alien CLI

The alien CLI is the tool you and your CI use to build stacks, publish releases, onboard customers, and operate deployments. Your customers use alien-deploy instead.

This page is generated from the help output of version 3.3.47. Run alien <command> --help for the same text in your terminal.

Install

Install the latest stable release on macOS or Linux:

curl -fsSL https://alien.dev/install | sh

Other install methods:

Method	Command
Homebrew	`brew install alienplatform/tap/alien`
npm	`npm install -g @alienplatform/cli`
Windows (PowerShell)	`irm https://alien.dev/install.ps1 \| iex`
A specific version	`curl -fsSL https://alien.dev/install \| sh -s -- --version 3.3.41`

Run alien upgrade to move to the latest stable release. It uses the same method you installed with.

Global flags

These flags work on every alien command.

Flag	Description
`-C, --dir <path>`	Run as if alien was started in <path> instead of the current working directory.
`--project <PROJECT>`	Project to manage (defaults to linked project or interactive bootstrap). Env: `ALIEN_PROJECT`.
`--api-key <API_KEY>`	API key (for alien.dev, or with ALIEN_MANAGER_URL for a manager you run). Env: `ALIEN_API_KEY`.
`--no-browser`	Don't open browser for authentication.
`--workspace <WORKSPACE>`	alien.dev workspace. Env: `ALIEN_WORKSPACE`.

Commands

Command	Description
`alien login`	Perform login & select default workspace.
`alien logout`	Remove saved tokens & workspace.
`alien whoami`	Show current authenticated user information.
`alien workspaces`	Workspace commands.
`alien projects`	Project commands.
`alien link`	Link directory to an Alien project.
`alien unlink`	Unlink directory from an Alien project.
`alien init`	Scaffold a new project from a template.
`alien upgrade`	Upgrade the Alien CLI to the latest stable or canary version.
`alien dev`	Local development commands.
`alien build`	Build the Alien application.
`alien release`	Push images and create a release.
`alien releases`	Release commands.
`alien render`	Render setup artifacts for review.
`alien packages`	List, inspect, rebuild, and download project packages.
`alien onboard`	Create a deployment group and generate a deployment link.
`alien deployment-groups`	List, inspect, and change project deployment groups.
`alien deploy`	Deploy to a cloud platform.
`alien deployments`	Deployment commands.
`alien status`	Show deployment status for the linked project or one deployment.
`alien destroy`	Destroy resources from a deployment.
`alien vault`	Manage vault secrets for a deployment.
`alien logs`	Search deployment and manager logs.
`alien commands`	Invoke remote commands on deployments.
`alien operations`	Build, test, and manage operations plugins.
`alien access-requests`	Request, approve, and deny time-boxed operation access.
`alien debug`	Run a local command against a deployment using manager-side credentials.
`alien api-keys`	Create, inspect, disable, and revoke API keys.
`alien tokens`	Create and revoke scoped tokens on your manager.
`alien managers`	Manage private managers deployed to your cloud.
`alien domains`	Manage workspace domains.
`alien serve`	Run a manager on this machine.
`alien examples`	Print executable integration examples.
`alien usage`	Show AI and Encryption Gateway usage.

Account and project

Perform login & select default workspace.

alien login [OPTIONS]

Flag	Description
`--manager <URL>`	URL of a manager you run (instead of alien.dev).
`--token <TOKEN>`	API key for --manager (prompted for when omitted in a terminal). Env: `ALIEN_API_KEY`.

Examples:

alien login
alien login --workspace my-workspace
alien login --manager https://manager.example.com --token ax_admin_...

`alien logout`

Remove saved tokens & workspace.

alien logout [OPTIONS]

`alien whoami`

Show current authenticated user information.

alien whoami [OPTIONS]

Flag	Description
`--json`	Emit structured JSON output.

Examples:

alien whoami
alien whoami --json
alien dev whoami

`alien workspaces`

Workspace commands.

alien workspaces [OPTIONS] <COMMAND>

Subcommand	Description
`current`	Print the effective current workspace.
`create`	Create a workspace and select it as the default.
`set`	Set the default workspace.
`ls`	List all available workspaces.

Flag	Description
`--json`	Emit structured JSON output.

Examples:

alien workspaces current
alien workspaces create my-workspace
alien workspaces ls
alien workspaces set my-workspace
alien workspaces set --json

`alien workspaces current`

Print the effective current workspace.

alien workspaces current [OPTIONS]

Flag	Description
`--json`	Emit structured JSON output.

`alien workspaces create`

Create a workspace and select it as the default.

alien workspaces create [OPTIONS] <NAME>

Argument	Description
`<NAME>`	Permanent workspace name used in URLs and CLI commands.

Flag	Description
`--json`	Emit structured JSON output.

`alien workspaces set`

Set the default workspace.

alien workspaces set [OPTIONS] [NAME]

Argument	Description
`[NAME]`	Workspace name. If omitted in a real TTY, prompts for selection.

Flag	Description
`--json`	Emit structured JSON output.

`alien workspaces ls`

List all available workspaces.

alien workspaces ls [OPTIONS]

Flag	Description
`--json`	Emit structured JSON output.

`alien projects`

Project commands.

alien projects [OPTIONS] <COMMAND>

Subcommand	Description
`create`	Create an ordinary project.
`ls`	List projects.
`get`	Show project configuration and enabled capabilities.
`delete`	Delete a project. The platform refuses while it still has deployments.
`portal`	Manage deployment portal appearance, domain, and Google sign-in.
`packages`	Inspect or update installation package settings.
`capabilities`	Inspect and enable project capabilities.

Flag	Description
`--json`	Emit structured JSON output.

Examples:

alien projects create my-project
alien projects get my-project
alien projects describe my-project --json
alien projects list
alien projects ls --json
alien --workspace my-workspace projects ls
alien projects packages get my-project --workspace my-workspace --json
alien projects packages update my-project --workspace my-workspace --file settings.json
alien projects portal get my-project --json
alien projects portal set my-project --title Acme --accent-color green
alien projects capabilities status
alien projects capabilities enable ai --model byo/claude-opus-5
alien projects capabilities enable encryption
alien projects capabilities enable remote-sandbox --image public.ecr.aws/example/analysis:v1 --max-session-lifetime-seconds 3600
alien projects capabilities enable remote-sandbox --src ./sandbox --max-session-lifetime-seconds 3600
alien projects capabilities enable remote-sandbox --src ./sandbox --dockerfile Sandbox.dockerfile --max-session-lifetime-seconds 3600
alien projects capabilities enable remote-sandbox --src ./sandbox --rebuild --max-session-lifetime-seconds 3600

`alien projects create`

Create an ordinary project.

alien projects create [OPTIONS] <NAME>

Argument	Description
`<NAME>`	Project name.

Flag	Description
`--json`	Emit structured JSON output.

`alien projects ls`

List projects.

Alias: list.

alien projects ls [OPTIONS]

Flag	Description
`--json`	Emit structured JSON output.

`alien projects get`

Show project configuration and enabled capabilities.

Alias: describe, show.

alien projects get [OPTIONS] [PROJECT]

Argument	Description
`[PROJECT]`	Project ID or name (defaults to the linked project).

Flag	Description
`--json`	Emit structured JSON output.

`alien projects delete`

Delete a project. The platform refuses while it still has deployments.

Alias: rm.

alien projects delete [OPTIONS] <PROJECT>

Argument	Description
`<PROJECT>`	Project ID or name.

Flag	Description
`--json`	Emit structured JSON output.
`-y, --yes`	Skip the confirmation prompt.

`alien projects portal`

Manage deployment portal appearance, domain, and Google sign-in.

alien projects portal [OPTIONS] <COMMAND>

Subcommand	Description
`get`	Print appearance, domain status, and Google sign-in settings.
`set`	Merge appearance settings; omitted fields are preserved.
`domain`	Inspect domain status or select an existing verified domain.
`google-sign-in`	Inspect Google sign-in or configure its OAuth web client.

Flag	Description
`--json`	Emit structured JSON output.

`alien projects portal get`

Print appearance, domain status, and Google sign-in settings.

alien projects portal get [OPTIONS] [PROJECT]

Argument	Description
`[PROJECT]`	Project ID or name (defaults to the linked project).

Flag	Description
`--json`	Emit structured JSON output.

Merge appearance settings; omitted fields are preserved. The API replaces the full appearance object and does not support conditional writes. Run appearance edits sequentially: concurrent edits from other clients can overwrite each other.

alien projects portal set [OPTIONS] [PROJECT]

Argument	Description
`[PROJECT]`	Project ID or name (defaults to the linked project).

Flag	Description
`--json`	Emit structured JSON output.
`--title <TITLE>`
`--subtitle <SUBTITLE>`
`--preset <PRESET>`	Values: `clean`, `technical`, `enterprise`, `playful`, `minimal`.
`--accent-color <ACCENT_COLOR>`	Values: `blue`, `purple`, `green`, `orange`, `pink`, `slate`.
`--density <DENSITY>`	Values: `comfortable`, `compact`.
`--avatar-url <AVATAR_URL>`
`--favicon-url <FAVICON_URL>`
`--support-url <SUPPORT_URL>`
`--docs-url <DOCS_URL>`
`--clear <CLEAR>`	Reset a nullable field to its default; repeat for multiple fields. Values: `title`, `subtitle`, `avatar-url`, `favicon-url`, `support-url`, `docs-url`.
`--file <FILE>`	Partial JSON object; flags override the file. Use - for stdin.

`alien projects portal domain`

Inspect domain status or select an existing verified domain.

alien projects portal domain [OPTIONS] [PROJECT]

Argument	Description
`[PROJECT]`	Project ID or name (defaults to the linked project).

Flag	Description
`--json`	Emit structured JSON output.
`--use <DOMAIN>`	Existing domain ID or hostname.
`--unset`	Return to the default domain.

Inspect Google sign-in or configure its OAuth web client.

alien projects portal google-sign-in [OPTIONS] [PROJECT]

Argument	Description
`[PROJECT]`	Project ID or name (defaults to the linked project).

Flag	Description
`--alien-managed`	Use the Alien-managed OAuth client.
`--json`	Emit structured JSON output.
`--client-id <CLIENT_ID>`	Google OAuth web client ID.
`--client-secret-file <CLIENT_SECRET_FILE>`	Read the write-only secret from a file or - for stdin.

`alien projects packages`

Inspect or update installation package settings.

alien projects packages [OPTIONS] <COMMAND>

Subcommand	Description
`get`	Print the project's installation package settings as JSON.
`update`	Merge settings from JSON; omitted fields are preserved.

Flag	Description
`--json`	Emit structured JSON output.

`alien projects packages get`

Print the project's installation package settings as JSON.

alien projects packages get [OPTIONS] [PROJECT]

Argument	Description
`[PROJECT]`	Project ID or name (defaults to the linked project).

Flag	Description
`--json`	Emit structured JSON output.

`alien projects packages update`

Merge settings from JSON; omitted fields are preserved.

alien projects packages update [OPTIONS] --file <FILE> [PROJECT]

Argument	Description
`[PROJECT]`	Project ID or name (defaults to the linked project).

Flag	Description
`--file <FILE>`	JSON patch file; use - to read standard input. Set a package to null to remove it.
`--json`	Emit structured JSON output.

`alien projects capabilities`

Inspect and enable project capabilities.

alien projects capabilities [OPTIONS] <COMMAND>

Subcommand	Description
`status`	Show configured capabilities and customer readiness.
`enable`	Enable or replace one capability's configuration.

Flag	Description
`--json`	Emit structured JSON output.

`alien projects capabilities status`

Show configured capabilities and customer readiness.

Alias: get, describe, show.

alien projects capabilities status [OPTIONS]

Flag	Description
`--json`	Emit structured JSON output.

`alien projects capabilities enable`

Enable or replace one capability's configuration.

alien projects capabilities enable [OPTIONS] <CAPABILITY>

Argument	Description
`<CAPABILITY>`	Values: `deployments`, `ai`, `encryption`, `buckets`, `registry`, `remote-sandbox`.

Flag	Description
`--json`	Emit structured JSON output.
`--model <MODELS>`	AI model to offer. Repeat for multiple models.
`--required-model <REQUIRED_MODELS>`	AI model that every customer must connect. Also enables the model.
`--provider <PROVIDERS>`	Allowed AI provider. Repeat for multiple providers. Values: `aws-bedrock`, `gcp-vertex`, `azure-foundry`, `anthropic`, `databricks`, `openai`.
`--repository <REPOSITORIES>`	Registry repository allowlist entry. Repeat for multiple repositories.
`--push`	Permit registry pushes in addition to pulls.
`--image <IMAGE>`	Prebuilt public container image the sandbox starts from. It needs a linux/arm64 variant, which runs on AWS; a linux/amd64 variant also runs it on Azure, and on GCP once Alien has added the sandbox agent to it. GCP gets no copy when the project's default GCP manager is a private manager, or when the variant's layers total more than 512 MiB compressed or leave their sizes out. For a private image, use --src. Omit to keep the saved image, or to use the platform's default images when none is saved.
`--src <SRC>`	Directory with a Dockerfile, built locally with Docker and pushed to the project's private repository on each cloud. The AWS image (linux/arm64) is required. Azure and GCP each get a linux/amd64 image only when the project has a manager there and the base image has a linux/amd64 variant.
`--dockerfile <DOCKERFILE>`	Dockerfile path relative to --src (default: Dockerfile).
`--rebuild`	Build and push even when --src looks unchanged. The check reads the files Docker sends as the build context, and the images in FROM by name only.
`--max-session-lifetime-seconds <MAX_SESSION_LIFETIME_SECONDS>`	Ceiling on a single sandbox session, in seconds. Defaults to the saved value, else 3600.

`alien link`

Link directory to an Alien project.

alien link [OPTIONS]

Flag	Description
`--no-git`	Do not attach detected git repository metadata when creating a project.
`--json`	Emit structured JSON output.
`--force`	Force re-linking even if this directory is already linked.

Examples:

alien link
alien link --project my-project
alien --workspace my-workspace link --project my-project --json

`alien unlink`

Unlink directory from an Alien project.

alien unlink [OPTIONS]

Flag	Description
`--force`	Force unlink without confirmation.

`alien init`

Scaffold a new project from a template.

alien init [OPTIONS] [TEMPLATE] [DIRECTORY]

Argument	Description
`[TEMPLATE]`	Template to use (omit for interactive selection).
`[DIRECTORY]`	Destination directory. Defaults to `alien` inside an existing repository and to the current directory when it is empty.

Flag	Description
`--force`	Overwrite target directory if it exists.

`alien upgrade`

Upgrade the Alien CLI to the latest stable or canary version.

Alias: update.

alien upgrade [OPTIONS]

Flag	Description
`--dry-run`	Check what would be installed without changing anything.
`--canary`	Install the latest canary build (standalone installations only).
`--force`	Reinstall even when the selected version matches the current version.

Local development

`alien dev`

Local development commands.

alien dev [OPTIONS] [COMMAND]

Subcommand	Description
`server`	Start the local manager only.
`deployments`	Deployment commands against the local manager.
`releases`	Release commands against the local manager.
`whoami`	Show local manager identity information.
`deploy`	Deploy to the local manager.
`destroy`	Destroy from the local manager.
`release`	Create a release on the local manager.
`vault`	Manage vault secrets for local dev deployments.
`commands`	Invoke remote commands on local dev deployments.
`debug`	Run a local command against a local dev deployment using manager-side credentials.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`-c, --config <CONFIG>`	Path to configuration file (default: auto-discover alien.ts in current directory).
`--skip-build`	Skip the build step (use existing build artifacts).
`--status-file <STATUS_FILE>`	Path to write status file (JSON with alien_core::DevStatus).
`--deployment-name <DEPLOYMENT_NAME>`	Deployment name, or an existing ID / group/name to migrate legacy local state. Default: `default`.
`--env <ENV_VARS>`	Plain environment variables (KEY=VALUE or KEY=VALUE:target1,target2).
`--secret <SECRET_VARS>`	Secret environment variables (KEY=VALUE or KEY=VALUE:target1,target2).
`--secret-file <SECRET_FILES>`	Secret environment variables read from files (KEY=PATH or KEY=PATH:target1,target2).
`--secret-env <SECRET_ENV_VARS>`	Secret environment variables inherited from the CLI environment (KEY=SOURCE_ENV or KEY=SOURCE_ENV:target1,target2).

`alien dev server`

Start the local manager only.

alien dev server [OPTIONS]

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev deployments`

Deployment commands against the local manager.

alien dev deployments [OPTIONS] <COMMAND>

Subcommand	Description
`set-domains`	Use managed certificates for endpoint hostnames, or restore generated domains.
`create`	Create a new deployment.
`ls`	List deployments.
`get`	Get deployment details.
`resources`	Show a safe resource summary without resource configuration or secrets.
`events`	Show deployment lifecycle and configuration events.
`wait`	Wait until a deployment is ready or reaches a terminal state.
`machines`	Show the machines connected to a deployment.
`drain-machine`	Drain a machine so its workloads move to other machines.
`cancel-machine-drain`	Cancel a machine drain so the machine takes work again.
`remove-machine`	Remove a machine from a deployment.
`join-tokens`	List, create, rotate, and revoke tokens that join hosts to a Machines deployment.
`volumes`	Show container volumes, their latest snapshots and restores.
`restore-volume`	Replace a replica's persistent volume with a volume made from a snapshot.
`cancel-volume-restore`	Cancel a pending volume restore.
`delete`	Delete a deployment.
`retry`	Retry a deployment.
`redeploy`	Redeploy a deployment with the same release.
`move`	Move a deployment to another group without changing its runtime.
`pin`	Pin a deployment to a specific release.
`set-compute`	Change machine counts, machine type, or quota warning overrides of a deployment.
`set-env`	Replace the environment variables of a deployment.
`inputs`	Show a deployment's stack inputs and their current values.
`set-inputs`	Change stack inputs of a deployment.
`check`	Ask the manager to check the deployment's health now.
`set-channel`	Change the channel followed by an unpinned deployment.
`token`	Create a deployment token (deployment-scoped API key).
`untrack`	Forget a deployment this machine tracks locally, discarding its stored key.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.

Related commands:

alien logs --deployment production/api --follow
alien debug production/api -- <command>
alien commands --help

Examples:

alien deployments list
alien deployments describe production/api
alien deployments resources production/api --json
alien deployments events production/api
alien deployments wait production/api --for ready --timeout 10m
alien deployments machines production/api --json
alien deployments set-compute production/api --machines 3
alien deployments set-inputs production/api --input region=eu-west-1
alien deployments drain-machine production/api <machine-id>
alien deployments join-tokens create production/api
alien deployments untrack my-sandbox

`alien dev deployments set-domains`

Use managed certificates for endpoint hostnames, or restore generated domains.

alien dev deployments set-domains [OPTIONS] --resource <RESOURCE> <ID>

Argument	Description
`<ID>`	Deployment ID or reference.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--resource <RESOURCE>`
`--endpoint <ENDPOINTS>`	Endpoint name and hostname (repeat for each endpoint).
`--clear`	Restore generated domains for this resource.
`--json`

`alien dev deployments create`

Create a new deployment.

alien dev deployments create [OPTIONS] --name <NAME> --project <PROJECT> --deployment-group <DEPLOYMENT_GROUP> --platform <PLATFORM>

Flag	Description
`--name <NAME>`	Deployment display name.
`--port <PORT>`	Dev server port. Default: `9090`.
`--deployment-group <DEPLOYMENT_GROUP>`	Deployment group ID (required).
`--platform <PLATFORM>`	Platform (aws, gcp, azure).
`--resource-prefix <RESOURCE_PREFIX>`	Physical-name prefix for generated cloud resources. Omit to let the manager generate one.
`--env <ENV>`	Plain environment variables in KEY=VALUE format (can be used multiple times).
`--secret <SECRET>`	Secret environment variables in KEY=VALUE format (can be used multiple times).
`--env-targeted <ENV_TARGETED>`	Plain environment variables with target functions in KEY=VALUE:pattern1,pattern2 format (can be used multiple times).
`--secret-targeted <SECRET_TARGETED>`	Secret environment variables with target functions in KEY=VALUE:pattern1,pattern2 format (can be used multiple times).
`--no-push`	Disable push (Operator handles deployments instead of manager).
`--no-heartbeat`	Disable heartbeat capability.
`--monitoring <MONITORING>`	Telemetry / monitoring mode. "auto" (default) uses the parent manager's built-in log store or external OTLP integration. "off" disables all monitoring. Values: `auto` (Automatically use the best available OTLP config: the parent manager's built-in log store or external OTLP integration (e.g. Axiom, Datadog)), `off` (Disable all monitoring: no OTLP logs for containers or worker VMs). Default: `auto`.

Network options:

Flag	Description
`--endpoint-access <ENDPOINT_ACCESS>`	Who can reach public endpoints: internet or private (AWS managed containers only).
`--network <NETWORK_MODE>`	Network mode: auto, use-default, create, byo. auto (system decides (create VPC if containers need it, skip otherwise) use-default ) use cloud provider's default VPC (fast, good for dev) create (create an isolated VPC (production-grade) byo ) bring your own VPC/VNet. Default: `auto`.
`--network-cidr <NETWORK_CIDR>`	VPC CIDR block (create mode only, auto-generated if omitted).
`--availability-zones <AVAILABILITY_ZONES>`	Number of availability zones (create mode only, default: 2).
`--vpc-id <VPC_ID>`	Existing VPC ID (byo mode, AWS).
`--public-subnet-ids <PUBLIC_SUBNET_IDS>`	Comma-separated public subnet IDs (byo mode, AWS).
`--private-subnet-ids <PRIVATE_SUBNET_IDS>`	Comma-separated private subnet IDs (byo mode, AWS).
`--security-group-ids <SECURITY_GROUP_IDS>`	Comma-separated security group IDs (byo mode, AWS, optional).
`--network-name <NETWORK_NAME>`	Existing VPC network name (byo mode, GCP).
`--subnet-name <SUBNET_NAME>`	Subnet name (byo mode, GCP).
`--network-region <NETWORK_REGION>`	Subnet region (byo mode, GCP).
`--vnet-resource-id <VNET_RESOURCE_ID>`	Existing VNet resource ID (byo mode, Azure).
`--public-subnet-name <PUBLIC_SUBNET_NAME>`	Public subnet name (byo mode, Azure).
`--private-subnet-name <PRIVATE_SUBNET_NAME>`	Private subnet name (byo mode, Azure).
`--format <FORMAT>`	Output format (json or text). Default: `text`.

`alien dev deployments ls`

List deployments.

Alias: list.

alien dev deployments ls [OPTIONS]

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--json`	Print machine-readable JSON.

`alien dev deployments get`

Get deployment details.

Alias: describe, show, status.

alien dev deployments get [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Print machine-readable JSON.
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev deployments resources`

Show a safe resource summary without resource configuration or secrets.

alien dev deployments resources [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Print stable machine-readable JSON.
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev deployments events`

Show deployment lifecycle and configuration events.

alien dev deployments events [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--limit <LIMIT>`	Maximum number of recent events to return. Default: `20`.
`--port <PORT>`	Dev server port. Default: `9090`.
`--json`	Print the API response as machine-readable JSON.

`alien dev deployments wait`

Wait until a deployment is ready or reaches a terminal state.

alien dev deployments wait [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--for <CONDITION>`	Condition to wait for. Values: `ready` (Running with the desired release applied), `terminal` (Any synchronized success or failure state), `deleted` (Fully deleted). Default: `ready`.
`--port <PORT>`	Dev server port. Default: `9090`.
`--timeout <TIMEOUT>`	Maximum wait duration in seconds, or with a unit such as 30s, 10m, or 1h. Default: `10m`.
`--interval <INTERVAL>`	Poll interval in seconds, optionally suffixed with s, m, or h. Default: `2s`.
`--json`	Print a stable machine-readable result.

`alien dev deployments machines`

Show the machines connected to a deployment.

alien dev deployments machines [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Print the complete inventory as machine-readable JSON.
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev deployments drain-machine`

Drain a machine so its workloads move to other machines.

The machine stops taking new work and its replicas are rescheduled. Undo it with alien deployments cancel-machine-drain.

alien dev deployments drain-machine [OPTIONS] <ID> <MACHINE_ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.
`<MACHINE_ID>`	Machine ID, as shown by `alien deployments machines`.

Flag	Description
`--deadline <DEADLINE>`	Report the drain as overdue if it hasn't finished after this long, such as 30m.
`--port <PORT>`	Dev server port. Default: `9090`.
`--force`	Stop the machine's replicas without waiting for healthy replacements.
`--yes`	Skip the confirmation prompt for --force.
`--json`	Print the result as machine-readable JSON.

`alien dev deployments cancel-machine-drain`

Cancel a machine drain so the machine takes work again.

alien dev deployments cancel-machine-drain [OPTIONS] <ID> <MACHINE_ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.
`<MACHINE_ID>`	Machine ID, as shown by `alien deployments machines`.

Flag	Description
`--json`	Print the result as machine-readable JSON.
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev deployments remove-machine`

Remove a machine from a deployment.

Drain the machine first so its workloads move. A removed machine can't rejoin with its old identity.

alien dev deployments remove-machine [OPTIONS] <ID> <MACHINE_ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.
`<MACHINE_ID>`	Machine ID, as shown by `alien deployments machines`.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--yes`	Skip confirmation prompt.
`--json`	Print the result as machine-readable JSON.

`alien dev deployments join-tokens`

List, create, rotate, and revoke tokens that join hosts to a Machines deployment.

Alias: join-token.

alien dev deployments join-tokens [OPTIONS] <COMMAND>

Subcommand	Description
`list`	List a deployment's join tokens.
`create`	Create a join token. Existing tokens keep working.
`rotate`	Revoke every join token and create a new one.
`revoke`	Revoke one join token. Hosts that already joined keep running.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev deployments join-tokens list`

List a deployment's join tokens.

Alias: ls.

alien dev deployments join-tokens list [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Print machine-readable JSON.
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev deployments join-tokens create`

Create a join token. Existing tokens keep working.

alien dev deployments join-tokens create [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Print the token and join details as JSON.
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev deployments join-tokens rotate`

Revoke every join token and create a new one.

alien dev deployments join-tokens rotate [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--yes`	Skip confirmation prompt.
`--json`	Print the token and join details as JSON.

`alien dev deployments join-tokens revoke`

Revoke one join token. Hosts that already joined keep running.

alien dev deployments join-tokens revoke [OPTIONS] <ID> <TOKEN_ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.
`<TOKEN_ID>`	Token ID, as shown by `alien deployments join-tokens list`.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--yes`	Skip confirmation prompt.
`--json`	Print the result as machine-readable JSON.

`alien dev deployments volumes`

Show container volumes, their latest snapshots and restores.

alien dev deployments volumes [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Print machine-readable JSON.
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev deployments restore-volume`

Replace a replica's persistent volume with a volume made from a snapshot.

The replica is stopped while its volume is swapped. The replaced volume is snapshotted before it is deleted, so the restore can be undone by restoring that snapshot.

alien dev deployments restore-volume [OPTIONS] --resource <RESOURCE> --ordinal <ORDINAL> --snapshot <SNAPSHOT> <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--resource <RESOURCE>`	Container resource that owns the volume.
`--ordinal <ORDINAL>`	Replica ordinal whose volume is replaced.
`--snapshot <SNAPSHOT>`	Snapshot to restore, as shown by `alien deployments volumes`.
`--yes`	Skip confirmation prompt.
`--json`	Print the restore request as machine-readable JSON.

`alien dev deployments cancel-volume-restore`

Cancel a pending volume restore.

Use it when a restore keeps failing. A restore whose volume was already swapped still finishes.

alien dev deployments cancel-volume-restore [OPTIONS] <ID> <REQUEST_ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.
`<REQUEST_ID>`	Restore request ID, as shown by `alien deployments volumes`.

Flag	Description
`--json`	Print the cancelled request as machine-readable JSON.
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev deployments delete`

Delete a deployment.

alien dev deployments delete [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--force <DEPLOYMENT_NAME>`	Force-delete: remove Alien's record without touching your cloud, so the deployment group accepts new deployments again. For a deployment whose stack is already gone or whose cleanup keeps failing. Takes the deployment's name as confirmation; nothing is sent unless it matches. Cannot be combined with --yes.
`--port <PORT>`	Dev server port. Default: `9090`.
`--erase-data`	Permanently erase durable data instead of retaining it.
`--yes`	Skip confirmation prompt.

`alien dev deployments retry`

Retry a deployment.

alien dev deployments retry [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Print the updated deployment as machine-readable JSON.
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev deployments redeploy`

Redeploy a deployment with the same release.

alien dev deployments redeploy [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--wait`	Wait for this exact redeploy operation to finish.
`--timeout <TIMEOUT>`	Maximum wait duration when --wait is used. Default: `10m`.
`--interval <INTERVAL>`	Poll interval when --wait is used. Default: `2s`.
`--json`	Print the updated deployment as machine-readable JSON.

`alien dev deployments move`

Move a deployment to another group without changing its runtime.

alien dev deployments move [OPTIONS] --deployment-group <DEPLOYMENT_GROUP> <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--deployment-group <DEPLOYMENT_GROUP>`	Destination deployment group ID.
`--port <PORT>`	Dev server port. Default: `9090`.
`--dry-run`	Preview eligibility without changing membership.
`--expected-membership-revision <EXPECTED_MEMBERSHIP_REVISION>`	Revision from a previous preview (otherwise preview immediately).
`--json`	Print the server response as machine-readable JSON.

`alien dev deployments pin`

Pin a deployment to a specific release.

alien dev deployments pin [OPTIONS] <ID> [RELEASE_ID]

Argument	Description
`<ID>`	Deployment ID.
`[RELEASE_ID]`	Release ID to pin to (omit to unpin and use active release).

Flag	Description
`--json`	Print the pin response as machine-readable JSON.
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev deployments set-compute`

Change machine counts, machine type, or quota warning overrides of a deployment.

Pass --machines for a fixed pool, or --min and --max for an autoscaling pool; switching between them changes the pool's mode. The update replaces the deployment's whole pool map with the saved pools plus this change, so other pools are sent back as they were read. Container CPU and memory settings are not sent and stay as they are. Adding or removing pools, or changing their placement, needs a new setup.

alien dev deployments set-compute [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--pool <POOL>`	Pool to change (required when the deployment has more than one).
`--port <PORT>`	Dev server port. Default: `9090`.
`--machines <MACHINES>`	Fixed number of machines.
`--min <MIN>`	Minimum machine count for an autoscaling pool.
`--max <MAX>`	Maximum machine count for an autoscaling pool.
`--machine <MACHINE>`	Provider machine type, such as m6i.large. It must keep the pool's CPU architecture; the pool's machines are replaced to apply it.
`--quota-warning-override <QUOTA_WARNING_OVERRIDES>`	Downgrade a quota failure to a visible warning (repeatable; replaces the saved list).
`--clear-quota-warning-overrides`	Remove all saved quota warning overrides.
`--yes`	Skip the confirmation prompt when scaling a pool to 0 machines.
`--json`	Print the update result as machine-readable JSON.

`alien dev deployments set-env`

Replace the environment variables of a deployment.

The variables you pass become the full set: any variable not listed is removed. Variables backed by stack inputs are kept; change those with alien deployments set-inputs.

alien dev deployments set-env [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--env <ENV>`	Plain environment variables in KEY=VALUE format (can be used multiple times).
`--port <PORT>`	Dev server port. Default: `9090`.
`--secret <SECRET>`	Secret environment variables in KEY=VALUE format (can be used multiple times).
`--env-targeted <ENV_TARGETED>`	Plain environment variables with target resources in KEY=VALUE:pattern1,pattern2 format (can be used multiple times).
`--secret-targeted <SECRET_TARGETED>`	Secret environment variables with target resources in KEY=VALUE:pattern1,pattern2 format (can be used multiple times).
`--clear`	Remove every environment variable.
`--yes`	Skip confirmation prompt.
`--json`	Print the result as machine-readable JSON.

`alien dev deployments inputs`

Show a deployment's stack inputs and their current values.

alien dev deployments inputs [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Print machine-readable JSON.
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev deployments set-inputs`

Change stack inputs of a deployment.

Values are read as in alien deploy: a JSON array of strings is a list, and anything else is text that Alien converts to the type the input declares (a number, true or false, or a comma-separated list). Inputs you don't pass keep their saved values.

alien dev deployments set-inputs [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--input <INPUTS>`	Input value in ID=VALUE format (can be used multiple times).
`--port <PORT>`	Dev server port. Default: `9090`.
`--secret-input <SECRET_INPUTS>`	Secret input value in ID=VALUE format, sent as text (can be used multiple times).
`--clear <CLEAR>`	Input to reset to its default (can be used multiple times).
`--json`	Print the saved inputs as machine-readable JSON.

`alien dev deployments check`

Ask the manager to check the deployment's health now.

alien dev deployments check [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Print the result as machine-readable JSON.
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev deployments set-channel`

Change the channel followed by an unpinned deployment.

alien dev deployments set-channel [OPTIONS] <ID> <CHANNEL>

Argument	Description
`<ID>`	Deployment ID.
`<CHANNEL>`	Channel to follow.

Flag	Description
`--json`	Print the updated deployment as machine-readable JSON.
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev deployments token`

Create a deployment token (deployment-scoped API key).

Alias: tokens.

alien dev deployments token [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID.

Flag	Description
`--json`	Print the token and deployment ID as JSON.
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev deployments untrack`

Forget a deployment this machine tracks locally, discarding its stored key.

alien dev deployments untrack [OPTIONS] <NAME>

Argument	Description
`<NAME>`	Deployment name, as passed to `alien deploy --name`.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev releases`

Release commands against the local manager.

alien dev releases [OPTIONS] <COMMAND>

Subcommand	Description
`ls`	List releases, newest first.
`get`	Show a release and how far it has rolled out across deployments.
`promote`	Move a channel to an existing release.
`channels`	List the project's release channels.
`create-channel`	Create a release channel.
`delete-channel`	Delete a non-production release channel.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev releases ls`

List releases, newest first.

Alias: list.

alien dev releases ls [OPTIONS]

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--channel <CHANNEL>`	Only show releases that have been selected by this channel (defaults to production).
`--all-channels`	Include releases that are not currently selected by any channel.
`--json`	Emit the manager API response as machine-readable JSON.

`alien dev releases get`

Show a release and how far it has rolled out across deployments.

Alias: describe, show.

alien dev releases get [OPTIONS] <ID>

Argument	Description
`<ID>`	Release ID (`rel_…`).

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--json`	Emit machine-readable JSON.

`alien dev releases promote`

Move a channel to an existing release.

alien dev releases promote [OPTIONS] <ID>

Argument	Description
`<ID>`	Release ID (`rel_…`).

Flag	Description
`--channel <CHANNEL>`	Channel to advance. Default: `production`.
`--port <PORT>`	Dev server port. Default: `9090`.
`--json`	Emit machine-readable JSON.

`alien dev releases channels`

List the project's release channels.

alien dev releases channels [OPTIONS]

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--json`

`alien dev releases create-channel`

Create a release channel.

alien dev releases create-channel [OPTIONS] <NAME>

Argument	Description
`<NAME>`

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--release <RELEASE>`	Optional release to select initially.
`--json`

`alien dev releases delete-channel`

Delete a non-production release channel.

alien dev releases delete-channel [OPTIONS] <NAME>

Argument	Description
`<NAME>`

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev whoami`

Show local manager identity information.

alien dev whoami [OPTIONS]

Flag	Description
`--json`	Emit structured JSON output.
`--port <PORT>`	Dev server port. Default: `9090`.

Examples:

alien whoami
alien whoami --json
alien dev whoami

`alien dev deploy`

Deploy to the local manager.

alien dev deploy [OPTIONS]

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--token <TOKEN>`	Deployment API key for authentication (optional if deployment is already tracked).
`--token-file <TOKEN_FILE>`	Read the deployment API key from a file instead of exposing it in command arguments.
`--name <NAME>`	Deployment name for identification in tracking.
`--deployment-group <DEPLOYMENT_GROUP>`	Existing deployment group ID, name, or external ID for a new deployment. The group is inferred when --token contains a deployment-group key.
`--platform <PLATFORM>`	Target platform for the deployment (aws, gcp, azure, machines).
`--machines`	Create or update a Machines deployment and print a host join command.
`--config <CONFIG>`	TOML file containing deployment settings.
`--quota-warning-override <QUOTA_WARNING_OVERRIDES>`	Downgrade a quota failure to a visible warning for this deployment (repeatable).
`--clear-quota-warning-overrides`	Remove all saved quota warning overrides from this deployment.
`--validate-only`	Validate the config locally without authentication, API calls, or deployment tracking.
`--input <INPUT_VALUES>`	Stack input value for setup (id=value).
`--secret-input <SECRET_INPUT_VALUES>`	Secret stack input value for setup (id=value).
`--setup-item <SETUP_ITEM>`	Customer setup item to install, for a deployment-group token whose group offers more than one. The API rejects the request without it. Values: `application` (The application itself), `models` (AI models in the customer's cloud), `keys` (Customer-managed encryption keys), `storage` (A storage bucket in the customer's cloud), `registry` (A container registry in the customer's cloud), `sandbox` (A remote sandbox).
`--public-subdomain <PUBLIC_SUBDOMAIN>`	Public subdomain for deployments in your own environment. This is only accepted when creating a new deployment without --token.
`--resource-prefix <RESOURCE_PREFIX>`	Physical-name prefix for generated cloud resources. Omit to let the manager generate one.
`--no-heartbeat`	Disable heartbeat capability.
`--automatic-setup`	Grant ongoing setup permissions for a new deployment in your own AWS, GCP or Azure environment. Alien can then add and change infrastructure without a separate setup run.
`--monitoring <MONITORING>`	Telemetry / monitoring mode. "auto" (default) uses the parent manager's built-in log store or external OTLP integration. "off" disables all monitoring. Values: `auto` (Automatically use the best available OTLP config: the parent manager's built-in log store or external OTLP integration (e.g. Axiom, Datadog)), `off` (Disable all monitoring: no OTLP logs for containers or worker VMs). Default: `auto`.
`--manager <MANAGER>`	Manager to use for deployment. Omit for auto-resolve (platform resolves from deployment record). Use "none" to deploy without a manager (e.g., bootstrapping the manager itself). Or pass a specific manager ID.
`--channel <CHANNEL>`	Release channel followed by a newly created deployment. Default: `production`.

Network options:

Flag	Description
`--endpoint-access <ENDPOINT_ACCESS>`	Who can reach public endpoints: internet or private (AWS managed containers only).
`--network <NETWORK_MODE>`	Network mode: auto, use-default, create, byo. auto (system decides (create VPC if containers need it, skip otherwise) use-default ) use cloud provider's default VPC (fast, good for dev) create (create an isolated VPC (production-grade) byo ) bring your own VPC/VNet. Default: `auto`.
`--network-cidr <NETWORK_CIDR>`	VPC CIDR block (create mode only, auto-generated if omitted).
`--availability-zones <AVAILABILITY_ZONES>`	Number of availability zones (create mode only, default: 2).
`--vpc-id <VPC_ID>`	Existing VPC ID (byo mode, AWS).
`--public-subnet-ids <PUBLIC_SUBNET_IDS>`	Comma-separated public subnet IDs (byo mode, AWS).
`--private-subnet-ids <PRIVATE_SUBNET_IDS>`	Comma-separated private subnet IDs (byo mode, AWS).
`--security-group-ids <SECURITY_GROUP_IDS>`	Comma-separated security group IDs (byo mode, AWS, optional).
`--network-name <NETWORK_NAME>`	Existing VPC network name (byo mode, GCP).
`--subnet-name <SUBNET_NAME>`	Subnet name (byo mode, GCP).
`--network-region <NETWORK_REGION>`	Subnet region (byo mode, GCP).
`--vnet-resource-id <VNET_RESOURCE_ID>`	Existing VNet resource ID (byo mode, Azure).
`--public-subnet-name <PUBLIC_SUBNET_NAME>`	Public subnet name (byo mode, Azure).
`--private-subnet-name <PRIVATE_SUBNET_NAME>`	Private subnet name (byo mode, Azure).

Examples:

# Deploy to your own AWS environment
alien deploy --name production --platform aws --secret-input apiKey=...

# Deploy into an existing customer deployment group
alien deploy --deployment-group customer-123 --name production --platform aws

# Create a Machines deployment and print a host join command
alien deploy --name eu-prod --machines

# Set up a deployment from a customer deployment-group token
alien deploy --token dg_abc123... --name production --platform aws

# Deploy an existing deployment (uses stored API key)
alien deploy --name production --platform aws

# Read a deployment token from a protected file
alien deploy --token-file deployment-token.txt --name prod --platform aws

# Deploy without heartbeat capability
alien deploy --token ax_deployment_xyz... --name prod --platform aws --no-heartbeat

`alien dev destroy`

Destroy from the local manager.

alien dev destroy [OPTIONS] --name <NAME>

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--token <TOKEN>`	Deployment API key for setup teardown (optional with local tracking or an Alien login).
`--name <NAME>`	Deployment ID, <group>/<name>, or a unique deployment name in the selected project.
`--platform <PLATFORM>`	Target platform (required by `alien destroy`; `alien dev destroy` is always local).
`--force`	Force-destroy: skip resource teardown and delete the record immediately.
`--erase-data`	Permanently erase durable data instead of retaining it. Also erases data an earlier destroy kept.
`--yes`	Skip confirmation for cloud destruction (local dev destruction never prompts).

Examples:

# Destroy a tracked deployment
alien destroy --name production --platform aws

# Force-destroy (skip resource teardown)
alien destroy --name production --platform aws --force

`alien dev release`

Create a release on the local manager.

alien dev release [OPTIONS]

Flag	Description
`--platforms <PLATFORMS>`	Target platforms to release (comma-separated). If not specified, auto-discovers from the manager's configured artifact registries, or releases all built platforms.
`--port <PORT>`	Dev server port. Default: `9090`.
`--no-git`	Skip git metadata collection.
`--no-stack`	Declare a stackless release: record a version (and git metadata) without building or pushing a stack. Use this to declare/enrich the release an operate (BYOC) environment is running. Requires --version.
`--channel <CHANNEL>`	Channel to advance after creating the release. Default: `production`.
`--no-promote`	Create the release without advancing a channel or scheduling deployment updates.
`--title <TITLE>`	Human-readable title for this release.
`--json`	Emit result JSON on stdout and plain progress lines on stderr. On failure, stderr ends with one JSON error document on its own line.
`--base-platform <BASE_PLATFORM>`	Base cloud platform for Kubernetes auto-builds. This keeps the release stack under Kubernetes while using the managed cluster's default architecture when auto-building missing artifacts.
`--prebuilt`	Skip the build and release the existing `.alien` output. Still pushes any local artifacts it contains, and reuses images that are already remote URIs.
`--targets <TARGETS>`	Target OS/architecture combinations to build for (comma-separated). Same format as `alien build --targets`: e.g. `linux-x64`, `linux-arm64`. When omitted, targets follow the compute pools' CPU architecture, or the platform default if no pool specifies one. AWS daemons requiring nested virtualization default to `linux-x64`; other AWS deployments retain the `linux-arm64` default. Explicit targets must match the stack's compute requirements.
`--image-repo <IMAGE_REPO>`	Image repository URL (manual override - skips platform manager).
`--registry-auth <REGISTRY_AUTH>`	Registry auth: "basic" or "anonymous".
`--registry-protocol <REGISTRY_PROTOCOL>`	Registry protocol: "http" or "https".
`--registry-username <REGISTRY_USERNAME>`	Registry username (required for basic auth).
`--registry-password <REGISTRY_PASSWORD>`	Registry password (required for basic auth).

Examples:

# Standard release (auto-discovers platforms from manager config)
alien release

# Release for specific project (skip linking)
alien release --project my-project

# Release specific platforms only
alien release --platforms aws
alien release --platforms aws,gcp

# Skip the build and release the existing build output (still pushes local artifacts)
alien release --prebuilt

# Create a release now and promote its saved ID later
alien release --no-promote
alien releases promote <release-id> --channel production

# Output JSON (for scripting/automation)
alien release --json

# Manual registry override (for deploying manager or custom setups)
alien release --image-repo my-registry.com/my-app --registry-auth basic --registry-username user --registry-password pass

# Skip git metadata collection
alien release --no-git

`alien dev vault`

Manage vault secrets for local dev deployments.

alien dev vault [OPTIONS] <COMMAND>

Subcommand	Description
`set`	Set a secret value in a vault.
`get`	Get a secret value from a vault.
`delete`	Delete a secret from a vault.
`list`	List all secrets in a vault.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--deployment <DEPLOYMENT>`	Target deployment ID or name (default: "default"). Default: `default`.
`--state-dir <STATE_DIR>`	State directory (default: .alien). Default: `.alien`.

`alien dev vault set`

Set a secret value in a vault.

alien dev vault set [OPTIONS] <VAULT_NAME> <SECRET_NAME> [VALUE]

Argument	Description
`<VAULT_NAME>`	Vault name (e.g., "customer-secrets").
`<SECRET_NAME>`	Secret name (e.g., "GITHUB_TOKEN").
`[VALUE]`	Secret value (prefer --stdin to keep it out of process arguments).

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--stdin`	Read the exact secret bytes from stdin, without trimming whitespace.
`--file <FILE>`	Read a UTF-8 file exactly, without adding a newline or exposing the value in arguments.
`--deployment <DEPLOYMENT>`	Target deployment ID or name (default: "default"). Default: `default`.

`alien dev vault get`

Get a secret value from a vault.

alien dev vault get [OPTIONS] <VAULT_NAME> <SECRET_NAME>

Argument	Description
`<VAULT_NAME>`	Vault name.
`<SECRET_NAME>`	Secret name.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--deployment <DEPLOYMENT>`	Target deployment ID or name (default: "default"). Default: `default`.

`alien dev vault delete`

Delete a secret from a vault.

alien dev vault delete [OPTIONS] <VAULT_NAME> <SECRET_NAME>

Argument	Description
`<VAULT_NAME>`	Vault name.
`<SECRET_NAME>`	Secret name.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--deployment <DEPLOYMENT>`	Target deployment ID or name (default: "default"). Default: `default`.

`alien dev vault list`

List all secrets in a vault.

alien dev vault list [OPTIONS] <VAULT_NAME>

Argument	Description
`<VAULT_NAME>`	Vault name.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--deployment <DEPLOYMENT>`	Target deployment ID or name (default: "default"). Default: `default`.

`alien dev commands`

Invoke remote commands on local dev deployments.

alien dev commands [OPTIONS] <COMMAND>

Subcommand	Description
`invoke`	Invoke a command on a deployment and wait for the result.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.

`alien dev commands invoke`

Invoke a command on a deployment and wait for the result.

alien dev commands invoke [OPTIONS] --deployment <DEPLOYMENT> --command <COMMAND>

Flag	Description
`--deployment <DEPLOYMENT>`	Deployment ID, or <deployment-group-name>/<deployment-name>.
`--port <PORT>`	Dev server port. Default: `9090`.
`--command <COMMAND>`	Command name to invoke.
`--target <TARGET>`	Resource ID to invoke when several resources handle commands.
`--params <PARAMS>`	Command parameters as JSON (default: {}). Default: `{}`.
`--timeout <TIMEOUT>`	Timeout in seconds (default: 60). Default: `60`.

`alien dev debug`

Run a local command against a local dev deployment using manager-side credentials.

alien dev debug [OPTIONS] [DEPLOYMENT] [-- <CMD>...] [COMMAND]

Subcommand	Description
`shell`	Open an interactive shell in the deployment runtime.
`exec`	Run a non-interactive command in the deployment runtime.

Argument	Description
`[DEPLOYMENT]`	Deployment ID (`dep_...`) or `<group>/<name>`.
`[CMD]...`	Command and arguments to execute. Everything after `--` is forwarded verbatim. If omitted, an interactive shell ($SHELL, or /bin/sh) is spawned instead.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--access-request <ACCESS_REQUEST>`	Access request id (`ar_...`) authorizing this debug session. Required for Remote Operator (pull-mode Kubernetes) deployments, where debugging shares the same approval flow as `alien operations invoke`. Create one with `alien access-requests create --debug-tool <kubectl\|aws\|gcloud\|az> ...`.
`--request-access`	Shortcut: create a debug-tool access request for this deployment, wait for customer approval, then start the session against it. Creates the same access-request resource as `alien access-requests create --debug-tool ...`.
`--access-duration <ACCESS_DURATION>`	Requested approval duration for `--request-access`, e.g. 30m, 1h. Informational until approved; the approver sets the actual grant window. Default: `30m`.
`--access-cloud-scope <ACCESS_CLOUD_SCOPE>`	Scope the `--request-access` grant to a specific cloud account/project/ subscription, e.g. `123456789012/prod-readonly`. Only meaningful for aws/gcloud/az (kubectl scopes by namespace, derived automatically from the debugged command). Omit for an unscoped grant covering the whole deployment's cloud identity.
`--json`	Emit errors as JSON. The spawned command's stdout/stderr are always passed through unchanged.

Examples:

alien debug dep_abc123 -- aws sts get-caller-identity
alien debug acme/prod -- gcloud projects list
alien debug acme/prod -- kubectl get pods

# Remote Operator (pull-mode Kubernetes) deployments require an approved
# access request covering the tool + namespace/scope you're debugging:
alien access-requests create --deployment acme/prod \
  --debug-tool kubectl --debug-namespace acme --duration 30m
alien debug acme/prod --access-request ar_123 -- kubectl get pods -n acme

# No `--` arg drops you into a local interactive shell with the env set:
alien debug acme/prod

# Open an interactive shell in a Local deployment runtime:
alien debug shell acme/prod

# Run a non-interactive command in a Local deployment runtime:
alien debug exec acme/prod -- uname -a
alien debug exec acme/prod -- powershell.exe -NoLogo -Command Get-Process

`alien dev debug shell`

Open an interactive shell in the deployment runtime.

alien dev debug shell [OPTIONS] <DEPLOYMENT>

Argument	Description
`<DEPLOYMENT>`	Deployment ID (`dep_...`) or `<group>/<name>`.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--resource <RESOURCE>`	Container or daemon resource ID to attach to.
`--machine <MACHINE>`	Machine ID to attach to directly.
`--json`	Emit errors as JSON.

Examples:

alien debug shell acme/prod

`alien dev debug exec`

Run a non-interactive command in the deployment runtime.

alien dev debug exec [OPTIONS] <DEPLOYMENT> -- <CMD>...

Argument	Description
`<DEPLOYMENT>`	Deployment ID (`dep_...`) or `<group>/<name>`.
`<CMD>...`	Command and arguments to execute remotely.

Flag	Description
`--port <PORT>`	Dev server port. Default: `9090`.
`--resource <RESOURCE>`	Container or daemon resource ID to attach to.
`--machine <MACHINE>`	Machine ID to attach to directly.
`--timeout-seconds <TIMEOUT_SECONDS>`	Timeout in seconds for the remote command. Default: `120`.
`--json`	Emit structured JSON with captured output.

Examples:

alien debug exec acme/prod -- uname -a
alien debug exec acme/prod -- powershell.exe -NoLogo -Command Get-Process

Build and release

`alien build`

Build the Alien application.

alien build [OPTIONS]

Subcommand	Description
`plan`	Compute the native-runner build groups for the stack's supported platforms.
`merge`	Merge partial build outputs (one per native runner) into one `.alien` directory.

Flag	Description
`-c, --config <CONFIG>`	Path to alien.ts/js/json file or directory containing it.
`-o, --output-dir <OUTPUT_DIR>`	Output directory.
`--platforms <PLATFORMS>`	Target platforms (comma-separated). When omitted, uses platforms declared by the stack. Examples: aws, gcp, azure, aws,gcp.
`--targets <TARGETS>`	Target OS/architecture combinations (comma-separated).
`--aws-managing-account-id <AWS_MANAGING_ACCOUNT_ID>`	AWS managing account ID.
`--base-platform <BASE_PLATFORM>`	Base cloud platform for Kubernetes builds. This keeps the output platform as Kubernetes while using the managed cluster's default architecture.
`--cache-url <CACHE_URL>`	Cache URL for build caching (for example s3://bucket/path).
`--json`	Emit result JSON on stdout and plain progress lines on stderr. On failure, stderr ends with one JSON error document on its own line.

Examples:

alien build --platform aws
alien build --platforms aws,gcp
alien build --platform aws --targets linux-arm64
alien build --config ../my-app/alien.ts --output-dir ./build --platform aws
alien build --platform aws --json
alien build plan --json
alien build merge --input ./build-artifacts --output .alien

`alien build plan`

Compute the native-runner build groups for the stack's supported platforms.

alien build plan [OPTIONS]

Flag	Description
`-c, --config <CONFIG>`	Path to alien.ts/js/json file or directory containing it.
`--json`	Emit structured JSON output.

Examples:

alien build plan
alien build plan --json

`alien build merge`

Merge partial build outputs (one per native runner) into one .alien directory.

alien build merge [OPTIONS] --input <INPUT> --output <OUTPUT>

Flag	Description
`--input <INPUT>`	Directory of downloaded partial outputs (each subdir holds `build/<platform>/`).
`--output <OUTPUT>`	Output directory for the merged `.alien` build.
`--json`	Emit structured JSON output.

Examples:

alien build merge --input ./build-artifacts --output .alien

`alien release`

Push images and create a release.

alien release [OPTIONS]

Flag	Description
`--platforms <PLATFORMS>`	Target platforms to release (comma-separated). If not specified, auto-discovers from the manager's configured artifact registries, or releases all built platforms.
`--no-git`	Skip git metadata collection.
`--no-stack`	Declare a stackless release: record a version (and git metadata) without building or pushing a stack. Use this to declare/enrich the release an operate (BYOC) environment is running. Requires --version.
`--channel <CHANNEL>`	Channel to advance after creating the release. Default: `production`.
`--no-promote`	Create the release without advancing a channel or scheduling deployment updates.
`--title <TITLE>`	Human-readable title for this release.
`--json`	Emit result JSON on stdout and plain progress lines on stderr. On failure, stderr ends with one JSON error document on its own line.
`--base-platform <BASE_PLATFORM>`	Base cloud platform for Kubernetes auto-builds. This keeps the release stack under Kubernetes while using the managed cluster's default architecture when auto-building missing artifacts.
`--prebuilt`	Skip the build and release the existing `.alien` output. Still pushes any local artifacts it contains, and reuses images that are already remote URIs.
`--targets <TARGETS>`	Target OS/architecture combinations to build for (comma-separated). Same format as `alien build --targets`: e.g. `linux-x64`, `linux-arm64`. When omitted, targets follow the compute pools' CPU architecture, or the platform default if no pool specifies one. AWS daemons requiring nested virtualization default to `linux-x64`; other AWS deployments retain the `linux-arm64` default. Explicit targets must match the stack's compute requirements.
`--image-repo <IMAGE_REPO>`	Image repository URL (manual override - skips platform manager).
`--registry-auth <REGISTRY_AUTH>`	Registry auth: "basic" or "anonymous".
`--registry-protocol <REGISTRY_PROTOCOL>`	Registry protocol: "http" or "https".
`--registry-username <REGISTRY_USERNAME>`	Registry username (required for basic auth).
`--registry-password <REGISTRY_PASSWORD>`	Registry password (required for basic auth).

Examples:

# Standard release (auto-discovers platforms from manager config)
alien release

# Release for specific project (skip linking)
alien release --project my-project

# Release specific platforms only
alien release --platforms aws
alien release --platforms aws,gcp

# Skip the build and release the existing build output (still pushes local artifacts)
alien release --prebuilt

# Create a release now and promote its saved ID later
alien release --no-promote
alien releases promote <release-id> --channel production

# Output JSON (for scripting/automation)
alien release --json

# Manual registry override (for deploying manager or custom setups)
alien release --image-repo my-registry.com/my-app --registry-auth basic --registry-username user --registry-password pass

# Skip git metadata collection
alien release --no-git

`alien releases`

Release commands.

alien releases [OPTIONS] <COMMAND>

Subcommand	Description
`ls`	List releases, newest first.
`get`	Show a release and how far it has rolled out across deployments.
`promote`	Move a channel to an existing release.
`channels`	List the project's release channels.
`create-channel`	Create a release channel.
`delete-channel`	Delete a non-production release channel.

`alien releases ls`

List releases, newest first.

Alias: list.

alien releases ls [OPTIONS]

Flag	Description
`--channel <CHANNEL>`	Only show releases that have been selected by this channel (defaults to production).
`--all-channels`	Include releases that are not currently selected by any channel.
`--json`	Emit the manager API response as machine-readable JSON.

`alien releases get`

Show a release and how far it has rolled out across deployments.

Alias: describe, show.

alien releases get [OPTIONS] <ID>

Argument	Description
`<ID>`	Release ID (`rel_…`).

Flag	Description
`--json`	Emit machine-readable JSON.

`alien releases promote`

Move a channel to an existing release.

alien releases promote [OPTIONS] <ID>

Argument	Description
`<ID>`	Release ID (`rel_…`).

Flag	Description
`--channel <CHANNEL>`	Channel to advance. Default: `production`.
`--json`	Emit machine-readable JSON.

`alien releases channels`

List the project's release channels.

alien releases channels [OPTIONS]

Flag	Description
`--json`

`alien releases create-channel`

Create a release channel.

alien releases create-channel [OPTIONS] <NAME>

Argument	Description
`<NAME>`

Flag	Description
`--release <RELEASE>`	Optional release to select initially.
`--json`

`alien releases delete-channel`

Delete a non-production release channel.

alien releases delete-channel [OPTIONS] <NAME>

Argument	Description
`<NAME>`

`alien render`

Render setup artifacts for review.

alien render [OPTIONS] --format <FORMAT> --stack <STACK>

Flag	Description
`--format <FORMAT>`	Artifact format to render. Values: `cloudformation`, `terraform`, `helm`.
`--target <TARGET>`	Terraform target. Required for --format terraform. Values: `aws`, `gcp`, `azure`, `eks`, `gke`, `aks`.
`--stack <STACK>`	Path to alien.ts, alien.js, alien.json, or a directory containing one.
`--output <OUTPUT>`	Output directory. Defaults to stdout.
`--check-quotas`	Check AWS quotas for a new installation before writing artifacts. Uses target AWS credentials and region from the environment; apply must use the same account and region.
`--registration-mode <REGISTRATION_MODE>`	CloudFormation registration behavior. Values: `auto`, `outputs`, `both`. Default: `auto`.
`--notification-lambda-arn <NOTIFICATION_LAMBDA_ARN>`	Lambda ARN for CloudFormation auto-registration. Env: `ALIEN_CFN_NOTIFICATION_LAMBDA_ARN`.
`--stack-settings <STACK_SETTINGS>`	Optional YAML or JSON StackSettings override.
`--json`	Emit CloudFormation JSON instead of YAML.

`alien packages`

List, inspect, rebuild, and download project packages.

alien packages [OPTIONS] <COMMAND>

Subcommand	Description
`list`	List packages for a project.
`get`	Show one package and its outputs.
`rebuild`	Build the project's packages again from its package settings.
`cancel`	Cancel a pending or building package.
`download`	Download an artifact from a ready package.

Flag	Description
`--json`	Emit machine-readable JSON.

Examples:

alien packages list --status failed
alien packages get pkg_abc123
alien packages rebuild
alien packages cancel pkg_abc123
alien packages download pkg_abc123 --artifact linux-x64

`alien packages list`

List packages for a project.

Alias: ls.

alien packages list [OPTIONS]

Flag	Description
`--type <PACKAGE_TYPE>`	Filter by package type.
`--status <STATUS>`	Filter by package status.
`--search <SEARCH>`	Search package type or version.
`--json`	Emit machine-readable JSON.

`alien packages get`

Show one package and its outputs.

Alias: describe, show.

alien packages get [OPTIONS] <ID>

Argument	Description
`<ID>`	Package ID.

Flag	Description
`--json`	Emit machine-readable JSON.

`alien packages rebuild`

Build the project's packages again from its package settings.

Pending and building packages are cancelled and replaced by new versions. Use it when a build failed for a reason that is now fixed.

alien packages rebuild [OPTIONS]

Flag	Description
`--yes`	Skip the confirmation prompt.
`--json`	Emit machine-readable JSON.

`alien packages cancel`

Cancel a pending or building package.

alien packages cancel [OPTIONS] <ID>

Argument	Description
`<ID>`	Package ID.

Flag	Description
`--yes`	Skip the confirmation prompt.
`--json`	Emit machine-readable JSON.

`alien packages download`

Download an artifact from a ready package.

alien packages download [OPTIONS] <ID>

Argument	Description
`<ID>`	Package ID.

Flag	Description
`--artifact <ARTIFACT>`	Artifact path or unique suffix, such as `binaries.linux-x64` or `linux-x64`.
`-o, --output <OUTPUT>`	Destination file. Defaults to the artifact URL filename.
`--force`	Replace an existing destination file.
`--json`	Emit machine-readable JSON.

Customers and deployments

`alien onboard`

Create a deployment group and generate a deployment link.

alien onboard [OPTIONS] [NAME]

Argument	Description
`[NAME]`	Customer name.

Flag	Description
`--external-id <EXTERNAL_ID>`	Stable customer identifier used by your application. Defaults to a URL-safe form of NAME.
`--setup-items <SETUP_ITEMS>`	Customer infrastructure to include in the setup link. Values: `application` (The application itself), `models` (AI models in the customer's cloud), `keys` (Customer-managed encryption keys), `storage` (A storage bucket in the customer's cloud), `registry` (A container registry in the customer's cloud), `sandbox` (A remote sandbox). Default: `application`.
`--return-url <RETURN_URL>`	HTTPS destination when the customer leaves or finishes setup (maximum 2048 characters).
`--refresh-url <REFRESH_URL>`	HTTPS destination for expired or unavailable links. Must authenticate the user before minting a new link.
`--max-deployments <MAX_DEPLOYMENTS>`	Maximum number of deployments for this customer. Default: `100`.
`--json`	Output in JSON format (for scripting).
`--env <ENV_VARS>`	Plain environment variables for deployments created from this link (KEY=VALUE or KEY=VALUE:target1,target2).
`--secret <SECRET_VARS>`	Secret environment variables for deployments created from this link (KEY=VALUE or KEY=VALUE:target1,target2).
`--input <INPUT_VALUES>`	Stack input value provided before creating the deployment link (id=value).
`--secret-input <SECRET_INPUT_VALUES>`	Secret stack input value provided before creating the deployment link (id=value).
`--platforms <PLATFORMS>`	Platforms this deployment link can create deployments for (comma-separated). Defaults to every platform in the active release.
`--subdomain <SUBDOMAIN>`	Public subdomain to reserve for deployments created from this link.
`--airgapped`	The environment can't reach your manager: register its deployment now. The site keeps it up to date with `alien-deploy sync`.

`alien deployment-groups`

List, inspect, and change project deployment groups.

Alias: customers, customer.

alien deployment-groups [OPTIONS] <COMMAND>

Subcommand	Description
`list`	List deployment groups in the project.
`get`	Show deployment-group details.
`update`	Rename a deployment group or change its deployment limit.
`set-external-id`	Set or clear the ID your own systems use for a deployment group.
`delete`	Delete an empty deployment group and its API keys.

Flag	Description
`--json`	Emit stable machine-readable JSON.

Examples:

alien deployment-groups list
alien deployment-groups get customer_123
alien deployment-groups describe acme --json
alien deployment-groups update acme --max-deployments 5
alien deployment-groups set-external-id acme customer_123
alien deployment-groups delete acme --yes
alien onboard acme --external-id customer_123 --setup-items models,keys

`alien deployment-groups list`

List deployment groups in the project.

Alias: ls.

alien deployment-groups list [OPTIONS]

Flag	Description
`--search <SEARCH>`	Search deployment-group name or external ID.
`--json`	Emit stable machine-readable JSON.

`alien deployment-groups get`

Show deployment-group details.

Alias: describe, show.

alien deployment-groups get [OPTIONS] <CUSTOMER>

Argument	Description
`<CUSTOMER>`	Deployment-group ID, name, or external ID.

Flag	Description
`--json`	Emit stable machine-readable JSON.

`alien deployment-groups update`

Rename a deployment group or change its deployment limit.

alien deployment-groups update [OPTIONS] <CUSTOMER>

Argument	Description
`<CUSTOMER>`	Deployment-group ID, name, or external ID.

Flag	Description
`--name <NAME>`	New name: lowercase letters, numbers, and hyphens.
`--json`	Emit stable machine-readable JSON.
`--max-deployments <MAX_DEPLOYMENTS>`	Most deployments the group may hold.

`alien deployment-groups set-external-id`

Set or clear the ID your own systems use for a deployment group.

alien deployment-groups set-external-id [OPTIONS] <CUSTOMER> [EXTERNAL_ID]

Argument	Description
`<CUSTOMER>`	Deployment-group ID, name, or external ID.
`[EXTERNAL_ID]`	External ID, unique within the project.

Flag	Description
`--clear`	Remove the external ID.
`--json`	Emit stable machine-readable JSON.

`alien deployment-groups delete`

Delete an empty deployment group and its API keys.

Alias: rm.

alien deployment-groups delete [OPTIONS] <CUSTOMER>

Argument	Description
`<CUSTOMER>`	Deployment-group ID, name, or external ID.

Flag	Description
`--yes`	Skip confirmation prompt.
`--json`	Emit stable machine-readable JSON.

`alien deploy`

Deploy to a cloud platform.

alien deploy [OPTIONS]

Flag	Description
`--token <TOKEN>`	Deployment API key for authentication (optional if deployment is already tracked).
`--token-file <TOKEN_FILE>`	Read the deployment API key from a file instead of exposing it in command arguments.
`--name <NAME>`	Deployment name for identification in tracking.
`--deployment-group <DEPLOYMENT_GROUP>`	Existing deployment group ID, name, or external ID for a new deployment. The group is inferred when --token contains a deployment-group key.
`--platform <PLATFORM>`	Target platform for the deployment (aws, gcp, azure, machines).
`--machines`	Create or update a Machines deployment and print a host join command.
`--config <CONFIG>`	TOML file containing deployment settings.
`--quota-warning-override <QUOTA_WARNING_OVERRIDES>`	Downgrade a quota failure to a visible warning for this deployment (repeatable).
`--clear-quota-warning-overrides`	Remove all saved quota warning overrides from this deployment.
`--validate-only`	Validate the config locally without authentication, API calls, or deployment tracking.
`--input <INPUT_VALUES>`	Stack input value for setup (id=value).
`--secret-input <SECRET_INPUT_VALUES>`	Secret stack input value for setup (id=value).
`--setup-item <SETUP_ITEM>`	Customer setup item to install, for a deployment-group token whose group offers more than one. The API rejects the request without it. Values: `application` (The application itself), `models` (AI models in the customer's cloud), `keys` (Customer-managed encryption keys), `storage` (A storage bucket in the customer's cloud), `registry` (A container registry in the customer's cloud), `sandbox` (A remote sandbox).
`--public-subdomain <PUBLIC_SUBDOMAIN>`	Public subdomain for deployments in your own environment. This is only accepted when creating a new deployment without --token.
`--resource-prefix <RESOURCE_PREFIX>`	Physical-name prefix for generated cloud resources. Omit to let the manager generate one.
`--no-heartbeat`	Disable heartbeat capability.
`--automatic-setup`	Grant ongoing setup permissions for a new deployment in your own AWS, GCP or Azure environment. Alien can then add and change infrastructure without a separate setup run.
`--monitoring <MONITORING>`	Telemetry / monitoring mode. "auto" (default) uses the parent manager's built-in log store or external OTLP integration. "off" disables all monitoring. Values: `auto` (Automatically use the best available OTLP config: the parent manager's built-in log store or external OTLP integration (e.g. Axiom, Datadog)), `off` (Disable all monitoring: no OTLP logs for containers or worker VMs). Default: `auto`.
`--manager <MANAGER>`	Manager to use for deployment. Omit for auto-resolve (platform resolves from deployment record). Use "none" to deploy without a manager (e.g., bootstrapping the manager itself). Or pass a specific manager ID.
`--channel <CHANNEL>`	Release channel followed by a newly created deployment. Default: `production`.

Network options:

Flag	Description
`--endpoint-access <ENDPOINT_ACCESS>`	Who can reach public endpoints: internet or private (AWS managed containers only).
`--network <NETWORK_MODE>`	Network mode: auto, use-default, create, byo. auto (system decides (create VPC if containers need it, skip otherwise) use-default ) use cloud provider's default VPC (fast, good for dev) create (create an isolated VPC (production-grade) byo ) bring your own VPC/VNet. Default: `auto`.
`--network-cidr <NETWORK_CIDR>`	VPC CIDR block (create mode only, auto-generated if omitted).
`--availability-zones <AVAILABILITY_ZONES>`	Number of availability zones (create mode only, default: 2).
`--vpc-id <VPC_ID>`	Existing VPC ID (byo mode, AWS).
`--public-subnet-ids <PUBLIC_SUBNET_IDS>`	Comma-separated public subnet IDs (byo mode, AWS).
`--private-subnet-ids <PRIVATE_SUBNET_IDS>`	Comma-separated private subnet IDs (byo mode, AWS).
`--security-group-ids <SECURITY_GROUP_IDS>`	Comma-separated security group IDs (byo mode, AWS, optional).
`--network-name <NETWORK_NAME>`	Existing VPC network name (byo mode, GCP).
`--subnet-name <SUBNET_NAME>`	Subnet name (byo mode, GCP).
`--network-region <NETWORK_REGION>`	Subnet region (byo mode, GCP).
`--vnet-resource-id <VNET_RESOURCE_ID>`	Existing VNet resource ID (byo mode, Azure).
`--public-subnet-name <PUBLIC_SUBNET_NAME>`	Public subnet name (byo mode, Azure).
`--private-subnet-name <PRIVATE_SUBNET_NAME>`	Private subnet name (byo mode, Azure).

Examples:

# Deploy to your own AWS environment
alien deploy --name production --platform aws --secret-input apiKey=...

# Deploy into an existing customer deployment group
alien deploy --deployment-group customer-123 --name production --platform aws

# Create a Machines deployment and print a host join command
alien deploy --name eu-prod --machines

# Set up a deployment from a customer deployment-group token
alien deploy --token dg_abc123... --name production --platform aws

# Deploy an existing deployment (uses stored API key)
alien deploy --name production --platform aws

# Read a deployment token from a protected file
alien deploy --token-file deployment-token.txt --name prod --platform aws

# Deploy without heartbeat capability
alien deploy --token ax_deployment_xyz... --name prod --platform aws --no-heartbeat

`alien deployments`

Deployment commands.

alien deployments [OPTIONS] <COMMAND>

Subcommand	Description
`set-domains`	Use managed certificates for endpoint hostnames, or restore generated domains.
`create`	Create a new deployment.
`ls`	List deployments.
`get`	Get deployment details.
`resources`	Show a safe resource summary without resource configuration or secrets.
`events`	Show deployment lifecycle and configuration events.
`wait`	Wait until a deployment is ready or reaches a terminal state.
`machines`	Show the machines connected to a deployment.
`drain-machine`	Drain a machine so its workloads move to other machines.
`cancel-machine-drain`	Cancel a machine drain so the machine takes work again.
`remove-machine`	Remove a machine from a deployment.
`join-tokens`	List, create, rotate, and revoke tokens that join hosts to a Machines deployment.
`volumes`	Show container volumes, their latest snapshots and restores.
`restore-volume`	Replace a replica's persistent volume with a volume made from a snapshot.
`cancel-volume-restore`	Cancel a pending volume restore.
`delete`	Delete a deployment.
`retry`	Retry a deployment.
`redeploy`	Redeploy a deployment with the same release.
`move`	Move a deployment to another group without changing its runtime.
`pin`	Pin a deployment to a specific release.
`set-compute`	Change machine counts, machine type, or quota warning overrides of a deployment.
`set-env`	Replace the environment variables of a deployment.
`inputs`	Show a deployment's stack inputs and their current values.
`set-inputs`	Change stack inputs of a deployment.
`check`	Ask the manager to check the deployment's health now.
`set-channel`	Change the channel followed by an unpinned deployment.
`token`	Create a deployment token (deployment-scoped API key).
`untrack`	Forget a deployment this machine tracks locally, discarding its stored key.

Related commands:

alien logs --deployment production/api --follow
alien debug production/api -- <command>
alien commands --help

Examples:

alien deployments list
alien deployments describe production/api
alien deployments resources production/api --json
alien deployments events production/api
alien deployments wait production/api --for ready --timeout 10m
alien deployments machines production/api --json
alien deployments set-compute production/api --machines 3
alien deployments set-inputs production/api --input region=eu-west-1
alien deployments drain-machine production/api <machine-id>
alien deployments join-tokens create production/api
alien deployments untrack my-sandbox

`alien deployments set-domains`

Use managed certificates for endpoint hostnames, or restore generated domains.

alien deployments set-domains [OPTIONS] --resource <RESOURCE> <ID>

Argument	Description
`<ID>`	Deployment ID or reference.

Flag	Description
`--resource <RESOURCE>`
`--endpoint <ENDPOINTS>`	Endpoint name and hostname (repeat for each endpoint).
`--clear`	Restore generated domains for this resource.
`--json`

`alien deployments create`

Create a new deployment.

alien deployments create [OPTIONS] --name <NAME> --project <PROJECT> --deployment-group <DEPLOYMENT_GROUP> --platform <PLATFORM>

Flag	Description
`--name <NAME>`	Deployment display name.
`--deployment-group <DEPLOYMENT_GROUP>`	Deployment group ID (required).
`--platform <PLATFORM>`	Platform (aws, gcp, azure).
`--resource-prefix <RESOURCE_PREFIX>`	Physical-name prefix for generated cloud resources. Omit to let the manager generate one.
`--env <ENV>`	Plain environment variables in KEY=VALUE format (can be used multiple times).
`--secret <SECRET>`	Secret environment variables in KEY=VALUE format (can be used multiple times).
`--env-targeted <ENV_TARGETED>`	Plain environment variables with target functions in KEY=VALUE:pattern1,pattern2 format (can be used multiple times).
`--secret-targeted <SECRET_TARGETED>`	Secret environment variables with target functions in KEY=VALUE:pattern1,pattern2 format (can be used multiple times).
`--no-push`	Disable push (Operator handles deployments instead of manager).
`--no-heartbeat`	Disable heartbeat capability.
`--monitoring <MONITORING>`	Telemetry / monitoring mode. "auto" (default) uses the parent manager's built-in log store or external OTLP integration. "off" disables all monitoring. Values: `auto` (Automatically use the best available OTLP config: the parent manager's built-in log store or external OTLP integration (e.g. Axiom, Datadog)), `off` (Disable all monitoring: no OTLP logs for containers or worker VMs). Default: `auto`.

Network options:

Flag	Description
`--endpoint-access <ENDPOINT_ACCESS>`	Who can reach public endpoints: internet or private (AWS managed containers only).
`--network <NETWORK_MODE>`	Network mode: auto, use-default, create, byo. auto (system decides (create VPC if containers need it, skip otherwise) use-default ) use cloud provider's default VPC (fast, good for dev) create (create an isolated VPC (production-grade) byo ) bring your own VPC/VNet. Default: `auto`.
`--network-cidr <NETWORK_CIDR>`	VPC CIDR block (create mode only, auto-generated if omitted).
`--availability-zones <AVAILABILITY_ZONES>`	Number of availability zones (create mode only, default: 2).
`--vpc-id <VPC_ID>`	Existing VPC ID (byo mode, AWS).
`--public-subnet-ids <PUBLIC_SUBNET_IDS>`	Comma-separated public subnet IDs (byo mode, AWS).
`--private-subnet-ids <PRIVATE_SUBNET_IDS>`	Comma-separated private subnet IDs (byo mode, AWS).
`--security-group-ids <SECURITY_GROUP_IDS>`	Comma-separated security group IDs (byo mode, AWS, optional).
`--network-name <NETWORK_NAME>`	Existing VPC network name (byo mode, GCP).
`--subnet-name <SUBNET_NAME>`	Subnet name (byo mode, GCP).
`--network-region <NETWORK_REGION>`	Subnet region (byo mode, GCP).
`--vnet-resource-id <VNET_RESOURCE_ID>`	Existing VNet resource ID (byo mode, Azure).
`--public-subnet-name <PUBLIC_SUBNET_NAME>`	Public subnet name (byo mode, Azure).
`--private-subnet-name <PRIVATE_SUBNET_NAME>`	Private subnet name (byo mode, Azure).
`--format <FORMAT>`	Output format (json or text). Default: `text`.

`alien deployments ls`

List deployments.

Alias: list.

alien deployments ls [OPTIONS]

Flag	Description
`--json`	Print machine-readable JSON.

`alien deployments get`

Get deployment details.

Alias: describe, show, status.

alien deployments get [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Print machine-readable JSON.

`alien deployments resources`

Show a safe resource summary without resource configuration or secrets.

alien deployments resources [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Print stable machine-readable JSON.

`alien deployments events`

Show deployment lifecycle and configuration events.

alien deployments events [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--limit <LIMIT>`	Maximum number of recent events to return. Default: `20`.
`--json`	Print the API response as machine-readable JSON.

`alien deployments wait`

Wait until a deployment is ready or reaches a terminal state.

alien deployments wait [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--for <CONDITION>`	Condition to wait for. Values: `ready` (Running with the desired release applied), `terminal` (Any synchronized success or failure state), `deleted` (Fully deleted). Default: `ready`.
`--timeout <TIMEOUT>`	Maximum wait duration in seconds, or with a unit such as 30s, 10m, or 1h. Default: `10m`.
`--interval <INTERVAL>`	Poll interval in seconds, optionally suffixed with s, m, or h. Default: `2s`.
`--json`	Print a stable machine-readable result.

`alien deployments machines`

Show the machines connected to a deployment.

alien deployments machines [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Print the complete inventory as machine-readable JSON.

`alien deployments drain-machine`

Drain a machine so its workloads move to other machines.

The machine stops taking new work and its replicas are rescheduled. Undo it with alien deployments cancel-machine-drain.

alien deployments drain-machine [OPTIONS] <ID> <MACHINE_ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.
`<MACHINE_ID>`	Machine ID, as shown by `alien deployments machines`.

Flag	Description
`--deadline <DEADLINE>`	Report the drain as overdue if it hasn't finished after this long, such as 30m.
`--force`	Stop the machine's replicas without waiting for healthy replacements.
`--yes`	Skip the confirmation prompt for --force.
`--json`	Print the result as machine-readable JSON.

`alien deployments cancel-machine-drain`

Cancel a machine drain so the machine takes work again.

alien deployments cancel-machine-drain [OPTIONS] <ID> <MACHINE_ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.
`<MACHINE_ID>`	Machine ID, as shown by `alien deployments machines`.

Flag	Description
`--json`	Print the result as machine-readable JSON.

`alien deployments remove-machine`

Remove a machine from a deployment.

Drain the machine first so its workloads move. A removed machine can't rejoin with its old identity.

alien deployments remove-machine [OPTIONS] <ID> <MACHINE_ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.
`<MACHINE_ID>`	Machine ID, as shown by `alien deployments machines`.

Flag	Description
`--yes`	Skip confirmation prompt.
`--json`	Print the result as machine-readable JSON.

`alien deployments join-tokens`

List, create, rotate, and revoke tokens that join hosts to a Machines deployment.

Alias: join-token.

alien deployments join-tokens [OPTIONS] <COMMAND>

Subcommand	Description
`list`	List a deployment's join tokens.
`create`	Create a join token. Existing tokens keep working.
`rotate`	Revoke every join token and create a new one.
`revoke`	Revoke one join token. Hosts that already joined keep running.

`alien deployments join-tokens list`

List a deployment's join tokens.

Alias: ls.

alien deployments join-tokens list [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Print machine-readable JSON.

`alien deployments join-tokens create`

Create a join token. Existing tokens keep working.

alien deployments join-tokens create [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Print the token and join details as JSON.

`alien deployments join-tokens rotate`

Revoke every join token and create a new one.

alien deployments join-tokens rotate [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--yes`	Skip confirmation prompt.
`--json`	Print the token and join details as JSON.

`alien deployments join-tokens revoke`

Revoke one join token. Hosts that already joined keep running.

alien deployments join-tokens revoke [OPTIONS] <ID> <TOKEN_ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.
`<TOKEN_ID>`	Token ID, as shown by `alien deployments join-tokens list`.

Flag	Description
`--yes`	Skip confirmation prompt.
`--json`	Print the result as machine-readable JSON.

`alien deployments volumes`

Show container volumes, their latest snapshots and restores.

alien deployments volumes [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Print machine-readable JSON.

`alien deployments restore-volume`

Replace a replica's persistent volume with a volume made from a snapshot.

The replica is stopped while its volume is swapped. The replaced volume is snapshotted before it is deleted, so the restore can be undone by restoring that snapshot.

alien deployments restore-volume [OPTIONS] --resource <RESOURCE> --ordinal <ORDINAL> --snapshot <SNAPSHOT> <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--resource <RESOURCE>`	Container resource that owns the volume.
`--ordinal <ORDINAL>`	Replica ordinal whose volume is replaced.
`--snapshot <SNAPSHOT>`	Snapshot to restore, as shown by `alien deployments volumes`.
`--yes`	Skip confirmation prompt.
`--json`	Print the restore request as machine-readable JSON.

`alien deployments cancel-volume-restore`

Cancel a pending volume restore.

Use it when a restore keeps failing. A restore whose volume was already swapped still finishes.

alien deployments cancel-volume-restore [OPTIONS] <ID> <REQUEST_ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.
`<REQUEST_ID>`	Restore request ID, as shown by `alien deployments volumes`.

Flag	Description
`--json`	Print the cancelled request as machine-readable JSON.

`alien deployments delete`

Delete a deployment.

alien deployments delete [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--force <DEPLOYMENT_NAME>`	Force-delete: remove Alien's record without touching your cloud, so the deployment group accepts new deployments again. For a deployment whose stack is already gone or whose cleanup keeps failing. Takes the deployment's name as confirmation; nothing is sent unless it matches. Cannot be combined with --yes.
`--erase-data`	Permanently erase durable data instead of retaining it.
`--yes`	Skip confirmation prompt.

`alien deployments retry`

Retry a deployment.

alien deployments retry [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Print the updated deployment as machine-readable JSON.

`alien deployments redeploy`

Redeploy a deployment with the same release.

alien deployments redeploy [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--wait`	Wait for this exact redeploy operation to finish.
`--timeout <TIMEOUT>`	Maximum wait duration when --wait is used. Default: `10m`.
`--interval <INTERVAL>`	Poll interval when --wait is used. Default: `2s`.
`--json`	Print the updated deployment as machine-readable JSON.

`alien deployments move`

Move a deployment to another group without changing its runtime.

alien deployments move [OPTIONS] --deployment-group <DEPLOYMENT_GROUP> <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--deployment-group <DEPLOYMENT_GROUP>`	Destination deployment group ID.
`--dry-run`	Preview eligibility without changing membership.
`--expected-membership-revision <EXPECTED_MEMBERSHIP_REVISION>`	Revision from a previous preview (otherwise preview immediately).
`--json`	Print the server response as machine-readable JSON.

`alien deployments pin`

Pin a deployment to a specific release.

alien deployments pin [OPTIONS] <ID> [RELEASE_ID]

Argument	Description
`<ID>`	Deployment ID.
`[RELEASE_ID]`	Release ID to pin to (omit to unpin and use active release).

Flag	Description
`--json`	Print the pin response as machine-readable JSON.

`alien deployments set-compute`

Change machine counts, machine type, or quota warning overrides of a deployment.

alien deployments set-compute [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--pool <POOL>`	Pool to change (required when the deployment has more than one).
`--machines <MACHINES>`	Fixed number of machines.
`--min <MIN>`	Minimum machine count for an autoscaling pool.
`--max <MAX>`	Maximum machine count for an autoscaling pool.
`--machine <MACHINE>`	Provider machine type, such as m6i.large. It must keep the pool's CPU architecture; the pool's machines are replaced to apply it.
`--quota-warning-override <QUOTA_WARNING_OVERRIDES>`	Downgrade a quota failure to a visible warning (repeatable; replaces the saved list).
`--clear-quota-warning-overrides`	Remove all saved quota warning overrides.
`--yes`	Skip the confirmation prompt when scaling a pool to 0 machines.
`--json`	Print the update result as machine-readable JSON.

`alien deployments set-env`

Replace the environment variables of a deployment.

The variables you pass become the full set: any variable not listed is removed. Variables backed by stack inputs are kept; change those with alien deployments set-inputs.

alien deployments set-env [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--env <ENV>`	Plain environment variables in KEY=VALUE format (can be used multiple times).
`--secret <SECRET>`	Secret environment variables in KEY=VALUE format (can be used multiple times).
`--env-targeted <ENV_TARGETED>`	Plain environment variables with target resources in KEY=VALUE:pattern1,pattern2 format (can be used multiple times).
`--secret-targeted <SECRET_TARGETED>`	Secret environment variables with target resources in KEY=VALUE:pattern1,pattern2 format (can be used multiple times).
`--clear`	Remove every environment variable.
`--yes`	Skip confirmation prompt.
`--json`	Print the result as machine-readable JSON.

`alien deployments inputs`

Show a deployment's stack inputs and their current values.

alien deployments inputs [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Print machine-readable JSON.

`alien deployments set-inputs`

Change stack inputs of a deployment.

alien deployments set-inputs [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--input <INPUTS>`	Input value in ID=VALUE format (can be used multiple times).
`--secret-input <SECRET_INPUTS>`	Secret input value in ID=VALUE format, sent as text (can be used multiple times).
`--clear <CLEAR>`	Input to reset to its default (can be used multiple times).
`--json`	Print the saved inputs as machine-readable JSON.

`alien deployments check`

Ask the manager to check the deployment's health now.

alien deployments check [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Print the result as machine-readable JSON.

`alien deployments set-channel`

Change the channel followed by an unpinned deployment.

alien deployments set-channel [OPTIONS] <ID> <CHANNEL>

Argument	Description
`<ID>`	Deployment ID.
`<CHANNEL>`	Channel to follow.

Flag	Description
`--json`	Print the updated deployment as machine-readable JSON.

`alien deployments token`

Create a deployment token (deployment-scoped API key).

Alias: tokens.

alien deployments token [OPTIONS] <ID>

Argument	Description
`<ID>`	Deployment ID.

Flag	Description
`--json`	Print the token and deployment ID as JSON.

`alien deployments untrack`

Forget a deployment this machine tracks locally, discarding its stored key.

alien deployments untrack [OPTIONS] <NAME>

Argument	Description
`<NAME>`	Deployment name, as passed to `alien deploy --name`.

`alien status`

Show deployment status for the linked project or one deployment.

alien status [OPTIONS] [DEPLOYMENT]

Argument	Description
`[DEPLOYMENT]`	Deployment ID, or <deployment-group-name>/<deployment-name>.

Flag	Description
`--json`	Emit machine-readable JSON.

Examples:

alien status
alien status --json
alien status production/api
alien status dep_abc123 --json

`alien destroy`

Destroy resources from a deployment.

alien destroy [OPTIONS] --name <NAME>

Flag	Description
`--token <TOKEN>`	Deployment API key for setup teardown (optional with local tracking or an Alien login).
`--name <NAME>`	Deployment ID, <group>/<name>, or a unique deployment name in the selected project.
`--platform <PLATFORM>`	Target platform (required by `alien destroy`; `alien dev destroy` is always local).
`--force`	Force-destroy: skip resource teardown and delete the record immediately.
`--erase-data`	Permanently erase durable data instead of retaining it. Also erases data an earlier destroy kept.
`--yes`	Skip confirmation for cloud destruction (local dev destruction never prompts).

Examples:

# Destroy a tracked deployment
alien destroy --name production --platform aws

# Force-destroy (skip resource teardown)
alien destroy --name production --platform aws --force

`alien vault`

Manage vault secrets for a deployment.

alien vault [OPTIONS] <COMMAND>

Subcommand	Description
`set`	Set a secret value in a vault.
`get`	Get a secret value from a vault.
`delete`	Delete a secret from a vault.
`list`	List all secrets in a vault.

Flag	Description
`--deployment <DEPLOYMENT>`	Target deployment ID, name, or group/name. Global so it can follow the subcommand; clap refuses a required global argument, so [`VaultRemoteArgs::deployment`] checks it.

`alien vault set`

Set a secret value in a vault.

alien vault set [OPTIONS] <VAULT_NAME> <SECRET_NAME> [VALUE]

Argument	Description
`<VAULT_NAME>`	Vault name (e.g., "customer-secrets").
`<SECRET_NAME>`	Secret name (e.g., "GITHUB_TOKEN").
`[VALUE]`	Secret value (prefer --stdin to keep it out of process arguments).

Flag	Description
`--stdin`	Read the exact secret bytes from stdin, without trimming whitespace.
`--file <FILE>`	Read a UTF-8 file exactly, without adding a newline or exposing the value in arguments.
`--deployment <DEPLOYMENT>`	Target deployment ID, name, or group/name. Global so it can follow the subcommand; clap refuses a required global argument, so [`VaultRemoteArgs::deployment`] checks it.

`alien vault get`

Get a secret value from a vault.

alien vault get [OPTIONS] <VAULT_NAME> <SECRET_NAME>

Argument	Description
`<VAULT_NAME>`	Vault name.
`<SECRET_NAME>`	Secret name.

Flag	Description
`--deployment <DEPLOYMENT>`	Target deployment ID, name, or group/name. Global so it can follow the subcommand; clap refuses a required global argument, so [`VaultRemoteArgs::deployment`] checks it.

`alien vault delete`

Delete a secret from a vault.

alien vault delete [OPTIONS] <VAULT_NAME> <SECRET_NAME>

Argument	Description
`<VAULT_NAME>`	Vault name.
`<SECRET_NAME>`	Secret name.

Flag	Description
`--deployment <DEPLOYMENT>`	Target deployment ID, name, or group/name. Global so it can follow the subcommand; clap refuses a required global argument, so [`VaultRemoteArgs::deployment`] checks it.

`alien vault list`

List all secrets in a vault.

alien vault list [OPTIONS] <VAULT_NAME>

Argument	Description
`<VAULT_NAME>`	Vault name.

Flag	Description
`--deployment <DEPLOYMENT>`	Target deployment ID, name, or group/name. Global so it can follow the subcommand; clap refuses a required global argument, so [`VaultRemoteArgs::deployment`] checks it.

Operate

`alien logs`

Search deployment and manager logs.

alien logs [OPTIONS]

Flag	Description
`--deployment <DEPLOYMENT>`	Deployment ID, or <deployment-group-name>/<deployment-name>.
`--manager <MANAGER_ID>`	Manager ID to search when --deployment is not provided.
`--cloud <CLOUD>`	Cloud default to use when the project has multiple default managers. Values: `aws`, `gcp`, `azure`, `kubernetes`, `local`.
`-q, --query <QUERY>`	Log query text. Default: `*`.
`--level <LEVEL>`	Severity band to include. Repeat to include several bands. Values: `trace`, `debug`, `info`, `warn`, `error`, `fatal`.
`--source <SOURCE>`	Restrict results to a gateway request-diagnostics source. Values: `application`, `ai-gateway`, `encryption-gateway`, `remote-sandbox`.
`--status <STATUS>`	Gateway outcome, such as success, provider-error, not-routed, gateway-error, cancelled, or failed.
`--model <MODEL>`	Requested AI model. Only valid with --source ai-gateway.
`--provider <PROVIDER>`	Selected AI provider. Only valid with --source ai-gateway.
`--operation <OPERATION>`	Encryption operation, such as encrypt or decrypt. Only valid with --source encryption-gateway.
`--deployment-group <DG_ID>`	Deployment-group ID associated with a gateway request.
`--since <SINCE>`	Relative time window, such as 30m, 2h, or 7d. Default: `1h`.
`--from <FROM>`	Start timestamp in RFC3339 format, or YYYY-MM-DD (midnight UTC). Overrides --since.
`--to <TO>`	End timestamp in RFC3339 format, or YYYY-MM-DD (midnight UTC). Defaults to now.
`--limit <LIMIT>`	Maximum logs to return per query. Default: `200`.
`--system`	Include logs from Alien system components (hidden by default).
`--follow`	Keep polling for new logs.
`--interval <INTERVAL>`	Poll interval used with --follow, such as 1s or 5s. Default: `2s`.
`--json`	Output a stable machine-readable format. With --follow, emits JSON lines.

Examples:

alien logs --deployment acme/production --follow
alien logs --source ai-gateway --status provider-error --provider anthropic
alien logs --source ai-gateway --model byo/claude-opus-5 --since 24h --json
alien logs --source encryption-gateway --status failed --operation decrypt
alien logs --source remote-sandbox --since 1h

`alien commands`

Invoke remote commands on deployments.

Commands let you run code inside a deployment's environment (query databases, trigger syncs, execute tool calls) without any inbound networking.

Commands are application RPC handled by your Worker, Container, or Daemon. See also: alien operations --help for Remote Operator operations, which carry a risk tier, approval policy, and access requests.

Docs: /docs/guide/commands.

alien commands [OPTIONS] <COMMAND>

Subcommand	Description
`invoke`	Invoke a command on a deployment and wait for the result.

Examples:

# Invoke a command in dev mode
alien dev commands invoke --deployment default --command list-tables

# Invoke with parameters
alien dev commands invoke --deployment default --command query \
  --params '{"sql": "SELECT * FROM users"}'

# Invoke against a manager you run
alien commands invoke --deployment acme-corp --command generate-report \
  --params '{"startDate": "2025-01-01"}'

`alien commands invoke`

Invoke a command on a deployment and wait for the result.

alien commands invoke [OPTIONS] --deployment <DEPLOYMENT> --command <COMMAND>

Flag	Description
`--deployment <DEPLOYMENT>`	Deployment ID, or <deployment-group-name>/<deployment-name>.
`--command <COMMAND>`	Command name to invoke.
`--target <TARGET>`	Resource ID to invoke when several resources handle commands.
`--params <PARAMS>`	Command parameters as JSON (default: {}). Default: `{}`.
`--timeout <TIMEOUT>`	Timeout in seconds (default: 60). Default: `60`.

`alien operations`

Build, test, and manage operations plugins.

Operations plugins package named operations (plugin/operation) that Remote Operator runs in a deployment. Each operation declares its risk, and invoking one goes through the project's approval policy and access requests. init, check, test, permissions, and package need no platform account (cargo may download the plugin's dependencies); publish, list, and invoke need a linked platform workspace.

See also: alien commands --help for application RPC handled by your Worker, Container, or Daemon. Commands have no approval policy or access requests.

alien operations [OPTIONS] <COMMAND>

Subcommand	Description
`init`	Scaffold a new operations plugin from the public SDK. Fully offline.
`check`	Validate a plugin's manifest, then build and run its required `generate-metadata` binary and fail if `metadata.json` differs from the metadata its typed operations generate. Needs no platform account; `cargo` may download the plugin's dependencies.
`test`	Run a plugin's own test suite (`cargo test` in its directory). Fully offline.
`permissions`	Compile a plugin's declared permission requirements into a cloud-specific policy document. Fully offline.
`docs`	Generate tool schemas and a Markdown reference page from a plugin's manifest. Fully offline.
`package`	Build a plugin's release binary and zip it with its manifest into a bundle ready for `publish`. Builds only for this host's architecture: publishing both amd64 and arm64 needs a build on each. Fully offline (aside from `cargo build`'s own dependency resolution).
`publish`	Publish a custom operations plugin bundle (ZIP) to your workspace.
`list`	List operations plugins: every built-in and published custom plugin a stack can declare, or only the ones a deployment declares.
`invoke`	Invoke an operation the deployment declares and wait for its result.

Flag	Description
`--json`	Emit machine-readable JSON.

Examples:

# Scaffold a new plugin
alien operations init my-plugin

# Validate its manifest and check its generated metadata
alien operations check

# Run its own test suite
alien operations test

# See what AWS IAM permissions it needs
alien operations permissions --cloud aws

# Build a release binary and zip it into a bundle
alien operations package

# Publish a custom plugin bundle
alien operations publish ./postgres-operations-1.0.0.zip

# List plugins a stack can declare in operations()
alien operations list

# List the plugins a deployment declares
alien operations list --deployment mycustomer/prod

# Invoke a declared operation without an AI agent
alien operations invoke --deployment mycustomer/prod \
  --operation kubernetes/get-pods \
  --params '{"namespace": "default", "maxResults": 10}'

`alien operations init`

Scaffold a new operations plugin from the public SDK. Fully offline.

alien operations init [OPTIONS] <NAME> [DIRECTORY]

Argument	Description
`<NAME>`	Plugin name (kebab-case), also used as the crate name.
`[DIRECTORY]`	Destination directory. Defaults to `./<name>`.

Flag	Description
`--json`	Emit machine-readable JSON.

`alien operations check`

Validate a plugin's manifest, then build and run its required generate-metadata binary and fail if metadata.json differs from the metadata its typed operations generate. Needs no platform account; cargo may download the plugin's dependencies.

alien operations check [OPTIONS] [DIRECTORY]

Argument	Description
`[DIRECTORY]`	Plugin directory containing `metadata.json`. Defaults to the current directory.

Flag	Description
`--manifest-only`	Only validate `metadata.json`. Does not build or run any plugin code, so it is safe for a plugin you do not trust.
`--json`	Emit machine-readable JSON.

`alien operations test`

Run a plugin's own test suite (cargo test in its directory). Fully offline.

alien operations test [OPTIONS] [DIRECTORY]

Argument	Description
`[DIRECTORY]`	Plugin directory. Defaults to the current directory.

Flag	Description
`--json`	Emit machine-readable JSON.

`alien operations permissions`

Compile a plugin's declared permission requirements into a cloud-specific policy document. Fully offline.

alien operations permissions [OPTIONS] --cloud <CLOUD> [DIRECTORY]

Argument	Description
`[DIRECTORY]`	Plugin directory containing `metadata.json`. Defaults to the current directory.

Flag	Description
`--cloud <CLOUD>`	Cloud to generate a policy for. Values: `aws`, `gcp`, `kubernetes`, `azure`.
`--permission <PERMISSION>`	Kubernetes installation permission mode. Values: `diagnostics`, `remediation`. Default: `diagnostics`.
`--s3-bucket-arn <S3_BUCKET_ARN>`	Exact S3 bucket ARN allowed by the installation. May be repeated.
`--sqs-queue-arn <SQS_QUEUE_ARN>`	Exact SQS queue ARN allowed by the installation. May be repeated.
`--gcs-bucket <GCS_BUCKET>`	Exact Cloud Storage bucket name allowed by the installation. May be repeated.
`--builtin`	Compile reviewed built-in source definitions. Custom plugins must use named AWS capabilities.
`--json`	Emit machine-readable JSON.

`alien operations docs`

Generate tool schemas and a Markdown reference page from a plugin's manifest. Fully offline.

alien operations docs [OPTIONS] [DIRECTORY]

Argument	Description
`[DIRECTORY]`	Plugin directory containing `metadata.json`. Defaults to the current directory.

Flag	Description
`--json`	Emit machine-readable JSON.

`alien operations package`

Build a plugin's release binary and zip it with its manifest into a bundle ready for publish. Builds only for this host's architecture: publishing both amd64 and arm64 needs a build on each. Fully offline (aside from cargo build's own dependency resolution).

alien operations package [OPTIONS] [DIRECTORY]

Argument	Description
`[DIRECTORY]`	Plugin directory. Defaults to the current directory.

Flag	Description
`--json`	Emit machine-readable JSON.

`alien operations publish`

Publish a custom operations plugin bundle (ZIP) to your workspace.

alien operations publish [OPTIONS] <BUNDLE>

Argument	Description
`<BUNDLE>`	Path to the plugin bundle ZIP (contains metadata.json + binaries).

Flag	Description
`--json`	Emit machine-readable JSON.

`alien operations list`

List operations plugins: every built-in and published custom plugin a stack can declare, or only the ones a deployment declares.

alien operations list [OPTIONS]

Flag	Description
`--deployment <DEPLOYMENT>`	Only the plugins this deployment declares. Deployment ID, or <deployment-group-name>/<deployment-name>.
`--json`	Emit machine-readable JSON.

`alien operations invoke`

Invoke an operation the deployment declares and wait for its result.

alien operations invoke [OPTIONS] --deployment <DEPLOYMENT> --operation <OPERATION>

Flag	Description
`--deployment <DEPLOYMENT>`	Deployment ID, or <deployment-group-name>/<deployment-name>.
`--operation <OPERATION>`	Operation name in <plugin>/<operation> form.
`--params <PARAMS>`	Operation parameters as JSON. Default: `{}`.
`--timeout <TIMEOUT>`	Timeout in seconds. Default: `60`.
`--request-access`	If the operation requires approval, automatically create an access request instead of printing instructions.
`--access-duration <ACCESS_DURATION>`	Approval duration to request with --request-access, e.g. 1h, 30m. Default: `1h`.
`--json`	Emit machine-readable JSON.

`alien access-requests`

Request, approve, and deny time-boxed operation access.

alien access-requests [OPTIONS] <COMMAND>

Subcommand	Description
`create`	Create an access request: an operations grant (exact <plugin>/<operation> or wildcard <plugin>/*), a remote-debugging grant (--debug-tool), or both.
`get`	Get an access request by id.
`wait`	Wait for an access request to be approved by the customer.
`approve`	Approve someone else's queued access request.
`deny`	Deny someone else's queued access request.
`revoke`	Revoke an access request: pending operations fail and open debug sessions stop.

Flag	Description
`--json`	Emit machine-readable JSON.

`alien access-requests create`

Create an access request: an operations grant (exact <plugin>/<operation> or wildcard <plugin>/*), a remote-debugging grant (--debug-tool), or both.

alien access-requests create [OPTIONS] --deployment <DEPLOYMENT>

Flag	Description
`--deployment <DEPLOYMENT>`	Deployment ID, or <deployment-group-name>/<deployment-name>.
`--operation <OPERATION>`	Operation to request: an exact <plugin>/<operation>, or a wildcard <plugin>/* covering every operation the plugin exposes right now.
`--params <PARAMS>`	Operation parameters as JSON. Only valid for an exact operation.
`--max-risk <MAX_RISK>`	Highest risk tier a wildcard grant may cover: read-only \| mutating \| destructive. Required for a wildcard operation.
`--debug-tool <DEBUG_TOOL>`	Remote-debugging tool to request access for: kubectl \| aws \| gcloud \| az. May be combined with --operation to request both in one row.
`--debug-namespace <DEBUG_NAMESPACE>`	Kubernetes namespace to scope a `kubectl` debug grant to. Requires --debug-tool kubectl.
`--debug-cloud-scope <DEBUG_CLOUD_SCOPE>`	Cloud account/project/subscription to scope an `aws`/`gcloud`/`az` debug grant to (e.g. an AWS account id, a GCP project id). Requires --debug-tool set to that provider.
`--duration <DURATION>`	Requested approval duration, e.g. 1h, 30m. Approvals cannot extend past this deadline.
`--json`	Emit machine-readable JSON.
`--title <TITLE>`	Human-readable title. Defaults to the operation or pattern.
`--reason <REASON>`	Why access is needed.

`alien access-requests get`

Get an access request by id.

alien access-requests get [OPTIONS] <ID>

Argument	Description
`<ID>`

Flag	Description
`--json`	Emit machine-readable JSON.

`alien access-requests wait`

Wait for an access request to be approved by the customer.

alien access-requests wait [OPTIONS] <ID>

Argument	Description
`<ID>`

Flag	Description
`--timeout <TIMEOUT>`	Timeout in seconds. Default: `3600`.
`--json`	Emit machine-readable JSON.

`alien access-requests approve`

Approve someone else's queued access request.

alien access-requests approve [OPTIONS] <ID>

Argument	Description
`<ID>`

Flag	Description
`--duration <DURATION>`	How long the approval lasts, e.g. 30m, 2h. It never runs past the deadline the requester asked for. Defaults to the longest allowed.
`--json`	Emit machine-readable JSON.

`alien access-requests deny`

Deny someone else's queued access request.

alien access-requests deny [OPTIONS] <ID>

Argument	Description
`<ID>`

Flag	Description
`--yes`	Skip the confirmation prompt.
`--json`	Emit machine-readable JSON.

`alien access-requests revoke`

Revoke an access request: pending operations fail and open debug sessions stop.

alien access-requests revoke [OPTIONS] <ID>

Argument	Description
`<ID>`

Flag	Description
`--reason <REASON>`	Why the grant is withdrawn (kept in the audit trail).
`--json`	Emit machine-readable JSON.

`alien debug`

Run a local command against a deployment using manager-side credentials.

alien debug [OPTIONS] [DEPLOYMENT] [-- <CMD>...] [COMMAND]

Subcommand	Description
`shell`	Open an interactive shell in the deployment runtime.
`exec`	Run a non-interactive command in the deployment runtime.

Argument	Description
`[DEPLOYMENT]`	Deployment ID (`dep_...`) or `<group>/<name>`.
`[CMD]...`	Command and arguments to execute. Everything after `--` is forwarded verbatim. If omitted, an interactive shell ($SHELL, or /bin/sh) is spawned instead.

Flag	Description
`--access-request <ACCESS_REQUEST>`	Access request id (`ar_...`) authorizing this debug session. Required for Remote Operator (pull-mode Kubernetes) deployments, where debugging shares the same approval flow as `alien operations invoke`. Create one with `alien access-requests create --debug-tool <kubectl\|aws\|gcloud\|az> ...`.
`--request-access`	Shortcut: create a debug-tool access request for this deployment, wait for customer approval, then start the session against it. Creates the same access-request resource as `alien access-requests create --debug-tool ...`.
`--access-duration <ACCESS_DURATION>`	Requested approval duration for `--request-access`, e.g. 30m, 1h. Informational until approved; the approver sets the actual grant window. Default: `30m`.
`--access-cloud-scope <ACCESS_CLOUD_SCOPE>`	Scope the `--request-access` grant to a specific cloud account/project/ subscription, e.g. `123456789012/prod-readonly`. Only meaningful for aws/gcloud/az (kubectl scopes by namespace, derived automatically from the debugged command). Omit for an unscoped grant covering the whole deployment's cloud identity.
`--json`	Emit errors as JSON. The spawned command's stdout/stderr are always passed through unchanged.

Examples:

alien debug dep_abc123 -- aws sts get-caller-identity
alien debug acme/prod -- gcloud projects list
alien debug acme/prod -- kubectl get pods

# Remote Operator (pull-mode Kubernetes) deployments require an approved
# access request covering the tool + namespace/scope you're debugging:
alien access-requests create --deployment acme/prod \
  --debug-tool kubectl --debug-namespace acme --duration 30m
alien debug acme/prod --access-request ar_123 -- kubectl get pods -n acme

# No `--` arg drops you into a local interactive shell with the env set:
alien debug acme/prod

# Open an interactive shell in a Local deployment runtime:
alien debug shell acme/prod

# Run a non-interactive command in a Local deployment runtime:
alien debug exec acme/prod -- uname -a
alien debug exec acme/prod -- powershell.exe -NoLogo -Command Get-Process

`alien debug shell`

Open an interactive shell in the deployment runtime.

alien debug shell [OPTIONS] <DEPLOYMENT>

Argument	Description
`<DEPLOYMENT>`	Deployment ID (`dep_...`) or `<group>/<name>`.

Flag	Description
`--resource <RESOURCE>`	Container or daemon resource ID to attach to.
`--machine <MACHINE>`	Machine ID to attach to directly.
`--json`	Emit errors as JSON.

Examples:

alien debug shell acme/prod

`alien debug exec`

Run a non-interactive command in the deployment runtime.

alien debug exec [OPTIONS] <DEPLOYMENT> -- <CMD>...

Argument	Description
`<DEPLOYMENT>`	Deployment ID (`dep_...`) or `<group>/<name>`.
`<CMD>...`	Command and arguments to execute remotely.

Flag	Description
`--resource <RESOURCE>`	Container or daemon resource ID to attach to.
`--machine <MACHINE>`	Machine ID to attach to directly.
`--timeout-seconds <TIMEOUT_SECONDS>`	Timeout in seconds for the remote command. Default: `120`.
`--json`	Emit structured JSON with captured output.

Examples:

alien debug exec acme/prod -- uname -a
alien debug exec acme/prod -- powershell.exe -NoLogo -Command Get-Process

Keys, tokens and managers

`alien api-keys`

Create, inspect, disable, and revoke API keys.

Alias: apikeys.

alien api-keys [OPTIONS] <COMMAND>

Subcommand	Description
`create`	Create a scoped project key. The secret is returned only once.
`list`	List project API keys without secrets.
`get`	Show API-key metadata without its secret.
`disable`	Stop accepting an API key until it is enabled again.
`enable`	Accept a disabled API key again.
`revoke`	Revoke an API key.

Flag	Description
`--json`	Emit stable machine-readable JSON.

Examples:

alien api-keys create --for ai-gateway --description production-backend
alien api-keys create --for encryption-gateway --json
alien api-keys list
alien api-keys get key_abc123
alien api-keys disable key_abc123
alien api-keys enable key_abc123
alien api-keys revoke key_abc123 --yes

`alien api-keys create`

Create a scoped project key. The secret is returned only once.

alien api-keys create [OPTIONS] --for <PURPOSE>

Flag	Description
`--for <PURPOSE>`	Intended use; selects the corresponding project role. Values: `ai-gateway`, `encryption-gateway`, `deployments`, `project-admin` (Full project lifecycle and API-key management), `remote-bindings`, `remote-sandbox`, `read-only`.
`--description <DESCRIPTION>`	Human-readable key description.
`--json`	Emit stable machine-readable JSON.

`alien api-keys list`

List project API keys without secrets.

Alias: ls.

alien api-keys list [OPTIONS]

Flag	Description
`--json`	Emit stable machine-readable JSON.

`alien api-keys get`

Show API-key metadata without its secret.

Alias: describe, show.

alien api-keys get [OPTIONS] <ID>

Argument	Description
`<ID>`

Flag	Description
`--json`	Emit stable machine-readable JSON.

`alien api-keys disable`

Stop accepting an API key until it is enabled again.

alien api-keys disable [OPTIONS] <ID>

Argument	Description
`<ID>`

Flag	Description
`--yes`	Skip the confirmation prompt.
`--json`	Emit stable machine-readable JSON.

`alien api-keys enable`

Accept a disabled API key again.

alien api-keys enable [OPTIONS] <ID>

Argument	Description
`<ID>`

Flag	Description
`--json`	Emit stable machine-readable JSON.

`alien api-keys revoke`

Revoke an API key.

Alias: delete.

alien api-keys revoke [OPTIONS] <ID>

Argument	Description
`<ID>`

Flag	Description
`--yes`	Confirm revocation.
`--json`	Emit stable machine-readable JSON.

`alien tokens`

Create and revoke scoped tokens on your manager.

alien tokens [OPTIONS] <COMMAND>

Subcommand	Description
`ls`	List tokens.
`create`	Create a token.
`revoke`	Revoke a token.

Examples:

alien tokens create --tunnel
alien tokens create --tunnel --customer customer-1
alien tokens ls
alien tokens revoke <token-id>

`alien tokens ls`

List tokens.

alien tokens ls [OPTIONS]

Flag	Description
`--json`	Emit structured JSON output.

`alien tokens create`

Create a token.

alien tokens create [OPTIONS] --tunnel

Flag	Description
`--tunnel`	A token that only calls deployment tunnels.
`--customer <CUSTOMER>`	Limit the token to one customer's deployments (deployment group name or ID).
`--json`	Emit structured JSON output.

`alien tokens revoke`

Revoke a token.

alien tokens revoke [OPTIONS] <ID>

Argument	Description
`<ID>`	Token ID (from `alien tokens ls`).

`alien managers`

Manage private managers deployed to your cloud.

alien managers [OPTIONS] <COMMAND>

Subcommand	Description
`create`	Create a new private manager and return its setup action.
`list`	List private managers.
`status`	Show manager status and details.
`setup`	Return a fresh setup action for a pending or failed manager.
`retry`	Retry private-manager setup or failed manager deployment.
`update`	Update a private manager to the latest manager release, or to a specific one.
`provision`	Run a private manager's provisioning again, for example after it failed.
`set-domain`	Serve a private manager's API on a workspace domain, or go back to its generated URL.
`cancel`	Cancel an incomplete private-manager setup.
`delete`	Delete a private manager.
`events`	View manager deployment events.
`defaults`	Manage project default private managers.

Flag	Description
`--json`	Print machine-readable JSON.

`alien managers create`

Create a new private manager and return its setup action.

alien managers create [OPTIONS] --cloud <CLOUD> --region <REGION>

Flag	Description
`--json`	Print machine-readable JSON.
`--name <NAME>`	Manager display name. Default: `alien-private-manager`.
`--cloud <CLOUD>`	Cloud where the manager will run. Values: `aws`, `gcp`, `azure`.
`--region <REGION>`	Cloud region for the manager.
`--setup <SETUP>`	Setup method. Defaults by cloud: AWS cloudformation, GCP google-oauth, Azure terraform. Values: `cloudformation`, `google-oauth`, `terraform`.
`--network <NETWORK>`	Network mode. Defaults to create; use default for faster dev/test setup. Values: `create`, `default`.
`--output-dir <OUTPUT_DIR>`	Write Terraform setup files to this directory.
`--open`	Open the returned browser setup URL.

`alien managers list`

List private managers.

Alias: ls.

alien managers list [OPTIONS]

Flag	Description
`--cloud <CLOUD>`	Filter by cloud. Values: `aws`, `gcp`, `azure`.
`--json`	Print machine-readable JSON.

`alien managers status`

Show manager status and details.

Alias: get, describe, show.

alien managers status [OPTIONS] <ID>

Argument	Description
`<ID>`	Manager ID.

Flag	Description
`--json`	Print machine-readable JSON.
`--watch`	Poll until setup reaches a terminal state.

`alien managers setup`

Return a fresh setup action for a pending or failed manager.

alien managers setup [OPTIONS] <ID>

Argument	Description
`<ID>`	Manager ID.

Flag	Description
`--json`	Print machine-readable JSON.
`--output-dir <OUTPUT_DIR>`	Write Terraform setup files to this directory.
`--open`	Open the returned browser setup URL.

`alien managers retry`

Retry private-manager setup or failed manager deployment.

alien managers retry [OPTIONS] <ID>

Argument	Description
`<ID>`	Manager ID.

Flag	Description
`--json`	Print machine-readable JSON.
`--output-dir <OUTPUT_DIR>`	Write Terraform setup files to this directory when setup is retried.
`--open`	Open the returned browser setup URL when setup is retried.

`alien managers update`

Update a private manager to the latest manager release, or to a specific one.

alien managers update [OPTIONS] <ID>

Argument	Description
`<ID>`	Manager ID.

Flag	Description
`--json`	Print machine-readable JSON.
`--release <RELEASE>`	Manager release ID (rel_...). Omit to use the latest release.
`--yes`	Skip confirmation prompt.

`alien managers provision`

Run a private manager's provisioning again, for example after it failed.

alien managers provision [OPTIONS] <ID>

Argument	Description
`<ID>`	Manager ID.

Flag	Description
`--json`	Print machine-readable JSON.

`alien managers set-domain`

Serve a private manager's API on a workspace domain, or go back to its generated URL.

alien managers set-domain [OPTIONS] <ID>

Argument	Description
`<ID>`	Manager ID.

Flag	Description
`--domain <DOMAIN>`	Domain ID (dom_...), as shown by `alien domains ls`.
`--json`	Print machine-readable JSON.
`--clear`	Remove the custom domain.

`alien managers cancel`

Cancel an incomplete private-manager setup.

alien managers cancel [OPTIONS] <ID>

Argument	Description
`<ID>`	Manager ID.

Flag	Description
`--json`	Print machine-readable JSON.
`--yes`	Skip confirmation prompt.

`alien managers delete`

Delete a private manager.

alien managers delete [OPTIONS] <ID>

Argument	Description
`<ID>`	Manager ID.

Flag	Description
`--json`	Print machine-readable JSON.
`--yes`	Skip confirmation prompt.

`alien managers events`

View manager deployment events.

alien managers events [OPTIONS] <ID>

Argument	Description
`<ID>`	Manager ID.

Flag	Description
`-f, --follow`	Follow events.
`--json`	Print machine-readable JSON.

`alien managers defaults`

Manage project default private managers.

alien managers defaults [OPTIONS] <COMMAND>

Subcommand	Description
`show`	Show default private managers for a project.
`set`	Set the default private manager for a cloud.
`clear`	Clear default private managers.

Flag	Description
`--json`	Print machine-readable JSON.

`alien managers defaults show`

Show default private managers for a project.

alien managers defaults show [OPTIONS]

Flag	Description
`--json`	Print machine-readable JSON.

`alien managers defaults set`

Set the default private manager for a cloud.

alien managers defaults set [OPTIONS] --cloud <CLOUD> --manager <MANAGER>

Flag	Description
`--json`	Print machine-readable JSON.
`--cloud <CLOUD>`	Cloud to configure. Values: `aws`, `gcp`, `azure`.
`--manager <MANAGER>`	Manager ID.

`alien managers defaults clear`

Clear default private managers.

alien managers defaults clear [OPTIONS] --cloud <CLOUD>

Flag	Description
`--json`	Print machine-readable JSON.
`--cloud <CLOUD>`	Cloud to clear, or all. Values: `aws`, `gcp`, `azure`, `all`.

`alien domains`

Manage workspace domains.

alien domains [OPTIONS] <COMMAND>

Subcommand	Description
`add`	Register a domain and show its required DNS records.
`ls`	List workspace domains.
`get`	Show a domain's verification state.
`refresh`	Check the domain's DNS records again.
`rm`	Remove a workspace domain.

Flag	Description
`--json`	Print machine-readable JSON.

`alien domains add`

alien domains add [OPTIONS] <DOMAIN>

Argument	Description
`<DOMAIN>`

Flag	Description
`--dns <DNS>`	Who manages the DNS zone. Values: `alien`, `customer`. Default: `alien`.
`--json`	Print machine-readable JSON.

`alien domains ls`

List workspace domains.

Alias: list.

alien domains ls [OPTIONS]

Flag	Description
`--json`	Print machine-readable JSON.

`alien domains get`

Show a domain's verification state.

alien domains get [OPTIONS] <ID>

Argument	Description
`<ID>`

Flag	Description
`--json`	Print machine-readable JSON.

`alien domains refresh`

Check the domain's DNS records again.

alien domains refresh [OPTIONS] <ID>

Argument	Description
`<ID>`

Flag	Description
`--json`	Print machine-readable JSON.

`alien domains rm`

Remove a workspace domain.

Alias: remove.

alien domains rm [OPTIONS] <ID>

Argument	Description
`<ID>`

Flag	Description
`--json`	Print machine-readable JSON.

`alien serve`

Run a manager on this machine.

alien serve [OPTIONS]

Flag	Description
`-c, --config <CONFIG>`	Path to TOML configuration file (default: alien-manager.toml in CWD).
`--init`	Write a commented alien-manager.toml to the current directory (or --config) and exit.
`--port <PORT>`	Override the HTTP server port.
`--host <HOST>`	Override the HTTP server bind address.

Gateways

`alien examples`

Print executable integration examples.

alien examples [OPTIONS] <COMMAND>

Subcommand	Description
`ai-gateway`	Generate an AI Gateway request.
`encryption-gateway`	Generate an Encryption Gateway request.
`remote-sandbox`	Generate a Remote Sandbox request.

Flag	Description
`--json`	Emit the example and metadata as JSON.

Examples:

alien examples ai-gateway --protocol openai-chat --model byo/claude-opus-5
alien examples ai-gateway --protocol openai-responses --json
alien examples ai-gateway --protocol anthropic-messages
alien examples encryption-gateway --operation encrypt
alien examples remote-sandbox --operation create
alien examples remote-sandbox --operation exec --command 'python3 --version'

`alien examples ai-gateway`

Generate an AI Gateway request.

alien examples ai-gateway [OPTIONS]

Flag	Description
`--json`	Emit the example and metadata as JSON.
`--protocol <PROTOCOL>`	Values: `openai-chat`, `openai-responses`, `anthropic-messages`. Default: `openai-chat`.
`--model <MODEL>`	Public model ID configured in the project. Default: `byo/claude-opus-5`.
`--external-id <EXTERNAL_ID>`	Literal external ID. Omit to use the $CUSTOMER_ID environment variable.

`alien examples encryption-gateway`

Generate an Encryption Gateway request.

alien examples encryption-gateway [OPTIONS]

Flag	Description
`--json`	Emit the example and metadata as JSON.
`--operation <OPERATION>`	Values: `encrypt`, `decrypt`. Default: `encrypt`.
`--external-id <EXTERNAL_ID>`	Literal external ID. Omit to use the $CUSTOMER_ID environment variable.
`--key-id <KEY_ID>`	Stable key identifier for this data class. Default: `customer-data`.

`alien examples remote-sandbox`

Generate a Remote Sandbox request.

alien examples remote-sandbox [OPTIONS]

Flag	Description
`--json`	Emit the example and metadata as JSON.
`--operation <OPERATION>`	Values: `create`, `exec`, `delete`. Default: `create`.
`--external-id <EXTERNAL_ID>`	Literal external ID. Omit to use the $CUSTOMER_ID environment variable.
`--command <COMMAND>`	Shell command the exec example runs inside the sandbox (exec and delete take the `sandboxId` create returns). Default: `"echo hello"`.

`alien usage`

Show AI and Encryption Gateway usage.

alien usage [OPTIONS] <SERVICE>

Argument	Description
`<SERVICE>`	Values: `ai`, `encryption`.

Flag	Description
`--range <RANGE>`	Values: `24h`, `7d`, `30d`. Default: `24h`.
`--json`	Emit the complete privacy-safe aggregate response.

Examples:

alien usage ai --range 24h
alien usage ai --range 7d --json
alien usage encryption --range 30d

InstallCopy Anchor Link

Global flagsCopy Anchor Link

CommandsCopy Anchor Link

Account and projectCopy Anchor Link

alien loginCopy Anchor Link

alien logoutCopy Anchor Link

alien whoamiCopy Anchor Link

alien workspacesCopy Anchor Link

alien workspaces currentCopy Anchor Link

alien workspaces createCopy Anchor Link

alien workspaces setCopy Anchor Link

alien workspaces lsCopy Anchor Link

alien projectsCopy Anchor Link

alien projects createCopy Anchor Link

alien projects lsCopy Anchor Link

alien projects getCopy Anchor Link

alien projects deleteCopy Anchor Link

alien projects portalCopy Anchor Link

alien projects portal getCopy Anchor Link

alien projects portal setCopy Anchor Link

alien projects portal domainCopy Anchor Link

alien projects portal google-sign-inCopy Anchor Link

alien projects packagesCopy Anchor Link

alien projects packages getCopy Anchor Link

alien projects packages updateCopy Anchor Link

alien projects capabilitiesCopy Anchor Link

alien projects capabilities statusCopy Anchor Link

alien projects capabilities enableCopy Anchor Link

alien linkCopy Anchor Link

alien unlinkCopy Anchor Link

alien initCopy Anchor Link

alien upgradeCopy Anchor Link

Local developmentCopy Anchor Link

alien devCopy Anchor Link

alien dev serverCopy Anchor Link

alien dev deploymentsCopy Anchor Link

alien dev deployments set-domainsCopy Anchor Link

alien dev deployments createCopy Anchor Link

alien dev deployments lsCopy Anchor Link

alien dev deployments getCopy Anchor Link

alien dev deployments resourcesCopy Anchor Link

alien dev deployments eventsCopy Anchor Link

alien dev deployments waitCopy Anchor Link

alien dev deployments machinesCopy Anchor Link

alien dev deployments drain-machineCopy Anchor Link

alien dev deployments cancel-machine-drainCopy Anchor Link

alien dev deployments remove-machineCopy Anchor Link

alien dev deployments join-tokensCopy Anchor Link

alien dev deployments join-tokens listCopy Anchor Link

alien dev deployments join-tokens createCopy Anchor Link

alien dev deployments join-tokens rotateCopy Anchor Link

alien dev deployments join-tokens revokeCopy Anchor Link

alien dev deployments volumesCopy Anchor Link

alien dev deployments restore-volumeCopy Anchor Link

alien dev deployments cancel-volume-restoreCopy Anchor Link

alien dev deployments deleteCopy Anchor Link

alien dev deployments retryCopy Anchor Link

alien dev deployments redeployCopy Anchor Link

alien dev deployments moveCopy Anchor Link

alien dev deployments pinCopy Anchor Link

alien dev deployments set-computeCopy Anchor Link

alien dev deployments set-envCopy Anchor Link

alien dev deployments inputsCopy Anchor Link

alien dev deployments set-inputsCopy Anchor Link

alien dev deployments checkCopy Anchor Link

alien dev deployments set-channelCopy Anchor Link

alien dev deployments tokenCopy Anchor Link

alien dev deployments untrackCopy Anchor Link

alien dev releasesCopy Anchor Link

alien dev releases lsCopy Anchor Link

alien dev releases getCopy Anchor Link

alien dev releases promoteCopy Anchor Link

alien dev releases channelsCopy Anchor Link

alien dev releases create-channelCopy Anchor Link

alien dev releases delete-channelCopy Anchor Link

alien dev whoamiCopy Anchor Link

alien dev deployCopy Anchor Link

alien dev destroyCopy Anchor Link

alien dev releaseCopy Anchor Link

Install

Global flags

Commands

Account and project

`alien login`

`alien logout`

`alien whoami`

`alien workspaces`

`alien workspaces current`

`alien workspaces create`

`alien workspaces set`

`alien workspaces ls`

`alien projects`

`alien projects create`

`alien projects ls`

`alien projects get`

`alien projects delete`

`alien projects portal`

`alien projects portal get`

`alien projects portal set`

`alien projects portal domain`

`alien projects portal google-sign-in`

`alien projects packages`

`alien projects packages get`

`alien projects packages update`

`alien projects capabilities`

`alien projects capabilities status`

`alien projects capabilities enable`

`alien link`

`alien unlink`

`alien init`

`alien upgrade`

Local development

`alien dev`

`alien dev server`

`alien dev deployments`

`alien dev deployments set-domains`

`alien dev deployments create`

`alien dev deployments ls`

`alien dev deployments get`

`alien dev deployments resources`

`alien dev deployments events`

`alien dev deployments wait`

`alien dev deployments machines`

`alien dev deployments drain-machine`

`alien dev deployments cancel-machine-drain`

`alien dev deployments remove-machine`

`alien dev deployments join-tokens`

`alien dev deployments join-tokens list`

`alien dev deployments join-tokens create`

`alien dev deployments join-tokens rotate`

`alien dev deployments join-tokens revoke`

`alien dev deployments volumes`

`alien dev deployments restore-volume`

`alien dev deployments cancel-volume-restore`

`alien dev deployments delete`

`alien dev deployments retry`

`alien dev deployments redeploy`

`alien dev deployments move`

`alien dev deployments pin`

`alien dev deployments set-compute`

`alien dev deployments set-env`

`alien dev deployments inputs`

`alien dev deployments set-inputs`

`alien dev deployments check`

`alien dev deployments set-channel`

`alien dev deployments token`

`alien dev deployments untrack`

`alien dev releases`

`alien dev releases ls`

`alien dev releases get`

`alien dev releases promote`

`alien dev releases channels`

`alien dev releases create-channel`

`alien dev releases delete-channel`

`alien dev whoami`

`alien dev deploy`

`alien dev destroy`

`alien dev release`

`alien dev vault`