@alienplatform/sdk 3.3.24 → 3.3.26

package/dist/dist.js

@@ -6842,10 +6842,12 @@ const AwsPermissionEffectSchema = _enum(["Allow", "Deny"]);
 const BindingConfigurationAwsBindingSpecSchema = object({
 	"resource": optional(object({
 		"condition": object({}).catchall(object({}).catchall(string())).describe("Optional condition for additional filtering (rare)").nullish(),
+		"notResources": optional(array(string()).describe("ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else.")),
 		"resources": array(string()).describe("Resource ARNs to bind to")
 	}).describe("AWS-specific binding specification")),
 	"stack": optional(object({
 		"condition": object({}).catchall(object({}).catchall(string())).describe("Optional condition for additional filtering (rare)").nullish(),
+		"notResources": optional(array(string()).describe("ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else.")),
 		"resources": array(string()).describe("Resource ARNs to bind to")
 	}).describe("AWS-specific binding specification"))
 }).describe("Generic binding configuration for permissions");
@@ -8335,6 +8337,7 @@ object({
 		return array(CapacityGroupSchema.describe("Capacity group definition.\n\nA capacity group represents machines with identical hardware profiles.\nEach group becomes a separate Auto Scaling Group (AWS), Managed Instance Group (GCP),\nor VM Scale Set (Azure).")).describe("Capacity groups defining the machine pools for this cluster.\nEach group becomes a separate ASG/MIG/VMSS.");
 	},
 	"containerCidr": string().describe("Container CIDR block for internal container networking.\nAuto-generated as \"10.244.0.0/16\" if not specified.\nEach machine gets a /24 subnet from this range.").nullish(),
+	"dynamicContainerPool": string().describe("Pool reserved for containers created after a deployment is installed.\nIf absent, the runtime uses the `general` pool when it exists.").nullish(),
 	"failureDomainSpread": optional(object({}).catchall(int().min(0)).describe("Requested failure-domain spread keyed by capacity group.\nEmpty preserves the existing aggregate layout.")),
 	"id": string().describe("Unique identifier for the container cluster.\nMust contain only alphanumeric characters, hyphens, and underscores."),
 	"selectedFailureDomains": optional(object({}).catchall(array(string())).describe("Concrete provider failure domains selected during setup, keyed by capacity group.\nEmpty preserves the existing aggregate layout when no spread policy is configured."))
@@ -8511,6 +8514,18 @@ const HorizonContainerHeartbeatDataSchema = object({
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
+/**
+* @description Image a running container reports.
+*/
+const ContainerImageIdentitySchema = object({
+	"digest": string().describe("Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one.").nullish(),
+	"image": string().describe("Image reference reported by the container runtime."),
+	"name": string().describe("Container name.")
+}).describe("Image a running container reports.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
 const KubernetesOwnerReferenceSchema = object({
 	"controller": boolean(),
 	"kind": string(),
@@ -8522,6 +8537,9 @@ const KubernetesOwnerReferenceSchema = object({
 * Do not edit manually.
 */
 const KubernetesPodRuntimeUnitStatusSchema = object({
+	get "containers"() {
+		return array(ContainerImageIdentitySchema.describe("Image a running container reports.")).optional();
+	},
 	get "cpu"() {
 		return union([MetricSampleSchema, _null()]).optional();
 	},
@@ -8799,6 +8817,29 @@ const ContainerPortSchema = object({ "port": int().min(0).describe("Port number"
 * Do not edit manually.
 */
 /**
+* @description Security profile shared by container runtimes.
+*/
+const ContainerSecurityProfileSchema = _enum(["restricted"]).describe("Security profile shared by container runtimes.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Container process identity and filesystem security.
+*/
+const ContainerSecuritySchema = object({
+	get "profile"() {
+		return ContainerSecurityProfileSchema.describe("Security profile shared by container runtimes.");
+	},
+	"readOnlyRootFilesystem": boolean().describe("Mount the root filesystem read-only."),
+	"runAsGroup": int().describe("Numeric GID for the container process."),
+	"runAsUser": int().describe("Numeric UID for the container process.")
+}).describe("Container process identity and filesystem security.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
 * @description HTTP health check configuration.
 */
 const HealthCheckSchema = object({
@@ -8813,6 +8854,28 @@ const HealthCheckSchema = object({
 * Do not edit manually.
 */
 /**
+* @description HTTP probe used by Kubernetes for workload liveness or readiness.
+*/
+const KubernetesHttpProbeSchema = object({
+	"path": string().describe("Absolute HTTP path served by the container."),
+	"port": int().min(0).describe("Container port to check.")
+}).describe("HTTP probe used by Kubernetes for workload liveness or readiness.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Mounts an existing, setup-owned Kubernetes Secret into a Container pod.\nThe Secret must exist in the deployment namespace before the workload starts.
+*/
+const KubernetesSecretMountSchema = object({
+	"mountPath": string().describe("Directory where Kubernetes mounts the Secret's keys as read-only files."),
+	"secretName": string().describe("Name of the existing Secret in the deployment namespace.")
+}).describe("Mounts an existing, setup-owned Kubernetes Secret into a Container pod.\nThe Secret must exist in the deployment namespace before the workload starts.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
 * @description Persistent storage configuration for stateful containers.
 */
 const PersistentStorageSchema = object({
@@ -8868,6 +8931,15 @@ object({
 		return union([HealthCheckSchema, _null()]).optional();
 	},
 	"id": string().describe("Unique identifier for the container.\nMust be DNS-compatible: lowercase alphanumeric with hyphens."),
+	get "kubernetesLivenessProbe"() {
+		return union([KubernetesHttpProbeSchema, _null()]).optional();
+	},
+	get "kubernetesReadinessProbe"() {
+		return union([KubernetesHttpProbeSchema, _null()]).optional();
+	},
+	get "kubernetesSecretMounts"() {
+		return array(KubernetesSecretMountSchema.describe("Mounts an existing, setup-owned Kubernetes Secret into a Container pod.\nThe Secret must exist in the deployment namespace before the workload starts.")).describe("Existing Kubernetes Secrets mounted as read-only directories.").optional();
+	},
 	get "links"() {
 		return array(ResourceRefSchema.describe("Reference to a resource by its stable id and resource type.")).describe("Resource links (dependencies)");
 	},
@@ -8886,6 +8958,9 @@ object({
 		return array(PublicEndpointSchema.describe("Public endpoint configuration for port-backed workload resources.")).describe("Public endpoints exposed by the container.").optional();
 	},
 	"replicas": int().min(0).describe("Fixed replica count (for stateful containers or stateless without autoscaling)").nullish(),
+	get "security"() {
+		return union([ContainerSecuritySchema, _null()]).optional();
+	},
 	"stateful": optional(boolean().describe("Whether container is stateful (gets stable ordinals, optional persistent volumes)")),
 	"stopGracePeriodSeconds": int().min(1).max(86400).describe("Grace period in seconds for stopping replicas during updates, drains, and deletes.\n\nWhen omitted, the runtime backend applies its default. Valid values are\n1 second through 24 hours.").nullish()
 }).describe("Container resource for running long-running container workloads.\n\nA Container defines a deployable unit that runs on a ComputeCluster.\nThe managed container backend handles scheduling replicas across machines,\nautoscaling based on various metrics, and service discovery.\n\n## Example\n\n```rust\nuse alien_core::{Container, ContainerCode, ResourceSpec, ContainerAutoscaling, PublicEndpoint, ExposeProtocol};\n\nlet container = Container::new(\"api\".to_string())\n    .cluster(\"compute\".to_string())\n    .code(ContainerCode::Image {\n        image: \"myapp:latest\".to_string(),\n    })\n    .cpu(ResourceSpec { min: \"0.5\".to_string(), desired: \"1\".to_string() })\n    .memory(ResourceSpec { min: \"512Mi\".to_string(), desired: \"1Gi\".to_string() })\n    .port(8080)\n    .public_endpoint(PublicEndpoint {\n        name: \"api\".to_string(),\n        port: 8080,\n        protocol: ExposeProtocol::Http,\n        host_label: None,\n        wildcard_subdomains: false,\n    })\n    .autoscaling(ContainerAutoscaling {\n        min: 2,\n        desired: 3,\n        max: 10,\n        target_cpu_percent: Some(70.0),\n        target_memory_percent: None,\n        target_http_in_flight_per_replica: Some(100),\n        max_http_p95_latency_ms: None,\n    })\n    .permissions(\"container-execution\".to_string())\n    .build();\n```");
@@ -9240,6 +9315,32 @@ const DomainSettingsSchema = object({
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
+const DynamicContainerHealthCheckSchema = object({
+	"path": string(),
+	"port": int().min(0)
+});
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+const DynamicContainerStatusSchema = _enum([
+	"pending",
+	"running",
+	"failing",
+	"stopped"
+]);
+object({
+	"generation": int().min(0),
+	"message": string().nullish(),
+	"name": string(),
+	get "status"() {
+		return DynamicContainerStatusSchema;
+	}
+}).describe("What the Operator observed after applying one target generation.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
 /**
 * @description A single DKIM CNAME record the operator must create in DNS.
 */
@@ -10516,6 +10617,39 @@ const NetworkSettingsSchema = union([
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
+/**
+* @description A container image running in one observed application workload.
+*/
+const ObservedApplicationImageSchema = object({
+	"container": string().describe("Container name within the workload."),
+	"digest": string().describe("Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one.").nullish(),
+	"image": string().describe("Image reference reported by the container runtime."),
+	"workload": string().describe("Inventory identity of the workload, matching the `rawIdentity` of its\nobserved resource sample (for example `apps/v1:Deployment:shop:api`).")
+}).describe("A container image running in one observed application workload.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Where the Operator read the application identity from.
+*/
+const ObservedApplicationSourceSchema = _enum(["kubernetes"]).describe("Where the Operator read the application identity from.");
+object({
+	"chartName": string().describe("Helm chart name from the workloads' `helm.sh/chart` label. Present only\nwhen every labelled workload names the same chart.").nullish(),
+	"chartVersion": string().describe("Helm chart version from the same label.").nullish(),
+	"complete": boolean().describe("Whether every workload kind could be listed. When `false`, the chart\nand images describe only the workloads the Operator could read."),
+	get "images"() {
+		return array(ObservedApplicationImageSchema.describe("A container image running in one observed application workload.")).describe("Distinct container images running in the observed workloads.").optional();
+	},
+	"observedAt": datetime().describe("When the workloads were read."),
+	get "source"() {
+		return ObservedApplicationSourceSchema.describe("Where the Operator read the application identity from.");
+	}
+}).describe("Application release the Operator observes running in its environment.\n\nThis identifies the customer's application, not the Operator: the\nOperator's own image is reported separately as [`OperatorImageReport`].");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
 const RawHeartbeatSnippetFormatSchema = _enum([
 	"json",
 	"yaml",
@@ -10552,6 +10686,9 @@ const ObservedResourceSampleSchema = object({
 	get "health"() {
 		return ObservedHealthSchema;
 	},
+	get "images"() {
+		return array(ContainerImageIdentitySchema.describe("Image a running container reports.")).describe("Distinct container images the resource's running instances report, when\nthe provider exposes them.").optional();
+	},
 	"labels": optional(object({}).catchall(string())),
 	get "lifecycle"() {
 		return ProviderLifecycleStateSchema;
@@ -10998,7 +11135,7 @@ object({
 });
 object({
 	"domainEgressRules": boolean().describe("Egress can be restricted to a hostname allowlist"),
-	"egressDeny": boolean().describe("Whether a declared `deny` is actually enforced, rather than accepted and dropped"),
+	"egressDeny": boolean().describe("Whether a declared `deny` is actually enforced, rather than accepted and dropped.\nIt covers routed traffic; the `deny` mode says where DNS still resolves."),
 	"enforcedLimits": boolean().describe("The platform enforces the declared cpu, memory and disk ceilings"),
 	"files": boolean().describe("Files can be moved in and out of a sandbox"),
 	"jobs": boolean().describe("A command can be started, polled and cancelled across separate calls, so it outlives the\none that started it. False where nothing inside the sandbox owns the process in between."),
@@ -11034,7 +11171,7 @@ _enum([
 * @description Specifies where the sandbox\'s root filesystem comes from.
 */
 const SandboxCodeSchema = union([object({
-	"image": string().describe("Image reference (e.g. `ubuntu:24.04`, `ghcr.io/myorg/sandbox:latest`).\n\nTwo backends narrow it in opposite directions: AWS wants an `s3://` bundle, Azure a\nbare catalog name such as `ubuntu`. Each refuses the other's shape while planning."),
+	"image": string().describe("Image reference (e.g. `ubuntu:24.04`, `ghcr.io/myorg/sandbox:latest`). AWS wants an\n`s3://` bundle; Azure takes a catalog name such as `ubuntu` or an amd64 registry\nimage, told apart by syntax. Each refuses what it cannot take while planning."),
 	"type": _enum(["image"])
 }), object({
 	"src": string().describe("The source directory to build from"),
@@ -11334,6 +11471,8 @@ const StackInputDefinitionSchema = object({
 }).describe("Stack input definition serialized into a release stack.");
 union([object({ "external": string().describe("Reference to another stack by ID") }), _enum(["current"])]).describe("Reference to a stack for management permissions");
 object({
+	"dynamicContainerImageResources": optional(array(string()).describe("Released Container resources whose image repositories are approved for\ncontainers created after installation.")),
+	"dynamicContainerRepositories": optional(array(string()).describe("Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest.")),
 	"id": string().describe("Unique identifier for the stack"),
 	get "inputs"() {
 		return array(StackInputDefinitionSchema.describe("Stack input definition serialized into a release stack.")).describe("Input definitions required before setup or deployment can proceed.").optional();
@@ -11408,6 +11547,22 @@ object({
 	"versioning": optional(boolean().describe("Enables object versioning.\nDefault: `false`"))
 }).describe("Represents an object storage bucket.");
 lazy(() => CommandResponseSchema).describe("Command response from deployment").describe("Request to submit a command response (from deployment)");
+object({
+	"cpu": string(),
+	"deleted": boolean(),
+	"env": optional(object({}).catchall(string())),
+	"generation": int().min(0),
+	get "healthCheck"() {
+		return union([DynamicContainerHealthCheckSchema, _null()]).optional();
+	},
+	"image": string(),
+	"memory": string(),
+	"name": string(),
+	"ports": array(int().min(0)),
+	"replicas": int().min(0),
+	"secretEnv": optional(object({}).catchall(string())),
+	"suspendedReason": string().describe("Stop an installed workload when its release no longer admits the image.").nullish()
+}).describe("One release-independent container the Operator should run in its namespace.\nThe manager sends the complete set on every sync. An empty set removes\ncontainers previously owned by this deployment.");
 object({
 	get "bundles"() {
 		return array(OperationsBundleDownloadSchema.describe("One bundle the Operator needs to download to reach `targetBundleHash`.\nThe manager mints a short-lived presigned GET URL per bundle — the\nOperator never holds real cloud storage credentials, mirroring the OCI\nregistry proxy's credential-injection pattern.")).describe("Presigned downloads for every bundle in the target set. The Operator\nfetches only the ones it doesn't already have loaded at the right\nversion; already-loaded bundles are harmless to re-download.").optional();