diff --git a/client-sdks/manager/openapi.json b/client-sdks/manager/openapi.json index f2213d052..6a2b9a5d1 100644 --- a/client-sdks/manager/openapi.json +++ b/client-sdks/manager/openapi.json @@ -16251,6 +16251,25 @@ } ] }, + "publicEndpoints": { + "type": [ + "object", + "null" + ], + "description": "Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates.", + "additionalProperties": { + "type": "object", + "additionalProperties": { + "type": "string" + }, + "propertyNames": { + "type": "string" + } + }, + "propertyNames": { + "type": "string" + } + }, "telemetry": { "$ref": "#/components/schemas/TelemetryMode", "description": "How telemetry (logs, metrics, traces) is handled.\n- off: No telemetry permissions\n- auto: Telemetry flows automatically (default)\n- approval-required: Telemetry waits for explicit approval" diff --git a/client-sdks/manager/rust/openapi-3.0.json b/client-sdks/manager/rust/openapi-3.0.json index 9a0fd333c..0fb8cca12 100644 --- a/client-sdks/manager/rust/openapi-3.0.json +++ b/client-sdks/manager/rust/openapi-3.0.json @@ -1552,6 +1552,63 @@ "target": {} } }, + "AiAccessTest": { + "type": "string", + "enum": [ + "verified", + "failed", + "not-checked" + ] + }, + "AiAvailabilityBlocker": { + "type": "string", + "enum": [ + "agreement-required", + "entitlement-required", + "model-activation-required", + "deployment-required", + "quota-configuration-required", + "region-unavailable", + "access-denied", + "observation-failed" + ] + }, + "AiAvailabilityObservation": { + "type": "object", + "required": [ + "source", + "catalogRevision", + "models" + ], + "properties": { + "catalogRevision": { + "type": "string" + }, + "location": { + "type": "string", + "nullable": true + }, + "models": { + "type": "array", + "items": { + "$ref": "#/components/schemas/AiModelAvailabilityObservation" + } + }, + "source": { + "$ref": "#/components/schemas/AiAvailabilitySource" + } + } + }, + "AiAvailabilitySource": { + "type": "string", + "description": "Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms.", + "enum": [ + "aws-bedrock", + "gcp-vertex", + "azure-foundry", + "anthropic" + ] + }, "AiHeartbeatData": { "oneOf": [ { @@ -1674,6 +1731,56 @@ } } }, + "AiModelAvailability": { + "type": "string", + "enum": [ + "available", + "blocked", + "unknown" + ] + }, + "AiModelAvailabilityObservation": { + "type": "object", + "required": [ + "publicModelId", + "clientApis", + "availability", + "blockers", + "accessTest" + ], + "properties": { + "accessTest": { + "$ref": "#/components/schemas/AiAccessTest" + }, + "availability": { + "$ref": "#/components/schemas/AiModelAvailability" + }, + "blockers": { + "type": "array", + "items": { + "$ref": "#/components/schemas/AiAvailabilityBlocker" + } + }, + "clientApis": { + "type": "array", + "items": { + "$ref": "#/components/schemas/ClientApi" + } + }, + "errorCode": { + "type": "string", + "nullable": true + }, + "publicModelId": { + "type": "string" + }, + "testedAt": { + "type": "string", + "format": "date-time", + "nullable": true + } + } + }, "AlienError": { "type": "object", "description": "Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems.", @@ -1886,9 +1993,13 @@ "type": "object", "required": [ "status", - "region" + "region", + "availability" ], "properties": { + "availability": { + "$ref": "#/components/schemas/AiAvailabilityObservation" + }, "region": { "type": "string" }, @@ -4002,12 +4113,16 @@ "type": "object", "required": [ "status", - "accountName" + "accountName", + "availability" ], "properties": { "accountName": { "type": "string" }, + "availability": { + "$ref": "#/components/schemas/AiAvailabilityObservation" + }, "endpoint": { "type": "string", "nullable": true @@ -5122,6 +5237,15 @@ } } }, + "ClientApi": { + "type": "string", + "description": "A public API accepted from an application client.", + "enum": [ + "open-ai-chat-completions", + "open-ai-responses", + "anthropic-messages" + ] + }, "ClientConfig": { "oneOf": [ { @@ -6602,6 +6726,10 @@ "provider" ], "properties": { + "availability": { + "$ref": "#/components/schemas/AiAvailabilityObservation", + "nullable": true + }, "provider": { "type": "string", "description": "The BYO-key provider serving this binding (e.g. \"openai\"). Used on the Local\nplatform, where the app brings its own provider key instead of an ambient cloud." @@ -7821,9 +7949,13 @@ "required": [ "status", "project", - "location" + "location", + "availability" ], "properties": { + "availability": { + "$ref": "#/components/schemas/AiAvailabilityObservation" + }, "location": { "type": "string" }, @@ -13821,6 +13953,17 @@ "description": "Network configuration for the stack (VPC/VNet settings).\nIf `None`, an isolated VPC with NAT is auto-created when the stack has resources\nthat require networking (e.g., containers). Set explicitly to customize:\n`UseDefault` for the provider's default network (fast, dev/test only),\n`Create` for an isolated VPC with managed NAT (production), or `ByoVpc*`\nto reference an existing customer-managed VPC.", "nullable": true }, + "publicEndpoints": { + "type": "object", + "description": "Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates.", + "additionalProperties": { + "type": "object", + "additionalProperties": { + "type": "string" + } + }, + "nullable": true + }, "telemetry": { "$ref": "#/components/schemas/TelemetryMode", "description": "How telemetry (logs, metrics, traces) is handled.\n- off: No telemetry permissions\n- auto: Telemetry flows automatically (default)\n- approval-required: Telemetry waits for explicit approval" diff --git a/crates/alien-core/src/stack_settings.rs b/crates/alien-core/src/stack_settings.rs index 88db50443..19ba4e74d 100644 --- a/crates/alien-core/src/stack_settings.rs +++ b/crates/alien-core/src/stack_settings.rs @@ -724,6 +724,18 @@ pub struct StackSettings { #[serde(default, skip_serializing_if = "Option::is_none")] pub compute: Option, + /// Exact externally managed endpoint URLs, keyed by resource ID and endpoint name. + /// + /// This is intended for adopted Machines deployments whose DNS and certificates remain + /// customer-owned. The platform passes these URLs to the runtime without creating or + /// replacing DNS records or certificates. + #[serde(default, skip_serializing_if = "Option::is_none")] + #[cfg_attr( + feature = "openapi", + schema(value_type = Option>>) + )] + pub public_endpoints: Option, + /// Deployment model: push (Manager) or pull (Agent). /// Default: Push. /// - Push: Manager drives updates. For cloud platforms, requires cross-account @@ -886,4 +898,24 @@ mod failure_domain_tests { }; assert_eq!(valid.validate(), Ok(())); } + + #[test] + fn machine_public_endpoints_round_trip_without_rewriting_urls() { + let settings: StackSettings = serde_json::from_value(serde_json::json!({ + "publicEndpoints": { + "loader": { + "api": "https://10m5el.compute.islo.ai", + "shares": "https://shares.10m5el.compute.islo.ai", + "webhooks": "https://webhooks.10m5el.compute.islo.ai" + } + } + })) + .expect("stack settings should deserialize"); + + assert_eq!( + serde_json::to_value(settings).expect("stack settings should serialize") + ["publicEndpoints"]["loader"]["shares"], + "https://shares.10m5el.compute.islo.ai" + ); + } } diff --git a/crates/alien-deploy-cli/src/commands/up.rs b/crates/alien-deploy-cli/src/commands/up.rs index 392aad9a2..ddb15af2c 100644 --- a/crates/alien-deploy-cli/src/commands/up.rs +++ b/crates/alien-deploy-cli/src/commands/up.rs @@ -517,6 +517,30 @@ mod tests { ); } + #[test] + fn sdk_stack_settings_preserves_public_endpoints() { + let settings = StackSettings { + public_endpoints: Some(std::collections::HashMap::from([( + "loader".to_string(), + std::collections::HashMap::from([( + "api".to_string(), + "https://10m5el.compute.islo.ai".to_string(), + )]), + )])), + ..StackSettings::default() + }; + + let wire = serde_json::to_value( + sdk_stack_settings(&settings).expect("settings should convert to SDK type"), + ) + .expect("settings should serialize"); + + assert_eq!( + wire["publicEndpoints"]["loader"]["api"], + "https://10m5el.compute.islo.ai" + ); + } + #[test] fn local_tracking_uses_service_data_dir_by_default() { let args = UpArgs::parse_from(["alien-deploy", "--platform", "local"]); diff --git a/crates/alien-manager/openapi.json b/crates/alien-manager/openapi.json index f2213d052..6a2b9a5d1 100644 --- a/crates/alien-manager/openapi.json +++ b/crates/alien-manager/openapi.json @@ -16251,6 +16251,25 @@ } ] }, + "publicEndpoints": { + "type": [ + "object", + "null" + ], + "description": "Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates.", + "additionalProperties": { + "type": "object", + "additionalProperties": { + "type": "string" + }, + "propertyNames": { + "type": "string" + } + }, + "propertyNames": { + "type": "string" + } + }, "telemetry": { "$ref": "#/components/schemas/TelemetryMode", "description": "How telemetry (logs, metrics, traces) is handled.\n- off: No telemetry permissions\n- auto: Telemetry flows automatically (default)\n- approval-required: Telemetry waits for explicit approval" diff --git a/crates/alien-operator/src/config.rs b/crates/alien-operator/src/config.rs index fb1c3ce58..165875146 100644 --- a/crates/alien-operator/src/config.rs +++ b/crates/alien-operator/src/config.rs @@ -202,6 +202,7 @@ mod tests { kubernetes: None, external_bindings: None, compute: None, + public_endpoints: None, })) .api_server_port(8080) .build(); @@ -258,6 +259,7 @@ mod tests { kubernetes: None, external_bindings: None, compute: None, + public_endpoints: None, })) .build(); @@ -281,6 +283,7 @@ mod tests { kubernetes: None, external_bindings: None, compute: None, + public_endpoints: None, })) .build(); @@ -304,6 +307,7 @@ mod tests { kubernetes: None, external_bindings: None, compute: None, + public_endpoints: None, })) .build(); diff --git a/packages/core/src/generated/schemas/stackImportRequest.json b/packages/core/src/generated/schemas/stackImportRequest.json index 09a452537..9622631fd 100644 --- a/packages/core/src/generated/schemas/stackImportRequest.json +++ b/packages/core/src/generated/schemas/stackImportRequest.json @@ -1 +1 @@ -{"type":"object","description":"Request body for manager-side stack import.","required":["setupImportFormatVersion","deploymentGroupToken","deploymentName","resourcePrefix","platform","region","setupTarget","setupFingerprint","setupFingerprintVersion","stackSettings","resources"],"properties":{"basePlatform":{"oneOf":[{"type":"null"},{"description":"Optional base cloud platform for Kubernetes setup targets such as\nEKS/GKE/AKS. The runtime platform remains Kubernetes.","type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"x-readme-ref-name":"Platform"}]},"deploymentGroupToken":{"type":"string","description":"Deployment-group token authorizing the import."},"deploymentName":{"type":"string","description":"User-chosen deployment name. Must be unique within the deployment\ngroup; the manager returns 409 on collision rather than silently\nresolving to an existing deployment. Each setup adapter picks\nthe natural source: CloudFormation defaults to the CFN stack name,\nHelm to `{namespace}/{release}`, Terraform requires an explicit\n`name` attribute on the `alien_deployment` resource."},"inputValues":{"type":"object","description":"Deployer-provided stack input values collected by generated setup\nsurfaces. Platform-backed managers resolve these into runtime\nenvironment variables before deployment creation; standalone managers\naccept the field for setup package compatibility.","additionalProperties":{},"propertyNames":{"type":"string"}},"managementConfig":{"oneOf":[{"type":"null"},{"description":"Platform-derived management configuration, when this setup creates a\ncross-account/cross-tenant management identity.","oneOf":[{"allOf":[{"description":"AWS management configuration","type":"object","required":["managingRoleArn"],"properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"x-readme-ref-name":"AwsManagementConfig"},{"type":"object","required":["platform"],"properties":{"platform":{"type":"string","enum":["aws"]}}}],"description":"AWS management configuration"},{"allOf":[{"description":"GCP management configuration","type":"object","required":["serviceAccountEmail"],"properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"x-readme-ref-name":"GcpManagementConfig"},{"type":"object","required":["platform"],"properties":{"platform":{"type":"string","enum":["gcp"]}}}],"description":"GCP management configuration"},{"allOf":[{"description":"Azure management configuration","type":"object","required":["managingTenantId","oidcIssuer","oidcSubject"],"properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"x-readme-ref-name":"AzureManagementConfig"},{"type":"object","required":["platform"],"properties":{"platform":{"type":"string","enum":["azure"]}}}],"description":"Azure management configuration"},{"type":"object","description":"Kubernetes management configuration (minimal for now)","required":["platform"],"properties":{"platform":{"type":"string","enum":["kubernetes"]}}}],"x-readme-ref-name":"ManagementConfig"}]},"platform":{"description":"Platform being imported.","type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"x-readme-ref-name":"Platform"},"region":{"type":"string","description":"Region or location reported by the setup artifact."},"releaseId":{"type":["string","null"],"description":"Optional release id that produced the setup package. When\nomitted, the manager imports against the latest release."},"resourcePrefix":{"type":"string","description":"Stable physical-name prefix used by the setup package for generated\nresources. Runtime controllers use it when addressing imported\nresources."},"resources":{"type":"array","items":{"type":"object","description":"One resolved resource import payload.","required":["id","type","importData"],"properties":{"id":{"type":"string","description":"Resource id from the active stack."},"importData":{"type":"object","description":"Resolved typed payload for this resource."},"type":{"description":"Resource type from the active stack.","type":"string","examples":["worker","storage","queue","redis","postgres"],"x-readme-ref-name":"ResourceType"}},"x-readme-ref-name":"ImportedResource"},"description":"Imported resources with typed per-resource payloads."},"setupFingerprint":{"type":"string","description":"Setup compatibility fingerprint embedded in the package."},"setupFingerprintVersion":{"type":"integer","format":"int32","description":"Setup fingerprint algorithm version embedded in the package.","minimum":0},"setupImportFormatVersion":{"type":"integer","format":"int32","description":"Wire-format version for the setup import payload.","minimum":0},"setupMetadata":{"description":"Setup source metadata needed by the control plane to guide privileged\nteardown. The manager treats this as opaque JSON."},"setupTarget":{"type":"string","description":"Setup target this package was generated for."},"sourceKind":{"oneOf":[{"type":"null"},{"description":"Optional source label for observability. Does not affect import\nbehavior — the manager dispatches the same `ImporterRegistry`\nregardless of which setup package emitted the payload.","type":"string","enum":["cloudformation","terraform","helm"],"x-readme-ref-name":"ImportSourceKind"}]},"stackSettings":{"description":"Resolved stack settings supplied by the setup artifact.","type":"object","properties":{"compute":{"oneOf":[{"type":"null"},{"description":"Deployment-time compute selections for Alien-managed compute pools.\n\nThis is where provider machine names such as EC2 instance types, GCE\nmachine types, or Azure VM SKUs belong. Application source should\ndeclare portable requirements instead.","type":"object","properties":{"pools":{"type":"object","description":"Selected compute choices keyed by pool ID.","additionalProperties":{"oneOf":[{"type":"object","description":"Fixed number of machines.","required":["machines","mode"],"properties":{"failure_domains":{"oneOf":[{"type":"null"},{"description":"Optional failure-domain policy. Absence preserves the existing aggregate layout.","type":"object","required":["spread"],"properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","format":"int32","description":"Number of distinct failure domains across which new stateful replicas may be spread.","minimum":0}},"x-readme-ref-name":"FailureDomainSelection"}]},"machine":{"type":["string","null"],"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","format":"int32","description":"Number of machines to run.","minimum":0},"mode":{"type":"string","enum":["fixed"]}}},{"type":"object","description":"Autoscaling machine pool.","required":["min","max","mode"],"properties":{"failure_domains":{"oneOf":[{"type":"null"},{"description":"Optional failure-domain policy. Absence preserves the existing aggregate layout.","type":"object","required":["spread"],"properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","format":"int32","description":"Number of distinct failure domains across which new stateful replicas may be spread.","minimum":0}},"x-readme-ref-name":"FailureDomainSelection"}]},"machine":{"type":["string","null"],"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","format":"int32","description":"Maximum machine count.","minimum":0},"min":{"type":"integer","format":"int32","description":"Minimum machine count.","minimum":0},"mode":{"type":"string","enum":["autoscale"]}}}],"description":"User-selected deployment settings for one compute pool.","x-readme-ref-name":"ComputePoolSelection"},"propertyNames":{"type":"string"}}},"x-readme-ref-name":"ComputeSettings"}]},"deploymentModel":{"description":"Deployment model: push (Manager) or pull (Agent).\nDefault: Push.\n- Push: Manager drives updates. For cloud platforms, requires cross-account\n credentials established during initial setup. For push-mode local\n deployments (currently `alien dev`), the manager has direct access —\n no bootstrap needed.\n- Pull: Agent in the target environment drives updates via polling.\n Required for Kubernetes and remote local deployments.","type":"string","enum":["push","pull"],"x-readme-ref-name":"DeploymentModel"},"domains":{"oneOf":[{"type":"null"},{"description":"Domain configuration (future).","type":"object","properties":{"customDomains":{"type":["object","null"],"description":"Custom domain configuration per resource ID.","additionalProperties":{"type":"object","description":"Custom domain configuration for a single resource.","required":["domain","certificate"],"properties":{"certificate":{"description":"Customer-provided certificate reference.","type":"object","properties":{"aws":{"oneOf":[{"type":"null"},{"description":"AWS ACM certificate ARN","type":"object","required":["certificateArn"],"properties":{"certificateArn":{"type":"string"}},"x-readme-ref-name":"AwsCustomCertificateConfig"}]},"azure":{"oneOf":[{"type":"null"},{"description":"Azure Key Vault certificate ID","type":"object","required":["keyVaultCertificateId"],"properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":["string","null"]}},"x-readme-ref-name":"AzureCustomCertificateConfig"}]},"gcp":{"oneOf":[{"type":"null"},{"description":"GCP Certificate Manager certificate name","type":"object","required":["certificateName"],"properties":{"certificateName":{"type":"string"}},"x-readme-ref-name":"GcpCustomCertificateConfig"}]},"kubernetes":{"oneOf":[{"type":"null"},{"description":"Kubernetes TLS Secret reference for Secret-backed route profiles.","type":"object","required":["tlsSecretRef"],"properties":{"tlsSecretRef":{"description":"Existing TLS Secret containing `tls.crt` and `tls.key`.","type":"object","required":["secretName"],"properties":{"namespace":{"type":["string","null"],"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"x-readme-ref-name":"KubernetesTlsSecretRef"}},"x-readme-ref-name":"KubernetesCustomCertificateConfig"}]}},"x-readme-ref-name":"CustomCertificateConfig"},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"x-readme-ref-name":"CustomDomainConfig"},"propertyNames":{"type":"string"}},"publicEndpointTarget":{"oneOf":[{"type":"null"},{"description":"Public endpoint DNS target selection for machines deployments.\n\nWhen omitted, machines deployments publish healthy machine public\naddresses directly. Use `LoadBalancer` when an external load balancer\nfronts the machines and Alien should publish a CNAME to that target.","oneOf":[{"type":"object","description":"Publish DNS records directly to healthy machine public IP addresses.","required":["mode"],"properties":{"mode":{"type":"string","enum":["machineAddresses"]}}},{"type":"object","description":"Publish a CNAME record to an external load balancer.","required":["cnameTarget","mode"],"properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}}}],"x-readme-ref-name":"PublicEndpointTargetSettings"}]}},"x-readme-ref-name":"DomainSettings"}]},"externalBindings":{"type":["object","null"],"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"description":"How heartbeat health checks are handled.\n- off: No heartbeat permissions\n- on: Heartbeat enabled (default)","type":"string","enum":["off","on"],"x-readme-ref-name":"HeartbeatsMode"},"kubernetes":{"oneOf":[{"type":"null"},{"description":"Kubernetes runtime substrate configuration.","type":"object","properties":{"cluster":{"oneOf":[{"type":"null"},{"description":"Cluster selection or creation settings.","type":"object","required":["ownership"],"properties":{"cloud":{"oneOf":[{"type":"null"},{"description":"Optional provider-specific cloud identity for existing clusters.","type":"object","properties":{"accountId":{"type":["string","null"]},"clusterId":{"type":["string","null"]},"clusterName":{"type":["string","null"]},"projectId":{"type":["string","null"]},"region":{"type":["string","null"]},"resourceGroup":{"type":["string","null"]},"subscriptionId":{"type":["string","null"]}},"additionalProperties":false,"x-readme-ref-name":"KubernetesCloudReference"}]},"namespace":{"type":["string","null"],"description":"Namespace where the Alien chart and application resources run."},"ownership":{"description":"Whether Alien should create the cluster, use a setup-owned existing\ncluster, or bind to an external/on-prem cluster.","type":"string","enum":["managed","existing","external"],"x-readme-ref-name":"KubernetesClusterOwnership"}},"x-readme-ref-name":"KubernetesClusterSettings"}]},"exposure":{"oneOf":[{"type":"null"},{"description":"Public HTTPS exposure contract shared by setup, Helm, and runtime.","oneOf":[{"type":"object","description":"Do not create Alien-managed external routing.","required":["mode"],"properties":{"mode":{"type":"string","enum":["disabled"]}}},{"type":"object","description":"Use Alien-generated DNS and Platform-managed certificate material.","required":["route","certificate","mode"],"properties":{"certificate":{"description":"How managed certificate material reaches the route profile.","oneOf":[{"type":"object","description":"Platform-managed cert imported into AWS ACM by the runtime.","required":["mode"],"properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":["string","null"],"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","description":"Tags applied to runtime-imported ACM certificates.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}}}},{"type":"object","description":"Customer-provided AWS ACM certificate ARN.","required":["certificateArn","mode"],"properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}}},{"type":"object","description":"Platform-managed cert written to a Kubernetes TLS Secret.","required":["secretNameTemplate","mode"],"properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}}},{"allOf":[{"description":"Customer-provided Kubernetes TLS Secret.","type":"object","required":["secretName"],"properties":{"namespace":{"type":["string","null"],"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"x-readme-ref-name":"KubernetesTlsSecretRef"},{"type":"object","required":["mode"],"properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}}}],"description":"Customer-provided Kubernetes TLS Secret."},{"type":"object","description":"No TLS certificate should be configured by Alien.","required":["mode"],"properties":{"mode":{"type":"string","enum":["none"]}}}],"x-readme-ref-name":"KubernetesCertificateMode"},"mode":{"type":"string","enum":["generated"]},"route":{"description":"Runtime route profile to materialize.","oneOf":[{"allOf":[{"description":"`networking.k8s.io/v1` Ingress route profile.","type":"object","required":["ingressClassName"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesIngressRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["ingress"]}}}],"description":"`networking.k8s.io/v1` Ingress route profile."},{"allOf":[{"description":"Gateway API `Gateway` + `HTTPRoute` route profile.","type":"object","required":["gatewayClassName","listenerPort"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"listenerPort":{"type":"integer","format":"int32","description":"Listener port, usually 443.","minimum":0},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesGatewayRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["gateway"]}}}],"description":"Gateway API `Gateway` + `HTTPRoute` route profile."}],"x-readme-ref-name":"KubernetesRouteProfile"}}},{"type":"object","description":"Use a customer hostname and customer-owned certificate reference.","required":["domain","route","certificate","mode"],"properties":{"certificate":{"description":"Customer-owned certificate reference consumed by the route profile.","oneOf":[{"type":"object","description":"Platform-managed cert imported into AWS ACM by the runtime.","required":["mode"],"properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":["string","null"],"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","description":"Tags applied to runtime-imported ACM certificates.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}}}},{"type":"object","description":"Customer-provided AWS ACM certificate ARN.","required":["certificateArn","mode"],"properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}}},{"type":"object","description":"Platform-managed cert written to a Kubernetes TLS Secret.","required":["secretNameTemplate","mode"],"properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}}},{"allOf":[{"description":"Customer-provided Kubernetes TLS Secret.","type":"object","required":["secretName"],"properties":{"namespace":{"type":["string","null"],"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"x-readme-ref-name":"KubernetesTlsSecretRef"},{"type":"object","required":["mode"],"properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}}}],"description":"Customer-provided Kubernetes TLS Secret."},{"type":"object","description":"No TLS certificate should be configured by Alien.","required":["mode"],"properties":{"mode":{"type":"string","enum":["none"]}}}],"x-readme-ref-name":"KubernetesCertificateMode"},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"description":"Runtime route profile to materialize.","oneOf":[{"allOf":[{"description":"`networking.k8s.io/v1` Ingress route profile.","type":"object","required":["ingressClassName"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesIngressRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["ingress"]}}}],"description":"`networking.k8s.io/v1` Ingress route profile."},{"allOf":[{"description":"Gateway API `Gateway` + `HTTPRoute` route profile.","type":"object","required":["gatewayClassName","listenerPort"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"listenerPort":{"type":"integer","format":"int32","description":"Listener port, usually 443.","minimum":0},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesGatewayRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["gateway"]}}}],"description":"Gateway API `Gateway` + `HTTPRoute` route profile."}],"x-readme-ref-name":"KubernetesRouteProfile"}}}],"x-readme-ref-name":"KubernetesExposureSettings"}]}},"x-readme-ref-name":"KubernetesSettings"}]},"network":{"oneOf":[{"type":"null"},{"description":"Network configuration for the stack (VPC/VNet settings).\nIf `None`, an isolated VPC with NAT is auto-created when the stack has resources\nthat require networking (e.g., containers). Set explicitly to customize:\n`UseDefault` for the provider's default network (fast, dev/test only),\n`Create` for an isolated VPC with managed NAT (production), or `ByoVpc*`\nto reference an existing customer-managed VPC.","oneOf":[{"type":"object","description":"Use the cloud provider's default VPC/network.\n\nDesigned for fast dev/test provisioning. No isolated VPC is created, so there\nis nothing to wait for or clean up. VMs receive ephemeral public IPs for internet\naccess — no NAT gateway is provisioned.\n\n- **AWS**: Discovers the account's default VPC. Subnets are public with auto-assigned IPs.\n- **GCP**: Discovers the project's `default` network and regional subnet. Instance\n templates include an `AccessConfig` to assign an ephemeral external IP.\n- **Azure**: Azure has no default VNet, so one is created along with a NAT Gateway.\n VMs stay private and use NAT for egress.\n\nNot recommended for production. Use `Create` instead.","required":["type"],"properties":{"type":{"type":"string","enum":["use-default"]}}},{"type":"object","description":"Create a new isolated VPC/VNet with a managed NAT gateway.\n\nAll networking infrastructure is provisioned by Alien and cleaned up on delete.\nVMs use private IPs only; all outbound traffic routes through the NAT gateway.\n\nRecommended for production deployments.","required":["type"],"properties":{"availability_zones":{"type":"integer","format":"int32","description":"Number of availability zones (default: 2).","minimum":0},"cidr":{"type":["string","null"],"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}}},{"type":"object","description":"Use an existing VPC (AWS).\n\nAlien validates the references but creates no networking infrastructure.\nThe customer is responsible for routing and egress (NAT, proxy, VPN, etc.).","required":["vpc_id","public_subnet_ids","private_subnet_ids","type"],"properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}}},{"type":"object","description":"Use an existing VPC (GCP).\n\nAlien validates the references but creates no networking infrastructure.\nThe customer is responsible for routing and egress (Cloud NAT, proxy, VPN, etc.).","required":["network_name","subnet_name","region","type"],"properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}}},{"type":"object","description":"Use an existing VNet (Azure).\n\nAlien validates the references but creates no networking infrastructure.\nThe customer is responsible for routing and egress (NAT Gateway, proxy, VPN, etc.).","required":["vnet_resource_id","public_subnet_name","private_subnet_name","type"],"properties":{"application_gateway_subnet_name":{"type":["string","null"],"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":["string","null"],"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}}}],"x-readme-ref-name":"NetworkSettings"}]},"telemetry":{"description":"How telemetry (logs, metrics, traces) is handled.\n- off: No telemetry permissions\n- auto: Telemetry flows automatically (default)\n- approval-required: Telemetry waits for explicit approval","type":"string","enum":["off","auto","approval-required"],"x-readme-ref-name":"TelemetryMode"},"updates":{"description":"How updates are delivered.\n- auto: Updates deploy automatically (default)\n- approval-required: Updates wait for explicit approval","type":"string","enum":["auto","approval-required"],"x-readme-ref-name":"UpdatesMode"}},"x-readme-ref-name":"StackSettings"}},"x-readme-ref-name":"StackImportRequest"} \ No newline at end of file +{"type":"object","description":"Request body for manager-side stack import.","required":["setupImportFormatVersion","deploymentGroupToken","deploymentName","resourcePrefix","platform","region","setupTarget","setupFingerprint","setupFingerprintVersion","stackSettings","resources"],"properties":{"basePlatform":{"oneOf":[{"type":"null"},{"description":"Optional base cloud platform for Kubernetes setup targets such as\nEKS/GKE/AKS. The runtime platform remains Kubernetes.","type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"x-readme-ref-name":"Platform"}]},"deploymentGroupToken":{"type":"string","description":"Deployment-group token authorizing the import."},"deploymentName":{"type":"string","description":"User-chosen deployment name. Must be unique within the deployment\ngroup; the manager returns 409 on collision rather than silently\nresolving to an existing deployment. Each setup adapter picks\nthe natural source: CloudFormation defaults to the CFN stack name,\nHelm to `{namespace}/{release}`, Terraform requires an explicit\n`name` attribute on the `alien_deployment` resource."},"inputValues":{"type":"object","description":"Deployer-provided stack input values collected by generated setup\nsurfaces. Platform-backed managers resolve these into runtime\nenvironment variables before deployment creation; standalone managers\naccept the field for setup package compatibility.","additionalProperties":{},"propertyNames":{"type":"string"}},"managementConfig":{"oneOf":[{"type":"null"},{"description":"Platform-derived management configuration, when this setup creates a\ncross-account/cross-tenant management identity.","oneOf":[{"allOf":[{"description":"AWS management configuration","type":"object","required":["managingRoleArn"],"properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"x-readme-ref-name":"AwsManagementConfig"},{"type":"object","required":["platform"],"properties":{"platform":{"type":"string","enum":["aws"]}}}],"description":"AWS management configuration"},{"allOf":[{"description":"GCP management configuration","type":"object","required":["serviceAccountEmail"],"properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"x-readme-ref-name":"GcpManagementConfig"},{"type":"object","required":["platform"],"properties":{"platform":{"type":"string","enum":["gcp"]}}}],"description":"GCP management configuration"},{"allOf":[{"description":"Azure management configuration","type":"object","required":["managingTenantId","oidcIssuer","oidcSubject"],"properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"x-readme-ref-name":"AzureManagementConfig"},{"type":"object","required":["platform"],"properties":{"platform":{"type":"string","enum":["azure"]}}}],"description":"Azure management configuration"},{"type":"object","description":"Kubernetes management configuration (minimal for now)","required":["platform"],"properties":{"platform":{"type":"string","enum":["kubernetes"]}}}],"x-readme-ref-name":"ManagementConfig"}]},"platform":{"description":"Platform being imported.","type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"x-readme-ref-name":"Platform"},"region":{"type":"string","description":"Region or location reported by the setup artifact."},"releaseId":{"type":["string","null"],"description":"Optional release id that produced the setup package. When\nomitted, the manager imports against the latest release."},"resourcePrefix":{"type":"string","description":"Stable physical-name prefix used by the setup package for generated\nresources. Runtime controllers use it when addressing imported\nresources."},"resources":{"type":"array","items":{"type":"object","description":"One resolved resource import payload.","required":["id","type","importData"],"properties":{"id":{"type":"string","description":"Resource id from the active stack."},"importData":{"type":"object","description":"Resolved typed payload for this resource."},"type":{"description":"Resource type from the active stack.","type":"string","examples":["worker","storage","queue","redis","postgres"],"x-readme-ref-name":"ResourceType"}},"x-readme-ref-name":"ImportedResource"},"description":"Imported resources with typed per-resource payloads."},"setupFingerprint":{"type":"string","description":"Setup compatibility fingerprint embedded in the package."},"setupFingerprintVersion":{"type":"integer","format":"int32","description":"Setup fingerprint algorithm version embedded in the package.","minimum":0},"setupImportFormatVersion":{"type":"integer","format":"int32","description":"Wire-format version for the setup import payload.","minimum":0},"setupMetadata":{"description":"Setup source metadata needed by the control plane to guide privileged\nteardown. The manager treats this as opaque JSON."},"setupTarget":{"type":"string","description":"Setup target this package was generated for."},"sourceKind":{"oneOf":[{"type":"null"},{"description":"Optional source label for observability. Does not affect import\nbehavior — the manager dispatches the same `ImporterRegistry`\nregardless of which setup package emitted the payload.","type":"string","enum":["cloudformation","terraform","helm"],"x-readme-ref-name":"ImportSourceKind"}]},"stackSettings":{"description":"Resolved stack settings supplied by the setup artifact.","type":"object","properties":{"compute":{"oneOf":[{"type":"null"},{"description":"Deployment-time compute selections for Alien-managed compute pools.\n\nThis is where provider machine names such as EC2 instance types, GCE\nmachine types, or Azure VM SKUs belong. Application source should\ndeclare portable requirements instead.","type":"object","properties":{"pools":{"type":"object","description":"Selected compute choices keyed by pool ID.","additionalProperties":{"oneOf":[{"type":"object","description":"Fixed number of machines.","required":["machines","mode"],"properties":{"failure_domains":{"oneOf":[{"type":"null"},{"description":"Optional failure-domain policy. Absence preserves the existing aggregate layout.","type":"object","required":["spread"],"properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","format":"int32","description":"Number of distinct failure domains across which new stateful replicas may be spread.","minimum":0}},"x-readme-ref-name":"FailureDomainSelection"}]},"machine":{"type":["string","null"],"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","format":"int32","description":"Number of machines to run.","minimum":0},"mode":{"type":"string","enum":["fixed"]}}},{"type":"object","description":"Autoscaling machine pool.","required":["min","max","mode"],"properties":{"failure_domains":{"oneOf":[{"type":"null"},{"description":"Optional failure-domain policy. Absence preserves the existing aggregate layout.","type":"object","required":["spread"],"properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","format":"int32","description":"Number of distinct failure domains across which new stateful replicas may be spread.","minimum":0}},"x-readme-ref-name":"FailureDomainSelection"}]},"machine":{"type":["string","null"],"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","format":"int32","description":"Maximum machine count.","minimum":0},"min":{"type":"integer","format":"int32","description":"Minimum machine count.","minimum":0},"mode":{"type":"string","enum":["autoscale"]}}}],"description":"User-selected deployment settings for one compute pool.","x-readme-ref-name":"ComputePoolSelection"},"propertyNames":{"type":"string"}}},"x-readme-ref-name":"ComputeSettings"}]},"deploymentModel":{"description":"Deployment model: push (Manager) or pull (Agent).\nDefault: Push.\n- Push: Manager drives updates. For cloud platforms, requires cross-account\n credentials established during initial setup. For push-mode local\n deployments (currently `alien dev`), the manager has direct access —\n no bootstrap needed.\n- Pull: Agent in the target environment drives updates via polling.\n Required for Kubernetes and remote local deployments.","type":"string","enum":["push","pull"],"x-readme-ref-name":"DeploymentModel"},"domains":{"oneOf":[{"type":"null"},{"description":"Domain configuration (future).","type":"object","properties":{"customDomains":{"type":["object","null"],"description":"Custom domain configuration per resource ID.","additionalProperties":{"type":"object","description":"Custom domain configuration for a single resource.","required":["domain","certificate"],"properties":{"certificate":{"description":"Customer-provided certificate reference.","type":"object","properties":{"aws":{"oneOf":[{"type":"null"},{"description":"AWS ACM certificate ARN","type":"object","required":["certificateArn"],"properties":{"certificateArn":{"type":"string"}},"x-readme-ref-name":"AwsCustomCertificateConfig"}]},"azure":{"oneOf":[{"type":"null"},{"description":"Azure Key Vault certificate ID","type":"object","required":["keyVaultCertificateId"],"properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":["string","null"]}},"x-readme-ref-name":"AzureCustomCertificateConfig"}]},"gcp":{"oneOf":[{"type":"null"},{"description":"GCP Certificate Manager certificate name","type":"object","required":["certificateName"],"properties":{"certificateName":{"type":"string"}},"x-readme-ref-name":"GcpCustomCertificateConfig"}]},"kubernetes":{"oneOf":[{"type":"null"},{"description":"Kubernetes TLS Secret reference for Secret-backed route profiles.","type":"object","required":["tlsSecretRef"],"properties":{"tlsSecretRef":{"description":"Existing TLS Secret containing `tls.crt` and `tls.key`.","type":"object","required":["secretName"],"properties":{"namespace":{"type":["string","null"],"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"x-readme-ref-name":"KubernetesTlsSecretRef"}},"x-readme-ref-name":"KubernetesCustomCertificateConfig"}]}},"x-readme-ref-name":"CustomCertificateConfig"},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"x-readme-ref-name":"CustomDomainConfig"},"propertyNames":{"type":"string"}},"publicEndpointTarget":{"oneOf":[{"type":"null"},{"description":"Public endpoint DNS target selection for machines deployments.\n\nWhen omitted, machines deployments publish healthy machine public\naddresses directly. Use `LoadBalancer` when an external load balancer\nfronts the machines and Alien should publish a CNAME to that target.","oneOf":[{"type":"object","description":"Publish DNS records directly to healthy machine public IP addresses.","required":["mode"],"properties":{"mode":{"type":"string","enum":["machineAddresses"]}}},{"type":"object","description":"Publish a CNAME record to an external load balancer.","required":["cnameTarget","mode"],"properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}}}],"x-readme-ref-name":"PublicEndpointTargetSettings"}]}},"x-readme-ref-name":"DomainSettings"}]},"externalBindings":{"type":["object","null"],"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"description":"How heartbeat health checks are handled.\n- off: No heartbeat permissions\n- on: Heartbeat enabled (default)","type":"string","enum":["off","on"],"x-readme-ref-name":"HeartbeatsMode"},"kubernetes":{"oneOf":[{"type":"null"},{"description":"Kubernetes runtime substrate configuration.","type":"object","properties":{"cluster":{"oneOf":[{"type":"null"},{"description":"Cluster selection or creation settings.","type":"object","required":["ownership"],"properties":{"cloud":{"oneOf":[{"type":"null"},{"description":"Optional provider-specific cloud identity for existing clusters.","type":"object","properties":{"accountId":{"type":["string","null"]},"clusterId":{"type":["string","null"]},"clusterName":{"type":["string","null"]},"projectId":{"type":["string","null"]},"region":{"type":["string","null"]},"resourceGroup":{"type":["string","null"]},"subscriptionId":{"type":["string","null"]}},"additionalProperties":false,"x-readme-ref-name":"KubernetesCloudReference"}]},"namespace":{"type":["string","null"],"description":"Namespace where the Alien chart and application resources run."},"ownership":{"description":"Whether Alien should create the cluster, use a setup-owned existing\ncluster, or bind to an external/on-prem cluster.","type":"string","enum":["managed","existing","external"],"x-readme-ref-name":"KubernetesClusterOwnership"}},"x-readme-ref-name":"KubernetesClusterSettings"}]},"exposure":{"oneOf":[{"type":"null"},{"description":"Public HTTPS exposure contract shared by setup, Helm, and runtime.","oneOf":[{"type":"object","description":"Do not create Alien-managed external routing.","required":["mode"],"properties":{"mode":{"type":"string","enum":["disabled"]}}},{"type":"object","description":"Use Alien-generated DNS and Platform-managed certificate material.","required":["route","certificate","mode"],"properties":{"certificate":{"description":"How managed certificate material reaches the route profile.","oneOf":[{"type":"object","description":"Platform-managed cert imported into AWS ACM by the runtime.","required":["mode"],"properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":["string","null"],"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","description":"Tags applied to runtime-imported ACM certificates.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}}}},{"type":"object","description":"Customer-provided AWS ACM certificate ARN.","required":["certificateArn","mode"],"properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}}},{"type":"object","description":"Platform-managed cert written to a Kubernetes TLS Secret.","required":["secretNameTemplate","mode"],"properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}}},{"allOf":[{"description":"Customer-provided Kubernetes TLS Secret.","type":"object","required":["secretName"],"properties":{"namespace":{"type":["string","null"],"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"x-readme-ref-name":"KubernetesTlsSecretRef"},{"type":"object","required":["mode"],"properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}}}],"description":"Customer-provided Kubernetes TLS Secret."},{"type":"object","description":"No TLS certificate should be configured by Alien.","required":["mode"],"properties":{"mode":{"type":"string","enum":["none"]}}}],"x-readme-ref-name":"KubernetesCertificateMode"},"mode":{"type":"string","enum":["generated"]},"route":{"description":"Runtime route profile to materialize.","oneOf":[{"allOf":[{"description":"`networking.k8s.io/v1` Ingress route profile.","type":"object","required":["ingressClassName"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesIngressRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["ingress"]}}}],"description":"`networking.k8s.io/v1` Ingress route profile."},{"allOf":[{"description":"Gateway API `Gateway` + `HTTPRoute` route profile.","type":"object","required":["gatewayClassName","listenerPort"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"listenerPort":{"type":"integer","format":"int32","description":"Listener port, usually 443.","minimum":0},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesGatewayRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["gateway"]}}}],"description":"Gateway API `Gateway` + `HTTPRoute` route profile."}],"x-readme-ref-name":"KubernetesRouteProfile"}}},{"type":"object","description":"Use a customer hostname and customer-owned certificate reference.","required":["domain","route","certificate","mode"],"properties":{"certificate":{"description":"Customer-owned certificate reference consumed by the route profile.","oneOf":[{"type":"object","description":"Platform-managed cert imported into AWS ACM by the runtime.","required":["mode"],"properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":["string","null"],"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","description":"Tags applied to runtime-imported ACM certificates.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}}}},{"type":"object","description":"Customer-provided AWS ACM certificate ARN.","required":["certificateArn","mode"],"properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}}},{"type":"object","description":"Platform-managed cert written to a Kubernetes TLS Secret.","required":["secretNameTemplate","mode"],"properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}}},{"allOf":[{"description":"Customer-provided Kubernetes TLS Secret.","type":"object","required":["secretName"],"properties":{"namespace":{"type":["string","null"],"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"x-readme-ref-name":"KubernetesTlsSecretRef"},{"type":"object","required":["mode"],"properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}}}],"description":"Customer-provided Kubernetes TLS Secret."},{"type":"object","description":"No TLS certificate should be configured by Alien.","required":["mode"],"properties":{"mode":{"type":"string","enum":["none"]}}}],"x-readme-ref-name":"KubernetesCertificateMode"},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"description":"Runtime route profile to materialize.","oneOf":[{"allOf":[{"description":"`networking.k8s.io/v1` Ingress route profile.","type":"object","required":["ingressClassName"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesIngressRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["ingress"]}}}],"description":"`networking.k8s.io/v1` Ingress route profile."},{"allOf":[{"description":"Gateway API `Gateway` + `HTTPRoute` route profile.","type":"object","required":["gatewayClassName","listenerPort"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"listenerPort":{"type":"integer","format":"int32","description":"Listener port, usually 443.","minimum":0},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesGatewayRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["gateway"]}}}],"description":"Gateway API `Gateway` + `HTTPRoute` route profile."}],"x-readme-ref-name":"KubernetesRouteProfile"}}}],"x-readme-ref-name":"KubernetesExposureSettings"}]}},"x-readme-ref-name":"KubernetesSettings"}]},"network":{"oneOf":[{"type":"null"},{"description":"Network configuration for the stack (VPC/VNet settings).\nIf `None`, an isolated VPC with NAT is auto-created when the stack has resources\nthat require networking (e.g., containers). Set explicitly to customize:\n`UseDefault` for the provider's default network (fast, dev/test only),\n`Create` for an isolated VPC with managed NAT (production), or `ByoVpc*`\nto reference an existing customer-managed VPC.","oneOf":[{"type":"object","description":"Use the cloud provider's default VPC/network.\n\nDesigned for fast dev/test provisioning. No isolated VPC is created, so there\nis nothing to wait for or clean up. VMs receive ephemeral public IPs for internet\naccess — no NAT gateway is provisioned.\n\n- **AWS**: Discovers the account's default VPC. Subnets are public with auto-assigned IPs.\n- **GCP**: Discovers the project's `default` network and regional subnet. Instance\n templates include an `AccessConfig` to assign an ephemeral external IP.\n- **Azure**: Azure has no default VNet, so one is created along with a NAT Gateway.\n VMs stay private and use NAT for egress.\n\nNot recommended for production. Use `Create` instead.","required":["type"],"properties":{"type":{"type":"string","enum":["use-default"]}}},{"type":"object","description":"Create a new isolated VPC/VNet with a managed NAT gateway.\n\nAll networking infrastructure is provisioned by Alien and cleaned up on delete.\nVMs use private IPs only; all outbound traffic routes through the NAT gateway.\n\nRecommended for production deployments.","required":["type"],"properties":{"availability_zones":{"type":"integer","format":"int32","description":"Number of availability zones (default: 2).","minimum":0},"cidr":{"type":["string","null"],"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}}},{"type":"object","description":"Use an existing VPC (AWS).\n\nAlien validates the references but creates no networking infrastructure.\nThe customer is responsible for routing and egress (NAT, proxy, VPN, etc.).","required":["vpc_id","public_subnet_ids","private_subnet_ids","type"],"properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}}},{"type":"object","description":"Use an existing VPC (GCP).\n\nAlien validates the references but creates no networking infrastructure.\nThe customer is responsible for routing and egress (Cloud NAT, proxy, VPN, etc.).","required":["network_name","subnet_name","region","type"],"properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}}},{"type":"object","description":"Use an existing VNet (Azure).\n\nAlien validates the references but creates no networking infrastructure.\nThe customer is responsible for routing and egress (NAT Gateway, proxy, VPN, etc.).","required":["vnet_resource_id","public_subnet_name","private_subnet_name","type"],"properties":{"application_gateway_subnet_name":{"type":["string","null"],"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":["string","null"],"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}}}],"x-readme-ref-name":"NetworkSettings"}]},"publicEndpoints":{"type":["object","null"],"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates.","additionalProperties":{"type":"object","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"propertyNames":{"type":"string"}},"telemetry":{"description":"How telemetry (logs, metrics, traces) is handled.\n- off: No telemetry permissions\n- auto: Telemetry flows automatically (default)\n- approval-required: Telemetry waits for explicit approval","type":"string","enum":["off","auto","approval-required"],"x-readme-ref-name":"TelemetryMode"},"updates":{"description":"How updates are delivered.\n- auto: Updates deploy automatically (default)\n- approval-required: Updates wait for explicit approval","type":"string","enum":["auto","approval-required"],"x-readme-ref-name":"UpdatesMode"}},"x-readme-ref-name":"StackSettings"}},"x-readme-ref-name":"StackImportRequest"} \ No newline at end of file diff --git a/packages/core/src/generated/schemas/stackImportResponse.json b/packages/core/src/generated/schemas/stackImportResponse.json index e4df9f81b..9390779f9 100644 --- a/packages/core/src/generated/schemas/stackImportResponse.json +++ b/packages/core/src/generated/schemas/stackImportResponse.json @@ -1 +1 @@ -{"type":"object","description":"Response body returned after a stack import.","required":["deploymentId","stackSettings","stackState"],"properties":{"deploymentId":{"type":"string","description":"Deployment created."},"deploymentToken":{"type":["string","null"],"description":"Deployment bearer token for the imported deployment, when available."},"stackSettings":{"description":"Stack settings persisted for the deployment.","type":"object","properties":{"compute":{"oneOf":[{"type":"null"},{"description":"Deployment-time compute selections for Alien-managed compute pools.\n\nThis is where provider machine names such as EC2 instance types, GCE\nmachine types, or Azure VM SKUs belong. Application source should\ndeclare portable requirements instead.","type":"object","properties":{"pools":{"type":"object","description":"Selected compute choices keyed by pool ID.","additionalProperties":{"oneOf":[{"type":"object","description":"Fixed number of machines.","required":["machines","mode"],"properties":{"failure_domains":{"oneOf":[{"type":"null"},{"description":"Optional failure-domain policy. Absence preserves the existing aggregate layout.","type":"object","required":["spread"],"properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","format":"int32","description":"Number of distinct failure domains across which new stateful replicas may be spread.","minimum":0}},"x-readme-ref-name":"FailureDomainSelection"}]},"machine":{"type":["string","null"],"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","format":"int32","description":"Number of machines to run.","minimum":0},"mode":{"type":"string","enum":["fixed"]}}},{"type":"object","description":"Autoscaling machine pool.","required":["min","max","mode"],"properties":{"failure_domains":{"oneOf":[{"type":"null"},{"description":"Optional failure-domain policy. Absence preserves the existing aggregate layout.","type":"object","required":["spread"],"properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","format":"int32","description":"Number of distinct failure domains across which new stateful replicas may be spread.","minimum":0}},"x-readme-ref-name":"FailureDomainSelection"}]},"machine":{"type":["string","null"],"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","format":"int32","description":"Maximum machine count.","minimum":0},"min":{"type":"integer","format":"int32","description":"Minimum machine count.","minimum":0},"mode":{"type":"string","enum":["autoscale"]}}}],"description":"User-selected deployment settings for one compute pool.","x-readme-ref-name":"ComputePoolSelection"},"propertyNames":{"type":"string"}}},"x-readme-ref-name":"ComputeSettings"}]},"deploymentModel":{"description":"Deployment model: push (Manager) or pull (Agent).\nDefault: Push.\n- Push: Manager drives updates. For cloud platforms, requires cross-account\n credentials established during initial setup. For push-mode local\n deployments (currently `alien dev`), the manager has direct access —\n no bootstrap needed.\n- Pull: Agent in the target environment drives updates via polling.\n Required for Kubernetes and remote local deployments.","type":"string","enum":["push","pull"],"x-readme-ref-name":"DeploymentModel"},"domains":{"oneOf":[{"type":"null"},{"description":"Domain configuration (future).","type":"object","properties":{"customDomains":{"type":["object","null"],"description":"Custom domain configuration per resource ID.","additionalProperties":{"type":"object","description":"Custom domain configuration for a single resource.","required":["domain","certificate"],"properties":{"certificate":{"description":"Customer-provided certificate reference.","type":"object","properties":{"aws":{"oneOf":[{"type":"null"},{"description":"AWS ACM certificate ARN","type":"object","required":["certificateArn"],"properties":{"certificateArn":{"type":"string"}},"x-readme-ref-name":"AwsCustomCertificateConfig"}]},"azure":{"oneOf":[{"type":"null"},{"description":"Azure Key Vault certificate ID","type":"object","required":["keyVaultCertificateId"],"properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":["string","null"]}},"x-readme-ref-name":"AzureCustomCertificateConfig"}]},"gcp":{"oneOf":[{"type":"null"},{"description":"GCP Certificate Manager certificate name","type":"object","required":["certificateName"],"properties":{"certificateName":{"type":"string"}},"x-readme-ref-name":"GcpCustomCertificateConfig"}]},"kubernetes":{"oneOf":[{"type":"null"},{"description":"Kubernetes TLS Secret reference for Secret-backed route profiles.","type":"object","required":["tlsSecretRef"],"properties":{"tlsSecretRef":{"description":"Existing TLS Secret containing `tls.crt` and `tls.key`.","type":"object","required":["secretName"],"properties":{"namespace":{"type":["string","null"],"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"x-readme-ref-name":"KubernetesTlsSecretRef"}},"x-readme-ref-name":"KubernetesCustomCertificateConfig"}]}},"x-readme-ref-name":"CustomCertificateConfig"},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"x-readme-ref-name":"CustomDomainConfig"},"propertyNames":{"type":"string"}},"publicEndpointTarget":{"oneOf":[{"type":"null"},{"description":"Public endpoint DNS target selection for machines deployments.\n\nWhen omitted, machines deployments publish healthy machine public\naddresses directly. Use `LoadBalancer` when an external load balancer\nfronts the machines and Alien should publish a CNAME to that target.","oneOf":[{"type":"object","description":"Publish DNS records directly to healthy machine public IP addresses.","required":["mode"],"properties":{"mode":{"type":"string","enum":["machineAddresses"]}}},{"type":"object","description":"Publish a CNAME record to an external load balancer.","required":["cnameTarget","mode"],"properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}}}],"x-readme-ref-name":"PublicEndpointTargetSettings"}]}},"x-readme-ref-name":"DomainSettings"}]},"externalBindings":{"type":["object","null"],"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"description":"How heartbeat health checks are handled.\n- off: No heartbeat permissions\n- on: Heartbeat enabled (default)","type":"string","enum":["off","on"],"x-readme-ref-name":"HeartbeatsMode"},"kubernetes":{"oneOf":[{"type":"null"},{"description":"Kubernetes runtime substrate configuration.","type":"object","properties":{"cluster":{"oneOf":[{"type":"null"},{"description":"Cluster selection or creation settings.","type":"object","required":["ownership"],"properties":{"cloud":{"oneOf":[{"type":"null"},{"description":"Optional provider-specific cloud identity for existing clusters.","type":"object","properties":{"accountId":{"type":["string","null"]},"clusterId":{"type":["string","null"]},"clusterName":{"type":["string","null"]},"projectId":{"type":["string","null"]},"region":{"type":["string","null"]},"resourceGroup":{"type":["string","null"]},"subscriptionId":{"type":["string","null"]}},"additionalProperties":false,"x-readme-ref-name":"KubernetesCloudReference"}]},"namespace":{"type":["string","null"],"description":"Namespace where the Alien chart and application resources run."},"ownership":{"description":"Whether Alien should create the cluster, use a setup-owned existing\ncluster, or bind to an external/on-prem cluster.","type":"string","enum":["managed","existing","external"],"x-readme-ref-name":"KubernetesClusterOwnership"}},"x-readme-ref-name":"KubernetesClusterSettings"}]},"exposure":{"oneOf":[{"type":"null"},{"description":"Public HTTPS exposure contract shared by setup, Helm, and runtime.","oneOf":[{"type":"object","description":"Do not create Alien-managed external routing.","required":["mode"],"properties":{"mode":{"type":"string","enum":["disabled"]}}},{"type":"object","description":"Use Alien-generated DNS and Platform-managed certificate material.","required":["route","certificate","mode"],"properties":{"certificate":{"description":"How managed certificate material reaches the route profile.","oneOf":[{"type":"object","description":"Platform-managed cert imported into AWS ACM by the runtime.","required":["mode"],"properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":["string","null"],"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","description":"Tags applied to runtime-imported ACM certificates.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}}}},{"type":"object","description":"Customer-provided AWS ACM certificate ARN.","required":["certificateArn","mode"],"properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}}},{"type":"object","description":"Platform-managed cert written to a Kubernetes TLS Secret.","required":["secretNameTemplate","mode"],"properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}}},{"allOf":[{"description":"Customer-provided Kubernetes TLS Secret.","type":"object","required":["secretName"],"properties":{"namespace":{"type":["string","null"],"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"x-readme-ref-name":"KubernetesTlsSecretRef"},{"type":"object","required":["mode"],"properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}}}],"description":"Customer-provided Kubernetes TLS Secret."},{"type":"object","description":"No TLS certificate should be configured by Alien.","required":["mode"],"properties":{"mode":{"type":"string","enum":["none"]}}}],"x-readme-ref-name":"KubernetesCertificateMode"},"mode":{"type":"string","enum":["generated"]},"route":{"description":"Runtime route profile to materialize.","oneOf":[{"allOf":[{"description":"`networking.k8s.io/v1` Ingress route profile.","type":"object","required":["ingressClassName"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesIngressRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["ingress"]}}}],"description":"`networking.k8s.io/v1` Ingress route profile."},{"allOf":[{"description":"Gateway API `Gateway` + `HTTPRoute` route profile.","type":"object","required":["gatewayClassName","listenerPort"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"listenerPort":{"type":"integer","format":"int32","description":"Listener port, usually 443.","minimum":0},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesGatewayRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["gateway"]}}}],"description":"Gateway API `Gateway` + `HTTPRoute` route profile."}],"x-readme-ref-name":"KubernetesRouteProfile"}}},{"type":"object","description":"Use a customer hostname and customer-owned certificate reference.","required":["domain","route","certificate","mode"],"properties":{"certificate":{"description":"Customer-owned certificate reference consumed by the route profile.","oneOf":[{"type":"object","description":"Platform-managed cert imported into AWS ACM by the runtime.","required":["mode"],"properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":["string","null"],"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","description":"Tags applied to runtime-imported ACM certificates.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}}}},{"type":"object","description":"Customer-provided AWS ACM certificate ARN.","required":["certificateArn","mode"],"properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}}},{"type":"object","description":"Platform-managed cert written to a Kubernetes TLS Secret.","required":["secretNameTemplate","mode"],"properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}}},{"allOf":[{"description":"Customer-provided Kubernetes TLS Secret.","type":"object","required":["secretName"],"properties":{"namespace":{"type":["string","null"],"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"x-readme-ref-name":"KubernetesTlsSecretRef"},{"type":"object","required":["mode"],"properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}}}],"description":"Customer-provided Kubernetes TLS Secret."},{"type":"object","description":"No TLS certificate should be configured by Alien.","required":["mode"],"properties":{"mode":{"type":"string","enum":["none"]}}}],"x-readme-ref-name":"KubernetesCertificateMode"},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"description":"Runtime route profile to materialize.","oneOf":[{"allOf":[{"description":"`networking.k8s.io/v1` Ingress route profile.","type":"object","required":["ingressClassName"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesIngressRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["ingress"]}}}],"description":"`networking.k8s.io/v1` Ingress route profile."},{"allOf":[{"description":"Gateway API `Gateway` + `HTTPRoute` route profile.","type":"object","required":["gatewayClassName","listenerPort"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"listenerPort":{"type":"integer","format":"int32","description":"Listener port, usually 443.","minimum":0},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesGatewayRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["gateway"]}}}],"description":"Gateway API `Gateway` + `HTTPRoute` route profile."}],"x-readme-ref-name":"KubernetesRouteProfile"}}}],"x-readme-ref-name":"KubernetesExposureSettings"}]}},"x-readme-ref-name":"KubernetesSettings"}]},"network":{"oneOf":[{"type":"null"},{"description":"Network configuration for the stack (VPC/VNet settings).\nIf `None`, an isolated VPC with NAT is auto-created when the stack has resources\nthat require networking (e.g., containers). Set explicitly to customize:\n`UseDefault` for the provider's default network (fast, dev/test only),\n`Create` for an isolated VPC with managed NAT (production), or `ByoVpc*`\nto reference an existing customer-managed VPC.","oneOf":[{"type":"object","description":"Use the cloud provider's default VPC/network.\n\nDesigned for fast dev/test provisioning. No isolated VPC is created, so there\nis nothing to wait for or clean up. VMs receive ephemeral public IPs for internet\naccess — no NAT gateway is provisioned.\n\n- **AWS**: Discovers the account's default VPC. Subnets are public with auto-assigned IPs.\n- **GCP**: Discovers the project's `default` network and regional subnet. Instance\n templates include an `AccessConfig` to assign an ephemeral external IP.\n- **Azure**: Azure has no default VNet, so one is created along with a NAT Gateway.\n VMs stay private and use NAT for egress.\n\nNot recommended for production. Use `Create` instead.","required":["type"],"properties":{"type":{"type":"string","enum":["use-default"]}}},{"type":"object","description":"Create a new isolated VPC/VNet with a managed NAT gateway.\n\nAll networking infrastructure is provisioned by Alien and cleaned up on delete.\nVMs use private IPs only; all outbound traffic routes through the NAT gateway.\n\nRecommended for production deployments.","required":["type"],"properties":{"availability_zones":{"type":"integer","format":"int32","description":"Number of availability zones (default: 2).","minimum":0},"cidr":{"type":["string","null"],"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}}},{"type":"object","description":"Use an existing VPC (AWS).\n\nAlien validates the references but creates no networking infrastructure.\nThe customer is responsible for routing and egress (NAT, proxy, VPN, etc.).","required":["vpc_id","public_subnet_ids","private_subnet_ids","type"],"properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}}},{"type":"object","description":"Use an existing VPC (GCP).\n\nAlien validates the references but creates no networking infrastructure.\nThe customer is responsible for routing and egress (Cloud NAT, proxy, VPN, etc.).","required":["network_name","subnet_name","region","type"],"properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}}},{"type":"object","description":"Use an existing VNet (Azure).\n\nAlien validates the references but creates no networking infrastructure.\nThe customer is responsible for routing and egress (NAT Gateway, proxy, VPN, etc.).","required":["vnet_resource_id","public_subnet_name","private_subnet_name","type"],"properties":{"application_gateway_subnet_name":{"type":["string","null"],"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":["string","null"],"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}}}],"x-readme-ref-name":"NetworkSettings"}]},"telemetry":{"description":"How telemetry (logs, metrics, traces) is handled.\n- off: No telemetry permissions\n- auto: Telemetry flows automatically (default)\n- approval-required: Telemetry waits for explicit approval","type":"string","enum":["off","auto","approval-required"],"x-readme-ref-name":"TelemetryMode"},"updates":{"description":"How updates are delivered.\n- auto: Updates deploy automatically (default)\n- approval-required: Updates wait for explicit approval","type":"string","enum":["auto","approval-required"],"x-readme-ref-name":"UpdatesMode"}},"x-readme-ref-name":"StackSettings"},"stackState":{"description":"Fully populated imported stack state.","type":"object","required":["platform","resources","resourcePrefix"],"properties":{"platform":{"description":"The target platform for this stack state.","type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"x-readme-ref-name":"Platform"},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","description":"The state of individual resources, keyed by resource ID.","additionalProperties":{"type":"object","description":"Represents the state of a single resource within the stack for a specific platform.","required":["type","status","config"],"properties":{"_internal":{"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"description":"The current resource configuration.","type":"object","required":["type","id"],"properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.","examples":["worker","storage","queue","redis","postgres"],"x-readme-ref-name":"ResourceType"}},"additionalProperties":true,"x-readme-ref-name":"BaseResource"},"controllerPlatform":{"oneOf":[{"type":"null"},{"description":"Platform whose controller owns this resource state. Defaults to the\ncontaining stack platform when absent.","type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"x-readme-ref-name":"Platform"}]},"dependencies":{"type":"array","items":{"type":"object","description":"Reference to a resource by its stable id and resource type.","required":["type","id"],"properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.","examples":["worker","storage","queue","redis","postgres"],"x-readme-ref-name":"ResourceType"}},"x-readme-ref-name":"ResourceRef"},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"null"},{"description":"Stores the last error encountered during a failed step transition.","type":"object","required":["code","message","retryable","internal"],"properties":{"code":{"type":"string","description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\"","example":"NOT_FOUND","maxLength":128},"context":{"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":["string","null"],"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":["integer","null"],"format":"int32","description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500.","maximum":599,"minimum":100},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it.","example":"Item not found.","maxLength":16384},"retryable":{"type":"boolean","description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes.","default":false},"source":{"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"x-readme-ref-name":"AlienError"}]},"lastFailedState":{"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"null"},{"description":"The lifecycle of the resource (Frozen or Live).\nDefaults to Live if not specified.","type":"string","enum":["frozen","live"],"x-readme-ref-name":"ResourceLifecycle"}]},"outputs":{"oneOf":[{"type":"null"},{"description":"Outputs generated by the resource (e.g., ARN, URL, Bucket Name).","type":"object","required":["type"],"properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.","examples":["worker","storage","queue","redis","postgres"],"x-readme-ref-name":"ResourceType"}},"additionalProperties":true,"x-readme-ref-name":"BaseResourceOutputs"}]},"previousConfig":{"oneOf":[{"type":"null"},{"description":"The previous resource configuration during updates.\nThis is set when an update is initiated and cleared when the update completes or fails.","type":"object","required":["type","id"],"properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.","examples":["worker","storage","queue","redis","postgres"],"x-readme-ref-name":"ResourceType"}},"additionalProperties":true,"x-readme-ref-name":"BaseResource"}]},"remoteBindingParams":{"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","format":"int32","description":"Tracks consecutive retry attempts for the current state transition.","minimum":0},"status":{"description":"High-level status derived from the internal state.","type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"x-readme-ref-name":"ResourceStatus"},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"x-readme-ref-name":"StackResourceState"},"propertyNames":{"type":"string"}}},"x-readme-ref-name":"StackState"}},"x-readme-ref-name":"StackImportResponse"} \ No newline at end of file +{"type":"object","description":"Response body returned after a stack import.","required":["deploymentId","stackSettings","stackState"],"properties":{"deploymentId":{"type":"string","description":"Deployment created."},"deploymentToken":{"type":["string","null"],"description":"Deployment bearer token for the imported deployment, when available."},"stackSettings":{"description":"Stack settings persisted for the deployment.","type":"object","properties":{"compute":{"oneOf":[{"type":"null"},{"description":"Deployment-time compute selections for Alien-managed compute pools.\n\nThis is where provider machine names such as EC2 instance types, GCE\nmachine types, or Azure VM SKUs belong. Application source should\ndeclare portable requirements instead.","type":"object","properties":{"pools":{"type":"object","description":"Selected compute choices keyed by pool ID.","additionalProperties":{"oneOf":[{"type":"object","description":"Fixed number of machines.","required":["machines","mode"],"properties":{"failure_domains":{"oneOf":[{"type":"null"},{"description":"Optional failure-domain policy. Absence preserves the existing aggregate layout.","type":"object","required":["spread"],"properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","format":"int32","description":"Number of distinct failure domains across which new stateful replicas may be spread.","minimum":0}},"x-readme-ref-name":"FailureDomainSelection"}]},"machine":{"type":["string","null"],"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","format":"int32","description":"Number of machines to run.","minimum":0},"mode":{"type":"string","enum":["fixed"]}}},{"type":"object","description":"Autoscaling machine pool.","required":["min","max","mode"],"properties":{"failure_domains":{"oneOf":[{"type":"null"},{"description":"Optional failure-domain policy. Absence preserves the existing aggregate layout.","type":"object","required":["spread"],"properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","format":"int32","description":"Number of distinct failure domains across which new stateful replicas may be spread.","minimum":0}},"x-readme-ref-name":"FailureDomainSelection"}]},"machine":{"type":["string","null"],"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","format":"int32","description":"Maximum machine count.","minimum":0},"min":{"type":"integer","format":"int32","description":"Minimum machine count.","minimum":0},"mode":{"type":"string","enum":["autoscale"]}}}],"description":"User-selected deployment settings for one compute pool.","x-readme-ref-name":"ComputePoolSelection"},"propertyNames":{"type":"string"}}},"x-readme-ref-name":"ComputeSettings"}]},"deploymentModel":{"description":"Deployment model: push (Manager) or pull (Agent).\nDefault: Push.\n- Push: Manager drives updates. For cloud platforms, requires cross-account\n credentials established during initial setup. For push-mode local\n deployments (currently `alien dev`), the manager has direct access —\n no bootstrap needed.\n- Pull: Agent in the target environment drives updates via polling.\n Required for Kubernetes and remote local deployments.","type":"string","enum":["push","pull"],"x-readme-ref-name":"DeploymentModel"},"domains":{"oneOf":[{"type":"null"},{"description":"Domain configuration (future).","type":"object","properties":{"customDomains":{"type":["object","null"],"description":"Custom domain configuration per resource ID.","additionalProperties":{"type":"object","description":"Custom domain configuration for a single resource.","required":["domain","certificate"],"properties":{"certificate":{"description":"Customer-provided certificate reference.","type":"object","properties":{"aws":{"oneOf":[{"type":"null"},{"description":"AWS ACM certificate ARN","type":"object","required":["certificateArn"],"properties":{"certificateArn":{"type":"string"}},"x-readme-ref-name":"AwsCustomCertificateConfig"}]},"azure":{"oneOf":[{"type":"null"},{"description":"Azure Key Vault certificate ID","type":"object","required":["keyVaultCertificateId"],"properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":["string","null"]}},"x-readme-ref-name":"AzureCustomCertificateConfig"}]},"gcp":{"oneOf":[{"type":"null"},{"description":"GCP Certificate Manager certificate name","type":"object","required":["certificateName"],"properties":{"certificateName":{"type":"string"}},"x-readme-ref-name":"GcpCustomCertificateConfig"}]},"kubernetes":{"oneOf":[{"type":"null"},{"description":"Kubernetes TLS Secret reference for Secret-backed route profiles.","type":"object","required":["tlsSecretRef"],"properties":{"tlsSecretRef":{"description":"Existing TLS Secret containing `tls.crt` and `tls.key`.","type":"object","required":["secretName"],"properties":{"namespace":{"type":["string","null"],"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"x-readme-ref-name":"KubernetesTlsSecretRef"}},"x-readme-ref-name":"KubernetesCustomCertificateConfig"}]}},"x-readme-ref-name":"CustomCertificateConfig"},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"x-readme-ref-name":"CustomDomainConfig"},"propertyNames":{"type":"string"}},"publicEndpointTarget":{"oneOf":[{"type":"null"},{"description":"Public endpoint DNS target selection for machines deployments.\n\nWhen omitted, machines deployments publish healthy machine public\naddresses directly. Use `LoadBalancer` when an external load balancer\nfronts the machines and Alien should publish a CNAME to that target.","oneOf":[{"type":"object","description":"Publish DNS records directly to healthy machine public IP addresses.","required":["mode"],"properties":{"mode":{"type":"string","enum":["machineAddresses"]}}},{"type":"object","description":"Publish a CNAME record to an external load balancer.","required":["cnameTarget","mode"],"properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}}}],"x-readme-ref-name":"PublicEndpointTargetSettings"}]}},"x-readme-ref-name":"DomainSettings"}]},"externalBindings":{"type":["object","null"],"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"description":"How heartbeat health checks are handled.\n- off: No heartbeat permissions\n- on: Heartbeat enabled (default)","type":"string","enum":["off","on"],"x-readme-ref-name":"HeartbeatsMode"},"kubernetes":{"oneOf":[{"type":"null"},{"description":"Kubernetes runtime substrate configuration.","type":"object","properties":{"cluster":{"oneOf":[{"type":"null"},{"description":"Cluster selection or creation settings.","type":"object","required":["ownership"],"properties":{"cloud":{"oneOf":[{"type":"null"},{"description":"Optional provider-specific cloud identity for existing clusters.","type":"object","properties":{"accountId":{"type":["string","null"]},"clusterId":{"type":["string","null"]},"clusterName":{"type":["string","null"]},"projectId":{"type":["string","null"]},"region":{"type":["string","null"]},"resourceGroup":{"type":["string","null"]},"subscriptionId":{"type":["string","null"]}},"additionalProperties":false,"x-readme-ref-name":"KubernetesCloudReference"}]},"namespace":{"type":["string","null"],"description":"Namespace where the Alien chart and application resources run."},"ownership":{"description":"Whether Alien should create the cluster, use a setup-owned existing\ncluster, or bind to an external/on-prem cluster.","type":"string","enum":["managed","existing","external"],"x-readme-ref-name":"KubernetesClusterOwnership"}},"x-readme-ref-name":"KubernetesClusterSettings"}]},"exposure":{"oneOf":[{"type":"null"},{"description":"Public HTTPS exposure contract shared by setup, Helm, and runtime.","oneOf":[{"type":"object","description":"Do not create Alien-managed external routing.","required":["mode"],"properties":{"mode":{"type":"string","enum":["disabled"]}}},{"type":"object","description":"Use Alien-generated DNS and Platform-managed certificate material.","required":["route","certificate","mode"],"properties":{"certificate":{"description":"How managed certificate material reaches the route profile.","oneOf":[{"type":"object","description":"Platform-managed cert imported into AWS ACM by the runtime.","required":["mode"],"properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":["string","null"],"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","description":"Tags applied to runtime-imported ACM certificates.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}}}},{"type":"object","description":"Customer-provided AWS ACM certificate ARN.","required":["certificateArn","mode"],"properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}}},{"type":"object","description":"Platform-managed cert written to a Kubernetes TLS Secret.","required":["secretNameTemplate","mode"],"properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}}},{"allOf":[{"description":"Customer-provided Kubernetes TLS Secret.","type":"object","required":["secretName"],"properties":{"namespace":{"type":["string","null"],"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"x-readme-ref-name":"KubernetesTlsSecretRef"},{"type":"object","required":["mode"],"properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}}}],"description":"Customer-provided Kubernetes TLS Secret."},{"type":"object","description":"No TLS certificate should be configured by Alien.","required":["mode"],"properties":{"mode":{"type":"string","enum":["none"]}}}],"x-readme-ref-name":"KubernetesCertificateMode"},"mode":{"type":"string","enum":["generated"]},"route":{"description":"Runtime route profile to materialize.","oneOf":[{"allOf":[{"description":"`networking.k8s.io/v1` Ingress route profile.","type":"object","required":["ingressClassName"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesIngressRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["ingress"]}}}],"description":"`networking.k8s.io/v1` Ingress route profile."},{"allOf":[{"description":"Gateway API `Gateway` + `HTTPRoute` route profile.","type":"object","required":["gatewayClassName","listenerPort"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"listenerPort":{"type":"integer","format":"int32","description":"Listener port, usually 443.","minimum":0},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesGatewayRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["gateway"]}}}],"description":"Gateway API `Gateway` + `HTTPRoute` route profile."}],"x-readme-ref-name":"KubernetesRouteProfile"}}},{"type":"object","description":"Use a customer hostname and customer-owned certificate reference.","required":["domain","route","certificate","mode"],"properties":{"certificate":{"description":"Customer-owned certificate reference consumed by the route profile.","oneOf":[{"type":"object","description":"Platform-managed cert imported into AWS ACM by the runtime.","required":["mode"],"properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":["string","null"],"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","description":"Tags applied to runtime-imported ACM certificates.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}}}},{"type":"object","description":"Customer-provided AWS ACM certificate ARN.","required":["certificateArn","mode"],"properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}}},{"type":"object","description":"Platform-managed cert written to a Kubernetes TLS Secret.","required":["secretNameTemplate","mode"],"properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}}},{"allOf":[{"description":"Customer-provided Kubernetes TLS Secret.","type":"object","required":["secretName"],"properties":{"namespace":{"type":["string","null"],"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"x-readme-ref-name":"KubernetesTlsSecretRef"},{"type":"object","required":["mode"],"properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}}}],"description":"Customer-provided Kubernetes TLS Secret."},{"type":"object","description":"No TLS certificate should be configured by Alien.","required":["mode"],"properties":{"mode":{"type":"string","enum":["none"]}}}],"x-readme-ref-name":"KubernetesCertificateMode"},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"description":"Runtime route profile to materialize.","oneOf":[{"allOf":[{"description":"`networking.k8s.io/v1` Ingress route profile.","type":"object","required":["ingressClassName"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesIngressRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["ingress"]}}}],"description":"`networking.k8s.io/v1` Ingress route profile."},{"allOf":[{"description":"Gateway API `Gateway` + `HTTPRoute` route profile.","type":"object","required":["gatewayClassName","listenerPort"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"listenerPort":{"type":"integer","format":"int32","description":"Listener port, usually 443.","minimum":0},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesGatewayRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["gateway"]}}}],"description":"Gateway API `Gateway` + `HTTPRoute` route profile."}],"x-readme-ref-name":"KubernetesRouteProfile"}}}],"x-readme-ref-name":"KubernetesExposureSettings"}]}},"x-readme-ref-name":"KubernetesSettings"}]},"network":{"oneOf":[{"type":"null"},{"description":"Network configuration for the stack (VPC/VNet settings).\nIf `None`, an isolated VPC with NAT is auto-created when the stack has resources\nthat require networking (e.g., containers). Set explicitly to customize:\n`UseDefault` for the provider's default network (fast, dev/test only),\n`Create` for an isolated VPC with managed NAT (production), or `ByoVpc*`\nto reference an existing customer-managed VPC.","oneOf":[{"type":"object","description":"Use the cloud provider's default VPC/network.\n\nDesigned for fast dev/test provisioning. No isolated VPC is created, so there\nis nothing to wait for or clean up. VMs receive ephemeral public IPs for internet\naccess — no NAT gateway is provisioned.\n\n- **AWS**: Discovers the account's default VPC. Subnets are public with auto-assigned IPs.\n- **GCP**: Discovers the project's `default` network and regional subnet. Instance\n templates include an `AccessConfig` to assign an ephemeral external IP.\n- **Azure**: Azure has no default VNet, so one is created along with a NAT Gateway.\n VMs stay private and use NAT for egress.\n\nNot recommended for production. Use `Create` instead.","required":["type"],"properties":{"type":{"type":"string","enum":["use-default"]}}},{"type":"object","description":"Create a new isolated VPC/VNet with a managed NAT gateway.\n\nAll networking infrastructure is provisioned by Alien and cleaned up on delete.\nVMs use private IPs only; all outbound traffic routes through the NAT gateway.\n\nRecommended for production deployments.","required":["type"],"properties":{"availability_zones":{"type":"integer","format":"int32","description":"Number of availability zones (default: 2).","minimum":0},"cidr":{"type":["string","null"],"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}}},{"type":"object","description":"Use an existing VPC (AWS).\n\nAlien validates the references but creates no networking infrastructure.\nThe customer is responsible for routing and egress (NAT, proxy, VPN, etc.).","required":["vpc_id","public_subnet_ids","private_subnet_ids","type"],"properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}}},{"type":"object","description":"Use an existing VPC (GCP).\n\nAlien validates the references but creates no networking infrastructure.\nThe customer is responsible for routing and egress (Cloud NAT, proxy, VPN, etc.).","required":["network_name","subnet_name","region","type"],"properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}}},{"type":"object","description":"Use an existing VNet (Azure).\n\nAlien validates the references but creates no networking infrastructure.\nThe customer is responsible for routing and egress (NAT Gateway, proxy, VPN, etc.).","required":["vnet_resource_id","public_subnet_name","private_subnet_name","type"],"properties":{"application_gateway_subnet_name":{"type":["string","null"],"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":["string","null"],"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}}}],"x-readme-ref-name":"NetworkSettings"}]},"publicEndpoints":{"type":["object","null"],"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates.","additionalProperties":{"type":"object","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"propertyNames":{"type":"string"}},"telemetry":{"description":"How telemetry (logs, metrics, traces) is handled.\n- off: No telemetry permissions\n- auto: Telemetry flows automatically (default)\n- approval-required: Telemetry waits for explicit approval","type":"string","enum":["off","auto","approval-required"],"x-readme-ref-name":"TelemetryMode"},"updates":{"description":"How updates are delivered.\n- auto: Updates deploy automatically (default)\n- approval-required: Updates wait for explicit approval","type":"string","enum":["auto","approval-required"],"x-readme-ref-name":"UpdatesMode"}},"x-readme-ref-name":"StackSettings"},"stackState":{"description":"Fully populated imported stack state.","type":"object","required":["platform","resources","resourcePrefix"],"properties":{"platform":{"description":"The target platform for this stack state.","type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"x-readme-ref-name":"Platform"},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","description":"The state of individual resources, keyed by resource ID.","additionalProperties":{"type":"object","description":"Represents the state of a single resource within the stack for a specific platform.","required":["type","status","config"],"properties":{"_internal":{"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"description":"The current resource configuration.","type":"object","required":["type","id"],"properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.","examples":["worker","storage","queue","redis","postgres"],"x-readme-ref-name":"ResourceType"}},"additionalProperties":true,"x-readme-ref-name":"BaseResource"},"controllerPlatform":{"oneOf":[{"type":"null"},{"description":"Platform whose controller owns this resource state. Defaults to the\ncontaining stack platform when absent.","type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"x-readme-ref-name":"Platform"}]},"dependencies":{"type":"array","items":{"type":"object","description":"Reference to a resource by its stable id and resource type.","required":["type","id"],"properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.","examples":["worker","storage","queue","redis","postgres"],"x-readme-ref-name":"ResourceType"}},"x-readme-ref-name":"ResourceRef"},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"null"},{"description":"Stores the last error encountered during a failed step transition.","type":"object","required":["code","message","retryable","internal"],"properties":{"code":{"type":"string","description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\"","example":"NOT_FOUND","maxLength":128},"context":{"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":["string","null"],"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":["integer","null"],"format":"int32","description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500.","maximum":599,"minimum":100},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it.","example":"Item not found.","maxLength":16384},"retryable":{"type":"boolean","description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes.","default":false},"source":{"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"x-readme-ref-name":"AlienError"}]},"lastFailedState":{"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"null"},{"description":"The lifecycle of the resource (Frozen or Live).\nDefaults to Live if not specified.","type":"string","enum":["frozen","live"],"x-readme-ref-name":"ResourceLifecycle"}]},"outputs":{"oneOf":[{"type":"null"},{"description":"Outputs generated by the resource (e.g., ARN, URL, Bucket Name).","type":"object","required":["type"],"properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.","examples":["worker","storage","queue","redis","postgres"],"x-readme-ref-name":"ResourceType"}},"additionalProperties":true,"x-readme-ref-name":"BaseResourceOutputs"}]},"previousConfig":{"oneOf":[{"type":"null"},{"description":"The previous resource configuration during updates.\nThis is set when an update is initiated and cleared when the update completes or fails.","type":"object","required":["type","id"],"properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.","examples":["worker","storage","queue","redis","postgres"],"x-readme-ref-name":"ResourceType"}},"additionalProperties":true,"x-readme-ref-name":"BaseResource"}]},"remoteBindingParams":{"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","format":"int32","description":"Tracks consecutive retry attempts for the current state transition.","minimum":0},"status":{"description":"High-level status derived from the internal state.","type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"x-readme-ref-name":"ResourceStatus"},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"x-readme-ref-name":"StackResourceState"},"propertyNames":{"type":"string"}}},"x-readme-ref-name":"StackState"}},"x-readme-ref-name":"StackImportResponse"} \ No newline at end of file diff --git a/packages/core/src/generated/schemas/stackSettings.json b/packages/core/src/generated/schemas/stackSettings.json index 494c892c7..b3dfd5772 100644 --- a/packages/core/src/generated/schemas/stackSettings.json +++ b/packages/core/src/generated/schemas/stackSettings.json @@ -1 +1 @@ -{"type":"object","description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount).","properties":{"compute":{"oneOf":[{"type":"null"},{"description":"Deployment-time compute selections for Alien-managed compute pools.\n\nThis is where provider machine names such as EC2 instance types, GCE\nmachine types, or Azure VM SKUs belong. Application source should\ndeclare portable requirements instead.","type":"object","properties":{"pools":{"type":"object","description":"Selected compute choices keyed by pool ID.","additionalProperties":{"oneOf":[{"type":"object","description":"Fixed number of machines.","required":["machines","mode"],"properties":{"failure_domains":{"oneOf":[{"type":"null"},{"description":"Optional failure-domain policy. Absence preserves the existing aggregate layout.","type":"object","required":["spread"],"properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","format":"int32","description":"Number of distinct failure domains across which new stateful replicas may be spread.","minimum":0}},"x-readme-ref-name":"FailureDomainSelection"}]},"machine":{"type":["string","null"],"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","format":"int32","description":"Number of machines to run.","minimum":0},"mode":{"type":"string","enum":["fixed"]}}},{"type":"object","description":"Autoscaling machine pool.","required":["min","max","mode"],"properties":{"failure_domains":{"oneOf":[{"type":"null"},{"description":"Optional failure-domain policy. Absence preserves the existing aggregate layout.","type":"object","required":["spread"],"properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","format":"int32","description":"Number of distinct failure domains across which new stateful replicas may be spread.","minimum":0}},"x-readme-ref-name":"FailureDomainSelection"}]},"machine":{"type":["string","null"],"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","format":"int32","description":"Maximum machine count.","minimum":0},"min":{"type":"integer","format":"int32","description":"Minimum machine count.","minimum":0},"mode":{"type":"string","enum":["autoscale"]}}}],"description":"User-selected deployment settings for one compute pool.","x-readme-ref-name":"ComputePoolSelection"},"propertyNames":{"type":"string"}}},"x-readme-ref-name":"ComputeSettings"}]},"deploymentModel":{"description":"Deployment model: push (Manager) or pull (Agent).\nDefault: Push.\n- Push: Manager drives updates. For cloud platforms, requires cross-account\n credentials established during initial setup. For push-mode local\n deployments (currently `alien dev`), the manager has direct access —\n no bootstrap needed.\n- Pull: Agent in the target environment drives updates via polling.\n Required for Kubernetes and remote local deployments.","type":"string","enum":["push","pull"],"x-readme-ref-name":"DeploymentModel"},"domains":{"oneOf":[{"type":"null"},{"description":"Domain configuration (future).","type":"object","properties":{"customDomains":{"type":["object","null"],"description":"Custom domain configuration per resource ID.","additionalProperties":{"type":"object","description":"Custom domain configuration for a single resource.","required":["domain","certificate"],"properties":{"certificate":{"description":"Customer-provided certificate reference.","type":"object","properties":{"aws":{"oneOf":[{"type":"null"},{"description":"AWS ACM certificate ARN","type":"object","required":["certificateArn"],"properties":{"certificateArn":{"type":"string"}},"x-readme-ref-name":"AwsCustomCertificateConfig"}]},"azure":{"oneOf":[{"type":"null"},{"description":"Azure Key Vault certificate ID","type":"object","required":["keyVaultCertificateId"],"properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":["string","null"]}},"x-readme-ref-name":"AzureCustomCertificateConfig"}]},"gcp":{"oneOf":[{"type":"null"},{"description":"GCP Certificate Manager certificate name","type":"object","required":["certificateName"],"properties":{"certificateName":{"type":"string"}},"x-readme-ref-name":"GcpCustomCertificateConfig"}]},"kubernetes":{"oneOf":[{"type":"null"},{"description":"Kubernetes TLS Secret reference for Secret-backed route profiles.","type":"object","required":["tlsSecretRef"],"properties":{"tlsSecretRef":{"description":"Existing TLS Secret containing `tls.crt` and `tls.key`.","type":"object","required":["secretName"],"properties":{"namespace":{"type":["string","null"],"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"x-readme-ref-name":"KubernetesTlsSecretRef"}},"x-readme-ref-name":"KubernetesCustomCertificateConfig"}]}},"x-readme-ref-name":"CustomCertificateConfig"},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"x-readme-ref-name":"CustomDomainConfig"},"propertyNames":{"type":"string"}},"publicEndpointTarget":{"oneOf":[{"type":"null"},{"description":"Public endpoint DNS target selection for machines deployments.\n\nWhen omitted, machines deployments publish healthy machine public\naddresses directly. Use `LoadBalancer` when an external load balancer\nfronts the machines and Alien should publish a CNAME to that target.","oneOf":[{"type":"object","description":"Publish DNS records directly to healthy machine public IP addresses.","required":["mode"],"properties":{"mode":{"type":"string","enum":["machineAddresses"]}}},{"type":"object","description":"Publish a CNAME record to an external load balancer.","required":["cnameTarget","mode"],"properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}}}],"x-readme-ref-name":"PublicEndpointTargetSettings"}]}},"x-readme-ref-name":"DomainSettings"}]},"externalBindings":{"type":["object","null"],"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"description":"How heartbeat health checks are handled.\n- off: No heartbeat permissions\n- on: Heartbeat enabled (default)","type":"string","enum":["off","on"],"x-readme-ref-name":"HeartbeatsMode"},"kubernetes":{"oneOf":[{"type":"null"},{"description":"Kubernetes runtime substrate configuration.","type":"object","properties":{"cluster":{"oneOf":[{"type":"null"},{"description":"Cluster selection or creation settings.","type":"object","required":["ownership"],"properties":{"cloud":{"oneOf":[{"type":"null"},{"description":"Optional provider-specific cloud identity for existing clusters.","type":"object","properties":{"accountId":{"type":["string","null"]},"clusterId":{"type":["string","null"]},"clusterName":{"type":["string","null"]},"projectId":{"type":["string","null"]},"region":{"type":["string","null"]},"resourceGroup":{"type":["string","null"]},"subscriptionId":{"type":["string","null"]}},"additionalProperties":false,"x-readme-ref-name":"KubernetesCloudReference"}]},"namespace":{"type":["string","null"],"description":"Namespace where the Alien chart and application resources run."},"ownership":{"description":"Whether Alien should create the cluster, use a setup-owned existing\ncluster, or bind to an external/on-prem cluster.","type":"string","enum":["managed","existing","external"],"x-readme-ref-name":"KubernetesClusterOwnership"}},"x-readme-ref-name":"KubernetesClusterSettings"}]},"exposure":{"oneOf":[{"type":"null"},{"description":"Public HTTPS exposure contract shared by setup, Helm, and runtime.","oneOf":[{"type":"object","description":"Do not create Alien-managed external routing.","required":["mode"],"properties":{"mode":{"type":"string","enum":["disabled"]}}},{"type":"object","description":"Use Alien-generated DNS and Platform-managed certificate material.","required":["route","certificate","mode"],"properties":{"certificate":{"description":"How managed certificate material reaches the route profile.","oneOf":[{"type":"object","description":"Platform-managed cert imported into AWS ACM by the runtime.","required":["mode"],"properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":["string","null"],"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","description":"Tags applied to runtime-imported ACM certificates.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}}}},{"type":"object","description":"Customer-provided AWS ACM certificate ARN.","required":["certificateArn","mode"],"properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}}},{"type":"object","description":"Platform-managed cert written to a Kubernetes TLS Secret.","required":["secretNameTemplate","mode"],"properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}}},{"allOf":[{"description":"Customer-provided Kubernetes TLS Secret.","type":"object","required":["secretName"],"properties":{"namespace":{"type":["string","null"],"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"x-readme-ref-name":"KubernetesTlsSecretRef"},{"type":"object","required":["mode"],"properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}}}],"description":"Customer-provided Kubernetes TLS Secret."},{"type":"object","description":"No TLS certificate should be configured by Alien.","required":["mode"],"properties":{"mode":{"type":"string","enum":["none"]}}}],"x-readme-ref-name":"KubernetesCertificateMode"},"mode":{"type":"string","enum":["generated"]},"route":{"description":"Runtime route profile to materialize.","oneOf":[{"allOf":[{"description":"`networking.k8s.io/v1` Ingress route profile.","type":"object","required":["ingressClassName"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesIngressRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["ingress"]}}}],"description":"`networking.k8s.io/v1` Ingress route profile."},{"allOf":[{"description":"Gateway API `Gateway` + `HTTPRoute` route profile.","type":"object","required":["gatewayClassName","listenerPort"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"listenerPort":{"type":"integer","format":"int32","description":"Listener port, usually 443.","minimum":0},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesGatewayRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["gateway"]}}}],"description":"Gateway API `Gateway` + `HTTPRoute` route profile."}],"x-readme-ref-name":"KubernetesRouteProfile"}}},{"type":"object","description":"Use a customer hostname and customer-owned certificate reference.","required":["domain","route","certificate","mode"],"properties":{"certificate":{"description":"Customer-owned certificate reference consumed by the route profile.","oneOf":[{"type":"object","description":"Platform-managed cert imported into AWS ACM by the runtime.","required":["mode"],"properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":["string","null"],"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","description":"Tags applied to runtime-imported ACM certificates.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}}}},{"type":"object","description":"Customer-provided AWS ACM certificate ARN.","required":["certificateArn","mode"],"properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}}},{"type":"object","description":"Platform-managed cert written to a Kubernetes TLS Secret.","required":["secretNameTemplate","mode"],"properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}}},{"allOf":[{"description":"Customer-provided Kubernetes TLS Secret.","type":"object","required":["secretName"],"properties":{"namespace":{"type":["string","null"],"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"x-readme-ref-name":"KubernetesTlsSecretRef"},{"type":"object","required":["mode"],"properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}}}],"description":"Customer-provided Kubernetes TLS Secret."},{"type":"object","description":"No TLS certificate should be configured by Alien.","required":["mode"],"properties":{"mode":{"type":"string","enum":["none"]}}}],"x-readme-ref-name":"KubernetesCertificateMode"},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"description":"Runtime route profile to materialize.","oneOf":[{"allOf":[{"description":"`networking.k8s.io/v1` Ingress route profile.","type":"object","required":["ingressClassName"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesIngressRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["ingress"]}}}],"description":"`networking.k8s.io/v1` Ingress route profile."},{"allOf":[{"description":"Gateway API `Gateway` + `HTTPRoute` route profile.","type":"object","required":["gatewayClassName","listenerPort"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"listenerPort":{"type":"integer","format":"int32","description":"Listener port, usually 443.","minimum":0},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesGatewayRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["gateway"]}}}],"description":"Gateway API `Gateway` + `HTTPRoute` route profile."}],"x-readme-ref-name":"KubernetesRouteProfile"}}}],"x-readme-ref-name":"KubernetesExposureSettings"}]}},"x-readme-ref-name":"KubernetesSettings"}]},"network":{"oneOf":[{"type":"null"},{"description":"Network configuration for the stack (VPC/VNet settings).\nIf `None`, an isolated VPC with NAT is auto-created when the stack has resources\nthat require networking (e.g., containers). Set explicitly to customize:\n`UseDefault` for the provider's default network (fast, dev/test only),\n`Create` for an isolated VPC with managed NAT (production), or `ByoVpc*`\nto reference an existing customer-managed VPC.","oneOf":[{"type":"object","description":"Use the cloud provider's default VPC/network.\n\nDesigned for fast dev/test provisioning. No isolated VPC is created, so there\nis nothing to wait for or clean up. VMs receive ephemeral public IPs for internet\naccess — no NAT gateway is provisioned.\n\n- **AWS**: Discovers the account's default VPC. Subnets are public with auto-assigned IPs.\n- **GCP**: Discovers the project's `default` network and regional subnet. Instance\n templates include an `AccessConfig` to assign an ephemeral external IP.\n- **Azure**: Azure has no default VNet, so one is created along with a NAT Gateway.\n VMs stay private and use NAT for egress.\n\nNot recommended for production. Use `Create` instead.","required":["type"],"properties":{"type":{"type":"string","enum":["use-default"]}}},{"type":"object","description":"Create a new isolated VPC/VNet with a managed NAT gateway.\n\nAll networking infrastructure is provisioned by Alien and cleaned up on delete.\nVMs use private IPs only; all outbound traffic routes through the NAT gateway.\n\nRecommended for production deployments.","required":["type"],"properties":{"availability_zones":{"type":"integer","format":"int32","description":"Number of availability zones (default: 2).","minimum":0},"cidr":{"type":["string","null"],"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}}},{"type":"object","description":"Use an existing VPC (AWS).\n\nAlien validates the references but creates no networking infrastructure.\nThe customer is responsible for routing and egress (NAT, proxy, VPN, etc.).","required":["vpc_id","public_subnet_ids","private_subnet_ids","type"],"properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}}},{"type":"object","description":"Use an existing VPC (GCP).\n\nAlien validates the references but creates no networking infrastructure.\nThe customer is responsible for routing and egress (Cloud NAT, proxy, VPN, etc.).","required":["network_name","subnet_name","region","type"],"properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}}},{"type":"object","description":"Use an existing VNet (Azure).\n\nAlien validates the references but creates no networking infrastructure.\nThe customer is responsible for routing and egress (NAT Gateway, proxy, VPN, etc.).","required":["vnet_resource_id","public_subnet_name","private_subnet_name","type"],"properties":{"application_gateway_subnet_name":{"type":["string","null"],"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":["string","null"],"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}}}],"x-readme-ref-name":"NetworkSettings"}]},"telemetry":{"description":"How telemetry (logs, metrics, traces) is handled.\n- off: No telemetry permissions\n- auto: Telemetry flows automatically (default)\n- approval-required: Telemetry waits for explicit approval","type":"string","enum":["off","auto","approval-required"],"x-readme-ref-name":"TelemetryMode"},"updates":{"description":"How updates are delivered.\n- auto: Updates deploy automatically (default)\n- approval-required: Updates wait for explicit approval","type":"string","enum":["auto","approval-required"],"x-readme-ref-name":"UpdatesMode"}},"x-readme-ref-name":"StackSettings"} \ No newline at end of file +{"type":"object","description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount).","properties":{"compute":{"oneOf":[{"type":"null"},{"description":"Deployment-time compute selections for Alien-managed compute pools.\n\nThis is where provider machine names such as EC2 instance types, GCE\nmachine types, or Azure VM SKUs belong. Application source should\ndeclare portable requirements instead.","type":"object","properties":{"pools":{"type":"object","description":"Selected compute choices keyed by pool ID.","additionalProperties":{"oneOf":[{"type":"object","description":"Fixed number of machines.","required":["machines","mode"],"properties":{"failure_domains":{"oneOf":[{"type":"null"},{"description":"Optional failure-domain policy. Absence preserves the existing aggregate layout.","type":"object","required":["spread"],"properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","format":"int32","description":"Number of distinct failure domains across which new stateful replicas may be spread.","minimum":0}},"x-readme-ref-name":"FailureDomainSelection"}]},"machine":{"type":["string","null"],"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","format":"int32","description":"Number of machines to run.","minimum":0},"mode":{"type":"string","enum":["fixed"]}}},{"type":"object","description":"Autoscaling machine pool.","required":["min","max","mode"],"properties":{"failure_domains":{"oneOf":[{"type":"null"},{"description":"Optional failure-domain policy. Absence preserves the existing aggregate layout.","type":"object","required":["spread"],"properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","format":"int32","description":"Number of distinct failure domains across which new stateful replicas may be spread.","minimum":0}},"x-readme-ref-name":"FailureDomainSelection"}]},"machine":{"type":["string","null"],"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","format":"int32","description":"Maximum machine count.","minimum":0},"min":{"type":"integer","format":"int32","description":"Minimum machine count.","minimum":0},"mode":{"type":"string","enum":["autoscale"]}}}],"description":"User-selected deployment settings for one compute pool.","x-readme-ref-name":"ComputePoolSelection"},"propertyNames":{"type":"string"}}},"x-readme-ref-name":"ComputeSettings"}]},"deploymentModel":{"description":"Deployment model: push (Manager) or pull (Agent).\nDefault: Push.\n- Push: Manager drives updates. For cloud platforms, requires cross-account\n credentials established during initial setup. For push-mode local\n deployments (currently `alien dev`), the manager has direct access —\n no bootstrap needed.\n- Pull: Agent in the target environment drives updates via polling.\n Required for Kubernetes and remote local deployments.","type":"string","enum":["push","pull"],"x-readme-ref-name":"DeploymentModel"},"domains":{"oneOf":[{"type":"null"},{"description":"Domain configuration (future).","type":"object","properties":{"customDomains":{"type":["object","null"],"description":"Custom domain configuration per resource ID.","additionalProperties":{"type":"object","description":"Custom domain configuration for a single resource.","required":["domain","certificate"],"properties":{"certificate":{"description":"Customer-provided certificate reference.","type":"object","properties":{"aws":{"oneOf":[{"type":"null"},{"description":"AWS ACM certificate ARN","type":"object","required":["certificateArn"],"properties":{"certificateArn":{"type":"string"}},"x-readme-ref-name":"AwsCustomCertificateConfig"}]},"azure":{"oneOf":[{"type":"null"},{"description":"Azure Key Vault certificate ID","type":"object","required":["keyVaultCertificateId"],"properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":["string","null"]}},"x-readme-ref-name":"AzureCustomCertificateConfig"}]},"gcp":{"oneOf":[{"type":"null"},{"description":"GCP Certificate Manager certificate name","type":"object","required":["certificateName"],"properties":{"certificateName":{"type":"string"}},"x-readme-ref-name":"GcpCustomCertificateConfig"}]},"kubernetes":{"oneOf":[{"type":"null"},{"description":"Kubernetes TLS Secret reference for Secret-backed route profiles.","type":"object","required":["tlsSecretRef"],"properties":{"tlsSecretRef":{"description":"Existing TLS Secret containing `tls.crt` and `tls.key`.","type":"object","required":["secretName"],"properties":{"namespace":{"type":["string","null"],"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"x-readme-ref-name":"KubernetesTlsSecretRef"}},"x-readme-ref-name":"KubernetesCustomCertificateConfig"}]}},"x-readme-ref-name":"CustomCertificateConfig"},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"x-readme-ref-name":"CustomDomainConfig"},"propertyNames":{"type":"string"}},"publicEndpointTarget":{"oneOf":[{"type":"null"},{"description":"Public endpoint DNS target selection for machines deployments.\n\nWhen omitted, machines deployments publish healthy machine public\naddresses directly. Use `LoadBalancer` when an external load balancer\nfronts the machines and Alien should publish a CNAME to that target.","oneOf":[{"type":"object","description":"Publish DNS records directly to healthy machine public IP addresses.","required":["mode"],"properties":{"mode":{"type":"string","enum":["machineAddresses"]}}},{"type":"object","description":"Publish a CNAME record to an external load balancer.","required":["cnameTarget","mode"],"properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}}}],"x-readme-ref-name":"PublicEndpointTargetSettings"}]}},"x-readme-ref-name":"DomainSettings"}]},"externalBindings":{"type":["object","null"],"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"description":"How heartbeat health checks are handled.\n- off: No heartbeat permissions\n- on: Heartbeat enabled (default)","type":"string","enum":["off","on"],"x-readme-ref-name":"HeartbeatsMode"},"kubernetes":{"oneOf":[{"type":"null"},{"description":"Kubernetes runtime substrate configuration.","type":"object","properties":{"cluster":{"oneOf":[{"type":"null"},{"description":"Cluster selection or creation settings.","type":"object","required":["ownership"],"properties":{"cloud":{"oneOf":[{"type":"null"},{"description":"Optional provider-specific cloud identity for existing clusters.","type":"object","properties":{"accountId":{"type":["string","null"]},"clusterId":{"type":["string","null"]},"clusterName":{"type":["string","null"]},"projectId":{"type":["string","null"]},"region":{"type":["string","null"]},"resourceGroup":{"type":["string","null"]},"subscriptionId":{"type":["string","null"]}},"additionalProperties":false,"x-readme-ref-name":"KubernetesCloudReference"}]},"namespace":{"type":["string","null"],"description":"Namespace where the Alien chart and application resources run."},"ownership":{"description":"Whether Alien should create the cluster, use a setup-owned existing\ncluster, or bind to an external/on-prem cluster.","type":"string","enum":["managed","existing","external"],"x-readme-ref-name":"KubernetesClusterOwnership"}},"x-readme-ref-name":"KubernetesClusterSettings"}]},"exposure":{"oneOf":[{"type":"null"},{"description":"Public HTTPS exposure contract shared by setup, Helm, and runtime.","oneOf":[{"type":"object","description":"Do not create Alien-managed external routing.","required":["mode"],"properties":{"mode":{"type":"string","enum":["disabled"]}}},{"type":"object","description":"Use Alien-generated DNS and Platform-managed certificate material.","required":["route","certificate","mode"],"properties":{"certificate":{"description":"How managed certificate material reaches the route profile.","oneOf":[{"type":"object","description":"Platform-managed cert imported into AWS ACM by the runtime.","required":["mode"],"properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":["string","null"],"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","description":"Tags applied to runtime-imported ACM certificates.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}}}},{"type":"object","description":"Customer-provided AWS ACM certificate ARN.","required":["certificateArn","mode"],"properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}}},{"type":"object","description":"Platform-managed cert written to a Kubernetes TLS Secret.","required":["secretNameTemplate","mode"],"properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}}},{"allOf":[{"description":"Customer-provided Kubernetes TLS Secret.","type":"object","required":["secretName"],"properties":{"namespace":{"type":["string","null"],"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"x-readme-ref-name":"KubernetesTlsSecretRef"},{"type":"object","required":["mode"],"properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}}}],"description":"Customer-provided Kubernetes TLS Secret."},{"type":"object","description":"No TLS certificate should be configured by Alien.","required":["mode"],"properties":{"mode":{"type":"string","enum":["none"]}}}],"x-readme-ref-name":"KubernetesCertificateMode"},"mode":{"type":"string","enum":["generated"]},"route":{"description":"Runtime route profile to materialize.","oneOf":[{"allOf":[{"description":"`networking.k8s.io/v1` Ingress route profile.","type":"object","required":["ingressClassName"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesIngressRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["ingress"]}}}],"description":"`networking.k8s.io/v1` Ingress route profile."},{"allOf":[{"description":"Gateway API `Gateway` + `HTTPRoute` route profile.","type":"object","required":["gatewayClassName","listenerPort"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"listenerPort":{"type":"integer","format":"int32","description":"Listener port, usually 443.","minimum":0},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesGatewayRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["gateway"]}}}],"description":"Gateway API `Gateway` + `HTTPRoute` route profile."}],"x-readme-ref-name":"KubernetesRouteProfile"}}},{"type":"object","description":"Use a customer hostname and customer-owned certificate reference.","required":["domain","route","certificate","mode"],"properties":{"certificate":{"description":"Customer-owned certificate reference consumed by the route profile.","oneOf":[{"type":"object","description":"Platform-managed cert imported into AWS ACM by the runtime.","required":["mode"],"properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":["string","null"],"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","description":"Tags applied to runtime-imported ACM certificates.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}}}},{"type":"object","description":"Customer-provided AWS ACM certificate ARN.","required":["certificateArn","mode"],"properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}}},{"type":"object","description":"Platform-managed cert written to a Kubernetes TLS Secret.","required":["secretNameTemplate","mode"],"properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}}},{"allOf":[{"description":"Customer-provided Kubernetes TLS Secret.","type":"object","required":["secretName"],"properties":{"namespace":{"type":["string","null"],"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"x-readme-ref-name":"KubernetesTlsSecretRef"},{"type":"object","required":["mode"],"properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}}}],"description":"Customer-provided Kubernetes TLS Secret."},{"type":"object","description":"No TLS certificate should be configured by Alien.","required":["mode"],"properties":{"mode":{"type":"string","enum":["none"]}}}],"x-readme-ref-name":"KubernetesCertificateMode"},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"description":"Runtime route profile to materialize.","oneOf":[{"allOf":[{"description":"`networking.k8s.io/v1` Ingress route profile.","type":"object","required":["ingressClassName"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesIngressRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["ingress"]}}}],"description":"`networking.k8s.io/v1` Ingress route profile."},{"allOf":[{"description":"Gateway API `Gateway` + `HTTPRoute` route profile.","type":"object","required":["gatewayClassName","listenerPort"],"properties":{"annotations":{"type":"object","description":"Annotations applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"controller":{"type":["string","null"],"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","description":"Labels applied to route objects.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"listenerPort":{"type":"integer","format":"int32","description":"Listener port, usually 443.","minimum":0},"provider":{"oneOf":[{"type":"null"},{"description":"Provider-specific route options that are required by the selected class.","oneOf":[{"type":"object","description":"AWS ALB route options for EKS.","required":["scheme","targetType","provider"],"properties":{"ipAddressType":{"type":["string","null"],"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}}},{"type":"object","description":"GKE Gateway route options.","required":["provider"],"properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":["string","null"],"description":"Optional static address name for the Gateway frontend."}}},{"type":"object","description":"Azure Application Gateway for Containers route options.","required":["frontend","provider"],"properties":{"albName":{"type":["string","null"],"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":["string","null"],"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}}}],"x-readme-ref-name":"KubernetesRouteProviderOptions"}]}},"x-readme-ref-name":"KubernetesGatewayRouteProfile"},{"type":"object","required":["routeApi"],"properties":{"routeApi":{"type":"string","enum":["gateway"]}}}],"description":"Gateway API `Gateway` + `HTTPRoute` route profile."}],"x-readme-ref-name":"KubernetesRouteProfile"}}}],"x-readme-ref-name":"KubernetesExposureSettings"}]}},"x-readme-ref-name":"KubernetesSettings"}]},"network":{"oneOf":[{"type":"null"},{"description":"Network configuration for the stack (VPC/VNet settings).\nIf `None`, an isolated VPC with NAT is auto-created when the stack has resources\nthat require networking (e.g., containers). Set explicitly to customize:\n`UseDefault` for the provider's default network (fast, dev/test only),\n`Create` for an isolated VPC with managed NAT (production), or `ByoVpc*`\nto reference an existing customer-managed VPC.","oneOf":[{"type":"object","description":"Use the cloud provider's default VPC/network.\n\nDesigned for fast dev/test provisioning. No isolated VPC is created, so there\nis nothing to wait for or clean up. VMs receive ephemeral public IPs for internet\naccess — no NAT gateway is provisioned.\n\n- **AWS**: Discovers the account's default VPC. Subnets are public with auto-assigned IPs.\n- **GCP**: Discovers the project's `default` network and regional subnet. Instance\n templates include an `AccessConfig` to assign an ephemeral external IP.\n- **Azure**: Azure has no default VNet, so one is created along with a NAT Gateway.\n VMs stay private and use NAT for egress.\n\nNot recommended for production. Use `Create` instead.","required":["type"],"properties":{"type":{"type":"string","enum":["use-default"]}}},{"type":"object","description":"Create a new isolated VPC/VNet with a managed NAT gateway.\n\nAll networking infrastructure is provisioned by Alien and cleaned up on delete.\nVMs use private IPs only; all outbound traffic routes through the NAT gateway.\n\nRecommended for production deployments.","required":["type"],"properties":{"availability_zones":{"type":"integer","format":"int32","description":"Number of availability zones (default: 2).","minimum":0},"cidr":{"type":["string","null"],"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}}},{"type":"object","description":"Use an existing VPC (AWS).\n\nAlien validates the references but creates no networking infrastructure.\nThe customer is responsible for routing and egress (NAT, proxy, VPN, etc.).","required":["vpc_id","public_subnet_ids","private_subnet_ids","type"],"properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}}},{"type":"object","description":"Use an existing VPC (GCP).\n\nAlien validates the references but creates no networking infrastructure.\nThe customer is responsible for routing and egress (Cloud NAT, proxy, VPN, etc.).","required":["network_name","subnet_name","region","type"],"properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}}},{"type":"object","description":"Use an existing VNet (Azure).\n\nAlien validates the references but creates no networking infrastructure.\nThe customer is responsible for routing and egress (NAT Gateway, proxy, VPN, etc.).","required":["vnet_resource_id","public_subnet_name","private_subnet_name","type"],"properties":{"application_gateway_subnet_name":{"type":["string","null"],"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":["string","null"],"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}}}],"x-readme-ref-name":"NetworkSettings"}]},"publicEndpoints":{"type":["object","null"],"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates.","additionalProperties":{"type":"object","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"propertyNames":{"type":"string"}},"telemetry":{"description":"How telemetry (logs, metrics, traces) is handled.\n- off: No telemetry permissions\n- auto: Telemetry flows automatically (default)\n- approval-required: Telemetry waits for explicit approval","type":"string","enum":["off","auto","approval-required"],"x-readme-ref-name":"TelemetryMode"},"updates":{"description":"How updates are delivered.\n- auto: Updates deploy automatically (default)\n- approval-required: Updates wait for explicit approval","type":"string","enum":["auto","approval-required"],"x-readme-ref-name":"UpdatesMode"}},"x-readme-ref-name":"StackSettings"} \ No newline at end of file diff --git a/packages/core/src/generated/zod/stack-settings-schema.ts b/packages/core/src/generated/zod/stack-settings-schema.ts index c49b912f9..0d1cf0204 100644 --- a/packages/core/src/generated/zod/stack-settings-schema.ts +++ b/packages/core/src/generated/zod/stack-settings-schema.ts @@ -27,7 +27,7 @@ get "domains"(){ return z.union([DomainSettingsSchema, z.null()]).optional() }, "externalBindings": z.object({ - + }).describe("External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms.").nullish(), get "heartbeats"(){ return HeartbeatsModeSchema.describe("How heartbeat health checks are handled.").optional() @@ -38,6 +38,11 @@ get "kubernetes"(){ get "network"(){ return z.union([NetworkSettingsSchema, z.null()]).optional() }, +"publicEndpoints": z.object({ + + }).catchall(z.object({ + + }).catchall(z.string())).describe("Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates.").nullish(), get "telemetry"(){ return TelemetryModeSchema.describe("How telemetry (logs, metrics, traces) is handled.").optional() }, diff --git a/packages/sdk/src/worker-runtime/generated/control.ts b/packages/sdk/src/worker-runtime/generated/control.ts index 31cb887d6..f61f9ce0e 100644 --- a/packages/sdk/src/worker-runtime/generated/control.ts +++ b/packages/sdk/src/worker-runtime/generated/control.ts @@ -1,6 +1,6 @@ // Code generated by protoc-gen-ts_proto. DO NOT EDIT. // versions: -// protoc-gen-ts_proto v2.12.0 +// protoc-gen-ts_proto v2.12.1 // protoc v7.35.1 // source: control.proto @@ -167,26 +167,35 @@ export const RegisterHttpServerRequest: MessageFns = decode(input: BinaryReader | Uint8Array, length?: number): RegisterHttpServerRequest { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseRegisterHttpServerRequest(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 8) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseRegisterHttpServerRequest(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 8) { + break; + } + + message.port = reader.uint32(); + continue; } - - message.port = reader.uint32(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): RegisterHttpServerRequest { @@ -225,26 +234,35 @@ export const RegisterHttpServerResponse: MessageFns decode(input: BinaryReader | Uint8Array, length?: number): RegisterHttpServerResponse { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseRegisterHttpServerResponse(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 8) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseRegisterHttpServerResponse(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 8) { + break; + } + + message.success = reader.bool(); + continue; } - - message.success = reader.bool(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): RegisterHttpServerResponse { @@ -286,34 +304,43 @@ export const RegisterEventHandlerRequest: MessageFns>> 3) { - case 1: { - if (tag !== 10) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseRegisterEventHandlerRequest(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 10) { + break; + } + + message.handlerType = reader.string(); + continue; } + case 2: { + if (tag !== 18) { + break; + } - message.handlerType = reader.string(); - continue; - } - case 2: { - if (tag !== 18) { - break; + message.resourceName = reader.string(); + continue; } - - message.resourceName = reader.string(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): RegisterEventHandlerRequest { @@ -367,26 +394,35 @@ export const RegisterEventHandlerResponse: MessageFns>> 3) { - case 1: { - if (tag !== 8) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseRegisterEventHandlerResponse(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 8) { + break; + } + + message.success = reader.bool(); + continue; } - - message.success = reader.bool(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): RegisterEventHandlerResponse { @@ -425,26 +461,35 @@ export const WaitForTasksRequest: MessageFns = { decode(input: BinaryReader | Uint8Array, length?: number): WaitForTasksRequest { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseWaitForTasksRequest(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 10) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseWaitForTasksRequest(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 10) { + break; + } + + message.applicationId = reader.string(); + continue; } - - message.applicationId = reader.string(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): WaitForTasksRequest { @@ -501,58 +546,67 @@ export const Task: MessageFns = { decode(input: BinaryReader | Uint8Array, length?: number): Task { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseTask(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 10) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseTask(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 10) { + break; + } + + message.taskId = reader.string(); + continue; } + case 2: { + if (tag !== 18) { + break; + } - message.taskId = reader.string(); - continue; - } - case 2: { - if (tag !== 18) { - break; + message.storageEvent = StorageEvent.decode(reader, reader.uint32()); + continue; } + case 3: { + if (tag !== 26) { + break; + } - message.storageEvent = StorageEvent.decode(reader, reader.uint32()); - continue; - } - case 3: { - if (tag !== 26) { - break; + message.cronEvent = CronEvent.decode(reader, reader.uint32()); + continue; } + case 4: { + if (tag !== 34) { + break; + } - message.cronEvent = CronEvent.decode(reader, reader.uint32()); - continue; - } - case 4: { - if (tag !== 34) { - break; + message.queueMessage = QueueMessage.decode(reader, reader.uint32()); + continue; } + case 5: { + if (tag !== 42) { + break; + } - message.queueMessage = QueueMessage.decode(reader, reader.uint32()); - continue; - } - case 5: { - if (tag !== 42) { - break; + message.arcCommand = ArcCommand.decode(reader, reader.uint32()); + continue; } - - message.arcCommand = ArcCommand.decode(reader, reader.uint32()); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): Task { @@ -683,109 +737,118 @@ export const StorageEvent: MessageFns = { decode(input: BinaryReader | Uint8Array, length?: number): StorageEvent { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseStorageEvent(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 10) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseStorageEvent(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 10) { + break; + } + + message.key = reader.string(); + continue; } + case 2: { + if (tag !== 18) { + break; + } - message.key = reader.string(); - continue; - } - case 2: { - if (tag !== 18) { - break; + message.eventType = reader.string(); + continue; } + case 3: { + if (tag !== 26) { + break; + } - message.eventType = reader.string(); - continue; - } - case 3: { - if (tag !== 26) { - break; + message.bucket = reader.string(); + continue; } + case 4: { + if (tag !== 32) { + break; + } - message.bucket = reader.string(); - continue; - } - case 4: { - if (tag !== 32) { - break; + message.size = longToNumber(reader.uint64()); + continue; } + case 5: { + if (tag !== 42) { + break; + } - message.size = longToNumber(reader.uint64()); - continue; - } - case 5: { - if (tag !== 42) { - break; + message.contentType = reader.string(); + continue; } + case 6: { + if (tag !== 50) { + break; + } - message.contentType = reader.string(); - continue; - } - case 6: { - if (tag !== 50) { - break; + message.timestamp = fromTimestamp(Timestamp.decode(reader, reader.uint32())); + continue; } + case 7: { + if (tag !== 58) { + break; + } - message.timestamp = fromTimestamp(Timestamp.decode(reader, reader.uint32())); - continue; - } - case 7: { - if (tag !== 58) { - break; + message.etag = reader.string(); + continue; } + case 8: { + if (tag !== 66) { + break; + } - message.etag = reader.string(); - continue; - } - case 8: { - if (tag !== 66) { - break; + message.region = reader.string(); + continue; } + case 9: { + if (tag !== 74) { + break; + } - message.region = reader.string(); - continue; - } - case 9: { - if (tag !== 74) { - break; + message.versionId = reader.string(); + continue; } + case 10: { + if (tag !== 82) { + break; + } - message.versionId = reader.string(); - continue; - } - case 10: { - if (tag !== 82) { - break; + message.currentTier = reader.string(); + continue; } - - message.currentTier = reader.string(); - continue; - } - case 11: { - if (tag !== 90) { - break; - } - - const entry11 = StorageEvent_MetadataEntry.decode(reader, reader.uint32()); - if (entry11.value !== undefined) { - message.metadata[entry11.key] = entry11.value; + case 11: { + if (tag !== 90) { + break; + } + + const entry11 = StorageEvent_MetadataEntry.decode(reader, reader.uint32()); + if (entry11.value !== undefined) { + message.metadata[entry11.key] = entry11.value; + } + continue; } - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): StorageEvent { @@ -819,7 +882,12 @@ export const StorageEvent: MessageFns = { metadata: isObject(object.metadata) ? (globalThis.Object.entries(object.metadata) as [string, any][]).reduce( (acc: { [key: string]: string }, [key, value]: [string, any]) => { - acc[key] = globalThis.String(value); + globalThis.Object.defineProperty(acc, key, { + value: globalThis.String(value), + enumerable: true, + configurable: true, + writable: true, + }); return acc; }, {}, @@ -917,34 +985,43 @@ export const StorageEvent_MetadataEntry: MessageFns decode(input: BinaryReader | Uint8Array, length?: number): StorageEvent_MetadataEntry { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseStorageEvent_MetadataEntry(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 10) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseStorageEvent_MetadataEntry(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 10) { + break; + } + + message.key = reader.string(); + continue; } + case 2: { + if (tag !== 18) { + break; + } - message.key = reader.string(); - continue; - } - case 2: { - if (tag !== 18) { - break; + message.value = reader.string(); + continue; } - - message.value = reader.string(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): StorageEvent_MetadataEntry { @@ -993,34 +1070,43 @@ export const CronEvent: MessageFns = { decode(input: BinaryReader | Uint8Array, length?: number): CronEvent { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseCronEvent(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 10) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseCronEvent(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 10) { + break; + } + + message.scheduleName = reader.string(); + continue; } + case 2: { + if (tag !== 18) { + break; + } - message.scheduleName = reader.string(); - continue; - } - case 2: { - if (tag !== 18) { - break; + message.scheduledTime = fromTimestamp(Timestamp.decode(reader, reader.uint32())); + continue; } - - message.scheduledTime = fromTimestamp(Timestamp.decode(reader, reader.uint32())); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): CronEvent { @@ -1100,77 +1186,86 @@ export const QueueMessage: MessageFns = { decode(input: BinaryReader | Uint8Array, length?: number): QueueMessage { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseQueueMessage(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 10) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseQueueMessage(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 10) { + break; + } + + message.id = reader.string(); + continue; } + case 2: { + if (tag !== 18) { + break; + } - message.id = reader.string(); - continue; - } - case 2: { - if (tag !== 18) { - break; + message.payload = reader.bytes(); + continue; } + case 3: { + if (tag !== 26) { + break; + } - message.payload = reader.bytes(); - continue; - } - case 3: { - if (tag !== 26) { - break; + message.receiptHandle = reader.string(); + continue; } + case 4: { + if (tag !== 34) { + break; + } - message.receiptHandle = reader.string(); - continue; - } - case 4: { - if (tag !== 34) { - break; + message.source = reader.string(); + continue; } + case 5: { + if (tag !== 40) { + break; + } - message.source = reader.string(); - continue; - } - case 5: { - if (tag !== 40) { - break; + message.attemptCount = reader.uint32(); + continue; } + case 6: { + if (tag !== 50) { + break; + } - message.attemptCount = reader.uint32(); - continue; - } - case 6: { - if (tag !== 50) { - break; + message.timestamp = fromTimestamp(Timestamp.decode(reader, reader.uint32())); + continue; } - - message.timestamp = fromTimestamp(Timestamp.decode(reader, reader.uint32())); - continue; - } - case 7: { - if (tag !== 58) { - break; - } - - const entry7 = QueueMessage_AttributesEntry.decode(reader, reader.uint32()); - if (entry7.value !== undefined) { - message.attributes[entry7.key] = entry7.value; + case 7: { + if (tag !== 58) { + break; + } + + const entry7 = QueueMessage_AttributesEntry.decode(reader, reader.uint32()); + if (entry7.value !== undefined) { + message.attributes[entry7.key] = entry7.value; + } + continue; } - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): QueueMessage { @@ -1192,7 +1287,12 @@ export const QueueMessage: MessageFns = { attributes: isObject(object.attributes) ? (globalThis.Object.entries(object.attributes) as [string, any][]).reduce( (acc: { [key: string]: string }, [key, value]: [string, any]) => { - acc[key] = globalThis.String(value); + globalThis.Object.defineProperty(acc, key, { + value: globalThis.String(value), + enumerable: true, + configurable: true, + writable: true, + }); return acc; }, {}, @@ -1274,34 +1374,43 @@ export const QueueMessage_AttributesEntry: MessageFns>> 3) { - case 1: { - if (tag !== 10) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseQueueMessage_AttributesEntry(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 10) { + break; + } + + message.key = reader.string(); + continue; } + case 2: { + if (tag !== 18) { + break; + } - message.key = reader.string(); - continue; - } - case 2: { - if (tag !== 18) { - break; + message.value = reader.string(); + continue; } - - message.value = reader.string(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): QueueMessage_AttributesEntry { @@ -1377,82 +1486,91 @@ export const ArcCommand: MessageFns = { decode(input: BinaryReader | Uint8Array, length?: number): ArcCommand { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseArcCommand(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 10) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseArcCommand(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 10) { + break; + } + + message.commandId = reader.string(); + continue; } + case 2: { + if (tag !== 18) { + break; + } - message.commandId = reader.string(); - continue; - } - case 2: { - if (tag !== 18) { - break; + message.commandName = reader.string(); + continue; } + case 3: { + if (tag !== 26) { + break; + } - message.commandName = reader.string(); - continue; - } - case 3: { - if (tag !== 26) { - break; + message.params = reader.bytes(); + continue; } + case 4: { + if (tag !== 32) { + break; + } - message.params = reader.bytes(); - continue; - } - case 4: { - if (tag !== 32) { - break; + message.attempt = reader.uint32(); + continue; } + case 5: { + if (tag !== 42) { + break; + } - message.attempt = reader.uint32(); - continue; - } - case 5: { - if (tag !== 42) { - break; + message.deadline = fromTimestamp(Timestamp.decode(reader, reader.uint32())); + continue; } + case 6: { + if (tag !== 50) { + break; + } - message.deadline = fromTimestamp(Timestamp.decode(reader, reader.uint32())); - continue; - } - case 6: { - if (tag !== 50) { - break; + message.responseUrl = reader.string(); + continue; } + case 7: { + if (tag !== 58) { + break; + } - message.responseUrl = reader.string(); - continue; - } - case 7: { - if (tag !== 58) { - break; + message.storageUploadUrl = reader.string(); + continue; } + case 8: { + if (tag !== 64) { + break; + } - message.storageUploadUrl = reader.string(); - continue; - } - case 8: { - if (tag !== 64) { - break; + message.maxInlineBytes = longToNumber(reader.uint64()); + continue; } - - message.maxInlineBytes = longToNumber(reader.uint64()); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): ArcCommand { @@ -1554,42 +1672,51 @@ export const SendTaskResultRequest: MessageFns = { decode(input: BinaryReader | Uint8Array, length?: number): SendTaskResultRequest { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseSendTaskResultRequest(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 10) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseSendTaskResultRequest(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 10) { + break; + } + + message.taskId = reader.string(); + continue; } + case 2: { + if (tag !== 18) { + break; + } - message.taskId = reader.string(); - continue; - } - case 2: { - if (tag !== 18) { - break; + message.success = TaskSuccess.decode(reader, reader.uint32()); + continue; } + case 3: { + if (tag !== 26) { + break; + } - message.success = TaskSuccess.decode(reader, reader.uint32()); - continue; - } - case 3: { - if (tag !== 26) { - break; + message.error = TaskError.decode(reader, reader.uint32()); + continue; } - - message.error = TaskError.decode(reader, reader.uint32()); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): SendTaskResultRequest { @@ -1648,26 +1775,35 @@ export const TaskSuccess: MessageFns = { decode(input: BinaryReader | Uint8Array, length?: number): TaskSuccess { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseTaskSuccess(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 10) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseTaskSuccess(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 10) { + break; + } + + message.responseData = reader.bytes(); + continue; } - - message.responseData = reader.bytes(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): TaskSuccess { @@ -1715,34 +1851,43 @@ export const TaskError: MessageFns = { decode(input: BinaryReader | Uint8Array, length?: number): TaskError { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseTaskError(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 10) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseTaskError(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 10) { + break; + } + + message.code = reader.string(); + continue; } + case 2: { + if (tag !== 18) { + break; + } - message.code = reader.string(); - continue; - } - case 2: { - if (tag !== 18) { - break; + message.message = reader.string(); + continue; } - - message.message = reader.string(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): TaskError { @@ -1788,26 +1933,35 @@ export const SendTaskResultResponse: MessageFns = { decode(input: BinaryReader | Uint8Array, length?: number): SendTaskResultResponse { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseSendTaskResultResponse(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 8) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseSendTaskResultResponse(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 8) { + break; + } + + message.acknowledged = reader.bool(); + continue; } - - message.acknowledged = reader.bool(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): SendTaskResultResponse { diff --git a/packages/sdk/src/worker-runtime/generated/google/protobuf/duration.ts b/packages/sdk/src/worker-runtime/generated/google/protobuf/duration.ts index 363126a11..2187dda2b 100644 --- a/packages/sdk/src/worker-runtime/generated/google/protobuf/duration.ts +++ b/packages/sdk/src/worker-runtime/generated/google/protobuf/duration.ts @@ -1,6 +1,6 @@ // Code generated by protoc-gen-ts_proto. DO NOT EDIT. // versions: -// protoc-gen-ts_proto v2.12.0 +// protoc-gen-ts_proto v2.12.1 // protoc v7.35.1 // source: google/protobuf/duration.proto @@ -104,34 +104,43 @@ export const Duration: MessageFns = { decode(input: BinaryReader | Uint8Array, length?: number): Duration { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseDuration(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 8) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseDuration(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 8) { + break; + } + + message.seconds = longToNumber(reader.int64()); + continue; } + case 2: { + if (tag !== 16) { + break; + } - message.seconds = longToNumber(reader.int64()); - continue; - } - case 2: { - if (tag !== 16) { - break; + message.nanos = reader.int32(); + continue; } - - message.nanos = reader.int32(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): Duration { diff --git a/packages/sdk/src/worker-runtime/generated/google/protobuf/timestamp.ts b/packages/sdk/src/worker-runtime/generated/google/protobuf/timestamp.ts index c887a3b7c..34feead43 100644 --- a/packages/sdk/src/worker-runtime/generated/google/protobuf/timestamp.ts +++ b/packages/sdk/src/worker-runtime/generated/google/protobuf/timestamp.ts @@ -1,6 +1,6 @@ // Code generated by protoc-gen-ts_proto. DO NOT EDIT. // versions: -// protoc-gen-ts_proto v2.12.0 +// protoc-gen-ts_proto v2.12.1 // protoc v7.35.1 // source: google/protobuf/timestamp.proto @@ -134,34 +134,43 @@ export const Timestamp: MessageFns = { decode(input: BinaryReader | Uint8Array, length?: number): Timestamp { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseTimestamp(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 8) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseTimestamp(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 8) { + break; + } + + message.seconds = longToNumber(reader.int64()); + continue; } + case 2: { + if (tag !== 16) { + break; + } - message.seconds = longToNumber(reader.int64()); - continue; - } - case 2: { - if (tag !== 16) { - break; + message.nanos = reader.int32(); + continue; } - - message.nanos = reader.int32(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): Timestamp { diff --git a/packages/sdk/src/worker-runtime/generated/wait_until.ts b/packages/sdk/src/worker-runtime/generated/wait_until.ts index c1f6b33e4..4529fe017 100644 --- a/packages/sdk/src/worker-runtime/generated/wait_until.ts +++ b/packages/sdk/src/worker-runtime/generated/wait_until.ts @@ -1,6 +1,6 @@ // Code generated by protoc-gen-ts_proto. DO NOT EDIT. // versions: -// protoc-gen-ts_proto v2.12.0 +// protoc-gen-ts_proto v2.12.1 // protoc v7.35.1 // source: wait_until.proto @@ -88,34 +88,43 @@ export const NotifyTaskRegisteredRequest: MessageFns>> 3) { - case 1: { - if (tag !== 10) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseNotifyTaskRegisteredRequest(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 10) { + break; + } + + message.applicationId = reader.string(); + continue; } + case 2: { + if (tag !== 18) { + break; + } - message.applicationId = reader.string(); - continue; - } - case 2: { - if (tag !== 18) { - break; + message.taskDescription = reader.string(); + continue; } - - message.taskDescription = reader.string(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): NotifyTaskRegisteredRequest { @@ -169,26 +178,35 @@ export const NotifyTaskRegisteredResponse: MessageFns>> 3) { - case 1: { - if (tag !== 8) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseNotifyTaskRegisteredResponse(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 8) { + break; + } + + message.success = reader.bool(); + continue; } - - message.success = reader.bool(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): NotifyTaskRegisteredResponse { @@ -230,34 +248,43 @@ export const WaitForDrainSignalRequest: MessageFns = decode(input: BinaryReader | Uint8Array, length?: number): WaitForDrainSignalRequest { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseWaitForDrainSignalRequest(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 10) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseWaitForDrainSignalRequest(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 10) { + break; + } + + message.applicationId = reader.string(); + continue; } + case 2: { + if (tag !== 18) { + break; + } - message.applicationId = reader.string(); - continue; - } - case 2: { - if (tag !== 18) { - break; + message.timeout = Duration.decode(reader, reader.uint32()); + continue; } - - message.timeout = Duration.decode(reader, reader.uint32()); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): WaitForDrainSignalRequest { @@ -315,42 +342,51 @@ export const WaitForDrainSignalResponse: MessageFns decode(input: BinaryReader | Uint8Array, length?: number): WaitForDrainSignalResponse { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseWaitForDrainSignalResponse(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 8) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseWaitForDrainSignalResponse(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 8) { + break; + } + + message.shouldDrain = reader.bool(); + continue; } + case 2: { + if (tag !== 18) { + break; + } - message.shouldDrain = reader.bool(); - continue; - } - case 2: { - if (tag !== 18) { - break; + message.drainTimeout = Duration.decode(reader, reader.uint32()); + continue; } + case 3: { + if (tag !== 26) { + break; + } - message.drainTimeout = Duration.decode(reader, reader.uint32()); - continue; - } - case 3: { - if (tag !== 26) { - break; + message.drainReason = reader.string(); + continue; } - - message.drainReason = reader.string(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): WaitForDrainSignalResponse { @@ -424,50 +460,59 @@ export const NotifyDrainCompleteRequest: MessageFns decode(input: BinaryReader | Uint8Array, length?: number): NotifyDrainCompleteRequest { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseNotifyDrainCompleteRequest(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 10) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseNotifyDrainCompleteRequest(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 10) { + break; + } + + message.applicationId = reader.string(); + continue; } + case 2: { + if (tag !== 16) { + break; + } - message.applicationId = reader.string(); - continue; - } - case 2: { - if (tag !== 16) { - break; + message.tasksDrained = reader.uint32(); + continue; } + case 3: { + if (tag !== 24) { + break; + } - message.tasksDrained = reader.uint32(); - continue; - } - case 3: { - if (tag !== 24) { - break; + message.success = reader.bool(); + continue; } + case 4: { + if (tag !== 34) { + break; + } - message.success = reader.bool(); - continue; - } - case 4: { - if (tag !== 34) { - break; + message.errorMessage = reader.string(); + continue; } - - message.errorMessage = reader.string(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): NotifyDrainCompleteRequest { @@ -535,26 +580,35 @@ export const NotifyDrainCompleteResponse: MessageFns>> 3) { - case 1: { - if (tag !== 8) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseNotifyDrainCompleteResponse(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 8) { + break; + } + + message.acknowledged = reader.bool(); + continue; } - - message.acknowledged = reader.bool(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): NotifyDrainCompleteResponse { @@ -593,26 +647,35 @@ export const GetTaskCountRequest: MessageFns = { decode(input: BinaryReader | Uint8Array, length?: number): GetTaskCountRequest { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseGetTaskCountRequest(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 10) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseGetTaskCountRequest(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 10) { + break; + } + + message.applicationId = reader.string(); + continue; } - - message.applicationId = reader.string(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): GetTaskCountRequest { @@ -657,26 +720,35 @@ export const GetTaskCountResponse: MessageFns = { decode(input: BinaryReader | Uint8Array, length?: number): GetTaskCountResponse { const reader = input instanceof BinaryReader ? input : new BinaryReader(input); - const end = length === undefined ? reader.len : reader.pos + length; - const message = createBaseGetTaskCountResponse(); - while (reader.pos < end) { - const tag = reader.uint32(); - switch (tag >>> 3) { - case 1: { - if (tag !== 8) { - break; + const previousRecursionDepth = (reader as any).__tsProtoDecodeDepth ?? 0; + if (previousRecursionDepth >= 100) { + throw new globalThis.Error("protobuf decode recursion limit exceeded"); + } + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth + 1; + try { + const end = length === undefined ? reader.len : reader.pos + length; + const message = createBaseGetTaskCountResponse(); + while (reader.pos < end) { + const tag = reader.uint32(); + switch (tag >>> 3) { + case 1: { + if (tag !== 8) { + break; + } + + message.taskCount = reader.uint32(); + continue; } - - message.taskCount = reader.uint32(); - continue; } + if ((tag & 7) === 4 || tag === 0) { + break; + } + reader.skip(tag & 7); } - if ((tag & 7) === 4 || tag === 0) { - break; - } - reader.skip(tag & 7); + return message; + } finally { + (reader as any).__tsProtoDecodeDepth = previousRecursionDepth; } - return message; }, fromJSON(object: any): GetTaskCountResponse {