@odigos/vmagent-api-apollo-client 0.24.0 → 0.26.0

package/dist/generated/next/graphql.d.ts

@@ -94,6 +94,42 @@ export type AwsManagedCollectorDetails = ManagedCollectorDetails & {
     /** ECS service ARN. */
     workloadRef?: Maybe<Scalars['String']['output']>;
 };
+/** AWS placement and network policy settings. */
+export type AwsManagedCollectorProviderOverrides = ManagedCollectorProviderOverrides & {
+    __typename?: 'AwsManagedCollectorProviderOverrides';
+    /** Additional security groups admitted to the Collector's OTLP ports. */
+    additionalSecurityGroupIds?: Maybe<Array<Scalars['String']['output']>>;
+    /** Whether to fall back to the selected network's CIDR when no sender security group resolves. */
+    allowNetworkCidrFallback: Scalars['Boolean']['output'];
+    assignPublicIp: Scalars['Boolean']['output'];
+    /** AWS cluster reference used for the Collector service. */
+    clusterRef?: Maybe<Scalars['String']['output']>;
+    /** Customer-provisioned ECS task execution role passed to the Collector task definition. */
+    executionRoleArn?: Maybe<Scalars['String']['output']>;
+    /** Minimum prefix length for CIDR fallback; larger values allow narrower ranges. */
+    minFallbackPrefixLength?: Maybe<Scalars['Int']['output']>;
+    provider: Scalars['String']['output'];
+    /** Security groups attached to the Collector's network interfaces. */
+    securityGroupIds?: Maybe<Array<Scalars['String']['output']>>;
+    /** Subnets to place the Collector in. Omit to let Odigos select eligible subnets. */
+    subnetIds?: Maybe<Array<Scalars['String']['output']>>;
+    /** Whether to use AWS Fargate Spot capacity. */
+    useFargateSpot: Scalars['Boolean']['output'];
+};
+export type AwsManagedCollectorProviderOverridesInput = {
+    additionalSecurityGroupIds?: InputMaybe<Array<Scalars['String']['input']>>;
+    allowNetworkCidrFallback?: InputMaybe<Scalars['Boolean']['input']>;
+    assignPublicIp?: InputMaybe<Scalars['Boolean']['input']>;
+    /** Required on create in both modes. Must identify an ACTIVE ECS cluster. */
+    clusterRef?: InputMaybe<Scalars['String']['input']>;
+    /** Required on create in both modes. The ECS task assumes this customer-owned role; Odigos never mutates it. */
+    executionRoleArn?: InputMaybe<Scalars['String']['input']>;
+    minFallbackPrefixLength?: InputMaybe<Scalars['Int']['input']>;
+    securityGroupIds?: InputMaybe<Array<Scalars['String']['input']>>;
+    /** Omit to keep the current pin; [] clears it and resumes automatic subnet selection. */
+    subnetIds?: InputMaybe<Array<Scalars['String']['input']>>;
+    useFargateSpot?: InputMaybe<Scalars['Boolean']['input']>;
+};
 export type CodeAttributesConfig = {
     __typename?: 'CodeAttributesConfig';
     collectColumn?: Maybe<Scalars['Boolean']['output']>;
@@ -252,35 +288,31 @@ export type CreateManagedCollectorDestinationInput = {
     type: Scalars['String']['input'];
 };
 /**
- * Settings for one region's Collector. Every field except the region is optional: an omitted field
- * inherits `collector.defaults`, which is what makes a bare `{ region }` a valid, fully-defaulted create.
+ * Settings for one region's Collector. The region and customer-provisioned deployment identity are
+ * required; other omitted fields inherit `collector.defaults`.
  *
  * An explicitly empty list means "none" and is NOT the same as omitting the field — omitting inherits the
  * default's list, and clearing it is the only way to say this region wants none of them.
  */
 export type CreateManagedCollectorInput = {
     arch?: InputMaybe<Scalars['String']['input']>;
-    assignPublicIp?: InputMaybe<Scalars['Boolean']['input']>;
-    clusterRef?: InputMaybe<Scalars['String']['input']>;
     cpu?: InputMaybe<Scalars['String']['input']>;
+    /** Customer-provisioned deployment identity. AWS expects an IAM role ARN. */
+    deploymentRoleRef: Scalars['String']['input'];
     endpointOverride?: InputMaybe<Scalars['String']['input']>;
-    /**
-     * Pin the Collector to one network. Omit to let Odigos select the region's only eligible network;
-     * it refuses to guess when several are eligible and reports the candidates.
-     */
-    hostNetworkId?: InputMaybe<Scalars['String']['input']>;
     imageRepositoryOverride?: InputMaybe<Scalars['String']['input']>;
     ingress?: InputMaybe<ManagedCollectorIngressInput>;
     logRetentionDays?: InputMaybe<Scalars['Int']['input']>;
     memory?: InputMaybe<Scalars['String']['input']>;
+    /** Required on AWS create in both modes; identifies the host VPC. */
+    networkId?: InputMaybe<Scalars['String']['input']>;
+    providerOverrides?: InputMaybe<ManagedCollectorProviderOverridesInput>;
     region: Scalars['String']['input'];
+    retention?: InputMaybe<ManagedCollectorRetentionInput>;
     /** How many workloads one cutover pass may re-point at this Collector. 0 uses the connector default. */
     rolloutBatchSize?: InputMaybe<Scalars['Int']['input']>;
     scaling?: InputMaybe<ManagedCollectorScalingInput>;
-    securityGroupIds?: InputMaybe<Array<Scalars['String']['input']>>;
-    subnetIds?: InputMaybe<Array<Scalars['String']['input']>>;
     transport?: InputMaybe<ManagedCollectorTransportInput>;
-    useFargateSpot?: InputMaybe<Scalars['Boolean']['input']>;
 };
 export type CreateSourceInput = {
     config?: InputMaybe<SourceConfigInput>;
@@ -695,6 +727,40 @@ export type InstrumentationRuleTypeOption = {
     supportedLanguages: Array<Scalars['String']['output']>;
     type: Scalars['String']['output'];
 };
+/**
+ * Parameters for issuing the OpAMP credential that a customer-managed Collector uses to connect to
+ * Odigos.
+ *
+ * This operation is available only for a Collector deployed in manual mode. `networkId` is the network
+ * where the customer will deploy the Collector, and `secretRef` identifies the customer-owned secret
+ * where they will store the returned authorization header.
+ */
+export type IssueManagedCollectorCredentialInput = {
+    networkId: Scalars['String']['input'];
+    region: Scalars['String']['input'];
+    /**
+     * Replace an existing active credential. Use this when the prior one was not received or must be
+     * rotated; the previous credential remains valid until its replacement connects.
+     */
+    rotate?: InputMaybe<Scalars['Boolean']['input']>;
+    /** A customer-owned secret reference. Odigos records the reference but never writes this secret. */
+    secretRef: Scalars['String']['input'];
+};
+/**
+ * The one-time OpAMP credential for a customer-managed Collector.
+ *
+ * `authorizationHeader` is revealed only by the successful issuance response and is never retained by
+ * Odigos. Store it immediately in `secretRef` and redeploy the Collector. If this response is lost, issue
+ * a replacement credential; the value cannot be retrieved again.
+ */
+export type IssueManagedCollectorCredentialPayload = {
+    __typename?: 'IssueManagedCollectorCredentialPayload';
+    /** The complete HTTP Authorization header value, including the Bearer scheme. */
+    authorizationHeader: Scalars['String']['output'];
+    collectorId: Scalars['String']['output'];
+    credentialId: Scalars['String']['output'];
+    secretRef: Scalars['String']['output'];
+};
 export type JavaProbe = {
     __typename?: 'JavaProbe';
     className: Scalars['String']['output'];
@@ -761,8 +827,8 @@ export type ManagedCollectorConfigIssueDetails = ManagedCollectorIssueDetails &
     validationError?: Maybe<Scalars['String']['output']>;
 };
 /**
- * A condition fixed by setting something under `collector.regions.<region>` — no usable subnets, no
- * egress route, no security group resolving, a refused TLS or ingress value, several eligible host
+ * A condition fixed by setting something under `collector.regions.<region>` — no usable network segments,
+ * no egress route, no network access policy resolving, a refused TLS or ingress value, or several eligible
  * networks with none pinned.
  *
  * Carries the region and the key so a client can send someone straight to the setting instead of asking
@@ -772,7 +838,7 @@ export type ManagedCollectorConfigurationIssueDetails = ManagedCollectorIssueDet
     __typename?: 'ManagedCollectorConfigurationIssueDetails';
     /**
      * The candidates a refusal was choosing between, when the refusal was an ambiguity — e.g. the eligible
-     * host networks found in this region when none was pinned. Empty for every other condition.
+     * networks found in this region when none was pinned. Empty for every other condition.
      *
      * Present because "Odigos refused to guess" is only actionable if the reader is told what it was
      * choosing between.
@@ -782,7 +848,7 @@ export type ManagedCollectorConfigurationIssueDetails = ManagedCollectorIssueDet
     /** The value that was refused, when there was one. Null when the setting is simply absent. */
     refusedValue?: Maybe<Scalars['String']['output']>;
     region: Scalars['String']['output'];
-    /** The setting to change, relative to the region, e.g. "hostNetworkId", "tls.hostname". */
+    /** The setting to change, relative to the region, e.g. "networkId", "tls.hostname". */
     settingKey: Scalars['String']['output'];
 };
 /**
@@ -825,9 +891,9 @@ export type ManagedCollectorCurrent = {
 export type ManagedCollectorDesired = {
     __typename?: 'ManagedCollectorDesired';
     arch: Scalars['String']['output'];
-    assignPublicIp: Scalars['Boolean']['output'];
-    clusterRef?: Maybe<Scalars['String']['output']>;
     cpu: Scalars['String']['output'];
+    /** Customer-provisioned identity used for Collector operations in this region. */
+    deploymentRoleRef?: Maybe<Scalars['String']['output']>;
     /**
      * Whether this region gets a Collector at all. Resolved: an unset region inherits the feature
      * switch, and an explicit false wins over it.
@@ -835,11 +901,6 @@ export type ManagedCollectorDesired = {
     enabled: Scalars['Boolean']['output'];
     /** When set, Odigos creates no load balancer and publishes this address instead. */
     endpointOverride?: Maybe<Scalars['String']['output']>;
-    /**
-     * The network the customer pinned the Collector to. Empty means Odigos selects the region's only
-     * eligible network, and refuses to guess when several are eligible.
-     */
-    hostNetworkId?: Maybe<Scalars['String']['output']>;
     imageRepositoryOverride?: Maybe<Scalars['String']['output']>;
     ingress: ManagedCollectorIngress;
     logRetentionDays: Scalars['Int']['output'];
@@ -848,15 +909,15 @@ export type ManagedCollectorDesired = {
      * well as a workload change.
      */
     memory: Scalars['String']['output'];
-    scaling: ManagedCollectorScalingTarget;
-    securityGroupIds?: Maybe<Array<Scalars['String']['output']>>;
     /**
-     * Placement the customer pinned. Empty means Odigos chooses.
-     *
-     * A value here means the customer pointed Odigos at their OWN object, which is never mutated or deleted
-     * whatever its tags say — see ManagedCollectorAuthority.
+     * The network the customer pinned the Collector to. Empty means Odigos selects the region's only
+     * eligible network, and refuses to guess when several are eligible.
      */
-    subnetIds?: Maybe<Array<Scalars['String']['output']>>;
+    networkId?: Maybe<Scalars['String']['output']>;
+    /** Provider-specific desired deployment settings. */
+    providerOverrides: ManagedCollectorProviderOverrides;
+    retention: ManagedCollectorRetention;
+    scaling: ManagedCollectorScalingTarget;
     transport: ManagedCollectorTransport;
 };
 /** Provider-specific infrastructure references, discriminated by `provider`. */
@@ -892,26 +953,11 @@ export type ManagedCollectorImage = {
 /** Which senders are admitted to the Collector's OTLP ports. */
 export type ManagedCollectorIngress = {
     __typename?: 'ManagedCollectorIngress';
-    /**
-     * Explicit ranges for senders with no security group, such as workloads in a peered network.
-     * Validated, never widened.
-     */
+    /** Explicit IP ranges for senders, validated and never widened. */
     additionalCidrs?: Maybe<Array<Scalars['String']['output']>>;
-    /** Groups admitted beyond the ones discovery found — senders Odigos does not instrument. */
-    additionalSecurityGroupIds?: Maybe<Array<Scalars['String']['output']>>;
-    /**
-     * Whether the host network's CIDR fallback may be used when no sender security group resolves. False
-     * skips the deploy with a message rather than widening the rule.
-     */
-    allowNetworkCidrFallback: Scalars['Boolean']['output'];
-    /** Floor on how wide that fallback may go; 0 means the default. Larger number = narrower block. */
-    minFallbackPrefixLength?: Maybe<Scalars['Int']['output']>;
 };
 export type ManagedCollectorIngressInput = {
     additionalCidrs?: InputMaybe<Array<Scalars['String']['input']>>;
-    additionalSecurityGroupIds?: InputMaybe<Array<Scalars['String']['input']>>;
-    allowNetworkCidrFallback?: InputMaybe<Scalars['Boolean']['input']>;
-    minFallbackPrefixLength?: InputMaybe<Scalars['Int']['input']>;
 };
 /**
  * How to deploy this region's Collector by hand or by IaC.
@@ -922,6 +968,8 @@ export type ManagedCollectorIngressInput = {
  */
 export type ManagedCollectorInstructions = {
     __typename?: 'ManagedCollectorInstructions';
+    /** Customer-provisioned identity used to inspect or deploy the Collector. */
+    deploymentRoleRef?: Maybe<Scalars['String']['output']>;
     /**
      * The deployment rendered per delivery tool, in the connector's preferred order. Never empty.
      *
@@ -929,10 +977,10 @@ export type ManagedCollectorInstructions = {
      * content, unresolved) carries nothing workload-specific and needs no Collector-specific twin.
      */
     documents: Array<InstructionDocument>;
-    /** The network the instructions place the Collector in; empty when placement has not resolved one. */
-    hostNetworkId: Scalars['String']['output'];
     /** automatic | manual — why the customer is being shown this. */
     mode: Scalars['String']['output'];
+    /** The network the instructions place the Collector in; empty when placement has not resolved one. */
+    networkId: Scalars['String']['output'];
     /**
      * Caveats that belong with the instructions whichever tool is used — a platform limit, a value the
      * customer must supply, a step that completes without telemetry actually flowing.
@@ -978,10 +1026,9 @@ export type ManagedCollectorIssueDetails = {
 /**
  * Throughput and resource counters for one region's Collector.
  *
- * Two possible sources, and `live` says which one answered: the snapshot the Collector last reported over
- * its OpAMP session (cached by the connector, always available), or a round trip to the running Collector
- * made for this query. A cached answer is not a degraded one — it is the normal path, and `observedAt`
- * says how old it is.
+ * Two possible answers, and `live` says which one answered: the last cached snapshot, or a new periodic
+ * own-metrics report received while this query waited. The Collector exports these metrics by OTLP/HTTP
+ * to the endpoint offered during its OpAMP session. `observedAt` says when the Collector sampled them.
  *
  * Every counter is nullable because a Collector that has never connected has reported none of them, and a
  * zero would be a lie about a Collector nobody has heard from.
@@ -998,10 +1045,7 @@ export type ManagedCollectorMetrics = {
     failedMetricPoints?: Maybe<Scalars['Int']['output']>;
     /** Failed to send and dropped after retries. The number that means telemetry was LOST. */
     failedSpans?: Maybe<Scalars['Int']['output']>;
-    /**
-     * True when this came from a round trip to the running Collector; false when it is the cached
-     * snapshot from its last periodic report.
-     */
+    /** True when a new report arrived while this query waited; false for a cached snapshot. */
     live: Scalars['Boolean']['output'];
     memoryBytes?: Maybe<Scalars['Int']['output']>;
     /** RFC3339 timestamp the snapshot was TAKEN by the Collector, not when it was read here. */
@@ -1021,11 +1065,19 @@ export type ManagedCollectorMetrics = {
     /** Seconds since the Collector process started. */
     uptimeSeconds?: Maybe<Scalars['Int']['output']>;
 };
+/** Provider-specific settings for the desired Collector deployment. */
+export type ManagedCollectorProviderOverrides = {
+    provider: Scalars['String']['output'];
+};
+export type ManagedCollectorProviderOverridesInput = {
+    /** Provider-specific deployment settings. Supply only the block matching this connector's provider. */
+    aws?: InputMaybe<AwsManagedCollectorProviderOverridesInput>;
+};
 /**
  * One managed Collector: identity, computed status, and the desired/current split that makes drift
  * visible rather than implicit in a stale message.
  *
- * Identity is `region`. Never the host network (a Collector can be moved between networks in its region)
+ * Identity is `region`. Never the network (a Collector can be moved between networks in its region)
  * and never the OpAMP instance uid (that rotates every time the underlying task is replaced).
  */
 export type ManagedCollectorReport = {
@@ -1041,12 +1093,6 @@ export type ManagedCollectorReport = {
      * ignore this entirely.
      */
     details?: Maybe<ManagedCollectorDetails>;
-    /**
-     * Provider network the Collector RUNS IN: VPC id on AWS, VNet on Azure, VPC network on GCP.
-     *
-     * Placement metadata, not identity — see the schema header. Empty before placement has resolved a host.
-     */
-    hostNetworkId: Scalars['String']['output'];
     /**
      * OpAMP instance uid of the current connection; null when never-connected. Useful for correlating
      * this report with the Collector's own Supervisor logs. Not an identity — see the type doc.
@@ -1058,7 +1104,7 @@ export type ManagedCollectorReport = {
      * on `code`, not parse a sentence back apart.
      */
     issues: Array<ManagedCollectorIssue>;
-    /** Collector type, e.g. "aws.fargate-collector". Informational; identity is `region`. */
+    /** Provider-defined Collector implementation kind. Informational; identity is `region`. */
     kind: Scalars['String']['output'];
     /**
      * never-connected | live | stale.
@@ -1075,12 +1121,28 @@ export type ManagedCollectorReport = {
      * because a status a client's version does not recognize still has to render as something.
      */
     message: Scalars['String']['output'];
+    /**
+     * Provider network the Collector runs in. Provider-specific placement settings are in `desired.providerOverrides`.
+     *
+     * Placement metadata, not identity — see the schema header. Empty before placement has resolved a host.
+     */
+    networkId: Scalars['String']['output'];
     region: Scalars['String']['output'];
     /** Pending | Deploying | Ready | Degraded | Error | AwaitingCustomer. */
     status: Scalars['String']['output'];
     /** RFC3339 timestamp of the last report refresh. */
     updatedAt: Scalars['String']['output'];
 };
+export type ManagedCollectorRetention = {
+    __typename?: 'ManagedCollectorRetention';
+    idleDeleteAfterHours: Scalars['Int']['output'];
+    idleScaleToZeroAfterHours: Scalars['Int']['output'];
+};
+/** Hours of continuous idleness before a disabled or source-free Collector is parked or removed. Zero keeps it. */
+export type ManagedCollectorRetentionInput = {
+    idleDeleteAfterHours?: InputMaybe<Scalars['Int']['input']>;
+    idleScaleToZeroAfterHours?: InputMaybe<Scalars['Int']['input']>;
+};
 /** Scaling policy. `mode` is manual (fixed desiredCount) or auto (the platform autoscaler bounds). */
 export type ManagedCollectorScalingInput = {
     desiredCount?: InputMaybe<Scalars['Int']['input']>;
@@ -1119,7 +1181,7 @@ export type ManagedCollectorScalingTarget = {
  */
 export type ManagedCollectorTransport = {
     __typename?: 'ManagedCollectorTransport';
-    /** Reference to the certificate: an ACM ARN, or a secret ref. Never a certificate or key value. */
+    /** Reference to a certificate or secret containing it. Never a certificate or key value. */
     certificateRef?: Maybe<Scalars['String']['output']>;
     /**
      * A hostname the customer owns, required by every mode that presents a certificate.
@@ -1133,7 +1195,7 @@ export type ManagedCollectorTransport = {
     mode?: Maybe<Scalars['String']['output']>;
 };
 export type ManagedCollectorTransportInput = {
-    /** An ACM ARN or a secret ref. Never a certificate or key value. */
+    /** A provider certificate identifier or a secret reference. Never a certificate or key value. */
     certificateRef?: InputMaybe<Scalars['String']['input']>;
     hostname?: InputMaybe<Scalars['String']['input']>;
     /** off | platform | loadBalancer | collector. */
@@ -1175,11 +1237,21 @@ export type Mutation = {
     enableSourceProfiling: SlotResult;
     generateDiagnoseBundle: DiagnoseBundle;
     generateProfileBundle: ProfileBundle;
+    /**
+     * Issue the one-time OpAMP authorization header for a manually deployed Collector.
+     *
+     * Odigos does not create or update the referenced secret, or any other cloud resource. Persist the
+     * returned header in `secretRef` and deploy or redeploy the Collector with it. Set `rotate` to replace
+     * an existing credential, including when a prior one-time response was lost.
+     */
+    issueManagedCollectorCredential: IssueManagedCollectorCredentialPayload;
     /** Trigger an out-of-band provider discovery refresh; returns true if a refresh was enqueued. */
     refreshDiscovery: Scalars['Boolean']['output'];
     /** Request bounded cleanup of connector-created resources. Not implemented in the discovery-only phase. */
     requestCleanup: Scalars['Boolean']['output'];
     restartSource: RestartSourcePayload;
+    /** Admin-only revocation; the Collector must use a replacement credential to reconnect. */
+    revokeManagedCollectorCredential: RevokeManagedCollectorCredentialPayload;
     startBackgroundProfileBundle: ProfileBundleStatus;
     /**
      * Request teardown of one region's Collector.
@@ -1268,12 +1340,18 @@ export type MutationGenerateProfileBundleArgs = {
     durationSeconds?: InputMaybe<Scalars['Int']['input']>;
     service?: InputMaybe<Scalars['String']['input']>;
 };
+export type MutationIssueManagedCollectorCredentialArgs = {
+    input: IssueManagedCollectorCredentialInput;
+};
 export type MutationRequestCleanupArgs = {
     id: Scalars['String']['input'];
 };
 export type MutationRestartSourceArgs = {
     input: RestartSourceInput;
 };
+export type MutationRevokeManagedCollectorCredentialArgs = {
+    input: RevokeManagedCollectorCredentialInput;
+};
 export type MutationStartBackgroundProfileBundleArgs = {
     durationSeconds?: InputMaybe<Scalars['Int']['input']>;
     service?: InputMaybe<Scalars['String']['input']>;
@@ -1453,9 +1531,9 @@ export type Query = {
     /**
      * Counters for one region's Collector; null when none is recorded there or it has never reported.
      *
-     * Cached by default. `refresh: true` asks the running Collector for a fresh snapshot and falls back to
-     * the cached one (with `live: false`) when it is not connected or does not answer promptly — a slow
-     * Collector degrades this query's freshness, never its availability.
+     * Cached by default. `refresh: true` waits briefly for the next periodic own-metrics report and falls
+     * back to the cached one (with `live: false`) if no report arrives. OpAMP does not provide a synchronous
+     * metrics request, so this argument cannot force a Collector to report immediately.
      */
     managedCollectorMetrics?: Maybe<ManagedCollectorMetrics>;
     /** One Collector by region; null when this connector has none there. */
@@ -1577,6 +1655,17 @@ export type RevisionedServiceWorkloadDetails = WorkloadDetails & {
     /** Fully-qualified platform resource identity: the Cloud Run service name, or the Container App resource id. */
     service?: Maybe<Scalars['String']['output']>;
 };
+/** Revoke one manual Collector credential after rotation or compromise. */
+export type RevokeManagedCollectorCredentialInput = {
+    credentialId: Scalars['String']['input'];
+    region: Scalars['String']['input'];
+};
+export type RevokeManagedCollectorCredentialPayload = {
+    __typename?: 'RevokeManagedCollectorCredentialPayload';
+    credentialId: Scalars['String']['output'];
+    region: Scalars['String']['output'];
+    revoked: Scalars['Boolean']['output'];
+};
 export declare enum RuleType {
     CodeAttributes = "CodeAttributes",
     CustomInstrumentation = "CustomInstrumentation",
@@ -1836,31 +1925,31 @@ export type UpdateManagedCollectorDestinationInput = {
  */
 export type UpdateManagedCollectorInput = {
     arch?: InputMaybe<Scalars['String']['input']>;
-    assignPublicIp?: InputMaybe<Scalars['Boolean']['input']>;
-    clusterRef?: InputMaybe<Scalars['String']['input']>;
     cpu?: InputMaybe<Scalars['String']['input']>;
+    /** Replace the customer-provisioned deployment identity for this region. */
+    deploymentRoleRef?: InputMaybe<Scalars['String']['input']>;
     /**
-     * Setting this to false stops convergence and leaves everything running — it does NOT remove the
-     * Collector. Use teardownManagedCollector to destroy it.
+     * Setting this to false stops convergence. Default retention keeps the Collector running;
+     * a configured retention policy can park or remove it after its idle grace.
      */
     enabled?: InputMaybe<Scalars['Boolean']['input']>;
     endpointOverride?: InputMaybe<Scalars['String']['input']>;
-    /**
-     * Moving the Collector to another network is a REDEPLOYMENT of the same logical Collector: its
-     * credential is replaced and its infrastructure rebuilt in the new network.
-     */
-    hostNetworkId?: InputMaybe<Scalars['String']['input']>;
     imageRepositoryOverride?: InputMaybe<Scalars['String']['input']>;
     ingress?: InputMaybe<ManagedCollectorIngressInput>;
     logRetentionDays?: InputMaybe<Scalars['Int']['input']>;
     memory?: InputMaybe<Scalars['String']['input']>;
+    /**
+     * On AWS automatic mode, a changed VPC starts a resumable old-stack teardown followed by
+     * provisioning in the new VPC; update networkId separately from other fields. In manual mode,
+     * the customer moves IaC and re-issues the revoked network-bound OpAMP credential.
+     */
+    networkId?: InputMaybe<Scalars['String']['input']>;
+    providerOverrides?: InputMaybe<ManagedCollectorProviderOverridesInput>;
     region: Scalars['String']['input'];
+    retention?: InputMaybe<ManagedCollectorRetentionInput>;
     rolloutBatchSize?: InputMaybe<Scalars['Int']['input']>;
     scaling?: InputMaybe<ManagedCollectorScalingInput>;
-    securityGroupIds?: InputMaybe<Array<Scalars['String']['input']>>;
-    subnetIds?: InputMaybe<Array<Scalars['String']['input']>>;
     transport?: InputMaybe<ManagedCollectorTransportInput>;
-    useFargateSpot?: InputMaybe<Scalars['Boolean']['input']>;
 };
 export type UpdateSourceInput = {
     config?: InputMaybe<SourceConfigInput>;
@@ -3255,7 +3344,7 @@ export type GetManagedCollectorReportsQuery = {
     managedCollectorReports: Array<{
         __typename?: 'ManagedCollectorReport';
         region: string;
-        hostNetworkId: string;
+        networkId: string;
         kind: string;
         status: string;
         message: string;
@@ -3265,11 +3354,8 @@ export type GetManagedCollectorReportsQuery = {
         desired: {
             __typename?: 'ManagedCollectorDesired';
             enabled: boolean;
-            hostNetworkId?: string | null;
-            subnetIds?: Array<string> | null;
-            securityGroupIds?: Array<string> | null;
-            clusterRef?: string | null;
-            assignPublicIp: boolean;
+            networkId?: string | null;
+            deploymentRoleRef?: string | null;
             cpu: string;
             memory: string;
             logRetentionDays: number;
@@ -3285,6 +3371,11 @@ export type GetManagedCollectorReportsQuery = {
                 targetCpuPercent?: number | null;
                 targetMemoryPercent?: number | null;
             };
+            retention: {
+                __typename?: 'ManagedCollectorRetention';
+                idleScaleToZeroAfterHours: number;
+                idleDeleteAfterHours: number;
+            };
             transport: {
                 __typename?: 'ManagedCollectorTransport';
                 mode?: string | null;
@@ -3293,10 +3384,20 @@ export type GetManagedCollectorReportsQuery = {
             };
             ingress: {
                 __typename?: 'ManagedCollectorIngress';
-                additionalSecurityGroupIds?: Array<string> | null;
                 additionalCidrs?: Array<string> | null;
+            };
+            providerOverrides: {
+                __typename?: 'AwsManagedCollectorProviderOverrides';
+                executionRoleArn?: string | null;
+                subnetIds?: Array<string> | null;
+                securityGroupIds?: Array<string> | null;
+                clusterRef?: string | null;
+                assignPublicIp: boolean;
+                useFargateSpot: boolean;
+                additionalSecurityGroupIds?: Array<string> | null;
                 allowNetworkCidrFallback: boolean;
                 minFallbackPrefixLength?: number | null;
+                provider: string;
             };
         };
         current: {
@@ -3380,7 +3481,7 @@ export type GetManagedCollectorReportQuery = {
     managedCollectorReport?: {
         __typename?: 'ManagedCollectorReport';
         region: string;
-        hostNetworkId: string;
+        networkId: string;
         kind: string;
         status: string;
         message: string;
@@ -3390,11 +3491,8 @@ export type GetManagedCollectorReportQuery = {
         desired: {
             __typename?: 'ManagedCollectorDesired';
             enabled: boolean;
-            hostNetworkId?: string | null;
-            subnetIds?: Array<string> | null;
-            securityGroupIds?: Array<string> | null;
-            clusterRef?: string | null;
-            assignPublicIp: boolean;
+            networkId?: string | null;
+            deploymentRoleRef?: string | null;
             cpu: string;
             memory: string;
             logRetentionDays: number;
@@ -3410,6 +3508,11 @@ export type GetManagedCollectorReportQuery = {
                 targetCpuPercent?: number | null;
                 targetMemoryPercent?: number | null;
             };
+            retention: {
+                __typename?: 'ManagedCollectorRetention';
+                idleScaleToZeroAfterHours: number;
+                idleDeleteAfterHours: number;
+            };
             transport: {
                 __typename?: 'ManagedCollectorTransport';
                 mode?: string | null;
@@ -3418,10 +3521,20 @@ export type GetManagedCollectorReportQuery = {
             };
             ingress: {
                 __typename?: 'ManagedCollectorIngress';
-                additionalSecurityGroupIds?: Array<string> | null;
                 additionalCidrs?: Array<string> | null;
+            };
+            providerOverrides: {
+                __typename?: 'AwsManagedCollectorProviderOverrides';
+                executionRoleArn?: string | null;
+                subnetIds?: Array<string> | null;
+                securityGroupIds?: Array<string> | null;
+                clusterRef?: string | null;
+                assignPublicIp: boolean;
+                useFargateSpot: boolean;
+                additionalSecurityGroupIds?: Array<string> | null;
                 allowNetworkCidrFallback: boolean;
                 minFallbackPrefixLength?: number | null;
+                provider: string;
             };
         };
         current: {
@@ -3505,7 +3618,8 @@ export type GetManagedCollectorInstructionsQuery = {
     managedCollectorInstructions?: {
         __typename?: 'ManagedCollectorInstructions';
         region: string;
-        hostNetworkId: string;
+        deploymentRoleRef?: string | null;
+        networkId: string;
         mode: string;
         notes: Array<string>;
         updatedAt: string;
@@ -3565,7 +3679,7 @@ export type CreateManagedCollectorMutation = {
     createManagedCollector: {
         __typename?: 'ManagedCollectorReport';
         region: string;
-        hostNetworkId: string;
+        networkId: string;
         kind: string;
         status: string;
         message: string;
@@ -3575,11 +3689,8 @@ export type CreateManagedCollectorMutation = {
         desired: {
             __typename?: 'ManagedCollectorDesired';
             enabled: boolean;
-            hostNetworkId?: string | null;
-            subnetIds?: Array<string> | null;
-            securityGroupIds?: Array<string> | null;
-            clusterRef?: string | null;
-            assignPublicIp: boolean;
+            networkId?: string | null;
+            deploymentRoleRef?: string | null;
             cpu: string;
             memory: string;
             logRetentionDays: number;
@@ -3595,6 +3706,11 @@ export type CreateManagedCollectorMutation = {
                 targetCpuPercent?: number | null;
                 targetMemoryPercent?: number | null;
             };
+            retention: {
+                __typename?: 'ManagedCollectorRetention';
+                idleScaleToZeroAfterHours: number;
+                idleDeleteAfterHours: number;
+            };
             transport: {
                 __typename?: 'ManagedCollectorTransport';
                 mode?: string | null;
@@ -3603,10 +3719,20 @@ export type CreateManagedCollectorMutation = {
             };
             ingress: {
                 __typename?: 'ManagedCollectorIngress';
-                additionalSecurityGroupIds?: Array<string> | null;
                 additionalCidrs?: Array<string> | null;
+            };
+            providerOverrides: {
+                __typename?: 'AwsManagedCollectorProviderOverrides';
+                executionRoleArn?: string | null;
+                subnetIds?: Array<string> | null;
+                securityGroupIds?: Array<string> | null;
+                clusterRef?: string | null;
+                assignPublicIp: boolean;
+                useFargateSpot: boolean;
+                additionalSecurityGroupIds?: Array<string> | null;
                 allowNetworkCidrFallback: boolean;
                 minFallbackPrefixLength?: number | null;
+                provider: string;
             };
         };
         current: {
@@ -3690,7 +3816,7 @@ export type UpdateManagedCollectorMutation = {
     updateManagedCollector: {
         __typename?: 'ManagedCollectorReport';
         region: string;
-        hostNetworkId: string;
+        networkId: string;
         kind: string;
         status: string;
         message: string;
@@ -3700,11 +3826,8 @@ export type UpdateManagedCollectorMutation = {
         desired: {
             __typename?: 'ManagedCollectorDesired';
             enabled: boolean;
-            hostNetworkId?: string | null;
-            subnetIds?: Array<string> | null;
-            securityGroupIds?: Array<string> | null;
-            clusterRef?: string | null;
-            assignPublicIp: boolean;
+            networkId?: string | null;
+            deploymentRoleRef?: string | null;
             cpu: string;
             memory: string;
             logRetentionDays: number;
@@ -3720,6 +3843,11 @@ export type UpdateManagedCollectorMutation = {
                 targetCpuPercent?: number | null;
                 targetMemoryPercent?: number | null;
             };
+            retention: {
+                __typename?: 'ManagedCollectorRetention';
+                idleScaleToZeroAfterHours: number;
+                idleDeleteAfterHours: number;
+            };
             transport: {
                 __typename?: 'ManagedCollectorTransport';
                 mode?: string | null;
@@ -3728,10 +3856,20 @@ export type UpdateManagedCollectorMutation = {
             };
             ingress: {
                 __typename?: 'ManagedCollectorIngress';
-                additionalSecurityGroupIds?: Array<string> | null;
                 additionalCidrs?: Array<string> | null;
+            };
+            providerOverrides: {
+                __typename?: 'AwsManagedCollectorProviderOverrides';
+                executionRoleArn?: string | null;
+                subnetIds?: Array<string> | null;
+                securityGroupIds?: Array<string> | null;
+                clusterRef?: string | null;
+                assignPublicIp: boolean;
+                useFargateSpot: boolean;
+                additionalSecurityGroupIds?: Array<string> | null;
                 allowNetworkCidrFallback: boolean;
                 minFallbackPrefixLength?: number | null;
+                provider: string;
             };
         };
         current: {
@@ -3820,10 +3958,35 @@ export type TeardownManagedCollectorMutation = {
         retained: Array<string>;
     };
 };
+export type IssueManagedCollectorCredentialMutationVariables = Exact<{
+    input: IssueManagedCollectorCredentialInput;
+}>;
+export type IssueManagedCollectorCredentialMutation = {
+    __typename?: 'Mutation';
+    issueManagedCollectorCredential: {
+        __typename?: 'IssueManagedCollectorCredentialPayload';
+        collectorId: string;
+        credentialId: string;
+        authorizationHeader: string;
+        secretRef: string;
+    };
+};
+export type RevokeManagedCollectorCredentialMutationVariables = Exact<{
+    input: RevokeManagedCollectorCredentialInput;
+}>;
+export type RevokeManagedCollectorCredentialMutation = {
+    __typename?: 'Mutation';
+    revokeManagedCollectorCredential: {
+        __typename?: 'RevokeManagedCollectorCredentialPayload';
+        region: string;
+        credentialId: string;
+        revoked: boolean;
+    };
+};
 export type ManagedCollectorReportFieldsFragment = {
     __typename?: 'ManagedCollectorReport';
     region: string;
-    hostNetworkId: string;
+    networkId: string;
     kind: string;
     status: string;
     message: string;
@@ -3833,11 +3996,8 @@ export type ManagedCollectorReportFieldsFragment = {
     desired: {
         __typename?: 'ManagedCollectorDesired';
         enabled: boolean;
-        hostNetworkId?: string | null;
-        subnetIds?: Array<string> | null;
-        securityGroupIds?: Array<string> | null;
-        clusterRef?: string | null;
-        assignPublicIp: boolean;
+        networkId?: string | null;
+        deploymentRoleRef?: string | null;
         cpu: string;
         memory: string;
         logRetentionDays: number;
@@ -3853,6 +4013,11 @@ export type ManagedCollectorReportFieldsFragment = {
             targetCpuPercent?: number | null;
             targetMemoryPercent?: number | null;
         };
+        retention: {
+            __typename?: 'ManagedCollectorRetention';
+            idleScaleToZeroAfterHours: number;
+            idleDeleteAfterHours: number;
+        };
         transport: {
             __typename?: 'ManagedCollectorTransport';
             mode?: string | null;
@@ -3861,10 +4026,20 @@ export type ManagedCollectorReportFieldsFragment = {
         };
         ingress: {
             __typename?: 'ManagedCollectorIngress';
-            additionalSecurityGroupIds?: Array<string> | null;
             additionalCidrs?: Array<string> | null;
+        };
+        providerOverrides: {
+            __typename?: 'AwsManagedCollectorProviderOverrides';
+            executionRoleArn?: string | null;
+            subnetIds?: Array<string> | null;
+            securityGroupIds?: Array<string> | null;
+            clusterRef?: string | null;
+            assignPublicIp: boolean;
+            useFargateSpot: boolean;
+            additionalSecurityGroupIds?: Array<string> | null;
             allowNetworkCidrFallback: boolean;
             minFallbackPrefixLength?: number | null;
+            provider: string;
         };
     };
     current: {
@@ -5715,6 +5890,8 @@ export declare const GetManagedCollectorMetricsDocument: DocumentNode<GetManaged
 export declare const CreateManagedCollectorDocument: DocumentNode<CreateManagedCollectorMutation, CreateManagedCollectorMutationVariables>;
 export declare const UpdateManagedCollectorDocument: DocumentNode<UpdateManagedCollectorMutation, UpdateManagedCollectorMutationVariables>;
 export declare const TeardownManagedCollectorDocument: DocumentNode<TeardownManagedCollectorMutation, TeardownManagedCollectorMutationVariables>;
+export declare const IssueManagedCollectorCredentialDocument: DocumentNode<IssueManagedCollectorCredentialMutation, IssueManagedCollectorCredentialMutationVariables>;
+export declare const RevokeManagedCollectorCredentialDocument: DocumentNode<RevokeManagedCollectorCredentialMutation, RevokeManagedCollectorCredentialMutationVariables>;
 export declare const GetManagedCollectorDestinationTypesDocument: DocumentNode<GetManagedCollectorDestinationTypesQuery, GetManagedCollectorDestinationTypesQueryVariables>;
 export declare const ListManagedCollectorDestinationsDocument: DocumentNode<ListManagedCollectorDestinationsQuery, ListManagedCollectorDestinationsQueryVariables>;
 export declare const GetManagedCollectorDestinationDocument: DocumentNode<GetManagedCollectorDestinationQuery, GetManagedCollectorDestinationQueryVariables>;