@alienplatform/core 3.3.28 → 3.3.30

package/dist/index.js

@@ -1,6 +1,62 @@
 import * as z$2 from "zod";
 import * as z$1 from "zod/v4";
 import { serializeError } from "serialize-error";
+//#region src/generated/zod/secret-reference-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Reference to a Kubernetes Secret
+*/
+const SecretReferenceSchema = z$2.object({
+	"key": z$2.string(),
+	"name": z$2.string()
+}).describe("Reference to a Kubernetes Secret");
+//#endregion
+//#region src/generated/zod/value-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+const ValueSchema = z$2.json();
+//#endregion
+//#region src/generated/zod/binding-value-string-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret
+*/
+const BindingValueStringSchema = z$2.union([
+	z$2.lazy(() => ValueSchema),
+	z$2.string(),
+	z$2.object({ get "secretRef"() {
+		return SecretReferenceSchema.describe("Reference to a Kubernetes Secret");
+	} })
+]).describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+//#endregion
+//#region src/generated/zod/acr-artifact-registry-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Azure Container Registry binding configuration
+*/
+const AcrArtifactRegistryBindingSchema = z$2.object({
+	get "registryName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "repositoryPrefix"() {
+		return z$2.union([BindingValueStringSchema, z$2.null()]).optional();
+	},
+	get "resourceGroupName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Azure Container Registry binding configuration");
+//#endregion
 //#region src/generated/zod/alien-error-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -705,6 +761,94 @@ const AlienEventSchema = z$2.union([
 */
 const ArchitectureSchema = z$2.enum(["arm64", "x86_64"]).describe("CPU architecture.");
 //#endregion
+//#region src/generated/zod/ecr-artifact-registry-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description AWS ECR (Elastic Container Registry) binding configuration
+*/
+const EcrArtifactRegistryBindingSchema = z$2.object({
+	get "pullRoleArn"() {
+		return z$2.union([BindingValueStringSchema, z$2.null()]).optional();
+	},
+	get "pushRoleArn"() {
+		return z$2.union([BindingValueStringSchema, z$2.null()]).optional();
+	},
+	get "repositoryPrefix"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("AWS ECR (Elastic Container Registry) binding configuration");
+//#endregion
+//#region src/generated/zod/gar-artifact-registry-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Google Artifact Registry binding configuration
+*/
+const GarArtifactRegistryBindingSchema = z$2.object({
+	get "pullServiceAccountEmail"() {
+		return z$2.union([BindingValueStringSchema, z$2.null()]).optional();
+	},
+	get "pushServiceAccountEmail"() {
+		return z$2.union([BindingValueStringSchema, z$2.null()]).optional();
+	},
+	get "repositoryName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Google Artifact Registry binding configuration");
+//#endregion
+//#region src/generated/zod/binding-value-option-string-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret
+*/
+const BindingValueOptionStringSchema = z$2.union([
+	z$2.union([z$2.string(), z$2.null()]),
+	z$2.lazy(() => ValueSchema),
+	z$2.object({ get "secretRef"() {
+		return SecretReferenceSchema.describe("Reference to a Kubernetes Secret");
+	} })
+]).describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+//#endregion
+//#region src/generated/zod/local-artifact-registry-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Local container registry binding configuration.\n\nThe local registry runs on localhost only and does not require authentication.\nSecurity boundary is the OS process isolation on the customer\'s machine.\nExternal image access is secured by the manager\'s registry proxy (deployment tokens).
+*/
+const LocalArtifactRegistryBindingSchema = z$2.object({
+	get "dataDir"() {
+		return BindingValueOptionStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "registryUrl"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Local container registry binding configuration.\n\nThe local registry runs on localhost only and does not require authentication.\nSecurity boundary is the OS process isolation on the customer's machine.\nExternal image access is secured by the manager's registry proxy (deployment tokens).");
+//#endregion
+//#region src/generated/zod/artifact-registry-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Service-type based artifact registry binding that supports multiple registry providers
+*/
+const ArtifactRegistryBindingSchema = z$2.union([
+	z$2.lazy(() => EcrArtifactRegistryBindingSchema).and(z$2.object({ "service": z$2.enum(["ecr"]) })).describe("AWS ECR (Elastic Container Registry) binding configuration"),
+	z$2.lazy(() => AcrArtifactRegistryBindingSchema).and(z$2.object({ "service": z$2.enum(["acr"]) })).describe("Azure Container Registry binding configuration"),
+	z$2.lazy(() => GarArtifactRegistryBindingSchema).and(z$2.object({ "service": z$2.enum(["gar"]) })).describe("Google Artifact Registry binding configuration"),
+	z$2.lazy(() => LocalArtifactRegistryBindingSchema).and(z$2.object({ "service": z$2.enum(["local"]) })).describe("Local container registry binding configuration.\n\nThe local registry runs on localhost only and does not require authentication.\nSecurity boundary is the OS process isolation on the customer's machine.\nExternal image access is secured by the manager's registry proxy (deployment tokens).")
+]).describe("Service-type based artifact registry binding that supports multiple registry providers");
+//#endregion
 //#region src/generated/zod/artifact-registry-heartbeat-status-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -885,6 +1029,48 @@ const ArtifactRegistrySchema = z$2.object({
 	"replicationRegions": z$2.optional(z$2.array(z$2.string()).describe("AWS-only: regions to replicate container images to.\nECR private image replication ensures images pushed in the registry's home region\nare automatically available in these additional regions (required when Lambda or\nother compute runs in a different region from the registry)."))
 }).describe("Represents an artifact registry for storing container images and other build artifacts.\nThis is a high-level wrapper resource that provides a cloud-agnostic interface over\nAWS ECR, GCP Artifact Registry, and Azure Container Registry.\n\n# Platform Mapping\n- **AWS**: Implicitly exists as the AWS account and region\n- **GCP**: Explicitly configured per project and location (Artifact Registry API enabled)\n- **Azure**: Explicitly provisioned Azure Container Registry instance\n\nThe actual repository management and permissions are handled through the bindings API.");
 //#endregion
+//#region src/generated/zod/binding-value-u16-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret
+*/
+const BindingValueU16Schema = z$2.union([
+	z$2.int(),
+	z$2.lazy(() => ValueSchema),
+	z$2.object({ get "secretRef"() {
+		return SecretReferenceSchema.describe("Reference to a Kubernetes Secret");
+	} })
+]).describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+//#endregion
+//#region src/generated/zod/aurora-postgres-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description AWS Aurora Serverless v2 binding.
+*/
+const AuroraPostgresBindingSchema = z$2.object({
+	get "clusterEndpoint"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "database"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "passwordSecretArn"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "port"() {
+		return BindingValueU16Schema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "username"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("AWS Aurora Serverless v2 binding.");
+//#endregion
 //#region src/generated/zod/postgres-heartbeat-status-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -1223,6 +1409,7 @@ const AwsComputeClusterHeartbeatDataSchema = z$2.object({
 const AwsComputeClusterImportDataSchema = z$2.object({
 	"clusterId": z$2.string().describe("Cluster identifier used by container orchestration."),
 	"instanceProfileArn": z$2.string().describe("IAM instance profile ARN for cluster machines."),
+	"isolatedInstanceProfileArn": z$2.string().describe("Optional isolated node instance profile ARN.").nullish(),
 	"securityGroupId": z$2.string().describe("Security group ID attached to cluster machines.")
 }).describe("AWS ComputeCluster ImportData.");
 //#endregion
@@ -1233,13 +1420,6 @@ const AwsComputeClusterImportDataSchema = z$2.object({
 */
 const AwsCustomCertificateConfigSchema = z$2.object({ "certificateArn": z$2.string() });
 //#endregion
-//#region src/generated/zod/value-schema.ts
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
-const ValueSchema = z$2.any();
-//#endregion
 //#region src/generated/zod/managed-runtime-event-involved-object-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -2260,6 +2440,9 @@ const AzureComputeClusterImportDataSchema = z$2.object({
 	"clusterId": z$2.string().describe("Cluster identifier used by the controller."),
 	"clusterIdentityPrincipalId": z$2.string().describe("AKS cluster identity principal id (system-assigned identity)."),
 	"identityId": z$2.string().describe("Resource ID of the user-assigned identity attached to cluster VMs."),
+	"isolatedIdentityClientId": z$2.string().describe("Optional isolated node identity client ID.").nullish(),
+	"isolatedIdentityId": z$2.string().describe("Optional isolated node identity resource ID.").nullish(),
+	"isolatedIdentityPrincipalId": z$2.string().describe("Optional isolated node identity principal ID.").nullish(),
 	"kubeletIdentityClientId": z$2.string().describe("kubelet UAMI client id used by node pools.")
 }).describe("Azure ComputeCluster ImportData — AKS node pool identity / network.");
 //#endregion
@@ -3083,6 +3266,55 @@ const BindingConfigurationGcpBindingSpecSchema = z$2.object({
 	}).describe("GCP-specific binding specification"))
 }).describe("Generic binding configuration for permissions");
 //#endregion
+//#region src/generated/zod/binding-value-u8-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret
+*/
+const BindingValueU8Schema = z$2.union([
+	z$2.int(),
+	z$2.lazy(() => ValueSchema),
+	z$2.object({ get "secretRef"() {
+		return SecretReferenceSchema.describe("Reference to a Kubernetes Secret");
+	} })
+]).describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+//#endregion
+//#region src/generated/zod/binding-value-vec-string-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret
+*/
+const BindingValueVecStringSchema = z$2.union([
+	z$2.array(z$2.string()),
+	z$2.lazy(() => ValueSchema),
+	z$2.object({ get "secretRef"() {
+		return SecretReferenceSchema.describe("Reference to a Kubernetes Secret");
+	} })
+]).describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+//#endregion
+//#region src/generated/zod/blob-storage-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Azure Blob Storage binding configuration
+*/
+const BlobStorageBindingSchema = z$2.object({
+	get "accountName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "containerName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Azure Blob Storage binding configuration");
+//#endregion
 //#region src/generated/zod/presigned-operation-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -3462,6 +3694,35 @@ const CapacityGroupSchema = z$2.object({
 	}
 }).describe("Capacity group definition.\n\nA capacity group represents machines with identical hardware profiles.\nEach group becomes a separate Auto Scaling Group (AWS), Managed Instance Group (GCP),\nor VM Scale Set (Azure).");
 //#endregion
+//#region src/generated/zod/cloud-sql-postgres-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description GCP Cloud SQL binding.
+*/
+const CloudSqlPostgresBindingSchema = z$2.object({
+	get "database"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "host"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "passwordSecretName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "port"() {
+		return BindingValueU16Schema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "serverCaCertificates"() {
+		return BindingValueVecStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "username"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("GCP Cloud SQL binding.");
+//#endregion
 //#region src/generated/zod/command-delivery-mode-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -3681,6 +3942,81 @@ const ComputeClusterHeartbeatDataSchema = z$2.union([
 	z$2.lazy(() => LocalComputeClusterHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["local"]) }))
 ]);
 //#endregion
+//#region src/generated/zod/gcp-platform-permission-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description GCP-specific platform permission configuration
+*/
+const GcpPlatformPermissionSchema = z$2.object({
+	get "binding"() {
+		return BindingConfigurationGcpBindingSpecSchema.describe("Generic binding configuration for permissions");
+	},
+	"description": z$2.string().describe("Short admin-facing description of why this entry exists.").nullish(),
+	get "grant"() {
+		return PermissionGrantSchema.describe("Grant permissions for a specific cloud platform");
+	},
+	"label": z$2.string().describe("Stable admin-facing label for this permission entry.").nullish()
+}).describe("GCP-specific platform permission configuration");
+//#endregion
+//#region src/generated/zod/platform-permissions-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Platform-specific permission configurations
+*/
+const PlatformPermissionsSchema = z$2.object({
+	get "aws"() {
+		return z$2.array(AwsPlatformPermissionSchema.describe("AWS-specific platform permission configuration")).describe("AWS permission configurations").nullish();
+	},
+	get "azure"() {
+		return z$2.array(AzurePlatformPermissionSchema.describe("Azure-specific platform permission configuration")).describe("Azure permission configurations").nullish();
+	},
+	get "gcp"() {
+		return z$2.array(GcpPlatformPermissionSchema.describe("GCP-specific platform permission configuration")).describe("GCP permission configurations").nullish();
+	}
+}).describe("Platform-specific permission configurations");
+//#endregion
+//#region src/generated/zod/permission-set-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description A permission set that can be applied across different cloud platforms
+*/
+const PermissionSetSchema = z$2.object({
+	"description": z$2.string().describe("Human-readable description of what this permission set allows"),
+	"id": z$2.string().describe("Unique identifier for the permission set (e.g., \"storage/data-read\")"),
+	get "platforms"() {
+		return PlatformPermissionsSchema.describe("Platform-specific permission configurations");
+	}
+}).describe("A permission set that can be applied across different cloud platforms");
+//#endregion
+//#region src/generated/zod/permission-set-reference-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Reference to a permission set - either by name or inline definition
+*/
+const PermissionSetReferenceSchema = z$2.union([z$2.lazy(() => PermissionSetSchema), z$2.string()]).describe("Reference to a permission set - either by name or inline definition");
+//#endregion
+//#region src/generated/zod/permission-profile-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource
+*/
+const PermissionProfileSchema = z$2.object({}).catchall(z$2.array(z$2.lazy(() => PermissionSetReferenceSchema).describe("Reference to a permission set - either by name or inline definition"))).describe("Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource");
+//#endregion
 //#region src/generated/zod/compute-cluster-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -3697,6 +4033,12 @@ const ComputeClusterSchema = z$2.object({
 	"dynamicContainerPool": z$2.string().describe("Pool reserved for containers created after a deployment is installed.\nIf absent, the runtime uses the `general` pool when it exists.").nullish(),
 	"failureDomainSpread": z$2.optional(z$2.object({}).catchall(z$2.int().min(0)).describe("Requested failure-domain spread keyed by capacity group.\nEmpty preserves the existing aggregate layout.")),
 	"id": z$2.string().describe("Unique identifier for the container cluster.\nMust contain only alphanumeric characters, hyphens, and underscores."),
+	get "nodePermissions"() {
+		return z$2.union([PermissionProfileSchema, z$2.null()]).optional();
+	},
+	get "nodePermissionsPlatforms"() {
+		return z$2.array(PlatformSchema.describe("Represents the target cloud platform.")).describe("Cloud platforms on which the explicit node grants apply; absent applies everywhere.").nullish();
+	},
 	"selectedFailureDomains": z$2.optional(z$2.object({}).catchall(z$2.array(z$2.string())).describe("Concrete provider failure domains selected during setup, keyed by capacity group.\nEmpty preserves the existing aggregate layout when no spread policy is configured."))
 }).describe("ComputeCluster resource for running long-running container workloads.\n\nA ComputeCluster provides the setup-owned machine boundary for containers.\nAlien may manage the worker fleet inside that boundary when setup grants\n`compute-cluster/management`.\n\n## Architecture\n\n- **Setup** creates cloud resources: ASGs/MIGs/VMSSs, IAM roles, security groups\n- **Alien** manages allowed fleet operations: machine count, runtime\n  machine image rollout and, on AWS, the machine type within one CPU architecture\n- A node agent runs on each machine from the selected runtime image channel\n\n## Example\n\n```rust\nuse alien_core::{CapacityGroup, ComputeCluster, MachineProfile};\n\nlet cluster = ComputeCluster::new(\"compute\".to_string())\n    .capacity_group(CapacityGroup {\n        group_id: \"general\".to_string(),\n        instance_type: None,\n        profile: Some(MachineProfile {\n            cpu: \"4.0\".to_string(),\n            memory_bytes: 16 * 1024 * 1024 * 1024,\n            ephemeral_storage_bytes: 20 * 1024 * 1024 * 1024,\n            architecture: None,\n            gpu: None,\n        }),\n        min_size: 1,\n        max_size: 5,\n        scale_policy: None,\n        nested_virtualization: None,\n    })\n    .build();\n```");
 //#endregion
@@ -3748,6 +4090,32 @@ const ComputePoolSelectionSchema = z$2.union([z$2.object({
 */
 const ComputeSettingsSchema = z$2.object({ "pools": z$2.optional(z$2.object({}).catchall(z$2.lazy(() => ComputePoolSelectionSchema).describe("User-selected deployment settings for one compute pool.")).describe("Selected compute choices keyed by pool ID.")) }).describe("Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts.");
 //#endregion
+//#region src/generated/zod/container-apps-environment-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Binding configuration for a pre-existing Azure Container Apps Environment.\n\nUsed when deploying to an existing environment instead of having Alien provision one.\nThis is useful for shared environments (e.g., test infrastructure) or enterprise\nsetups where environments are managed by a separate team.
+*/
+const ContainerAppsEnvironmentBindingSchema = z$2.object({
+	get "defaultDomain"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "environmentName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "resourceGroupName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "resourceId"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "staticIp"() {
+		return z$2.union([BindingValueStringSchema, z$2.null()]).optional();
+	}
+}).describe("Binding configuration for a pre-existing Azure Container Apps Environment.\n\nUsed when deploying to an existing environment instead of having Alien provision one.\nThis is useful for shared environments (e.g., test infrastructure) or enterprise\nsetups where environments are managed by a separate team.");
+//#endregion
 //#region src/generated/zod/container-autoscaling-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -4205,6 +4573,69 @@ const ReplicaStatusSchema = z$2.object({
 	"replicaId": z$2.string().describe("Replica ID (e.g., \"api-0\", \"api-1\")")
 }).describe("Status of a single container replica.");
 //#endregion
+//#region src/generated/zod/volume-backups-state-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description State of a container\'s snapshot schedule.
+*/
+const VolumeBackupsStateSchema = z$2.enum([
+	"active",
+	"disabled",
+	"setupRequired"
+]).describe("State of a container's snapshot schedule.");
+//#endregion
+//#region src/generated/zod/volume-backups-status-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Whether a container\'s snapshot schedule is in place.
+*/
+const VolumeBackupsStatusSchema = z$2.object({
+	"message": z$2.string().describe("What is missing when the state is `setupRequired`").nullish(),
+	get "state"() {
+		return VolumeBackupsStateSchema.describe("State of a container's snapshot schedule.");
+	}
+}).describe("Whether a container's snapshot schedule is in place.");
+//#endregion
+//#region src/generated/zod/volume-restore-output-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description A completed volume restore.
+*/
+const VolumeRestoreOutputSchema = z$2.object({
+	"completedAt": z$2.string().describe("When the restored volume was put in place (RFC 3339)"),
+	"replacedVolumeSnapshotId": z$2.string().describe("Snapshot of the replaced volume, taken just before it was deleted"),
+	"requestId": z$2.string().describe("ID of the restore request"),
+	"snapshotId": z$2.string().describe("Snapshot the volume was restored from")
+}).describe("A completed volume restore.");
+//#endregion
+//#region src/generated/zod/volume-output-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description A replica\'s persistent volume and its latest completed snapshot.
+*/
+const VolumeOutputSchema = z$2.object({
+	get "lastRestore"() {
+		return z$2.union([VolumeRestoreOutputSchema, z$2.null()]).optional();
+	},
+	"lastSnapshotAt": z$2.string().describe("When the latest completed snapshot was started (RFC 3339)").nullish(),
+	"lastSnapshotId": z$2.string().describe("Cloud ID of the latest completed snapshot, if any").nullish(),
+	"ordinal": z$2.int().min(0).describe("Replica ordinal the volume belongs to"),
+	"volumeId": z$2.string().describe("Cloud ID of the volume (EBS volume ID, Persistent Disk name, or Managed Disk ID)"),
+	"zone": z$2.string().describe("Zone the volume lives in")
+}).describe("A replica's persistent volume and its latest completed snapshot.");
+//#endregion
 //#region src/generated/zod/container-outputs-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -4224,6 +4655,12 @@ const ContainerOutputsSchema = z$2.object({
 	},
 	get "status"() {
 		return ContainerStatusSchema.describe("Container status in the managed container backend.");
+	},
+	get "volumeBackups"() {
+		return z$2.union([VolumeBackupsStatusSchema, z$2.null()]).optional();
+	},
+	get "volumes"() {
+		return z$2.array(VolumeOutputSchema.describe("A replica's persistent volume and its latest completed snapshot.")).describe("Persistent volumes, one per replica ordinal, with their latest snapshot.").optional();
 	}
 }).describe("Outputs generated by a successfully provisioned Container.");
 //#endregion
@@ -4316,6 +4753,20 @@ const KubernetesSecretMountSchema = z$2.object({
 	"secretName": z$2.string().describe("Name of the existing Secret in the deployment namespace.")
 }).describe("Mounts an existing, setup-owned Kubernetes Secret into a Container pod.\nThe Secret must exist in the deployment namespace before the workload starts.");
 //#endregion
+//#region src/generated/zod/volume-backups-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Scheduled snapshots of a persistent volume.\n\nThe cloud\'s own scheduler takes the snapshots (AWS Data Lifecycle Manager,\na Compute Engine snapshot schedule, or Azure Disk Backup), so they keep being\ntaken while the deployment is unreachable. Snapshots are crash-consistent:\nthe volume as it would be after a sudden power loss. When a container is\ndeleted, Alien keeps one final snapshot of each volume.\n\nKubernetes deployments leave volume backups to the cluster\'s own tooling,\nand local deployments don\'t snapshot volumes. Neither reports volumes in\n`ContainerOutputs.volumes` or a `volumeBackups` status.
+*/
+const VolumeBackupsSchema = z$2.object({
+	"enabled": z$2.optional(z$2.boolean().describe("Whether snapshots are taken. Defaults to true.")),
+	"intervalHours": z$2.optional(z$2.int().min(0).describe("Hours between snapshots: 1, 2, 4, 6, 8, 12 or 24. Defaults to 24.")),
+	"retentionDays": z$2.optional(z$2.int().min(0).describe("Days each snapshot is kept, at most 365. Defaults to 7."))
+}).describe("Scheduled snapshots of a persistent volume.\n\nThe cloud's own scheduler takes the snapshots (AWS Data Lifecycle Manager,\na Compute Engine snapshot schedule, or Azure Disk Backup), so they keep being\ntaken while the deployment is unreachable. Snapshots are crash-consistent:\nthe volume as it would be after a sudden power loss. When a container is\ndeleted, Alien keeps one final snapshot of each volume.\n\nKubernetes deployments leave volume backups to the cluster's own tooling,\nand local deployments don't snapshot volumes. Neither reports volumes in\n`ContainerOutputs.volumes` or a `volumeBackups` status.");
+//#endregion
 //#region src/generated/zod/persistent-storage-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -4325,6 +4776,9 @@ const KubernetesSecretMountSchema = z$2.object({
 * @description Persistent storage configuration for stateful containers.
 */
 const PersistentStorageSchema = z$2.object({
+	get "backups"() {
+		return VolumeBackupsSchema.describe("Scheduled snapshots of a persistent volume.\n\nThe cloud's own scheduler takes the snapshots (AWS Data Lifecycle Manager,\na Compute Engine snapshot schedule, or Azure Disk Backup), so they keep being\ntaken while the deployment is unreachable. Snapshots are crash-consistent:\nthe volume as it would be after a sudden power loss. When a container is\ndeleted, Alien keeps one final snapshot of each volume.\n\nKubernetes deployments leave volume backups to the cluster's own tooling,\nand local deployments don't snapshot volumes. Neither reports volumes in\n`ContainerOutputs.volumes` or a `volumeBackups` status.").optional();
+	},
 	"mountPath": z$2.string().describe("Mount path inside the container"),
 	"size": z$2.string().describe("Storage size (e.g., \"100Gi\", \"500Gi\")")
 }).describe("Persistent storage configuration for stateful containers.");
@@ -4760,7 +5214,7 @@ const DaemonSchema = z$2.object({
 	get "memory"() {
 		return ResourceSpecSchema.describe("Resource specification with min/desired values.").optional();
 	},
-	"permissions": z$2.string(),
+	"permissions": z$2.string().describe("Named workload permission profile. Absent means no workload cloud identity.").nullish(),
 	"pool": z$2.string().describe("Capacity group/pool to run on for backends that expose machine pools.").nullish(),
 	get "publicEndpoints"() {
 		return z$2.array(PublicEndpointSchema.describe("Public endpoint configuration for port-backed workload resources.")).describe("Public endpoints exposed by the daemon.").optional();
@@ -4798,6 +5252,7 @@ const DeployerSecretStoreSchema = z$2.enum([
 const DeployerSecretLocationSchema = z$2.object({
 	"cliCommand": z$2.string().describe("Command that writes the value, with `<VALUE>` in place of the secret."),
 	"consoleUrl": z$2.string().describe("Cloud console page where the secret is created, when the store has one.").nullish(),
+	"deleteCommand": z$2.string().describe("Command that deletes the secret. Deleting a deployment keeps the\nsecrets the deployer wrote, since Alien never owned their values.").nullish(),
 	"name": z$2.string().describe("Full name of the secret in that store."),
 	get "store"() {
 		return DeployerSecretStoreSchema.describe("The secret store a deployer writes a vault-native secret into.");
@@ -4837,7 +5292,8 @@ const DeployerSecretReportSchema = z$2.object({
 	"required": z$2.boolean().describe("Whether the workload cannot start without it."),
 	get "status"() {
 		return DeployerSecretStatusSchema.describe("Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value.");
-	}
+	},
+	"version": z$2.string().describe("The secret store's version of the present value (never the value or a\nhash of it). A new version reaches workloads with the next update.").nullish()
 }).describe("The state of one deployer secret slot, reported with the deployment.");
 //#endregion
 //#region src/generated/zod/deployment-model-schema.ts
@@ -4879,271 +5335,754 @@ const DevStatusSchema = z$2.object({
 	get "error"() {
 		return z$2.union([AlienErrorSchema, z$2.null()]).optional();
 	},
-	"lastUpdated": z$2.string().describe("ISO 8601 timestamp of last status update"),
-	"pid": z$2.int().min(0).describe("Dev server process ID"),
-	"platform": z$2.string().describe("Platform (always \"local\" for dev server)"),
-	"stackId": z$2.string().describe("Stack ID (always \"dev\" for dev server)"),
-	"startedAt": z$2.string().describe("ISO 8601 timestamp when dev server started"),
-	"stateDir": z$2.string().describe("Path to state directory"),
-	get "status"() {
-		return DevStatusStateSchema.describe("Overall dev server status");
+	"lastUpdated": z$2.string().describe("ISO 8601 timestamp of last status update"),
+	"pid": z$2.int().min(0).describe("Dev server process ID"),
+	"platform": z$2.string().describe("Platform (always \"local\" for dev server)"),
+	"stackId": z$2.string().describe("Stack ID (always \"dev\" for dev server)"),
+	"startedAt": z$2.string().describe("ISO 8601 timestamp when dev server started"),
+	"stateDir": z$2.string().describe("Path to state directory"),
+	get "status"() {
+		return DevStatusStateSchema.describe("Overall dev server status");
+	}
+}).describe("Overall status of the dev server");
+//#endregion
+//#region src/generated/zod/public-endpoint-target-settings-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description DNS target mode for public endpoints.
+*/
+const PublicEndpointTargetSettingsSchema = z$2.union([z$2.object({ "mode": z$2.enum(["machineAddresses"]) }), z$2.object({
+	"cnameTarget": z$2.string().describe("DNS name or URL for the external load balancer."),
+	"mode": z$2.enum(["loadBalancer"])
+})]).describe("DNS target mode for public endpoints.");
+//#endregion
+//#region src/generated/zod/domain-settings-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains.
+*/
+const DomainSettingsSchema = z$2.object({
+	"customDomains": z$2.object({}).catchall(z$2.lazy(() => CustomDomainConfigSchema).describe("Custom domain configuration for a single resource.")).describe("Custom domain configuration per resource ID.").nullish(),
+	get "publicEndpointTarget"() {
+		return z$2.union([PublicEndpointTargetSettingsSchema, z$2.null()]).optional();
+	}
+}).describe("Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains.");
+//#endregion
+//#region src/generated/zod/dynamic-container-health-check-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+const DynamicContainerHealthCheckSchema = z$2.object({
+	"path": z$2.string(),
+	"port": z$2.int().min(0)
+});
+//#endregion
+//#region src/generated/zod/dynamic-container-status-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+const DynamicContainerStatusSchema = z$2.enum([
+	"pending",
+	"running",
+	"failing",
+	"stopped"
+]);
+z$2.object({
+	"generation": z$2.int().min(0),
+	"message": z$2.string().nullish(),
+	"name": z$2.string(),
+	get "status"() {
+		return DynamicContainerStatusSchema;
+	}
+}).describe("What the Operator observed after applying one target generation.");
+//#endregion
+//#region src/generated/zod/dynamodb-kv-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description AWS DynamoDB KV binding configuration
+*/
+const DynamodbKvBindingSchema = z$2.object({
+	get "endpointUrl"() {
+		return z$2.union([BindingValueStringSchema, z$2.null()]).optional();
+	},
+	get "region"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "tableName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("AWS DynamoDB KV binding configuration");
+//#endregion
+//#region src/generated/zod/email-dkim-token-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description A single DKIM CNAME record the operator must create in DNS.
+*/
+const EmailDkimTokenSchema = z$2.object({
+	"name": z$2.string().describe("CNAME record host name."),
+	"value": z$2.string().describe("CNAME record value.")
+}).describe("A single DKIM CNAME record the operator must create in DNS.");
+//#endregion
+//#region src/generated/zod/email-domain-outputs-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Per-domain DNS records the operator must create.
+*/
+const EmailDomainOutputsSchema = z$2.object({ get "dkimTokens"() {
+	return z$2.array(EmailDkimTokenSchema.describe("A single DKIM CNAME record the operator must create in DNS.")).describe("Easy-DKIM CNAME tokens (three per domain). The domain is verified once\nthese records exist in its DNS configuration.");
+} }).describe("Per-domain DNS records the operator must create.");
+//#endregion
+//#region src/generated/zod/email-events-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Event configuration for an [`Email`] resource.
+*/
+const EmailEventsSchema = z$2.object({ get "queue"() {
+	return ResourceRefSchema.describe("Reference to a resource by its stable id and resource type.");
+} }).describe("Event configuration for an [`Email`] resource.");
+//#endregion
+//#region src/generated/zod/email-inbound-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Inbound-mail configuration for an [`Email`] resource.
+*/
+const EmailInboundSchema = z$2.object({ get "storage"() {
+	return ResourceRefSchema.describe("Reference to a resource by its stable id and resource type.");
+} }).describe("Inbound-mail configuration for an [`Email`] resource.");
+z$2.object({
+	"configurationSet": z$2.string().describe("The provisioned configuration set name (used when sending)."),
+	"domains": z$2.object({}).catchall(z$2.lazy(() => EmailDomainOutputsSchema).describe("Per-domain DNS records the operator must create.")).describe("DNS records per mail domain."),
+	"ruleSetName": z$2.string().describe("The inbound receipt rule set name, when `inbound` is configured.").nullish()
+}).describe("Outputs generated by a successfully provisioned Email resource.\n\nDomain verification status cannot be known at provisioning time — SES\nverifies a domain asynchronously once its DKIM records exist in DNS — so\nthe outputs carry the records the operator must create rather than a\nverification result.");
+//#endregion
+//#region src/generated/zod/email-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change.\n\nAlien activates the provisioned receipt rule set as part of setup. Because\nSES permits only one active receipt rule set per AWS account and region, an\nAWS stack may contain only one email resource with inbound delivery. The\nresource requires exclusive ownership of SES receiving in its account and\nregion: setup refuses to replace an active rule set it does not own. Choose\nan unused region when the account already receives email through SES. SES email\nreceiving is available only in a subset of AWS regions; deploying `inbound`\nto an unsupported region fails during setup.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.
+*/
+const EmailSchema = z$2.object({
+	"domains": z$2.optional(z$2.array(z$2.string()).describe("Seed mail domains provisioned at deploy time (one SES identity each).\nUseful for day-0 bootstrap and products with a static domain set.\nMay be empty (the default): products that create and verify domains\ndynamically should manage identities at runtime through the\n`email/manage-identities` grant instead of listing them here.")),
+	get "events"() {
+		return z$2.union([EmailEventsSchema, z$2.null()]).optional();
+	},
+	"id": z$2.string().describe("Identifier for the email resource. Must contain only alphanumeric\ncharacters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."),
+	get "inbound"() {
+		return z$2.union([EmailInboundSchema, z$2.null()]).optional();
+	}
+}).describe("Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change.\n\nAlien activates the provisioned receipt rule set as part of setup. Because\nSES permits only one active receipt rule set per AWS account and region, an\nAWS stack may contain only one email resource with inbound delivery. The\nresource requires exclusive ownership of SES receiving in its account and\nregion: setup refuses to replace an active rule set it does not own. Choose\nan unused region when the account already receives email through SES. SES email\nreceiving is available only in a subset of AWS regions; deploying `inbound`\nto an unsupported region fails during setup.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.");
+//#endregion
+//#region src/generated/zod/endpoint-access-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Reachability of the deployment\'s public endpoints, fixed at setup.
+*/
+const EndpointAccessSchema = z$2.enum(["internet", "private"]).describe("Reachability of the deployment's public endpoints, fixed at setup.");
+//#endregion
+//#region src/generated/zod/response-handling-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Response handling configuration for deployments
+*/
+const ResponseHandlingSchema = z$2.object({
+	"maxInlineBytes": z$2.int().min(0).describe("Maximum response body size that can be submitted inline"),
+	get "storageUploadRequest"() {
+		return PresignedRequestSchema.describe("A presigned request that can be serialized, stored, and executed later.\nHides implementation details for different storage backends.");
+	},
+	"submitResponseUrl": z$2.string().describe("URL where deployments submit responses")
+}).describe("Response handling configuration for deployments");
+//#endregion
+//#region src/generated/zod/trace-context-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description W3C Trace Context propagated with a command lease.\n\nThe values are kept in their standard wire form so receivers can attach\nthem to handler telemetry without inventing separate trace/span fields.
+*/
+const TraceContextSchema = z$2.object({
+	"traceparent": z$2.string().describe("W3C `traceparent` header value."),
+	"tracestate": z$2.string().describe("Optional W3C `tracestate` header value.").nullish()
+}).describe("W3C Trace Context propagated with a command lease.\n\nThe values are kept in their standard wire form so receivers can attach\nthem to handler telemetry without inventing separate trace/span fields.");
+//#endregion
+//#region src/generated/zod/envelope-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Commands envelope sent to deployments
+*/
+const EnvelopeSchema = z$2.object({
+	"attempt": z$2.int().min(0).describe("Attempt number (starts at 1)"),
+	"command": z$2.string().describe("Command name (e.g., \"generate-report\", \"sync-data\")"),
+	"commandId": z$2.string().describe("Unique command identifier"),
+	"deadline": z$2.iso.datetime().describe("Command deadline").nullish(),
+	"deploymentId": z$2.string().describe("Target deployment identifier"),
+	get "params"() {
+		return BodySpecSchema.describe("Body specification supporting inline and storage modes");
+	},
+	"protocol": z$2.string().describe("Protocol version identifier"),
+	get "responseHandling"() {
+		return ResponseHandlingSchema.describe("Response handling configuration for deployments");
+	},
+	get "target"() {
+		return CommandTargetSchema.describe("Identifies the specific resource a command is addressed to.");
+	},
+	get "traceContext"() {
+		return z$2.union([TraceContextSchema, z$2.null()]).optional();
+	}
+}).describe("Commands envelope sent to deployments");
+//#endregion
+//#region src/generated/zod/event-state-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Represents the state of an event
+*/
+const EventStateSchema = z$2.union([
+	z$2.object({ "failed": z$2.object({ get "error"() {
+		return z$2.union([AlienErrorSchema, z$2.null()]).optional();
+	} }).describe("Event failed with an error") }),
+	z$2.enum(["none"]),
+	z$2.enum(["started"]),
+	z$2.enum(["success"])
+]).describe("Represents the state of an event");
+//#endregion
+//#region src/generated/zod/event-change-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Represents a change to an event
+*/
+const EventChangeSchema = z$2.union([
+	z$2.object({
+		"createdAt": z$2.iso.datetime().describe("Timestamp when the event was created"),
+		get "event"() {
+			return AlienEventSchema.describe("Represents all possible events in the Alien system");
+		},
+		"id": z$2.string().describe("Unique identifier for the event"),
+		"parentId": z$2.string().describe("Parent event ID if this is a child event").nullish(),
+		get "state"() {
+			return EventStateSchema.describe("Represents the state of an event");
+		},
+		"type": z$2.enum(["created"])
+	}),
+	z$2.object({
+		get "event"() {
+			return AlienEventSchema.describe("Represents all possible events in the Alien system");
+		},
+		"id": z$2.string().describe("Unique identifier for the event"),
+		"type": z$2.enum(["updated"]),
+		"updatedAt": z$2.iso.datetime().describe("Timestamp when the event was updated")
+	}),
+	z$2.object({
+		"id": z$2.string().describe("Unique identifier for the event"),
+		get "newState"() {
+			return EventStateSchema.describe("Represents the state of an event");
+		},
+		"type": z$2.enum(["stateChanged"]),
+		"updatedAt": z$2.iso.datetime().describe("Timestamp when the state changed")
+	})
+]).describe("Represents a change to an event");
+//#endregion
+//#region src/generated/zod/external-ai-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description External AI provider binding configuration (BYO-key).\n\nThe operator-supplied secret rides inside the binding via\n`BindingValue<String>`, so it is a literal on cloud platforms and gains\nKubernetes SecretRef resolution for free (`extract_binding_secrets` walks\nthe binding JSON for `secretRef`).
+*/
+const ExternalAiBindingSchema = z$2.object({
+	get "apiKey"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	"provider": z$2.string().describe("The external AI provider name (e.g., \"openai\", \"anthropic\")")
+}).describe("External AI provider binding configuration (BYO-key).\n\nThe operator-supplied secret rides inside the binding via\n`BindingValue<String>`, so it is a literal on cloud platforms and gains\nKubernetes SecretRef resolution for free (`extract_binding_secrets` walks\nthe binding JSON for `secretRef`).");
+//#endregion
+//#region src/generated/zod/firestore-kv-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description GCP Firestore KV binding configuration
+*/
+const FirestoreKvBindingSchema = z$2.object({
+	get "collectionName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "databaseId"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "projectId"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("GCP Firestore KV binding configuration");
+//#endregion
+//#region src/generated/zod/local-kv-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Local development KV binding configuration
+*/
+const LocalKvBindingSchema = z$2.object({
+	get "dataDir"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "keyPrefix"() {
+		return z$2.union([BindingValueStringSchema, z$2.null()]).optional();
+	}
+}).describe("Local development KV binding configuration");
+//#endregion
+//#region src/generated/zod/redis-kv-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Redis KV binding configuration
+*/
+const RedisKvBindingSchema = z$2.object({
+	get "connectionUrl"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "database"() {
+		return z$2.union([BindingValueU8Schema, z$2.null()]).optional();
+	},
+	get "keyPrefix"() {
+		return z$2.union([BindingValueStringSchema, z$2.null()]).optional();
+	}
+}).describe("Redis KV binding configuration");
+//#endregion
+//#region src/generated/zod/table-storage-kv-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Azure Table Storage KV binding configuration
+*/
+const TableStorageKvBindingSchema = z$2.object({
+	get "accountName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "resourceGroupName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "tableName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Azure Table Storage KV binding configuration");
+//#endregion
+//#region src/generated/zod/kv-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Represents a KV binding for key-value storage across platforms
+*/
+const KvBindingSchema = z$2.union([
+	z$2.lazy(() => DynamodbKvBindingSchema).and(z$2.object({ "service": z$2.enum(["dynamodb"]) })).describe("AWS DynamoDB KV binding configuration"),
+	z$2.lazy(() => FirestoreKvBindingSchema).and(z$2.object({ "service": z$2.enum(["firestore"]) })).describe("GCP Firestore KV binding configuration"),
+	z$2.lazy(() => TableStorageKvBindingSchema).and(z$2.object({ "service": z$2.enum(["tablestorage"]) })).describe("Azure Table Storage KV binding configuration"),
+	z$2.lazy(() => RedisKvBindingSchema).and(z$2.object({ "service": z$2.enum(["redis"]) })).describe("Redis KV binding configuration"),
+	z$2.lazy(() => LocalKvBindingSchema).and(z$2.object({ "service": z$2.enum(["local-kv"]) })).describe("Local development KV binding configuration")
+]).describe("Represents a KV binding for key-value storage across platforms");
+//#endregion
+//#region src/generated/zod/external-postgres-ssl-mode-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description TLS policy for an operator-provided / BYO Postgres database.\n\nUnlike libpq\'s ambiguous `prefer` mode, both choices map exactly to the\nconnection settings exposed by every supported SDK.
+*/
+const ExternalPostgresSslModeSchema = z$2.enum(["verify-full", "disable"]).describe("TLS policy for an operator-provided / BYO Postgres database.\n\nUnlike libpq's ambiguous `prefer` mode, both choices map exactly to the\nconnection settings exposed by every supported SDK.");
+//#endregion
+//#region src/generated/zod/external-postgres-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Operator-provided / BYO database binding.
+*/
+const ExternalPostgresBindingSchema = z$2.object({
+	get "database"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "host"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	"password": z$2.string().describe("Connection password as a concrete value, never an unresolved `SecretRef`: the platform\nmaterializes the Kubernetes secret into the pod env. The cloud variants carry a secret\nlocator instead."),
+	get "port"() {
+		return BindingValueU16Schema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "sslMode"() {
+		return ExternalPostgresSslModeSchema.describe("TLS policy for an operator-provided / BYO Postgres database.\n\nUnlike libpq's ambiguous `prefer` mode, both choices map exactly to the\nconnection settings exposed by every supported SDK.").optional();
+	},
+	get "username"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Operator-provided / BYO database binding.");
+//#endregion
+//#region src/generated/zod/flexible-server-postgres-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Azure Flexible Server binding.
+*/
+const FlexibleServerPostgresBindingSchema = z$2.object({
+	get "database"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "host"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "passwordSecretUri"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "port"() {
+		return BindingValueU16Schema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "username"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Azure Flexible Server binding.");
+//#endregion
+//#region src/generated/zod/local-postgres-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Local embedded Postgres binding.
+*/
+const LocalPostgresBindingSchema = z$2.object({
+	get "database"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "host"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	"password": z$2.string(),
+	get "port"() {
+		return BindingValueU16Schema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "username"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Local embedded Postgres binding.");
+//#endregion
+//#region src/generated/zod/postgres-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Connection details for a Postgres database, one variant per backend.
+*/
+const PostgresBindingSchema = z$2.union([
+	z$2.lazy(() => AuroraPostgresBindingSchema).and(z$2.object({ "service": z$2.enum(["aurora"]) })).describe("AWS Aurora Serverless v2 binding."),
+	z$2.lazy(() => CloudSqlPostgresBindingSchema).and(z$2.object({ "service": z$2.enum(["cloud-sql"]) })).describe("GCP Cloud SQL binding."),
+	z$2.lazy(() => FlexibleServerPostgresBindingSchema).and(z$2.object({ "service": z$2.enum(["flexible-server"]) })).describe("Azure Flexible Server binding."),
+	z$2.lazy(() => ExternalPostgresBindingSchema).and(z$2.object({ "service": z$2.enum(["external"]) })).describe("Operator-provided / BYO database binding."),
+	z$2.lazy(() => LocalPostgresBindingSchema).and(z$2.object({ "service": z$2.enum(["local-postgres"]) })).describe("Local embedded Postgres binding.")
+]).describe("Connection details for a Postgres database, one variant per backend.");
+//#endregion
+//#region src/generated/zod/local-queue-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Local queue parameters
+*/
+const LocalQueueBindingSchema = z$2.object({ get "queuePath"() {
+	return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+} }).describe("Local queue parameters");
+//#endregion
+//#region src/generated/zod/pub-sub-queue-binding-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description GCP Pub/Sub parameters
+*/
+const PubSubQueueBindingSchema = z$2.object({
+	get "subscription"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "topic"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
 	}
-}).describe("Overall status of the dev server");
+}).describe("GCP Pub/Sub parameters");
 //#endregion
-//#region src/generated/zod/public-endpoint-target-settings-schema.ts
+//#region src/generated/zod/service-bus-queue-binding-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
 /**
-* @description DNS target mode for public endpoints.
+* @description Azure Service Bus parameters
 */
-const PublicEndpointTargetSettingsSchema = z$2.union([z$2.object({ "mode": z$2.enum(["machineAddresses"]) }), z$2.object({
-	"cnameTarget": z$2.string().describe("DNS name or URL for the external load balancer."),
-	"mode": z$2.enum(["loadBalancer"])
-})]).describe("DNS target mode for public endpoints.");
+const ServiceBusQueueBindingSchema = z$2.object({
+	get "namespace"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "queueName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Azure Service Bus parameters");
 //#endregion
-//#region src/generated/zod/domain-settings-schema.ts
+//#region src/generated/zod/sqs-queue-binding-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
 /**
-* @description Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains.
+* @description AWS SQS queue parameters
 */
-const DomainSettingsSchema = z$2.object({
-	"customDomains": z$2.object({}).catchall(z$2.lazy(() => CustomDomainConfigSchema).describe("Custom domain configuration for a single resource.")).describe("Custom domain configuration per resource ID.").nullish(),
-	get "publicEndpointTarget"() {
-		return z$2.union([PublicEndpointTargetSettingsSchema, z$2.null()]).optional();
-	}
-}).describe("Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains.");
+const SqsQueueBindingSchema = z$2.object({ get "queueUrl"() {
+	return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+} }).describe("AWS SQS queue parameters");
 //#endregion
-//#region src/generated/zod/dynamic-container-health-check-schema.ts
+//#region src/generated/zod/queue-binding-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
-const DynamicContainerHealthCheckSchema = z$2.object({
-	"path": z$2.string(),
-	"port": z$2.int().min(0)
-});
+/**
+* @description Binding parameters for Queue at runtime or in templates.
+*/
+const QueueBindingSchema = z$2.union([
+	z$2.lazy(() => SqsQueueBindingSchema).and(z$2.object({ "service": z$2.enum(["sqs"]) })).describe("AWS SQS queue parameters"),
+	z$2.lazy(() => PubSubQueueBindingSchema).and(z$2.object({ "service": z$2.enum(["pubsub"]) })).describe("GCP Pub/Sub parameters"),
+	z$2.lazy(() => ServiceBusQueueBindingSchema).and(z$2.object({ "service": z$2.enum(["servicebus"]) })).describe("Azure Service Bus parameters"),
+	z$2.lazy(() => LocalQueueBindingSchema).and(z$2.object({ "service": z$2.enum(["local-queue"]) })).describe("Local queue parameters")
+]).describe("Binding parameters for Queue at runtime or in templates.");
 //#endregion
-//#region src/generated/zod/dynamic-container-status-schema.ts
+//#region src/generated/zod/gcs-storage-binding-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
-const DynamicContainerStatusSchema = z$2.enum([
-	"pending",
-	"running",
-	"failing",
-	"stopped"
-]);
-z$2.object({
-	"generation": z$2.int().min(0),
-	"message": z$2.string().nullish(),
-	"name": z$2.string(),
-	get "status"() {
-		return DynamicContainerStatusSchema;
-	}
-}).describe("What the Operator observed after applying one target generation.");
+/**
+* @description Google Cloud Storage binding configuration
+*/
+const GcsStorageBindingSchema = z$2.object({ get "bucketName"() {
+	return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+} }).describe("Google Cloud Storage binding configuration");
 //#endregion
-//#region src/generated/zod/email-dkim-token-schema.ts
+//#region src/generated/zod/local-storage-binding-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
 /**
-* @description A single DKIM CNAME record the operator must create in DNS.
+* @description Local filesystem storage binding configuration
 */
-const EmailDkimTokenSchema = z$2.object({
-	"name": z$2.string().describe("CNAME record host name."),
-	"value": z$2.string().describe("CNAME record value.")
-}).describe("A single DKIM CNAME record the operator must create in DNS.");
+const LocalStorageBindingSchema = z$2.object({ get "storagePath"() {
+	return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+} }).describe("Local filesystem storage binding configuration");
 //#endregion
-//#region src/generated/zod/email-domain-outputs-schema.ts
+//#region src/generated/zod/s3-storage-binding-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
 /**
-* @description Per-domain DNS records the operator must create.
+* @description S3 storage binding configuration.\n\nTargets AWS S3 by default. Setting `endpoint` targets any S3-compatible\nstore instead (MinIO, Ceph RGW, NetApp StorageGRID, Cloudflare R2, ...),\nwhich is how Kubernetes deployments outside a cloud account attach the\ncustomer\'s existing object storage.
 */
-const EmailDomainOutputsSchema = z$2.object({ get "dkimTokens"() {
-	return z$2.array(EmailDkimTokenSchema.describe("A single DKIM CNAME record the operator must create in DNS.")).describe("Easy-DKIM CNAME tokens (three per domain). The domain is verified once\nthese records exist in its DNS configuration.");
-} }).describe("Per-domain DNS records the operator must create.");
+const S3StorageBindingSchema = z$2.object({
+	get "accessKeyId"() {
+		return z$2.union([BindingValueStringSchema, z$2.null()]).optional();
+	},
+	get "bucketName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "endpoint"() {
+		return z$2.union([BindingValueStringSchema, z$2.null()]).optional();
+	},
+	"forcePathStyle": z$2.boolean().describe("Use path-style URLs (`endpoint/bucket/key`) instead of virtual-hosted\nones (`bucket.endpoint/key`). Defaults to `true` when `endpoint` is\nset, since most S3-compatible stores require it.").nullish(),
+	get "region"() {
+		return z$2.union([BindingValueStringSchema, z$2.null()]).optional();
+	},
+	get "secretAccessKey"() {
+		return z$2.union([BindingValueStringSchema, z$2.null()]).optional();
+	}
+}).describe("S3 storage binding configuration.\n\nTargets AWS S3 by default. Setting `endpoint` targets any S3-compatible\nstore instead (MinIO, Ceph RGW, NetApp StorageGRID, Cloudflare R2, ...),\nwhich is how Kubernetes deployments outside a cloud account attach the\ncustomer's existing object storage.");
 //#endregion
-//#region src/generated/zod/email-events-schema.ts
+//#region src/generated/zod/storage-binding-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
 /**
-* @description Event configuration for an [`Email`] resource.
+* @description Service-type based storage binding that supports multiple storage providers
 */
-const EmailEventsSchema = z$2.object({ get "queue"() {
-	return ResourceRefSchema.describe("Reference to a resource by its stable id and resource type.");
-} }).describe("Event configuration for an [`Email`] resource.");
+const StorageBindingSchema = z$2.union([
+	z$2.lazy(() => S3StorageBindingSchema).and(z$2.object({ "service": z$2.enum(["s3"]) })).describe("S3 storage binding configuration.\n\nTargets AWS S3 by default. Setting `endpoint` targets any S3-compatible\nstore instead (MinIO, Ceph RGW, NetApp StorageGRID, Cloudflare R2, ...),\nwhich is how Kubernetes deployments outside a cloud account attach the\ncustomer's existing object storage."),
+	z$2.lazy(() => BlobStorageBindingSchema).and(z$2.object({ "service": z$2.enum(["blob"]) })).describe("Azure Blob Storage binding configuration"),
+	z$2.lazy(() => GcsStorageBindingSchema).and(z$2.object({ "service": z$2.enum(["gcs"]) })).describe("Google Cloud Storage binding configuration"),
+	z$2.lazy(() => LocalStorageBindingSchema).and(z$2.object({ "service": z$2.enum(["local-storage"]) })).describe("Local filesystem storage binding configuration")
+]).describe("Service-type based storage binding that supports multiple storage providers");
 //#endregion
-//#region src/generated/zod/email-inbound-schema.ts
+//#region src/generated/zod/key-vault-binding-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
 /**
-* @description Inbound-mail configuration for an [`Email`] resource.
+* @description Azure Key Vault binding configuration
 */
-const EmailInboundSchema = z$2.object({ get "storage"() {
-	return ResourceRefSchema.describe("Reference to a resource by its stable id and resource type.");
-} }).describe("Inbound-mail configuration for an [`Email`] resource.");
-z$2.object({
-	"configurationSet": z$2.string().describe("The provisioned configuration set name (used when sending)."),
-	"domains": z$2.object({}).catchall(z$2.lazy(() => EmailDomainOutputsSchema).describe("Per-domain DNS records the operator must create.")).describe("DNS records per mail domain."),
-	"ruleSetName": z$2.string().describe("The inbound receipt rule set name, when `inbound` is configured.").nullish()
-}).describe("Outputs generated by a successfully provisioned Email resource.\n\nDomain verification status cannot be known at provisioning time — SES\nverifies a domain asynchronously once its DKIM records exist in DNS — so\nthe outputs carry the records the operator must create rather than a\nverification result.");
+const KeyVaultBindingSchema = z$2.object({ get "vaultName"() {
+	return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+} }).describe("Azure Key Vault binding configuration");
 //#endregion
-//#region src/generated/zod/email-schema.ts
+//#region src/generated/zod/kubernetes-secret-vault-binding-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
 /**
-* @description Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change.\n\nAlien activates the provisioned receipt rule set as part of setup. Because\nSES permits only one active receipt rule set per AWS account and region, an\nAWS stack may contain only one email resource with inbound delivery. The\nresource requires exclusive ownership of SES receiving in its account and\nregion: setup refuses to replace an active rule set it does not own. Choose\nan unused region when the account already receives email through SES. SES email\nreceiving is available only in a subset of AWS regions; deploying `inbound`\nto an unsupported region fails during setup.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.
+* @description Kubernetes Secrets vault binding configuration
 */
-const EmailSchema = z$2.object({
-	"domains": z$2.optional(z$2.array(z$2.string()).describe("Seed mail domains provisioned at deploy time (one SES identity each).\nUseful for day-0 bootstrap and products with a static domain set.\nMay be empty (the default): products that create and verify domains\ndynamically should manage identities at runtime through the\n`email/manage-identities` grant instead of listing them here.")),
-	get "events"() {
-		return z$2.union([EmailEventsSchema, z$2.null()]).optional();
+const KubernetesSecretVaultBindingSchema = z$2.object({
+	get "namespace"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
 	},
-	"id": z$2.string().describe("Identifier for the email resource. Must contain only alphanumeric\ncharacters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."),
-	get "inbound"() {
-		return z$2.union([EmailInboundSchema, z$2.null()]).optional();
+	get "vaultPrefix"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
 	}
-}).describe("Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change.\n\nAlien activates the provisioned receipt rule set as part of setup. Because\nSES permits only one active receipt rule set per AWS account and region, an\nAWS stack may contain only one email resource with inbound delivery. The\nresource requires exclusive ownership of SES receiving in its account and\nregion: setup refuses to replace an active rule set it does not own. Choose\nan unused region when the account already receives email through SES. SES email\nreceiving is available only in a subset of AWS regions; deploying `inbound`\nto an unsupported region fails during setup.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.");
+}).describe("Kubernetes Secrets vault binding configuration");
 //#endregion
-//#region src/generated/zod/endpoint-access-schema.ts
+//#region src/generated/zod/local-vault-binding-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
 /**
-* @description Reachability of the deployment\'s public endpoints, fixed at setup.
+* @description Local development vault binding (for testing/development)
 */
-const EndpointAccessSchema = z$2.enum(["internet", "private"]).describe("Reachability of the deployment's public endpoints, fixed at setup.");
+const LocalVaultBindingSchema = z$2.object({
+	get "dataDir"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	"vaultName": z$2.string().describe("The vault name for local storage")
+}).describe("Local development vault binding (for testing/development)");
 //#endregion
-//#region src/generated/zod/response-handling-schema.ts
+//#region src/generated/zod/parameter-store-vault-binding-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
 /**
-* @description Response handling configuration for deployments
+* @description AWS SSM Parameter Store vault binding configuration
 */
-const ResponseHandlingSchema = z$2.object({
-	"maxInlineBytes": z$2.int().min(0).describe("Maximum response body size that can be submitted inline"),
-	get "storageUploadRequest"() {
-		return PresignedRequestSchema.describe("A presigned request that can be serialized, stored, and executed later.\nHides implementation details for different storage backends.");
-	},
-	"submitResponseUrl": z$2.string().describe("URL where deployments submit responses")
-}).describe("Response handling configuration for deployments");
+const ParameterStoreVaultBindingSchema = z$2.object({ get "vaultPrefix"() {
+	return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+} }).describe("AWS SSM Parameter Store vault binding configuration");
 //#endregion
-//#region src/generated/zod/trace-context-schema.ts
+//#region src/generated/zod/secret-manager-vault-binding-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
 /**
-* @description W3C Trace Context propagated with a command lease.\n\nThe values are kept in their standard wire form so receivers can attach\nthem to handler telemetry without inventing separate trace/span fields.
+* @description GCP Secret Manager vault binding configuration
 */
-const TraceContextSchema = z$2.object({
-	"traceparent": z$2.string().describe("W3C `traceparent` header value."),
-	"tracestate": z$2.string().describe("Optional W3C `tracestate` header value.").nullish()
-}).describe("W3C Trace Context propagated with a command lease.\n\nThe values are kept in their standard wire form so receivers can attach\nthem to handler telemetry without inventing separate trace/span fields.");
+const SecretManagerVaultBindingSchema = z$2.object({ get "vaultPrefix"() {
+	return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+} }).describe("GCP Secret Manager vault binding configuration");
 //#endregion
-//#region src/generated/zod/envelope-schema.ts
+//#region src/generated/zod/vault-binding-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
 /**
-* @description Commands envelope sent to deployments
+* @description Represents a vault binding for secure secret management
 */
-const EnvelopeSchema = z$2.object({
-	"attempt": z$2.int().min(0).describe("Attempt number (starts at 1)"),
-	"command": z$2.string().describe("Command name (e.g., \"generate-report\", \"sync-data\")"),
-	"commandId": z$2.string().describe("Unique command identifier"),
-	"deadline": z$2.iso.datetime().describe("Command deadline").nullish(),
-	"deploymentId": z$2.string().describe("Target deployment identifier"),
-	get "params"() {
-		return BodySpecSchema.describe("Body specification supporting inline and storage modes");
-	},
-	"protocol": z$2.string().describe("Protocol version identifier"),
-	get "responseHandling"() {
-		return ResponseHandlingSchema.describe("Response handling configuration for deployments");
-	},
-	get "target"() {
-		return CommandTargetSchema.describe("Identifies the specific resource a command is addressed to.");
-	},
-	get "traceContext"() {
-		return z$2.union([TraceContextSchema, z$2.null()]).optional();
-	}
-}).describe("Commands envelope sent to deployments");
+const VaultBindingSchema = z$2.union([
+	z$2.lazy(() => ParameterStoreVaultBindingSchema).and(z$2.object({ "service": z$2.enum(["parameter-store"]) })).describe("AWS SSM Parameter Store vault binding configuration"),
+	z$2.lazy(() => SecretManagerVaultBindingSchema).and(z$2.object({ "service": z$2.enum(["secret-manager"]) })).describe("GCP Secret Manager vault binding configuration"),
+	z$2.lazy(() => KeyVaultBindingSchema).and(z$2.object({ "service": z$2.enum(["key-vault"]) })).describe("Azure Key Vault binding configuration"),
+	z$2.lazy(() => KubernetesSecretVaultBindingSchema).and(z$2.object({ "service": z$2.enum(["kubernetes-secret"]) })).describe("Kubernetes Secrets vault binding configuration"),
+	z$2.lazy(() => LocalVaultBindingSchema).and(z$2.object({ "service": z$2.enum(["local-vault"]) })).describe("Local development vault binding (for testing/development)")
+]).describe("Represents a vault binding for secure secret management");
 //#endregion
-//#region src/generated/zod/event-state-schema.ts
+//#region src/generated/zod/external-binding-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
 /**
-* @description Represents the state of an event
+* @description Represents a binding to pre-existing infrastructure.\n\nThe binding type must match the resource type it\'s applied to.\nValidated at runtime by the executor.
 */
-const EventStateSchema = z$2.union([
-	z$2.object({ "failed": z$2.object({ get "error"() {
-		return z$2.union([AlienErrorSchema, z$2.null()]).optional();
-	} }).describe("Event failed with an error") }),
-	z$2.enum(["none"]),
-	z$2.enum(["started"]),
-	z$2.enum(["success"])
-]).describe("Represents the state of an event");
+const ExternalBindingSchema = z$2.union([
+	z$2.lazy(() => StorageBindingSchema).and(z$2.object({ "type": z$2.enum(["storage"]) })).describe("Service-type based storage binding that supports multiple storage providers"),
+	z$2.lazy(() => QueueBindingSchema).and(z$2.object({ "type": z$2.enum(["queue"]) })).describe("Binding parameters for Queue at runtime or in templates."),
+	z$2.lazy(() => KvBindingSchema).and(z$2.object({ "type": z$2.enum(["kv"]) })).describe("Represents a KV binding for key-value storage across platforms"),
+	z$2.lazy(() => ArtifactRegistryBindingSchema).and(z$2.object({ "type": z$2.enum(["artifact_registry"]) })).describe("Service-type based artifact registry binding that supports multiple registry providers"),
+	z$2.lazy(() => VaultBindingSchema).and(z$2.object({ "type": z$2.enum(["vault"]) })).describe("Represents a vault binding for secure secret management"),
+	z$2.lazy(() => ContainerAppsEnvironmentBindingSchema).and(z$2.object({ "type": z$2.enum(["container_apps_environment"]) })).describe("Binding configuration for a pre-existing Azure Container Apps Environment.\n\nUsed when deploying to an existing environment instead of having Alien provision one.\nThis is useful for shared environments (e.g., test infrastructure) or enterprise\nsetups where environments are managed by a separate team."),
+	z$2.lazy(() => PostgresBindingSchema).and(z$2.object({ "type": z$2.enum(["postgres"]) })).describe("Connection details for a Postgres database, one variant per backend."),
+	z$2.lazy(() => ExternalAiBindingSchema).and(z$2.object({ "type": z$2.enum(["ai"]) })).describe("External AI provider binding configuration (BYO-key).\n\nThe operator-supplied secret rides inside the binding via\n`BindingValue<String>`, so it is a literal on cloud platforms and gains\nKubernetes SecretRef resolution for free (`extract_binding_secrets` walks\nthe binding JSON for `secretRef`).")
+]).describe("Represents a binding to pre-existing infrastructure.\n\nThe binding type must match the resource type it's applied to.\nValidated at runtime by the executor.");
 //#endregion
-//#region src/generated/zod/event-change-schema.ts
+//#region src/generated/zod/external-bindings-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
 /**
-* @description Represents a change to an event
+* @description Map from resource ID to external binding.\n\nValidated at runtime: binding type must match resource type.
 */
-const EventChangeSchema = z$2.union([
-	z$2.object({
-		"createdAt": z$2.iso.datetime().describe("Timestamp when the event was created"),
-		get "event"() {
-			return AlienEventSchema.describe("Represents all possible events in the Alien system");
-		},
-		"id": z$2.string().describe("Unique identifier for the event"),
-		"parentId": z$2.string().describe("Parent event ID if this is a child event").nullish(),
-		get "state"() {
-			return EventStateSchema.describe("Represents the state of an event");
-		},
-		"type": z$2.enum(["created"])
-	}),
-	z$2.object({
-		get "event"() {
-			return AlienEventSchema.describe("Represents all possible events in the Alien system");
-		},
-		"id": z$2.string().describe("Unique identifier for the event"),
-		"type": z$2.enum(["updated"]),
-		"updatedAt": z$2.iso.datetime().describe("Timestamp when the event was updated")
-	}),
-	z$2.object({
-		"id": z$2.string().describe("Unique identifier for the event"),
-		get "newState"() {
-			return EventStateSchema.describe("Represents the state of an event");
-		},
-		"type": z$2.enum(["stateChanged"]),
-		"updatedAt": z$2.iso.datetime().describe("Timestamp when the state changed")
-	})
-]).describe("Represents a change to an event");
+const ExternalBindingsSchema = z$2.object({}).catchall(z$2.lazy(() => ExternalBindingSchema).describe("Represents a binding to pre-existing infrastructure.\n\nThe binding type must match the resource type it's applied to.\nValidated at runtime by the executor.")).describe("Map from resource ID to external binding.\n\nValidated at runtime: binding type must match resource type.");
 z$2.object({ "engineId": z$2.string().describe("The engine's resource name, or the bare id it ends with.") }).describe("GCP Agent Platform reasoning-engine ImportData.\n\nEmitted only for a Frozen engine, which the setup stack creates. Vertex assigns the id, so it\nis read off the created resource rather than derived: the controller and the template beneath\nit address the engine by exactly this segment.");
 //#endregion
 //#region src/generated/zod/gcp-agent-platform-sandbox-heartbeat-data-schema.ts
@@ -5369,25 +6308,6 @@ const GcpNetworkImportDataSchema = z$2.object({
 	"vpcName": z$2.string().describe("VPC short name.").nullish(),
 	"vpcSelfLink": z$2.string().describe("VPC self-link. Absent when the controller will look up the\ndefault network at runtime.").nullish()
 }).describe("GCP Network ImportData — VPC + subnetwork + Cloud NAT topology.");
-//#endregion
-//#region src/generated/zod/gcp-platform-permission-schema.ts
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
-/**
-* @description GCP-specific platform permission configuration
-*/
-const GcpPlatformPermissionSchema = z$2.object({
-	get "binding"() {
-		return BindingConfigurationGcpBindingSpecSchema.describe("Generic binding configuration for permissions");
-	},
-	"description": z$2.string().describe("Short admin-facing description of why this entry exists.").nullish(),
-	get "grant"() {
-		return PermissionGrantSchema.describe("Grant permissions for a specific cloud platform");
-	},
-	"label": z$2.string().describe("Stable admin-facing label for this permission entry.").nullish()
-}).describe("GCP-specific platform permission configuration");
 z$2.object({
 	"database": z$2.string().describe("Default database name."),
 	"databaseVersion": z$2.string().describe("Engine version the instance reports."),
@@ -6406,62 +7326,6 @@ const ManagementConfigSchema = z$2.union([
 	z$2.object({ "platform": z$2.enum(["kubernetes"]) })
 ]).describe("Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount.");
 //#endregion
-//#region src/generated/zod/platform-permissions-schema.ts
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
-/**
-* @description Platform-specific permission configurations
-*/
-const PlatformPermissionsSchema = z$2.object({
-	get "aws"() {
-		return z$2.array(AwsPlatformPermissionSchema.describe("AWS-specific platform permission configuration")).describe("AWS permission configurations").nullish();
-	},
-	get "azure"() {
-		return z$2.array(AzurePlatformPermissionSchema.describe("Azure-specific platform permission configuration")).describe("Azure permission configurations").nullish();
-	},
-	get "gcp"() {
-		return z$2.array(GcpPlatformPermissionSchema.describe("GCP-specific platform permission configuration")).describe("GCP permission configurations").nullish();
-	}
-}).describe("Platform-specific permission configurations");
-//#endregion
-//#region src/generated/zod/permission-set-schema.ts
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
-/**
-* @description A permission set that can be applied across different cloud platforms
-*/
-const PermissionSetSchema = z$2.object({
-	"description": z$2.string().describe("Human-readable description of what this permission set allows"),
-	"id": z$2.string().describe("Unique identifier for the permission set (e.g., \"storage/data-read\")"),
-	get "platforms"() {
-		return PlatformPermissionsSchema.describe("Platform-specific permission configurations");
-	}
-}).describe("A permission set that can be applied across different cloud platforms");
-//#endregion
-//#region src/generated/zod/permission-set-reference-schema.ts
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
-/**
-* @description Reference to a permission set - either by name or inline definition
-*/
-const PermissionSetReferenceSchema = z$2.union([z$2.lazy(() => PermissionSetSchema), z$2.string()]).describe("Reference to a permission set - either by name or inline definition");
-//#endregion
-//#region src/generated/zod/permission-profile-schema.ts
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
-/**
-* @description Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource
-*/
-const PermissionProfileSchema = z$2.object({}).catchall(z$2.array(z$2.lazy(() => PermissionSetReferenceSchema).describe("Reference to a permission set - either by name or inline definition"))).describe("Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource");
-//#endregion
 //#region src/generated/zod/management-permissions-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -7369,6 +8233,7 @@ const ServiceAccountOutputsSchema = z$2.object({
 */
 const ServiceAccountSchema = z$2.object({
 	"id": z$2.string().describe("Identifier for the service account. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]).\nMaximum 64 characters."),
+	"resourcePermissionSets": z$2.optional(z$2.object({}).catchall(z$2.array(z$2.lazy(() => PermissionSetSchema).describe("A permission set that can be applied across different cloud platforms"))).describe("Resolved grants for concrete resource IDs, captured for setup comparison.")),
 	get "stackPermissionSets"() {
 		return z$2.array(PermissionSetSchema.describe("A permission set that can be applied across different cloud platforms")).describe("Stack-level permission sets that apply to all resources in the stack.\nThese are derived from the \"*\" scope in the permission profile.\nResource-scoped permissions are handled by individual resource controllers.");
 	}
@@ -7419,7 +8284,9 @@ const StackSettingsSchema = z$2.object({
 	get "endpointAccess"() {
 		return EndpointAccessSchema.describe("Reachability of the deployment's public endpoints, fixed at setup.").optional();
 	},
-	"externalBindings": z$2.object({}).describe("External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms.").nullish(),
+	get "externalBindings"() {
+		return z$2.union([ExternalBindingsSchema, z$2.null()]).optional();
+	},
 	get "heartbeats"() {
 		return HeartbeatsModeSchema.describe("How heartbeat health checks are handled.").optional();
 	},
@@ -8345,8 +9212,10 @@ var AlienError = class AlienError extends Error {
 				context: contextData
 			};
 		} else options = input;
+		const sourceOptions = options.source;
+		const source = sourceOptions && typeof sourceOptions === "object" && "code" in sourceOptions && "message" in sourceOptions && "retryable" in sourceOptions && "internal" in sourceOptions ? new AlienError(sourceOptions) : void 0;
 		const message = options.message;
-		super(message, { cause: options.source });
+		super(message, { cause: source });
 		this.name = "AlienError";
 		this.code = options.code;
 		this.retryable = options.retryable;
@@ -8354,10 +9223,7 @@ var AlienError = class AlienError extends Error {
 		this.httpStatusCode = options.httpStatusCode ?? 500;
 		this.context = options.context;
 		this.hint = options.hint;
-		this.source = void 0;
-		if (options.source && typeof options.source === "object") {
-			if ("code" in options.source && "message" in options.source && "retryable" in options.source && "internal" in options.source) this.source = new AlienError(options.source);
-		}
+		this.source = source;
 	}
 	/**
 	* Create an AlienError from a type-safe error definition.
@@ -8795,6 +9661,12 @@ var ComputeCluster = class {
 	static any() {
 		return "compute-cluster";
 	}
+	/** Grants the node identity access to explicitly named resources only. */
+	nodePermissions(permissions, options) {
+		this._config.nodePermissions = permissions;
+		this._config.nodePermissionsPlatforms = options?.platforms;
+		return this;
+	}
 	pool(groupId, config) {
 		if (config.dynamicContainers) {
 			if (this._config.dynamicContainerPool !== void 0) throw new Error("Only one compute pool may accept dynamic containers");
@@ -9137,7 +10009,7 @@ var Container = class extends ResourceBuilder {
 	* Configures persistent storage and marks the container stateful.
 	* Data survives container restarts.
 	* @param size Storage size (e.g., "100Gi", "500Gi", "1Ti").
-	* @param options Optional mount path.
+	* @param options Optional mount path and backup schedule.
 	* @returns The Container builder instance.
 	*/
 	persistentStorage(size, options = {}) {
@@ -9145,6 +10017,15 @@ var Container = class extends ResourceBuilder {
 			size,
 			mountPath: options.mountPath ?? "/data"
 		};
+		if (options.backups !== void 0) persistentStorage.backups = options.backups === false ? {
+			enabled: false,
+			intervalHours: 24,
+			retentionDays: 7
+		} : {
+			enabled: true,
+			intervalHours: options.backups.intervalHours ?? 24,
+			retentionDays: options.backups.retentionDays ?? 7
+		};
 		this._config.persistentStorage = persistentStorage;
 		this._config.stateful = true;
 		return this;
@@ -9432,7 +10313,7 @@ var Daemon = class extends ResourceBuilder {
 	/**
 	* Links another resource to this daemon.
 	* This makes the linked resource accessible to the daemon, often by injecting
-	* environment variables or granting permissions.
+	* environment variables. Permission grants require an explicit workload profile.
 	* @param resource The resource to link.
 	* @returns The Daemon builder instance.
 	*/
@@ -9442,7 +10323,7 @@ var Daemon = class extends ResourceBuilder {
 		return this;
 	}
 	/**
-	* Assigns a permission profile to this daemon.
+	* Assigns a permission profile to this daemon. Without one, no workload cloud identity is created.
 	* The profile defines the permissions granted to this daemon when interacting
 	* with other cloud resources.
 	* @param permissions The permission profile name.
@@ -10759,6 +11640,6 @@ function validateOcu(field, value, allowZero) {
 //#region src/index.ts
 const experimental = { AwsOpenSearch };
 //#endregion
-export { AI, AgentStatusSchema, AiSchema as AiConfigSchema, AlienError, AlienErrorSchema as AlienErrorOptionsSchema, AlienEventSchema, ArtifactRegistry, ArtifactRegistrySchema as ArtifactRegistryConfigSchema, ArtifactRegistryHeartbeatDataSchema, ArtifactRegistryHeartbeatStatusSchema, AwsArtifactRegistryImportDataSchema, AwsBuildImportDataSchema, AwsCodeBuildHeartbeatDataSchema, AwsComputeClusterHeartbeatDataSchema, AwsComputeClusterImportDataSchema, AwsDynamoDbKeySchemaElementSchema, AwsDynamoDbKvHeartbeatDataSchema, AwsEcrArtifactRegistryHeartbeatDataSchema, AwsEcrRepositoryHeartbeatDataSchema, AwsIamRoleServiceAccountHeartbeatDataSchema, AwsKvImportDataSchema, AwsLambdaWorkerHeartbeatDataSchema, AwsNetworkImportDataSchema, AwsParameterStoreVaultHeartbeatDataSchema, AwsQueueImportDataSchema, AwsRemoteStackManagementHeartbeatDataSchema, AwsRemoteStackManagementImportDataSchema, AwsS3StorageHeartbeatDataSchema, AwsServiceAccountImportDataSchema, AwsSqsQueueHeartbeatDataSchema, AwsStorageImportDataSchema, AwsVaultImportDataSchema, AwsVpcNetworkHeartbeatDataSchema, AwsWorkerImportDataSchema, AzureArtifactRegistryImportDataSchema, AzureBlobStorageHeartbeatDataSchema, AzureBuildImportDataSchema, AzureComputeClusterHeartbeatDataSchema, AzureComputeClusterImportDataSchema, AzureContainerAppsBuildHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatStatusSchema, AzureContainerAppsEnvironmentImportDataSchema, AzureContainerAppsEnvironmentWorkloadProfileSchema, AzureContainerAppsWorkerHeartbeatDataSchema, AzureContainerRegistryHeartbeatDataSchema, AzureKeyVaultHeartbeatDataSchema, AzureKvImportDataSchema, AzureManagedIdentityServiceAccountHeartbeatDataSchema, AzureNetworkImportDataSchema, AzureQueueImportDataSchema, AzureRemoteStackManagementHeartbeatDataSchema, AzureRemoteStackManagementImportDataSchema, AzureResourceGroupHeartbeatDataSchema, AzureResourceGroupHeartbeatStatusSchema, AzureResourceGroupImportDataSchema, AzureResourceProviderActivationHeartbeatDataSchema, AzureServiceAccountImportDataSchema, AzureServiceActivationImportDataSchema, AzureServiceBusNamespaceHeartbeatDataSchema, AzureServiceBusNamespaceImportDataSchema, AzureServiceBusQueueHeartbeatDataSchema, AzureStorageAccountEndpointsSchema, AzureStorageAccountHeartbeatDataSchema, AzureStorageAccountImportDataSchema, AzureStorageImportDataSchema, AzureTableKvHeartbeatDataSchema, AzureVaultImportDataSchema, AzureVnetNetworkHeartbeatDataSchema, AzureWorkerImportDataSchema, BindingNotFoundError, BodySpecSchema, Build, BuildConfigSchema, BuildHeartbeatDataSchema, BuildHeartbeatStatusSchema, BuildOutputsSchema, BuildStatusSchema, CapacityGroupScalePolicySchema, CapacityGroupSchema, CommandDeliveryModeSchema, CommandResponseSchema, CommandStateSchema, CommandStatusResponseSchema, CommandTargetSchema, CommandTargetTypeSchema, ComputeCapacityGroupStatusSchema, ComputeCapacityRecommendationSchema, ComputeChoiceRangeSchema, ComputeCluster, ComputeClusterSchema as ComputeClusterConfigSchema, ComputeClusterHeartbeatDataSchema, ComputeClusterHeartbeatStatusSchema, ComputePoolSelectionSchema, ComputeSettingsSchema, ComputeTypeSchema, Container, ContainerAutoscalingSchema, ContainerCodeSchema, ContainerSchema as ContainerConfigSchema, ContainerHeartbeatDataSchema, ContainerImageIdentitySchema, ContainerPortSchema, CreateCommandRequestSchema, CreateCommandResponseSchema, Daemon, DaemonCodeSchema, DaemonSchema as DaemonConfigSchema, DaemonHeartbeatDataSchema, DaemonOutputsSchema, DeployerSecretLocationSchema, DeployerSecretReportSchema, DeployerSecretStatusSchema, DeployerSecretStoreSchema, DeploymentModelSchema, DevResourceInfoSchema, DevStatusSchema, DevStatusStateSchema, Email, EmailSchema as EmailConfigSchema, EndpointAccessSchema, EnvelopeSchema, EventChangeSchema, EventStateSchema, ExposeProtocolSchema, FailureDomainSelectionSchema, GcpArtifactRegistryHeartbeatDataSchema, GcpArtifactRegistryImportDataSchema, GcpBuildImportDataSchema, GcpCloudBuildHeartbeatDataSchema, GcpCloudRunWorkerHeartbeatDataSchema, GcpCloudStorageHeartbeatDataSchema, GcpComputeClusterHeartbeatDataSchema, GcpComputeClusterImportDataSchema, GcpFirestoreKvHeartbeatDataSchema, GcpKvImportDataSchema, GcpNetworkImportDataSchema, GcpPubSubQueueHeartbeatDataSchema, GcpQueueImportDataSchema, GcpRemoteStackManagementHeartbeatDataSchema, GcpRemoteStackManagementImportDataSchema, GcpSecretManagerVaultHeartbeatDataSchema, GcpServiceAccountHeartbeatDataSchema, GcpServiceAccountImportDataSchema, GcpServiceActivationImportDataSchema, GcpServiceUsageActivationHeartbeatDataSchema, GcpStorageImportDataSchema, GcpVaultImportDataSchema, GcpVpcNetworkHeartbeatDataSchema, GcpWorkerImportDataSchema, HeartbeatBackendSchema, HeartbeatIssueSeveritySchema, HeartbeatsModeSchema, HorizonContainerHeartbeatDataSchema, HttpMethodSchema, InvalidBindingConfigError, Key, KeySchema as KeyConfigSchema, KubernetesBuildHeartbeatDataSchema, KubernetesClusterNodeStatusSchema, KubernetesContainerHeartbeatDataSchema, KubernetesDaemonHeartbeatDataSchema, KubernetesEventInvolvedObjectSchema, KubernetesEventSnapshotSchema, KubernetesEventSourceSchema, KubernetesNodeConditionStatusSchema, KubernetesNodeResourcesSchema, KubernetesNodeUsageSchema, KubernetesPodRuntimeUnitStatusSchema, KubernetesSecretVaultHeartbeatDataSchema, KubernetesWorkerHeartbeatDataSchema, Kv, KvSchema as KvConfigSchema, KvHeartbeatDataSchema, KvHeartbeatStatusSchema, LeaseInfoSchema, LeaseRequestSchema, LeaseResponseSchema, LocalArtifactRegistryHeartbeatDataSchema, LocalComputeClusterHeartbeatDataSchema, LocalContainerHeartbeatDataSchema, LocalDaemonHeartbeatDataSchema, LocalKvHeartbeatDataSchema, LocalQueueHeartbeatDataSchema, LocalRuntimeEventSnapshotSchema, LocalRuntimeEventSubjectSchema, LocalRuntimeUnitKindSchema, LocalRuntimeUnitStatusSchema, LocalServiceAccountHeartbeatDataSchema, LocalStorageHeartbeatDataSchema, LocalVaultHeartbeatDataSchema, LocalWorkerHeartbeatDataSchema, MachineProfileSchema, ManagedRuntimeEventInvolvedObjectSchema, ManagedRuntimeEventSnapshotSchema, ManagedRuntimeEventSourceSchema, ManagedRuntimeUnitStatusSchema, MessagePayloadSchema, MetricSampleSchema, NetworkHeartbeatDataSchema, NetworkHeartbeatStatusSchema, ObservedApplicationImageSchema, ObservedApplicationReportSchema, ObservedApplicationSourceSchema, ObservedCountsSchema, ObservedHealthSchema, ObservedInventoryBatchSchema, ObservedResourceSampleSchema, OperatorImageReportSchema, OperatorImageSourceSchema, PermissionSetSchema, PlatformSchema, Postgres, PostgresSchema as PostgresConfigSchema, PresignedRequestBackendSchema, PresignedRequestSchema, ProviderFleetStatusSchema, ProviderLifecycleStateSchema, PublicEndpointSchema, PublicEndpointTargetSettingsSchema, Queue, QueueSchema as QueueConfigSchema, QueueHeartbeatDataSchema, QueueHeartbeatStatusSchema, QueueMessageSchema, ReadinessProbeSchema, ReleaseRequestSchema, RemoteStackManagementHeartbeatDataSchema, RemoteStackManagementHeartbeatStatusSchema, Resource, ResourceHeartbeatDataSchema, ResourceHeartbeatSchema, ResourceLifecycleSchema, ResourceNotFoundError, ResourceOutputsParseError, ResourceRefSchema, ResourceSchemaMapping, ResourceStatusSchema, ResourceTypeSchema, ResponseHandlingSchema, STACK_INPUT_GENERATE_MAX_LENGTH, STACK_INPUT_GENERATE_MIN_LENGTH, Sandbox, SandboxSchema as SandboxConfigSchema, ScheduledEventSchema, ServiceAccount, ServiceAccountSchema as ServiceAccountConfigSchema, ServiceAccountHeartbeatDataSchema, ServiceAccountHeartbeatStatusSchema, ServiceAccountOutputsSchema, ServiceActivationHeartbeatDataSchema, ServiceActivationHeartbeatStatusSchema, Stack, StackInputDefaultValueSchema, StackInputDefinitionSchema, StackInputEnvironmentMappingSchema, StackInputEnvironmentVariableTypeSchema, StackInputKindSchema, StackInputProviderSchema, StackInputValidationSchema, StackResourceStateSchema, StackSchema, StackSettingsSchema, StackStateSchema, StackStatusSchema, Storage, StorageSchema as StorageConfigSchema, StorageEventSchema, StorageEventTypeSchema, StorageEventsSchema, StorageHeartbeatDataSchema, StorageHeartbeatStatusSchema, StorageUploadSchema, SubmitResponseRequestSchema, TelemetryModeSchema, TraceContextSchema, UnexpectedResourceTypeError, UpdatesModeSchema, UploadCompleteRequestSchema, UploadCompleteResponseSchema, Vault, VaultSchema as VaultConfigSchema, VaultHeartbeatDataSchema, VaultHeartbeatStatusSchema, Worker, WorkerSchema as WorkerConfigSchema, WorkerHeartbeatDataSchema, WorkerOutputsSchema, WorkerPublicEndpointSchema, WorkerTriggerSchema, WorkloadHeartbeatStatusSchema, WorkloadReplicaStatusSchema, defineBooleanInput as boolean, defineError, defineEnumInput as enum, experimental, getResourceOutputs, getStackInputDefinitions, inputs, defineIntegerInput as integer, isDeployerSecretInput, defineNumberInput as number, defineSecretInput as secret, defineStringInput as string, defineStringListInput as stringList };
+export { AI, AgentStatusSchema, AiSchema as AiConfigSchema, AlienError, AlienErrorSchema as AlienErrorOptionsSchema, AlienEventSchema, ArtifactRegistry, ArtifactRegistrySchema as ArtifactRegistryConfigSchema, ArtifactRegistryHeartbeatDataSchema, ArtifactRegistryHeartbeatStatusSchema, AwsArtifactRegistryImportDataSchema, AwsBuildImportDataSchema, AwsCodeBuildHeartbeatDataSchema, AwsComputeClusterHeartbeatDataSchema, AwsComputeClusterImportDataSchema, AwsDynamoDbKeySchemaElementSchema, AwsDynamoDbKvHeartbeatDataSchema, AwsEcrArtifactRegistryHeartbeatDataSchema, AwsEcrRepositoryHeartbeatDataSchema, AwsIamRoleServiceAccountHeartbeatDataSchema, AwsKvImportDataSchema, AwsLambdaWorkerHeartbeatDataSchema, AwsNetworkImportDataSchema, AwsParameterStoreVaultHeartbeatDataSchema, AwsQueueImportDataSchema, AwsRemoteStackManagementHeartbeatDataSchema, AwsRemoteStackManagementImportDataSchema, AwsS3StorageHeartbeatDataSchema, AwsServiceAccountImportDataSchema, AwsSqsQueueHeartbeatDataSchema, AwsStorageImportDataSchema, AwsVaultImportDataSchema, AwsVpcNetworkHeartbeatDataSchema, AwsWorkerImportDataSchema, AzureArtifactRegistryImportDataSchema, AzureBlobStorageHeartbeatDataSchema, AzureBuildImportDataSchema, AzureComputeClusterHeartbeatDataSchema, AzureComputeClusterImportDataSchema, AzureContainerAppsBuildHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatStatusSchema, AzureContainerAppsEnvironmentImportDataSchema, AzureContainerAppsEnvironmentWorkloadProfileSchema, AzureContainerAppsWorkerHeartbeatDataSchema, AzureContainerRegistryHeartbeatDataSchema, AzureKeyVaultHeartbeatDataSchema, AzureKvImportDataSchema, AzureManagedIdentityServiceAccountHeartbeatDataSchema, AzureNetworkImportDataSchema, AzureQueueImportDataSchema, AzureRemoteStackManagementHeartbeatDataSchema, AzureRemoteStackManagementImportDataSchema, AzureResourceGroupHeartbeatDataSchema, AzureResourceGroupHeartbeatStatusSchema, AzureResourceGroupImportDataSchema, AzureResourceProviderActivationHeartbeatDataSchema, AzureServiceAccountImportDataSchema, AzureServiceActivationImportDataSchema, AzureServiceBusNamespaceHeartbeatDataSchema, AzureServiceBusNamespaceImportDataSchema, AzureServiceBusQueueHeartbeatDataSchema, AzureStorageAccountEndpointsSchema, AzureStorageAccountHeartbeatDataSchema, AzureStorageAccountImportDataSchema, AzureStorageImportDataSchema, AzureTableKvHeartbeatDataSchema, AzureVaultImportDataSchema, AzureVnetNetworkHeartbeatDataSchema, AzureWorkerImportDataSchema, BindingNotFoundError, BodySpecSchema, Build, BuildConfigSchema, BuildHeartbeatDataSchema, BuildHeartbeatStatusSchema, BuildOutputsSchema, BuildStatusSchema, CapacityGroupScalePolicySchema, CapacityGroupSchema, CommandDeliveryModeSchema, CommandResponseSchema, CommandStateSchema, CommandStatusResponseSchema, CommandTargetSchema, CommandTargetTypeSchema, ComputeCapacityGroupStatusSchema, ComputeCapacityRecommendationSchema, ComputeChoiceRangeSchema, ComputeCluster, ComputeClusterSchema as ComputeClusterConfigSchema, ComputeClusterHeartbeatDataSchema, ComputeClusterHeartbeatStatusSchema, ComputePoolSelectionSchema, ComputeSettingsSchema, ComputeTypeSchema, Container, ContainerAutoscalingSchema, ContainerCodeSchema, ContainerSchema as ContainerConfigSchema, ContainerHeartbeatDataSchema, ContainerImageIdentitySchema, ContainerPortSchema, CreateCommandRequestSchema, CreateCommandResponseSchema, Daemon, DaemonCodeSchema, DaemonSchema as DaemonConfigSchema, DaemonHeartbeatDataSchema, DaemonOutputsSchema, DeployerSecretLocationSchema, DeployerSecretReportSchema, DeployerSecretStatusSchema, DeployerSecretStoreSchema, DeploymentModelSchema, DevResourceInfoSchema, DevStatusSchema, DevStatusStateSchema, Email, EmailSchema as EmailConfigSchema, EndpointAccessSchema, EnvelopeSchema, EventChangeSchema, EventStateSchema, ExposeProtocolSchema, ExternalBindingSchema, ExternalBindingsSchema, FailureDomainSelectionSchema, GcpArtifactRegistryHeartbeatDataSchema, GcpArtifactRegistryImportDataSchema, GcpBuildImportDataSchema, GcpCloudBuildHeartbeatDataSchema, GcpCloudRunWorkerHeartbeatDataSchema, GcpCloudStorageHeartbeatDataSchema, GcpComputeClusterHeartbeatDataSchema, GcpComputeClusterImportDataSchema, GcpFirestoreKvHeartbeatDataSchema, GcpKvImportDataSchema, GcpNetworkImportDataSchema, GcpPubSubQueueHeartbeatDataSchema, GcpQueueImportDataSchema, GcpRemoteStackManagementHeartbeatDataSchema, GcpRemoteStackManagementImportDataSchema, GcpSecretManagerVaultHeartbeatDataSchema, GcpServiceAccountHeartbeatDataSchema, GcpServiceAccountImportDataSchema, GcpServiceActivationImportDataSchema, GcpServiceUsageActivationHeartbeatDataSchema, GcpStorageImportDataSchema, GcpVaultImportDataSchema, GcpVpcNetworkHeartbeatDataSchema, GcpWorkerImportDataSchema, HeartbeatBackendSchema, HeartbeatIssueSeveritySchema, HeartbeatsModeSchema, HorizonContainerHeartbeatDataSchema, HttpMethodSchema, InvalidBindingConfigError, Key, KeySchema as KeyConfigSchema, KubernetesBuildHeartbeatDataSchema, KubernetesClusterNodeStatusSchema, KubernetesContainerHeartbeatDataSchema, KubernetesDaemonHeartbeatDataSchema, KubernetesEventInvolvedObjectSchema, KubernetesEventSnapshotSchema, KubernetesEventSourceSchema, KubernetesNodeConditionStatusSchema, KubernetesNodeResourcesSchema, KubernetesNodeUsageSchema, KubernetesPodRuntimeUnitStatusSchema, KubernetesSecretVaultHeartbeatDataSchema, KubernetesWorkerHeartbeatDataSchema, Kv, KvSchema as KvConfigSchema, KvHeartbeatDataSchema, KvHeartbeatStatusSchema, LeaseInfoSchema, LeaseRequestSchema, LeaseResponseSchema, LocalArtifactRegistryHeartbeatDataSchema, LocalComputeClusterHeartbeatDataSchema, LocalContainerHeartbeatDataSchema, LocalDaemonHeartbeatDataSchema, LocalKvHeartbeatDataSchema, LocalQueueHeartbeatDataSchema, LocalRuntimeEventSnapshotSchema, LocalRuntimeEventSubjectSchema, LocalRuntimeUnitKindSchema, LocalRuntimeUnitStatusSchema, LocalServiceAccountHeartbeatDataSchema, LocalStorageHeartbeatDataSchema, LocalVaultHeartbeatDataSchema, LocalWorkerHeartbeatDataSchema, MachineProfileSchema, ManagedRuntimeEventInvolvedObjectSchema, ManagedRuntimeEventSnapshotSchema, ManagedRuntimeEventSourceSchema, ManagedRuntimeUnitStatusSchema, MessagePayloadSchema, MetricSampleSchema, NetworkHeartbeatDataSchema, NetworkHeartbeatStatusSchema, ObservedApplicationImageSchema, ObservedApplicationReportSchema, ObservedApplicationSourceSchema, ObservedCountsSchema, ObservedHealthSchema, ObservedInventoryBatchSchema, ObservedResourceSampleSchema, OperatorImageReportSchema, OperatorImageSourceSchema, PermissionSetSchema, PlatformSchema, Postgres, PostgresSchema as PostgresConfigSchema, PresignedRequestBackendSchema, PresignedRequestSchema, ProviderFleetStatusSchema, ProviderLifecycleStateSchema, PublicEndpointSchema, PublicEndpointTargetSettingsSchema, Queue, QueueSchema as QueueConfigSchema, QueueHeartbeatDataSchema, QueueHeartbeatStatusSchema, QueueMessageSchema, ReadinessProbeSchema, ReleaseRequestSchema, RemoteStackManagementHeartbeatDataSchema, RemoteStackManagementHeartbeatStatusSchema, Resource, ResourceHeartbeatDataSchema, ResourceHeartbeatSchema, ResourceLifecycleSchema, ResourceNotFoundError, ResourceOutputsParseError, ResourceRefSchema, ResourceSchemaMapping, ResourceStatusSchema, ResourceTypeSchema, ResponseHandlingSchema, STACK_INPUT_GENERATE_MAX_LENGTH, STACK_INPUT_GENERATE_MIN_LENGTH, Sandbox, SandboxSchema as SandboxConfigSchema, ScheduledEventSchema, ServiceAccount, ServiceAccountSchema as ServiceAccountConfigSchema, ServiceAccountHeartbeatDataSchema, ServiceAccountHeartbeatStatusSchema, ServiceAccountOutputsSchema, ServiceActivationHeartbeatDataSchema, ServiceActivationHeartbeatStatusSchema, Stack, StackInputDefaultValueSchema, StackInputDefinitionSchema, StackInputEnvironmentMappingSchema, StackInputEnvironmentVariableTypeSchema, StackInputKindSchema, StackInputProviderSchema, StackInputValidationSchema, StackResourceStateSchema, StackSchema, StackSettingsSchema, StackStateSchema, StackStatusSchema, Storage, StorageSchema as StorageConfigSchema, StorageEventSchema, StorageEventTypeSchema, StorageEventsSchema, StorageHeartbeatDataSchema, StorageHeartbeatStatusSchema, StorageUploadSchema, SubmitResponseRequestSchema, TelemetryModeSchema, TraceContextSchema, UnexpectedResourceTypeError, UpdatesModeSchema, UploadCompleteRequestSchema, UploadCompleteResponseSchema, ValueSchema, Vault, VaultSchema as VaultConfigSchema, VaultHeartbeatDataSchema, VaultHeartbeatStatusSchema, Worker, WorkerSchema as WorkerConfigSchema, WorkerHeartbeatDataSchema, WorkerOutputsSchema, WorkerPublicEndpointSchema, WorkerTriggerSchema, WorkloadHeartbeatStatusSchema, WorkloadReplicaStatusSchema, defineBooleanInput as boolean, defineError, defineEnumInput as enum, experimental, getResourceOutputs, getStackInputDefinitions, inputs, defineIntegerInput as integer, isDeployerSecretInput, defineNumberInput as number, defineSecretInput as secret, defineStringInput as string, defineStringListInput as stringList };
 
 //# sourceMappingURL=index.js.map