feat: add trusted gateway telemetry capabilities

README.md

@@ -40,6 +40,48 @@ Follow the [Quickstart](https://www.alien.dev/docs/quickstart) guide to build an
 
 Or [try it with Claude Code, Codex, or Cursor](https://www.alien.dev#prompt).
 
+### CLI automation
+
+Every platform workflow has a non-interactive form. Link a directory once, then
+commands use that project unless `--project` is provided explicitly:
+
+```bash
+alien login
+alien projects list
+alien link --project my-project
+alien projects describe --json
+
+# Configure project capabilities.
+alien projects capabilities enable models \
+  --model byo/claude-opus-5 \
+  --provider anthropic
+
+# Create a least-privileged key and onboard a customer environment.
+alien api-keys create --for ai-gateway --description production-backend --json
+alien onboard acme --external-id customer_123 --setup-items models,keys --json
+
+# Print an executable request for the active environment.
+alien examples ai-gateway --protocol anthropic-messages
+
+# Search structured gateway diagnostics without writing a raw query.
+alien logs --source ai-gateway --status provider-error --provider anthropic --json
+
+# Inspect live rollout state without parsing the raw stack state.
+alien deployments status production/api
+alien deployments resources production/api --json
+alien deployments wait production/api --for ready --timeout 10m --json
+
+# Read privacy-safe aggregate usage.
+alien usage ai --range 7d --json
+```
+
+Resource detail commands accept `get`, `describe`, and `show`; list commands
+accept both `list` and `ls`. JSON mode never prompts and writes structured data
+to stdout, making the same CLI suitable for humans, scripts, and coding agents.
+The normalized resource view intentionally excludes resource configuration,
+internal controller state, environment variables, and arbitrary provider
+outputs.
+
 ## Features
 
 - **[AWS, GCP, and Azure support](https://www.alien.dev/docs/how-alien-works)** - Deploy to all major clouds. 

client-sdks/platform/rust/build.rs

@@ -14,8 +14,10 @@ fn run() {
     let manifest_dir = std::env::var("CARGO_MANIFEST_DIR").unwrap();
     let src = std::path::Path::new(&manifest_dir).join("openapi.json");
     println!("cargo:rerun-if-changed={}", src.display());
-    let file = std::fs::File::open(&src).unwrap();
-    let spec = serde_json::from_reader(file).unwrap();
+    // Keep the specification in rustc's dependency graph as well as Cargo's
+    // build-script watch list so restored build caches cannot reuse code that
+    // was generated from an older API schema.
+    let spec = serde_json::from_str(include_str!("openapi.json")).unwrap();
     let mut generator = progenitor::Generator::new(
         GenerationSettings::new().with_interface(InterfaceStyle::Builder),
     );

client-sdks/platform/typescript/FUNCTIONS.md

@@ -2,7 +2,7 @@
 
 > [!NOTE]
 > This section is useful if you are using a bundler and targetting browsers and
-> runtimes where the size of an application affects performance and load times. 
+> runtimes where the size of an application affects performance and load times.
 
 Every method in this SDK is also available as a standalone function. This
 alternative API is suitable when targetting the browser or serverless runtimes

client-sdks/platform/typescript/README.md

@@ -254,6 +254,8 @@ run();
 * [getExternalAIBinding](docs/sdks/deploymentgroups/README.md#getexternalaibinding) - Get external AI connection state
 * [putExternalAIBinding](docs/sdks/deploymentgroups/README.md#putexternalaibinding) - Connect or rotate an external AI provider key
 * [deleteExternalAIBinding](docs/sdks/deploymentgroups/README.md#deleteexternalaibinding) - Revoke the external AI connection
+* [createExternalAIModelCheck](docs/sdks/deploymentgroups/README.md#createexternalaimodelcheck) - Queue an explicit external model access check
+* [getExternalAIModelCheck](docs/sdks/deploymentgroups/README.md#getexternalaimodelcheck) - Get an external model access check
 
 ### [Deployments](docs/sdks/deployments/README.md)
 
@@ -368,14 +370,18 @@ run();
 * [getTemplateUrls](docs/sdks/projects/README.md#gettemplateurls) - Get template URLs for deploying setup stacks in this project.
 * [getDeploymentLinkSetup](docs/sdks/projects/README.md#getdeploymentlinksetup) - Get the active release stack and portal-visible setup availability for deployment-link configuration.
 * [getActiveRelease](docs/sdks/projects/README.md#getactiverelease) - Get the production channel's current release. When deploymentId is provided, returns that deployment's effective release: its pin, or its followed channel's current release.
+* [previewModelsImpact](docs/sdks/projects/README.md#previewmodelsimpact) - Preview which customer model connections a configuration change may affect.
 * [setCapabilities](docs/sdks/projects/README.md#setcapabilities) - Set the capabilities offered by a Project. Removing a capability prevents new setup without deleting existing customer resources.
 * [configureDeployments](docs/sdks/projects/README.md#configuredeployments) - Enable deployments for a Project.
+* [getAiProviderHeaders](docs/sdks/projects/README.md#getaiproviderheaders) - Get static headers added to AI requests for each provider.
+* [configureAiProviderHeaders](docs/sdks/projects/README.md#configureaiproviderheaders) - Replace the static headers added to AI requests for each provider.
 * [configureModels](docs/sdks/projects/README.md#configuremodels) - Configure customer-owned model providers without requiring an application Release.
 * [configureKeys](docs/sdks/projects/README.md#configurekeys) - Enable customer-owned application encryption without requiring an application Release.
 * [configureBuckets](docs/sdks/projects/README.md#configurebuckets) - Enable buckets without requiring a project Release.
 * [configureRegistry](docs/sdks/projects/README.md#configureregistry) - Enable customer-owned container registries without requiring an application Release.
 * [getCapabilityOverview](docs/sdks/projects/README.md#getcapabilityoverview) - Get safe, server-derived capability status for a Project.
 * [getAiUsage](docs/sdks/projects/README.md#getaiusage)
+* [getEncryptionUsage](docs/sdks/projects/README.md#getencryptionusage)
 
 ### [ReleaseChannels](docs/sdks/releasechannels/README.md)
 
@@ -520,6 +526,7 @@ To read more about standalone functions, check [FUNCTIONS.md](./FUNCTIONS.md).
 - [`deploymentGetInfo`](docs/sdks/deployment/README.md#getinfo) - Get deployment information for the deployment portal. Accepts both deployment-scoped and deployment-group-scoped API keys. Returns project information, package status/outputs, and either deployment or deployment group details depending on the token type. Poll this endpoint to check if packages are ready.
 - [`deploymentGroupsCreateDeploymentGroup`](docs/sdks/deploymentgroups/README.md#createdeploymentgroup) - Create a new deployment group
 - [`deploymentGroupsCreateDeploymentGroupToken`](docs/sdks/deploymentgroups/README.md#createdeploymentgrouptoken) - Create deployment group token
+- [`deploymentGroupsCreateExternalAIModelCheck`](docs/sdks/deploymentgroups/README.md#createexternalaimodelcheck) - Queue an explicit external model access check
 - [`deploymentGroupsCreateFirstPartyDeploymentSession`](docs/sdks/deploymentgroups/README.md#createfirstpartydeploymentsession) - Create first-party deployment session
 - [`deploymentGroupsDeleteDeploymentGroup`](docs/sdks/deploymentgroups/README.md#deletedeploymentgroup) - Delete deployment group
 - [`deploymentGroupsDeleteExternalAIBinding`](docs/sdks/deploymentgroups/README.md#deleteexternalaibinding) - Revoke the external AI connection
@@ -528,6 +535,7 @@ To read more about standalone functions, check [FUNCTIONS.md](./FUNCTIONS.md).
 - [`deploymentGroupsGetDeploymentGroup`](docs/sdks/deploymentgroups/README.md#getdeploymentgroup) - Get deployment group details
 - [`deploymentGroupsGetDeploymentGroupByExternalId`](docs/sdks/deploymentgroups/README.md#getdeploymentgroupbyexternalid) - Get a deployment group by project and external ID
 - [`deploymentGroupsGetExternalAIBinding`](docs/sdks/deploymentgroups/README.md#getexternalaibinding) - Get external AI connection state
+- [`deploymentGroupsGetExternalAIModelCheck`](docs/sdks/deploymentgroups/README.md#getexternalaimodelcheck) - Get an external model access check
 - [`deploymentGroupsListDeploymentGroups`](docs/sdks/deploymentgroups/README.md#listdeploymentgroups) - List deployment groups
 - [`deploymentGroupsPutExternalAIBinding`](docs/sdks/deploymentgroups/README.md#putexternalaibinding) - Connect or rotate an external AI provider key
 - [`deploymentGroupsSetDeploymentGroupExternalId`](docs/sdks/deploymentgroups/README.md#setdeploymentgroupexternalid) - Set or clear a deployment group's external ID
@@ -611,6 +619,7 @@ To read more about standalone functions, check [FUNCTIONS.md](./FUNCTIONS.md).
 - [`packagesGet`](docs/sdks/packages/README.md#get) - Get details of a specific package.
 - [`packagesList`](docs/sdks/packages/README.md#list) - List packages with optional filters. Returns packages ordered by creation date (newest first).
 - [`packagesRebuild`](docs/sdks/packages/README.md#rebuild) - Rebuild packages for a project. This will cancel any pending packages and create new ones with auto-incremented versions.
+- [`projectsConfigureAiProviderHeaders`](docs/sdks/projects/README.md#configureaiproviderheaders) - Replace the static headers added to AI requests for each provider.
 - [`projectsConfigureBuckets`](docs/sdks/projects/README.md#configurebuckets) - Enable buckets without requiring a project Release.
 - [`projectsConfigureDeployments`](docs/sdks/projects/README.md#configuredeployments) - Enable deployments for a Project.
 - [`projectsConfigureKeys`](docs/sdks/projects/README.md#configurekeys) - Enable customer-owned application encryption without requiring an application Release.
@@ -622,13 +631,16 @@ To read more about standalone functions, check [FUNCTIONS.md](./FUNCTIONS.md).
 - [`projectsDelete`](docs/sdks/projects/README.md#delete) - Delete a project. The project must have no deployments.
 - [`projectsGet`](docs/sdks/projects/README.md#get) - Retrieve a project by ID or name.
 - [`projectsGetActiveRelease`](docs/sdks/projects/README.md#getactiverelease) - Get the production channel's current release. When deploymentId is provided, returns that deployment's effective release: its pin, or its followed channel's current release.
+- [`projectsGetAiProviderHeaders`](docs/sdks/projects/README.md#getaiproviderheaders) - Get static headers added to AI requests for each provider.
 - [`projectsGetAiUsage`](docs/sdks/projects/README.md#getaiusage)
 - [`projectsGetCapabilityOverview`](docs/sdks/projects/README.md#getcapabilityoverview) - Get safe, server-derived capability status for a Project.
 - [`projectsGetDeploymentLinkSetup`](docs/sdks/projects/README.md#getdeploymentlinksetup) - Get the active release stack and portal-visible setup availability for deployment-link configuration.
 - [`projectsGetDeploymentPortalDomain`](docs/sdks/projects/README.md#getdeploymentportaldomain) - Get the deployment portal domain binding for a project.
+- [`projectsGetEncryptionUsage`](docs/sdks/projects/README.md#getencryptionusage)
 - [`projectsGetGcpOAuthProvider`](docs/sdks/projects/README.md#getgcpoauthprovider) - Retrieve redacted project-level Google Cloud OAuth provider settings.
 - [`projectsGetTemplateUrls`](docs/sdks/projects/README.md#gettemplateurls) - Get template URLs for deploying setup stacks in this project.
 - [`projectsList`](docs/sdks/projects/README.md#list) - Retrieve all projects.
+- [`projectsPreviewModelsImpact`](docs/sdks/projects/README.md#previewmodelsimpact) - Preview which customer model connections a configuration change may affect.
 - [`projectsSetCapabilities`](docs/sdks/projects/README.md#setcapabilities) - Set the capabilities offered by a Project. Removing a capability prevents new setup without deleting existing customer resources.
 - [`projectsUpdate`](docs/sdks/projects/README.md#update) - Update a project.
 - [`projectsUpdateGcpOAuthProvider`](docs/sdks/projects/README.md#updategcpoauthprovider) - Update project-level Google Cloud OAuth provider settings.