@alienplatform/sdk 3.3.34 → 3.3.36

package/dist/dist.js

@@ -6187,6 +6187,9 @@ const EcrArtifactRegistryBindingSchema = object({
 	},
 	get "repositoryPrefix"() {
 		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "sandboxRepositoryPrefix"() {
+		return union([BindingValueStringSchema, _null()]).optional();
 	}
 }).describe("AWS ECR (Elastic Container Registry) binding configuration");
 /**
@@ -7086,9 +7089,25 @@ const AwsMicrovmSandboxHeartbeatDataSchema = object({
 		return SandboxHeartbeatStatusSchema;
 	}
 }).describe("AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Setup network coordinates; the deployment controller verifies actual EC2 routes and CIDRs.
+*/
+const AwsSandboxNetworkSchema = object({
+	"gatewayCidrs": array(string()).describe("Only destinations permitted by the connector security group."),
+	"gatewaySubnetIds": array(string()).describe("Dedicated NAT-routed subnets for the gateway's internal load balancer."),
+	"sandboxCidrs": array(string()).describe("Source ranges permitted on the gateway proxy port."),
+	"sandboxSubnetIds": array(string()).describe("Route-less connector subnet identifiers."),
+	"vpcCidrs": array(string()).describe("Every associated VPC IPv4 range, denied by the gateway."),
+	"workloadCidrs": array(string()).describe("Source ranges permitted on the gateway admin port.")
+}).describe("Setup network coordinates; the deployment controller verifies actual EC2 routes and CIDRs.");
 object({
 	"availabilityZones": array(string()).describe("Availability zone names used by created or BYO subnets."),
 	"cidrBlock": string().describe("VPC CIDR block when the VPC is created by this stack.").nullish(),
+	"egressPublicIps": optional(array(string()).describe("Public addresses allocated to this deployment's NAT; empty when unknown.")),
 	"eipAllocationId": string().describe("Elastic IP allocation ID backing the NAT gateway.").nullish(),
 	"internetGatewayId": string().describe("Internet gateway ID when created by this stack.").nullish(),
 	"isByoVpc": boolean().describe("True when the VPC is owned outside this stack."),
@@ -7097,6 +7116,9 @@ object({
 	"privateSubnetIds": array(string()).describe("Private subnet IDs."),
 	"publicRouteTableId": string().describe("Public route table ID.").nullish(),
 	"publicSubnetIds": array(string()).describe("Public subnet IDs."),
+	get "sandboxNetwork"() {
+		return union([AwsSandboxNetworkSchema, _null()]).optional();
+	},
 	"securityGroupId": string().describe("Security group ID for private workloads.").nullish(),
 	"subnetsByFailureDomain": optional(object({}).catchall(lazy(() => AwsFailureDomainSubnetsSchema).describe("AWS subnets grouped by their real availability zone.")).describe("Exact subnet membership keyed by real availability zone.")),
 	"vpcId": string().describe("VPC ID. Absent when default-VPC mode defers lookup to AWS at runtime.").nullish()
@@ -7350,7 +7372,7 @@ const AwsS3StorageHeartbeatDataSchema = object({
 	"versioningStatus": string().nullish()
 });
 object({
-	"allowEgress": optional(boolean().describe("Whether the declaration asked for open egress.\n\nThe controller builds the binding from this, and an empty connector list cannot be read\nwithout it: a stripped `deny` import would otherwise look exactly like an open sandbox.")),
+	"allowEgress": optional(boolean().describe("Whether sessions use native cloud internet without a deployment gateway.\nIsolated sessions must instead name their setup-owned connector.")),
 	"buildRoleArn": string().describe("Role the controller passes to `CreateMicrovmImage`. Setup owns it because\n`sandbox/provision` grants the controller `iam:PassRole` and no `iam:CreateRole`.").nullish(),
 	"bundleUri": string().describe("Bundle the controller builds the image from. Only a runtime-provisioned sandbox carries it.").nullish(),
 	"egressConnectorArns": optional(array(string()).describe("Egress network connectors. Deleting one while MicroVMs still reference it breaks their\nnetworking, so teardown needs them named rather than rediscovered.")),
@@ -9000,6 +9022,14 @@ const ContainerCodeSchema = union([object({
 * Do not edit manually.
 */
 /**
+* @description Outbound network restriction enforced outside the container.\nInternet access also permits this container\'s own replicas on declared TCP ports,\nown-service discovery, and the credential proxy for its own identity.\nAbsence preserves the runtime\'s existing full-network behavior.
+*/
+const ContainerEgressSchema = _enum(["internet"]).describe("Outbound network restriction enforced outside the container.\nInternet access also permits this container's own replicas on declared TCP ports,\nown-service discovery, and the credential proxy for its own identity.\nAbsence preserves the runtime's existing full-network behavior.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
 * @description GPU specification for a container.
 */
 const ContainerGpuSpecSchema = object({
@@ -9399,6 +9429,7 @@ object({
 	"currentReplicas": int().min(0).describe("Number of current replicas"),
 	"desiredReplicas": int().min(0).describe("Desired number of replicas"),
 	"internalDns": string().describe("Internal DNS name (e.g., \"api.svc\")"),
+	"internalUrls": optional(object({}).catchall(string()).describe("Internal URLs keyed by port for cluster members and linking resources.")),
 	"name": string().describe("Container name in the managed container backend"),
 	"publicEndpoints": optional(object({}).catchall(lazy(() => PublicEndpointOutputSchema).describe("Runtime-resolved public endpoint metadata.")).describe("Public endpoints resolved for this container.")),
 	get "replicas"() {
@@ -9585,6 +9616,9 @@ object({
 	get "cpu"() {
 		return ResourceSpecSchema.describe("Resource specification with min/desired values.");
 	},
+	get "egress"() {
+		return union([ContainerEgressSchema, _null()]).optional();
+	},
 	"environment": optional(object({}).catchall(string()).describe("Environment variables")),
 	"ephemeralStorage": string().describe("Ephemeral storage requirement (e.g., \"10Gi\")").nullish(),
 	get "gpu"() {
@@ -9615,7 +9649,7 @@ object({
 	},
 	"pool": string().describe("Capacity group to run on (must exist in the cluster)\nIf not specified, containers are scheduled to any available group.").nullish(),
 	get "ports"() {
-		return array(ContainerPortSchema.describe("Container port configuration.")).describe("Internal container ports (at least one required).");
+		return array(ContainerPortSchema.describe("Container port configuration.")).describe("Ports reachable by compute-cluster members and resources that link to this container.");
 	},
 	get "publicEndpoints"() {
 		return array(PublicEndpointSchema.describe("Public endpoint configuration for port-backed workload resources.")).describe("Public endpoints exposed by the container.").optional();
@@ -9669,6 +9703,12 @@ object({
 		return union([StorageUploadSchema, _null()]).optional();
 	}
 }).describe("Response to command creation");
+object({
+	"startedAt": datetime().describe("First credential failure in this phase; subsequent attempts keep this timestamp."),
+	get "status"() {
+		return DeploymentStatusSchema.describe("Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data.");
+	}
+}).describe("A credential outage's durable retry window, scoped to its deployment phase.");
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
@@ -10172,6 +10212,14 @@ const DynamodbKvBindingSchema = object({
 * Do not edit manually.
 */
 /**
+* @description Per-sandbox outbound policy. Mail ports 25, 465 and 587 require an explicit allowlist port, such as smtp.example.com:587; internet and portless targets exclude them. This protects the deployment\'s shared outbound IP from mail abuse and blocklisting that could disrupt every tenant.
+*/
+const EgressPolicySchema = union([object({ "allow": array(string()).min(0).max(4096) }), _enum(["internet"])]).describe("Per-sandbox outbound policy. Mail ports 25, 465 and 587 require an explicit allowlist port, such as smtp.example.com:587; internet and portless targets exclude them. This protects the deployment's shared outbound IP from mail abuse and blocklisting that could disrupt every tenant.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
 * @description A single DKIM CNAME record the operator must create in DNS.
 */
 const EmailDkimTokenSchema = object({
@@ -11596,6 +11644,14 @@ object({
 object({ get "leases"() {
 	return array(LeaseInfoSchema.describe("Lease information")).describe("Acquired leases (empty array if none available)");
 } }).describe("Response to lease acquisition");
+union([
+	object({ "mode": _enum(["deny"]) }),
+	object({ "mode": _enum(["allow"]) }),
+	object({
+		"domains": array(string()),
+		"mode": _enum(["allowDomains"])
+	})
+]).describe("Deprecated object declarations preserve their released backend behavior.");
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
@@ -11998,7 +12054,7 @@ const PostgresHeartbeatDataSchema = union([
 	lazy(() => LocalPostgresHeartbeatDataSchema).and(object({ "backend": _enum(["local"]) })).describe("Local embedded Postgres backend.")
 ]);
 object({
-	"database": string().describe("The default database created for this resource. On cloud backends this is the fixed\nlabel `POSTGRES_DATABASE_NAME` (`alien`); on Local it is the resource id."),
+	"database": string().describe("The default database created for this resource. On cloud backends this is the fixed\nlabel `POSTGRES_DATABASE_NAME` (`app`); on Local it is the resource id."),
 	"endpoint": string().describe("Host (or host:port) the database listens on; never publicly reachable."),
 	"port": int().min(0).describe("Listening port, when known.").nullish()
 }).describe("Outputs generated by a successfully provisioned Postgres database.");
@@ -12382,17 +12438,14 @@ const SandboxCodeSchema = union([object({
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
-/**
-* @description Outbound network policy for a sandbox.
-*/
-const SandboxEgressSchema = union([
+const SandboxEgressSchema = union([union([
 	object({ "mode": _enum(["deny"]) }),
 	object({ "mode": _enum(["allow"]) }),
 	object({
-		"domains": array(string()).describe("Hostnames the sandbox may reach"),
+		"domains": array(string()),
 		"mode": _enum(["allowDomains"])
 	})
-]).describe("Outbound network policy for a sandbox.");
+]), _enum(["none", "internet"])]);
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
@@ -12434,10 +12487,13 @@ object({
 	get "code"() {
 		return SandboxCodeSchema.describe("Specifies where the sandbox's root filesystem comes from.");
 	},
+	get "defaultPolicy"() {
+		return union([EgressPolicySchema, _null()]).optional();
+	},
 	get "egress"() {
-		return SandboxEgressSchema.describe("Outbound network policy for a sandbox.");
+		return SandboxEgressSchema.describe("Outbound network policy");
 	},
-	"id": string().describe("Identifier for the sandbox. Must contain only alphanumeric characters, hyphens, and\nunderscores ([A-Za-z0-9-_]). Maximum 64 characters."),
+	"id": string().describe("Identifier for the sandbox. Must be DNS-compatible: lowercase letters, digits and hyphens,\nstarting and ending with a letter or digit, with no consecutive hyphens."),
 	get "lifecycle"() {
 		return SandboxLifecyclePolicySchema.describe("How long a sandbox may live and when it is paused.\n\nDeclaration-time ceilings, not per-request values: every sandbox created through this\ndeclaration's binding is held to them, whatever a caller asks for at runtime.");
 	},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alienplatform/sdk",
-  "version": "3.3.34",
+  "version": "3.3.36",
   "type": "module",
   "files": [
     "dist"
@@ -57,9 +57,9 @@
     "nice-grpc": "^2.1.11",
     "nice-grpc-common": "^2.0.2",
     "zod": "^4.5.2",
-    "@alienplatform/ai-gateway": "^3.3.34",
-    "@alienplatform/bindings": "^3.3.34",
-    "@alienplatform/core": "^3.3.34"
+    "@alienplatform/ai-gateway": "^3.3.36",
+    "@alienplatform/bindings": "^3.3.36",
+    "@alienplatform/core": "^3.3.36"
   },
   "scripts": {
     "build": "tsdown && tsc --emitDeclarationOnly",