feat!: enable remote customer-cloud storage bindings (ALIEN-291)

.github/workflows/ci-fast.yml

@@ -155,13 +155,16 @@ jobs:
 
       - name: TypeScript unit tests
         # The per-package vitest suites (commands receiver twins, bindings
-        # loader/error mapping, core schemas) — `test:ts` above is
-        # typecheck-only, so without this step they never ran in CI. Must run
-        # after the dev-addon build: the bindings kv/queue/storage/vault
-        # suites load the native addon.
+        # loader/error mapping, core schemas) and generated SDK wire contracts.
+        # `test:ts` above is typecheck-only, so without this step
+        # they never ran in CI. Must run after the dev-addon build: the bindings
+        # kv/queue/storage/vault suites load the native addon.
         env:
           NODE_OPTIONS: "--max-old-space-size=8192"
-        run: pnpm --filter @alienplatform/core --filter @alienplatform/bindings --filter @alienplatform/commands test
+        run: |
+          pnpm --filter @alienplatform/core --filter @alienplatform/bindings --filter @alienplatform/commands test
+          pnpm test:manager-sdk-wire
+          pnpm test:platform-sdk-wire
 
       - name: Rust fast tests (non-cloud)
         env:
@@ -180,6 +183,16 @@ jobs:
             --exclude alien-test-server \
             --filter-expr 'not binary_id(alien-build::build_integration_tests) and not binary_id(alien-build::image_shape_tests) and not binary_id(alien-build::rust_integration_tests) and not binary_id(alien-build::typescript_integration_tests) and not binary_id(alien-worker-runtime::lambda) and not binary_id(alien-test::distribution) and not binary_id(alien-test::pull) and not binary_id(alien-test::push) and not binary_id(alien-manager::registry_proxy_cloud_test)'
 
+      - name: Manager OpenAPI security contract
+        run: cargo test -p alien-manager --features openapi --lib api::tests::openapi_declares_http_bearer_security_without_dropping_schemas
+
+      - name: Remote bindings tests (non-cloud)
+        run: |
+          depot cargo test -p alien-bindings --features platform-sdk --lib remote::
+          depot cargo test -p alien-aws-clients --lib
+          depot cargo test -p alien-gcp-clients --lib
+          depot cargo test -p alien-azure-clients --lib user_delegation_sas
+
       - name: Build all CLIs
         if: steps.changes.outcome != 'success' || steps.changes.outputs.examples == 'true' || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main'
         run: depot cargo build -p alien-cli -p alien-deploy-cli -p alien-operator

.github/workflows/ci-fork.yml

@@ -89,6 +89,13 @@ jobs:
           NODE_OPTIONS: "--max-old-space-size=8192"
         run: pnpm test:ts
 
+      - name: Generated SDK wire contracts
+        env:
+          NODE_OPTIONS: "--max-old-space-size=8192"
+        run: |
+          pnpm test:manager-sdk-wire
+          pnpm test:platform-sdk-wire
+
       - name: Rust tests (non-cloud)
         run: |
           cargo nextest run --workspace \
@@ -101,3 +108,10 @@ jobs:
             --exclude endpoint-agent \
             --exclude alien-test-server \
             --filter-expr 'not binary_id(alien-build::build_integration_tests) and not binary_id(alien-build::image_shape_tests) and not binary_id(alien-build::rust_integration_tests) and not binary_id(alien-build::typescript_integration_tests) and not binary_id(alien-worker-runtime::lambda) and not binary_id(alien-test::distribution) and not binary_id(alien-test::pull) and not binary_id(alien-test::push) and not binary_id(alien-manager::registry_proxy_cloud_test)'
+
+      - name: Remote bindings tests (non-cloud)
+        run: |
+          cargo test -p alien-bindings --features platform-sdk --lib remote::
+          cargo test -p alien-aws-clients --lib
+          cargo test -p alien-gcp-clients --lib
+          cargo test -p alien-azure-clients --lib user_delegation_sas

.github/workflows/e2e-cloud.yml

@@ -129,11 +129,11 @@ on:
   pull_request:
     types: [opened, reopened, synchronize, labeled]
 
-# Every run currently shares ALIEN_E2E_SLOT 03. Serialize the complete workflow
-# so a newer run cannot reuse resources while an older run is still testing or
+# Every run shares ALIEN_E2E_SLOT 10. Serialize the complete workflow so a
+# newer run cannot reuse resources while an older run is still testing or
 # cleaning them up.
 concurrency:
-  group: e2e-tests-slot-03
+  group: e2e-tests-slot-10
   cancel-in-progress: false
 
 permissions:
@@ -142,7 +142,7 @@ permissions:
   packages: write
 
 env:
-  ALIEN_E2E_SLOT: "03"
+  ALIEN_E2E_SLOT: "10"
   # Fall back to local compilation when the shared sccache backend returns a
   # transient error (e.g. webdav 403) instead of failing the whole build.
   SCCACHE_IGNORE_SERVER_IO_ERROR: "1"

.github/workflows/release.yml

@@ -95,7 +95,7 @@ jobs:
         env:
           VERSION: ${{ steps.bump.outputs.version }}
 
-      - name: Set npm package versions
+      - name: Set JavaScript package versions
         run: |
           VERSION="${{ steps.bump.outputs.version }}"
           # The bindings addon ships as a wrapper + per-platform prebuild packages
@@ -114,6 +114,60 @@ jobs:
               fs.writeFileSync(path, content.replace(/\"version\": \"[^\"]*\"/, '\"version\": \"${VERSION}\"'));
             "
           done
+          # Both generated SDKs publish a JSR manifest alongside package.json.
+          # Keep the two registries on the release version.
+          node -e "
+            const fs = require('fs');
+            for (const path of [
+              'client-sdks/platform/typescript/jsr.json',
+              'client-sdks/manager/typescript/jsr.json',
+            ]) {
+              const content = fs.readFileSync(path, 'utf8');
+              fs.writeFileSync(path, content.replace(/\"version\": \"[^\"]*\"/, '\"version\": \"${VERSION}\"'));
+            }
+          "
+          # Speakeasy emits npm locks for both SDKs and the Manager examples.
+          # Stamp embedded package metadata alongside the publish manifests.
+          node -e "
+            const fs = require('fs');
+            for (const sdk of ['platform', 'manager']) {
+              const lockPath = 'client-sdks/' + sdk + '/typescript/package-lock.json';
+              const lock = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+              lock.version = '${VERSION}';
+              lock.packages[''].version = '${VERSION}';
+              fs.writeFileSync(lockPath, JSON.stringify(lock, null, 2) + '\\n');
+            }
+
+            const examplesLockPath = 'client-sdks/manager/typescript/examples/package-lock.json';
+            const examplesLock = JSON.parse(fs.readFileSync(examplesLockPath, 'utf8'));
+            examplesLock.packages['..'].version = '${VERSION}';
+            fs.writeFileSync(examplesLockPath, JSON.stringify(examplesLock, null, 2) + '\\n');
+          "
+          # Both checked-in generation workflows use the version from gen.yaml.
+          # Advance them with the release so later regeneration cannot reset manifests.
+          node -e "
+            const fs = require('fs');
+            for (const sdk of ['platform', 'manager']) {
+              const root = 'client-sdks/' + sdk + '/typescript/.speakeasy/';
+              const configPath = root + 'gen.yaml';
+              const config = fs.readFileSync(configPath, 'utf8');
+              const updatedConfig = config.replace(
+                /(typescript:\\n  version: )[^\\n]+/,
+                (_, prefix) => prefix + '${VERSION}',
+              );
+              if (updatedConfig === config) throw new Error(sdk + ' SDK version not found in gen.yaml');
+              fs.writeFileSync(configPath, updatedConfig);
+
+              const lockPath = root + 'gen.lock';
+              const lock = fs.readFileSync(lockPath, 'utf8');
+              const updatedLock = lock.replace(
+                /(  releaseVersion: )[^\\n]+/,
+                (_, prefix) => prefix + '${VERSION}',
+              );
+              if (updatedLock === lock) throw new Error(sdk + ' SDK releaseVersion not found in gen.lock');
+              fs.writeFileSync(lockPath, updatedLock);
+            }
+          "
 
       # Dry-run build jobs start from the untagged commit, so carry the exact
       # versioned manifests that a real release would commit into those fresh
@@ -132,7 +186,16 @@ jobs:
             packages/sdk/package.json
             packages/testing/package.json
             client-sdks/platform/typescript/package.json
+            client-sdks/platform/typescript/jsr.json
+            client-sdks/platform/typescript/package-lock.json
+            client-sdks/platform/typescript/.speakeasy/gen.yaml
+            client-sdks/platform/typescript/.speakeasy/gen.lock
             client-sdks/manager/typescript/package.json
+            client-sdks/manager/typescript/jsr.json
+            client-sdks/manager/typescript/package-lock.json
+            client-sdks/manager/typescript/examples/package-lock.json
+            client-sdks/manager/typescript/.speakeasy/gen.yaml
+            client-sdks/manager/typescript/.speakeasy/gen.lock
             packages/bindings/package.json
             crates/alien-bindings-node/package.json
             packages/bindings/npm/darwin-arm64/package.json
@@ -148,7 +211,13 @@ jobs:
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add Cargo.toml packages/core/package.json packages/commands/package.json \
             packages/sdk/package.json packages/testing/package.json \
-            client-sdks/platform/typescript/package.json client-sdks/manager/typescript/package.json \
+            client-sdks/platform/typescript/package.json client-sdks/platform/typescript/jsr.json \
+            client-sdks/platform/typescript/package-lock.json client-sdks/platform/typescript/.speakeasy/gen.yaml \
+            client-sdks/platform/typescript/.speakeasy/gen.lock \
+            client-sdks/manager/typescript/package.json client-sdks/manager/typescript/jsr.json \
+            client-sdks/manager/typescript/package-lock.json client-sdks/manager/typescript/examples/package-lock.json \
+            client-sdks/manager/typescript/.speakeasy/gen.yaml \
+            client-sdks/manager/typescript/.speakeasy/gen.lock \
             packages/bindings/package.json crates/alien-bindings-node/package.json \
             packages/bindings/npm/darwin-arm64/package.json packages/bindings/npm/darwin-x64/package.json \
             packages/bindings/npm/linux-x64-gnu/package.json packages/bindings/npm/linux-arm64-gnu/package.json