES receipt rule set name, present only when inbound mail is\nconfigured. Activating the rule set is a manual post-deploy step.").nullish()
+}).describe("AWS Email ImportData.\n\nMirrors the `emit_import_ref` payload of the AWS SES email emitter: the\nshared configuration set name, one entry per seed domain carrying its\nEasy-DKIM CNAME records, and — when inbound mail is configured — the\nreceipt rule set name. Identities created at runtime through the\n`email/manage-identities` grant are application data and never appear\nhere.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description AWS subnets grouped by their real availability zone.
+*/
+const AwsFailureDomainSubnetsSchema = object({
+	"privateSubnetIds": optional(array(string()).describe("Private subnet IDs in this availability zone.")),
+	"publicSubnetIds": optional(array(string()).describe("Public subnet IDs in this availability zone."))
+}).describe("AWS subnets grouped by their real availability zone.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
 const ServiceAccountHeartbeatStatusSchema = object({
 	get "collectionIssues"() {
 		return array(HeartbeatCollectionIssueSchema);
@@ -5213,12 +5250,37 @@ object({
 	"publicRouteTableId": string().describe("Public route table ID.").nullish(),
 	"publicSubnetIds": array(string()).describe("Public subnet IDs."),
 	"securityGroupId": string().describe("Security group ID for private workloads.").nullish(),
+	"subnetsByFailureDomain": optional(object({}).catchall(lazy(() => AwsFailureDomainSubnetsSchema).describe("AWS subnets grouped by their real availability zone.")).describe("Exact subnet membership keyed by real availability zone.")),
 	"vpcId": string().describe("VPC ID. Absent when default-VPC mode defers lookup to AWS at runtime.").nullish()
 }).describe("AWS Network ImportData.");
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
+/**
+* @description Workload type for an OpenSearch Serverless collection.\n\n`TIMESERIES` is intentionally not exposed: next-generation serverless\nscale-to-zero targets search and vector workloads.
+*/
+const AwsOpenSearchCollectionTypeSchema = _enum(["search", "vectorSearch"]).describe("Workload type for an OpenSearch Serverless collection.\n\n`TIMESERIES` is intentionally not exposed: next-generation serverless\nscale-to-zero targets search and vector workloads.");
+object({
+	"collectionArn": string().describe("ARN of the collection."),
+	"collectionId": string().describe("Server-assigned collection id."),
+	"collectionName": string().describe("Physical collection name (`{id}-{stack-suffix}`)."),
+	"endpoint": string().describe("Collection endpoint (`https://<collectionId>.aoss.<region>.on.aws`).\nRequests must be SigV4-signed with service name `aoss`.")
+}).describe("AWS OpenSearch (`experimental/aws-opensearch`) ImportData.\n\nMirrors the `emit_import_ref` payload of the AWS OpenSearch Serverless\nemitter. Next-generation collections expose no Dashboards endpoint, so\nonly the data-plane endpoint and identifiers are carried.");
+object({
+	"collectionArn": string().describe("ARN of the collection."),
+	"endpoint": string().describe("Collection endpoint (`https://<collectionId>.aoss.<region>.on.aws`).\nRequests must be SigV4-signed with service name `aoss`.")
+}).describe("Outputs generated by a successfully provisioned AwsOpenSearch collection.\n\nNext-generation collections expose no OpenSearch Dashboards endpoint\n(the `DashboardEndpoint` attribute exists only for classic collections),\nso only the data-plane endpoint and ARN are surfaced.");
+object({
+	get "collectionType"() {
+		return AwsOpenSearchCollectionTypeSchema.describe("Workload type for an OpenSearch Serverless collection.\n\n`TIMESERIES` is intentionally not exposed: next-generation serverless\nscale-to-zero targets search and vector workloads.").optional();
+	},
+	"id": string().describe("Identifier for the collection. Becomes part of the physical collection\nname, so it must match `[a-z][a-z0-9-]*` and be at most 23 characters.")
+}).describe("An Amazon OpenSearch Serverless collection (next generation).\n\n# Experimental namespace\n\nThis is the first resource under the `experimental/` resource-type\nnamespace. Experimental resources are provider-specific (they do not\nabstract over clouds), may change or be promoted to a portable resource\nin a breaking way, and are only registered for the platforms they\nsupport. `AwsOpenSearch` registers an AWS CloudFormation emitter only;\ndeploying it to any other platform fails with a typed\n`ImportRegistrationMissing` error at generation time.\n\n# What gets provisioned\n\nThe AWS emitter provisions next-generation OpenSearch Serverless:\na collection group (`Generation: NEXTGEN`, compute/storage decoupled,\nscale-to-zero) plus a collection inside it, an AWS-owned-key encryption\nconfiguration, a public network policy, and a data-access policy for\nservice-account roles granted `experimental/aws-opensearch/data-access`.\nThe collection endpoint is public but every request must be SigV4-signed\nand pass both IAM (`aoss:APIAccessAll`) and the data-access policy.\n\n# Naming\n\nThe physical collection (and collection group) name is\n`{id}-{stack-suffix}` and must satisfy the AOSS name grammar, so `id`\nmust match `[a-z][a-z0-9-]*` and be at most 23 characters. The emitter\nrejects ids that don't fit.\n\n# Runtime access\n\nWorkers reach the collection over HTTPS with SigV4. The SigV4 signing\nservice name for OpenSearch Serverless is `aoss` (not `es`); the runtime\nbinding payload carries `\"service\": \"aoss\"` so clients sign correctly.\nRequests with a body must also send an `x-amz-content-sha256` header\n(the AOSS gateway rejects body-carrying requests without it with an\nempty 403); official OpenSearch clients with an `aoss` signer handle\nthis automatically.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
 const VaultHeartbeatStatusSchema = object({
 	get "collectionIssues"() {
 		return array(HeartbeatCollectionIssueSchema);
@@ -5601,6 +5663,7 @@ const AzureComputeClusterHeartbeatDataSchema = object({
 object({
 	"clusterId": string().describe("Cluster identifier used by the controller."),
 	"clusterIdentityPrincipalId": string().describe("AKS cluster identity principal id (system-assigned identity)."),
+	"identityId": string().describe("Resource ID of the user-assigned identity attached to cluster VMs."),
 	"kubeletIdentityClientId": string().describe("kubelet UAMI client id used by node pools.")
 }).describe("Azure ComputeCluster ImportData — AKS node pool identity / network.");
 /**
@@ -6700,20 +6763,39 @@ object({
 		return array(CapacityGroupSchema.describe("Capacity group definition.\n\nA capacity group represents machines with identical hardware profiles.\nEach group becomes a separate Auto Scaling Group (AWS), Managed Instance Group (GCP),\nor VM Scale Set (Azure).")).describe("Capacity groups defining the machine pools for this cluster.\nEach group becomes a separate ASG/MIG/VMSS.");
 	},
 	"containerCidr": string().describe("Container CIDR block for internal container networking.\nAuto-generated as \"10.244.0.0/16\" if not specified.\nEach machine gets a /24 subnet from this range.").nullish(),
-	"id": string().describe("Unique identifier for the container cluster.\nMust contain only alphanumeric characters, hyphens, and underscores.")
+	"failureDomainSpread": optional(object({}).catchall(int().min(0)).describe("Requested failure-domain spread keyed by capacity group.\nEmpty preserves the existing aggregate layout.")),
+	"id": string().describe("Unique identifier for the container cluster.\nMust contain only alphanumeric characters, hyphens, and underscores."),
+	"selectedFailureDomains": optional(object({}).catchall(array(string())).describe("Concrete provider failure domains selected during setup, keyed by capacity group.\nEmpty preserves the existing aggregate layout when no spread policy is configured."))
 }).describe("ComputeCluster resource for running long-running container workloads.\n\nA ComputeCluster provides the setup-owned machine boundary for containers.\nAlien may manage the worker fleet inside that boundary when setup grants\n`compute-cluster/management`.\n\n## Architecture\n\n- **Setup** creates cloud resources: ASGs/MIGs/VMSSs, IAM roles, security groups\n- **Alien** manages allowed fleet operations: machine count and runtime\n  machine image rollout\n- A node agent runs on each machine from the selected runtime image channel\n\n## Example\n\n```rust\nuse alien_core::{CapacityGroup, ComputeCluster, MachineProfile};\n\nlet cluster = ComputeCluster::new(\"compute\".to_string())\n    .capacity_group(CapacityGroup {\n        group_id: \"general\".to_string(),\n        instance_type: None,\n        profile: Some(MachineProfile {\n            cpu: \"4.0\".to_string(),\n            memory_bytes: 16 * 1024 * 1024 * 1024,\n            ephemeral_storage_bytes: 20 * 1024 * 1024 * 1024,\n            architecture: None,\n            gpu: None,\n        }),\n        min_size: 1,\n        max_size: 5,\n        scale_policy: None,\n        nested_virtualization: None,\n    })\n    .build();\n```");
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
 /**
+* @description Failure-domain policy selected for a compute pool.
+*/
+const FailureDomainSelectionSchema = object({
+	"selectedFailureDomains": optional(array(string()).describe("Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation.")),
+	"spread": int().min(0).describe("Number of distinct failure domains across which new stateful replicas may be spread.")
+}).describe("Failure-domain policy selected for a compute pool.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
 * @description User-selected deployment settings for one compute pool.
 */
 const ComputePoolSelectionSchema = union([object({
+	get "failure_domains"() {
+		return union([FailureDomainSelectionSchema, _null()]).optional();
+	},
 	"machine": string().describe("Provider machine type selected for this deployment.").nullish(),
 	"machines": int().min(0).describe("Number of machines to run."),
 	"mode": _enum(["fixed"])
 }), object({
+	get "failure_domains"() {
+		return union([FailureDomainSelectionSchema, _null()]).optional();
+	},
 	"machine": string().describe("Provider machine type selected for this deployment.").nullish(),
 	"max": int().min(0).describe("Maximum machine count."),
 	"min": int().min(0).describe("Minimum machine count."),
@@ -7066,6 +7148,14 @@ const ContainerStatusSchema = _enum([
 * Do not edit manually.
 */
 /**
+* @description Protocol for public workload endpoints.
+*/
+const ExposeProtocolSchema = _enum(["http", "tcp"]).describe("Protocol for public workload endpoints.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
 * @description Load balancer endpoint information for DNS management.\nThis is optional metadata used by the DNS controller to create domain mappings.
 */
 const LoadBalancerEndpointSchema = object({
@@ -7084,6 +7174,10 @@ const PublicEndpointOutputSchema = object({
 	get "loadBalancerEndpoint"() {
 		return union([LoadBalancerEndpointSchema, _null()]).optional();
 	},
+	"port": int().min(1).max(65535).describe("Public connection port."),
+	get "protocol"() {
+		return ExposeProtocolSchema.describe("Protocol for public workload endpoints.");
+	},
 	"url": string().describe("Base URL for this endpoint."),
 	"wildcardHost": string().describe("Wildcard hostname routed to this endpoint, when configured.").nullish()
 }).describe("Runtime-resolved public endpoint metadata.");
@@ -7152,14 +7246,6 @@ const PersistentStorageSchema = object({
 * Do not edit manually.
 */
 /**
-* @description Protocol for public workload endpoints.
-*/
-const ExposeProtocolSchema = _enum(["http", "tcp"]).describe("Protocol for public workload endpoints.");
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
-/**
 * @description Public endpoint configuration for port-backed workload resources.
 */
 const PublicEndpointSchema = object({
@@ -7575,6 +7661,62 @@ const DomainSettingsSchema = object({
 * Do not edit manually.
 */
 /**
+* @description A single DKIM CNAME record the operator must create in DNS.
+*/
+const EmailDkimTokenSchema = object({
+	"name": string().describe("CNAME record host name."),
+	"value": string().describe("CNAME record value.")
+}).describe("A single DKIM CNAME record the operator must create in DNS.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Per-domain DNS records the operator must create.
+*/
+const EmailDomainOutputsSchema = object({ get "dkimTokens"() {
+	return array(EmailDkimTokenSchema.describe("A single DKIM CNAME record the operator must create in DNS.")).describe("Easy-DKIM CNAME tokens (three per domain). The domain is verified once\nthese records exist in its DNS configuration.");
+} }).describe("Per-domain DNS records the operator must create.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Sending-event configuration for an [`Email`] resource.
+*/
+const EmailEventsSchema = object({ get "queue"() {
+	return ResourceRefSchema.describe("Reference to a resource by its stable id and resource type.");
+} }).describe("Sending-event configuration for an [`Email`] resource.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Inbound-mail configuration for an [`Email`] resource.
+*/
+const EmailInboundSchema = object({ get "storage"() {
+	return ResourceRefSchema.describe("Reference to a resource by its stable id and resource type.");
+} }).describe("Inbound-mail configuration for an [`Email`] resource.");
+object({
+	"configurationSet": string().describe("The provisioned configuration set name (used when sending)."),
+	"domains": object({}).catchall(lazy(() => EmailDomainOutputsSchema).describe("Per-domain DNS records the operator must create.")).describe("DNS records per mail domain."),
+	"ruleSetName": string().describe("The inbound receipt rule set name, when `inbound` is configured.\nActivating it is a manual post-deploy step — CloudFormation cannot\nactivate a receipt rule set, and only one can be active per account.").nullish()
+}).describe("Outputs generated by a successfully provisioned Email resource.\n\nDomain verification status cannot be known at provisioning time — SES\nverifies a domain asynchronously once its DKIM records exist in DNS — so\nthe outputs carry the records the operator must create rather than a\nverification result.");
+object({
+	"domains": optional(array(string()).describe("Seed mail domains provisioned at deploy time (one SES identity each).\nUseful for day-0 bootstrap and products with a static domain set.\nMay be empty (the default): products that create and verify domains\ndynamically should manage identities at runtime through the\n`email/manage-identities` grant instead of listing them here.")),
+	get "events"() {
+		return union([EmailEventsSchema, _null()]).optional();
+	},
+	"id": string().describe("Identifier for the email resource. Must contain only alphanumeric\ncharacters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."),
+	get "inbound"() {
+		return union([EmailInboundSchema, _null()]).optional();
+	}
+}).describe("Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change. Two caveats apply:\n\n* SES allows only **one active receipt rule set per AWS account**, and\n  CloudFormation has no resource that activates a rule set. Activating the\n  provisioned rule set is a documented post-deploy step:\n  `aws ses set-active-receipt-rule-set --rule-set-name <ruleSetName>`.\n* SES email receiving is only available in a subset of AWS regions (see the\n  SES endpoints documentation). Deploying `inbound` to an unsupported\n  region fails at the CloudFormation layer.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
 * @description Response handling configuration for deployments
 */
 const ResponseHandlingSchema = object({

package/dist/worker-runtime/event-loop.d.ts

@@ -5,6 +5,17 @@
  */
 import { type Channel } from "nice-grpc";
 import type { getControlServiceDefinition } from "./service-definitions.js";
+/**
+ * Handlers register by the resource's logical name (the name given in the
+ * stack program), but cloud transports deliver events keyed by the provider's
+ * physical identifier — the S3 bucket name for storage events, the SQS queue
+ * name for queue messages. Resolve a registered source through its
+ * `ALIEN_<NAME>_BINDING` env payload so both spellings match. Local transports
+ * dispatch logical names directly, so this only widens the match.
+ */
+export declare function physicalSourceNames(source: string): string[];
+/** @internal exported for tests */
+export declare function sourceMatches(src: string, physical: string): boolean;
 /**
  * Event loop runner for processing tasks from the runtime.
  *

package/dist/worker-runtime/event-loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"event-loop.d.ts","sourceRoot":"","sources":["../../src/worker-runtime/event-loop.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,KAAK,OAAO,EAAgB,MAAM,WAAW,CAAA;AAkBtD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AAE3E;;;;GAIG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgD;IACxE,OAAO,CAAC,OAAO,CAAQ;gBAGrB,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC;IAQzD;;;;OAIG;YACW,aAAa;IAQ3B;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BvC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAYd,YAAY;YAaZ,UAAU;YA4DV,aAAa;YAyBb,cAAc;IAqB5B,OAAO,CAAC,qBAAqB;IA4B7B,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,qBAAqB;CA4B9B"}
+{"version":3,"file":"event-loop.d.ts","sourceRoot":"","sources":["../../src/worker-runtime/event-loop.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,KAAK,OAAO,EAAgB,MAAM,WAAW,CAAA;AAkBtD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AAE3E;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAe5D;AAED,mCAAmC;AACnC,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEpE;AAED;;;;GAIG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgD;IACxE,OAAO,CAAC,OAAO,CAAQ;gBAGrB,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC;IAQzD;;;;OAIG;YACW,aAAa;IAQ3B;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BvC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAYd,YAAY;YAaZ,UAAU;YAmEV,aAAa;YAyBb,cAAc;IAqB5B,OAAO,CAAC,qBAAqB;IA4B7B,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,qBAAqB;CA4B9B"}

package/dist/worker-runtime/index.js

@@ -27539,6 +27539,32 @@ async function wrapGrpcCall(service, method, call) {
 //#endregion
 //#region src/worker-runtime/event-loop.ts
 /**
+* Handlers register by the resource's logical name (the name given in the
+* stack program), but cloud transports deliver events keyed by the provider's
+* physical identifier — the S3 bucket name for storage events, the SQS queue
+* name for queue messages. Resolve a registered source through its
+* `ALIEN_<NAME>_BINDING` env payload so both spellings match. Local transports
+* dispatch logical names directly, so this only widens the match.
+*/
+function physicalSourceNames(source) {
+	const raw = process.env[`ALIEN_${source.replaceAll("-", "_").toUpperCase()}_BINDING`];
+	if (!raw) return [];
+	try {
+		const binding = JSON.parse(raw);
+		return [
+			binding.bucketName,
+			binding.queueName,
+			binding.queueUrl?.split("/").pop()
+		].filter((name) => typeof name === "string" && name.length > 0);
+	} catch {
+		return [];
+	}
+}
+/** @internal exported for tests */
+function sourceMatches(src, physical) {
+	return src === "*" || src === physical || physicalSourceNames(src).includes(physical);
+}
+/**
 * Event loop runner for processing tasks from the runtime.
 *
 * @internal
@@ -27621,7 +27647,7 @@ var EventLoop = class {
 			for (const entry of getEventHandlers().values()) {
 				const src = entry.registration.source;
 				if (task.storageEvent && entry.registration.type === "storage") {
-					if (src === "*" || src === task.storageEvent.bucket) {
+					if (sourceMatches(src, task.storageEvent.bucket)) {
 						matchedEntry = entry;
 						break;
 					}
@@ -27631,7 +27657,7 @@ var EventLoop = class {
 						break;
 					}
 				} else if (task.queueMessage && entry.registration.type === "queue") {
-					if (src === "*" || src === task.queueMessage.source) {
+					if (sourceMatches(src, task.queueMessage.source)) {
 						matchedEntry = entry;
 						break;
 					}
@@ -27639,6 +27665,10 @@ var EventLoop = class {
 			}
 			if (!matchedEntry) {
 				console.warn(`No handler found for task: ${task.taskId}`);
+				await this.sendTaskResult(task.taskId, {
+					success: false,
+					error: `No handler registered for task ${task.taskId}`
+				});
 				return;
 			}
 			if (task.storageEvent) await matchedEntry.handler(this.fromProtoStorageEvent(task.storageEvent));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alienplatform/sdk",
-  "version": "2.0.1",
+  "version": "2.1.0",
   "type": "module",
   "files": [
     "dist"
@@ -53,8 +53,8 @@
     "nice-grpc": "^2.1.11",
     "nice-grpc-common": "^2.0.2",
     "zod": "4.3.2",
-    "@alienplatform/bindings": "^2.0.1",
-    "@alienplatform/core": "^2.0.1"
+    "@alienplatform/bindings": "^2.1.0",
+    "@alienplatform/core": "^2.1.0"
   },
   "scripts": {
     "build": "tsdown && tsc --emitDeclarationOnly",