feat: configure externally managed machine endpoints

crates/alien-core/src/stack_settings.rs

@@ -724,6 +724,18 @@ pub struct StackSettings {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub compute: Option<ComputeSettings>,
 
+    /// Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.
+    ///
+    /// This is intended for adopted Machines deployments whose DNS and certificates remain
+    /// customer-owned. The platform passes these URLs to the runtime without creating or
+    /// replacing DNS records or certificates.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(
+        feature = "openapi",
+        schema(value_type = Option<HashMap<String, HashMap<String, String>>>)
+    )]
+    pub public_endpoints: Option<crate::PublicEndpointUrls>,
+
     /// Deployment model: push (Manager) or pull (Agent).
     /// Default: Push.
     /// - Push: Manager drives updates. For cloud platforms, requires cross-account
@@ -886,4 +898,24 @@ mod failure_domain_tests {
         };
         assert_eq!(valid.validate(), Ok(()));
     }
+
+    #[test]
+    fn machine_public_endpoints_round_trip_without_rewriting_urls() {
+        let settings: StackSettings = serde_json::from_value(serde_json::json!({
+            "publicEndpoints": {
+                "loader": {
+                    "api": "https://10m5el.compute.islo.ai",
+                    "shares": "https://shares.10m5el.compute.islo.ai",
+                    "webhooks": "https://webhooks.10m5el.compute.islo.ai"
+                }
+            }
+        }))
+        .expect("stack settings should deserialize");
+
+        assert_eq!(
+            serde_json::to_value(settings).expect("stack settings should serialize")
+                ["publicEndpoints"]["loader"]["shares"],
+            "https://shares.10m5el.compute.islo.ai"
+        );
+    }
 }

crates/alien-deploy-cli/src/commands/up.rs

@@ -517,6 +517,30 @@ mod tests {
         );
     }
 
+    #[test]
+    fn sdk_stack_settings_preserves_public_endpoints() {
+        let settings = StackSettings {
+            public_endpoints: Some(std::collections::HashMap::from([(
+                "loader".to_string(),
+                std::collections::HashMap::from([(
+                    "api".to_string(),
+                    "https://10m5el.compute.islo.ai".to_string(),
+                )]),
+            )])),
+            ..StackSettings::default()
+        };
+
+        let wire = serde_json::to_value(
+            sdk_stack_settings(&settings).expect("settings should convert to SDK type"),
+        )
+        .expect("settings should serialize");
+
+        assert_eq!(
+            wire["publicEndpoints"]["loader"]["api"],
+            "https://10m5el.compute.islo.ai"
+        );
+    }
+
     #[test]
     fn local_tracking_uses_service_data_dir_by_default() {
         let args = UpArgs::parse_from(["alien-deploy", "--platform", "local"]);

crates/alien-operator/src/config.rs

@@ -202,6 +202,7 @@ mod tests {
                 kubernetes: None,
                 external_bindings: None,
                 compute: None,
+                public_endpoints: None,
             }))
             .api_server_port(8080)
             .build();
@@ -258,6 +259,7 @@ mod tests {
                 kubernetes: None,
                 external_bindings: None,
                 compute: None,
+                public_endpoints: None,
             }))
             .build();
 
@@ -281,6 +283,7 @@ mod tests {
                 kubernetes: None,
                 external_bindings: None,
                 compute: None,
+                public_endpoints: None,
             }))
             .build();
 
@@ -304,6 +307,7 @@ mod tests {
                 kubernetes: None,
                 external_bindings: None,
                 compute: None,
+                public_endpoints: None,
             }))
             .build();