@alienplatform/platform-api 1.3.5 → 1.4.1

package/esm/models/syncreconcileresponse.d.ts

@@ -53,6 +53,17 @@ export type SyncReconcileResponseCurrentReleaseOverrideAwBinding = {
      */
     stack?: SyncReconcileResponseCurrentReleaseOverrideAwStack | undefined;
 };
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export declare const SyncReconcileResponseCurrentReleaseOverrideEffect: {
+    readonly Allow: "Allow";
+    readonly Deny: "Deny";
+};
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export type SyncReconcileResponseCurrentReleaseOverrideEffect = ClosedEnum<typeof SyncReconcileResponseCurrentReleaseOverrideEffect>;
 /**
  * Grant permissions for a specific cloud platform
  */
@@ -66,9 +77,17 @@ export type SyncReconcileResponseCurrentReleaseOverrideAwGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * AWS-specific platform permission configuration
@@ -78,10 +97,22 @@ export type SyncReconcileResponseCurrentReleaseOverrideAw = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponseCurrentReleaseOverrideAwBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
+    /**
+     * IAM effect. Defaults to Allow.
+     */
+    effect?: SyncReconcileResponseCurrentReleaseOverrideEffect | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponseCurrentReleaseOverrideAwGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Azure-specific binding specification
@@ -127,9 +158,17 @@ export type SyncReconcileResponseCurrentReleaseOverrideAzureGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * Azure-specific platform permission configuration
@@ -139,10 +178,18 @@ export type SyncReconcileResponseCurrentReleaseOverrideAzure = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponseCurrentReleaseOverrideAzureBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponseCurrentReleaseOverrideAzureGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * GCP IAM condition
@@ -206,9 +253,17 @@ export type SyncReconcileResponseCurrentReleaseOverrideGcpGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * GCP-specific platform permission configuration
@@ -218,10 +273,18 @@ export type SyncReconcileResponseCurrentReleaseOverrideGcp = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponseCurrentReleaseOverrideGcpBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponseCurrentReleaseOverrideGcpGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Platform-specific permission configurations
@@ -319,6 +382,17 @@ export type SyncReconcileResponseCurrentReleaseExtendAwBinding = {
      */
     stack?: SyncReconcileResponseCurrentReleaseExtendAwStack | undefined;
 };
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export declare const SyncReconcileResponseCurrentReleaseExtendEffect: {
+    readonly Allow: "Allow";
+    readonly Deny: "Deny";
+};
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export type SyncReconcileResponseCurrentReleaseExtendEffect = ClosedEnum<typeof SyncReconcileResponseCurrentReleaseExtendEffect>;
 /**
  * Grant permissions for a specific cloud platform
  */
@@ -332,9 +406,17 @@ export type SyncReconcileResponseCurrentReleaseExtendAwGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * AWS-specific platform permission configuration
@@ -344,10 +426,22 @@ export type SyncReconcileResponseCurrentReleaseExtendAw = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponseCurrentReleaseExtendAwBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
+    /**
+     * IAM effect. Defaults to Allow.
+     */
+    effect?: SyncReconcileResponseCurrentReleaseExtendEffect | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponseCurrentReleaseExtendAwGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Azure-specific binding specification
@@ -393,9 +487,17 @@ export type SyncReconcileResponseCurrentReleaseExtendAzureGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * Azure-specific platform permission configuration
@@ -405,10 +507,18 @@ export type SyncReconcileResponseCurrentReleaseExtendAzure = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponseCurrentReleaseExtendAzureBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponseCurrentReleaseExtendAzureGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * GCP IAM condition
@@ -472,9 +582,17 @@ export type SyncReconcileResponseCurrentReleaseExtendGcpGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * GCP-specific platform permission configuration
@@ -484,10 +602,18 @@ export type SyncReconcileResponseCurrentReleaseExtendGcp = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponseCurrentReleaseExtendGcpBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponseCurrentReleaseExtendGcpGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Platform-specific permission configurations
@@ -589,6 +715,17 @@ export type SyncReconcileResponseCurrentReleaseProfileAwBinding = {
      */
     stack?: SyncReconcileResponseCurrentReleaseProfileAwStack | undefined;
 };
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export declare const SyncReconcileResponseCurrentReleaseProfileEffect: {
+    readonly Allow: "Allow";
+    readonly Deny: "Deny";
+};
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export type SyncReconcileResponseCurrentReleaseProfileEffect = ClosedEnum<typeof SyncReconcileResponseCurrentReleaseProfileEffect>;
 /**
  * Grant permissions for a specific cloud platform
  */
@@ -602,9 +739,17 @@ export type SyncReconcileResponseCurrentReleaseProfileAwGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * AWS-specific platform permission configuration
@@ -614,10 +759,22 @@ export type SyncReconcileResponseCurrentReleaseProfileAw = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponseCurrentReleaseProfileAwBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
+    /**
+     * IAM effect. Defaults to Allow.
+     */
+    effect?: SyncReconcileResponseCurrentReleaseProfileEffect | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponseCurrentReleaseProfileAwGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Azure-specific binding specification
@@ -663,9 +820,17 @@ export type SyncReconcileResponseCurrentReleaseProfileAzureGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * Azure-specific platform permission configuration
@@ -675,10 +840,18 @@ export type SyncReconcileResponseCurrentReleaseProfileAzure = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponseCurrentReleaseProfileAzureBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponseCurrentReleaseProfileAzureGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * GCP IAM condition
@@ -742,9 +915,17 @@ export type SyncReconcileResponseCurrentReleaseProfileGcpGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * GCP-specific platform permission configuration
@@ -754,10 +935,18 @@ export type SyncReconcileResponseCurrentReleaseProfileGcp = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponseCurrentReleaseProfileGcpBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponseCurrentReleaseProfileGcpGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Platform-specific permission configurations
@@ -852,7 +1041,6 @@ export type SyncReconcileResponseCurrentReleaseDependency = {
 export declare const SyncReconcileResponseCurrentReleaseLifecycle: {
     readonly Frozen: "frozen";
     readonly Live: "live";
-    readonly LiveOnSetup: "live-on-setup";
 };
 /**
  * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
@@ -883,6 +1071,21 @@ export type SyncReconcileResponseCurrentReleaseResources = {
      */
     remoteAccess?: boolean | undefined;
 };
+/**
+ * Represents the target cloud platform.
+ */
+export declare const SyncReconcileResponseCurrentReleaseSupportedPlatform: {
+    readonly Aws: "aws";
+    readonly Gcp: "gcp";
+    readonly Azure: "azure";
+    readonly Kubernetes: "kubernetes";
+    readonly Local: "local";
+    readonly Test: "test";
+};
+/**
+ * Represents the target cloud platform.
+ */
+export type SyncReconcileResponseCurrentReleaseSupportedPlatform = ClosedEnum<typeof SyncReconcileResponseCurrentReleaseSupportedPlatform>;
 /**
  * A bag of resources, unaware of any cloud.
  */
@@ -901,6 +1104,10 @@ export type SyncReconcileResponseCurrentReleaseStack = {
     resources: {
         [k: string]: SyncReconcileResponseCurrentReleaseResources;
     };
+    /**
+     * Which platforms this stack supports. When None, all platforms are supported.
+     */
+    supportedPlatforms?: Array<SyncReconcileResponseCurrentReleaseSupportedPlatform> | null | undefined;
 };
 /**
  * Release metadata
@@ -1044,6 +1251,58 @@ export declare const SyncReconcileResponseCurrentPlatform: {
  * Represents the target cloud platform.
  */
 export type SyncReconcileResponseCurrentPlatform = ClosedEnum<typeof SyncReconcileResponseCurrentPlatform>;
+/**
+ * Scope for a delete operation.
+ *
+ * @remarks
+ *
+ * Full deletes are setup/admin owned and may remove both Frozen and Live
+ * resources. Live-only deletes are used by setup handoff resources
+ * (Terraform/CloudFormation) so Alien removes only the resources it owns
+ * before setup tears down Frozen resources.
+ */
+export declare const SyncReconcileResponseDeleteScopeEnum: {
+    readonly Full: "full";
+    readonly LiveOnly: "liveOnly";
+};
+/**
+ * Scope for a delete operation.
+ *
+ * @remarks
+ *
+ * Full deletes are setup/admin owned and may remove both Frozen and Live
+ * resources. Live-only deletes are used by setup handoff resources
+ * (Terraform/CloudFormation) so Alien removes only the resources it owns
+ * before setup tears down Frozen resources.
+ */
+export type SyncReconcileResponseDeleteScopeEnum = ClosedEnum<typeof SyncReconcileResponseDeleteScopeEnum>;
+export type SyncReconcileResponseDeleteScopeUnion = SyncReconcileResponseDeleteScopeEnum | any;
+/**
+ * Scope for a delete operation.
+ *
+ * @remarks
+ *
+ * Full deletes are setup/admin owned and may remove both Frozen and Live
+ * resources. Live-only deletes are used by setup handoff resources
+ * (Terraform/CloudFormation) so Alien removes only the resources it owns
+ * before setup tears down Frozen resources.
+ */
+export declare const SyncReconcileResponsePendingDeleteScopeEnum: {
+    readonly Full: "full";
+    readonly LiveOnly: "liveOnly";
+};
+/**
+ * Scope for a delete operation.
+ *
+ * @remarks
+ *
+ * Full deletes are setup/admin owned and may remove both Frozen and Live
+ * resources. Live-only deletes are used by setup handoff resources
+ * (Terraform/CloudFormation) so Alien removes only the resources it owns
+ * before setup tears down Frozen resources.
+ */
+export type SyncReconcileResponsePendingDeleteScopeEnum = ClosedEnum<typeof SyncReconcileResponsePendingDeleteScopeEnum>;
+export type SyncReconcileResponsePendingDeleteScopeUnion = SyncReconcileResponsePendingDeleteScopeEnum | any;
 export declare const SyncReconcileResponsePreparedStackManagementEnum: {
     readonly Auto: "auto";
 };
@@ -1095,6 +1354,17 @@ export type SyncReconcileResponsePreparedStackOverrideAwBinding = {
      */
     stack?: SyncReconcileResponsePreparedStackOverrideAwStack | undefined;
 };
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export declare const SyncReconcileResponsePreparedStackOverrideEffect: {
+    readonly Allow: "Allow";
+    readonly Deny: "Deny";
+};
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export type SyncReconcileResponsePreparedStackOverrideEffect = ClosedEnum<typeof SyncReconcileResponsePreparedStackOverrideEffect>;
 /**
  * Grant permissions for a specific cloud platform
  */
@@ -1108,9 +1378,17 @@ export type SyncReconcileResponsePreparedStackOverrideAwGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * AWS-specific platform permission configuration
@@ -1120,10 +1398,22 @@ export type SyncReconcileResponsePreparedStackOverrideAw = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponsePreparedStackOverrideAwBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
+    /**
+     * IAM effect. Defaults to Allow.
+     */
+    effect?: SyncReconcileResponsePreparedStackOverrideEffect | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponsePreparedStackOverrideAwGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Azure-specific binding specification
@@ -1169,9 +1459,17 @@ export type SyncReconcileResponsePreparedStackOverrideAzureGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * Azure-specific platform permission configuration
@@ -1181,10 +1479,18 @@ export type SyncReconcileResponsePreparedStackOverrideAzure = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponsePreparedStackOverrideAzureBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponsePreparedStackOverrideAzureGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * GCP IAM condition
@@ -1248,9 +1554,17 @@ export type SyncReconcileResponsePreparedStackOverrideGcpGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * GCP-specific platform permission configuration
@@ -1260,10 +1574,18 @@ export type SyncReconcileResponsePreparedStackOverrideGcp = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponsePreparedStackOverrideGcpBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponsePreparedStackOverrideGcpGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Platform-specific permission configurations
@@ -1361,6 +1683,17 @@ export type SyncReconcileResponsePreparedStackExtendAwBinding = {
      */
     stack?: SyncReconcileResponsePreparedStackExtendAwStack | undefined;
 };
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export declare const SyncReconcileResponsePreparedStackExtendEffect: {
+    readonly Allow: "Allow";
+    readonly Deny: "Deny";
+};
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export type SyncReconcileResponsePreparedStackExtendEffect = ClosedEnum<typeof SyncReconcileResponsePreparedStackExtendEffect>;
 /**
  * Grant permissions for a specific cloud platform
  */
@@ -1374,9 +1707,17 @@ export type SyncReconcileResponsePreparedStackExtendAwGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * AWS-specific platform permission configuration
@@ -1386,10 +1727,22 @@ export type SyncReconcileResponsePreparedStackExtendAw = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponsePreparedStackExtendAwBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
+    /**
+     * IAM effect. Defaults to Allow.
+     */
+    effect?: SyncReconcileResponsePreparedStackExtendEffect | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponsePreparedStackExtendAwGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Azure-specific binding specification
@@ -1435,9 +1788,17 @@ export type SyncReconcileResponsePreparedStackExtendAzureGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * Azure-specific platform permission configuration
@@ -1447,10 +1808,18 @@ export type SyncReconcileResponsePreparedStackExtendAzure = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponsePreparedStackExtendAzureBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponsePreparedStackExtendAzureGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * GCP IAM condition
@@ -1514,9 +1883,17 @@ export type SyncReconcileResponsePreparedStackExtendGcpGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * GCP-specific platform permission configuration
@@ -1526,10 +1903,18 @@ export type SyncReconcileResponsePreparedStackExtendGcp = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponsePreparedStackExtendGcpBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponsePreparedStackExtendGcpGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Platform-specific permission configurations
@@ -1631,6 +2016,17 @@ export type SyncReconcileResponsePreparedStackProfileAwBinding = {
      */
     stack?: SyncReconcileResponsePreparedStackProfileAwStack | undefined;
 };
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export declare const SyncReconcileResponsePreparedStackProfileEffect: {
+    readonly Allow: "Allow";
+    readonly Deny: "Deny";
+};
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export type SyncReconcileResponsePreparedStackProfileEffect = ClosedEnum<typeof SyncReconcileResponsePreparedStackProfileEffect>;
 /**
  * Grant permissions for a specific cloud platform
  */
@@ -1644,9 +2040,17 @@ export type SyncReconcileResponsePreparedStackProfileAwGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * AWS-specific platform permission configuration
@@ -1656,10 +2060,22 @@ export type SyncReconcileResponsePreparedStackProfileAw = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponsePreparedStackProfileAwBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
+    /**
+     * IAM effect. Defaults to Allow.
+     */
+    effect?: SyncReconcileResponsePreparedStackProfileEffect | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponsePreparedStackProfileAwGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Azure-specific binding specification
@@ -1705,9 +2121,17 @@ export type SyncReconcileResponsePreparedStackProfileAzureGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * Azure-specific platform permission configuration
@@ -1717,10 +2141,18 @@ export type SyncReconcileResponsePreparedStackProfileAzure = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponsePreparedStackProfileAzureBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponsePreparedStackProfileAzureGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * GCP IAM condition
@@ -1784,9 +2216,17 @@ export type SyncReconcileResponsePreparedStackProfileGcpGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * GCP-specific platform permission configuration
@@ -1796,10 +2236,18 @@ export type SyncReconcileResponsePreparedStackProfileGcp = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponsePreparedStackProfileGcpBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponsePreparedStackProfileGcpGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Platform-specific permission configurations
@@ -1894,7 +2342,6 @@ export type SyncReconcileResponsePreparedStackDependency = {
 export declare const SyncReconcileResponsePreparedStackLifecycle: {
     readonly Frozen: "frozen";
     readonly Live: "live";
-    readonly LiveOnSetup: "live-on-setup";
 };
 /**
  * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
@@ -1925,6 +2372,21 @@ export type SyncReconcileResponsePreparedStackResources = {
      */
     remoteAccess?: boolean | undefined;
 };
+/**
+ * Represents the target cloud platform.
+ */
+export declare const SyncReconcileResponsePreparedStackSupportedPlatform: {
+    readonly Aws: "aws";
+    readonly Gcp: "gcp";
+    readonly Azure: "azure";
+    readonly Kubernetes: "kubernetes";
+    readonly Local: "local";
+    readonly Test: "test";
+};
+/**
+ * Represents the target cloud platform.
+ */
+export type SyncReconcileResponsePreparedStackSupportedPlatform = ClosedEnum<typeof SyncReconcileResponsePreparedStackSupportedPlatform>;
 /**
  * A bag of resources, unaware of any cloud.
  */
@@ -1943,6 +2405,10 @@ export type SyncReconcileResponsePreparedStack = {
     resources: {
         [k: string]: SyncReconcileResponsePreparedStackResources;
     };
+    /**
+     * Which platforms this stack supports. When None, all platforms are supported.
+     */
+    supportedPlatforms?: Array<SyncReconcileResponsePreparedStackSupportedPlatform> | null | undefined;
 };
 export type SyncReconcileResponsePreparedStackUnion = SyncReconcileResponsePreparedStack | any;
 /**
@@ -1953,6 +2419,7 @@ export type SyncReconcileResponsePreparedStackUnion = SyncReconcileResponsePrepa
  * Stores deployment state that needs to persist across step calls.
  */
 export type SyncReconcileResponseRuntimeMetadata = {
+    deleteScope?: SyncReconcileResponseDeleteScopeEnum | any | null | undefined;
     /**
      * Hash of the environment variables snapshot that was last synced to the vault
      *
@@ -1960,7 +2427,17 @@ export type SyncReconcileResponseRuntimeMetadata = {
      * Used to avoid redundant sync operations during incremental deployment
      */
     lastSyncedEnvVarsHash?: string | null | undefined;
+    pendingDeleteScope?: SyncReconcileResponsePendingDeleteScopeEnum | any | null | undefined;
     preparedStack?: SyncReconcileResponsePreparedStack | any | null | undefined;
+    /**
+     * Whether cross-account registry access has been successfully granted.
+     *
+     * @remarks
+     * Set to true after the manager successfully sets the ECR/GAR repo policy
+     * for this deployment's target account. Prevents redundant API calls on
+     * every reconcile tick.
+     */
+    registryAccessGranted?: boolean | undefined;
 };
 export type SyncReconcileResponseRuntimeMetadataUnion = SyncReconcileResponseRuntimeMetadata | any;
 /**
@@ -1994,6 +2471,22 @@ export type SyncReconcileResponseStackStateConfig = {
         [k: string]: any | null;
     } | undefined;
 };
+/**
+ * Represents the target cloud platform.
+ */
+export declare const SyncReconcileResponseControllerPlatformEnum: {
+    readonly Aws: "aws";
+    readonly Gcp: "gcp";
+    readonly Azure: "azure";
+    readonly Kubernetes: "kubernetes";
+    readonly Local: "local";
+    readonly Test: "test";
+};
+/**
+ * Represents the target cloud platform.
+ */
+export type SyncReconcileResponseControllerPlatformEnum = ClosedEnum<typeof SyncReconcileResponseControllerPlatformEnum>;
+export type SyncReconcileResponseControllerPlatformUnion = SyncReconcileResponseControllerPlatformEnum | any;
 /**
  * New ResourceRef that works with any resource type.
  *
@@ -2039,6 +2532,10 @@ export type SyncReconcileResponseError = {
      * caused the issue, or other relevant context information.
      */
     context?: any | null | undefined;
+    /**
+     * Optional human-facing remediation hint.
+     */
+    hint?: string | null | undefined;
     /**
      * HTTP status code for this error.
      *
@@ -2095,7 +2592,6 @@ export type SyncReconcileResponseErrorUnion = SyncReconcileResponseError | any;
 export declare const SyncReconcileResponseStackStateLifecycleEnum: {
     readonly Frozen: "frozen";
     readonly Live: "live";
-    readonly LiveOnSetup: "live-on-setup";
 };
 /**
  * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
@@ -2167,6 +2663,7 @@ export type SyncReconcileResponseStackStateResources = {
      * Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties.
      */
     config: SyncReconcileResponseStackStateConfig;
+    controllerPlatform?: SyncReconcileResponseControllerPlatformEnum | any | null | undefined;
     /**
      * Complete list of dependencies for this resource, including infrastructure dependencies.
      *
@@ -2175,13 +2672,6 @@ export type SyncReconcileResponseStackStateResources = {
      */
     dependencies?: Array<SyncReconcileResponseStackStateDependency> | undefined;
     error?: SyncReconcileResponseError | any | null | undefined;
-    /**
-     * True if the resource was provisioned by an external system (e.g., CloudFormation).
-     *
-     * @remarks
-     * Defaults to false, indicating dynamic provisioning by the executor.
-     */
-    isExternallyProvisioned?: boolean | undefined;
     /**
      * Stores the controller state that failed, used for manual retry operations.
      *
@@ -2211,7 +2701,7 @@ export type SyncReconcileResponseStackStateResources = {
      */
     status: SyncReconcileResponseStackStateStatus;
     /**
-     * The high-level type of the resource (e.g., Function::RESOURCE_TYPE, Storage::RESOURCE_TYPE).
+     * The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE).
      */
     type: string;
 };
@@ -2253,6 +2743,7 @@ export declare const SyncReconcileResponseStatus: {
     readonly Deleting: "deleting";
     readonly DeleteFailed: "delete-failed";
     readonly Deleted: "deleted";
+    readonly Error: "error";
 };
 /**
  * Deployment status in the deployment lifecycle
@@ -2309,6 +2800,17 @@ export type SyncReconcileResponseTargetReleaseOverrideAwBinding = {
      */
     stack?: SyncReconcileResponseTargetReleaseOverrideAwStack | undefined;
 };
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export declare const SyncReconcileResponseTargetReleaseOverrideEffect: {
+    readonly Allow: "Allow";
+    readonly Deny: "Deny";
+};
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export type SyncReconcileResponseTargetReleaseOverrideEffect = ClosedEnum<typeof SyncReconcileResponseTargetReleaseOverrideEffect>;
 /**
  * Grant permissions for a specific cloud platform
  */
@@ -2322,9 +2824,17 @@ export type SyncReconcileResponseTargetReleaseOverrideAwGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * AWS-specific platform permission configuration
@@ -2334,10 +2844,22 @@ export type SyncReconcileResponseTargetReleaseOverrideAw = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponseTargetReleaseOverrideAwBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
+    /**
+     * IAM effect. Defaults to Allow.
+     */
+    effect?: SyncReconcileResponseTargetReleaseOverrideEffect | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponseTargetReleaseOverrideAwGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Azure-specific binding specification
@@ -2383,9 +2905,17 @@ export type SyncReconcileResponseTargetReleaseOverrideAzureGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * Azure-specific platform permission configuration
@@ -2395,10 +2925,18 @@ export type SyncReconcileResponseTargetReleaseOverrideAzure = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponseTargetReleaseOverrideAzureBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponseTargetReleaseOverrideAzureGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * GCP IAM condition
@@ -2462,9 +3000,17 @@ export type SyncReconcileResponseTargetReleaseOverrideGcpGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * GCP-specific platform permission configuration
@@ -2474,10 +3020,18 @@ export type SyncReconcileResponseTargetReleaseOverrideGcp = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponseTargetReleaseOverrideGcpBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponseTargetReleaseOverrideGcpGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Platform-specific permission configurations
@@ -2575,6 +3129,17 @@ export type SyncReconcileResponseTargetReleaseExtendAwBinding = {
      */
     stack?: SyncReconcileResponseTargetReleaseExtendAwStack | undefined;
 };
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export declare const SyncReconcileResponseTargetReleaseExtendEffect: {
+    readonly Allow: "Allow";
+    readonly Deny: "Deny";
+};
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export type SyncReconcileResponseTargetReleaseExtendEffect = ClosedEnum<typeof SyncReconcileResponseTargetReleaseExtendEffect>;
 /**
  * Grant permissions for a specific cloud platform
  */
@@ -2588,9 +3153,17 @@ export type SyncReconcileResponseTargetReleaseExtendAwGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * AWS-specific platform permission configuration
@@ -2600,10 +3173,22 @@ export type SyncReconcileResponseTargetReleaseExtendAw = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponseTargetReleaseExtendAwBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
+    /**
+     * IAM effect. Defaults to Allow.
+     */
+    effect?: SyncReconcileResponseTargetReleaseExtendEffect | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponseTargetReleaseExtendAwGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Azure-specific binding specification
@@ -2649,9 +3234,17 @@ export type SyncReconcileResponseTargetReleaseExtendAzureGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * Azure-specific platform permission configuration
@@ -2661,10 +3254,18 @@ export type SyncReconcileResponseTargetReleaseExtendAzure = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponseTargetReleaseExtendAzureBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponseTargetReleaseExtendAzureGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * GCP IAM condition
@@ -2728,9 +3329,17 @@ export type SyncReconcileResponseTargetReleaseExtendGcpGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * GCP-specific platform permission configuration
@@ -2740,10 +3349,18 @@ export type SyncReconcileResponseTargetReleaseExtendGcp = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponseTargetReleaseExtendGcpBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponseTargetReleaseExtendGcpGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Platform-specific permission configurations
@@ -2845,6 +3462,17 @@ export type SyncReconcileResponseTargetReleaseProfileAwBinding = {
      */
     stack?: SyncReconcileResponseTargetReleaseProfileAwStack | undefined;
 };
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export declare const SyncReconcileResponseTargetReleaseProfileEffect: {
+    readonly Allow: "Allow";
+    readonly Deny: "Deny";
+};
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export type SyncReconcileResponseTargetReleaseProfileEffect = ClosedEnum<typeof SyncReconcileResponseTargetReleaseProfileEffect>;
 /**
  * Grant permissions for a specific cloud platform
  */
@@ -2858,9 +3486,17 @@ export type SyncReconcileResponseTargetReleaseProfileAwGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * AWS-specific platform permission configuration
@@ -2870,10 +3506,22 @@ export type SyncReconcileResponseTargetReleaseProfileAw = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponseTargetReleaseProfileAwBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
+    /**
+     * IAM effect. Defaults to Allow.
+     */
+    effect?: SyncReconcileResponseTargetReleaseProfileEffect | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponseTargetReleaseProfileAwGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Azure-specific binding specification
@@ -2919,9 +3567,17 @@ export type SyncReconcileResponseTargetReleaseProfileAzureGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * Azure-specific platform permission configuration
@@ -2931,10 +3587,18 @@ export type SyncReconcileResponseTargetReleaseProfileAzure = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponseTargetReleaseProfileAzureBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponseTargetReleaseProfileAzureGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * GCP IAM condition
@@ -2998,9 +3662,17 @@ export type SyncReconcileResponseTargetReleaseProfileGcpGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * GCP-specific platform permission configuration
@@ -3010,10 +3682,18 @@ export type SyncReconcileResponseTargetReleaseProfileGcp = {
      * Generic binding configuration for permissions
      */
     binding: SyncReconcileResponseTargetReleaseProfileGcpBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: SyncReconcileResponseTargetReleaseProfileGcpGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Platform-specific permission configurations
@@ -3108,7 +3788,6 @@ export type SyncReconcileResponseTargetReleaseDependency = {
 export declare const SyncReconcileResponseTargetReleaseLifecycle: {
     readonly Frozen: "frozen";
     readonly Live: "live";
-    readonly LiveOnSetup: "live-on-setup";
 };
 /**
  * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
@@ -3139,6 +3818,21 @@ export type SyncReconcileResponseTargetReleaseResources = {
      */
     remoteAccess?: boolean | undefined;
 };
+/**
+ * Represents the target cloud platform.
+ */
+export declare const SyncReconcileResponseTargetReleaseSupportedPlatform: {
+    readonly Aws: "aws";
+    readonly Gcp: "gcp";
+    readonly Azure: "azure";
+    readonly Kubernetes: "kubernetes";
+    readonly Local: "local";
+    readonly Test: "test";
+};
+/**
+ * Represents the target cloud platform.
+ */
+export type SyncReconcileResponseTargetReleaseSupportedPlatform = ClosedEnum<typeof SyncReconcileResponseTargetReleaseSupportedPlatform>;
 /**
  * A bag of resources, unaware of any cloud.
  */
@@ -3157,6 +3851,10 @@ export type SyncReconcileResponseTargetReleaseStack = {
     resources: {
         [k: string]: SyncReconcileResponseTargetReleaseResources;
     };
+    /**
+     * Which platforms this stack supports. When None, all platforms are supported.
+     */
+    supportedPlatforms?: Array<SyncReconcileResponseTargetReleaseSupportedPlatform> | null | undefined;
 };
 /**
  * Release metadata
@@ -3196,6 +3894,15 @@ export type SyncReconcileResponseCurrent = {
      * Represents the target cloud platform.
      */
     platform: SyncReconcileResponseCurrentPlatform;
+    /**
+     * Protocol version for cross-actor compatibility.
+     *
+     * @remarks
+     * All actors (manager, push client, agent) check this before stepping.
+     * Mismatched versions produce a clear error instead of silent corruption.
+     * See docs/02-manager/10-deployment-protocol.md.
+     */
+    protocolVersion: number;
     /**
      * Whether a retry has been requested for a failed deployment
      *
@@ -3212,35 +3919,28 @@ export type SyncReconcileResponseCurrent = {
     targetRelease?: SyncReconcileResponseTargetRelease | any | null | undefined;
 };
 /**
- * Artifact registry configuration for pulling container images.
- *
- * @remarks
- *
- * Used when the deployment needs to pull images from a manager's artifact registry.
- * This is required for Local platform and can optionally be used by cloud platforms
- * instead of native registry mechanisms (ECR/GCR/ACR).
+ * Represents the target cloud platform.
  */
-export type SyncReconcileResponseArtifactRegistry = {
-    /**
-     * Optional authentication token (JWT) for manager API access
-     *
-     * @remarks
-     * When present, must be included in Authorization header as "Bearer {token}"
-     */
-    authToken?: string | null | undefined;
-    /**
-     * Manager base URL for fetching credentials and accessing the registry
-     */
-    managerUrl: string;
+export declare const SyncReconcileResponseBasePlatformEnum: {
+    readonly Aws: "aws";
+    readonly Gcp: "gcp";
+    readonly Azure: "azure";
+    readonly Kubernetes: "kubernetes";
+    readonly Local: "local";
+    readonly Test: "test";
 };
-export type SyncReconcileResponseArtifactRegistryUnion = SyncReconcileResponseArtifactRegistry | any;
 /**
- * Configuration for a single Horizon cluster.
+ * Represents the target cloud platform.
+ */
+export type SyncReconcileResponseBasePlatformEnum = ClosedEnum<typeof SyncReconcileResponseBasePlatformEnum>;
+export type SyncReconcileResponseBasePlatformUnion = SyncReconcileResponseBasePlatformEnum | any;
+/**
+ * Configuration for a single container worker cluster.
  *
  * @remarks
  *
  * Contains the cluster ID and management token needed to interact with
- * the Horizon control plane API for container operations.
+ * the managed container control plane API for container operations.
  */
 export type SyncReconcileResponseClusters = {
     /**
@@ -3255,54 +3955,138 @@ export type SyncReconcileResponseClusters = {
      */
     managementToken: string;
 };
+/**
+ * AWS Horizon machine image catalog.
+ */
+export type SyncReconcileResponseHorizonMachineImageAws = {
+    /**
+     * AMI IDs by architecture, then AWS region.
+     */
+    amis: {
+        [k: string]: {
+            [k: string]: string;
+        };
+    };
+};
+export type SyncReconcileResponseHorizonMachineImageAwsUnion = SyncReconcileResponseHorizonMachineImageAws | any;
+/**
+ * Azure Horizon machine image entry.
+ */
+export type SyncReconcileResponseAzureImages = {
+    /**
+     * Azure Compute Gallery image version ID.
+     */
+    imageVersionId: string;
+};
+/**
+ * Azure Horizon machine image catalog.
+ */
+export type HorizonMachineImageAzureTarget = {
+    /**
+     * Images by architecture.
+     */
+    images: {
+        [k: string]: SyncReconcileResponseAzureImages;
+    };
+};
+export type HorizonMachineImageTargetAzureUnion = HorizonMachineImageAzureTarget | any;
+/**
+ * Base image metadata for the Horizon machine image.
+ */
+export type SyncReconcileResponseBaseImage = {
+    /**
+     * Base OS image name.
+     */
+    name: string;
+    /**
+     * Base OS image version or channel.
+     */
+    version: string;
+};
+/**
+ * GCP Horizon machine image entry.
+ */
+export type SyncReconcileResponseGcpImages = {
+    /**
+     * Source image self link or image-family URL.
+     */
+    sourceImage: string;
+};
+/**
+ * GCP Horizon machine image catalog.
+ */
+export type HorizonMachineImageGcpTarget = {
+    /**
+     * Images by architecture.
+     */
+    images: {
+        [k: string]: SyncReconcileResponseGcpImages;
+    };
+};
+export type HorizonMachineImageTargetGcpUnion = HorizonMachineImageGcpTarget | any;
+/**
+ * Horizon machine image catalog.
+ *
+ * @remarks
+ *
+ * Platform resolves concrete provider images from this catalog during rollout.
+ */
+export type SyncReconcileResponseHorizonMachineImage = {
+    aws?: SyncReconcileResponseHorizonMachineImageAws | any | null | undefined;
+    azure?: HorizonMachineImageAzureTarget | any | null | undefined;
+    /**
+     * Base image metadata for the Horizon machine image.
+     */
+    baseImage: SyncReconcileResponseBaseImage;
+    /**
+     * Logical image channel, such as prod, staging, or canary.
+     */
+    channel: string;
+    /**
+     * Image manifest creation timestamp.
+     */
+    createdAt: string;
+    gcp?: HorizonMachineImageGcpTarget | any | null | undefined;
+    /**
+     * Git commit SHA used to build the image.
+     */
+    gitSha: string;
+    /**
+     * horizond daemon version baked into the image.
+     */
+    horizondVersion: string;
+    /**
+     * Published immutable machine image version.
+     */
+    machineImageVersion: string;
+};
+export type SyncReconcileResponseHorizonMachineImageUnion = SyncReconcileResponseHorizonMachineImage | any;
 export declare const SyncReconcileResponseComputeBackendType: {
     readonly Horizon: "horizon";
 };
 export type SyncReconcileResponseComputeBackendType = ClosedEnum<typeof SyncReconcileResponseComputeBackendType>;
 /**
- * Compute backend for Container and Function resources.
+ * Compute backend for Container and Worker resources.
  *
  * @remarks
  *
  * Determines how compute workloads are orchestrated on cloud platforms.
- * When None, the platform default is used (Horizon for cloud platforms).
+ * When None, the platform default is used for cloud platforms.
  */
 export type SyncReconcileResponseComputeBackendHorizon = {
     /**
-     * Cluster configurations (one per ContainerCluster resource)
+     * Cluster configurations (one per ComputeCluster resource)
      *
      * @remarks
-     * Key: ContainerCluster resource ID from stack
+     * Key: ComputeCluster resource ID from stack
      * Value: Cluster ID and management token for that cluster
      */
     clusters: {
         [k: string]: SyncReconcileResponseClusters;
     };
+    horizonMachineImage?: SyncReconcileResponseHorizonMachineImage | any | null | undefined;
     /**
-     * ETag of the horizond binary fetched from the releases server — used as a
-     *
-     * @remarks
-     * change-detection signal only. nginx auto-generates ETags from mtime+size,
-     * so every `cargo zigbuild` changes this value and triggers a rolling update.
-     *
-     * Optional: when absent (releases server unreachable), change detection
-     * falls back to URL-only (sufficient for versioned production releases).
-     */
-    horizondBinaryHash?: string | null | undefined;
-    /**
-     * Base URL for downloading the horizond binary, without arch suffix.
-     *
-     * @remarks
-     *
-     * Each cloud controller appends `/linux-{arch}/horizond` to construct the
-     * final download URL used in VM startup scripts.
-     *
-     * Production example: "https://releases.alien.dev/horizond/v0.3.0"
-     * Dev example (ngrok): "https://abc123.ngrok.io"
-     */
-    horizondDownloadBaseUrl: string;
-    /**
-     * Horizon API base URL (e.g., "https://horizon.alien.dev")
+     * Horizon control-plane API base URL.
      */
     url: string;
     type: SyncReconcileResponseComputeBackendType;
@@ -3459,15 +4243,15 @@ export type SyncReconcileResponseEnvironmentVariables = {
 /**
  * Reference to a Kubernetes Secret
  */
-export type SyncReconcileResponseDataDirSecretRef3 = {
+export type SyncReconcileResponseDefaultDomainSecretRef = {
     key: string;
     name: string;
 };
-export type SyncReconcileResponseDataDir3 = {
+export type SyncReconcileResponseDefaultDomain = {
     /**
      * Reference to a Kubernetes Secret
      */
-    secretRef: SyncReconcileResponseDataDirSecretRef3;
+    secretRef: SyncReconcileResponseDefaultDomainSecretRef;
 };
 /**
  * Represents a value that can be either a concrete value, a template expression,
@@ -3475,26 +4259,164 @@ export type SyncReconcileResponseDataDir3 = {
  * @remarks
  * or a reference to a Kubernetes Secret
  */
-export type SyncReconcileResponseDataDirUnion2 = SyncReconcileResponseDataDir3 | any | string;
-export declare const SyncReconcileResponseTypeVault5: {
-    readonly Vault: "vault";
-};
-export type SyncReconcileResponseTypeVault5 = ClosedEnum<typeof SyncReconcileResponseTypeVault5>;
+export type SyncReconcileResponseDefaultDomainUnion = SyncReconcileResponseDefaultDomain | any | string;
 /**
- * Local development vault binding (for testing/development)
+ * Reference to a Kubernetes Secret
  */
-export type SyncReconcileResponseExternalBindingsLocalVault = {
-    /**
-     * Represents a value that can be either a concrete value, a template expression,
-     *
-     * @remarks
-     * or a reference to a Kubernetes Secret
-     */
-    dataDir?: SyncReconcileResponseDataDir3 | any | string | null | undefined;
+export type SyncReconcileResponseEnvironmentNameSecretRef = {
+    key: string;
+    name: string;
+};
+export type SyncReconcileResponseEnvironmentName = {
     /**
-     * The vault name for local storage
+     * Reference to a Kubernetes Secret
      */
-    vaultName: string;
+    secretRef: SyncReconcileResponseEnvironmentNameSecretRef;
+};
+/**
+ * Represents a value that can be either a concrete value, a template expression,
+ *
+ * @remarks
+ * or a reference to a Kubernetes Secret
+ */
+export type SyncReconcileResponseEnvironmentNameUnion = SyncReconcileResponseEnvironmentName | any | string;
+/**
+ * Reference to a Kubernetes Secret
+ */
+export type SyncReconcileResponseResourceGroupNameSecretRef3 = {
+    key: string;
+    name: string;
+};
+export type SyncReconcileResponseResourceGroupName3 = {
+    /**
+     * Reference to a Kubernetes Secret
+     */
+    secretRef: SyncReconcileResponseResourceGroupNameSecretRef3;
+};
+/**
+ * Represents a value that can be either a concrete value, a template expression,
+ *
+ * @remarks
+ * or a reference to a Kubernetes Secret
+ */
+export type SyncReconcileResponseResourceGroupNameUnion3 = SyncReconcileResponseResourceGroupName3 | any | string;
+/**
+ * Reference to a Kubernetes Secret
+ */
+export type SyncReconcileResponseResourceIdSecretRef = {
+    key: string;
+    name: string;
+};
+export type SyncReconcileResponseResourceId = {
+    /**
+     * Reference to a Kubernetes Secret
+     */
+    secretRef: SyncReconcileResponseResourceIdSecretRef;
+};
+/**
+ * Represents a value that can be either a concrete value, a template expression,
+ *
+ * @remarks
+ * or a reference to a Kubernetes Secret
+ */
+export type SyncReconcileResponseResourceIdUnion = SyncReconcileResponseResourceId | any | string;
+/**
+ * Reference to a Kubernetes Secret
+ */
+export type SyncReconcileResponseStaticIpSecretRef = {
+    key: string;
+    name: string;
+};
+export type SyncReconcileResponseStaticIp = {
+    /**
+     * Reference to a Kubernetes Secret
+     */
+    secretRef: SyncReconcileResponseStaticIpSecretRef;
+};
+export declare const SyncReconcileResponseTypeContainerAppsEnvironment: {
+    readonly ContainerAppsEnvironment: "container_apps_environment";
+};
+export type SyncReconcileResponseTypeContainerAppsEnvironment = ClosedEnum<typeof SyncReconcileResponseTypeContainerAppsEnvironment>;
+/**
+ * Binding configuration for a pre-existing Azure Container Apps Environment.
+ *
+ * @remarks
+ *
+ * Used when deploying to an existing environment instead of having Alien provision one.
+ * This is useful for shared environments (e.g., test infrastructure) or enterprise
+ * setups where environments are managed by a separate team.
+ */
+export type SyncReconcileResponseExternalBindingsContainerAppsEnvironment = {
+    /**
+     * Represents a value that can be either a concrete value, a template expression,
+     *
+     * @remarks
+     * or a reference to a Kubernetes Secret
+     */
+    defaultDomain?: SyncReconcileResponseDefaultDomain | any | string | null | undefined;
+    /**
+     * Represents a value that can be either a concrete value, a template expression,
+     *
+     * @remarks
+     * or a reference to a Kubernetes Secret
+     */
+    environmentName?: SyncReconcileResponseEnvironmentName | any | string | null | undefined;
+    /**
+     * Represents a value that can be either a concrete value, a template expression,
+     *
+     * @remarks
+     * or a reference to a Kubernetes Secret
+     */
+    resourceGroupName?: SyncReconcileResponseResourceGroupName3 | any | string | null | undefined;
+    /**
+     * Represents a value that can be either a concrete value, a template expression,
+     *
+     * @remarks
+     * or a reference to a Kubernetes Secret
+     */
+    resourceId?: SyncReconcileResponseResourceId | any | string | null | undefined;
+    staticIp?: any | null | undefined;
+    type: SyncReconcileResponseTypeContainerAppsEnvironment;
+};
+/**
+ * Reference to a Kubernetes Secret
+ */
+export type SyncReconcileResponseDataDirSecretRef3 = {
+    key: string;
+    name: string;
+};
+export type SyncReconcileResponseDataDir3 = {
+    /**
+     * Reference to a Kubernetes Secret
+     */
+    secretRef: SyncReconcileResponseDataDirSecretRef3;
+};
+/**
+ * Represents a value that can be either a concrete value, a template expression,
+ *
+ * @remarks
+ * or a reference to a Kubernetes Secret
+ */
+export type SyncReconcileResponseDataDirUnion2 = SyncReconcileResponseDataDir3 | any | string;
+export declare const SyncReconcileResponseTypeVault5: {
+    readonly Vault: "vault";
+};
+export type SyncReconcileResponseTypeVault5 = ClosedEnum<typeof SyncReconcileResponseTypeVault5>;
+/**
+ * Local development vault binding (for testing/development)
+ */
+export type SyncReconcileResponseExternalBindingsLocalVault = {
+    /**
+     * Represents a value that can be either a concrete value, a template expression,
+     *
+     * @remarks
+     * or a reference to a Kubernetes Secret
+     */
+    dataDir?: SyncReconcileResponseDataDir3 | any | string | null | undefined;
+    /**
+     * The vault name for local storage
+     */
+    vaultName: string;
     service: "local-vault";
     type: SyncReconcileResponseTypeVault5;
 };
@@ -3719,7 +4641,13 @@ export declare const SyncReconcileResponseTypeArtifactRegistry4: {
 };
 export type SyncReconcileResponseTypeArtifactRegistry4 = ClosedEnum<typeof SyncReconcileResponseTypeArtifactRegistry4>;
 /**
- * Local container registry binding configuration
+ * Local container registry binding configuration.
+ *
+ * @remarks
+ *
+ * The local registry runs on localhost only and does not require authentication.
+ * Security boundary is the OS process isolation on the customer's machine.
+ * External image access is secured by the manager's registry proxy (deployment tokens).
  */
 export type SyncReconcileResponseExternalBindingsLocal = {
     /**
@@ -3765,6 +4693,26 @@ export type SyncReconcileResponsePushServiceAccountEmail = {
      */
     secretRef: SyncReconcileResponsePushServiceAccountEmailSecretRef;
 };
+/**
+ * Reference to a Kubernetes Secret
+ */
+export type SyncReconcileResponseRepositoryNameSecretRef = {
+    key: string;
+    name: string;
+};
+export type SyncReconcileResponseRepositoryName = {
+    /**
+     * Reference to a Kubernetes Secret
+     */
+    secretRef: SyncReconcileResponseRepositoryNameSecretRef;
+};
+/**
+ * Represents a value that can be either a concrete value, a template expression,
+ *
+ * @remarks
+ * or a reference to a Kubernetes Secret
+ */
+export type SyncReconcileResponseRepositoryNameUnion = SyncReconcileResponseRepositoryName | any | string;
 export declare const SyncReconcileResponseTypeArtifactRegistry3: {
     readonly ArtifactRegistry: "artifact_registry";
 };
@@ -3773,20 +4721,15 @@ export type SyncReconcileResponseTypeArtifactRegistry3 = ClosedEnum<typeof SyncR
  * Google Artifact Registry binding configuration
  */
 export type SyncReconcileResponseExternalBindingsGar = {
-    /**
-     * Represents a value that can be either a concrete value, a template expression,
-     *
-     * @remarks
-     * or a reference to a Kubernetes Secret
-     */
     pullServiceAccountEmail?: any | null | undefined;
+    pushServiceAccountEmail?: any | null | undefined;
     /**
      * Represents a value that can be either a concrete value, a template expression,
      *
      * @remarks
      * or a reference to a Kubernetes Secret
      */
-    pushServiceAccountEmail?: any | null | undefined;
+    repositoryName?: SyncReconcileResponseRepositoryName | any | string | null | undefined;
     service: "gar";
     type: SyncReconcileResponseTypeArtifactRegistry3;
 };
@@ -3810,6 +4753,19 @@ export type SyncReconcileResponseRegistryName = {
  * or a reference to a Kubernetes Secret
  */
 export type SyncReconcileResponseRegistryNameUnion = SyncReconcileResponseRegistryName | any | string;
+/**
+ * Reference to a Kubernetes Secret
+ */
+export type SyncReconcileResponseRepositoryPrefixSecretRef2 = {
+    key: string;
+    name: string;
+};
+export type SyncReconcileResponseRepositoryPrefix2 = {
+    /**
+     * Reference to a Kubernetes Secret
+     */
+    secretRef: SyncReconcileResponseRepositoryPrefixSecretRef2;
+};
 /**
  * Reference to a Kubernetes Secret
  */
@@ -3845,6 +4801,7 @@ export type SyncReconcileResponseExternalBindingsAcr = {
      * or a reference to a Kubernetes Secret
      */
     registryName?: SyncReconcileResponseRegistryName | any | string | null | undefined;
+    repositoryPrefix?: any | null | undefined;
     /**
      * Represents a value that can be either a concrete value, a template expression,
      *
@@ -3884,15 +4841,15 @@ export type SyncReconcileResponsePushRoleArn = {
 /**
  * Reference to a Kubernetes Secret
  */
-export type SyncReconcileResponseRepositoryPrefixSecretRef = {
+export type SyncReconcileResponseRepositoryPrefixSecretRef1 = {
     key: string;
     name: string;
 };
-export type SyncReconcileResponseRepositoryPrefix = {
+export type SyncReconcileResponseRepositoryPrefix1 = {
     /**
      * Reference to a Kubernetes Secret
      */
-    secretRef: SyncReconcileResponseRepositoryPrefixSecretRef;
+    secretRef: SyncReconcileResponseRepositoryPrefixSecretRef1;
 };
 /**
  * Represents a value that can be either a concrete value, a template expression,
@@ -3900,7 +4857,7 @@ export type SyncReconcileResponseRepositoryPrefix = {
  * @remarks
  * or a reference to a Kubernetes Secret
  */
-export type SyncReconcileResponseRepositoryPrefixUnion = SyncReconcileResponseRepositoryPrefix | any | string;
+export type SyncReconcileResponseRepositoryPrefixUnion = SyncReconcileResponseRepositoryPrefix1 | any | string;
 export declare const SyncReconcileResponseTypeArtifactRegistry1: {
     readonly ArtifactRegistry: "artifact_registry";
 };
@@ -3909,19 +4866,7 @@ export type SyncReconcileResponseTypeArtifactRegistry1 = ClosedEnum<typeof SyncR
  * AWS ECR (Elastic Container Registry) binding configuration
  */
 export type SyncReconcileResponseExternalBindingsEcr = {
-    /**
-     * Represents a value that can be either a concrete value, a template expression,
-     *
-     * @remarks
-     * or a reference to a Kubernetes Secret
-     */
     pullRoleArn?: any | null | undefined;
-    /**
-     * Represents a value that can be either a concrete value, a template expression,
-     *
-     * @remarks
-     * or a reference to a Kubernetes Secret
-     */
     pushRoleArn?: any | null | undefined;
     /**
      * Represents a value that can be either a concrete value, a template expression,
@@ -3929,7 +4874,7 @@ export type SyncReconcileResponseExternalBindingsEcr = {
      * @remarks
      * or a reference to a Kubernetes Secret
      */
-    repositoryPrefix?: SyncReconcileResponseRepositoryPrefix | any | string | null | undefined;
+    repositoryPrefix?: SyncReconcileResponseRepositoryPrefix1 | any | string | null | undefined;
     service: "ecr";
     type: SyncReconcileResponseTypeArtifactRegistry1;
 };
@@ -4322,6 +5267,44 @@ export type SyncReconcileResponseExternalBindingsDynamodb = {
  * Represents a KV binding for key-value storage across platforms
  */
 export type SyncReconcileResponseExternalBindingsUnion3 = SyncReconcileResponseExternalBindingsDynamodb | SyncReconcileResponseExternalBindingsFirestore | SyncReconcileResponseExternalBindingsTablestorage | SyncReconcileResponseExternalBindingsRedis | SyncReconcileResponseExternalBindingsLocalKv;
+/**
+ * Reference to a Kubernetes Secret
+ */
+export type SyncReconcileResponseQueuePathSecretRef = {
+    key: string;
+    name: string;
+};
+export type SyncReconcileResponseQueuePath = {
+    /**
+     * Reference to a Kubernetes Secret
+     */
+    secretRef: SyncReconcileResponseQueuePathSecretRef;
+};
+/**
+ * Represents a value that can be either a concrete value, a template expression,
+ *
+ * @remarks
+ * or a reference to a Kubernetes Secret
+ */
+export type SyncReconcileResponseQueuePathUnion = SyncReconcileResponseQueuePath | any | string;
+export declare const SyncReconcileResponseTypeQueue4: {
+    readonly Queue: "queue";
+};
+export type SyncReconcileResponseTypeQueue4 = ClosedEnum<typeof SyncReconcileResponseTypeQueue4>;
+/**
+ * Local queue parameters
+ */
+export type SyncReconcileResponseExternalBindingsLocalQueue = {
+    /**
+     * Represents a value that can be either a concrete value, a template expression,
+     *
+     * @remarks
+     * or a reference to a Kubernetes Secret
+     */
+    queuePath?: SyncReconcileResponseQueuePath | any | string | null | undefined;
+    service: "local-queue";
+    type: SyncReconcileResponseTypeQueue4;
+};
 /**
  * Reference to a Kubernetes Secret
  */
@@ -4493,7 +5476,7 @@ export type SyncReconcileResponseExternalBindingsSqs = {
 /**
  * Binding parameters for Queue at runtime or in templates.
  */
-export type SyncReconcileResponseExternalBindingsUnion2 = SyncReconcileResponseExternalBindingsSqs | SyncReconcileResponseExternalBindingsPubsub | SyncReconcileResponseExternalBindingsServicebus;
+export type SyncReconcileResponseExternalBindingsUnion2 = SyncReconcileResponseExternalBindingsSqs | SyncReconcileResponseExternalBindingsPubsub | SyncReconcileResponseExternalBindingsServicebus | SyncReconcileResponseExternalBindingsLocalQueue;
 /**
  * Reference to a Kubernetes Secret
  */
@@ -4685,21 +5668,7 @@ export type SyncReconcileResponseExternalBindingsUnion1 = SyncReconcileResponseE
  * The binding type must match the resource type it's applied to.
  * Validated at runtime by the executor.
  */
-export type SyncReconcileResponseExternalBindingsUnion6 = SyncReconcileResponseExternalBindingsS3 | SyncReconcileResponseExternalBindingsBlob | SyncReconcileResponseExternalBindingsGcs | SyncReconcileResponseExternalBindingsLocalStorage | SyncReconcileResponseExternalBindingsSqs | SyncReconcileResponseExternalBindingsPubsub | SyncReconcileResponseExternalBindingsServicebus | SyncReconcileResponseExternalBindingsDynamodb | SyncReconcileResponseExternalBindingsFirestore | SyncReconcileResponseExternalBindingsTablestorage | SyncReconcileResponseExternalBindingsRedis | SyncReconcileResponseExternalBindingsLocalKv | SyncReconcileResponseExternalBindingsEcr | SyncReconcileResponseExternalBindingsAcr | SyncReconcileResponseExternalBindingsGar | SyncReconcileResponseExternalBindingsLocal | SyncReconcileResponseExternalBindingsParameterStore | SyncReconcileResponseExternalBindingsSecretManager | SyncReconcileResponseExternalBindingsKeyVault | SyncReconcileResponseExternalBindingsKubernetesSecret | SyncReconcileResponseExternalBindingsLocalVault;
-/**
- * Image pull credentials for container registries
- */
-export type SyncReconcileResponseImagePullCredentials = {
-    /**
-     * Password for the container registry
-     */
-    password: string;
-    /**
-     * Username for the container registry
-     */
-    username: string;
-};
-export type SyncReconcileResponseImagePullCredentialsUnion = SyncReconcileResponseImagePullCredentials | any;
+export type SyncReconcileResponseExternalBindingsUnion6 = SyncReconcileResponseExternalBindingsContainerAppsEnvironment | SyncReconcileResponseExternalBindingsS3 | SyncReconcileResponseExternalBindingsBlob | SyncReconcileResponseExternalBindingsGcs | SyncReconcileResponseExternalBindingsLocalStorage | SyncReconcileResponseExternalBindingsSqs | SyncReconcileResponseExternalBindingsPubsub | SyncReconcileResponseExternalBindingsServicebus | SyncReconcileResponseExternalBindingsLocalQueue | SyncReconcileResponseExternalBindingsDynamodb | SyncReconcileResponseExternalBindingsFirestore | SyncReconcileResponseExternalBindingsTablestorage | SyncReconcileResponseExternalBindingsRedis | SyncReconcileResponseExternalBindingsLocalKv | SyncReconcileResponseExternalBindingsEcr | SyncReconcileResponseExternalBindingsAcr | SyncReconcileResponseExternalBindingsGar | SyncReconcileResponseExternalBindingsLocal | SyncReconcileResponseExternalBindingsParameterStore | SyncReconcileResponseExternalBindingsSecretManager | SyncReconcileResponseExternalBindingsKeyVault | SyncReconcileResponseExternalBindingsKubernetesSecret | SyncReconcileResponseExternalBindingsLocalVault;
 export declare const TargetPlatformKubernetes: {
     readonly Kubernetes: "kubernetes";
 };
@@ -4715,14 +5684,18 @@ export type TargetPlatformAzure = ClosedEnum<typeof TargetPlatformAzure>;
  * Azure management configuration extracted from stack settings
  */
 export type SyncReconcileResponseManagementConfigAzure = {
-    /**
-     * The principal ID of the service principal in the management account
-     */
-    managementPrincipalId: string;
     /**
      * The managing Azure Tenant ID for cross-tenant access
      */
     managingTenantId: string;
+    /**
+     * OIDC issuer URL trusted by the target-side managed identity.
+     */
+    oidcIssuer: string;
+    /**
+     * OIDC subject claim trusted by the target-side managed identity.
+     */
+    oidcSubject: string;
     platform: TargetPlatformAzure;
 };
 export declare const TargetPlatformGcp: {
@@ -4759,14 +5732,14 @@ export type SyncReconcileResponseManagementConfigUnion = SyncReconcileResponseMa
  *
  * @remarks
  *
- * When set, all compute workloads (containers and horizond VM workers) export
+ * When set, all compute workloads (containers and worker VMs) export
  * their logs to the given endpoint via OTLP/HTTP.
  *
  * The `logs_auth_header` is stored as plain text in DeploymentConfig because
  * alien-runtime reads `OTEL_EXPORTER_OTLP_HEADERS` at tracing-init time,
- * before vault secrets load. For horizond, the infra controller writes the
- * same value to the cloud vault (same pattern as the machine token) and the
- * startup script fetches it at boot via IAM.
+ * before vault secrets load. For worker VMs, worker-template stamping passes
+ * the monitoring configuration to the provider controller, which stores the
+ * sensitive header in the cloud vault used by the worker image.
  */
 export type SyncReconcileResponseMonitoring = {
     /**
@@ -4778,10 +5751,9 @@ export type SyncReconcileResponseMonitoring = {
      * into all containers. It must be plain (not a vault secret) because alien-runtime
      * reads `OTEL_EXPORTER_OTLP_HEADERS` at tracing-init time, before vault secrets load.
      *
-     * horizond VM workers do NOT use this field directly. The ContainerCluster infra
-     * controller writes the same value to the cloud vault (GCP: Secret Manager,
-     * AWS: Secrets Manager, Azure: Key Vault) and the startup script fetches it at
-     * boot via IAM — the same pattern as the machine token.
+     * Worker VMs do NOT use this field directly. The ComputeCluster infra
+     * controller writes the same value to the cloud vault used by the worker
+     * image (GCP: Secret Manager, AWS: Secrets Manager, Azure: Key Vault).
      *
      * Example: "authorization=Bearer <write-token>"
      */
@@ -4798,7 +5770,7 @@ export type SyncReconcileResponseMonitoring = {
      *
      * @remarks
      *
-     * When absent, `logs_auth_header` is reused for metrics — suitable when the same
+     * When absent, `logs_auth_header` is reused for metrics -- suitable when the same
      * credential covers both signals. When present (e.g. Axiom with separate datasets),
      * this value is used exclusively for metrics.
      *
@@ -4809,7 +5781,7 @@ export type SyncReconcileResponseMonitoring = {
      * Full OTLP metrics endpoint URL (optional).
      *
      * @remarks
-     * When set, horizond exports its own VM/container orchestration metrics here.
+     * When set, the worker runtime exports its own VM/container orchestration metrics here.
      * Example: "https://api.axiom.co/v1/metrics"
      */
     metricsEndpoint?: string | null | undefined;
@@ -4826,25 +5798,46 @@ export declare const SyncReconcileResponseDeploymentModel: {
  * Deployment model: how updates are delivered to the remote environment.
  */
 export type SyncReconcileResponseDeploymentModel = ClosedEnum<typeof SyncReconcileResponseDeploymentModel>;
-export type SyncReconcileResponseAws = {
+export type SyncReconcileResponseAwsStackSettings = {
     certificateArn: string;
 };
-export type SyncReconcileResponseAwsUnion = SyncReconcileResponseAws | any;
-export type AzureTargetConfig = {
+export type SyncReconcileResponseStackSettingsAwsUnion = SyncReconcileResponseAwsStackSettings | any;
+export type AzureTargetStackSettings = {
     keyVaultCertificateId: string;
 };
-export type TargetAzureUnion = AzureTargetConfig | any;
-export type GcpTargetConfig = {
+export type TargetStackSettingsAzureUnion = AzureTargetStackSettings | any;
+export type GcpTargetStackSettings = {
     certificateName: string;
 };
-export type TargetGcpUnion = GcpTargetConfig | any;
+export type TargetStackSettingsGcpUnion = GcpTargetStackSettings | any;
+/**
+ * Namespace-scoped Kubernetes TLS Secret reference.
+ */
+export type SyncReconcileResponseTlsSecretRef = {
+    /**
+     * Secret namespace. Defaults to the release namespace when omitted.
+     */
+    namespace?: string | null | undefined;
+    /**
+     * Secret name.
+     */
+    secretName: string;
+};
+export type SyncReconcileResponseDomainsKubernetes = {
+    /**
+     * Namespace-scoped Kubernetes TLS Secret reference.
+     */
+    tlsSecretRef: SyncReconcileResponseTlsSecretRef;
+};
+export type SyncReconcileResponseDomainsKubernetesUnion = SyncReconcileResponseDomainsKubernetes | any;
 /**
  * Platform-specific certificate references for custom domains.
  */
-export type SyncReconcileResponseCertificate = {
-    aws?: SyncReconcileResponseAws | any | null | undefined;
-    azure?: AzureTargetConfig | any | null | undefined;
-    gcp?: GcpTargetConfig | any | null | undefined;
+export type SyncReconcileResponseDomainsCertificate = {
+    aws?: SyncReconcileResponseAwsStackSettings | any | null | undefined;
+    azure?: AzureTargetStackSettings | any | null | undefined;
+    gcp?: GcpTargetStackSettings | any | null | undefined;
+    kubernetes?: SyncReconcileResponseDomainsKubernetes | any | null | undefined;
 };
 /**
  * Custom domain configuration for a single resource.
@@ -4853,7 +5846,7 @@ export type SyncReconcileResponseCustomDomains = {
     /**
      * Platform-specific certificate references for custom domains.
      */
-    certificate: SyncReconcileResponseCertificate;
+    certificate: SyncReconcileResponseDomainsCertificate;
     /**
      * Fully qualified domain name to use.
      */
@@ -4876,6 +5869,15 @@ export type SyncReconcileResponseDomains = {
     } | null | undefined;
 };
 export type SyncReconcileResponseDomainsUnion = SyncReconcileResponseDomains | any;
+/**
+ * External bindings for pre-existing infrastructure.
+ *
+ * @remarks
+ * Allows using existing resources (MinIO, Redis, shared Container Apps
+ * Environment, etc.) instead of having Alien provision them.
+ * Required for Kubernetes platform, optional for cloud platforms.
+ */
+export type SyncReconcileResponseStackSettingsExternalBindings = {};
 /**
  * How heartbeat health checks are handled.
  */
@@ -4887,6 +5889,539 @@ export declare const SyncReconcileResponseHeartbeats: {
  * How heartbeat health checks are handled.
  */
 export type SyncReconcileResponseHeartbeats = ClosedEnum<typeof SyncReconcileResponseHeartbeats>;
+/**
+ * Optional provider-specific identity for a cloud-backed Kubernetes cluster.
+ */
+export type SyncReconcileResponseCloud = {
+    accountId?: string | null | undefined;
+    clusterId?: string | null | undefined;
+    clusterName?: string | null | undefined;
+    projectId?: string | null | undefined;
+    region?: string | null | undefined;
+    resourceGroup?: string | null | undefined;
+    subscriptionId?: string | null | undefined;
+};
+export type SyncReconcileResponseCloudUnion = SyncReconcileResponseCloud | any;
+/**
+ * Ownership model for the Kubernetes cluster.
+ */
+export declare const SyncReconcileResponseOwnership: {
+    readonly Managed: "managed";
+    readonly Existing: "existing";
+    readonly External: "external";
+};
+/**
+ * Ownership model for the Kubernetes cluster.
+ */
+export type SyncReconcileResponseOwnership = ClosedEnum<typeof SyncReconcileResponseOwnership>;
+/**
+ * Kubernetes cluster setup settings.
+ */
+export type SyncReconcileResponseCluster = {
+    cloud?: SyncReconcileResponseCloud | any | null | undefined;
+    /**
+     * Namespace where the Alien chart and application resources run.
+     */
+    namespace?: string | null | undefined;
+    /**
+     * Ownership model for the Kubernetes cluster.
+     */
+    ownership: SyncReconcileResponseOwnership;
+};
+export type SyncReconcileResponseClusterUnion = SyncReconcileResponseCluster | any;
+export type SyncReconcileResponseCertificateNone2 = {
+    mode: "none";
+};
+export type SyncReconcileResponseCertificateManagedTLSSecret2 = {
+    mode: "managedTlsSecret";
+    /**
+     * Secret name template. Runtime may substitute resource/deployment tokens.
+     */
+    secretNameTemplate: string;
+};
+export type SyncReconcileResponseCertificateAwsAcmArn2 = {
+    /**
+     * Existing ACM certificate ARN.
+     */
+    certificateArn: string;
+    mode: "awsAcmArn";
+};
+export type SyncReconcileResponseCertificateManagedAcmImport2 = {
+    mode: "managedAcmImport";
+    /**
+     * ACM region. Defaults to the deployment region when omitted.
+     */
+    region?: string | null | undefined;
+    /**
+     * Tags applied to runtime-imported ACM certificates.
+     */
+    tags?: {
+        [k: string]: string;
+    } | undefined;
+};
+/**
+ * Namespace-scoped Kubernetes TLS Secret reference.
+ */
+export type SyncReconcileResponseCertificateTLSSecretRef2 = {
+    /**
+     * Secret namespace. Defaults to the release namespace when omitted.
+     */
+    namespace?: string | null | undefined;
+    /**
+     * Secret name.
+     */
+    secretName: string;
+    mode: "tlsSecretRef";
+};
+/**
+ * Certificate publication or reference mode for Kubernetes public endpoints.
+ */
+export type SyncReconcileResponseCertificateUnion2 = SyncReconcileResponseCertificateTLSSecretRef2 | SyncReconcileResponseCertificateManagedAcmImport2 | SyncReconcileResponseCertificateAwsAcmArn2 | SyncReconcileResponseCertificateManagedTLSSecret2 | SyncReconcileResponseCertificateNone2;
+export declare const SyncReconcileResponseModeCustom: {
+    readonly Custom: "custom";
+};
+export type SyncReconcileResponseModeCustom = ClosedEnum<typeof SyncReconcileResponseModeCustom>;
+export declare const SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum4: {
+    readonly AzureApplicationGatewayForContainers: "azureApplicationGatewayForContainers";
+};
+export type SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum4 = ClosedEnum<typeof SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum4>;
+export type SyncReconcileResponseProviderAzureApplicationGatewayForContainers4 = {
+    /**
+     * Optional ALB name when using BYO Application Gateway resources.
+     */
+    albName?: string | null | undefined;
+    /**
+     * Optional ALB namespace when using BYO Application Gateway resources.
+     */
+    albNamespace?: string | null | undefined;
+    /**
+     * Public or internal frontend exposure.
+     */
+    frontend: string;
+    provider: SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum4;
+};
+export declare const SyncReconcileResponseProviderGkeGatewayEnum4: {
+    readonly GkeGateway: "gkeGateway";
+};
+export type SyncReconcileResponseProviderGkeGatewayEnum4 = ClosedEnum<typeof SyncReconcileResponseProviderGkeGatewayEnum4>;
+export type SyncReconcileResponseProviderGkeGateway4 = {
+    provider: SyncReconcileResponseProviderGkeGatewayEnum4;
+    /**
+     * Optional static address name for the Gateway frontend.
+     */
+    staticAddressName?: string | null | undefined;
+};
+export declare const SyncReconcileResponseProviderAwsAlbEnum4: {
+    readonly AwsAlb: "awsAlb";
+};
+export type SyncReconcileResponseProviderAwsAlbEnum4 = ClosedEnum<typeof SyncReconcileResponseProviderAwsAlbEnum4>;
+export type SyncReconcileResponseProviderAwsAlb4 = {
+    /**
+     * Optional ALB IP address type, such as `dualstack`.
+     */
+    ipAddressType?: string | null | undefined;
+    provider: SyncReconcileResponseProviderAwsAlbEnum4;
+    /**
+     * Internet-facing or internal ALB scheme.
+     */
+    scheme: string;
+    /**
+     * Explicit subnet IDs when the profile cannot rely on controller discovery.
+     */
+    subnetIds?: Array<string> | undefined;
+    /**
+     * ALB target type, usually `ip`.
+     */
+    targetType: string;
+};
+export type SyncReconcileResponseProviderUnion4 = SyncReconcileResponseProviderAwsAlb4 | SyncReconcileResponseProviderAzureApplicationGatewayForContainers4 | SyncReconcileResponseProviderGkeGateway4 | any;
+/**
+ * Shared Gateway API route profile values.
+ */
+export type SyncReconcileResponseRouteGateway2 = {
+    /**
+     * Annotations applied to route objects.
+     */
+    annotations?: {
+        [k: string]: string;
+    } | undefined;
+    /**
+     * Route controller identifier, for example a cloud Gateway controller.
+     */
+    controller?: string | null | undefined;
+    /**
+     * GatewayClass selected for generated Gateways.
+     */
+    gatewayClassName: string;
+    /**
+     * Labels applied to route objects.
+     */
+    labels?: {
+        [k: string]: string;
+    } | undefined;
+    /**
+     * Listener port, usually 443.
+     */
+    listenerPort: number;
+    provider?: SyncReconcileResponseProviderAwsAlb4 | SyncReconcileResponseProviderAzureApplicationGatewayForContainers4 | SyncReconcileResponseProviderGkeGateway4 | any | null | undefined;
+    routeApi: "gateway";
+};
+export declare const SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum3: {
+    readonly AzureApplicationGatewayForContainers: "azureApplicationGatewayForContainers";
+};
+export type SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum3 = ClosedEnum<typeof SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum3>;
+export type SyncReconcileResponseProviderAzureApplicationGatewayForContainers3 = {
+    /**
+     * Optional ALB name when using BYO Application Gateway resources.
+     */
+    albName?: string | null | undefined;
+    /**
+     * Optional ALB namespace when using BYO Application Gateway resources.
+     */
+    albNamespace?: string | null | undefined;
+    /**
+     * Public or internal frontend exposure.
+     */
+    frontend: string;
+    provider: SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum3;
+};
+export declare const SyncReconcileResponseProviderGkeGatewayEnum3: {
+    readonly GkeGateway: "gkeGateway";
+};
+export type SyncReconcileResponseProviderGkeGatewayEnum3 = ClosedEnum<typeof SyncReconcileResponseProviderGkeGatewayEnum3>;
+export type SyncReconcileResponseProviderGkeGateway3 = {
+    provider: SyncReconcileResponseProviderGkeGatewayEnum3;
+    /**
+     * Optional static address name for the Gateway frontend.
+     */
+    staticAddressName?: string | null | undefined;
+};
+export declare const SyncReconcileResponseProviderAwsAlbEnum3: {
+    readonly AwsAlb: "awsAlb";
+};
+export type SyncReconcileResponseProviderAwsAlbEnum3 = ClosedEnum<typeof SyncReconcileResponseProviderAwsAlbEnum3>;
+export type SyncReconcileResponseProviderAwsAlb3 = {
+    /**
+     * Optional ALB IP address type, such as `dualstack`.
+     */
+    ipAddressType?: string | null | undefined;
+    provider: SyncReconcileResponseProviderAwsAlbEnum3;
+    /**
+     * Internet-facing or internal ALB scheme.
+     */
+    scheme: string;
+    /**
+     * Explicit subnet IDs when the profile cannot rely on controller discovery.
+     */
+    subnetIds?: Array<string> | undefined;
+    /**
+     * ALB target type, usually `ip`.
+     */
+    targetType: string;
+};
+export type SyncReconcileResponseProviderUnion3 = SyncReconcileResponseProviderAwsAlb3 | SyncReconcileResponseProviderAzureApplicationGatewayForContainers3 | SyncReconcileResponseProviderGkeGateway3 | any;
+/**
+ * Shared Ingress route profile values.
+ */
+export type SyncReconcileResponseRouteIngress2 = {
+    /**
+     * Annotations applied to route objects.
+     */
+    annotations?: {
+        [k: string]: string;
+    } | undefined;
+    /**
+     * Route controller identifier, for example `eks.amazonaws.com/alb`.
+     */
+    controller?: string | null | undefined;
+    /**
+     * `spec.ingressClassName` for generated Ingresses.
+     */
+    ingressClassName: string;
+    /**
+     * Labels applied to route objects.
+     */
+    labels?: {
+        [k: string]: string;
+    } | undefined;
+    provider?: SyncReconcileResponseProviderAwsAlb3 | SyncReconcileResponseProviderAzureApplicationGatewayForContainers3 | SyncReconcileResponseProviderGkeGateway3 | any | null | undefined;
+    routeApi: "ingress";
+};
+/**
+ * Kubernetes route API selected for public endpoints.
+ */
+export type SyncReconcileResponseRouteUnion2 = SyncReconcileResponseRouteIngress2 | SyncReconcileResponseRouteGateway2;
+export type SyncReconcileResponseExposureCustom = {
+    /**
+     * Certificate publication or reference mode for Kubernetes public endpoints.
+     */
+    certificate: SyncReconcileResponseCertificateTLSSecretRef2 | SyncReconcileResponseCertificateManagedAcmImport2 | SyncReconcileResponseCertificateAwsAcmArn2 | SyncReconcileResponseCertificateManagedTLSSecret2 | SyncReconcileResponseCertificateNone2;
+    /**
+     * Hostname routed by the Kubernetes public endpoint.
+     */
+    domain: string;
+    mode: SyncReconcileResponseModeCustom;
+    /**
+     * Kubernetes route API selected for public endpoints.
+     */
+    route: SyncReconcileResponseRouteIngress2 | SyncReconcileResponseRouteGateway2;
+};
+export type SyncReconcileResponseCertificateNone1 = {
+    mode: "none";
+};
+export type SyncReconcileResponseCertificateManagedTLSSecret1 = {
+    mode: "managedTlsSecret";
+    /**
+     * Secret name template. Runtime may substitute resource/deployment tokens.
+     */
+    secretNameTemplate: string;
+};
+export type SyncReconcileResponseCertificateAwsAcmArn1 = {
+    /**
+     * Existing ACM certificate ARN.
+     */
+    certificateArn: string;
+    mode: "awsAcmArn";
+};
+export type SyncReconcileResponseCertificateManagedAcmImport1 = {
+    mode: "managedAcmImport";
+    /**
+     * ACM region. Defaults to the deployment region when omitted.
+     */
+    region?: string | null | undefined;
+    /**
+     * Tags applied to runtime-imported ACM certificates.
+     */
+    tags?: {
+        [k: string]: string;
+    } | undefined;
+};
+/**
+ * Namespace-scoped Kubernetes TLS Secret reference.
+ */
+export type SyncReconcileResponseCertificateTLSSecretRef1 = {
+    /**
+     * Secret namespace. Defaults to the release namespace when omitted.
+     */
+    namespace?: string | null | undefined;
+    /**
+     * Secret name.
+     */
+    secretName: string;
+    mode: "tlsSecretRef";
+};
+/**
+ * Certificate publication or reference mode for Kubernetes public endpoints.
+ */
+export type SyncReconcileResponseCertificateUnion1 = SyncReconcileResponseCertificateTLSSecretRef1 | SyncReconcileResponseCertificateManagedAcmImport1 | SyncReconcileResponseCertificateAwsAcmArn1 | SyncReconcileResponseCertificateManagedTLSSecret1 | SyncReconcileResponseCertificateNone1;
+export declare const SyncReconcileResponseModeGenerated: {
+    readonly Generated: "generated";
+};
+export type SyncReconcileResponseModeGenerated = ClosedEnum<typeof SyncReconcileResponseModeGenerated>;
+export declare const SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum2: {
+    readonly AzureApplicationGatewayForContainers: "azureApplicationGatewayForContainers";
+};
+export type SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum2 = ClosedEnum<typeof SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum2>;
+export type SyncReconcileResponseProviderAzureApplicationGatewayForContainers2 = {
+    /**
+     * Optional ALB name when using BYO Application Gateway resources.
+     */
+    albName?: string | null | undefined;
+    /**
+     * Optional ALB namespace when using BYO Application Gateway resources.
+     */
+    albNamespace?: string | null | undefined;
+    /**
+     * Public or internal frontend exposure.
+     */
+    frontend: string;
+    provider: SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum2;
+};
+export declare const SyncReconcileResponseProviderGkeGatewayEnum2: {
+    readonly GkeGateway: "gkeGateway";
+};
+export type SyncReconcileResponseProviderGkeGatewayEnum2 = ClosedEnum<typeof SyncReconcileResponseProviderGkeGatewayEnum2>;
+export type SyncReconcileResponseProviderGkeGateway2 = {
+    provider: SyncReconcileResponseProviderGkeGatewayEnum2;
+    /**
+     * Optional static address name for the Gateway frontend.
+     */
+    staticAddressName?: string | null | undefined;
+};
+export declare const SyncReconcileResponseProviderAwsAlbEnum2: {
+    readonly AwsAlb: "awsAlb";
+};
+export type SyncReconcileResponseProviderAwsAlbEnum2 = ClosedEnum<typeof SyncReconcileResponseProviderAwsAlbEnum2>;
+export type SyncReconcileResponseProviderAwsAlb2 = {
+    /**
+     * Optional ALB IP address type, such as `dualstack`.
+     */
+    ipAddressType?: string | null | undefined;
+    provider: SyncReconcileResponseProviderAwsAlbEnum2;
+    /**
+     * Internet-facing or internal ALB scheme.
+     */
+    scheme: string;
+    /**
+     * Explicit subnet IDs when the profile cannot rely on controller discovery.
+     */
+    subnetIds?: Array<string> | undefined;
+    /**
+     * ALB target type, usually `ip`.
+     */
+    targetType: string;
+};
+export type SyncReconcileResponseProviderUnion2 = SyncReconcileResponseProviderAwsAlb2 | SyncReconcileResponseProviderAzureApplicationGatewayForContainers2 | SyncReconcileResponseProviderGkeGateway2 | any;
+/**
+ * Shared Gateway API route profile values.
+ */
+export type SyncReconcileResponseRouteGateway1 = {
+    /**
+     * Annotations applied to route objects.
+     */
+    annotations?: {
+        [k: string]: string;
+    } | undefined;
+    /**
+     * Route controller identifier, for example a cloud Gateway controller.
+     */
+    controller?: string | null | undefined;
+    /**
+     * GatewayClass selected for generated Gateways.
+     */
+    gatewayClassName: string;
+    /**
+     * Labels applied to route objects.
+     */
+    labels?: {
+        [k: string]: string;
+    } | undefined;
+    /**
+     * Listener port, usually 443.
+     */
+    listenerPort: number;
+    provider?: SyncReconcileResponseProviderAwsAlb2 | SyncReconcileResponseProviderAzureApplicationGatewayForContainers2 | SyncReconcileResponseProviderGkeGateway2 | any | null | undefined;
+    routeApi: "gateway";
+};
+export declare const SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum1: {
+    readonly AzureApplicationGatewayForContainers: "azureApplicationGatewayForContainers";
+};
+export type SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum1 = ClosedEnum<typeof SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum1>;
+export type SyncReconcileResponseProviderAzureApplicationGatewayForContainers1 = {
+    /**
+     * Optional ALB name when using BYO Application Gateway resources.
+     */
+    albName?: string | null | undefined;
+    /**
+     * Optional ALB namespace when using BYO Application Gateway resources.
+     */
+    albNamespace?: string | null | undefined;
+    /**
+     * Public or internal frontend exposure.
+     */
+    frontend: string;
+    provider: SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum1;
+};
+export declare const SyncReconcileResponseProviderGkeGatewayEnum1: {
+    readonly GkeGateway: "gkeGateway";
+};
+export type SyncReconcileResponseProviderGkeGatewayEnum1 = ClosedEnum<typeof SyncReconcileResponseProviderGkeGatewayEnum1>;
+export type SyncReconcileResponseProviderGkeGateway1 = {
+    provider: SyncReconcileResponseProviderGkeGatewayEnum1;
+    /**
+     * Optional static address name for the Gateway frontend.
+     */
+    staticAddressName?: string | null | undefined;
+};
+export declare const SyncReconcileResponseProviderAwsAlbEnum1: {
+    readonly AwsAlb: "awsAlb";
+};
+export type SyncReconcileResponseProviderAwsAlbEnum1 = ClosedEnum<typeof SyncReconcileResponseProviderAwsAlbEnum1>;
+export type SyncReconcileResponseProviderAwsAlb1 = {
+    /**
+     * Optional ALB IP address type, such as `dualstack`.
+     */
+    ipAddressType?: string | null | undefined;
+    provider: SyncReconcileResponseProviderAwsAlbEnum1;
+    /**
+     * Internet-facing or internal ALB scheme.
+     */
+    scheme: string;
+    /**
+     * Explicit subnet IDs when the profile cannot rely on controller discovery.
+     */
+    subnetIds?: Array<string> | undefined;
+    /**
+     * ALB target type, usually `ip`.
+     */
+    targetType: string;
+};
+export type SyncReconcileResponseProviderUnion1 = SyncReconcileResponseProviderAwsAlb1 | SyncReconcileResponseProviderAzureApplicationGatewayForContainers1 | SyncReconcileResponseProviderGkeGateway1 | any;
+/**
+ * Shared Ingress route profile values.
+ */
+export type SyncReconcileResponseRouteIngress1 = {
+    /**
+     * Annotations applied to route objects.
+     */
+    annotations?: {
+        [k: string]: string;
+    } | undefined;
+    /**
+     * Route controller identifier, for example `eks.amazonaws.com/alb`.
+     */
+    controller?: string | null | undefined;
+    /**
+     * `spec.ingressClassName` for generated Ingresses.
+     */
+    ingressClassName: string;
+    /**
+     * Labels applied to route objects.
+     */
+    labels?: {
+        [k: string]: string;
+    } | undefined;
+    provider?: SyncReconcileResponseProviderAwsAlb1 | SyncReconcileResponseProviderAzureApplicationGatewayForContainers1 | SyncReconcileResponseProviderGkeGateway1 | any | null | undefined;
+    routeApi: "ingress";
+};
+/**
+ * Kubernetes route API selected for public endpoints.
+ */
+export type SyncReconcileResponseRouteUnion1 = SyncReconcileResponseRouteIngress1 | SyncReconcileResponseRouteGateway1;
+export type SyncReconcileResponseExposureGenerated = {
+    /**
+     * Certificate publication or reference mode for Kubernetes public endpoints.
+     */
+    certificate: SyncReconcileResponseCertificateTLSSecretRef1 | SyncReconcileResponseCertificateManagedAcmImport1 | SyncReconcileResponseCertificateAwsAcmArn1 | SyncReconcileResponseCertificateManagedTLSSecret1 | SyncReconcileResponseCertificateNone1;
+    mode: SyncReconcileResponseModeGenerated;
+    /**
+     * Kubernetes route API selected for public endpoints.
+     */
+    route: SyncReconcileResponseRouteIngress1 | SyncReconcileResponseRouteGateway1;
+};
+export declare const SyncReconcileResponseModeDisabled: {
+    readonly Disabled: "disabled";
+};
+export type SyncReconcileResponseModeDisabled = ClosedEnum<typeof SyncReconcileResponseModeDisabled>;
+export type SyncReconcileResponseExposureDisabled = {
+    mode: SyncReconcileResponseModeDisabled;
+};
+export type SyncReconcileResponseExposureUnion = SyncReconcileResponseExposureCustom | SyncReconcileResponseExposureGenerated | SyncReconcileResponseExposureDisabled | any;
+/**
+ * Kubernetes runtime substrate configuration.
+ *
+ * @remarks
+ *
+ * This controls how setup chooses the cluster backing `Platform::Kubernetes`
+ * deployments. When omitted, cloud-backed Kubernetes deployments default to a
+ * managed cluster and generic/on-prem Kubernetes defaults to an external
+ * cluster.
+ */
+export type SyncReconcileResponseKubernetes = {
+    cluster?: SyncReconcileResponseCluster | any | null | undefined;
+    exposure?: SyncReconcileResponseExposureCustom | SyncReconcileResponseExposureGenerated | SyncReconcileResponseExposureDisabled | any | null | undefined;
+};
+export type SyncReconcileResponseKubernetesUnion = SyncReconcileResponseKubernetes | any;
 export declare const SyncReconcileResponseTypeByoVnetAzure: {
     readonly ByoVnetAzure: "byo-vnet-azure";
 };
@@ -5015,10 +6550,20 @@ export type SyncReconcileResponseStackSettings = {
      */
     deploymentModel?: SyncReconcileResponseDeploymentModel | undefined;
     domains?: SyncReconcileResponseDomains | any | null | undefined;
+    /**
+     * External bindings for pre-existing infrastructure.
+     *
+     * @remarks
+     * Allows using existing resources (MinIO, Redis, shared Container Apps
+     * Environment, etc.) instead of having Alien provision them.
+     * Required for Kubernetes platform, optional for cloud platforms.
+     */
+    externalBindings?: SyncReconcileResponseStackSettingsExternalBindings | null | undefined;
     /**
      * How heartbeat health checks are handled.
      */
     heartbeats?: SyncReconcileResponseHeartbeats | undefined;
+    kubernetes?: SyncReconcileResponseKubernetes | any | null | undefined;
     network?: SyncReconcileResponseNetworkByoVpcAws | SyncReconcileResponseNetworkByoVpcGcp | SyncReconcileResponseNetworkByoVnetAzure | SyncReconcileResponseNetworkUseDefault | SyncReconcileResponseNetworkCreate | any | null | undefined;
     /**
      * How telemetry (logs, metrics, traces) is handled.
@@ -5045,9 +6590,28 @@ export type TargetConfig = {
      * When true, skips the frozen resources compatibility check.
      * This requires running with elevated cloud credentials.
      */
-    allowFrozenChanges?: boolean | undefined;
-    artifactRegistry?: SyncReconcileResponseArtifactRegistry | any | null | undefined;
-    computeBackend?: SyncReconcileResponseComputeBackendHorizon | any | null | undefined;
+    allowFrozenChanges?: boolean | undefined;
+    basePlatform?: SyncReconcileResponseBasePlatformEnum | any | null | undefined;
+    computeBackend?: SyncReconcileResponseComputeBackendHorizon | any | null | undefined;
+    /**
+     * Human-readable deployment name for cloud console metadata.
+     *
+     * @remarks
+     *
+     * This is separate from the physical resource prefix in StackState. It is
+     * used only for display text such as IAM role descriptions, service
+     * account descriptions, and custom role titles.
+     */
+    deploymentName?: string | null | undefined;
+    /**
+     * Deployment token for pull authentication with the manager's registry.
+     *
+     * @remarks
+     *
+     * Used by controllers to configure registry credentials so cloud platforms
+     * and K8s can pull images from the manager's `/v2/` endpoint.
+     */
+    deploymentToken?: string | null | undefined;
     domainMetadata?: SyncReconcileResponseDomainMetadata | any | null | undefined;
     /**
      * Snapshot of environment variables at a point in time
@@ -5061,24 +6625,50 @@ export type TargetConfig = {
      * Validated at runtime: binding type must match resource type.
      */
     externalBindings?: {
-        [k: string]: SyncReconcileResponseExternalBindingsS3 | SyncReconcileResponseExternalBindingsBlob | SyncReconcileResponseExternalBindingsGcs | SyncReconcileResponseExternalBindingsLocalStorage | SyncReconcileResponseExternalBindingsSqs | SyncReconcileResponseExternalBindingsPubsub | SyncReconcileResponseExternalBindingsServicebus | SyncReconcileResponseExternalBindingsDynamodb | SyncReconcileResponseExternalBindingsFirestore | SyncReconcileResponseExternalBindingsTablestorage | SyncReconcileResponseExternalBindingsRedis | SyncReconcileResponseExternalBindingsLocalKv | SyncReconcileResponseExternalBindingsEcr | SyncReconcileResponseExternalBindingsAcr | SyncReconcileResponseExternalBindingsGar | SyncReconcileResponseExternalBindingsLocal | SyncReconcileResponseExternalBindingsParameterStore | SyncReconcileResponseExternalBindingsSecretManager | SyncReconcileResponseExternalBindingsKeyVault | SyncReconcileResponseExternalBindingsKubernetesSecret | SyncReconcileResponseExternalBindingsLocalVault;
+        [k: string]: SyncReconcileResponseExternalBindingsContainerAppsEnvironment | SyncReconcileResponseExternalBindingsS3 | SyncReconcileResponseExternalBindingsBlob | SyncReconcileResponseExternalBindingsGcs | SyncReconcileResponseExternalBindingsLocalStorage | SyncReconcileResponseExternalBindingsSqs | SyncReconcileResponseExternalBindingsPubsub | SyncReconcileResponseExternalBindingsServicebus | SyncReconcileResponseExternalBindingsLocalQueue | SyncReconcileResponseExternalBindingsDynamodb | SyncReconcileResponseExternalBindingsFirestore | SyncReconcileResponseExternalBindingsTablestorage | SyncReconcileResponseExternalBindingsRedis | SyncReconcileResponseExternalBindingsLocalKv | SyncReconcileResponseExternalBindingsEcr | SyncReconcileResponseExternalBindingsAcr | SyncReconcileResponseExternalBindingsGar | SyncReconcileResponseExternalBindingsLocal | SyncReconcileResponseExternalBindingsParameterStore | SyncReconcileResponseExternalBindingsSecretManager | SyncReconcileResponseExternalBindingsKeyVault | SyncReconcileResponseExternalBindingsKubernetesSecret | SyncReconcileResponseExternalBindingsLocalVault;
     } | undefined;
-    imagePullCredentials?: SyncReconcileResponseImagePullCredentials | any | null | undefined;
     managementConfig?: SyncReconcileResponseManagementConfigAzure | SyncReconcileResponseManagementConfigAws | SyncReconcileResponseManagementConfigGcp | SyncReconcileResponseManagementConfigKubernetes | any | null | undefined;
+    /**
+     * Manager base URL (e.g., "https://manager.alien.dev").
+     *
+     * @remarks
+     *
+     * The manager IS the container registry — its `/v2/` endpoint serves as
+     * the OCI Distribution API. Controllers derive the proxy host from this
+     * to configure pull auth (RegistryCredentials, imagePullSecrets).
+     *
+     * When None (e.g., `alien dev`), controllers use image URIs as-is.
+     */
+    managerUrl?: string | null | undefined;
     monitoring?: SyncReconcileResponseMonitoring | any | null | undefined;
     /**
-     * Public URLs for exposed resources (optional override for all platforms).
+     * Native image registry host+prefix for platforms that require it.
      *
      * @remarks
      *
-     * - **Kubernetes**: Pre-computed by Helm from services config (highly recommended)
-     * - **Cloud**: Optional override of domain_metadata or load balancer DNS
-     * - **Local**: Optional override of dynamic localhost URLs
+     * Lambda (ECR) and Cloud Run (GAR) require native registry URIs. Other
+     * runtimes, including Azure Container Apps, pull through the manager's
+     * registry proxy.
+     *
+     * Derived by the manager from the artifact registry binding:
+     * - ECR: `{account_id}.dkr.ecr.{region}.amazonaws.com/{repository_prefix}`
+     * - GAR: `{region}-docker.pkg.dev/{project_id}/{repository_name}`
+     */
+    nativeImageHost?: string | null | undefined;
+    /**
+     * Public URLs for exposed resources (optional override).
+     *
+     * @remarks
+     *
+     * Use this only when a caller already knows the public URL. Managed public
+     * endpoint flows should prefer `domain_metadata` plus controller-reported
+     * load balancer outputs so DNS, certificate renewal, and route readiness
+     * stay tied to the resource state.
      *
      * If not set, platforms determine public URLs from other sources:
-     * - Cloud: domain_metadata FQDN or load balancer DNS
-     * - Local: http://localhost:{allocated_port}
-     * - Kubernetes: None (unless provided by Helm)
+     * - Managed DNS/TLS flows: `domain_metadata` FQDN or load balancer DNS
+     * - Local: `http://localhost:{allocated_port}`
+     * - Custom or disabled exposure: no public URL unless a controller reports one
      *
      * Key: resource ID, Value: public URL (e.g., "https://api.acme.com")
      */
@@ -5150,6 +6740,17 @@ export type OverrideReleaseInfoAwBinding = {
      */
     stack?: OverrideReleaseInfoAwStack | undefined;
 };
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export declare const OverrideReleaseInfoEffect: {
+    readonly Allow: "Allow";
+    readonly Deny: "Deny";
+};
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export type OverrideReleaseInfoEffect = ClosedEnum<typeof OverrideReleaseInfoEffect>;
 /**
  * Grant permissions for a specific cloud platform
  */
@@ -5163,9 +6764,17 @@ export type OverrideReleaseInfoAwGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * AWS-specific platform permission configuration
@@ -5175,10 +6784,22 @@ export type OverrideReleaseInfoAw = {
      * Generic binding configuration for permissions
      */
     binding: OverrideReleaseInfoAwBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
+    /**
+     * IAM effect. Defaults to Allow.
+     */
+    effect?: OverrideReleaseInfoEffect | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: OverrideReleaseInfoAwGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Azure-specific binding specification
@@ -5224,9 +6845,17 @@ export type OverrideReleaseInfoAzureGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * Azure-specific platform permission configuration
@@ -5236,10 +6865,18 @@ export type OverrideReleaseInfoAzure = {
      * Generic binding configuration for permissions
      */
     binding: OverrideReleaseInfoAzureBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: OverrideReleaseInfoAzureGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * GCP IAM condition
@@ -5303,9 +6940,17 @@ export type OverrideReleaseInfoGcpGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * GCP-specific platform permission configuration
@@ -5315,10 +6960,18 @@ export type OverrideReleaseInfoGcp = {
      * Generic binding configuration for permissions
      */
     binding: OverrideReleaseInfoGcpBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: OverrideReleaseInfoGcpGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Platform-specific permission configurations
@@ -5416,6 +7069,17 @@ export type ExtendReleaseInfoAwBinding = {
      */
     stack?: ExtendReleaseInfoAwStack | undefined;
 };
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export declare const ExtendReleaseInfoEffect: {
+    readonly Allow: "Allow";
+    readonly Deny: "Deny";
+};
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export type ExtendReleaseInfoEffect = ClosedEnum<typeof ExtendReleaseInfoEffect>;
 /**
  * Grant permissions for a specific cloud platform
  */
@@ -5429,9 +7093,17 @@ export type ExtendReleaseInfoAwGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * AWS-specific platform permission configuration
@@ -5441,10 +7113,22 @@ export type ExtendReleaseInfoAw = {
      * Generic binding configuration for permissions
      */
     binding: ExtendReleaseInfoAwBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
+    /**
+     * IAM effect. Defaults to Allow.
+     */
+    effect?: ExtendReleaseInfoEffect | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: ExtendReleaseInfoAwGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Azure-specific binding specification
@@ -5490,9 +7174,17 @@ export type ExtendReleaseInfoAzureGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * Azure-specific platform permission configuration
@@ -5502,10 +7194,18 @@ export type ExtendReleaseInfoAzure = {
      * Generic binding configuration for permissions
      */
     binding: ExtendReleaseInfoAzureBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: ExtendReleaseInfoAzureGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * GCP IAM condition
@@ -5569,9 +7269,17 @@ export type ExtendReleaseInfoGcpGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * GCP-specific platform permission configuration
@@ -5581,10 +7289,18 @@ export type ExtendReleaseInfoGcp = {
      * Generic binding configuration for permissions
      */
     binding: ExtendReleaseInfoGcpBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: ExtendReleaseInfoGcpGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Platform-specific permission configurations
@@ -5686,6 +7402,17 @@ export type ProfileReleaseInfoAwBinding = {
      */
     stack?: ProfileReleaseInfoAwStack | undefined;
 };
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export declare const ProfileReleaseInfoEffect: {
+    readonly Allow: "Allow";
+    readonly Deny: "Deny";
+};
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export type ProfileReleaseInfoEffect = ClosedEnum<typeof ProfileReleaseInfoEffect>;
 /**
  * Grant permissions for a specific cloud platform
  */
@@ -5699,9 +7426,17 @@ export type ProfileReleaseInfoAwGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * AWS-specific platform permission configuration
@@ -5711,10 +7446,22 @@ export type ProfileReleaseInfoAw = {
      * Generic binding configuration for permissions
      */
     binding: ProfileReleaseInfoAwBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
+    /**
+     * IAM effect. Defaults to Allow.
+     */
+    effect?: ProfileReleaseInfoEffect | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: ProfileReleaseInfoAwGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Azure-specific binding specification
@@ -5760,9 +7507,17 @@ export type ProfileReleaseInfoAzureGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * Azure-specific platform permission configuration
@@ -5772,10 +7527,18 @@ export type ProfileReleaseInfoAzure = {
      * Generic binding configuration for permissions
      */
     binding: ProfileReleaseInfoAzureBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: ProfileReleaseInfoAzureGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * GCP IAM condition
@@ -5839,9 +7602,17 @@ export type ProfileReleaseInfoGcpGrant = {
      */
     dataActions?: Array<string> | null | undefined;
     /**
-     * GCP permissions (only for GCP)
+     * GCP permissions that require an exact residual custom role.
      */
     permissions?: Array<string> | null | undefined;
+    /**
+     * Provider predefined roles to bind directly.
+     */
+    predefinedRoles?: Array<string> | null | undefined;
+    /**
+     * GCP residual custom permissions to pair with predefined roles.
+     */
+    residualPermissions?: Array<string> | null | undefined;
 };
 /**
  * GCP-specific platform permission configuration
@@ -5851,10 +7622,18 @@ export type ProfileReleaseInfoGcp = {
      * Generic binding configuration for permissions
      */
     binding: ProfileReleaseInfoGcpBinding;
+    /**
+     * Short admin-facing description of why this entry exists.
+     */
+    description?: string | null | undefined;
     /**
      * Grant permissions for a specific cloud platform
      */
     grant: ProfileReleaseInfoGcpGrant;
+    /**
+     * Stable admin-facing label for this permission entry.
+     */
+    label?: string | null | undefined;
 };
 /**
  * Platform-specific permission configurations
@@ -5949,7 +7728,6 @@ export type ReleaseInfoDependency = {
 export declare const ReleaseInfoLifecycle: {
     readonly Frozen: "frozen";
     readonly Live: "live";
-    readonly LiveOnSetup: "live-on-setup";
 };
 /**
  * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
@@ -5980,6 +7758,21 @@ export type ReleaseInfoResources = {
      */
     remoteAccess?: boolean | undefined;
 };
+/**
+ * Represents the target cloud platform.
+ */
+export declare const ReleaseInfoSupportedPlatform: {
+    readonly Aws: "aws";
+    readonly Gcp: "gcp";
+    readonly Azure: "azure";
+    readonly Kubernetes: "kubernetes";
+    readonly Local: "local";
+    readonly Test: "test";
+};
+/**
+ * Represents the target cloud platform.
+ */
+export type ReleaseInfoSupportedPlatform = ClosedEnum<typeof ReleaseInfoSupportedPlatform>;
 /**
  * A bag of resources, unaware of any cloud.
  */
@@ -5998,6 +7791,10 @@ export type ReleaseInfoStack = {
     resources: {
         [k: string]: ReleaseInfoResources;
     };
+    /**
+     * Which platforms this stack supports. When None, all platforms are supported.
+     */
+    supportedPlatforms?: Array<ReleaseInfoSupportedPlatform> | null | undefined;
 };
 /**
  * Release metadata
@@ -6079,6 +7876,8 @@ export declare function syncReconcileResponseCurrentReleaseOverrideAwStackFromJS
 export declare const SyncReconcileResponseCurrentReleaseOverrideAwBinding$inboundSchema: z.ZodType<SyncReconcileResponseCurrentReleaseOverrideAwBinding, unknown>;
 export declare function syncReconcileResponseCurrentReleaseOverrideAwBindingFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCurrentReleaseOverrideAwBinding, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponseCurrentReleaseOverrideEffect$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseCurrentReleaseOverrideEffect>;
+/** @internal */
 export declare const SyncReconcileResponseCurrentReleaseOverrideAwGrant$inboundSchema: z.ZodType<SyncReconcileResponseCurrentReleaseOverrideAwGrant, unknown>;
 export declare function syncReconcileResponseCurrentReleaseOverrideAwGrantFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCurrentReleaseOverrideAwGrant, SDKValidationError>;
 /** @internal */
@@ -6148,6 +7947,8 @@ export declare function syncReconcileResponseCurrentReleaseExtendAwStackFromJSON
 export declare const SyncReconcileResponseCurrentReleaseExtendAwBinding$inboundSchema: z.ZodType<SyncReconcileResponseCurrentReleaseExtendAwBinding, unknown>;
 export declare function syncReconcileResponseCurrentReleaseExtendAwBindingFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCurrentReleaseExtendAwBinding, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponseCurrentReleaseExtendEffect$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseCurrentReleaseExtendEffect>;
+/** @internal */
 export declare const SyncReconcileResponseCurrentReleaseExtendAwGrant$inboundSchema: z.ZodType<SyncReconcileResponseCurrentReleaseExtendAwGrant, unknown>;
 export declare function syncReconcileResponseCurrentReleaseExtendAwGrantFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCurrentReleaseExtendAwGrant, SDKValidationError>;
 /** @internal */
@@ -6220,6 +8021,8 @@ export declare function syncReconcileResponseCurrentReleaseProfileAwStackFromJSO
 export declare const SyncReconcileResponseCurrentReleaseProfileAwBinding$inboundSchema: z.ZodType<SyncReconcileResponseCurrentReleaseProfileAwBinding, unknown>;
 export declare function syncReconcileResponseCurrentReleaseProfileAwBindingFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCurrentReleaseProfileAwBinding, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponseCurrentReleaseProfileEffect$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseCurrentReleaseProfileEffect>;
+/** @internal */
 export declare const SyncReconcileResponseCurrentReleaseProfileAwGrant$inboundSchema: z.ZodType<SyncReconcileResponseCurrentReleaseProfileAwGrant, unknown>;
 export declare function syncReconcileResponseCurrentReleaseProfileAwGrantFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCurrentReleaseProfileAwGrant, SDKValidationError>;
 /** @internal */
@@ -6291,6 +8094,8 @@ export declare const SyncReconcileResponseCurrentReleaseLifecycle$inboundSchema:
 export declare const SyncReconcileResponseCurrentReleaseResources$inboundSchema: z.ZodType<SyncReconcileResponseCurrentReleaseResources, unknown>;
 export declare function syncReconcileResponseCurrentReleaseResourcesFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCurrentReleaseResources, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponseCurrentReleaseSupportedPlatform$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseCurrentReleaseSupportedPlatform>;
+/** @internal */
 export declare const SyncReconcileResponseCurrentReleaseStack$inboundSchema: z.ZodType<SyncReconcileResponseCurrentReleaseStack, unknown>;
 export declare function syncReconcileResponseCurrentReleaseStackFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCurrentReleaseStack, SDKValidationError>;
 /** @internal */
@@ -6330,6 +8135,16 @@ export declare function syncReconcileResponseEnvironmentInfoUnionFromJSON(jsonSt
 /** @internal */
 export declare const SyncReconcileResponseCurrentPlatform$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseCurrentPlatform>;
 /** @internal */
+export declare const SyncReconcileResponseDeleteScopeEnum$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseDeleteScopeEnum>;
+/** @internal */
+export declare const SyncReconcileResponseDeleteScopeUnion$inboundSchema: z.ZodType<SyncReconcileResponseDeleteScopeUnion, unknown>;
+export declare function syncReconcileResponseDeleteScopeUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseDeleteScopeUnion, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponsePendingDeleteScopeEnum$inboundSchema: z.ZodEnum<typeof SyncReconcileResponsePendingDeleteScopeEnum>;
+/** @internal */
+export declare const SyncReconcileResponsePendingDeleteScopeUnion$inboundSchema: z.ZodType<SyncReconcileResponsePendingDeleteScopeUnion, unknown>;
+export declare function syncReconcileResponsePendingDeleteScopeUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponsePendingDeleteScopeUnion, SDKValidationError>;
+/** @internal */
 export declare const SyncReconcileResponsePreparedStackManagementEnum$inboundSchema: z.ZodEnum<typeof SyncReconcileResponsePreparedStackManagementEnum>;
 /** @internal */
 export declare const SyncReconcileResponsePreparedStackOverrideAwResource$inboundSchema: z.ZodType<SyncReconcileResponsePreparedStackOverrideAwResource, unknown>;
@@ -6341,6 +8156,8 @@ export declare function syncReconcileResponsePreparedStackOverrideAwStackFromJSO
 export declare const SyncReconcileResponsePreparedStackOverrideAwBinding$inboundSchema: z.ZodType<SyncReconcileResponsePreparedStackOverrideAwBinding, unknown>;
 export declare function syncReconcileResponsePreparedStackOverrideAwBindingFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponsePreparedStackOverrideAwBinding, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponsePreparedStackOverrideEffect$inboundSchema: z.ZodEnum<typeof SyncReconcileResponsePreparedStackOverrideEffect>;
+/** @internal */
 export declare const SyncReconcileResponsePreparedStackOverrideAwGrant$inboundSchema: z.ZodType<SyncReconcileResponsePreparedStackOverrideAwGrant, unknown>;
 export declare function syncReconcileResponsePreparedStackOverrideAwGrantFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponsePreparedStackOverrideAwGrant, SDKValidationError>;
 /** @internal */
@@ -6410,6 +8227,8 @@ export declare function syncReconcileResponsePreparedStackExtendAwStackFromJSON(
 export declare const SyncReconcileResponsePreparedStackExtendAwBinding$inboundSchema: z.ZodType<SyncReconcileResponsePreparedStackExtendAwBinding, unknown>;
 export declare function syncReconcileResponsePreparedStackExtendAwBindingFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponsePreparedStackExtendAwBinding, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponsePreparedStackExtendEffect$inboundSchema: z.ZodEnum<typeof SyncReconcileResponsePreparedStackExtendEffect>;
+/** @internal */
 export declare const SyncReconcileResponsePreparedStackExtendAwGrant$inboundSchema: z.ZodType<SyncReconcileResponsePreparedStackExtendAwGrant, unknown>;
 export declare function syncReconcileResponsePreparedStackExtendAwGrantFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponsePreparedStackExtendAwGrant, SDKValidationError>;
 /** @internal */
@@ -6482,6 +8301,8 @@ export declare function syncReconcileResponsePreparedStackProfileAwStackFromJSON
 export declare const SyncReconcileResponsePreparedStackProfileAwBinding$inboundSchema: z.ZodType<SyncReconcileResponsePreparedStackProfileAwBinding, unknown>;
 export declare function syncReconcileResponsePreparedStackProfileAwBindingFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponsePreparedStackProfileAwBinding, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponsePreparedStackProfileEffect$inboundSchema: z.ZodEnum<typeof SyncReconcileResponsePreparedStackProfileEffect>;
+/** @internal */
 export declare const SyncReconcileResponsePreparedStackProfileAwGrant$inboundSchema: z.ZodType<SyncReconcileResponsePreparedStackProfileAwGrant, unknown>;
 export declare function syncReconcileResponsePreparedStackProfileAwGrantFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponsePreparedStackProfileAwGrant, SDKValidationError>;
 /** @internal */
@@ -6553,6 +8374,8 @@ export declare const SyncReconcileResponsePreparedStackLifecycle$inboundSchema:
 export declare const SyncReconcileResponsePreparedStackResources$inboundSchema: z.ZodType<SyncReconcileResponsePreparedStackResources, unknown>;
 export declare function syncReconcileResponsePreparedStackResourcesFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponsePreparedStackResources, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponsePreparedStackSupportedPlatform$inboundSchema: z.ZodEnum<typeof SyncReconcileResponsePreparedStackSupportedPlatform>;
+/** @internal */
 export declare const SyncReconcileResponsePreparedStack$inboundSchema: z.ZodType<SyncReconcileResponsePreparedStack, unknown>;
 export declare function syncReconcileResponsePreparedStackFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponsePreparedStack, SDKValidationError>;
 /** @internal */
@@ -6570,6 +8393,11 @@ export declare const SyncReconcileResponseStackStatePlatform$inboundSchema: z.Zo
 export declare const SyncReconcileResponseStackStateConfig$inboundSchema: z.ZodType<SyncReconcileResponseStackStateConfig, unknown>;
 export declare function syncReconcileResponseStackStateConfigFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseStackStateConfig, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponseControllerPlatformEnum$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseControllerPlatformEnum>;
+/** @internal */
+export declare const SyncReconcileResponseControllerPlatformUnion$inboundSchema: z.ZodType<SyncReconcileResponseControllerPlatformUnion, unknown>;
+export declare function syncReconcileResponseControllerPlatformUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseControllerPlatformUnion, SDKValidationError>;
+/** @internal */
 export declare const SyncReconcileResponseStackStateDependency$inboundSchema: z.ZodType<SyncReconcileResponseStackStateDependency, unknown>;
 export declare function syncReconcileResponseStackStateDependencyFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseStackStateDependency, SDKValidationError>;
 /** @internal */
@@ -6620,6 +8448,8 @@ export declare function syncReconcileResponseTargetReleaseOverrideAwStackFromJSO
 export declare const SyncReconcileResponseTargetReleaseOverrideAwBinding$inboundSchema: z.ZodType<SyncReconcileResponseTargetReleaseOverrideAwBinding, unknown>;
 export declare function syncReconcileResponseTargetReleaseOverrideAwBindingFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseTargetReleaseOverrideAwBinding, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponseTargetReleaseOverrideEffect$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseTargetReleaseOverrideEffect>;
+/** @internal */
 export declare const SyncReconcileResponseTargetReleaseOverrideAwGrant$inboundSchema: z.ZodType<SyncReconcileResponseTargetReleaseOverrideAwGrant, unknown>;
 export declare function syncReconcileResponseTargetReleaseOverrideAwGrantFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseTargetReleaseOverrideAwGrant, SDKValidationError>;
 /** @internal */
@@ -6689,6 +8519,8 @@ export declare function syncReconcileResponseTargetReleaseExtendAwStackFromJSON(
 export declare const SyncReconcileResponseTargetReleaseExtendAwBinding$inboundSchema: z.ZodType<SyncReconcileResponseTargetReleaseExtendAwBinding, unknown>;
 export declare function syncReconcileResponseTargetReleaseExtendAwBindingFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseTargetReleaseExtendAwBinding, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponseTargetReleaseExtendEffect$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseTargetReleaseExtendEffect>;
+/** @internal */
 export declare const SyncReconcileResponseTargetReleaseExtendAwGrant$inboundSchema: z.ZodType<SyncReconcileResponseTargetReleaseExtendAwGrant, unknown>;
 export declare function syncReconcileResponseTargetReleaseExtendAwGrantFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseTargetReleaseExtendAwGrant, SDKValidationError>;
 /** @internal */
@@ -6761,6 +8593,8 @@ export declare function syncReconcileResponseTargetReleaseProfileAwStackFromJSON
 export declare const SyncReconcileResponseTargetReleaseProfileAwBinding$inboundSchema: z.ZodType<SyncReconcileResponseTargetReleaseProfileAwBinding, unknown>;
 export declare function syncReconcileResponseTargetReleaseProfileAwBindingFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseTargetReleaseProfileAwBinding, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponseTargetReleaseProfileEffect$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseTargetReleaseProfileEffect>;
+/** @internal */
 export declare const SyncReconcileResponseTargetReleaseProfileAwGrant$inboundSchema: z.ZodType<SyncReconcileResponseTargetReleaseProfileAwGrant, unknown>;
 export declare function syncReconcileResponseTargetReleaseProfileAwGrantFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseTargetReleaseProfileAwGrant, SDKValidationError>;
 /** @internal */
@@ -6832,6 +8666,8 @@ export declare const SyncReconcileResponseTargetReleaseLifecycle$inboundSchema:
 export declare const SyncReconcileResponseTargetReleaseResources$inboundSchema: z.ZodType<SyncReconcileResponseTargetReleaseResources, unknown>;
 export declare function syncReconcileResponseTargetReleaseResourcesFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseTargetReleaseResources, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponseTargetReleaseSupportedPlatform$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseTargetReleaseSupportedPlatform>;
+/** @internal */
 export declare const SyncReconcileResponseTargetReleaseStack$inboundSchema: z.ZodType<SyncReconcileResponseTargetReleaseStack, unknown>;
 export declare function syncReconcileResponseTargetReleaseStackFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseTargetReleaseStack, SDKValidationError>;
 /** @internal */
@@ -6844,15 +8680,47 @@ export declare function syncReconcileResponseTargetReleaseUnionFromJSON(jsonStri
 export declare const SyncReconcileResponseCurrent$inboundSchema: z.ZodType<SyncReconcileResponseCurrent, unknown>;
 export declare function syncReconcileResponseCurrentFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCurrent, SDKValidationError>;
 /** @internal */
-export declare const SyncReconcileResponseArtifactRegistry$inboundSchema: z.ZodType<SyncReconcileResponseArtifactRegistry, unknown>;
-export declare function syncReconcileResponseArtifactRegistryFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseArtifactRegistry, SDKValidationError>;
+export declare const SyncReconcileResponseBasePlatformEnum$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseBasePlatformEnum>;
 /** @internal */
-export declare const SyncReconcileResponseArtifactRegistryUnion$inboundSchema: z.ZodType<SyncReconcileResponseArtifactRegistryUnion, unknown>;
-export declare function syncReconcileResponseArtifactRegistryUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseArtifactRegistryUnion, SDKValidationError>;
+export declare const SyncReconcileResponseBasePlatformUnion$inboundSchema: z.ZodType<SyncReconcileResponseBasePlatformUnion, unknown>;
+export declare function syncReconcileResponseBasePlatformUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseBasePlatformUnion, SDKValidationError>;
 /** @internal */
 export declare const SyncReconcileResponseClusters$inboundSchema: z.ZodType<SyncReconcileResponseClusters, unknown>;
 export declare function syncReconcileResponseClustersFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseClusters, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponseHorizonMachineImageAws$inboundSchema: z.ZodType<SyncReconcileResponseHorizonMachineImageAws, unknown>;
+export declare function syncReconcileResponseHorizonMachineImageAwsFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseHorizonMachineImageAws, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseHorizonMachineImageAwsUnion$inboundSchema: z.ZodType<SyncReconcileResponseHorizonMachineImageAwsUnion, unknown>;
+export declare function syncReconcileResponseHorizonMachineImageAwsUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseHorizonMachineImageAwsUnion, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseAzureImages$inboundSchema: z.ZodType<SyncReconcileResponseAzureImages, unknown>;
+export declare function syncReconcileResponseAzureImagesFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseAzureImages, SDKValidationError>;
+/** @internal */
+export declare const HorizonMachineImageAzureTarget$inboundSchema: z.ZodType<HorizonMachineImageAzureTarget, unknown>;
+export declare function horizonMachineImageAzureTargetFromJSON(jsonString: string): SafeParseResult<HorizonMachineImageAzureTarget, SDKValidationError>;
+/** @internal */
+export declare const HorizonMachineImageTargetAzureUnion$inboundSchema: z.ZodType<HorizonMachineImageTargetAzureUnion, unknown>;
+export declare function horizonMachineImageTargetAzureUnionFromJSON(jsonString: string): SafeParseResult<HorizonMachineImageTargetAzureUnion, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseBaseImage$inboundSchema: z.ZodType<SyncReconcileResponseBaseImage, unknown>;
+export declare function syncReconcileResponseBaseImageFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseBaseImage, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseGcpImages$inboundSchema: z.ZodType<SyncReconcileResponseGcpImages, unknown>;
+export declare function syncReconcileResponseGcpImagesFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseGcpImages, SDKValidationError>;
+/** @internal */
+export declare const HorizonMachineImageGcpTarget$inboundSchema: z.ZodType<HorizonMachineImageGcpTarget, unknown>;
+export declare function horizonMachineImageGcpTargetFromJSON(jsonString: string): SafeParseResult<HorizonMachineImageGcpTarget, SDKValidationError>;
+/** @internal */
+export declare const HorizonMachineImageTargetGcpUnion$inboundSchema: z.ZodType<HorizonMachineImageTargetGcpUnion, unknown>;
+export declare function horizonMachineImageTargetGcpUnionFromJSON(jsonString: string): SafeParseResult<HorizonMachineImageTargetGcpUnion, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseHorizonMachineImage$inboundSchema: z.ZodType<SyncReconcileResponseHorizonMachineImage, unknown>;
+export declare function syncReconcileResponseHorizonMachineImageFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseHorizonMachineImage, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseHorizonMachineImageUnion$inboundSchema: z.ZodType<SyncReconcileResponseHorizonMachineImageUnion, unknown>;
+export declare function syncReconcileResponseHorizonMachineImageUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseHorizonMachineImageUnion, SDKValidationError>;
+/** @internal */
 export declare const SyncReconcileResponseComputeBackendType$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseComputeBackendType>;
 /** @internal */
 export declare const SyncReconcileResponseComputeBackendHorizon$inboundSchema: z.ZodType<SyncReconcileResponseComputeBackendHorizon, unknown>;
@@ -6882,6 +8750,53 @@ export declare function syncReconcileResponseVariableFromJSON(jsonString: string
 export declare const SyncReconcileResponseEnvironmentVariables$inboundSchema: z.ZodType<SyncReconcileResponseEnvironmentVariables, unknown>;
 export declare function syncReconcileResponseEnvironmentVariablesFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseEnvironmentVariables, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponseDefaultDomainSecretRef$inboundSchema: z.ZodType<SyncReconcileResponseDefaultDomainSecretRef, unknown>;
+export declare function syncReconcileResponseDefaultDomainSecretRefFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseDefaultDomainSecretRef, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseDefaultDomain$inboundSchema: z.ZodType<SyncReconcileResponseDefaultDomain, unknown>;
+export declare function syncReconcileResponseDefaultDomainFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseDefaultDomain, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseDefaultDomainUnion$inboundSchema: z.ZodType<SyncReconcileResponseDefaultDomainUnion, unknown>;
+export declare function syncReconcileResponseDefaultDomainUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseDefaultDomainUnion, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseEnvironmentNameSecretRef$inboundSchema: z.ZodType<SyncReconcileResponseEnvironmentNameSecretRef, unknown>;
+export declare function syncReconcileResponseEnvironmentNameSecretRefFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseEnvironmentNameSecretRef, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseEnvironmentName$inboundSchema: z.ZodType<SyncReconcileResponseEnvironmentName, unknown>;
+export declare function syncReconcileResponseEnvironmentNameFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseEnvironmentName, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseEnvironmentNameUnion$inboundSchema: z.ZodType<SyncReconcileResponseEnvironmentNameUnion, unknown>;
+export declare function syncReconcileResponseEnvironmentNameUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseEnvironmentNameUnion, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseResourceGroupNameSecretRef3$inboundSchema: z.ZodType<SyncReconcileResponseResourceGroupNameSecretRef3, unknown>;
+export declare function syncReconcileResponseResourceGroupNameSecretRef3FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseResourceGroupNameSecretRef3, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseResourceGroupName3$inboundSchema: z.ZodType<SyncReconcileResponseResourceGroupName3, unknown>;
+export declare function syncReconcileResponseResourceGroupName3FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseResourceGroupName3, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseResourceGroupNameUnion3$inboundSchema: z.ZodType<SyncReconcileResponseResourceGroupNameUnion3, unknown>;
+export declare function syncReconcileResponseResourceGroupNameUnion3FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseResourceGroupNameUnion3, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseResourceIdSecretRef$inboundSchema: z.ZodType<SyncReconcileResponseResourceIdSecretRef, unknown>;
+export declare function syncReconcileResponseResourceIdSecretRefFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseResourceIdSecretRef, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseResourceId$inboundSchema: z.ZodType<SyncReconcileResponseResourceId, unknown>;
+export declare function syncReconcileResponseResourceIdFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseResourceId, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseResourceIdUnion$inboundSchema: z.ZodType<SyncReconcileResponseResourceIdUnion, unknown>;
+export declare function syncReconcileResponseResourceIdUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseResourceIdUnion, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseStaticIpSecretRef$inboundSchema: z.ZodType<SyncReconcileResponseStaticIpSecretRef, unknown>;
+export declare function syncReconcileResponseStaticIpSecretRefFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseStaticIpSecretRef, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseStaticIp$inboundSchema: z.ZodType<SyncReconcileResponseStaticIp, unknown>;
+export declare function syncReconcileResponseStaticIpFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseStaticIp, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseTypeContainerAppsEnvironment$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseTypeContainerAppsEnvironment>;
+/** @internal */
+export declare const SyncReconcileResponseExternalBindingsContainerAppsEnvironment$inboundSchema: z.ZodType<SyncReconcileResponseExternalBindingsContainerAppsEnvironment, unknown>;
+export declare function syncReconcileResponseExternalBindingsContainerAppsEnvironmentFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseExternalBindingsContainerAppsEnvironment, SDKValidationError>;
+/** @internal */
 export declare const SyncReconcileResponseDataDirSecretRef3$inboundSchema: z.ZodType<SyncReconcileResponseDataDirSecretRef3, unknown>;
 export declare function syncReconcileResponseDataDirSecretRef3FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseDataDirSecretRef3, SDKValidationError>;
 /** @internal */
@@ -6996,6 +8911,15 @@ export declare function syncReconcileResponsePushServiceAccountEmailSecretRefFro
 export declare const SyncReconcileResponsePushServiceAccountEmail$inboundSchema: z.ZodType<SyncReconcileResponsePushServiceAccountEmail, unknown>;
 export declare function syncReconcileResponsePushServiceAccountEmailFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponsePushServiceAccountEmail, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponseRepositoryNameSecretRef$inboundSchema: z.ZodType<SyncReconcileResponseRepositoryNameSecretRef, unknown>;
+export declare function syncReconcileResponseRepositoryNameSecretRefFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseRepositoryNameSecretRef, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseRepositoryName$inboundSchema: z.ZodType<SyncReconcileResponseRepositoryName, unknown>;
+export declare function syncReconcileResponseRepositoryNameFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseRepositoryName, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseRepositoryNameUnion$inboundSchema: z.ZodType<SyncReconcileResponseRepositoryNameUnion, unknown>;
+export declare function syncReconcileResponseRepositoryNameUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseRepositoryNameUnion, SDKValidationError>;
+/** @internal */
 export declare const SyncReconcileResponseTypeArtifactRegistry3$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseTypeArtifactRegistry3>;
 /** @internal */
 export declare const SyncReconcileResponseExternalBindingsGar$inboundSchema: z.ZodType<SyncReconcileResponseExternalBindingsGar, unknown>;
@@ -7010,6 +8934,12 @@ export declare function syncReconcileResponseRegistryNameFromJSON(jsonString: st
 export declare const SyncReconcileResponseRegistryNameUnion$inboundSchema: z.ZodType<SyncReconcileResponseRegistryNameUnion, unknown>;
 export declare function syncReconcileResponseRegistryNameUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseRegistryNameUnion, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponseRepositoryPrefixSecretRef2$inboundSchema: z.ZodType<SyncReconcileResponseRepositoryPrefixSecretRef2, unknown>;
+export declare function syncReconcileResponseRepositoryPrefixSecretRef2FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseRepositoryPrefixSecretRef2, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseRepositoryPrefix2$inboundSchema: z.ZodType<SyncReconcileResponseRepositoryPrefix2, unknown>;
+export declare function syncReconcileResponseRepositoryPrefix2FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseRepositoryPrefix2, SDKValidationError>;
+/** @internal */
 export declare const SyncReconcileResponseResourceGroupNameSecretRef2$inboundSchema: z.ZodType<SyncReconcileResponseResourceGroupNameSecretRef2, unknown>;
 export declare function syncReconcileResponseResourceGroupNameSecretRef2FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseResourceGroupNameSecretRef2, SDKValidationError>;
 /** @internal */
@@ -7036,11 +8966,11 @@ export declare function syncReconcileResponsePushRoleArnSecretRefFromJSON(jsonSt
 export declare const SyncReconcileResponsePushRoleArn$inboundSchema: z.ZodType<SyncReconcileResponsePushRoleArn, unknown>;
 export declare function syncReconcileResponsePushRoleArnFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponsePushRoleArn, SDKValidationError>;
 /** @internal */
-export declare const SyncReconcileResponseRepositoryPrefixSecretRef$inboundSchema: z.ZodType<SyncReconcileResponseRepositoryPrefixSecretRef, unknown>;
-export declare function syncReconcileResponseRepositoryPrefixSecretRefFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseRepositoryPrefixSecretRef, SDKValidationError>;
+export declare const SyncReconcileResponseRepositoryPrefixSecretRef1$inboundSchema: z.ZodType<SyncReconcileResponseRepositoryPrefixSecretRef1, unknown>;
+export declare function syncReconcileResponseRepositoryPrefixSecretRef1FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseRepositoryPrefixSecretRef1, SDKValidationError>;
 /** @internal */
-export declare const SyncReconcileResponseRepositoryPrefix$inboundSchema: z.ZodType<SyncReconcileResponseRepositoryPrefix, unknown>;
-export declare function syncReconcileResponseRepositoryPrefixFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseRepositoryPrefix, SDKValidationError>;
+export declare const SyncReconcileResponseRepositoryPrefix1$inboundSchema: z.ZodType<SyncReconcileResponseRepositoryPrefix1, unknown>;
+export declare function syncReconcileResponseRepositoryPrefix1FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseRepositoryPrefix1, SDKValidationError>;
 /** @internal */
 export declare const SyncReconcileResponseRepositoryPrefixUnion$inboundSchema: z.ZodType<SyncReconcileResponseRepositoryPrefixUnion, unknown>;
 export declare function syncReconcileResponseRepositoryPrefixUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseRepositoryPrefixUnion, SDKValidationError>;
@@ -7195,6 +9125,20 @@ export declare function syncReconcileResponseExternalBindingsDynamodbFromJSON(js
 export declare const SyncReconcileResponseExternalBindingsUnion3$inboundSchema: z.ZodType<SyncReconcileResponseExternalBindingsUnion3, unknown>;
 export declare function syncReconcileResponseExternalBindingsUnion3FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseExternalBindingsUnion3, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponseQueuePathSecretRef$inboundSchema: z.ZodType<SyncReconcileResponseQueuePathSecretRef, unknown>;
+export declare function syncReconcileResponseQueuePathSecretRefFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseQueuePathSecretRef, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseQueuePath$inboundSchema: z.ZodType<SyncReconcileResponseQueuePath, unknown>;
+export declare function syncReconcileResponseQueuePathFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseQueuePath, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseQueuePathUnion$inboundSchema: z.ZodType<SyncReconcileResponseQueuePathUnion, unknown>;
+export declare function syncReconcileResponseQueuePathUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseQueuePathUnion, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseTypeQueue4$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseTypeQueue4>;
+/** @internal */
+export declare const SyncReconcileResponseExternalBindingsLocalQueue$inboundSchema: z.ZodType<SyncReconcileResponseExternalBindingsLocalQueue, unknown>;
+export declare function syncReconcileResponseExternalBindingsLocalQueueFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseExternalBindingsLocalQueue, SDKValidationError>;
+/** @internal */
 export declare const SyncReconcileResponseNamespaceSecretRef1$inboundSchema: z.ZodType<SyncReconcileResponseNamespaceSecretRef1, unknown>;
 export declare function syncReconcileResponseNamespaceSecretRef1FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseNamespaceSecretRef1, SDKValidationError>;
 /** @internal */
@@ -7329,12 +9273,6 @@ export declare function syncReconcileResponseExternalBindingsUnion1FromJSON(json
 export declare const SyncReconcileResponseExternalBindingsUnion6$inboundSchema: z.ZodType<SyncReconcileResponseExternalBindingsUnion6, unknown>;
 export declare function syncReconcileResponseExternalBindingsUnion6FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseExternalBindingsUnion6, SDKValidationError>;
 /** @internal */
-export declare const SyncReconcileResponseImagePullCredentials$inboundSchema: z.ZodType<SyncReconcileResponseImagePullCredentials, unknown>;
-export declare function syncReconcileResponseImagePullCredentialsFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseImagePullCredentials, SDKValidationError>;
-/** @internal */
-export declare const SyncReconcileResponseImagePullCredentialsUnion$inboundSchema: z.ZodType<SyncReconcileResponseImagePullCredentialsUnion, unknown>;
-export declare function syncReconcileResponseImagePullCredentialsUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseImagePullCredentialsUnion, SDKValidationError>;
-/** @internal */
 export declare const TargetPlatformKubernetes$inboundSchema: z.ZodEnum<typeof TargetPlatformKubernetes>;
 /** @internal */
 export declare const SyncReconcileResponseManagementConfigKubernetes$inboundSchema: z.ZodType<SyncReconcileResponseManagementConfigKubernetes, unknown>;
@@ -7366,26 +9304,35 @@ export declare function syncReconcileResponseMonitoringUnionFromJSON(jsonString:
 /** @internal */
 export declare const SyncReconcileResponseDeploymentModel$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseDeploymentModel>;
 /** @internal */
-export declare const SyncReconcileResponseAws$inboundSchema: z.ZodType<SyncReconcileResponseAws, unknown>;
-export declare function syncReconcileResponseAwsFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseAws, SDKValidationError>;
+export declare const SyncReconcileResponseAwsStackSettings$inboundSchema: z.ZodType<SyncReconcileResponseAwsStackSettings, unknown>;
+export declare function syncReconcileResponseAwsStackSettingsFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseAwsStackSettings, SDKValidationError>;
 /** @internal */
-export declare const SyncReconcileResponseAwsUnion$inboundSchema: z.ZodType<SyncReconcileResponseAwsUnion, unknown>;
-export declare function syncReconcileResponseAwsUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseAwsUnion, SDKValidationError>;
+export declare const SyncReconcileResponseStackSettingsAwsUnion$inboundSchema: z.ZodType<SyncReconcileResponseStackSettingsAwsUnion, unknown>;
+export declare function syncReconcileResponseStackSettingsAwsUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseStackSettingsAwsUnion, SDKValidationError>;
 /** @internal */
-export declare const AzureTargetConfig$inboundSchema: z.ZodType<AzureTargetConfig, unknown>;
-export declare function azureTargetConfigFromJSON(jsonString: string): SafeParseResult<AzureTargetConfig, SDKValidationError>;
+export declare const AzureTargetStackSettings$inboundSchema: z.ZodType<AzureTargetStackSettings, unknown>;
+export declare function azureTargetStackSettingsFromJSON(jsonString: string): SafeParseResult<AzureTargetStackSettings, SDKValidationError>;
 /** @internal */
-export declare const TargetAzureUnion$inboundSchema: z.ZodType<TargetAzureUnion, unknown>;
-export declare function targetAzureUnionFromJSON(jsonString: string): SafeParseResult<TargetAzureUnion, SDKValidationError>;
+export declare const TargetStackSettingsAzureUnion$inboundSchema: z.ZodType<TargetStackSettingsAzureUnion, unknown>;
+export declare function targetStackSettingsAzureUnionFromJSON(jsonString: string): SafeParseResult<TargetStackSettingsAzureUnion, SDKValidationError>;
 /** @internal */
-export declare const GcpTargetConfig$inboundSchema: z.ZodType<GcpTargetConfig, unknown>;
-export declare function gcpTargetConfigFromJSON(jsonString: string): SafeParseResult<GcpTargetConfig, SDKValidationError>;
+export declare const GcpTargetStackSettings$inboundSchema: z.ZodType<GcpTargetStackSettings, unknown>;
+export declare function gcpTargetStackSettingsFromJSON(jsonString: string): SafeParseResult<GcpTargetStackSettings, SDKValidationError>;
 /** @internal */
-export declare const TargetGcpUnion$inboundSchema: z.ZodType<TargetGcpUnion, unknown>;
-export declare function targetGcpUnionFromJSON(jsonString: string): SafeParseResult<TargetGcpUnion, SDKValidationError>;
+export declare const TargetStackSettingsGcpUnion$inboundSchema: z.ZodType<TargetStackSettingsGcpUnion, unknown>;
+export declare function targetStackSettingsGcpUnionFromJSON(jsonString: string): SafeParseResult<TargetStackSettingsGcpUnion, SDKValidationError>;
 /** @internal */
-export declare const SyncReconcileResponseCertificate$inboundSchema: z.ZodType<SyncReconcileResponseCertificate, unknown>;
-export declare function syncReconcileResponseCertificateFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCertificate, SDKValidationError>;
+export declare const SyncReconcileResponseTlsSecretRef$inboundSchema: z.ZodType<SyncReconcileResponseTlsSecretRef, unknown>;
+export declare function syncReconcileResponseTlsSecretRefFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseTlsSecretRef, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseDomainsKubernetes$inboundSchema: z.ZodType<SyncReconcileResponseDomainsKubernetes, unknown>;
+export declare function syncReconcileResponseDomainsKubernetesFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseDomainsKubernetes, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseDomainsKubernetesUnion$inboundSchema: z.ZodType<SyncReconcileResponseDomainsKubernetesUnion, unknown>;
+export declare function syncReconcileResponseDomainsKubernetesUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseDomainsKubernetesUnion, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseDomainsCertificate$inboundSchema: z.ZodType<SyncReconcileResponseDomainsCertificate, unknown>;
+export declare function syncReconcileResponseDomainsCertificateFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseDomainsCertificate, SDKValidationError>;
 /** @internal */
 export declare const SyncReconcileResponseCustomDomains$inboundSchema: z.ZodType<SyncReconcileResponseCustomDomains, unknown>;
 export declare function syncReconcileResponseCustomDomainsFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCustomDomains, SDKValidationError>;
@@ -7396,8 +9343,175 @@ export declare function syncReconcileResponseDomainsFromJSON(jsonString: string)
 export declare const SyncReconcileResponseDomainsUnion$inboundSchema: z.ZodType<SyncReconcileResponseDomainsUnion, unknown>;
 export declare function syncReconcileResponseDomainsUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseDomainsUnion, SDKValidationError>;
 /** @internal */
+export declare const SyncReconcileResponseStackSettingsExternalBindings$inboundSchema: z.ZodType<SyncReconcileResponseStackSettingsExternalBindings, unknown>;
+export declare function syncReconcileResponseStackSettingsExternalBindingsFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseStackSettingsExternalBindings, SDKValidationError>;
+/** @internal */
 export declare const SyncReconcileResponseHeartbeats$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseHeartbeats>;
 /** @internal */
+export declare const SyncReconcileResponseCloud$inboundSchema: z.ZodType<SyncReconcileResponseCloud, unknown>;
+export declare function syncReconcileResponseCloudFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCloud, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseCloudUnion$inboundSchema: z.ZodType<SyncReconcileResponseCloudUnion, unknown>;
+export declare function syncReconcileResponseCloudUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCloudUnion, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseOwnership$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseOwnership>;
+/** @internal */
+export declare const SyncReconcileResponseCluster$inboundSchema: z.ZodType<SyncReconcileResponseCluster, unknown>;
+export declare function syncReconcileResponseClusterFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCluster, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseClusterUnion$inboundSchema: z.ZodType<SyncReconcileResponseClusterUnion, unknown>;
+export declare function syncReconcileResponseClusterUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseClusterUnion, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseCertificateNone2$inboundSchema: z.ZodType<SyncReconcileResponseCertificateNone2, unknown>;
+export declare function syncReconcileResponseCertificateNone2FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCertificateNone2, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseCertificateManagedTLSSecret2$inboundSchema: z.ZodType<SyncReconcileResponseCertificateManagedTLSSecret2, unknown>;
+export declare function syncReconcileResponseCertificateManagedTLSSecret2FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCertificateManagedTLSSecret2, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseCertificateAwsAcmArn2$inboundSchema: z.ZodType<SyncReconcileResponseCertificateAwsAcmArn2, unknown>;
+export declare function syncReconcileResponseCertificateAwsAcmArn2FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCertificateAwsAcmArn2, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseCertificateManagedAcmImport2$inboundSchema: z.ZodType<SyncReconcileResponseCertificateManagedAcmImport2, unknown>;
+export declare function syncReconcileResponseCertificateManagedAcmImport2FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCertificateManagedAcmImport2, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseCertificateTLSSecretRef2$inboundSchema: z.ZodType<SyncReconcileResponseCertificateTLSSecretRef2, unknown>;
+export declare function syncReconcileResponseCertificateTLSSecretRef2FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCertificateTLSSecretRef2, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseCertificateUnion2$inboundSchema: z.ZodType<SyncReconcileResponseCertificateUnion2, unknown>;
+export declare function syncReconcileResponseCertificateUnion2FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCertificateUnion2, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseModeCustom$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseModeCustom>;
+/** @internal */
+export declare const SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum4$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum4>;
+/** @internal */
+export declare const SyncReconcileResponseProviderAzureApplicationGatewayForContainers4$inboundSchema: z.ZodType<SyncReconcileResponseProviderAzureApplicationGatewayForContainers4, unknown>;
+export declare function syncReconcileResponseProviderAzureApplicationGatewayForContainers4FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseProviderAzureApplicationGatewayForContainers4, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseProviderGkeGatewayEnum4$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseProviderGkeGatewayEnum4>;
+/** @internal */
+export declare const SyncReconcileResponseProviderGkeGateway4$inboundSchema: z.ZodType<SyncReconcileResponseProviderGkeGateway4, unknown>;
+export declare function syncReconcileResponseProviderGkeGateway4FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseProviderGkeGateway4, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseProviderAwsAlbEnum4$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseProviderAwsAlbEnum4>;
+/** @internal */
+export declare const SyncReconcileResponseProviderAwsAlb4$inboundSchema: z.ZodType<SyncReconcileResponseProviderAwsAlb4, unknown>;
+export declare function syncReconcileResponseProviderAwsAlb4FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseProviderAwsAlb4, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseProviderUnion4$inboundSchema: z.ZodType<SyncReconcileResponseProviderUnion4, unknown>;
+export declare function syncReconcileResponseProviderUnion4FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseProviderUnion4, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseRouteGateway2$inboundSchema: z.ZodType<SyncReconcileResponseRouteGateway2, unknown>;
+export declare function syncReconcileResponseRouteGateway2FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseRouteGateway2, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum3$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum3>;
+/** @internal */
+export declare const SyncReconcileResponseProviderAzureApplicationGatewayForContainers3$inboundSchema: z.ZodType<SyncReconcileResponseProviderAzureApplicationGatewayForContainers3, unknown>;
+export declare function syncReconcileResponseProviderAzureApplicationGatewayForContainers3FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseProviderAzureApplicationGatewayForContainers3, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseProviderGkeGatewayEnum3$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseProviderGkeGatewayEnum3>;
+/** @internal */
+export declare const SyncReconcileResponseProviderGkeGateway3$inboundSchema: z.ZodType<SyncReconcileResponseProviderGkeGateway3, unknown>;
+export declare function syncReconcileResponseProviderGkeGateway3FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseProviderGkeGateway3, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseProviderAwsAlbEnum3$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseProviderAwsAlbEnum3>;
+/** @internal */
+export declare const SyncReconcileResponseProviderAwsAlb3$inboundSchema: z.ZodType<SyncReconcileResponseProviderAwsAlb3, unknown>;
+export declare function syncReconcileResponseProviderAwsAlb3FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseProviderAwsAlb3, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseProviderUnion3$inboundSchema: z.ZodType<SyncReconcileResponseProviderUnion3, unknown>;
+export declare function syncReconcileResponseProviderUnion3FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseProviderUnion3, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseRouteIngress2$inboundSchema: z.ZodType<SyncReconcileResponseRouteIngress2, unknown>;
+export declare function syncReconcileResponseRouteIngress2FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseRouteIngress2, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseRouteUnion2$inboundSchema: z.ZodType<SyncReconcileResponseRouteUnion2, unknown>;
+export declare function syncReconcileResponseRouteUnion2FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseRouteUnion2, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseExposureCustom$inboundSchema: z.ZodType<SyncReconcileResponseExposureCustom, unknown>;
+export declare function syncReconcileResponseExposureCustomFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseExposureCustom, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseCertificateNone1$inboundSchema: z.ZodType<SyncReconcileResponseCertificateNone1, unknown>;
+export declare function syncReconcileResponseCertificateNone1FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCertificateNone1, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseCertificateManagedTLSSecret1$inboundSchema: z.ZodType<SyncReconcileResponseCertificateManagedTLSSecret1, unknown>;
+export declare function syncReconcileResponseCertificateManagedTLSSecret1FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCertificateManagedTLSSecret1, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseCertificateAwsAcmArn1$inboundSchema: z.ZodType<SyncReconcileResponseCertificateAwsAcmArn1, unknown>;
+export declare function syncReconcileResponseCertificateAwsAcmArn1FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCertificateAwsAcmArn1, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseCertificateManagedAcmImport1$inboundSchema: z.ZodType<SyncReconcileResponseCertificateManagedAcmImport1, unknown>;
+export declare function syncReconcileResponseCertificateManagedAcmImport1FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCertificateManagedAcmImport1, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseCertificateTLSSecretRef1$inboundSchema: z.ZodType<SyncReconcileResponseCertificateTLSSecretRef1, unknown>;
+export declare function syncReconcileResponseCertificateTLSSecretRef1FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCertificateTLSSecretRef1, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseCertificateUnion1$inboundSchema: z.ZodType<SyncReconcileResponseCertificateUnion1, unknown>;
+export declare function syncReconcileResponseCertificateUnion1FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseCertificateUnion1, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseModeGenerated$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseModeGenerated>;
+/** @internal */
+export declare const SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum2$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum2>;
+/** @internal */
+export declare const SyncReconcileResponseProviderAzureApplicationGatewayForContainers2$inboundSchema: z.ZodType<SyncReconcileResponseProviderAzureApplicationGatewayForContainers2, unknown>;
+export declare function syncReconcileResponseProviderAzureApplicationGatewayForContainers2FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseProviderAzureApplicationGatewayForContainers2, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseProviderGkeGatewayEnum2$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseProviderGkeGatewayEnum2>;
+/** @internal */
+export declare const SyncReconcileResponseProviderGkeGateway2$inboundSchema: z.ZodType<SyncReconcileResponseProviderGkeGateway2, unknown>;
+export declare function syncReconcileResponseProviderGkeGateway2FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseProviderGkeGateway2, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseProviderAwsAlbEnum2$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseProviderAwsAlbEnum2>;
+/** @internal */
+export declare const SyncReconcileResponseProviderAwsAlb2$inboundSchema: z.ZodType<SyncReconcileResponseProviderAwsAlb2, unknown>;
+export declare function syncReconcileResponseProviderAwsAlb2FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseProviderAwsAlb2, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseProviderUnion2$inboundSchema: z.ZodType<SyncReconcileResponseProviderUnion2, unknown>;
+export declare function syncReconcileResponseProviderUnion2FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseProviderUnion2, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseRouteGateway1$inboundSchema: z.ZodType<SyncReconcileResponseRouteGateway1, unknown>;
+export declare function syncReconcileResponseRouteGateway1FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseRouteGateway1, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum1$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseProviderAzureApplicationGatewayForContainersEnum1>;
+/** @internal */
+export declare const SyncReconcileResponseProviderAzureApplicationGatewayForContainers1$inboundSchema: z.ZodType<SyncReconcileResponseProviderAzureApplicationGatewayForContainers1, unknown>;
+export declare function syncReconcileResponseProviderAzureApplicationGatewayForContainers1FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseProviderAzureApplicationGatewayForContainers1, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseProviderGkeGatewayEnum1$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseProviderGkeGatewayEnum1>;
+/** @internal */
+export declare const SyncReconcileResponseProviderGkeGateway1$inboundSchema: z.ZodType<SyncReconcileResponseProviderGkeGateway1, unknown>;
+export declare function syncReconcileResponseProviderGkeGateway1FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseProviderGkeGateway1, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseProviderAwsAlbEnum1$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseProviderAwsAlbEnum1>;
+/** @internal */
+export declare const SyncReconcileResponseProviderAwsAlb1$inboundSchema: z.ZodType<SyncReconcileResponseProviderAwsAlb1, unknown>;
+export declare function syncReconcileResponseProviderAwsAlb1FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseProviderAwsAlb1, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseProviderUnion1$inboundSchema: z.ZodType<SyncReconcileResponseProviderUnion1, unknown>;
+export declare function syncReconcileResponseProviderUnion1FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseProviderUnion1, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseRouteIngress1$inboundSchema: z.ZodType<SyncReconcileResponseRouteIngress1, unknown>;
+export declare function syncReconcileResponseRouteIngress1FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseRouteIngress1, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseRouteUnion1$inboundSchema: z.ZodType<SyncReconcileResponseRouteUnion1, unknown>;
+export declare function syncReconcileResponseRouteUnion1FromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseRouteUnion1, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseExposureGenerated$inboundSchema: z.ZodType<SyncReconcileResponseExposureGenerated, unknown>;
+export declare function syncReconcileResponseExposureGeneratedFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseExposureGenerated, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseModeDisabled$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseModeDisabled>;
+/** @internal */
+export declare const SyncReconcileResponseExposureDisabled$inboundSchema: z.ZodType<SyncReconcileResponseExposureDisabled, unknown>;
+export declare function syncReconcileResponseExposureDisabledFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseExposureDisabled, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseExposureUnion$inboundSchema: z.ZodType<SyncReconcileResponseExposureUnion, unknown>;
+export declare function syncReconcileResponseExposureUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseExposureUnion, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseKubernetes$inboundSchema: z.ZodType<SyncReconcileResponseKubernetes, unknown>;
+export declare function syncReconcileResponseKubernetesFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseKubernetes, SDKValidationError>;
+/** @internal */
+export declare const SyncReconcileResponseKubernetesUnion$inboundSchema: z.ZodType<SyncReconcileResponseKubernetesUnion, unknown>;
+export declare function syncReconcileResponseKubernetesUnionFromJSON(jsonString: string): SafeParseResult<SyncReconcileResponseKubernetesUnion, SDKValidationError>;
+/** @internal */
 export declare const SyncReconcileResponseTypeByoVnetAzure$inboundSchema: z.ZodEnum<typeof SyncReconcileResponseTypeByoVnetAzure>;
 /** @internal */
 export declare const SyncReconcileResponseNetworkByoVnetAzure$inboundSchema: z.ZodType<SyncReconcileResponseNetworkByoVnetAzure, unknown>;
@@ -7447,6 +9561,8 @@ export declare function overrideReleaseInfoAwStackFromJSON(jsonString: string):
 export declare const OverrideReleaseInfoAwBinding$inboundSchema: z.ZodType<OverrideReleaseInfoAwBinding, unknown>;
 export declare function overrideReleaseInfoAwBindingFromJSON(jsonString: string): SafeParseResult<OverrideReleaseInfoAwBinding, SDKValidationError>;
 /** @internal */
+export declare const OverrideReleaseInfoEffect$inboundSchema: z.ZodEnum<typeof OverrideReleaseInfoEffect>;
+/** @internal */
 export declare const OverrideReleaseInfoAwGrant$inboundSchema: z.ZodType<OverrideReleaseInfoAwGrant, unknown>;
 export declare function overrideReleaseInfoAwGrantFromJSON(jsonString: string): SafeParseResult<OverrideReleaseInfoAwGrant, SDKValidationError>;
 /** @internal */
@@ -7516,6 +9632,8 @@ export declare function extendReleaseInfoAwStackFromJSON(jsonString: string): Sa
 export declare const ExtendReleaseInfoAwBinding$inboundSchema: z.ZodType<ExtendReleaseInfoAwBinding, unknown>;
 export declare function extendReleaseInfoAwBindingFromJSON(jsonString: string): SafeParseResult<ExtendReleaseInfoAwBinding, SDKValidationError>;
 /** @internal */
+export declare const ExtendReleaseInfoEffect$inboundSchema: z.ZodEnum<typeof ExtendReleaseInfoEffect>;
+/** @internal */
 export declare const ExtendReleaseInfoAwGrant$inboundSchema: z.ZodType<ExtendReleaseInfoAwGrant, unknown>;
 export declare function extendReleaseInfoAwGrantFromJSON(jsonString: string): SafeParseResult<ExtendReleaseInfoAwGrant, SDKValidationError>;
 /** @internal */
@@ -7588,6 +9706,8 @@ export declare function profileReleaseInfoAwStackFromJSON(jsonString: string): S
 export declare const ProfileReleaseInfoAwBinding$inboundSchema: z.ZodType<ProfileReleaseInfoAwBinding, unknown>;
 export declare function profileReleaseInfoAwBindingFromJSON(jsonString: string): SafeParseResult<ProfileReleaseInfoAwBinding, SDKValidationError>;
 /** @internal */
+export declare const ProfileReleaseInfoEffect$inboundSchema: z.ZodEnum<typeof ProfileReleaseInfoEffect>;
+/** @internal */
 export declare const ProfileReleaseInfoAwGrant$inboundSchema: z.ZodType<ProfileReleaseInfoAwGrant, unknown>;
 export declare function profileReleaseInfoAwGrantFromJSON(jsonString: string): SafeParseResult<ProfileReleaseInfoAwGrant, SDKValidationError>;
 /** @internal */
@@ -7659,6 +9779,8 @@ export declare const ReleaseInfoLifecycle$inboundSchema: z.ZodEnum<typeof Releas
 export declare const ReleaseInfoResources$inboundSchema: z.ZodType<ReleaseInfoResources, unknown>;
 export declare function releaseInfoResourcesFromJSON(jsonString: string): SafeParseResult<ReleaseInfoResources, SDKValidationError>;
 /** @internal */
+export declare const ReleaseInfoSupportedPlatform$inboundSchema: z.ZodEnum<typeof ReleaseInfoSupportedPlatform>;
+/** @internal */
 export declare const ReleaseInfoStack$inboundSchema: z.ZodType<ReleaseInfoStack, unknown>;
 export declare function releaseInfoStackFromJSON(jsonString: string): SafeParseResult<ReleaseInfoStack, SDKValidationError>;
 /** @internal */