@alienplatform/sdk 3.3.26 → 3.3.28

package/dist/dist.js

@@ -5325,6 +5325,7 @@ const DeploymentStatusSchema = _enum([
 	"initial-setup-failed",
 	"provisioning",
 	"waiting-for-machines",
+	"waiting-for-secrets",
 	"provisioning-failed",
 	"running",
 	"refresh-failed",
@@ -8341,7 +8342,7 @@ object({
 	"failureDomainSpread": optional(object({}).catchall(int().min(0)).describe("Requested failure-domain spread keyed by capacity group.\nEmpty preserves the existing aggregate layout.")),
 	"id": string().describe("Unique identifier for the container cluster.\nMust contain only alphanumeric characters, hyphens, and underscores."),
 	"selectedFailureDomains": optional(object({}).catchall(array(string())).describe("Concrete provider failure domains selected during setup, keyed by capacity group.\nEmpty preserves the existing aggregate layout when no spread policy is configured."))
-}).describe("ComputeCluster resource for running long-running container workloads.\n\nA ComputeCluster provides the setup-owned machine boundary for containers.\nAlien may manage the worker fleet inside that boundary when setup grants\n`compute-cluster/management`.\n\n## Architecture\n\n- **Setup** creates cloud resources: ASGs/MIGs/VMSSs, IAM roles, security groups\n- **Alien** manages allowed fleet operations: machine count and runtime\n  machine image rollout\n- A node agent runs on each machine from the selected runtime image channel\n\n## Example\n\n```rust\nuse alien_core::{CapacityGroup, ComputeCluster, MachineProfile};\n\nlet cluster = ComputeCluster::new(\"compute\".to_string())\n    .capacity_group(CapacityGroup {\n        group_id: \"general\".to_string(),\n        instance_type: None,\n        profile: Some(MachineProfile {\n            cpu: \"4.0\".to_string(),\n            memory_bytes: 16 * 1024 * 1024 * 1024,\n            ephemeral_storage_bytes: 20 * 1024 * 1024 * 1024,\n            architecture: None,\n            gpu: None,\n        }),\n        min_size: 1,\n        max_size: 5,\n        scale_policy: None,\n        nested_virtualization: None,\n    })\n    .build();\n```");
+}).describe("ComputeCluster resource for running long-running container workloads.\n\nA ComputeCluster provides the setup-owned machine boundary for containers.\nAlien may manage the worker fleet inside that boundary when setup grants\n`compute-cluster/management`.\n\n## Architecture\n\n- **Setup** creates cloud resources: ASGs/MIGs/VMSSs, IAM roles, security groups\n- **Alien** manages allowed fleet operations: machine count, runtime\n  machine image rollout and, on AWS, the machine type within one CPU architecture\n- A node agent runs on each machine from the selected runtime image channel\n\n## Example\n\n```rust\nuse alien_core::{CapacityGroup, ComputeCluster, MachineProfile};\n\nlet cluster = ComputeCluster::new(\"compute\".to_string())\n    .capacity_group(CapacityGroup {\n        group_id: \"general\".to_string(),\n        instance_type: None,\n        profile: Some(MachineProfile {\n            cpu: \"4.0\".to_string(),\n            memory_bytes: 16 * 1024 * 1024 * 1024,\n            ephemeral_storage_bytes: 20 * 1024 * 1024 * 1024,\n            architecture: None,\n            gpu: None,\n        }),\n        min_size: 1,\n        max_size: 5,\n        scale_policy: None,\n        nested_virtualization: None,\n    })\n    .build();\n```");
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
@@ -8840,6 +8841,14 @@ const ContainerSecuritySchema = object({
 * Do not edit manually.
 */
 /**
+* @description A container port reachable from the control plane through the manager.\n\nRequests to `/v1/deployments/{deployment}/tunnels/{container}/...` on the\nmanager are forwarded to this port over the operator\'s outbound\nconnection, so the control plane can call the service without any inbound\nnetwork path into the deployment.
+*/
+const ContainerTunnelSchema = object({ "port": int().min(0).describe("Container port that serves HTTP. Must be one of the container's ports.") }).describe("A container port reachable from the control plane through the manager.\n\nRequests to `/v1/deployments/{deployment}/tunnels/{container}/...` on the\nmanager are forwarded to this port over the operator's outbound\nconnection, so the control plane can call the service without any inbound\nnetwork path into the deployment.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
 * @description HTTP health check configuration.
 */
 const HealthCheckSchema = object({
@@ -8962,7 +8971,10 @@ object({
 		return union([ContainerSecuritySchema, _null()]).optional();
 	},
 	"stateful": optional(boolean().describe("Whether container is stateful (gets stable ordinals, optional persistent volumes)")),
-	"stopGracePeriodSeconds": int().min(1).max(86400).describe("Grace period in seconds for stopping replicas during updates, drains, and deletes.\n\nWhen omitted, the runtime backend applies its default. Valid values are\n1 second through 24 hours.").nullish()
+	"stopGracePeriodSeconds": int().min(1).max(86400).describe("Grace period in seconds for stopping replicas during updates, drains, and deletes.\n\nWhen omitted, the runtime backend applies its default. Valid values are\n1 second through 24 hours.").nullish(),
+	get "tunnel"() {
+		return union([ContainerTunnelSchema, _null()]).optional();
+	}
 }).describe("Container resource for running long-running container workloads.\n\nA Container defines a deployable unit that runs on a ComputeCluster.\nThe managed container backend handles scheduling replicas across machines,\nautoscaling based on various metrics, and service discovery.\n\n## Example\n\n```rust\nuse alien_core::{Container, ContainerCode, ResourceSpec, ContainerAutoscaling, PublicEndpoint, ExposeProtocol};\n\nlet container = Container::new(\"api\".to_string())\n    .cluster(\"compute\".to_string())\n    .code(ContainerCode::Image {\n        image: \"myapp:latest\".to_string(),\n    })\n    .cpu(ResourceSpec { min: \"0.5\".to_string(), desired: \"1\".to_string() })\n    .memory(ResourceSpec { min: \"512Mi\".to_string(), desired: \"1Gi\".to_string() })\n    .port(8080)\n    .public_endpoint(PublicEndpoint {\n        name: \"api\".to_string(),\n        port: 8080,\n        protocol: ExposeProtocol::Http,\n        host_label: None,\n        wildcard_subdomains: false,\n    })\n    .autoscaling(ContainerAutoscaling {\n        min: 2,\n        desired: 3,\n        max: 10,\n        target_cpu_percent: Some(70.0),\n        target_memory_percent: None,\n        target_http_in_flight_per_replica: Some(100),\n        max_http_p95_latency_ms: None,\n    })\n    .permissions(\"container-execution\".to_string())\n    .build();\n```");
 object({
 	"command": string().describe("Command name (e.g., \"generate-report\", \"sync-data\")"),
@@ -9255,6 +9267,60 @@ object({
 * Do not edit manually.
 */
 /**
+* @description The secret store a deployer writes a vault-native secret into.
+*/
+const DeployerSecretStoreSchema = _enum([
+	"aws-parameter-store",
+	"gcp-secret-manager",
+	"azure-key-vault",
+	"kubernetes-secret",
+	"local-vault"
+]).describe("The secret store a deployer writes a vault-native secret into.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Where a deployer writes a vault-native secret.
+*/
+const DeployerSecretLocationSchema = object({
+	"cliCommand": string().describe("Command that writes the value, with `<VALUE>` in place of the secret."),
+	"consoleUrl": string().describe("Cloud console page where the secret is created, when the store has one.").nullish(),
+	"name": string().describe("Full name of the secret in that store."),
+	get "store"() {
+		return DeployerSecretStoreSchema.describe("The secret store a deployer writes a vault-native secret into.");
+	},
+	"vaultName": string().describe("The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project.").nullish()
+}).describe("Where a deployer writes a vault-native secret.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value.
+*/
+const DeployerSecretStatusSchema = _enum([
+	"present",
+	"missing",
+	"invalid"
+]).describe("Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value.");
+object({
+	"inputId": string().describe("Stack input id."),
+	"label": string().describe("The input's label."),
+	get "location"() {
+		return DeployerSecretLocationSchema.describe("Where a deployer writes a vault-native secret.");
+	},
+	"message": string().describe("Why the slot is invalid.").nullish(),
+	"required": boolean().describe("Whether the workload cannot start without it."),
+	get "status"() {
+		return DeployerSecretStatusSchema.describe("Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value.");
+	}
+}).describe("The state of one deployer secret slot, reported with the deployment.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
 * @description Deployment model: how updates are delivered to the remote environment.
 */
 const DeploymentModelSchema = _enum(["push", "pull"]).describe("Deployment model: how updates are delivered to the remote environment.");
@@ -9398,6 +9464,14 @@ object({
 * Do not edit manually.
 */
 /**
+* @description Reachability of the deployment\'s public endpoints, fixed at setup.
+*/
+const EndpointAccessSchema = _enum(["internet", "private"]).describe("Reachability of the deployment's public endpoints, fixed at setup.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
 * @description Response handling configuration for deployments
 */
 const ResponseHandlingSchema = object({
@@ -11203,7 +11277,7 @@ const SandboxEgressSchema = union([
 * @description How long a sandbox may live and when it is paused.\n\nDeclaration-time ceilings, not per-request values: every sandbox created through this\ndeclaration\'s binding is held to them, whatever a caller asks for at runtime.
 */
 const SandboxLifecyclePolicySchema = object({
-	"idlePauseSeconds": int().min(0).describe("Idle period after which the sandbox is paused, where the platform supports it").nullish(),
+	"idlePauseSeconds": int().min(0).describe("Idle period after which the sandbox is paused, where the platform supports it.\n\nStored state written before the rename calls this `idleSuspendSeconds`.").nullish(),
 	"maxLifetimeSeconds": int().min(0).describe("Wall-clock ceiling on a single sandbox, after which the platform terminates it.\n\nOptional because not every backend has the primitive: Kubernetes has\n`activeDeadlineSeconds` and AWS `maximumDurationInSeconds`, while neither Azure nor Local\nexpose one, so declaring a ceiling there is refused at plan time rather than accepted and\nnever applied. AWS caps it at 8 hours.").nullish()
 }).describe("How long a sandbox may live and when it is paused.\n\nDeclaration-time ceilings, not per-request values: every sandbox created through this\ndeclaration's binding is held to them, whatever a caller asks for at runtime.");
 /**
@@ -11224,6 +11298,14 @@ object({
 	"identifier": string().describe("Platform-specific identifier for the parent (image ARN, sandbox group id, namespace)").nullish(),
 	"parentName": string().describe("Name of the durable parent that sandboxes are created inside")
 }).describe("Outputs generated by a successfully provisioned Sandbox parent.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Opt-in supervisor-owned network enforcement. Caller requests cannot change this identity.
+*/
+const SandboxPrivilegedSupervisorSchema = object({ "commandUid": int().min(0).describe("Nonzero numeric uid and primary gid for every command, including the image entrypoint.") }).describe("Opt-in supervisor-owned network enforcement. Caller requests cannot change this identity.");
 object({
 	get "code"() {
 		return SandboxCodeSchema.describe("Specifies where the sandbox's root filesystem comes from.");
@@ -11239,7 +11321,10 @@ object({
 		return union([SandboxLimitsSchema, _null()]).optional();
 	},
 	"previewPorts": optional(array(int().min(0)).describe("Ports eligible for a preview capability. An application reaches its sandbox through the\nprovider, so it cannot widen its own ingress at runtime; a holder of a remote binding's\ncredentials is bounded by no port condition, which is why a remote sandbox declares none.")),
-	"privateBaseImage": string().describe("Private ECR base image an AWS build pulls; `code.image` names only the S3 bundle, so this is\nwhat the cross-account grant opens. Live only: the grant needs the customer account,\nwhich registration reports. Absent means the base image is pulled anonymously.").nullish()
+	"privateBaseImage": string().describe("Private ECR base image an AWS build pulls; `code.image` names only the S3 bundle, so this is\nwhat the cross-account grant opens. Live only: the grant needs the customer account,\nwhich registration reports. Absent means the base image is pulled anonymously.").nullish(),
+	get "privilegedSupervisor"() {
+		return union([SandboxPrivilegedSupervisorSchema, _null()]).optional();
+	}
 }).describe("An isolated environment for running untrusted code, created at runtime.");
 object({ "timestamp": datetime().describe("The timestamp when the event was scheduled or triggered.") }).describe("Represents a scheduled event trigger, typically from a cron job or timer.\n\nThis struct aims to provide a common representation for scheduled events\nacross different providers like AWS CloudWatch Events, Google Cloud Scheduler,\nand Azure Timer Triggers.");
 object({
@@ -11289,6 +11374,9 @@ const StackSettingsSchema = object({
 	get "domains"() {
 		return union([DomainSettingsSchema, _null()]).optional();
 	},
+	get "endpointAccess"() {
+		return EndpointAccessSchema.describe("Reachability of the deployment's public endpoints, fixed at setup.").optional();
+	},
 	"externalBindings": object({}).describe("External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms.").nullish(),
 	get "heartbeats"() {
 		return HeartbeatsModeSchema.describe("How heartbeat health checks are handled.").optional();
@@ -11400,6 +11488,14 @@ const StackInputEnvironmentMappingSchema = object({
 * Do not edit manually.
 */
 /**
+* @description Asks Alien to generate a secret input\'s value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment\'s input values are first resolved, and then kept\nwith the deployment\'s other input values.
+*/
+const StackInputGenerateSchema = object({ "length": int().min(0).describe("Number of characters to generate.") }).describe("Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
 * @description Primitive stack input kind.
 */
 const StackInputKindSchema = _enum([
@@ -11452,6 +11548,9 @@ const StackInputDefinitionSchema = object({
 	get "env"() {
 		return array(StackInputEnvironmentMappingSchema.describe("How a resolved stack input is injected into runtime environment variables.")).describe("Runtime env-var mappings for v1 input resolution.").optional();
 	},
+	get "generate"() {
+		return union([StackInputGenerateSchema, _null()]).optional();
+	},
 	"id": string().describe("Stable input ID used by CLI/API calls."),
 	get "kind"() {
 		return StackInputKindSchema.describe("Primitive stack input kind.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alienplatform/sdk",
-  "version": "3.3.26",
+  "version": "3.3.28",
   "type": "module",
   "files": [
     "dist"
@@ -56,10 +56,10 @@
     "@grpc/grpc-js": "^1.14.4",
     "nice-grpc": "^2.1.11",
     "nice-grpc-common": "^2.0.2",
-    "zod": "4.5.2",
-    "@alienplatform/ai-gateway": "^3.3.26",
-    "@alienplatform/bindings": "^3.3.26",
-    "@alienplatform/core": "^3.3.26"
+    "zod": "^4.5.2",
+    "@alienplatform/ai-gateway": "^3.3.28",
+    "@alienplatform/bindings": "^3.3.28",
+    "@alienplatform/core": "^3.3.28"
   },
   "scripts": {
     "build": "tsdown && tsc --emitDeclarationOnly",