@alienplatform/platform-api 3.3.30 → 3.3.31

package/src/models/synclistresponse.ts

@@ -51,168 +51,23 @@ import {
 import {
   SyncListResponsePendingPreparedStackUnion,
   SyncListResponsePendingPreparedStackUnion$inboundSchema,
-  SyncListResponsePreparedStackExtendAw,
-  SyncListResponsePreparedStackExtendAw$inboundSchema,
-  SyncListResponsePreparedStackExtendAzure,
-  SyncListResponsePreparedStackExtendAzure$inboundSchema,
-  SyncListResponsePreparedStackExtendConditionStack,
-  SyncListResponsePreparedStackExtendConditionStack$inboundSchema,
-  SyncListResponsePreparedStackExtendGcpResource,
-  SyncListResponsePreparedStackExtendGcpResource$inboundSchema,
   SyncListResponsePreparedStackInput,
   SyncListResponsePreparedStackInput$inboundSchema,
-  SyncListResponsePreparedStackManagement2,
-  SyncListResponsePreparedStackManagement2$inboundSchema,
-  SyncListResponsePreparedStackManagementEnum,
-  SyncListResponsePreparedStackManagementEnum$inboundSchema,
-} from "./synclistresponsepreparedstackextendconditionstack.js";
-
-export type SyncListResponsePreparedStackExtendStackConditionUnion =
-  | SyncListResponsePreparedStackExtendConditionStack
-  | string;
-
-/**
- * GCP-specific binding specification
- */
-export type SyncListResponsePreparedStackExtendGcpStack = {
-  condition?:
-    | SyncListResponsePreparedStackExtendConditionStack
-    | string
-    | null
-    | undefined;
-  /**
-   * Scope (project/resource level)
-   */
-  scope: string;
-};
-
-/**
- * Generic binding configuration for permissions
- */
-export type SyncListResponsePreparedStackExtendGcpBinding = {
-  /**
-   * GCP-specific binding specification
-   */
-  resource?: SyncListResponsePreparedStackExtendGcpResource | undefined;
-  /**
-   * GCP-specific binding specification
-   */
-  stack?: SyncListResponsePreparedStackExtendGcpStack | undefined;
-};
-
-/**
- * Grant permissions for a specific cloud platform
- */
-export type SyncListResponsePreparedStackExtendGcpGrant = {
-  /**
-   * AWS IAM actions (only for AWS)
-   */
-  actions?: Array<string> | null | undefined;
-  /**
-   * Azure actions (only for Azure)
-   */
-  dataActions?: Array<string> | null | undefined;
-  /**
-   * GCP permissions that require an exact residual custom role.
-   */
-  permissions?: Array<string> | null | undefined;
-  /**
-   * Provider predefined roles to bind directly.
-   */
-  predefinedRoles?: Array<string> | null | undefined;
-  /**
-   * GCP residual custom permissions to pair with predefined roles.
-   */
-  residualPermissions?: Array<string> | null | undefined;
-};
-
-/**
- * GCP-specific platform permission configuration
- */
-export type SyncListResponsePreparedStackExtendGcp = {
-  /**
-   * Generic binding configuration for permissions
-   */
-  binding: SyncListResponsePreparedStackExtendGcpBinding;
-  /**
-   * Short admin-facing description of why this entry exists.
-   */
-  description?: string | null | undefined;
-  /**
-   * Grant permissions for a specific cloud platform
-   */
-  grant: SyncListResponsePreparedStackExtendGcpGrant;
-  /**
-   * Stable admin-facing label for this permission entry.
-   */
-  label?: string | null | undefined;
-};
-
-/**
- * Platform-specific permission configurations
- */
-export type SyncListResponsePreparedStackExtendPlatforms = {
-  /**
-   * AWS permission configurations
-   */
-  aws?: Array<SyncListResponsePreparedStackExtendAw> | null | undefined;
-  /**
-   * Azure permission configurations
-   */
-  azure?: Array<SyncListResponsePreparedStackExtendAzure> | null | undefined;
-  /**
-   * GCP permission configurations
-   */
-  gcp?: Array<SyncListResponsePreparedStackExtendGcp> | null | undefined;
-};
-
-/**
- * A permission set that can be applied across different cloud platforms
- */
-export type SyncListResponsePreparedStackExtend = {
-  /**
-   * Human-readable description of what this permission set allows
-   */
-  description: string;
-  /**
-   * Unique identifier for the permission set (e.g., "storage/data-read")
-   */
-  id: string;
-  /**
-   * Platform-specific permission configurations
-   */
-  platforms: SyncListResponsePreparedStackExtendPlatforms;
-};
-
-/**
- * Reference to a permission set - either by name or inline definition
- */
-export type SyncListResponsePreparedStackExtendUnion =
-  | SyncListResponsePreparedStackExtend
-  | string;
-
-export type SyncListResponsePreparedStackManagement1 = {
-  /**
-   * Permission profile that maps resources to permission sets
-   *
-   * @remarks
-   * Key can be "*" for all resources or resource name for specific resource
-   */
-  extend: { [k: string]: Array<SyncListResponsePreparedStackExtend | string> };
-};
+  SyncListResponsePreparedStackOperationsUnion,
+  SyncListResponsePreparedStackOperationsUnion$inboundSchema,
+} from "./synclistresponsepreparedstackoperationsunion.js";
 
-/**
- * Management permissions configuration for stack management access
- */
-export type SyncListResponsePreparedStackManagementUnion =
-  | SyncListResponsePreparedStackManagement1
-  | SyncListResponsePreparedStackManagement2
-  | SyncListResponsePreparedStackManagementEnum;
+export const SyncListResponsePreparedStackManagementEnum = {
+  Auto: "auto",
+} as const;
+export type SyncListResponsePreparedStackManagementEnum = ClosedEnum<
+  typeof SyncListResponsePreparedStackManagementEnum
+>;
 
 /**
  * AWS-specific binding specification
  */
-export type SyncListResponsePreparedStackProfileAwResource = {
+export type SyncListResponsePreparedStackOverrideAwResource = {
   /**
    * Optional condition for additional filtering (rare)
    */
@@ -234,7 +89,7 @@ export type SyncListResponsePreparedStackProfileAwResource = {
 /**
  * AWS-specific binding specification
  */
-export type SyncListResponsePreparedStackProfileAwStack = {
+export type SyncListResponsePreparedStackOverrideAwStack = {
   /**
    * Optional condition for additional filtering (rare)
    */
@@ -256,35 +111,35 @@ export type SyncListResponsePreparedStackProfileAwStack = {
 /**
  * Generic binding configuration for permissions
  */
-export type SyncListResponsePreparedStackProfileAwBinding = {
+export type SyncListResponsePreparedStackOverrideAwBinding = {
   /**
    * AWS-specific binding specification
    */
-  resource?: SyncListResponsePreparedStackProfileAwResource | undefined;
+  resource?: SyncListResponsePreparedStackOverrideAwResource | undefined;
   /**
    * AWS-specific binding specification
    */
-  stack?: SyncListResponsePreparedStackProfileAwStack | undefined;
+  stack?: SyncListResponsePreparedStackOverrideAwStack | undefined;
 };
 
 /**
  * IAM effect. Defaults to Allow.
  */
-export const SyncListResponsePreparedStackProfileEffect = {
+export const SyncListResponsePreparedStackOverrideEffect = {
   Allow: "Allow",
   Deny: "Deny",
 } as const;
 /**
  * IAM effect. Defaults to Allow.
  */
-export type SyncListResponsePreparedStackProfileEffect = ClosedEnum<
-  typeof SyncListResponsePreparedStackProfileEffect
+export type SyncListResponsePreparedStackOverrideEffect = ClosedEnum<
+  typeof SyncListResponsePreparedStackOverrideEffect
 >;
 
 /**
  * Grant permissions for a specific cloud platform
  */
-export type SyncListResponsePreparedStackProfileAwGrant = {
+export type SyncListResponsePreparedStackOverrideAwGrant = {
   /**
    * AWS IAM actions (only for AWS)
    */
@@ -310,11 +165,11 @@ export type SyncListResponsePreparedStackProfileAwGrant = {
 /**
  * AWS-specific platform permission configuration
  */
-export type SyncListResponsePreparedStackProfileAw = {
+export type SyncListResponsePreparedStackOverrideAw = {
   /**
    * Generic binding configuration for permissions
    */
-  binding: SyncListResponsePreparedStackProfileAwBinding;
+  binding: SyncListResponsePreparedStackOverrideAwBinding;
   /**
    * Short admin-facing description of why this entry exists.
    */
@@ -322,11 +177,11 @@ export type SyncListResponsePreparedStackProfileAw = {
   /**
    * IAM effect. Defaults to Allow.
    */
-  effect?: SyncListResponsePreparedStackProfileEffect | undefined;
+  effect?: SyncListResponsePreparedStackOverrideEffect | undefined;
   /**
    * Grant permissions for a specific cloud platform
    */
-  grant: SyncListResponsePreparedStackProfileAwGrant;
+  grant: SyncListResponsePreparedStackOverrideAwGrant;
   /**
    * Stable admin-facing label for this permission entry.
    */
@@ -336,7 +191,7 @@ export type SyncListResponsePreparedStackProfileAw = {
 /**
  * Azure-specific binding specification
  */
-export type SyncListResponsePreparedStackProfileAzureResource = {
+export type SyncListResponsePreparedStackOverrideAzureResource = {
   /**
    * Scope (subscription/resource group/resource level)
    */
@@ -346,7 +201,7 @@ export type SyncListResponsePreparedStackProfileAzureResource = {
 /**
  * Azure-specific binding specification
  */
-export type SyncListResponsePreparedStackProfileAzureStack = {
+export type SyncListResponsePreparedStackOverrideAzureStack = {
   /**
    * Scope (subscription/resource group/resource level)
    */
@@ -356,21 +211,21 @@ export type SyncListResponsePreparedStackProfileAzureStack = {
 /**
  * Generic binding configuration for permissions
  */
-export type SyncListResponsePreparedStackProfileAzureBinding = {
+export type SyncListResponsePreparedStackOverrideAzureBinding = {
   /**
    * Azure-specific binding specification
    */
-  resource?: SyncListResponsePreparedStackProfileAzureResource | undefined;
+  resource?: SyncListResponsePreparedStackOverrideAzureResource | undefined;
   /**
    * Azure-specific binding specification
    */
-  stack?: SyncListResponsePreparedStackProfileAzureStack | undefined;
+  stack?: SyncListResponsePreparedStackOverrideAzureStack | undefined;
 };
 
 /**
  * Grant permissions for a specific cloud platform
  */
-export type SyncListResponsePreparedStackProfileAzureGrant = {
+export type SyncListResponsePreparedStackOverrideAzureGrant = {
   /**
    * AWS IAM actions (only for AWS)
    */
@@ -396,11 +251,11 @@ export type SyncListResponsePreparedStackProfileAzureGrant = {
 /**
  * Azure-specific platform permission configuration
  */
-export type SyncListResponsePreparedStackProfileAzure = {
+export type SyncListResponsePreparedStackOverrideAzure = {
   /**
    * Generic binding configuration for permissions
    */
-  binding: SyncListResponsePreparedStackProfileAzureBinding;
+  binding: SyncListResponsePreparedStackOverrideAzureBinding;
   /**
    * Short admin-facing description of why this entry exists.
    */
@@ -408,7 +263,7 @@ export type SyncListResponsePreparedStackProfileAzure = {
   /**
    * Grant permissions for a specific cloud platform
    */
-  grant: SyncListResponsePreparedStackProfileAzureGrant;
+  grant: SyncListResponsePreparedStackOverrideAzureGrant;
   /**
    * Stable admin-facing label for this permission entry.
    */
@@ -418,21 +273,21 @@ export type SyncListResponsePreparedStackProfileAzure = {
 /**
  * GCP IAM condition
  */
-export type SyncListResponsePreparedStackProfileConditionResource = {
+export type SyncListResponsePreparedStackOverrideConditionResource = {
   expression: string;
   title: string;
 };
 
-export type SyncListResponsePreparedStackProfileResourceConditionUnion =
-  | SyncListResponsePreparedStackProfileConditionResource
+export type SyncListResponsePreparedStackOverrideResourceConditionUnion =
+  | SyncListResponsePreparedStackOverrideConditionResource
   | string;
 
 /**
  * GCP-specific binding specification
  */
-export type SyncListResponsePreparedStackProfileGcpResource = {
+export type SyncListResponsePreparedStackOverrideGcpResource = {
   condition?:
-    | SyncListResponsePreparedStackProfileConditionResource
+    | SyncListResponsePreparedStackOverrideConditionResource
     | string
     | null
     | undefined;
@@ -445,21 +300,21 @@ export type SyncListResponsePreparedStackProfileGcpResource = {
 /**
  * GCP IAM condition
  */
-export type SyncListResponsePreparedStackProfileConditionStack = {
+export type SyncListResponsePreparedStackOverrideConditionStack = {
   expression: string;
   title: string;
 };
 
-export type SyncListResponsePreparedStackProfileStackConditionUnion =
-  | SyncListResponsePreparedStackProfileConditionStack
+export type SyncListResponsePreparedStackOverrideStackConditionUnion =
+  | SyncListResponsePreparedStackOverrideConditionStack
   | string;
 
 /**
  * GCP-specific binding specification
  */
-export type SyncListResponsePreparedStackProfileGcpStack = {
+export type SyncListResponsePreparedStackOverrideGcpStack = {
   condition?:
-    | SyncListResponsePreparedStackProfileConditionStack
+    | SyncListResponsePreparedStackOverrideConditionStack
     | string
     | null
     | undefined;
@@ -472,21 +327,21 @@ export type SyncListResponsePreparedStackProfileGcpStack = {
 /**
  * Generic binding configuration for permissions
  */
-export type SyncListResponsePreparedStackProfileGcpBinding = {
+export type SyncListResponsePreparedStackOverrideGcpBinding = {
   /**
    * GCP-specific binding specification
    */
-  resource?: SyncListResponsePreparedStackProfileGcpResource | undefined;
+  resource?: SyncListResponsePreparedStackOverrideGcpResource | undefined;
   /**
    * GCP-specific binding specification
    */
-  stack?: SyncListResponsePreparedStackProfileGcpStack | undefined;
+  stack?: SyncListResponsePreparedStackOverrideGcpStack | undefined;
 };
 
 /**
  * Grant permissions for a specific cloud platform
  */
-export type SyncListResponsePreparedStackProfileGcpGrant = {
+export type SyncListResponsePreparedStackOverrideGcpGrant = {
   /**
    * AWS IAM actions (only for AWS)
    */
@@ -512,11 +367,11 @@ export type SyncListResponsePreparedStackProfileGcpGrant = {
 /**
  * GCP-specific platform permission configuration
  */
-export type SyncListResponsePreparedStackProfileGcp = {
+export type SyncListResponsePreparedStackOverrideGcp = {
   /**
    * Generic binding configuration for permissions
    */
-  binding: SyncListResponsePreparedStackProfileGcpBinding;
+  binding: SyncListResponsePreparedStackOverrideGcpBinding;
   /**
    * Short admin-facing description of why this entry exists.
    */
@@ -524,7 +379,7 @@ export type SyncListResponsePreparedStackProfileGcp = {
   /**
    * Grant permissions for a specific cloud platform
    */
-  grant: SyncListResponsePreparedStackProfileGcpGrant;
+  grant: SyncListResponsePreparedStackOverrideGcpGrant;
   /**
    * Stable admin-facing label for this permission entry.
    */
@@ -534,25 +389,25 @@ export type SyncListResponsePreparedStackProfileGcp = {
 /**
  * Platform-specific permission configurations
  */
-export type SyncListResponsePreparedStackProfilePlatforms = {
+export type SyncListResponsePreparedStackOverridePlatforms = {
   /**
    * AWS permission configurations
    */
-  aws?: Array<SyncListResponsePreparedStackProfileAw> | null | undefined;
+  aws?: Array<SyncListResponsePreparedStackOverrideAw> | null | undefined;
   /**
    * Azure permission configurations
    */
-  azure?: Array<SyncListResponsePreparedStackProfileAzure> | null | undefined;
+  azure?: Array<SyncListResponsePreparedStackOverrideAzure> | null | undefined;
   /**
    * GCP permission configurations
    */
-  gcp?: Array<SyncListResponsePreparedStackProfileGcp> | null | undefined;
+  gcp?: Array<SyncListResponsePreparedStackOverrideGcp> | null | undefined;
 };
 
 /**
  * A permission set that can be applied across different cloud platforms
  */
-export type SyncListResponsePreparedStackProfile = {
+export type SyncListResponsePreparedStackOverride = {
   /**
    * Human-readable description of what this permission set allows
    */
@@ -564,782 +419,2552 @@ export type SyncListResponsePreparedStackProfile = {
   /**
    * Platform-specific permission configurations
    */
-  platforms: SyncListResponsePreparedStackProfilePlatforms;
+  platforms: SyncListResponsePreparedStackOverridePlatforms;
 };
 
 /**
  * Reference to a permission set - either by name or inline definition
  */
-export type SyncListResponsePreparedStackProfileUnion =
-  | SyncListResponsePreparedStackProfile
+export type SyncListResponsePreparedStackOverrideUnion =
+  | SyncListResponsePreparedStackOverride
   | string;
 
-/**
- * Combined permissions configuration that contains both profiles and management
- */
-export type SyncListResponsePreparedStackPermissions = {
-  /**
-   * Management permissions configuration for stack management access
-   */
-  management?:
-    | SyncListResponsePreparedStackManagement1
-    | SyncListResponsePreparedStackManagement2
-    | SyncListResponsePreparedStackManagementEnum
-    | undefined;
+export type SyncListResponsePreparedStackManagement2 = {
   /**
-   * Permission profiles that define access control for compute services
+   * Permission profile that maps resources to permission sets
    *
    * @remarks
-   * Key is the profile name, value is the permission configuration
+   * Key can be "*" for all resources or resource name for specific resource
    */
-  profiles: {
-    [k: string]: {
-      [k: string]: Array<SyncListResponsePreparedStackProfile | string>;
-    };
+  override: {
+    [k: string]: Array<SyncListResponsePreparedStackOverride | string>;
   };
 };
 
 /**
- * Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties.
+ * AWS-specific binding specification
  */
-export type SyncListResponsePreparedStackConfig = {
+export type SyncListResponsePreparedStackExtendAwResource = {
   /**
-   * The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+   * Optional condition for additional filtering (rare)
    */
-  id: string;
+  condition?: { [k: string]: { [k: string]: string } } | null | undefined;
   /**
-   * Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.
+   * ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a
+   *
+   * @remarks
+   * tag-on-create grant whose implied check AWS authorizes against no resource; the build
+   * refuses it anywhere else.
    */
-  type: string;
-  additionalProperties?: { [k: string]: any | null } | undefined;
+  notResources?: Array<string> | undefined;
+  /**
+   * Resource ARNs to bind to
+   */
+  resources: Array<string>;
 };
 
 /**
- * Reference to a resource by its stable id and resource type.
+ * AWS-specific binding specification
  */
-export type SyncListResponsePreparedStackDependency = {
-  id: string;
+export type SyncListResponsePreparedStackExtendAwStack = {
   /**
-   * Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.
+   * Optional condition for additional filtering (rare)
    */
-  type: string;
+  condition?: { [k: string]: { [k: string]: string } } | null | undefined;
+  /**
+   * ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a
+   *
+   * @remarks
+   * tag-on-create grant whose implied check AWS authorizes against no resource; the build
+   * refuses it anywhere else.
+   */
+  notResources?: Array<string> | undefined;
+  /**
+   * Resource ARNs to bind to
+   */
+  resources: Array<string>;
 };
 
 /**
- * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
- */
-export const SyncListResponsePreparedStackLifecycle = {
-  Frozen: "frozen",
-  Live: "live",
-} as const;
-/**
- * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+ * Generic binding configuration for permissions
  */
-export type SyncListResponsePreparedStackLifecycle = ClosedEnum<
-  typeof SyncListResponsePreparedStackLifecycle
->;
-
-export type SyncListResponsePreparedStackResources = {
-  /**
-   * Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties.
-   */
-  config: SyncListResponsePreparedStackConfig;
-  /**
-   * Additional dependencies for this resource beyond those defined in the resource itself.
-   *
-   * @remarks
-   * The total dependencies are: resource.get_dependencies() + this list
-   */
-  dependencies: Array<SyncListResponsePreparedStackDependency>;
-  /**
-   * Id of the boolean stack input that decides whether this resource is
-   *
-   * @remarks
-   * created at all. `None` means always create it.
-   *
-   * Set by `.enabled(input)` in the SDK. Setup emitters render the resource
-   * conditionally on the matching template variable, so a deployer who says no
-   * never gets the resource, its outputs, or anything derived from it.
-   */
-  enabledWhen?: string | null | undefined;
+export type SyncListResponsePreparedStackExtendAwBinding = {
   /**
-   * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+   * AWS-specific binding specification
    */
-  lifecycle: SyncListResponsePreparedStackLifecycle;
+  resource?: SyncListResponsePreparedStackExtendAwResource | undefined;
   /**
-   * Enable remote bindings for this resource (BYOB use case).
-   *
-   * @remarks
-   * When true, binding params are synced to StackState's `remote_binding_params`.
-   * Default: false (prevents sensitive data in synced state).
+   * AWS-specific binding specification
    */
-  remoteAccess?: boolean | undefined;
+  stack?: SyncListResponsePreparedStackExtendAwStack | undefined;
 };
 
 /**
- * Represents the target cloud platform.
+ * IAM effect. Defaults to Allow.
  */
-export const SyncListResponsePreparedStackSupportedPlatform = {
-  Aws: "aws",
-  Gcp: "gcp",
-  Azure: "azure",
-  Kubernetes: "kubernetes",
-  Machines: "machines",
-  Local: "local",
-  Test: "test",
+export const SyncListResponsePreparedStackExtendEffect = {
+  Allow: "Allow",
+  Deny: "Deny",
 } as const;
 /**
- * Represents the target cloud platform.
+ * IAM effect. Defaults to Allow.
  */
-export type SyncListResponsePreparedStackSupportedPlatform = ClosedEnum<
-  typeof SyncListResponsePreparedStackSupportedPlatform
+export type SyncListResponsePreparedStackExtendEffect = ClosedEnum<
+  typeof SyncListResponsePreparedStackExtendEffect
 >;
 
 /**
- * A bag of resources, unaware of any cloud.
+ * Grant permissions for a specific cloud platform
  */
-export type SyncListResponsePreparedStack = {
+export type SyncListResponsePreparedStackExtendAwGrant = {
   /**
-   * Released Container resources whose image repositories are approved for
-   *
-   * @remarks
-   * containers created after installation.
-   */
-  dynamicContainerImageResources?: Array<string> | undefined;
-  /**
-   * Exact image repositories approved for containers created after installation.
-   *
-   * @remarks
-   * The runtime API also requires an immutable SHA-256 digest.
-   */
-  dynamicContainerRepositories?: Array<string> | undefined;
-  /**
-   * Unique identifier for the stack
+   * AWS IAM actions (only for AWS)
    */
-  id: string;
+  actions?: Array<string> | null | undefined;
   /**
-   * Input definitions required before setup or deployment can proceed.
+   * Azure actions (only for Azure)
    */
-  inputs?: Array<SyncListResponsePreparedStackInput> | undefined;
+  dataActions?: Array<string> | null | undefined;
   /**
-   * Combined permissions configuration that contains both profiles and management
+   * GCP permissions that require an exact residual custom role.
    */
-  permissions?: SyncListResponsePreparedStackPermissions | undefined;
+  permissions?: Array<string> | null | undefined;
   /**
-   * Map of resource IDs to their configurations and lifecycle settings
+   * Provider predefined roles to bind directly.
    */
-  resources: { [k: string]: SyncListResponsePreparedStackResources };
+  predefinedRoles?: Array<string> | null | undefined;
   /**
-   * Which platforms this stack supports. When None, all platforms are supported.
+   * GCP residual custom permissions to pair with predefined roles.
    */
-  supportedPlatforms?:
-    | Array<SyncListResponsePreparedStackSupportedPlatform>
-    | null
-    | undefined;
+  residualPermissions?: Array<string> | null | undefined;
 };
 
-export type SyncListResponsePreparedStackUnion =
-  | SyncListResponsePreparedStack
-  | string;
-
 /**
- * The cross-account read a manager opened on Alien's registry for one deployment.
+ * AWS-specific platform permission configuration
  */
-export type SyncListResponseRegistryAccess = {
-  /**
-   * Repository identifiers the grant names, sorted.
-   */
-  repositories?: Array<string> | undefined;
+export type SyncListResponsePreparedStackExtendAw = {
   /**
-   * Compute services the grant admits, sorted. Each pulls as its own principal, so a service
-   *
-   * @remarks
-   * added later needs the policy rewritten.
+   * Generic binding configuration for permissions
    */
-  serviceTypes?: Array<string> | undefined;
-};
-
-export type SyncListResponseRegistryAccessUnion =
-  | SyncListResponseRegistryAccess
-  | string;
-
-/**
- * The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as
- *
- * @remarks
- * soon as the object exists and cleared once it is deleted.
- */
-export type SyncListResponseEgress = {
+  binding: SyncListResponsePreparedStackExtendAwBinding;
   /**
-   * `AWS::Lambda::NetworkConnector` the sessions start with.
+   * Short admin-facing description of why this entry exists.
    */
-  connectorArn?: string | null | undefined;
+  description?: string | null | undefined;
   /**
-   * Cloud Control request creating or deleting the connector that AWS has not finished. Kept
-   *
-   * @remarks
-   * so the request's outcome, and AWS's reason when it fails, is read on a later call.
+   * IAM effect. Defaults to Allow.
    */
-  connectorRequest?: string | null | undefined;
+  effect?: SyncListResponsePreparedStackExtendEffect | undefined;
   /**
-   * IAM role Lambda assumes to place the connector's network interfaces.
+   * Grant permissions for a specific cloud platform
    */
-  operatorRoleName: string;
+  grant: SyncListResponsePreparedStackExtendAwGrant;
   /**
-   * Security group permitting egress to loopback only.
+   * Stable admin-facing label for this permission entry.
    */
-  securityGroupId?: string | null | undefined;
+  label?: string | null | undefined;
 };
 
-export type SyncListResponseEgressUnion = SyncListResponseEgress | string;
-
-export const SyncListResponseTypeAwsSandbox = {
-  AwsSandbox: "awsSandbox",
-} as const;
-export type SyncListResponseTypeAwsSandbox = ClosedEnum<
-  typeof SyncListResponseTypeAwsSandbox
->;
-
 /**
- * Cloud objects a direct setup created so a runtime-owned resource can run.
+ * Azure-specific binding specification
  */
-export type SyncListResponseSetupScaffolding = {
+export type SyncListResponsePreparedStackExtendAzureResource = {
   /**
-   * IAM role the image build runs as.
+   * Scope (subscription/resource group/resource level)
    */
-  buildRoleName: string;
-  egress?: SyncListResponseEgress | string | null | undefined;
+  scope: string;
+};
+
+/**
+ * Azure-specific binding specification
+ */
+export type SyncListResponsePreparedStackExtendAzureStack = {
   /**
-   * A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its
-   *
-   * @remarks
-   * runtime controller.
+   * Scope (subscription/resource group/resource level)
    */
-  imageArn?: string | null | undefined;
-  type: SyncListResponseTypeAwsSandbox;
+  scope: string;
 };
 
 /**
- * One-shot authority for a setup re-import to replace setup-owned resources.
+ * Generic binding configuration for permissions
  */
-export type SyncListResponseSetupUpdateAuthorization = {
+export type SyncListResponsePreparedStackExtendAzureBinding = {
   /**
-   * Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment.
+   * Azure-specific binding specification
    */
-  baselineFrozenDigest: string;
+  resource?: SyncListResponsePreparedStackExtendAzureResource | undefined;
   /**
-   * Unique revision used by persistence layers for compare-and-swap updates.
+   * Azure-specific binding specification
    */
-  nonce: string;
+  stack?: SyncListResponsePreparedStackExtendAzureStack | undefined;
+};
+
+/**
+ * Grant permissions for a specific cloud platform
+ */
+export type SyncListResponsePreparedStackExtendAzureGrant = {
   /**
-   * Release whose stack was prepared by setup.
+   * AWS IAM actions (only for AWS)
    */
-  releaseId: string;
+  actions?: Array<string> | null | undefined;
   /**
-   * Exact setup artifact revision that authored this authority.
+   * Azure actions (only for Azure)
    */
-  setupFingerprint: string;
+  dataActions?: Array<string> | null | undefined;
   /**
-   * Setup fingerprint contract version.
+   * GCP permissions that require an exact residual custom role.
    */
-  setupFingerprintVersion: number;
+  permissions?: Array<string> | null | undefined;
   /**
-   * Stable setup target recorded on the imported deployment.
+   * Provider predefined roles to bind directly.
    */
-  setupTarget: string;
+  predefinedRoles?: Array<string> | null | undefined;
   /**
-   * Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared.
+   * GCP residual custom permissions to pair with predefined roles.
    */
-  targetFrozenDigest: string;
+  residualPermissions?: Array<string> | null | undefined;
 };
 
-export type SyncListResponseSetupUpdateAuthorizationUnion =
-  | SyncListResponseSetupUpdateAuthorization
-  | string;
-
 /**
- * Runtime metadata for deployment state persistence
+ * Azure-specific platform permission configuration
  */
-export type SyncListResponseRuntimeMetadata = {
-  /**
-   * Whether each vault-native deployer secret is in the customer's secret
-   *
-   * @remarks
-   * store, with where it goes. Checked from metadata only; no value is ever
-   * read or recorded here.
-   */
-  deployerSecrets?: Array<SyncListResponseDeployerSecret> | undefined;
+export type SyncListResponsePreparedStackExtendAzure = {
   /**
-   * Last generated CLI package revision whose direct setup was applied.
-   *
-   * @remarks
-   * This lets a newer generated CLI refresh setup-owned infrastructure once
-   * before handing runtime changes back to the hosted manager.
+   * Generic binding configuration for permissions
    */
-  directSetupRevision?: string | null | undefined;
+  binding: SyncListResponsePreparedStackExtendAzureBinding;
   /**
-   * Actor that owns structural work during the initial setup phase.
+   * Short admin-facing description of why this entry exists.
    */
-  initialSetupAuthority?: SyncListResponseInitialSetupAuthority | undefined;
+  description?: string | null | undefined;
   /**
-   * Hash of the environment variables snapshot that was last synced to the vault
-   *
-   * @remarks
-   * Used to avoid redundant sync operations during incremental deployment
+   * Grant permissions for a specific cloud platform
    */
-  lastSyncedEnvVarsHash?: string | null | undefined;
+  grant: SyncListResponsePreparedStackExtendAzureGrant;
   /**
-   * Exact vault keys owned by the deployment secret synchronizer. This
-   *
-   * @remarks
-   * inventory lets a later snapshot delete removed keys without listing or
-   * touching unrelated values in the same vault.
+   * Stable admin-facing label for this permission entry.
    */
-  lastSyncedSecretNames?: Array<string> | undefined;
-  /**
-   * Release `pending_prepared_stack` was prepared from. The target can move
-   *
-   * @remarks
-   * to a newer release while that stack is still being applied; this tells
-   * the update which release actually converged.
-   */
-  pendingPreparedReleaseId?: string | null | undefined;
-  pendingPreparedStack?:
-    | SyncListResponsePendingPreparedStackUnion
+  label?: string | null | undefined;
+};
+
+/**
+ * GCP IAM condition
+ */
+export type SyncListResponsePreparedStackExtendConditionResource = {
+  expression: string;
+  title: string;
+};
+
+export type SyncListResponsePreparedStackExtendResourceConditionUnion =
+  | SyncListResponsePreparedStackExtendConditionResource
+  | string;
+
+/**
+ * GCP-specific binding specification
+ */
+export type SyncListResponsePreparedStackExtendGcpResource = {
+  condition?:
+    | SyncListResponsePreparedStackExtendConditionResource
+    | string
     | null
     | undefined;
   /**
-   * Canonical resolved answers for inputs that gate Frozen resources,
-   *
-   * @remarks
-   * keyed by input id, recorded when the deployment is created or its
-   * setup import registers.
-   *
-   * A frozen gate's answer is fixed for the deployment's lifetime: the
-   * update path refuses input values that conflict with these, and a Live
-   * resource sharing such an input resolves the persisted answer forever.
-   */
-  persistedGateAnswers?: { [k: string]: boolean } | undefined;
-  preparedStack?: SyncListResponsePreparedStack | string | null | undefined;
-  registryAccess?: SyncListResponseRegistryAccess | string | null | undefined;
-  /**
-   * Whether cross-account registry access has been successfully granted.
-   *
-   * @remarks
-   * Set to true after the manager successfully sets the ECR/GAR repo policy
-   * for this deployment's target account. Prevents redundant API calls on
-   * every reconcile tick.
-   */
-  registryAccessGranted?: boolean | undefined;
-  /**
-   * What a direct setup created for resources it does not own, keyed by resource id. Setup
-   *
-   * @remarks
-   * teardown removes exactly what is recorded here.
+   * Scope (project/resource level)
    */
-  setupScaffolding?:
-    | { [k: string]: SyncListResponseSetupScaffolding }
-    | undefined;
-  setupUpdateAuthorization?:
-    | SyncListResponseSetupUpdateAuthorization
-    | string
-    | null
-    | undefined;
+  scope: string;
 };
 
 /**
- * Setup source that imported this deployment
- */
-export const SyncListResponseImportSource = {
-  Cloudformation: "cloudformation",
-  Terraform: "terraform",
-  Helm: "helm",
-} as const;
-/**
- * Setup source that imported this deployment
+ * GCP IAM condition
  */
-export type SyncListResponseImportSource = ClosedEnum<
-  typeof SyncListResponseImportSource
->;
+export type SyncListResponsePreparedStackExtendConditionStack = {
+  expression: string;
+  title: string;
+};
+
+export type SyncListResponsePreparedStackExtendStackConditionUnion =
+  | SyncListResponsePreparedStackExtendConditionStack
+  | string;
 
 /**
- * Setup method that created the deployment record and owns setup-time resources.
+ * GCP-specific binding specification
  */
-export const SyncListResponseSetupMethod = {
-  Cloudformation: "cloudformation",
-  GoogleOauth: "google-oauth",
-  Terraform: "terraform",
-  Helm: "helm",
-  Cli: "cli",
-  Manual: "manual",
-} as const;
+export type SyncListResponsePreparedStackExtendGcpStack = {
+  condition?:
+    | SyncListResponsePreparedStackExtendConditionStack
+    | string
+    | null
+    | undefined;
+  /**
+   * Scope (project/resource level)
+   */
+  scope: string;
+};
+
 /**
- * Setup method that created the deployment record and owns setup-time resources.
+ * Generic binding configuration for permissions
  */
-export type SyncListResponseSetupMethod = ClosedEnum<
-  typeof SyncListResponseSetupMethod
->;
+export type SyncListResponsePreparedStackExtendGcpBinding = {
+  /**
+   * GCP-specific binding specification
+   */
+  resource?: SyncListResponsePreparedStackExtendGcpResource | undefined;
+  /**
+   * GCP-specific binding specification
+   */
+  stack?: SyncListResponsePreparedStackExtendGcpStack | undefined;
+};
 
 /**
- * Latest error information if the deployment is in a failed state
+ * Grant permissions for a specific cloud platform
  */
-export type SyncListResponseError = {
+export type SyncListResponsePreparedStackExtendGcpGrant = {
   /**
-   * A unique identifier for the type of error.
-   *
-   * @remarks
-   *
-   * This should be a short, machine-readable string that can be used
-   * by clients to programmatically handle different error types.
-   * Examples: "NOT_FOUND", "VALIDATION_ERROR", "TIMEOUT"
+   * AWS IAM actions (only for AWS)
    */
-  code: string;
+  actions?: Array<string> | null | undefined;
   /**
-   * Additional diagnostic information about the error context.
-   *
-   * @remarks
-   *
-   * This optional field can contain structured data providing more details
-   * about the error, such as validation errors, request parameters that
-   * caused the issue, or other relevant context information.
+   * Azure actions (only for Azure)
    */
-  context?: any | null | undefined;
+  dataActions?: Array<string> | null | undefined;
   /**
-   * Optional human-facing remediation hint.
+   * GCP permissions that require an exact residual custom role.
    */
-  hint?: string | null | undefined;
+  permissions?: Array<string> | null | undefined;
   /**
-   * HTTP status code for this error.
-   *
-   * @remarks
-   *
-   * Used when converting the error to an HTTP response. If None, falls back to
-   * the error type's default status code or 500.
+   * Provider predefined roles to bind directly.
    */
-  httpStatusCode?: number | null | undefined;
+  predefinedRoles?: Array<string> | null | undefined;
   /**
-   * Indicates if this is an internal error that should not be exposed to users.
-   *
-   * @remarks
-   *
-   * When `true`, this error contains sensitive information or implementation
-   * details that should not be shown to end-users. Such errors should be
-   * logged for debugging but replaced with generic error messages in responses.
+   * GCP residual custom permissions to pair with predefined roles.
    */
-  internal: boolean;
+  residualPermissions?: Array<string> | null | undefined;
+};
+
+/**
+ * GCP-specific platform permission configuration
+ */
+export type SyncListResponsePreparedStackExtendGcp = {
   /**
-   * Human-readable error message.
-   *
-   * @remarks
-   *
-   * This message should be clear and actionable for developers or end-users,
-   * providing context about what went wrong and potentially how to fix it.
+   * Generic binding configuration for permissions
    */
-  message: string;
+  binding: SyncListResponsePreparedStackExtendGcpBinding;
   /**
-   * Indicates whether the operation that caused the error should be retried.
-   *
-   * @remarks
-   *
-   * When `true`, the error is transient and the operation might succeed
-   * if attempted again. When `false`, retrying the same operation is
-   * unlikely to succeed without changes.
+   * Short admin-facing description of why this entry exists.
    */
-  retryable: boolean;
+  description?: string | null | undefined;
   /**
-   * The underlying error that caused this error, creating an error chain.
-   *
-   * @remarks
-   *
-   * This allows for proper error propagation and debugging by maintaining
-   * the full context of how an error occurred through multiple layers
-   * of an application.
+   * Grant permissions for a specific cloud platform
    */
-  source?: any | null | undefined;
+  grant: SyncListResponsePreparedStackExtendGcpGrant;
+  /**
+   * Stable admin-facing label for this permission entry.
+   */
+  label?: string | null | undefined;
 };
 
 /**
- * Durable progress for deployment updates
+ * Platform-specific permission configurations
  */
-export type SyncListResponseUpdateState = {
-  active: DeploymentUpdateOperationSummary | null;
-  next: DeploymentUpdateOperationSummary | null;
-  latest: DeploymentUpdateOperationSummary | null;
-};
-
-export const SyncListResponsePlatformKubernetes = {
-  Kubernetes: "kubernetes",
-} as const;
-export type SyncListResponsePlatformKubernetes = ClosedEnum<
-  typeof SyncListResponsePlatformKubernetes
->;
-
-export type SyncListResponseManagementConfigKubernetes = {
-  platform: SyncListResponsePlatformKubernetes;
+export type SyncListResponsePreparedStackExtendPlatforms = {
+  /**
+   * AWS permission configurations
+   */
+  aws?: Array<SyncListResponsePreparedStackExtendAw> | null | undefined;
+  /**
+   * Azure permission configurations
+   */
+  azure?: Array<SyncListResponsePreparedStackExtendAzure> | null | undefined;
+  /**
+   * GCP permission configurations
+   */
+  gcp?: Array<SyncListResponsePreparedStackExtendGcp> | null | undefined;
 };
 
-export const SyncListResponseManagementConfigPlatformAzure = {
-  Azure: "azure",
-} as const;
-export type SyncListResponseManagementConfigPlatformAzure = ClosedEnum<
-  typeof SyncListResponseManagementConfigPlatformAzure
->;
-
 /**
- * Azure management configuration extracted from stack settings
+ * A permission set that can be applied across different cloud platforms
  */
-export type SyncListResponseManagementConfigAzure = {
+export type SyncListResponsePreparedStackExtend = {
   /**
-   * The managing Azure Tenant ID for cross-tenant access
+   * Human-readable description of what this permission set allows
    */
-  managingTenantId: string;
+  description: string;
   /**
-   * OIDC issuer URL trusted by the target-side managed identity.
+   * Unique identifier for the permission set (e.g., "storage/data-read")
    */
-  oidcIssuer: string;
+  id: string;
   /**
-   * OIDC subject claim trusted by the target-side managed identity.
+   * Platform-specific permission configurations
    */
-  oidcSubject: string;
-  platform: SyncListResponseManagementConfigPlatformAzure;
+  platforms: SyncListResponsePreparedStackExtendPlatforms;
 };
 
-export const SyncListResponseManagementConfigPlatformGcp = {
-  Gcp: "gcp",
-} as const;
-export type SyncListResponseManagementConfigPlatformGcp = ClosedEnum<
-  typeof SyncListResponseManagementConfigPlatformGcp
->;
+/**
+ * Reference to a permission set - either by name or inline definition
+ */
+export type SyncListResponsePreparedStackExtendUnion =
+  | SyncListResponsePreparedStackExtend
+  | string;
+
+export type SyncListResponsePreparedStackManagement1 = {
+  /**
+   * Permission profile that maps resources to permission sets
+   *
+   * @remarks
+   * Key can be "*" for all resources or resource name for specific resource
+   */
+  extend: { [k: string]: Array<SyncListResponsePreparedStackExtend | string> };
+};
 
 /**
- * GCP management configuration extracted from stack settings
+ * Management permissions configuration for stack management access
  */
-export type SyncListResponseManagementConfigGcp = {
+export type SyncListResponsePreparedStackManagementUnion =
+  | SyncListResponsePreparedStackManagement1
+  | SyncListResponsePreparedStackManagement2
+  | SyncListResponsePreparedStackManagementEnum;
+
+/**
+ * AWS-specific binding specification
+ */
+export type SyncListResponsePreparedStackProfileAwResource = {
   /**
-   * Service account email for management roles
+   * Optional condition for additional filtering (rare)
    */
-  serviceAccountEmail: string;
-  platform: SyncListResponseManagementConfigPlatformGcp;
+  condition?: { [k: string]: { [k: string]: string } } | null | undefined;
+  /**
+   * ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a
+   *
+   * @remarks
+   * tag-on-create grant whose implied check AWS authorizes against no resource; the build
+   * refuses it anywhere else.
+   */
+  notResources?: Array<string> | undefined;
+  /**
+   * Resource ARNs to bind to
+   */
+  resources: Array<string>;
 };
 
-export const SyncListResponseManagementConfigPlatformAws = {
-  Aws: "aws",
+/**
+ * AWS-specific binding specification
+ */
+export type SyncListResponsePreparedStackProfileAwStack = {
+  /**
+   * Optional condition for additional filtering (rare)
+   */
+  condition?: { [k: string]: { [k: string]: string } } | null | undefined;
+  /**
+   * ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a
+   *
+   * @remarks
+   * tag-on-create grant whose implied check AWS authorizes against no resource; the build
+   * refuses it anywhere else.
+   */
+  notResources?: Array<string> | undefined;
+  /**
+   * Resource ARNs to bind to
+   */
+  resources: Array<string>;
+};
+
+/**
+ * Generic binding configuration for permissions
+ */
+export type SyncListResponsePreparedStackProfileAwBinding = {
+  /**
+   * AWS-specific binding specification
+   */
+  resource?: SyncListResponsePreparedStackProfileAwResource | undefined;
+  /**
+   * AWS-specific binding specification
+   */
+  stack?: SyncListResponsePreparedStackProfileAwStack | undefined;
+};
+
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export const SyncListResponsePreparedStackProfileEffect = {
+  Allow: "Allow",
+  Deny: "Deny",
 } as const;
-export type SyncListResponseManagementConfigPlatformAws = ClosedEnum<
-  typeof SyncListResponseManagementConfigPlatformAws
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export type SyncListResponsePreparedStackProfileEffect = ClosedEnum<
+  typeof SyncListResponsePreparedStackProfileEffect
 >;
 
-/**
- * AWS management configuration extracted from stack settings
- */
-export type SyncListResponseManagementConfigAws = {
-  /**
-   * The managing AWS IAM role ARN that can assume cross-account roles
-   */
-  managingRoleArn: string;
-  platform: SyncListResponseManagementConfigPlatformAws;
-};
+/**
+ * Grant permissions for a specific cloud platform
+ */
+export type SyncListResponsePreparedStackProfileAwGrant = {
+  /**
+   * AWS IAM actions (only for AWS)
+   */
+  actions?: Array<string> | null | undefined;
+  /**
+   * Azure actions (only for Azure)
+   */
+  dataActions?: Array<string> | null | undefined;
+  /**
+   * GCP permissions that require an exact residual custom role.
+   */
+  permissions?: Array<string> | null | undefined;
+  /**
+   * Provider predefined roles to bind directly.
+   */
+  predefinedRoles?: Array<string> | null | undefined;
+  /**
+   * GCP residual custom permissions to pair with predefined roles.
+   */
+  residualPermissions?: Array<string> | null | undefined;
+};
+
+/**
+ * AWS-specific platform permission configuration
+ */
+export type SyncListResponsePreparedStackProfileAw = {
+  /**
+   * Generic binding configuration for permissions
+   */
+  binding: SyncListResponsePreparedStackProfileAwBinding;
+  /**
+   * Short admin-facing description of why this entry exists.
+   */
+  description?: string | null | undefined;
+  /**
+   * IAM effect. Defaults to Allow.
+   */
+  effect?: SyncListResponsePreparedStackProfileEffect | undefined;
+  /**
+   * Grant permissions for a specific cloud platform
+   */
+  grant: SyncListResponsePreparedStackProfileAwGrant;
+  /**
+   * Stable admin-facing label for this permission entry.
+   */
+  label?: string | null | undefined;
+};
+
+/**
+ * Azure-specific binding specification
+ */
+export type SyncListResponsePreparedStackProfileAzureResource = {
+  /**
+   * Scope (subscription/resource group/resource level)
+   */
+  scope: string;
+};
+
+/**
+ * Azure-specific binding specification
+ */
+export type SyncListResponsePreparedStackProfileAzureStack = {
+  /**
+   * Scope (subscription/resource group/resource level)
+   */
+  scope: string;
+};
+
+/**
+ * Generic binding configuration for permissions
+ */
+export type SyncListResponsePreparedStackProfileAzureBinding = {
+  /**
+   * Azure-specific binding specification
+   */
+  resource?: SyncListResponsePreparedStackProfileAzureResource | undefined;
+  /**
+   * Azure-specific binding specification
+   */
+  stack?: SyncListResponsePreparedStackProfileAzureStack | undefined;
+};
+
+/**
+ * Grant permissions for a specific cloud platform
+ */
+export type SyncListResponsePreparedStackProfileAzureGrant = {
+  /**
+   * AWS IAM actions (only for AWS)
+   */
+  actions?: Array<string> | null | undefined;
+  /**
+   * Azure actions (only for Azure)
+   */
+  dataActions?: Array<string> | null | undefined;
+  /**
+   * GCP permissions that require an exact residual custom role.
+   */
+  permissions?: Array<string> | null | undefined;
+  /**
+   * Provider predefined roles to bind directly.
+   */
+  predefinedRoles?: Array<string> | null | undefined;
+  /**
+   * GCP residual custom permissions to pair with predefined roles.
+   */
+  residualPermissions?: Array<string> | null | undefined;
+};
+
+/**
+ * Azure-specific platform permission configuration
+ */
+export type SyncListResponsePreparedStackProfileAzure = {
+  /**
+   * Generic binding configuration for permissions
+   */
+  binding: SyncListResponsePreparedStackProfileAzureBinding;
+  /**
+   * Short admin-facing description of why this entry exists.
+   */
+  description?: string | null | undefined;
+  /**
+   * Grant permissions for a specific cloud platform
+   */
+  grant: SyncListResponsePreparedStackProfileAzureGrant;
+  /**
+   * Stable admin-facing label for this permission entry.
+   */
+  label?: string | null | undefined;
+};
+
+/**
+ * GCP IAM condition
+ */
+export type SyncListResponsePreparedStackProfileConditionResource = {
+  expression: string;
+  title: string;
+};
+
+export type SyncListResponsePreparedStackProfileResourceConditionUnion =
+  | SyncListResponsePreparedStackProfileConditionResource
+  | string;
+
+/**
+ * GCP-specific binding specification
+ */
+export type SyncListResponsePreparedStackProfileGcpResource = {
+  condition?:
+    | SyncListResponsePreparedStackProfileConditionResource
+    | string
+    | null
+    | undefined;
+  /**
+   * Scope (project/resource level)
+   */
+  scope: string;
+};
+
+/**
+ * GCP IAM condition
+ */
+export type SyncListResponsePreparedStackProfileConditionStack = {
+  expression: string;
+  title: string;
+};
+
+export type SyncListResponsePreparedStackProfileStackConditionUnion =
+  | SyncListResponsePreparedStackProfileConditionStack
+  | string;
+
+/**
+ * GCP-specific binding specification
+ */
+export type SyncListResponsePreparedStackProfileGcpStack = {
+  condition?:
+    | SyncListResponsePreparedStackProfileConditionStack
+    | string
+    | null
+    | undefined;
+  /**
+   * Scope (project/resource level)
+   */
+  scope: string;
+};
+
+/**
+ * Generic binding configuration for permissions
+ */
+export type SyncListResponsePreparedStackProfileGcpBinding = {
+  /**
+   * GCP-specific binding specification
+   */
+  resource?: SyncListResponsePreparedStackProfileGcpResource | undefined;
+  /**
+   * GCP-specific binding specification
+   */
+  stack?: SyncListResponsePreparedStackProfileGcpStack | undefined;
+};
+
+/**
+ * Grant permissions for a specific cloud platform
+ */
+export type SyncListResponsePreparedStackProfileGcpGrant = {
+  /**
+   * AWS IAM actions (only for AWS)
+   */
+  actions?: Array<string> | null | undefined;
+  /**
+   * Azure actions (only for Azure)
+   */
+  dataActions?: Array<string> | null | undefined;
+  /**
+   * GCP permissions that require an exact residual custom role.
+   */
+  permissions?: Array<string> | null | undefined;
+  /**
+   * Provider predefined roles to bind directly.
+   */
+  predefinedRoles?: Array<string> | null | undefined;
+  /**
+   * GCP residual custom permissions to pair with predefined roles.
+   */
+  residualPermissions?: Array<string> | null | undefined;
+};
+
+/**
+ * GCP-specific platform permission configuration
+ */
+export type SyncListResponsePreparedStackProfileGcp = {
+  /**
+   * Generic binding configuration for permissions
+   */
+  binding: SyncListResponsePreparedStackProfileGcpBinding;
+  /**
+   * Short admin-facing description of why this entry exists.
+   */
+  description?: string | null | undefined;
+  /**
+   * Grant permissions for a specific cloud platform
+   */
+  grant: SyncListResponsePreparedStackProfileGcpGrant;
+  /**
+   * Stable admin-facing label for this permission entry.
+   */
+  label?: string | null | undefined;
+};
+
+/**
+ * Platform-specific permission configurations
+ */
+export type SyncListResponsePreparedStackProfilePlatforms = {
+  /**
+   * AWS permission configurations
+   */
+  aws?: Array<SyncListResponsePreparedStackProfileAw> | null | undefined;
+  /**
+   * Azure permission configurations
+   */
+  azure?: Array<SyncListResponsePreparedStackProfileAzure> | null | undefined;
+  /**
+   * GCP permission configurations
+   */
+  gcp?: Array<SyncListResponsePreparedStackProfileGcp> | null | undefined;
+};
+
+/**
+ * A permission set that can be applied across different cloud platforms
+ */
+export type SyncListResponsePreparedStackProfile = {
+  /**
+   * Human-readable description of what this permission set allows
+   */
+  description: string;
+  /**
+   * Unique identifier for the permission set (e.g., "storage/data-read")
+   */
+  id: string;
+  /**
+   * Platform-specific permission configurations
+   */
+  platforms: SyncListResponsePreparedStackProfilePlatforms;
+};
+
+/**
+ * Reference to a permission set - either by name or inline definition
+ */
+export type SyncListResponsePreparedStackProfileUnion =
+  | SyncListResponsePreparedStackProfile
+  | string;
+
+/**
+ * Combined permissions configuration that contains both profiles and management
+ */
+export type SyncListResponsePreparedStackPermissions = {
+  /**
+   * Management permissions configuration for stack management access
+   */
+  management?:
+    | SyncListResponsePreparedStackManagement1
+    | SyncListResponsePreparedStackManagement2
+    | SyncListResponsePreparedStackManagementEnum
+    | undefined;
+  /**
+   * Permission profiles that define access control for compute services
+   *
+   * @remarks
+   * Key is the profile name, value is the permission configuration
+   */
+  profiles: {
+    [k: string]: {
+      [k: string]: Array<SyncListResponsePreparedStackProfile | string>;
+    };
+  };
+};
+
+/**
+ * Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties.
+ */
+export type SyncListResponsePreparedStackConfig = {
+  /**
+   * The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+   */
+  id: string;
+  /**
+   * Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.
+   */
+  type: string;
+  additionalProperties?: { [k: string]: any | null } | undefined;
+};
+
+/**
+ * Reference to a resource by its stable id and resource type.
+ */
+export type SyncListResponsePreparedStackDependency = {
+  id: string;
+  /**
+   * Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.
+   */
+  type: string;
+};
+
+/**
+ * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+ */
+export const SyncListResponsePreparedStackLifecycle = {
+  Frozen: "frozen",
+  Live: "live",
+} as const;
+/**
+ * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+ */
+export type SyncListResponsePreparedStackLifecycle = ClosedEnum<
+  typeof SyncListResponsePreparedStackLifecycle
+>;
+
+export type SyncListResponsePreparedStackResources = {
+  /**
+   * Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties.
+   */
+  config: SyncListResponsePreparedStackConfig;
+  /**
+   * Additional dependencies for this resource beyond those defined in the resource itself.
+   *
+   * @remarks
+   * The total dependencies are: resource.get_dependencies() + this list
+   */
+  dependencies: Array<SyncListResponsePreparedStackDependency>;
+  /**
+   * Id of the boolean stack input that decides whether this resource is
+   *
+   * @remarks
+   * created at all. `None` means always create it.
+   *
+   * Set by `.enabled(input)` in the SDK. Setup emitters render the resource
+   * conditionally on the matching template variable, so a deployer who says no
+   * never gets the resource, its outputs, or anything derived from it.
+   */
+  enabledWhen?: string | null | undefined;
+  /**
+   * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+   */
+  lifecycle: SyncListResponsePreparedStackLifecycle;
+  /**
+   * Enable remote bindings for this resource (BYOB use case).
+   *
+   * @remarks
+   * When true, binding params are synced to StackState's `remote_binding_params`.
+   * Default: false (prevents sensitive data in synced state).
+   */
+  remoteAccess?: boolean | undefined;
+};
+
+/**
+ * Represents the target cloud platform.
+ */
+export const SyncListResponsePreparedStackSupportedPlatform = {
+  Aws: "aws",
+  Gcp: "gcp",
+  Azure: "azure",
+  Kubernetes: "kubernetes",
+  Machines: "machines",
+  Local: "local",
+  Test: "test",
+} as const;
+/**
+ * Represents the target cloud platform.
+ */
+export type SyncListResponsePreparedStackSupportedPlatform = ClosedEnum<
+  typeof SyncListResponsePreparedStackSupportedPlatform
+>;
+
+/**
+ * A bag of resources, unaware of any cloud.
+ */
+export type SyncListResponsePreparedStack = {
+  /**
+   * Released Container resources whose image repositories are approved for
+   *
+   * @remarks
+   * containers created after installation.
+   */
+  dynamicContainerImageResources?: Array<string> | undefined;
+  /**
+   * Exact image repositories approved for containers created after installation.
+   *
+   * @remarks
+   * The runtime API also requires an immutable SHA-256 digest.
+   */
+  dynamicContainerRepositories?: Array<string> | undefined;
+  /**
+   * Unique identifier for the stack
+   */
+  id: string;
+  /**
+   * Input definitions required before setup or deployment can proceed.
+   */
+  inputs?: Array<SyncListResponsePreparedStackInput> | undefined;
+  operations?: SyncListResponsePreparedStackOperationsUnion | null | undefined;
+  /**
+   * Combined permissions configuration that contains both profiles and management
+   */
+  permissions?: SyncListResponsePreparedStackPermissions | undefined;
+  /**
+   * Map of resource IDs to their configurations and lifecycle settings
+   */
+  resources: { [k: string]: SyncListResponsePreparedStackResources };
+  /**
+   * Which platforms this stack supports. When None, all platforms are supported.
+   */
+  supportedPlatforms?:
+    | Array<SyncListResponsePreparedStackSupportedPlatform>
+    | null
+    | undefined;
+};
+
+export type SyncListResponsePreparedStackUnion =
+  | SyncListResponsePreparedStack
+  | string;
+
+/**
+ * The cross-account read a manager opened on Alien's registry for one deployment.
+ */
+export type SyncListResponseRegistryAccess = {
+  /**
+   * Repository identifiers the grant names, sorted.
+   */
+  repositories?: Array<string> | undefined;
+  /**
+   * Compute services the grant admits, sorted. Each pulls as its own principal, so a service
+   *
+   * @remarks
+   * added later needs the policy rewritten.
+   */
+  serviceTypes?: Array<string> | undefined;
+};
+
+export type SyncListResponseRegistryAccessUnion =
+  | SyncListResponseRegistryAccess
+  | string;
+
+/**
+ * The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as
+ *
+ * @remarks
+ * soon as the object exists and cleared once it is deleted.
+ */
+export type SyncListResponseEgress = {
+  /**
+   * `AWS::Lambda::NetworkConnector` the sessions start with.
+   */
+  connectorArn?: string | null | undefined;
+  /**
+   * Cloud Control request creating or deleting the connector that AWS has not finished. Kept
+   *
+   * @remarks
+   * so the request's outcome, and AWS's reason when it fails, is read on a later call.
+   */
+  connectorRequest?: string | null | undefined;
+  /**
+   * IAM role Lambda assumes to place the connector's network interfaces.
+   */
+  operatorRoleName: string;
+  /**
+   * Security group permitting egress to loopback only.
+   */
+  securityGroupId?: string | null | undefined;
+};
+
+export type SyncListResponseEgressUnion = SyncListResponseEgress | string;
+
+export const SyncListResponseTypeAwsSandbox = {
+  AwsSandbox: "awsSandbox",
+} as const;
+export type SyncListResponseTypeAwsSandbox = ClosedEnum<
+  typeof SyncListResponseTypeAwsSandbox
+>;
+
+/**
+ * Cloud objects a direct setup created so a runtime-owned resource can run.
+ */
+export type SyncListResponseSetupScaffolding = {
+  /**
+   * IAM role the image build runs as.
+   */
+  buildRoleName: string;
+  egress?: SyncListResponseEgress | string | null | undefined;
+  /**
+   * A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its
+   *
+   * @remarks
+   * runtime controller.
+   */
+  imageArn?: string | null | undefined;
+  type: SyncListResponseTypeAwsSandbox;
+};
+
+/**
+ * One-shot authority for a setup re-import to replace setup-owned resources.
+ */
+export type SyncListResponseSetupUpdateAuthorization = {
+  /**
+   * Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment.
+   */
+  baselineFrozenDigest: string;
+  /**
+   * Unique revision used by persistence layers for compare-and-swap updates.
+   */
+  nonce: string;
+  /**
+   * Release whose stack was prepared by setup.
+   */
+  releaseId: string;
+  /**
+   * Exact setup artifact revision that authored this authority.
+   */
+  setupFingerprint: string;
+  /**
+   * Setup fingerprint contract version.
+   */
+  setupFingerprintVersion: number;
+  /**
+   * Stable setup target recorded on the imported deployment.
+   */
+  setupTarget: string;
+  /**
+   * Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared.
+   */
+  targetFrozenDigest: string;
+};
+
+export type SyncListResponseSetupUpdateAuthorizationUnion =
+  | SyncListResponseSetupUpdateAuthorization
+  | string;
+
+/**
+ * Runtime metadata for deployment state persistence
+ */
+export type SyncListResponseRuntimeMetadata = {
+  /**
+   * Whether each vault-native deployer secret is in the customer's secret
+   *
+   * @remarks
+   * store, with where it goes. Checked from metadata only; no value is ever
+   * read or recorded here.
+   */
+  deployerSecrets?: Array<SyncListResponseDeployerSecret> | undefined;
+  /**
+   * Last generated CLI package revision whose direct setup was applied.
+   *
+   * @remarks
+   * This lets a newer generated CLI refresh setup-owned infrastructure once
+   * before handing runtime changes back to the hosted manager.
+   */
+  directSetupRevision?: string | null | undefined;
+  /**
+   * Actor that owns structural work during the initial setup phase.
+   */
+  initialSetupAuthority?: SyncListResponseInitialSetupAuthority | undefined;
+  /**
+   * Hash of the environment variables snapshot that was last synced to the vault
+   *
+   * @remarks
+   * Used to avoid redundant sync operations during incremental deployment
+   */
+  lastSyncedEnvVarsHash?: string | null | undefined;
+  /**
+   * Exact vault keys owned by the deployment secret synchronizer. This
+   *
+   * @remarks
+   * inventory lets a later snapshot delete removed keys without listing or
+   * touching unrelated values in the same vault.
+   */
+  lastSyncedSecretNames?: Array<string> | undefined;
+  /**
+   * Release `pending_prepared_stack` was prepared from. The target can move
+   *
+   * @remarks
+   * to a newer release while that stack is still being applied; this tells
+   * the update which release actually converged.
+   */
+  pendingPreparedReleaseId?: string | null | undefined;
+  pendingPreparedStack?:
+    | SyncListResponsePendingPreparedStackUnion
+    | null
+    | undefined;
+  /**
+   * Canonical resolved answers for inputs that gate Frozen resources,
+   *
+   * @remarks
+   * keyed by input id, recorded when the deployment is created or its
+   * setup import registers.
+   *
+   * A frozen gate's answer is fixed for the deployment's lifetime: the
+   * update path refuses input values that conflict with these, and a Live
+   * resource sharing such an input resolves the persisted answer forever.
+   */
+  persistedGateAnswers?: { [k: string]: boolean } | undefined;
+  preparedStack?: SyncListResponsePreparedStack | string | null | undefined;
+  registryAccess?: SyncListResponseRegistryAccess | string | null | undefined;
+  /**
+   * Whether cross-account registry access has been successfully granted.
+   *
+   * @remarks
+   * Set to true after the manager successfully sets the ECR/GAR repo policy
+   * for this deployment's target account. Prevents redundant API calls on
+   * every reconcile tick.
+   */
+  registryAccessGranted?: boolean | undefined;
+  /**
+   * What a direct setup created for resources it does not own, keyed by resource id. Setup
+   *
+   * @remarks
+   * teardown removes exactly what is recorded here.
+   */
+  setupScaffolding?:
+    | { [k: string]: SyncListResponseSetupScaffolding }
+    | undefined;
+  setupUpdateAuthorization?:
+    | SyncListResponseSetupUpdateAuthorization
+    | string
+    | null
+    | undefined;
+};
+
+/**
+ * Setup source that imported this deployment
+ */
+export const SyncListResponseImportSource = {
+  Cloudformation: "cloudformation",
+  Terraform: "terraform",
+  Helm: "helm",
+} as const;
+/**
+ * Setup source that imported this deployment
+ */
+export type SyncListResponseImportSource = ClosedEnum<
+  typeof SyncListResponseImportSource
+>;
+
+/**
+ * Setup method that created the deployment record and owns setup-time resources.
+ */
+export const SyncListResponseSetupMethod = {
+  Cloudformation: "cloudformation",
+  GoogleOauth: "google-oauth",
+  Terraform: "terraform",
+  Helm: "helm",
+  Cli: "cli",
+  Manual: "manual",
+} as const;
+/**
+ * Setup method that created the deployment record and owns setup-time resources.
+ */
+export type SyncListResponseSetupMethod = ClosedEnum<
+  typeof SyncListResponseSetupMethod
+>;
+
+/**
+ * Latest error information if the deployment is in a failed state
+ */
+export type SyncListResponseError = {
+  /**
+   * A unique identifier for the type of error.
+   *
+   * @remarks
+   *
+   * This should be a short, machine-readable string that can be used
+   * by clients to programmatically handle different error types.
+   * Examples: "NOT_FOUND", "VALIDATION_ERROR", "TIMEOUT"
+   */
+  code: string;
+  /**
+   * Additional diagnostic information about the error context.
+   *
+   * @remarks
+   *
+   * This optional field can contain structured data providing more details
+   * about the error, such as validation errors, request parameters that
+   * caused the issue, or other relevant context information.
+   */
+  context?: any | null | undefined;
+  /**
+   * Optional human-facing remediation hint.
+   */
+  hint?: string | null | undefined;
+  /**
+   * HTTP status code for this error.
+   *
+   * @remarks
+   *
+   * Used when converting the error to an HTTP response. If None, falls back to
+   * the error type's default status code or 500.
+   */
+  httpStatusCode?: number | null | undefined;
+  /**
+   * Indicates if this is an internal error that should not be exposed to users.
+   *
+   * @remarks
+   *
+   * When `true`, this error contains sensitive information or implementation
+   * details that should not be shown to end-users. Such errors should be
+   * logged for debugging but replaced with generic error messages in responses.
+   */
+  internal: boolean;
+  /**
+   * Human-readable error message.
+   *
+   * @remarks
+   *
+   * This message should be clear and actionable for developers or end-users,
+   * providing context about what went wrong and potentially how to fix it.
+   */
+  message: string;
+  /**
+   * Indicates whether the operation that caused the error should be retried.
+   *
+   * @remarks
+   *
+   * When `true`, the error is transient and the operation might succeed
+   * if attempted again. When `false`, retrying the same operation is
+   * unlikely to succeed without changes.
+   */
+  retryable: boolean;
+  /**
+   * The underlying error that caused this error, creating an error chain.
+   *
+   * @remarks
+   *
+   * This allows for proper error propagation and debugging by maintaining
+   * the full context of how an error occurred through multiple layers
+   * of an application.
+   */
+  source?: any | null | undefined;
+};
+
+/**
+ * Durable progress for deployment updates
+ */
+export type SyncListResponseUpdateState = {
+  active: DeploymentUpdateOperationSummary | null;
+  next: DeploymentUpdateOperationSummary | null;
+  latest: DeploymentUpdateOperationSummary | null;
+};
+
+export const SyncListResponsePlatformKubernetes = {
+  Kubernetes: "kubernetes",
+} as const;
+export type SyncListResponsePlatformKubernetes = ClosedEnum<
+  typeof SyncListResponsePlatformKubernetes
+>;
+
+export type SyncListResponseManagementConfigKubernetes = {
+  platform: SyncListResponsePlatformKubernetes;
+};
+
+export const SyncListResponseManagementConfigPlatformAzure = {
+  Azure: "azure",
+} as const;
+export type SyncListResponseManagementConfigPlatformAzure = ClosedEnum<
+  typeof SyncListResponseManagementConfigPlatformAzure
+>;
+
+/**
+ * Azure management configuration extracted from stack settings
+ */
+export type SyncListResponseManagementConfigAzure = {
+  /**
+   * The managing Azure Tenant ID for cross-tenant access
+   */
+  managingTenantId: string;
+  /**
+   * OIDC issuer URL trusted by the target-side managed identity.
+   */
+  oidcIssuer: string;
+  /**
+   * OIDC subject claim trusted by the target-side managed identity.
+   */
+  oidcSubject: string;
+  platform: SyncListResponseManagementConfigPlatformAzure;
+};
+
+export const SyncListResponseManagementConfigPlatformGcp = {
+  Gcp: "gcp",
+} as const;
+export type SyncListResponseManagementConfigPlatformGcp = ClosedEnum<
+  typeof SyncListResponseManagementConfigPlatformGcp
+>;
+
+/**
+ * GCP management configuration extracted from stack settings
+ */
+export type SyncListResponseManagementConfigGcp = {
+  /**
+   * Service account email for management roles
+   */
+  serviceAccountEmail: string;
+  platform: SyncListResponseManagementConfigPlatformGcp;
+};
+
+export const SyncListResponseManagementConfigPlatformAws = {
+  Aws: "aws",
+} as const;
+export type SyncListResponseManagementConfigPlatformAws = ClosedEnum<
+  typeof SyncListResponseManagementConfigPlatformAws
+>;
+
+/**
+ * AWS management configuration extracted from stack settings
+ */
+export type SyncListResponseManagementConfigAws = {
+  /**
+   * The managing AWS IAM role ARN that can assume cross-account roles
+   */
+  managingRoleArn: string;
+  platform: SyncListResponseManagementConfigPlatformAws;
+};
+
+/**
+ * Management configuration for different cloud platforms.
+ *
+ * @remarks
+ *
+ * Platform-derived configuration for cross-account/cross-tenant access.
+ * This is NOT user-specified - it's derived from the Manager's ServiceAccount.
+ */
+export type SyncListResponseManagementConfigUnion =
+  | SyncListResponseManagementConfigAzure
+  | SyncListResponseManagementConfigAws
+  | SyncListResponseManagementConfigGcp
+  | SyncListResponseManagementConfigKubernetes
+  | string;
+
+export type SyncListResponseDeployment = {
+  /**
+   * Unique identifier for the deployment.
+   */
+  id: string;
+  /**
+   * Deployment name.
+   */
+  name: string;
+  /**
+   * Public subdomain for auto-generated domains
+   */
+  publicSubdomain?: string | null | undefined;
+  /**
+   * Deployment status in the deployment lifecycle.
+   *
+   * @remarks
+   *
+   * For observe-only deployments with no release or stack state, `Running`
+   * means the Operator is attached. Connectivity comes from `lastHeartbeatAt`;
+   * resource health comes from inventory and resource heartbeat data.
+   */
+  status: SyncListResponseStatus;
+  /**
+   * Unique identifier for the project.
+   */
+  projectId: string;
+  /**
+   * Target platform for the deployment
+   */
+  platform: SyncListResponsePlatform;
+  /**
+   * Underlying cloud platform for Kubernetes deployments.
+   */
+  basePlatform?: SyncListResponseBasePlatform | null | undefined;
+  /**
+   * Cloud region or location for the deployment.
+   */
+  region?: string | null | undefined;
+  /**
+   * DeploymentState protocol version owned by the runtime/manager
+   */
+  deploymentProtocolVersion: number;
+  /**
+   * ID of deployment group this deployment belongs to
+   */
+  deploymentGroupId: string;
+  membershipRevision: number;
+  membershipProjectionRevision: number | null;
+  /**
+   * Operational purpose of this deployment within its customer environment.
+   */
+  purpose: DeploymentPurpose;
+  /**
+   * Cloud environment information
+   */
+  environmentInfo?: SyncListResponseEnvironmentInfoUnion | null | undefined;
+  /**
+   * User-provided configuration (network, deployment model, approvals)
+   */
+  stackSettings: SyncListResponseStackSettings;
+  /**
+   * State of infrastructure components managed by this deployment
+   */
+  stackState?: SyncListResponseStackState | null | undefined;
+  /**
+   * Runtime metadata for deployment state persistence
+   */
+  runtimeMetadata?: SyncListResponseRuntimeMetadata | null | undefined;
+  /**
+   * ID of the currently deployed release (actual state)
+   */
+  currentReleaseId?: string | null | undefined;
+  /**
+   * ID of the desired release for deployment/update (desired state)
+   */
+  desiredReleaseId?: string | null | undefined;
+  /**
+   * ID of the pinned release
+   */
+  pinnedReleaseId?: string | null | undefined;
+  releaseChannel: string;
+  /**
+   * Setup source that imported this deployment
+   */
+  importSource?: SyncListResponseImportSource | null | undefined;
+  /**
+   * Setup method that created the deployment record and owns setup-time resources.
+   */
+  setupMethod?: SyncListResponseSetupMethod | null | undefined;
+  /**
+   * Setup method metadata needed to guide privileged teardown.
+   */
+  setupMetadata?: { [k: string]: any | null } | null | undefined;
+  /**
+   * Imported setup target for compatibility checks
+   */
+  setupTarget?: string | null | undefined;
+  /**
+   * Imported setup compatibility fingerprint
+   */
+  setupFingerprint?: string | null | undefined;
+  /**
+   * Imported setup fingerprint algorithm version
+   */
+  setupFingerprintVersion?: number | null | undefined;
+  /**
+   * Display-only scope reported by the Operator manifest
+   */
+  operatorScope?: string | null | undefined;
+  /**
+   * Display-only permission tier reported by the Operator manifest
+   */
+  operatorPermission?: string | null | undefined;
+  /**
+   * Version reported by the Operator
+   */
+  operatorVersion?: string | null | undefined;
+  /**
+   * Capability state reported by the Operator
+   */
+  capabilities?: Array<OperatorCapabilityReport> | null | undefined;
+  /**
+   * Enabled-plugin-bundle-set hash the Operator reports having loaded
+   */
+  observedOperationsBundleHash?: string | null | undefined;
+  /**
+   * Operations the Operator reports as currently loaded
+   */
+  observedOperations?: Array<ReportedOperation> | null | undefined;
+  /**
+   * Whether a retry has been requested for a failed deployment
+   */
+  retryRequested: boolean;
+  /**
+   * Timestamp of the last received heartbeat from the deployment
+   */
+  lastHeartbeatAt?: Date | null | undefined;
+  /**
+   * Latest error information if the deployment is in a failed state
+   */
+  error?: SyncListResponseError | null | undefined;
+  /**
+   * Durable progress for deployment updates
+   */
+  updateState?: SyncListResponseUpdateState | undefined;
+  createdAt: Date;
+  updatedAt: Date;
+  managerId: string;
+  /**
+   * Unique identifier for the workspace.
+   */
+  workspaceId: string;
+  userEnvironmentVariables: Array<EnvironmentVariableConfig> | null;
+  /**
+   * Management configuration for different cloud platforms.
+   *
+   * @remarks
+   *
+   * Platform-derived configuration for cross-account/cross-tenant access.
+   * This is NOT user-specified - it's derived from the Manager's ServiceAccount.
+   */
+  managementConfig?:
+    | SyncListResponseManagementConfigAzure
+    | SyncListResponseManagementConfigAws
+    | SyncListResponseManagementConfigGcp
+    | SyncListResponseManagementConfigKubernetes
+    | string
+    | null
+    | undefined;
+  deploymentToken?: string | null | undefined;
+  lockedBy?: string | null | undefined;
+  lockedAt?: Date | null | undefined;
+};
+
+/**
+ * Full deployment records for manager operation
+ */
+export type SyncListResponse = {
+  deployments: Array<SyncListResponseDeployment>;
+};
+
+/** @internal */
+export const SyncListResponsePreparedStackManagementEnum$inboundSchema:
+  z.ZodEnum<typeof SyncListResponsePreparedStackManagementEnum> = z.enum(
+    SyncListResponsePreparedStackManagementEnum,
+  );
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideAwResource$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackOverrideAwResource, unknown> = z
+    .object({
+      condition: z.nullable(
+        z.record(z.string(), z.record(z.string(), z.string())),
+      ).optional(),
+      notResources: z.array(z.string()).optional(),
+      resources: z.array(z.string()),
+    });
+
+export function syncListResponsePreparedStackOverrideAwResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideAwResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideAwResource$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideAwResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideAwStack$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackOverrideAwStack, unknown> = z.object({
+    condition: z.nullable(
+      z.record(z.string(), z.record(z.string(), z.string())),
+    ).optional(),
+    notResources: z.array(z.string()).optional(),
+    resources: z.array(z.string()),
+  });
+
+export function syncListResponsePreparedStackOverrideAwStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideAwStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideAwStack$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideAwStack' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideAwBinding$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackOverrideAwBinding, unknown> = z.object(
+    {
+      resource: z.lazy(() =>
+        SyncListResponsePreparedStackOverrideAwResource$inboundSchema
+      ).optional(),
+      stack: z.lazy(() =>
+        SyncListResponsePreparedStackOverrideAwStack$inboundSchema
+      ).optional(),
+    },
+  );
+
+export function syncListResponsePreparedStackOverrideAwBindingFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideAwBinding,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideAwBinding$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideAwBinding' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideEffect$inboundSchema:
+  z.ZodEnum<typeof SyncListResponsePreparedStackOverrideEffect> = z.enum(
+    SyncListResponsePreparedStackOverrideEffect,
+  );
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideAwGrant$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackOverrideAwGrant, unknown> = z.object({
+    actions: z.nullable(z.array(z.string())).optional(),
+    dataActions: z.nullable(z.array(z.string())).optional(),
+    permissions: z.nullable(z.array(z.string())).optional(),
+    predefinedRoles: z.nullable(z.array(z.string())).optional(),
+    residualPermissions: z.nullable(z.array(z.string())).optional(),
+  });
+
+export function syncListResponsePreparedStackOverrideAwGrantFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideAwGrant,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideAwGrant$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideAwGrant' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideAw$inboundSchema: z.ZodType<
+  SyncListResponsePreparedStackOverrideAw,
+  unknown
+> = z.object({
+  binding: z.lazy(() =>
+    SyncListResponsePreparedStackOverrideAwBinding$inboundSchema
+  ),
+  description: z.nullable(z.string()).optional(),
+  effect: SyncListResponsePreparedStackOverrideEffect$inboundSchema.optional(),
+  grant: z.lazy(() =>
+    SyncListResponsePreparedStackOverrideAwGrant$inboundSchema
+  ),
+  label: z.nullable(z.string()).optional(),
+});
+
+export function syncListResponsePreparedStackOverrideAwFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideAw,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideAw$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideAw' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideAzureResource$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackOverrideAzureResource, unknown> = z
+    .object({
+      scope: z.string(),
+    });
+
+export function syncListResponsePreparedStackOverrideAzureResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideAzureResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideAzureResource$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideAzureResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideAzureStack$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackOverrideAzureStack, unknown> = z
+    .object({
+      scope: z.string(),
+    });
+
+export function syncListResponsePreparedStackOverrideAzureStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideAzureStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideAzureStack$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideAzureStack' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideAzureBinding$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackOverrideAzureBinding, unknown> = z
+    .object({
+      resource: z.lazy(() =>
+        SyncListResponsePreparedStackOverrideAzureResource$inboundSchema
+      ).optional(),
+      stack: z.lazy(() =>
+        SyncListResponsePreparedStackOverrideAzureStack$inboundSchema
+      ).optional(),
+    });
+
+export function syncListResponsePreparedStackOverrideAzureBindingFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideAzureBinding,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideAzureBinding$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideAzureBinding' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideAzureGrant$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackOverrideAzureGrant, unknown> = z
+    .object({
+      actions: z.nullable(z.array(z.string())).optional(),
+      dataActions: z.nullable(z.array(z.string())).optional(),
+      permissions: z.nullable(z.array(z.string())).optional(),
+      predefinedRoles: z.nullable(z.array(z.string())).optional(),
+      residualPermissions: z.nullable(z.array(z.string())).optional(),
+    });
+
+export function syncListResponsePreparedStackOverrideAzureGrantFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideAzureGrant,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideAzureGrant$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideAzureGrant' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideAzure$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackOverrideAzure, unknown> = z.object({
+    binding: z.lazy(() =>
+      SyncListResponsePreparedStackOverrideAzureBinding$inboundSchema
+    ),
+    description: z.nullable(z.string()).optional(),
+    grant: z.lazy(() =>
+      SyncListResponsePreparedStackOverrideAzureGrant$inboundSchema
+    ),
+    label: z.nullable(z.string()).optional(),
+  });
+
+export function syncListResponsePreparedStackOverrideAzureFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideAzure,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideAzure$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideAzure' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideConditionResource$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackOverrideConditionResource, unknown> = z
+    .object({
+      expression: z.string(),
+      title: z.string(),
+    });
+
+export function syncListResponsePreparedStackOverrideConditionResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideConditionResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideConditionResource$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideConditionResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideResourceConditionUnion$inboundSchema:
+  z.ZodType<
+    SyncListResponsePreparedStackOverrideResourceConditionUnion,
+    unknown
+  > = z.union([
+    z.lazy(() =>
+      SyncListResponsePreparedStackOverrideConditionResource$inboundSchema
+    ),
+    z.string(),
+  ]);
+
+export function syncListResponsePreparedStackOverrideResourceConditionUnionFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideResourceConditionUnion,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideResourceConditionUnion$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideResourceConditionUnion' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideGcpResource$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackOverrideGcpResource, unknown> = z
+    .object({
+      condition: z.nullable(
+        z.union([
+          z.lazy(() =>
+            SyncListResponsePreparedStackOverrideConditionResource$inboundSchema
+          ),
+          z.string(),
+        ]),
+      ).optional(),
+      scope: z.string(),
+    });
+
+export function syncListResponsePreparedStackOverrideGcpResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideGcpResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideGcpResource$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideGcpResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideConditionStack$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackOverrideConditionStack, unknown> = z
+    .object({
+      expression: z.string(),
+      title: z.string(),
+    });
+
+export function syncListResponsePreparedStackOverrideConditionStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideConditionStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideConditionStack$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideConditionStack' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideStackConditionUnion$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackOverrideStackConditionUnion, unknown> =
+    z.union([
+      z.lazy(() =>
+        SyncListResponsePreparedStackOverrideConditionStack$inboundSchema
+      ),
+      z.string(),
+    ]);
+
+export function syncListResponsePreparedStackOverrideStackConditionUnionFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideStackConditionUnion,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideStackConditionUnion$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideStackConditionUnion' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideGcpStack$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackOverrideGcpStack, unknown> = z.object({
+    condition: z.nullable(
+      z.union([
+        z.lazy(() =>
+          SyncListResponsePreparedStackOverrideConditionStack$inboundSchema
+        ),
+        z.string(),
+      ]),
+    ).optional(),
+    scope: z.string(),
+  });
+
+export function syncListResponsePreparedStackOverrideGcpStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideGcpStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideGcpStack$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideGcpStack' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideGcpBinding$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackOverrideGcpBinding, unknown> = z
+    .object({
+      resource: z.lazy(() =>
+        SyncListResponsePreparedStackOverrideGcpResource$inboundSchema
+      ).optional(),
+      stack: z.lazy(() =>
+        SyncListResponsePreparedStackOverrideGcpStack$inboundSchema
+      ).optional(),
+    });
+
+export function syncListResponsePreparedStackOverrideGcpBindingFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideGcpBinding,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideGcpBinding$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideGcpBinding' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideGcpGrant$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackOverrideGcpGrant, unknown> = z.object({
+    actions: z.nullable(z.array(z.string())).optional(),
+    dataActions: z.nullable(z.array(z.string())).optional(),
+    permissions: z.nullable(z.array(z.string())).optional(),
+    predefinedRoles: z.nullable(z.array(z.string())).optional(),
+    residualPermissions: z.nullable(z.array(z.string())).optional(),
+  });
+
+export function syncListResponsePreparedStackOverrideGcpGrantFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideGcpGrant,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideGcpGrant$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideGcpGrant' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideGcp$inboundSchema: z.ZodType<
+  SyncListResponsePreparedStackOverrideGcp,
+  unknown
+> = z.object({
+  binding: z.lazy(() =>
+    SyncListResponsePreparedStackOverrideGcpBinding$inboundSchema
+  ),
+  description: z.nullable(z.string()).optional(),
+  grant: z.lazy(() =>
+    SyncListResponsePreparedStackOverrideGcpGrant$inboundSchema
+  ),
+  label: z.nullable(z.string()).optional(),
+});
+
+export function syncListResponsePreparedStackOverrideGcpFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideGcp,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideGcp$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideGcp' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverridePlatforms$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackOverridePlatforms, unknown> = z.object(
+    {
+      aws: z.nullable(z.array(z.lazy(() =>
+        SyncListResponsePreparedStackOverrideAw$inboundSchema
+      ))).optional(),
+      azure: z.nullable(z.array(z.lazy(() =>
+        SyncListResponsePreparedStackOverrideAzure$inboundSchema
+      ))).optional(),
+      gcp: z.nullable(z.array(z.lazy(() =>
+        SyncListResponsePreparedStackOverrideGcp$inboundSchema
+      ))).optional(),
+    },
+  );
+
+export function syncListResponsePreparedStackOverridePlatformsFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverridePlatforms,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverridePlatforms$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackOverridePlatforms' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverride$inboundSchema: z.ZodType<
+  SyncListResponsePreparedStackOverride,
+  unknown
+> = z.object({
+  description: z.string(),
+  id: z.string(),
+  platforms: z.lazy(() =>
+    SyncListResponsePreparedStackOverridePlatforms$inboundSchema
+  ),
+});
+
+export function syncListResponsePreparedStackOverrideFromJSON(
+  jsonString: string,
+): SafeParseResult<SyncListResponsePreparedStackOverride, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverride$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'SyncListResponsePreparedStackOverride' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackOverrideUnion$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackOverrideUnion, unknown> = z.union([
+    z.lazy(() => SyncListResponsePreparedStackOverride$inboundSchema),
+    z.string(),
+  ]);
+
+export function syncListResponsePreparedStackOverrideUnionFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackOverrideUnion,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackOverrideUnion$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackOverrideUnion' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackManagement2$inboundSchema: z.ZodType<
+  SyncListResponsePreparedStackManagement2,
+  unknown
+> = z.object({
+  override: z.record(
+    z.string(),
+    z.array(z.union([
+      z.lazy(() => SyncListResponsePreparedStackOverride$inboundSchema),
+      z.string(),
+    ])),
+  ),
+});
+
+export function syncListResponsePreparedStackManagement2FromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackManagement2,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackManagement2$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackManagement2' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackExtendAwResource$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackExtendAwResource, unknown> = z.object({
+    condition: z.nullable(
+      z.record(z.string(), z.record(z.string(), z.string())),
+    ).optional(),
+    notResources: z.array(z.string()).optional(),
+    resources: z.array(z.string()),
+  });
+
+export function syncListResponsePreparedStackExtendAwResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackExtendAwResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackExtendAwResource$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackExtendAwResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackExtendAwStack$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackExtendAwStack, unknown> = z.object({
+    condition: z.nullable(
+      z.record(z.string(), z.record(z.string(), z.string())),
+    ).optional(),
+    notResources: z.array(z.string()).optional(),
+    resources: z.array(z.string()),
+  });
+
+export function syncListResponsePreparedStackExtendAwStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackExtendAwStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackExtendAwStack$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackExtendAwStack' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackExtendAwBinding$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackExtendAwBinding, unknown> = z.object({
+    resource: z.lazy(() =>
+      SyncListResponsePreparedStackExtendAwResource$inboundSchema
+    ).optional(),
+    stack: z.lazy(() =>
+      SyncListResponsePreparedStackExtendAwStack$inboundSchema
+    ).optional(),
+  });
+
+export function syncListResponsePreparedStackExtendAwBindingFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackExtendAwBinding,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackExtendAwBinding$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackExtendAwBinding' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackExtendEffect$inboundSchema: z.ZodEnum<
+  typeof SyncListResponsePreparedStackExtendEffect
+> = z.enum(SyncListResponsePreparedStackExtendEffect);
+
+/** @internal */
+export const SyncListResponsePreparedStackExtendAwGrant$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackExtendAwGrant, unknown> = z.object({
+    actions: z.nullable(z.array(z.string())).optional(),
+    dataActions: z.nullable(z.array(z.string())).optional(),
+    permissions: z.nullable(z.array(z.string())).optional(),
+    predefinedRoles: z.nullable(z.array(z.string())).optional(),
+    residualPermissions: z.nullable(z.array(z.string())).optional(),
+  });
+
+export function syncListResponsePreparedStackExtendAwGrantFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackExtendAwGrant,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackExtendAwGrant$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackExtendAwGrant' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackExtendAw$inboundSchema: z.ZodType<
+  SyncListResponsePreparedStackExtendAw,
+  unknown
+> = z.object({
+  binding: z.lazy(() =>
+    SyncListResponsePreparedStackExtendAwBinding$inboundSchema
+  ),
+  description: z.nullable(z.string()).optional(),
+  effect: SyncListResponsePreparedStackExtendEffect$inboundSchema.optional(),
+  grant: z.lazy(() => SyncListResponsePreparedStackExtendAwGrant$inboundSchema),
+  label: z.nullable(z.string()).optional(),
+});
+
+export function syncListResponsePreparedStackExtendAwFromJSON(
+  jsonString: string,
+): SafeParseResult<SyncListResponsePreparedStackExtendAw, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackExtendAw$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'SyncListResponsePreparedStackExtendAw' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackExtendAzureResource$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackExtendAzureResource, unknown> = z
+    .object({
+      scope: z.string(),
+    });
+
+export function syncListResponsePreparedStackExtendAzureResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackExtendAzureResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackExtendAzureResource$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackExtendAzureResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackExtendAzureStack$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackExtendAzureStack, unknown> = z.object({
+    scope: z.string(),
+  });
+
+export function syncListResponsePreparedStackExtendAzureStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackExtendAzureStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackExtendAzureStack$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackExtendAzureStack' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackExtendAzureBinding$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackExtendAzureBinding, unknown> = z
+    .object({
+      resource: z.lazy(() =>
+        SyncListResponsePreparedStackExtendAzureResource$inboundSchema
+      ).optional(),
+      stack: z.lazy(() =>
+        SyncListResponsePreparedStackExtendAzureStack$inboundSchema
+      ).optional(),
+    });
+
+export function syncListResponsePreparedStackExtendAzureBindingFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackExtendAzureBinding,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackExtendAzureBinding$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackExtendAzureBinding' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackExtendAzureGrant$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackExtendAzureGrant, unknown> = z.object({
+    actions: z.nullable(z.array(z.string())).optional(),
+    dataActions: z.nullable(z.array(z.string())).optional(),
+    permissions: z.nullable(z.array(z.string())).optional(),
+    predefinedRoles: z.nullable(z.array(z.string())).optional(),
+    residualPermissions: z.nullable(z.array(z.string())).optional(),
+  });
+
+export function syncListResponsePreparedStackExtendAzureGrantFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackExtendAzureGrant,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackExtendAzureGrant$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackExtendAzureGrant' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackExtendAzure$inboundSchema: z.ZodType<
+  SyncListResponsePreparedStackExtendAzure,
+  unknown
+> = z.object({
+  binding: z.lazy(() =>
+    SyncListResponsePreparedStackExtendAzureBinding$inboundSchema
+  ),
+  description: z.nullable(z.string()).optional(),
+  grant: z.lazy(() =>
+    SyncListResponsePreparedStackExtendAzureGrant$inboundSchema
+  ),
+  label: z.nullable(z.string()).optional(),
+});
+
+export function syncListResponsePreparedStackExtendAzureFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackExtendAzure,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackExtendAzure$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackExtendAzure' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackExtendConditionResource$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackExtendConditionResource, unknown> = z
+    .object({
+      expression: z.string(),
+      title: z.string(),
+    });
+
+export function syncListResponsePreparedStackExtendConditionResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackExtendConditionResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackExtendConditionResource$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackExtendConditionResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackExtendResourceConditionUnion$inboundSchema:
+  z.ZodType<
+    SyncListResponsePreparedStackExtendResourceConditionUnion,
+    unknown
+  > = z.union([
+    z.lazy(() =>
+      SyncListResponsePreparedStackExtendConditionResource$inboundSchema
+    ),
+    z.string(),
+  ]);
+
+export function syncListResponsePreparedStackExtendResourceConditionUnionFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackExtendResourceConditionUnion,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackExtendResourceConditionUnion$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'SyncListResponsePreparedStackExtendResourceConditionUnion' from JSON`,
+  );
+}
+
+/** @internal */
+export const SyncListResponsePreparedStackExtendGcpResource$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackExtendGcpResource, unknown> = z.object(
+    {
+      condition: z.nullable(z.union([
+        z.lazy(() =>
+          SyncListResponsePreparedStackExtendConditionResource$inboundSchema
+        ),
+        z.string(),
+      ])).optional(),
+      scope: z.string(),
+    },
+  );
 
-/**
- * Management configuration for different cloud platforms.
- *
- * @remarks
- *
- * Platform-derived configuration for cross-account/cross-tenant access.
- * This is NOT user-specified - it's derived from the Manager's ServiceAccount.
- */
-export type SyncListResponseManagementConfigUnion =
-  | SyncListResponseManagementConfigAzure
-  | SyncListResponseManagementConfigAws
-  | SyncListResponseManagementConfigGcp
-  | SyncListResponseManagementConfigKubernetes
-  | string;
+export function syncListResponsePreparedStackExtendGcpResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackExtendGcpResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackExtendGcpResource$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackExtendGcpResource' from JSON`,
+  );
+}
 
-export type SyncListResponseDeployment = {
-  /**
-   * Unique identifier for the deployment.
-   */
-  id: string;
-  /**
-   * Deployment name.
-   */
-  name: string;
-  /**
-   * Public subdomain for auto-generated domains
-   */
-  publicSubdomain?: string | null | undefined;
-  /**
-   * Deployment status in the deployment lifecycle.
-   *
-   * @remarks
-   *
-   * For observe-only deployments with no release or stack state, `Running`
-   * means the Operator is attached. Connectivity comes from `lastHeartbeatAt`;
-   * resource health comes from inventory and resource heartbeat data.
-   */
-  status: SyncListResponseStatus;
-  /**
-   * Unique identifier for the project.
-   */
-  projectId: string;
-  /**
-   * Target platform for the deployment
-   */
-  platform: SyncListResponsePlatform;
-  /**
-   * Underlying cloud platform for Kubernetes deployments.
-   */
-  basePlatform?: SyncListResponseBasePlatform | null | undefined;
-  /**
-   * Cloud region or location for the deployment.
-   */
-  region?: string | null | undefined;
-  /**
-   * DeploymentState protocol version owned by the runtime/manager
-   */
-  deploymentProtocolVersion: number;
-  /**
-   * ID of deployment group this deployment belongs to
-   */
-  deploymentGroupId: string;
-  /**
-   * Operational purpose of this deployment within its customer environment.
-   */
-  purpose: DeploymentPurpose;
-  /**
-   * Cloud environment information
-   */
-  environmentInfo?: SyncListResponseEnvironmentInfoUnion | null | undefined;
-  /**
-   * User-provided configuration (network, deployment model, approvals)
-   */
-  stackSettings: SyncListResponseStackSettings;
-  /**
-   * State of infrastructure components managed by this deployment
-   */
-  stackState?: SyncListResponseStackState | null | undefined;
-  /**
-   * Runtime metadata for deployment state persistence
-   */
-  runtimeMetadata?: SyncListResponseRuntimeMetadata | null | undefined;
-  /**
-   * ID of the currently deployed release (actual state)
-   */
-  currentReleaseId?: string | null | undefined;
-  /**
-   * ID of the desired release for deployment/update (desired state)
-   */
-  desiredReleaseId?: string | null | undefined;
-  /**
-   * ID of the pinned release
-   */
-  pinnedReleaseId?: string | null | undefined;
-  releaseChannel: string;
-  /**
-   * Setup source that imported this deployment
-   */
-  importSource?: SyncListResponseImportSource | null | undefined;
-  /**
-   * Setup method that created the deployment record and owns setup-time resources.
-   */
-  setupMethod?: SyncListResponseSetupMethod | null | undefined;
-  /**
-   * Setup method metadata needed to guide privileged teardown.
-   */
-  setupMetadata?: { [k: string]: any | null } | null | undefined;
-  /**
-   * Imported setup target for compatibility checks
-   */
-  setupTarget?: string | null | undefined;
-  /**
-   * Imported setup compatibility fingerprint
-   */
-  setupFingerprint?: string | null | undefined;
-  /**
-   * Imported setup fingerprint algorithm version
-   */
-  setupFingerprintVersion?: number | null | undefined;
-  /**
-   * Display-only scope reported by the Operator manifest
-   */
-  operatorScope?: string | null | undefined;
-  /**
-   * Display-only permission tier reported by the Operator manifest
-   */
-  operatorPermission?: string | null | undefined;
-  /**
-   * Version reported by the Operator
-   */
-  operatorVersion?: string | null | undefined;
-  /**
-   * Capability state reported by the Operator
-   */
-  capabilities?: Array<OperatorCapabilityReport> | null | undefined;
-  /**
-   * Enabled-plugin-bundle-set hash the Operator reports having loaded
-   */
-  observedOperationsBundleHash?: string | null | undefined;
-  /**
-   * Operations the Operator reports as currently loaded
-   */
-  observedOperations?: Array<ReportedOperation> | null | undefined;
-  /**
-   * Whether a retry has been requested for a failed deployment
-   */
-  retryRequested: boolean;
-  /**
-   * Timestamp of the last received heartbeat from the deployment
-   */
-  lastHeartbeatAt?: Date | null | undefined;
-  /**
-   * Latest error information if the deployment is in a failed state
-   */
-  error?: SyncListResponseError | null | undefined;
-  /**
-   * Durable progress for deployment updates
-   */
-  updateState?: SyncListResponseUpdateState | undefined;
-  createdAt: Date;
-  updatedAt: Date;
-  managerId: string;
-  /**
-   * Unique identifier for the workspace.
-   */
-  workspaceId: string;
-  userEnvironmentVariables: Array<EnvironmentVariableConfig> | null;
-  /**
-   * Management configuration for different cloud platforms.
-   *
-   * @remarks
-   *
-   * Platform-derived configuration for cross-account/cross-tenant access.
-   * This is NOT user-specified - it's derived from the Manager's ServiceAccount.
-   */
-  managementConfig?:
-    | SyncListResponseManagementConfigAzure
-    | SyncListResponseManagementConfigAws
-    | SyncListResponseManagementConfigGcp
-    | SyncListResponseManagementConfigKubernetes
-    | string
-    | null
-    | undefined;
-  deploymentToken?: string | null | undefined;
-  lockedBy?: string | null | undefined;
-  lockedAt?: Date | null | undefined;
-};
+/** @internal */
+export const SyncListResponsePreparedStackExtendConditionStack$inboundSchema:
+  z.ZodType<SyncListResponsePreparedStackExtendConditionStack, unknown> = z
+    .object({
+      expression: z.string(),
+      title: z.string(),
+    });
 
-/**
- * Full deployment records for manager operation
- */
-export type SyncListResponse = {
-  deployments: Array<SyncListResponseDeployment>;
-};
+export function syncListResponsePreparedStackExtendConditionStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  SyncListResponsePreparedStackExtendConditionStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      SyncListResponsePreparedStackExtendConditionStack$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'SyncListResponsePreparedStackExtendConditionStack' from JSON`,
+  );
+}
 
 /** @internal */
 export const SyncListResponsePreparedStackExtendStackConditionUnion$inboundSchema:
   z.ZodType<SyncListResponsePreparedStackExtendStackConditionUnion, unknown> = z
     .union([
-      SyncListResponsePreparedStackExtendConditionStack$inboundSchema,
+      z.lazy(() =>
+        SyncListResponsePreparedStackExtendConditionStack$inboundSchema
+      ),
       z.string(),
     ]);
 
@@ -1363,7 +2988,9 @@ export const SyncListResponsePreparedStackExtendGcpStack$inboundSchema:
   z.ZodType<SyncListResponsePreparedStackExtendGcpStack, unknown> = z.object({
     condition: z.nullable(
       z.union([
-        SyncListResponsePreparedStackExtendConditionStack$inboundSchema,
+        z.lazy(() =>
+          SyncListResponsePreparedStackExtendConditionStack$inboundSchema
+        ),
         z.string(),
       ]),
     ).optional(),
@@ -1389,8 +3016,9 @@ export function syncListResponsePreparedStackExtendGcpStackFromJSON(
 /** @internal */
 export const SyncListResponsePreparedStackExtendGcpBinding$inboundSchema:
   z.ZodType<SyncListResponsePreparedStackExtendGcpBinding, unknown> = z.object({
-    resource: SyncListResponsePreparedStackExtendGcpResource$inboundSchema
-      .optional(),
+    resource: z.lazy(() =>
+      SyncListResponsePreparedStackExtendGcpResource$inboundSchema
+    ).optional(),
     stack: z.lazy(() =>
       SyncListResponsePreparedStackExtendGcpStack$inboundSchema
     ).optional(),
@@ -1468,10 +3096,14 @@ export function syncListResponsePreparedStackExtendGcpFromJSON(
 export const SyncListResponsePreparedStackExtendPlatforms$inboundSchema:
   z.ZodType<SyncListResponsePreparedStackExtendPlatforms, unknown> = z.object({
     aws: z.nullable(
-      z.array(SyncListResponsePreparedStackExtendAw$inboundSchema),
+      z.array(
+        z.lazy(() => SyncListResponsePreparedStackExtendAw$inboundSchema),
+      ),
     ).optional(),
     azure: z.nullable(
-      z.array(SyncListResponsePreparedStackExtendAzure$inboundSchema),
+      z.array(z.lazy(() =>
+        SyncListResponsePreparedStackExtendAzure$inboundSchema
+      )),
     ).optional(),
     gcp: z.nullable(
       z.array(
@@ -1578,7 +3210,7 @@ export function syncListResponsePreparedStackManagement1FromJSON(
 export const SyncListResponsePreparedStackManagementUnion$inboundSchema:
   z.ZodType<SyncListResponsePreparedStackManagementUnion, unknown> = z.union([
     z.lazy(() => SyncListResponsePreparedStackManagement1$inboundSchema),
-    SyncListResponsePreparedStackManagement2$inboundSchema,
+    z.lazy(() => SyncListResponsePreparedStackManagement2$inboundSchema),
     SyncListResponsePreparedStackManagementEnum$inboundSchema,
   ]);
 
@@ -2210,7 +3842,7 @@ export const SyncListResponsePreparedStackPermissions$inboundSchema: z.ZodType<
 > = z.object({
   management: z.union([
     z.lazy(() => SyncListResponsePreparedStackManagement1$inboundSchema),
-    SyncListResponsePreparedStackManagement2$inboundSchema,
+    z.lazy(() => SyncListResponsePreparedStackManagement2$inboundSchema),
     SyncListResponsePreparedStackManagementEnum$inboundSchema,
   ]).optional(),
   profiles: z.record(
@@ -2337,6 +3969,9 @@ export const SyncListResponsePreparedStack$inboundSchema: z.ZodType<
   dynamicContainerRepositories: z.array(z.string()).optional(),
   id: z.string(),
   inputs: z.array(SyncListResponsePreparedStackInput$inboundSchema).optional(),
+  operations: z.nullable(
+    SyncListResponsePreparedStackOperationsUnion$inboundSchema,
+  ).optional(),
   permissions: z.lazy(() =>
     SyncListResponsePreparedStackPermissions$inboundSchema
   ).optional(),
@@ -2789,6 +4424,8 @@ export const SyncListResponseDeployment$inboundSchema: z.ZodType<
   region: z.nullable(z.string()).optional(),
   deploymentProtocolVersion: z.int(),
   deploymentGroupId: z.string(),
+  membershipRevision: z.int().default(0),
+  membershipProjectionRevision: z.nullable(z.int()).default(null),
   purpose: DeploymentPurpose$inboundSchema,
   environmentInfo: z.nullable(
     SyncListResponseEnvironmentInfoUnion$inboundSchema,