@alienplatform/platform-api 3.3.30 → 3.3.32

package/src/models/deployment.ts

@@ -26,25 +26,15 @@ import {
   DeploymentStackState$inboundSchema,
   DeploymentStatus,
   DeploymentStatus$inboundSchema,
-} from "./deploymentpendingpreparedstacktypeunion.js";
+} from "./deploymentpendingpreparedstacktypeenvenum.js";
 import {
   DeploymentPendingPreparedStackUnion,
   DeploymentPendingPreparedStackUnion$inboundSchema,
-  DeploymentPreparedStackExtendAw,
-  DeploymentPreparedStackExtendAw$inboundSchema,
-  DeploymentPreparedStackExtendAzure,
-  DeploymentPreparedStackExtendAzure$inboundSchema,
-  DeploymentPreparedStackExtendConditionStack,
-  DeploymentPreparedStackExtendConditionStack$inboundSchema,
-  DeploymentPreparedStackExtendGcpResource,
-  DeploymentPreparedStackExtendGcpResource$inboundSchema,
   DeploymentPreparedStackInput,
   DeploymentPreparedStackInput$inboundSchema,
-  DeploymentPreparedStackManagement2,
-  DeploymentPreparedStackManagement2$inboundSchema,
-  DeploymentPreparedStackManagementEnum,
-  DeploymentPreparedStackManagementEnum$inboundSchema,
-} from "./deploymentpreparedstackextendconditionstack.js";
+  DeploymentPreparedStackOperations,
+  DeploymentPreparedStackOperations$inboundSchema,
+} from "./deploymentpreparedstackoperations.js";
 import {
   DeploymentPurpose,
   DeploymentPurpose$inboundSchema,
@@ -63,152 +53,21 @@ import {
   ReportedOperation$inboundSchema,
 } from "./reportedoperation.js";
 
-export type DeploymentPreparedStackExtendStackConditionUnion =
-  | DeploymentPreparedStackExtendConditionStack
-  | string;
-
-/**
- * GCP-specific binding specification
- */
-export type DeploymentPreparedStackExtendGcpStack = {
-  condition?:
-    | DeploymentPreparedStackExtendConditionStack
-    | string
-    | null
-    | undefined;
-  /**
-   * Scope (project/resource level)
-   */
-  scope: string;
-};
-
-/**
- * Generic binding configuration for permissions
- */
-export type DeploymentPreparedStackExtendGcpBinding = {
-  /**
-   * GCP-specific binding specification
-   */
-  resource?: DeploymentPreparedStackExtendGcpResource | undefined;
-  /**
-   * GCP-specific binding specification
-   */
-  stack?: DeploymentPreparedStackExtendGcpStack | undefined;
-};
-
-/**
- * Grant permissions for a specific cloud platform
- */
-export type DeploymentPreparedStackExtendGcpGrant = {
-  /**
-   * AWS IAM actions (only for AWS)
-   */
-  actions?: Array<string> | null | undefined;
-  /**
-   * Azure actions (only for Azure)
-   */
-  dataActions?: Array<string> | null | undefined;
-  /**
-   * GCP permissions that require an exact residual custom role.
-   */
-  permissions?: Array<string> | null | undefined;
-  /**
-   * Provider predefined roles to bind directly.
-   */
-  predefinedRoles?: Array<string> | null | undefined;
-  /**
-   * GCP residual custom permissions to pair with predefined roles.
-   */
-  residualPermissions?: Array<string> | null | undefined;
-};
-
-/**
- * GCP-specific platform permission configuration
- */
-export type DeploymentPreparedStackExtendGcp = {
-  /**
-   * Generic binding configuration for permissions
-   */
-  binding: DeploymentPreparedStackExtendGcpBinding;
-  /**
-   * Short admin-facing description of why this entry exists.
-   */
-  description?: string | null | undefined;
-  /**
-   * Grant permissions for a specific cloud platform
-   */
-  grant: DeploymentPreparedStackExtendGcpGrant;
-  /**
-   * Stable admin-facing label for this permission entry.
-   */
-  label?: string | null | undefined;
-};
-
-/**
- * Platform-specific permission configurations
- */
-export type DeploymentPreparedStackExtendPlatforms = {
-  /**
-   * AWS permission configurations
-   */
-  aws?: Array<DeploymentPreparedStackExtendAw> | null | undefined;
-  /**
-   * Azure permission configurations
-   */
-  azure?: Array<DeploymentPreparedStackExtendAzure> | null | undefined;
-  /**
-   * GCP permission configurations
-   */
-  gcp?: Array<DeploymentPreparedStackExtendGcp> | null | undefined;
-};
-
-/**
- * A permission set that can be applied across different cloud platforms
- */
-export type DeploymentPreparedStackExtend = {
-  /**
-   * Human-readable description of what this permission set allows
-   */
-  description: string;
-  /**
-   * Unique identifier for the permission set (e.g., "storage/data-read")
-   */
-  id: string;
-  /**
-   * Platform-specific permission configurations
-   */
-  platforms: DeploymentPreparedStackExtendPlatforms;
-};
-
-/**
- * Reference to a permission set - either by name or inline definition
- */
-export type DeploymentPreparedStackExtendUnion =
-  | DeploymentPreparedStackExtend
+export type DeploymentPreparedStackOperationsUnion =
+  | DeploymentPreparedStackOperations
   | string;
 
-export type DeploymentPreparedStackManagement1 = {
-  /**
-   * Permission profile that maps resources to permission sets
-   *
-   * @remarks
-   * Key can be "*" for all resources or resource name for specific resource
-   */
-  extend: { [k: string]: Array<DeploymentPreparedStackExtend | string> };
-};
-
-/**
- * Management permissions configuration for stack management access
- */
-export type DeploymentPreparedStackManagementUnion =
-  | DeploymentPreparedStackManagement1
-  | DeploymentPreparedStackManagement2
-  | DeploymentPreparedStackManagementEnum;
+export const DeploymentPreparedStackManagementEnum = {
+  Auto: "auto",
+} as const;
+export type DeploymentPreparedStackManagementEnum = ClosedEnum<
+  typeof DeploymentPreparedStackManagementEnum
+>;
 
 /**
  * AWS-specific binding specification
  */
-export type DeploymentPreparedStackProfileAwResource = {
+export type DeploymentPreparedStackOverrideAwResource = {
   /**
    * Optional condition for additional filtering (rare)
    */
@@ -230,7 +89,7 @@ export type DeploymentPreparedStackProfileAwResource = {
 /**
  * AWS-specific binding specification
  */
-export type DeploymentPreparedStackProfileAwStack = {
+export type DeploymentPreparedStackOverrideAwStack = {
   /**
    * Optional condition for additional filtering (rare)
    */
@@ -252,35 +111,35 @@ export type DeploymentPreparedStackProfileAwStack = {
 /**
  * Generic binding configuration for permissions
  */
-export type DeploymentPreparedStackProfileAwBinding = {
+export type DeploymentPreparedStackOverrideAwBinding = {
   /**
    * AWS-specific binding specification
    */
-  resource?: DeploymentPreparedStackProfileAwResource | undefined;
+  resource?: DeploymentPreparedStackOverrideAwResource | undefined;
   /**
    * AWS-specific binding specification
    */
-  stack?: DeploymentPreparedStackProfileAwStack | undefined;
+  stack?: DeploymentPreparedStackOverrideAwStack | undefined;
 };
 
 /**
  * IAM effect. Defaults to Allow.
  */
-export const DeploymentPreparedStackProfileEffect = {
+export const DeploymentPreparedStackOverrideEffect = {
   Allow: "Allow",
   Deny: "Deny",
 } as const;
 /**
  * IAM effect. Defaults to Allow.
  */
-export type DeploymentPreparedStackProfileEffect = ClosedEnum<
-  typeof DeploymentPreparedStackProfileEffect
+export type DeploymentPreparedStackOverrideEffect = ClosedEnum<
+  typeof DeploymentPreparedStackOverrideEffect
 >;
 
 /**
  * Grant permissions for a specific cloud platform
  */
-export type DeploymentPreparedStackProfileAwGrant = {
+export type DeploymentPreparedStackOverrideAwGrant = {
   /**
    * AWS IAM actions (only for AWS)
    */
@@ -306,11 +165,11 @@ export type DeploymentPreparedStackProfileAwGrant = {
 /**
  * AWS-specific platform permission configuration
  */
-export type DeploymentPreparedStackProfileAw = {
+export type DeploymentPreparedStackOverrideAw = {
   /**
    * Generic binding configuration for permissions
    */
-  binding: DeploymentPreparedStackProfileAwBinding;
+  binding: DeploymentPreparedStackOverrideAwBinding;
   /**
    * Short admin-facing description of why this entry exists.
    */
@@ -318,11 +177,11 @@ export type DeploymentPreparedStackProfileAw = {
   /**
    * IAM effect. Defaults to Allow.
    */
-  effect?: DeploymentPreparedStackProfileEffect | undefined;
+  effect?: DeploymentPreparedStackOverrideEffect | undefined;
   /**
    * Grant permissions for a specific cloud platform
    */
-  grant: DeploymentPreparedStackProfileAwGrant;
+  grant: DeploymentPreparedStackOverrideAwGrant;
   /**
    * Stable admin-facing label for this permission entry.
    */
@@ -332,7 +191,7 @@ export type DeploymentPreparedStackProfileAw = {
 /**
  * Azure-specific binding specification
  */
-export type DeploymentPreparedStackProfileAzureResource = {
+export type DeploymentPreparedStackOverrideAzureResource = {
   /**
    * Scope (subscription/resource group/resource level)
    */
@@ -342,7 +201,7 @@ export type DeploymentPreparedStackProfileAzureResource = {
 /**
  * Azure-specific binding specification
  */
-export type DeploymentPreparedStackProfileAzureStack = {
+export type DeploymentPreparedStackOverrideAzureStack = {
   /**
    * Scope (subscription/resource group/resource level)
    */
@@ -352,21 +211,21 @@ export type DeploymentPreparedStackProfileAzureStack = {
 /**
  * Generic binding configuration for permissions
  */
-export type DeploymentPreparedStackProfileAzureBinding = {
+export type DeploymentPreparedStackOverrideAzureBinding = {
   /**
    * Azure-specific binding specification
    */
-  resource?: DeploymentPreparedStackProfileAzureResource | undefined;
+  resource?: DeploymentPreparedStackOverrideAzureResource | undefined;
   /**
    * Azure-specific binding specification
    */
-  stack?: DeploymentPreparedStackProfileAzureStack | undefined;
+  stack?: DeploymentPreparedStackOverrideAzureStack | undefined;
 };
 
 /**
  * Grant permissions for a specific cloud platform
  */
-export type DeploymentPreparedStackProfileAzureGrant = {
+export type DeploymentPreparedStackOverrideAzureGrant = {
   /**
    * AWS IAM actions (only for AWS)
    */
@@ -392,11 +251,11 @@ export type DeploymentPreparedStackProfileAzureGrant = {
 /**
  * Azure-specific platform permission configuration
  */
-export type DeploymentPreparedStackProfileAzure = {
+export type DeploymentPreparedStackOverrideAzure = {
   /**
    * Generic binding configuration for permissions
    */
-  binding: DeploymentPreparedStackProfileAzureBinding;
+  binding: DeploymentPreparedStackOverrideAzureBinding;
   /**
    * Short admin-facing description of why this entry exists.
    */
@@ -404,7 +263,7 @@ export type DeploymentPreparedStackProfileAzure = {
   /**
    * Grant permissions for a specific cloud platform
    */
-  grant: DeploymentPreparedStackProfileAzureGrant;
+  grant: DeploymentPreparedStackOverrideAzureGrant;
   /**
    * Stable admin-facing label for this permission entry.
    */
@@ -414,21 +273,21 @@ export type DeploymentPreparedStackProfileAzure = {
 /**
  * GCP IAM condition
  */
-export type DeploymentPreparedStackProfileConditionResource = {
+export type DeploymentPreparedStackOverrideConditionResource = {
   expression: string;
   title: string;
 };
 
-export type DeploymentPreparedStackProfileResourceConditionUnion =
-  | DeploymentPreparedStackProfileConditionResource
+export type DeploymentPreparedStackOverrideResourceConditionUnion =
+  | DeploymentPreparedStackOverrideConditionResource
   | string;
 
 /**
  * GCP-specific binding specification
  */
-export type DeploymentPreparedStackProfileGcpResource = {
+export type DeploymentPreparedStackOverrideGcpResource = {
   condition?:
-    | DeploymentPreparedStackProfileConditionResource
+    | DeploymentPreparedStackOverrideConditionResource
     | string
     | null
     | undefined;
@@ -441,21 +300,21 @@ export type DeploymentPreparedStackProfileGcpResource = {
 /**
  * GCP IAM condition
  */
-export type DeploymentPreparedStackProfileConditionStack = {
+export type DeploymentPreparedStackOverrideConditionStack = {
   expression: string;
   title: string;
 };
 
-export type DeploymentPreparedStackProfileStackConditionUnion =
-  | DeploymentPreparedStackProfileConditionStack
+export type DeploymentPreparedStackOverrideStackConditionUnion =
+  | DeploymentPreparedStackOverrideConditionStack
   | string;
 
 /**
  * GCP-specific binding specification
  */
-export type DeploymentPreparedStackProfileGcpStack = {
+export type DeploymentPreparedStackOverrideGcpStack = {
   condition?:
-    | DeploymentPreparedStackProfileConditionStack
+    | DeploymentPreparedStackOverrideConditionStack
     | string
     | null
     | undefined;
@@ -468,21 +327,21 @@ export type DeploymentPreparedStackProfileGcpStack = {
 /**
  * Generic binding configuration for permissions
  */
-export type DeploymentPreparedStackProfileGcpBinding = {
+export type DeploymentPreparedStackOverrideGcpBinding = {
   /**
    * GCP-specific binding specification
    */
-  resource?: DeploymentPreparedStackProfileGcpResource | undefined;
+  resource?: DeploymentPreparedStackOverrideGcpResource | undefined;
   /**
    * GCP-specific binding specification
    */
-  stack?: DeploymentPreparedStackProfileGcpStack | undefined;
+  stack?: DeploymentPreparedStackOverrideGcpStack | undefined;
 };
 
 /**
  * Grant permissions for a specific cloud platform
  */
-export type DeploymentPreparedStackProfileGcpGrant = {
+export type DeploymentPreparedStackOverrideGcpGrant = {
   /**
    * AWS IAM actions (only for AWS)
    */
@@ -508,11 +367,11 @@ export type DeploymentPreparedStackProfileGcpGrant = {
 /**
  * GCP-specific platform permission configuration
  */
-export type DeploymentPreparedStackProfileGcp = {
+export type DeploymentPreparedStackOverrideGcp = {
   /**
    * Generic binding configuration for permissions
    */
-  binding: DeploymentPreparedStackProfileGcpBinding;
+  binding: DeploymentPreparedStackOverrideGcpBinding;
   /**
    * Short admin-facing description of why this entry exists.
    */
@@ -520,7 +379,7 @@ export type DeploymentPreparedStackProfileGcp = {
   /**
    * Grant permissions for a specific cloud platform
    */
-  grant: DeploymentPreparedStackProfileGcpGrant;
+  grant: DeploymentPreparedStackOverrideGcpGrant;
   /**
    * Stable admin-facing label for this permission entry.
    */
@@ -530,25 +389,25 @@ export type DeploymentPreparedStackProfileGcp = {
 /**
  * Platform-specific permission configurations
  */
-export type DeploymentPreparedStackProfilePlatforms = {
+export type DeploymentPreparedStackOverridePlatforms = {
   /**
    * AWS permission configurations
    */
-  aws?: Array<DeploymentPreparedStackProfileAw> | null | undefined;
+  aws?: Array<DeploymentPreparedStackOverrideAw> | null | undefined;
   /**
    * Azure permission configurations
    */
-  azure?: Array<DeploymentPreparedStackProfileAzure> | null | undefined;
+  azure?: Array<DeploymentPreparedStackOverrideAzure> | null | undefined;
   /**
    * GCP permission configurations
    */
-  gcp?: Array<DeploymentPreparedStackProfileGcp> | null | undefined;
+  gcp?: Array<DeploymentPreparedStackOverrideGcp> | null | undefined;
 };
 
 /**
  * A permission set that can be applied across different cloud platforms
  */
-export type DeploymentPreparedStackProfile = {
+export type DeploymentPreparedStackOverride = {
   /**
    * Human-readable description of what this permission set allows
    */
@@ -560,654 +419,2377 @@ export type DeploymentPreparedStackProfile = {
   /**
    * Platform-specific permission configurations
    */
-  platforms: DeploymentPreparedStackProfilePlatforms;
+  platforms: DeploymentPreparedStackOverridePlatforms;
 };
 
 /**
  * Reference to a permission set - either by name or inline definition
  */
-export type DeploymentPreparedStackProfileUnion =
-  | DeploymentPreparedStackProfile
+export type DeploymentPreparedStackOverrideUnion =
+  | DeploymentPreparedStackOverride
   | string;
 
+export type DeploymentPreparedStackManagement2 = {
+  /**
+   * Permission profile that maps resources to permission sets
+   *
+   * @remarks
+   * Key can be "*" for all resources or resource name for specific resource
+   */
+  override: { [k: string]: Array<DeploymentPreparedStackOverride | string> };
+};
+
 /**
- * Combined permissions configuration that contains both profiles and management
+ * AWS-specific binding specification
  */
-export type DeploymentPreparedStackPermissions = {
+export type DeploymentPreparedStackExtendAwResource = {
   /**
-   * Management permissions configuration for stack management access
+   * Optional condition for additional filtering (rare)
    */
-  management?:
-    | DeploymentPreparedStackManagement1
-    | DeploymentPreparedStackManagement2
-    | DeploymentPreparedStackManagementEnum
-    | undefined;
+  condition?: { [k: string]: { [k: string]: string } } | null | undefined;
   /**
-   * Permission profiles that define access control for compute services
+   * ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a
    *
    * @remarks
-   * Key is the profile name, value is the permission configuration
+   * tag-on-create grant whose implied check AWS authorizes against no resource; the build
+   * refuses it anywhere else.
    */
-  profiles: {
-    [k: string]: {
-      [k: string]: Array<DeploymentPreparedStackProfile | string>;
-    };
-  };
+  notResources?: Array<string> | undefined;
+  /**
+   * Resource ARNs to bind to
+   */
+  resources: Array<string>;
 };
 
 /**
- * Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties.
+ * AWS-specific binding specification
  */
-export type DeploymentPreparedStackConfig = {
+export type DeploymentPreparedStackExtendAwStack = {
   /**
-   * The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+   * Optional condition for additional filtering (rare)
    */
-  id: string;
+  condition?: { [k: string]: { [k: string]: string } } | null | undefined;
   /**
-   * Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.
+   * ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a
+   *
+   * @remarks
+   * tag-on-create grant whose implied check AWS authorizes against no resource; the build
+   * refuses it anywhere else.
    */
-  type: string;
-  additionalProperties?: { [k: string]: any | null } | undefined;
+  notResources?: Array<string> | undefined;
+  /**
+   * Resource ARNs to bind to
+   */
+  resources: Array<string>;
 };
 
 /**
- * Reference to a resource by its stable id and resource type.
+ * Generic binding configuration for permissions
  */
-export type DeploymentPreparedStackDependency = {
-  id: string;
+export type DeploymentPreparedStackExtendAwBinding = {
   /**
-   * Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.
+   * AWS-specific binding specification
    */
-  type: string;
-};
+  resource?: DeploymentPreparedStackExtendAwResource | undefined;
+  /**
+   * AWS-specific binding specification
+   */
+  stack?: DeploymentPreparedStackExtendAwStack | undefined;
+};
 
 /**
- * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+ * IAM effect. Defaults to Allow.
  */
-export const DeploymentPreparedStackLifecycle = {
-  Frozen: "frozen",
-  Live: "live",
+export const DeploymentPreparedStackExtendEffect = {
+  Allow: "Allow",
+  Deny: "Deny",
 } as const;
 /**
- * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+ * IAM effect. Defaults to Allow.
  */
-export type DeploymentPreparedStackLifecycle = ClosedEnum<
-  typeof DeploymentPreparedStackLifecycle
+export type DeploymentPreparedStackExtendEffect = ClosedEnum<
+  typeof DeploymentPreparedStackExtendEffect
 >;
 
-export type DeploymentPreparedStackResources = {
+/**
+ * Grant permissions for a specific cloud platform
+ */
+export type DeploymentPreparedStackExtendAwGrant = {
   /**
-   * Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties.
+   * AWS IAM actions (only for AWS)
    */
-  config: DeploymentPreparedStackConfig;
+  actions?: Array<string> | null | undefined;
   /**
-   * Additional dependencies for this resource beyond those defined in the resource itself.
-   *
-   * @remarks
-   * The total dependencies are: resource.get_dependencies() + this list
+   * Azure actions (only for Azure)
    */
-  dependencies: Array<DeploymentPreparedStackDependency>;
+  dataActions?: Array<string> | null | undefined;
   /**
-   * Id of the boolean stack input that decides whether this resource is
-   *
-   * @remarks
-   * created at all. `None` means always create it.
-   *
-   * Set by `.enabled(input)` in the SDK. Setup emitters render the resource
-   * conditionally on the matching template variable, so a deployer who says no
-   * never gets the resource, its outputs, or anything derived from it.
+   * GCP permissions that require an exact residual custom role.
    */
-  enabledWhen?: string | null | undefined;
+  permissions?: Array<string> | null | undefined;
   /**
-   * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+   * Provider predefined roles to bind directly.
    */
-  lifecycle: DeploymentPreparedStackLifecycle;
+  predefinedRoles?: Array<string> | null | undefined;
   /**
-   * Enable remote bindings for this resource (BYOB use case).
-   *
-   * @remarks
-   * When true, binding params are synced to StackState's `remote_binding_params`.
-   * Default: false (prevents sensitive data in synced state).
+   * GCP residual custom permissions to pair with predefined roles.
    */
-  remoteAccess?: boolean | undefined;
+  residualPermissions?: Array<string> | null | undefined;
 };
 
 /**
- * Represents the target cloud platform.
- */
-export const DeploymentPreparedStackSupportedPlatform = {
-  Aws: "aws",
-  Gcp: "gcp",
-  Azure: "azure",
-  Kubernetes: "kubernetes",
-  Machines: "machines",
-  Local: "local",
-  Test: "test",
-} as const;
-/**
- * Represents the target cloud platform.
- */
-export type DeploymentPreparedStackSupportedPlatform = ClosedEnum<
-  typeof DeploymentPreparedStackSupportedPlatform
->;
-
-/**
- * A bag of resources, unaware of any cloud.
+ * AWS-specific platform permission configuration
  */
-export type DeploymentPreparedStack = {
-  /**
-   * Released Container resources whose image repositories are approved for
-   *
-   * @remarks
-   * containers created after installation.
-   */
-  dynamicContainerImageResources?: Array<string> | undefined;
-  /**
-   * Exact image repositories approved for containers created after installation.
-   *
-   * @remarks
-   * The runtime API also requires an immutable SHA-256 digest.
-   */
-  dynamicContainerRepositories?: Array<string> | undefined;
+export type DeploymentPreparedStackExtendAw = {
   /**
-   * Unique identifier for the stack
+   * Generic binding configuration for permissions
    */
-  id: string;
+  binding: DeploymentPreparedStackExtendAwBinding;
   /**
-   * Input definitions required before setup or deployment can proceed.
+   * Short admin-facing description of why this entry exists.
    */
-  inputs?: Array<DeploymentPreparedStackInput> | undefined;
+  description?: string | null | undefined;
   /**
-   * Combined permissions configuration that contains both profiles and management
+   * IAM effect. Defaults to Allow.
    */
-  permissions?: DeploymentPreparedStackPermissions | undefined;
+  effect?: DeploymentPreparedStackExtendEffect | undefined;
   /**
-   * Map of resource IDs to their configurations and lifecycle settings
+   * Grant permissions for a specific cloud platform
    */
-  resources: { [k: string]: DeploymentPreparedStackResources };
+  grant: DeploymentPreparedStackExtendAwGrant;
   /**
-   * Which platforms this stack supports. When None, all platforms are supported.
+   * Stable admin-facing label for this permission entry.
    */
-  supportedPlatforms?:
-    | Array<DeploymentPreparedStackSupportedPlatform>
-    | null
-    | undefined;
+  label?: string | null | undefined;
 };
 
-export type DeploymentPreparedStackUnion = DeploymentPreparedStack | string;
-
 /**
- * The cross-account read a manager opened on Alien's registry for one deployment.
+ * Azure-specific binding specification
  */
-export type DeploymentRegistryAccess = {
-  /**
-   * Repository identifiers the grant names, sorted.
-   */
-  repositories?: Array<string> | undefined;
+export type DeploymentPreparedStackExtendAzureResource = {
   /**
-   * Compute services the grant admits, sorted. Each pulls as its own principal, so a service
-   *
-   * @remarks
-   * added later needs the policy rewritten.
+   * Scope (subscription/resource group/resource level)
    */
-  serviceTypes?: Array<string> | undefined;
+  scope: string;
 };
 
-export type DeploymentRegistryAccessUnion = DeploymentRegistryAccess | string;
-
 /**
- * The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as
- *
- * @remarks
- * soon as the object exists and cleared once it is deleted.
+ * Azure-specific binding specification
  */
-export type DeploymentEgress = {
-  /**
-   * `AWS::Lambda::NetworkConnector` the sessions start with.
-   */
-  connectorArn?: string | null | undefined;
-  /**
-   * Cloud Control request creating or deleting the connector that AWS has not finished. Kept
-   *
-   * @remarks
-   * so the request's outcome, and AWS's reason when it fails, is read on a later call.
-   */
-  connectorRequest?: string | null | undefined;
+export type DeploymentPreparedStackExtendAzureStack = {
   /**
-   * IAM role Lambda assumes to place the connector's network interfaces.
-   */
-  operatorRoleName: string;
-  /**
-   * Security group permitting egress to loopback only.
+   * Scope (subscription/resource group/resource level)
    */
-  securityGroupId?: string | null | undefined;
+  scope: string;
 };
 
-export type DeploymentEgressUnion = DeploymentEgress | string;
-
-export const DeploymentTypeAwsSandbox = {
-  AwsSandbox: "awsSandbox",
-} as const;
-export type DeploymentTypeAwsSandbox = ClosedEnum<
-  typeof DeploymentTypeAwsSandbox
->;
-
 /**
- * Cloud objects a direct setup created so a runtime-owned resource can run.
+ * Generic binding configuration for permissions
  */
-export type DeploymentSetupScaffolding = {
+export type DeploymentPreparedStackExtendAzureBinding = {
   /**
-   * IAM role the image build runs as.
+   * Azure-specific binding specification
    */
-  buildRoleName: string;
-  egress?: DeploymentEgress | string | null | undefined;
+  resource?: DeploymentPreparedStackExtendAzureResource | undefined;
   /**
-   * A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its
-   *
-   * @remarks
-   * runtime controller.
+   * Azure-specific binding specification
    */
-  imageArn?: string | null | undefined;
-  type: DeploymentTypeAwsSandbox;
+  stack?: DeploymentPreparedStackExtendAzureStack | undefined;
 };
 
 /**
- * One-shot authority for a setup re-import to replace setup-owned resources.
+ * Grant permissions for a specific cloud platform
  */
-export type DeploymentSetupUpdateAuthorization = {
-  /**
-   * Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment.
-   */
-  baselineFrozenDigest: string;
-  /**
-   * Unique revision used by persistence layers for compare-and-swap updates.
-   */
-  nonce: string;
+export type DeploymentPreparedStackExtendAzureGrant = {
   /**
-   * Release whose stack was prepared by setup.
+   * AWS IAM actions (only for AWS)
    */
-  releaseId: string;
+  actions?: Array<string> | null | undefined;
   /**
-   * Exact setup artifact revision that authored this authority.
+   * Azure actions (only for Azure)
    */
-  setupFingerprint: string;
+  dataActions?: Array<string> | null | undefined;
   /**
-   * Setup fingerprint contract version.
+   * GCP permissions that require an exact residual custom role.
    */
-  setupFingerprintVersion: number;
+  permissions?: Array<string> | null | undefined;
   /**
-   * Stable setup target recorded on the imported deployment.
+   * Provider predefined roles to bind directly.
    */
-  setupTarget: string;
+  predefinedRoles?: Array<string> | null | undefined;
   /**
-   * Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared.
+   * GCP residual custom permissions to pair with predefined roles.
    */
-  targetFrozenDigest: string;
+  residualPermissions?: Array<string> | null | undefined;
 };
 
-export type DeploymentSetupUpdateAuthorizationUnion =
-  | DeploymentSetupUpdateAuthorization
-  | string;
-
 /**
- * Runtime metadata for deployment state persistence
+ * Azure-specific platform permission configuration
  */
-export type DeploymentRuntimeMetadata = {
+export type DeploymentPreparedStackExtendAzure = {
   /**
-   * Whether each vault-native deployer secret is in the customer's secret
-   *
-   * @remarks
-   * store, with where it goes. Checked from metadata only; no value is ever
-   * read or recorded here.
+   * Generic binding configuration for permissions
    */
-  deployerSecrets?: Array<DeploymentDeployerSecret> | undefined;
+  binding: DeploymentPreparedStackExtendAzureBinding;
   /**
-   * Last generated CLI package revision whose direct setup was applied.
-   *
-   * @remarks
-   * This lets a newer generated CLI refresh setup-owned infrastructure once
-   * before handing runtime changes back to the hosted manager.
+   * Short admin-facing description of why this entry exists.
    */
-  directSetupRevision?: string | null | undefined;
+  description?: string | null | undefined;
   /**
-   * Actor that owns structural work during the initial setup phase.
+   * Grant permissions for a specific cloud platform
    */
-  initialSetupAuthority?: DeploymentInitialSetupAuthority | undefined;
+  grant: DeploymentPreparedStackExtendAzureGrant;
   /**
-   * Hash of the environment variables snapshot that was last synced to the vault
-   *
-   * @remarks
-   * Used to avoid redundant sync operations during incremental deployment
+   * Stable admin-facing label for this permission entry.
    */
-  lastSyncedEnvVarsHash?: string | null | undefined;
+  label?: string | null | undefined;
+};
+
+/**
+ * GCP IAM condition
+ */
+export type DeploymentPreparedStackExtendConditionResource = {
+  expression: string;
+  title: string;
+};
+
+export type DeploymentPreparedStackExtendResourceConditionUnion =
+  | DeploymentPreparedStackExtendConditionResource
+  | string;
+
+/**
+ * GCP-specific binding specification
+ */
+export type DeploymentPreparedStackExtendGcpResource = {
+  condition?:
+    | DeploymentPreparedStackExtendConditionResource
+    | string
+    | null
+    | undefined;
   /**
-   * Exact vault keys owned by the deployment secret synchronizer. This
-   *
-   * @remarks
-   * inventory lets a later snapshot delete removed keys without listing or
-   * touching unrelated values in the same vault.
-   */
-  lastSyncedSecretNames?: Array<string> | undefined;
-  /**
-   * Release `pending_prepared_stack` was prepared from. The target can move
-   *
-   * @remarks
-   * to a newer release while that stack is still being applied; this tells
-   * the update which release actually converged.
+   * Scope (project/resource level)
    */
-  pendingPreparedReleaseId?: string | null | undefined;
-  pendingPreparedStack?: DeploymentPendingPreparedStackUnion | null | undefined;
+  scope: string;
+};
+
+/**
+ * GCP IAM condition
+ */
+export type DeploymentPreparedStackExtendConditionStack = {
+  expression: string;
+  title: string;
+};
+
+export type DeploymentPreparedStackExtendStackConditionUnion =
+  | DeploymentPreparedStackExtendConditionStack
+  | string;
+
+/**
+ * GCP-specific binding specification
+ */
+export type DeploymentPreparedStackExtendGcpStack = {
+  condition?:
+    | DeploymentPreparedStackExtendConditionStack
+    | string
+    | null
+    | undefined;
   /**
-   * Canonical resolved answers for inputs that gate Frozen resources,
-   *
-   * @remarks
-   * keyed by input id, recorded when the deployment is created or its
-   * setup import registers.
-   *
-   * A frozen gate's answer is fixed for the deployment's lifetime: the
-   * update path refuses input values that conflict with these, and a Live
-   * resource sharing such an input resolves the persisted answer forever.
+   * Scope (project/resource level)
    */
-  persistedGateAnswers?: { [k: string]: boolean } | undefined;
-  preparedStack?: DeploymentPreparedStack | string | null | undefined;
-  registryAccess?: DeploymentRegistryAccess | string | null | undefined;
+  scope: string;
+};
+
+/**
+ * Generic binding configuration for permissions
+ */
+export type DeploymentPreparedStackExtendGcpBinding = {
   /**
-   * Whether cross-account registry access has been successfully granted.
-   *
-   * @remarks
-   * Set to true after the manager successfully sets the ECR/GAR repo policy
-   * for this deployment's target account. Prevents redundant API calls on
-   * every reconcile tick.
+   * GCP-specific binding specification
    */
-  registryAccessGranted?: boolean | undefined;
+  resource?: DeploymentPreparedStackExtendGcpResource | undefined;
   /**
-   * What a direct setup created for resources it does not own, keyed by resource id. Setup
-   *
-   * @remarks
-   * teardown removes exactly what is recorded here.
+   * GCP-specific binding specification
    */
-  setupScaffolding?: { [k: string]: DeploymentSetupScaffolding } | undefined;
-  setupUpdateAuthorization?:
-    | DeploymentSetupUpdateAuthorization
-    | string
-    | null
-    | undefined;
+  stack?: DeploymentPreparedStackExtendGcpStack | undefined;
 };
 
 /**
- * Setup source that imported this deployment
+ * Grant permissions for a specific cloud platform
  */
-export const DeploymentImportSource = {
-  Cloudformation: "cloudformation",
-  Terraform: "terraform",
-  Helm: "helm",
-} as const;
+export type DeploymentPreparedStackExtendGcpGrant = {
+  /**
+   * AWS IAM actions (only for AWS)
+   */
+  actions?: Array<string> | null | undefined;
+  /**
+   * Azure actions (only for Azure)
+   */
+  dataActions?: Array<string> | null | undefined;
+  /**
+   * GCP permissions that require an exact residual custom role.
+   */
+  permissions?: Array<string> | null | undefined;
+  /**
+   * Provider predefined roles to bind directly.
+   */
+  predefinedRoles?: Array<string> | null | undefined;
+  /**
+   * GCP residual custom permissions to pair with predefined roles.
+   */
+  residualPermissions?: Array<string> | null | undefined;
+};
+
 /**
- * Setup source that imported this deployment
+ * GCP-specific platform permission configuration
  */
-export type DeploymentImportSource = ClosedEnum<typeof DeploymentImportSource>;
+export type DeploymentPreparedStackExtendGcp = {
+  /**
+   * Generic binding configuration for permissions
+   */
+  binding: DeploymentPreparedStackExtendGcpBinding;
+  /**
+   * Short admin-facing description of why this entry exists.
+   */
+  description?: string | null | undefined;
+  /**
+   * Grant permissions for a specific cloud platform
+   */
+  grant: DeploymentPreparedStackExtendGcpGrant;
+  /**
+   * Stable admin-facing label for this permission entry.
+   */
+  label?: string | null | undefined;
+};
 
 /**
- * Setup method that created the deployment record and owns setup-time resources.
+ * Platform-specific permission configurations
  */
-export const DeploymentSetupMethod1 = {
-  Cloudformation: "cloudformation",
-  GoogleOauth: "google-oauth",
-  Terraform: "terraform",
-  Helm: "helm",
-  Cli: "cli",
-  Manual: "manual",
-} as const;
+export type DeploymentPreparedStackExtendPlatforms = {
+  /**
+   * AWS permission configurations
+   */
+  aws?: Array<DeploymentPreparedStackExtendAw> | null | undefined;
+  /**
+   * Azure permission configurations
+   */
+  azure?: Array<DeploymentPreparedStackExtendAzure> | null | undefined;
+  /**
+   * GCP permission configurations
+   */
+  gcp?: Array<DeploymentPreparedStackExtendGcp> | null | undefined;
+};
+
 /**
- * Setup method that created the deployment record and owns setup-time resources.
+ * A permission set that can be applied across different cloud platforms
  */
-export type DeploymentSetupMethod1 = ClosedEnum<typeof DeploymentSetupMethod1>;
+export type DeploymentPreparedStackExtend = {
+  /**
+   * Human-readable description of what this permission set allows
+   */
+  description: string;
+  /**
+   * Unique identifier for the permission set (e.g., "storage/data-read")
+   */
+  id: string;
+  /**
+   * Platform-specific permission configurations
+   */
+  platforms: DeploymentPreparedStackExtendPlatforms;
+};
 
 /**
- * Latest error information if the deployment is in a failed state
+ * Reference to a permission set - either by name or inline definition
  */
-export type DeploymentError = {
+export type DeploymentPreparedStackExtendUnion =
+  | DeploymentPreparedStackExtend
+  | string;
+
+export type DeploymentPreparedStackManagement1 = {
   /**
-   * A unique identifier for the type of error.
+   * Permission profile that maps resources to permission sets
    *
    * @remarks
-   *
-   * This should be a short, machine-readable string that can be used
-   * by clients to programmatically handle different error types.
-   * Examples: "NOT_FOUND", "VALIDATION_ERROR", "TIMEOUT"
+   * Key can be "*" for all resources or resource name for specific resource
    */
-  code: string;
+  extend: { [k: string]: Array<DeploymentPreparedStackExtend | string> };
+};
+
+/**
+ * Management permissions configuration for stack management access
+ */
+export type DeploymentPreparedStackManagementUnion =
+  | DeploymentPreparedStackManagement1
+  | DeploymentPreparedStackManagement2
+  | DeploymentPreparedStackManagementEnum;
+
+/**
+ * AWS-specific binding specification
+ */
+export type DeploymentPreparedStackProfileAwResource = {
   /**
-   * Additional diagnostic information about the error context.
+   * Optional condition for additional filtering (rare)
+   */
+  condition?: { [k: string]: { [k: string]: string } } | null | undefined;
+  /**
+   * ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a
    *
    * @remarks
-   *
-   * This optional field can contain structured data providing more details
-   * about the error, such as validation errors, request parameters that
-   * caused the issue, or other relevant context information.
+   * tag-on-create grant whose implied check AWS authorizes against no resource; the build
+   * refuses it anywhere else.
    */
-  context?: any | null | undefined;
+  notResources?: Array<string> | undefined;
   /**
-   * Optional human-facing remediation hint.
+   * Resource ARNs to bind to
    */
-  hint?: string | null | undefined;
+  resources: Array<string>;
+};
+
+/**
+ * AWS-specific binding specification
+ */
+export type DeploymentPreparedStackProfileAwStack = {
   /**
-   * HTTP status code for this error.
-   *
-   * @remarks
-   *
-   * Used when converting the error to an HTTP response. If None, falls back to
-   * the error type's default status code or 500.
+   * Optional condition for additional filtering (rare)
    */
-  httpStatusCode?: number | null | undefined;
+  condition?: { [k: string]: { [k: string]: string } } | null | undefined;
   /**
-   * Indicates if this is an internal error that should not be exposed to users.
+   * ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a
    *
    * @remarks
-   *
-   * When `true`, this error contains sensitive information or implementation
-   * details that should not be shown to end-users. Such errors should be
-   * logged for debugging but replaced with generic error messages in responses.
+   * tag-on-create grant whose implied check AWS authorizes against no resource; the build
+   * refuses it anywhere else.
    */
-  internal: boolean;
+  notResources?: Array<string> | undefined;
   /**
-   * Human-readable error message.
-   *
-   * @remarks
-   *
-   * This message should be clear and actionable for developers or end-users,
-   * providing context about what went wrong and potentially how to fix it.
+   * Resource ARNs to bind to
    */
-  message: string;
-  /**
-   * Indicates whether the operation that caused the error should be retried.
-   *
-   * @remarks
-   *
-   * When `true`, the error is transient and the operation might succeed
-   * if attempted again. When `false`, retrying the same operation is
-   * unlikely to succeed without changes.
+  resources: Array<string>;
+};
+
+/**
+ * Generic binding configuration for permissions
+ */
+export type DeploymentPreparedStackProfileAwBinding = {
+  /**
+   * AWS-specific binding specification
    */
-  retryable: boolean;
+  resource?: DeploymentPreparedStackProfileAwResource | undefined;
   /**
-   * The underlying error that caused this error, creating an error chain.
-   *
-   * @remarks
-   *
-   * This allows for proper error propagation and debugging by maintaining
-   * the full context of how an error occurred through multiple layers
-   * of an application.
+   * AWS-specific binding specification
    */
-  source?: any | null | undefined;
+  stack?: DeploymentPreparedStackProfileAwStack | undefined;
+};
+
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export const DeploymentPreparedStackProfileEffect = {
+  Allow: "Allow",
+  Deny: "Deny",
+} as const;
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export type DeploymentPreparedStackProfileEffect = ClosedEnum<
+  typeof DeploymentPreparedStackProfileEffect
+>;
+
+/**
+ * Grant permissions for a specific cloud platform
+ */
+export type DeploymentPreparedStackProfileAwGrant = {
+  /**
+   * AWS IAM actions (only for AWS)
+   */
+  actions?: Array<string> | null | undefined;
+  /**
+   * Azure actions (only for Azure)
+   */
+  dataActions?: Array<string> | null | undefined;
+  /**
+   * GCP permissions that require an exact residual custom role.
+   */
+  permissions?: Array<string> | null | undefined;
+  /**
+   * Provider predefined roles to bind directly.
+   */
+  predefinedRoles?: Array<string> | null | undefined;
+  /**
+   * GCP residual custom permissions to pair with predefined roles.
+   */
+  residualPermissions?: Array<string> | null | undefined;
+};
+
+/**
+ * AWS-specific platform permission configuration
+ */
+export type DeploymentPreparedStackProfileAw = {
+  /**
+   * Generic binding configuration for permissions
+   */
+  binding: DeploymentPreparedStackProfileAwBinding;
+  /**
+   * Short admin-facing description of why this entry exists.
+   */
+  description?: string | null | undefined;
+  /**
+   * IAM effect. Defaults to Allow.
+   */
+  effect?: DeploymentPreparedStackProfileEffect | undefined;
+  /**
+   * Grant permissions for a specific cloud platform
+   */
+  grant: DeploymentPreparedStackProfileAwGrant;
+  /**
+   * Stable admin-facing label for this permission entry.
+   */
+  label?: string | null | undefined;
+};
+
+/**
+ * Azure-specific binding specification
+ */
+export type DeploymentPreparedStackProfileAzureResource = {
+  /**
+   * Scope (subscription/resource group/resource level)
+   */
+  scope: string;
+};
+
+/**
+ * Azure-specific binding specification
+ */
+export type DeploymentPreparedStackProfileAzureStack = {
+  /**
+   * Scope (subscription/resource group/resource level)
+   */
+  scope: string;
+};
+
+/**
+ * Generic binding configuration for permissions
+ */
+export type DeploymentPreparedStackProfileAzureBinding = {
+  /**
+   * Azure-specific binding specification
+   */
+  resource?: DeploymentPreparedStackProfileAzureResource | undefined;
+  /**
+   * Azure-specific binding specification
+   */
+  stack?: DeploymentPreparedStackProfileAzureStack | undefined;
 };
 
-/**
- * Durable progress for deployment updates
- */
-export type DeploymentUpdateState = {
-  active: DeploymentUpdateOperationSummary | null;
-  next: DeploymentUpdateOperationSummary | null;
-  latest: DeploymentUpdateOperationSummary | null;
-};
+/**
+ * Grant permissions for a specific cloud platform
+ */
+export type DeploymentPreparedStackProfileAzureGrant = {
+  /**
+   * AWS IAM actions (only for AWS)
+   */
+  actions?: Array<string> | null | undefined;
+  /**
+   * Azure actions (only for Azure)
+   */
+  dataActions?: Array<string> | null | undefined;
+  /**
+   * GCP permissions that require an exact residual custom role.
+   */
+  permissions?: Array<string> | null | undefined;
+  /**
+   * Provider predefined roles to bind directly.
+   */
+  predefinedRoles?: Array<string> | null | undefined;
+  /**
+   * GCP residual custom permissions to pair with predefined roles.
+   */
+  residualPermissions?: Array<string> | null | undefined;
+};
+
+/**
+ * Azure-specific platform permission configuration
+ */
+export type DeploymentPreparedStackProfileAzure = {
+  /**
+   * Generic binding configuration for permissions
+   */
+  binding: DeploymentPreparedStackProfileAzureBinding;
+  /**
+   * Short admin-facing description of why this entry exists.
+   */
+  description?: string | null | undefined;
+  /**
+   * Grant permissions for a specific cloud platform
+   */
+  grant: DeploymentPreparedStackProfileAzureGrant;
+  /**
+   * Stable admin-facing label for this permission entry.
+   */
+  label?: string | null | undefined;
+};
+
+/**
+ * GCP IAM condition
+ */
+export type DeploymentPreparedStackProfileConditionResource = {
+  expression: string;
+  title: string;
+};
+
+export type DeploymentPreparedStackProfileResourceConditionUnion =
+  | DeploymentPreparedStackProfileConditionResource
+  | string;
+
+/**
+ * GCP-specific binding specification
+ */
+export type DeploymentPreparedStackProfileGcpResource = {
+  condition?:
+    | DeploymentPreparedStackProfileConditionResource
+    | string
+    | null
+    | undefined;
+  /**
+   * Scope (project/resource level)
+   */
+  scope: string;
+};
+
+/**
+ * GCP IAM condition
+ */
+export type DeploymentPreparedStackProfileConditionStack = {
+  expression: string;
+  title: string;
+};
+
+export type DeploymentPreparedStackProfileStackConditionUnion =
+  | DeploymentPreparedStackProfileConditionStack
+  | string;
+
+/**
+ * GCP-specific binding specification
+ */
+export type DeploymentPreparedStackProfileGcpStack = {
+  condition?:
+    | DeploymentPreparedStackProfileConditionStack
+    | string
+    | null
+    | undefined;
+  /**
+   * Scope (project/resource level)
+   */
+  scope: string;
+};
+
+/**
+ * Generic binding configuration for permissions
+ */
+export type DeploymentPreparedStackProfileGcpBinding = {
+  /**
+   * GCP-specific binding specification
+   */
+  resource?: DeploymentPreparedStackProfileGcpResource | undefined;
+  /**
+   * GCP-specific binding specification
+   */
+  stack?: DeploymentPreparedStackProfileGcpStack | undefined;
+};
+
+/**
+ * Grant permissions for a specific cloud platform
+ */
+export type DeploymentPreparedStackProfileGcpGrant = {
+  /**
+   * AWS IAM actions (only for AWS)
+   */
+  actions?: Array<string> | null | undefined;
+  /**
+   * Azure actions (only for Azure)
+   */
+  dataActions?: Array<string> | null | undefined;
+  /**
+   * GCP permissions that require an exact residual custom role.
+   */
+  permissions?: Array<string> | null | undefined;
+  /**
+   * Provider predefined roles to bind directly.
+   */
+  predefinedRoles?: Array<string> | null | undefined;
+  /**
+   * GCP residual custom permissions to pair with predefined roles.
+   */
+  residualPermissions?: Array<string> | null | undefined;
+};
+
+/**
+ * GCP-specific platform permission configuration
+ */
+export type DeploymentPreparedStackProfileGcp = {
+  /**
+   * Generic binding configuration for permissions
+   */
+  binding: DeploymentPreparedStackProfileGcpBinding;
+  /**
+   * Short admin-facing description of why this entry exists.
+   */
+  description?: string | null | undefined;
+  /**
+   * Grant permissions for a specific cloud platform
+   */
+  grant: DeploymentPreparedStackProfileGcpGrant;
+  /**
+   * Stable admin-facing label for this permission entry.
+   */
+  label?: string | null | undefined;
+};
+
+/**
+ * Platform-specific permission configurations
+ */
+export type DeploymentPreparedStackProfilePlatforms = {
+  /**
+   * AWS permission configurations
+   */
+  aws?: Array<DeploymentPreparedStackProfileAw> | null | undefined;
+  /**
+   * Azure permission configurations
+   */
+  azure?: Array<DeploymentPreparedStackProfileAzure> | null | undefined;
+  /**
+   * GCP permission configurations
+   */
+  gcp?: Array<DeploymentPreparedStackProfileGcp> | null | undefined;
+};
+
+/**
+ * A permission set that can be applied across different cloud platforms
+ */
+export type DeploymentPreparedStackProfile = {
+  /**
+   * Human-readable description of what this permission set allows
+   */
+  description: string;
+  /**
+   * Unique identifier for the permission set (e.g., "storage/data-read")
+   */
+  id: string;
+  /**
+   * Platform-specific permission configurations
+   */
+  platforms: DeploymentPreparedStackProfilePlatforms;
+};
+
+/**
+ * Reference to a permission set - either by name or inline definition
+ */
+export type DeploymentPreparedStackProfileUnion =
+  | DeploymentPreparedStackProfile
+  | string;
+
+/**
+ * Combined permissions configuration that contains both profiles and management
+ */
+export type DeploymentPreparedStackPermissions = {
+  /**
+   * Management permissions configuration for stack management access
+   */
+  management?:
+    | DeploymentPreparedStackManagement1
+    | DeploymentPreparedStackManagement2
+    | DeploymentPreparedStackManagementEnum
+    | undefined;
+  /**
+   * Permission profiles that define access control for compute services
+   *
+   * @remarks
+   * Key is the profile name, value is the permission configuration
+   */
+  profiles: {
+    [k: string]: {
+      [k: string]: Array<DeploymentPreparedStackProfile | string>;
+    };
+  };
+};
+
+/**
+ * Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties.
+ */
+export type DeploymentPreparedStackConfig = {
+  /**
+   * The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+   */
+  id: string;
+  /**
+   * Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.
+   */
+  type: string;
+  additionalProperties?: { [k: string]: any | null } | undefined;
+};
+
+/**
+ * Reference to a resource by its stable id and resource type.
+ */
+export type DeploymentPreparedStackDependency = {
+  id: string;
+  /**
+   * Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.
+   */
+  type: string;
+};
+
+/**
+ * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+ */
+export const DeploymentPreparedStackLifecycle = {
+  Frozen: "frozen",
+  Live: "live",
+} as const;
+/**
+ * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+ */
+export type DeploymentPreparedStackLifecycle = ClosedEnum<
+  typeof DeploymentPreparedStackLifecycle
+>;
+
+export type DeploymentPreparedStackResources = {
+  /**
+   * Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties.
+   */
+  config: DeploymentPreparedStackConfig;
+  /**
+   * Additional dependencies for this resource beyond those defined in the resource itself.
+   *
+   * @remarks
+   * The total dependencies are: resource.get_dependencies() + this list
+   */
+  dependencies: Array<DeploymentPreparedStackDependency>;
+  /**
+   * Id of the boolean stack input that decides whether this resource is
+   *
+   * @remarks
+   * created at all. `None` means always create it.
+   *
+   * Set by `.enabled(input)` in the SDK. Setup emitters render the resource
+   * conditionally on the matching template variable, so a deployer who says no
+   * never gets the resource, its outputs, or anything derived from it.
+   */
+  enabledWhen?: string | null | undefined;
+  /**
+   * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+   */
+  lifecycle: DeploymentPreparedStackLifecycle;
+  /**
+   * Enable remote bindings for this resource (BYOB use case).
+   *
+   * @remarks
+   * When true, binding params are synced to StackState's `remote_binding_params`.
+   * Default: false (prevents sensitive data in synced state).
+   */
+  remoteAccess?: boolean | undefined;
+};
+
+/**
+ * Represents the target cloud platform.
+ */
+export const DeploymentPreparedStackSupportedPlatform = {
+  Aws: "aws",
+  Gcp: "gcp",
+  Azure: "azure",
+  Kubernetes: "kubernetes",
+  Machines: "machines",
+  Local: "local",
+  Test: "test",
+} as const;
+/**
+ * Represents the target cloud platform.
+ */
+export type DeploymentPreparedStackSupportedPlatform = ClosedEnum<
+  typeof DeploymentPreparedStackSupportedPlatform
+>;
+
+/**
+ * A bag of resources, unaware of any cloud.
+ */
+export type DeploymentPreparedStack = {
+  /**
+   * Released Container resources whose image repositories are approved for
+   *
+   * @remarks
+   * containers created after installation.
+   */
+  dynamicContainerImageResources?: Array<string> | undefined;
+  /**
+   * Exact image repositories approved for containers created after installation.
+   *
+   * @remarks
+   * The runtime API also requires an immutable SHA-256 digest.
+   */
+  dynamicContainerRepositories?: Array<string> | undefined;
+  /**
+   * Unique identifier for the stack
+   */
+  id: string;
+  /**
+   * Input definitions required before setup or deployment can proceed.
+   */
+  inputs?: Array<DeploymentPreparedStackInput> | undefined;
+  operations?: DeploymentPreparedStackOperations | string | null | undefined;
+  /**
+   * Combined permissions configuration that contains both profiles and management
+   */
+  permissions?: DeploymentPreparedStackPermissions | undefined;
+  /**
+   * Map of resource IDs to their configurations and lifecycle settings
+   */
+  resources: { [k: string]: DeploymentPreparedStackResources };
+  /**
+   * Which platforms this stack supports. When None, all platforms are supported.
+   */
+  supportedPlatforms?:
+    | Array<DeploymentPreparedStackSupportedPlatform>
+    | null
+    | undefined;
+};
+
+export type DeploymentPreparedStackUnion = DeploymentPreparedStack | string;
+
+/**
+ * The cross-account read a manager opened on Alien's registry for one deployment.
+ */
+export type DeploymentRegistryAccess = {
+  /**
+   * Repository identifiers the grant names, sorted.
+   */
+  repositories?: Array<string> | undefined;
+  /**
+   * Compute services the grant admits, sorted. Each pulls as its own principal, so a service
+   *
+   * @remarks
+   * added later needs the policy rewritten.
+   */
+  serviceTypes?: Array<string> | undefined;
+};
+
+export type DeploymentRegistryAccessUnion = DeploymentRegistryAccess | string;
+
+/**
+ * The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as
+ *
+ * @remarks
+ * soon as the object exists and cleared once it is deleted.
+ */
+export type DeploymentEgress = {
+  /**
+   * `AWS::Lambda::NetworkConnector` the sessions start with.
+   */
+  connectorArn?: string | null | undefined;
+  /**
+   * Cloud Control request creating or deleting the connector that AWS has not finished. Kept
+   *
+   * @remarks
+   * so the request's outcome, and AWS's reason when it fails, is read on a later call.
+   */
+  connectorRequest?: string | null | undefined;
+  /**
+   * IAM role Lambda assumes to place the connector's network interfaces.
+   */
+  operatorRoleName: string;
+  /**
+   * Security group permitting egress to loopback only.
+   */
+  securityGroupId?: string | null | undefined;
+};
+
+export type DeploymentEgressUnion = DeploymentEgress | string;
+
+export const DeploymentTypeAwsSandbox = {
+  AwsSandbox: "awsSandbox",
+} as const;
+export type DeploymentTypeAwsSandbox = ClosedEnum<
+  typeof DeploymentTypeAwsSandbox
+>;
+
+/**
+ * Cloud objects a direct setup created so a runtime-owned resource can run.
+ */
+export type DeploymentSetupScaffolding = {
+  /**
+   * IAM role the image build runs as.
+   */
+  buildRoleName: string;
+  egress?: DeploymentEgress | string | null | undefined;
+  /**
+   * A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its
+   *
+   * @remarks
+   * runtime controller.
+   */
+  imageArn?: string | null | undefined;
+  type: DeploymentTypeAwsSandbox;
+};
+
+/**
+ * One-shot authority for a setup re-import to replace setup-owned resources.
+ */
+export type DeploymentSetupUpdateAuthorization = {
+  /**
+   * Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment.
+   */
+  baselineFrozenDigest: string;
+  /**
+   * Unique revision used by persistence layers for compare-and-swap updates.
+   */
+  nonce: string;
+  /**
+   * Release whose stack was prepared by setup.
+   */
+  releaseId: string;
+  /**
+   * Exact setup artifact revision that authored this authority.
+   */
+  setupFingerprint: string;
+  /**
+   * Setup fingerprint contract version.
+   */
+  setupFingerprintVersion: number;
+  /**
+   * Stable setup target recorded on the imported deployment.
+   */
+  setupTarget: string;
+  /**
+   * Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared.
+   */
+  targetFrozenDigest: string;
+};
+
+export type DeploymentSetupUpdateAuthorizationUnion =
+  | DeploymentSetupUpdateAuthorization
+  | string;
+
+/**
+ * Runtime metadata for deployment state persistence
+ */
+export type DeploymentRuntimeMetadata = {
+  /**
+   * Whether each vault-native deployer secret is in the customer's secret
+   *
+   * @remarks
+   * store, with where it goes. Checked from metadata only; no value is ever
+   * read or recorded here.
+   */
+  deployerSecrets?: Array<DeploymentDeployerSecret> | undefined;
+  /**
+   * Last generated CLI package revision whose direct setup was applied.
+   *
+   * @remarks
+   * This lets a newer generated CLI refresh setup-owned infrastructure once
+   * before handing runtime changes back to the hosted manager.
+   */
+  directSetupRevision?: string | null | undefined;
+  /**
+   * Actor that owns structural work during the initial setup phase.
+   */
+  initialSetupAuthority?: DeploymentInitialSetupAuthority | undefined;
+  /**
+   * Hash of the environment variables snapshot that was last synced to the vault
+   *
+   * @remarks
+   * Used to avoid redundant sync operations during incremental deployment
+   */
+  lastSyncedEnvVarsHash?: string | null | undefined;
+  /**
+   * Exact vault keys owned by the deployment secret synchronizer. This
+   *
+   * @remarks
+   * inventory lets a later snapshot delete removed keys without listing or
+   * touching unrelated values in the same vault.
+   */
+  lastSyncedSecretNames?: Array<string> | undefined;
+  /**
+   * Release `pending_prepared_stack` was prepared from. The target can move
+   *
+   * @remarks
+   * to a newer release while that stack is still being applied; this tells
+   * the update which release actually converged.
+   */
+  pendingPreparedReleaseId?: string | null | undefined;
+  pendingPreparedStack?: DeploymentPendingPreparedStackUnion | null | undefined;
+  /**
+   * Canonical resolved answers for inputs that gate Frozen resources,
+   *
+   * @remarks
+   * keyed by input id, recorded when the deployment is created or its
+   * setup import registers.
+   *
+   * A frozen gate's answer is fixed for the deployment's lifetime: the
+   * update path refuses input values that conflict with these, and a Live
+   * resource sharing such an input resolves the persisted answer forever.
+   */
+  persistedGateAnswers?: { [k: string]: boolean } | undefined;
+  preparedStack?: DeploymentPreparedStack | string | null | undefined;
+  registryAccess?: DeploymentRegistryAccess | string | null | undefined;
+  /**
+   * Whether cross-account registry access has been successfully granted.
+   *
+   * @remarks
+   * Set to true after the manager successfully sets the ECR/GAR repo policy
+   * for this deployment's target account. Prevents redundant API calls on
+   * every reconcile tick.
+   */
+  registryAccessGranted?: boolean | undefined;
+  /**
+   * What a direct setup created for resources it does not own, keyed by resource id. Setup
+   *
+   * @remarks
+   * teardown removes exactly what is recorded here.
+   */
+  setupScaffolding?: { [k: string]: DeploymentSetupScaffolding } | undefined;
+  setupUpdateAuthorization?:
+    | DeploymentSetupUpdateAuthorization
+    | string
+    | null
+    | undefined;
+};
+
+/**
+ * Setup source that imported this deployment
+ */
+export const DeploymentImportSource = {
+  Cloudformation: "cloudformation",
+  Terraform: "terraform",
+  Helm: "helm",
+} as const;
+/**
+ * Setup source that imported this deployment
+ */
+export type DeploymentImportSource = ClosedEnum<typeof DeploymentImportSource>;
+
+/**
+ * Setup method that created the deployment record and owns setup-time resources.
+ */
+export const DeploymentSetupMethod1 = {
+  Cloudformation: "cloudformation",
+  GoogleOauth: "google-oauth",
+  Terraform: "terraform",
+  Helm: "helm",
+  Cli: "cli",
+  Manual: "manual",
+} as const;
+/**
+ * Setup method that created the deployment record and owns setup-time resources.
+ */
+export type DeploymentSetupMethod1 = ClosedEnum<typeof DeploymentSetupMethod1>;
+
+/**
+ * Latest error information if the deployment is in a failed state
+ */
+export type DeploymentError = {
+  /**
+   * A unique identifier for the type of error.
+   *
+   * @remarks
+   *
+   * This should be a short, machine-readable string that can be used
+   * by clients to programmatically handle different error types.
+   * Examples: "NOT_FOUND", "VALIDATION_ERROR", "TIMEOUT"
+   */
+  code: string;
+  /**
+   * Additional diagnostic information about the error context.
+   *
+   * @remarks
+   *
+   * This optional field can contain structured data providing more details
+   * about the error, such as validation errors, request parameters that
+   * caused the issue, or other relevant context information.
+   */
+  context?: any | null | undefined;
+  /**
+   * Optional human-facing remediation hint.
+   */
+  hint?: string | null | undefined;
+  /**
+   * HTTP status code for this error.
+   *
+   * @remarks
+   *
+   * Used when converting the error to an HTTP response. If None, falls back to
+   * the error type's default status code or 500.
+   */
+  httpStatusCode?: number | null | undefined;
+  /**
+   * Indicates if this is an internal error that should not be exposed to users.
+   *
+   * @remarks
+   *
+   * When `true`, this error contains sensitive information or implementation
+   * details that should not be shown to end-users. Such errors should be
+   * logged for debugging but replaced with generic error messages in responses.
+   */
+  internal: boolean;
+  /**
+   * Human-readable error message.
+   *
+   * @remarks
+   *
+   * This message should be clear and actionable for developers or end-users,
+   * providing context about what went wrong and potentially how to fix it.
+   */
+  message: string;
+  /**
+   * Indicates whether the operation that caused the error should be retried.
+   *
+   * @remarks
+   *
+   * When `true`, the error is transient and the operation might succeed
+   * if attempted again. When `false`, retrying the same operation is
+   * unlikely to succeed without changes.
+   */
+  retryable: boolean;
+  /**
+   * The underlying error that caused this error, creating an error chain.
+   *
+   * @remarks
+   *
+   * This allows for proper error propagation and debugging by maintaining
+   * the full context of how an error occurred through multiple layers
+   * of an application.
+   */
+  source?: any | null | undefined;
+};
+
+/**
+ * Durable progress for deployment updates
+ */
+export type DeploymentUpdateState = {
+  active: DeploymentUpdateOperationSummary | null;
+  next: DeploymentUpdateOperationSummary | null;
+  latest: DeploymentUpdateOperationSummary | null;
+};
+
+export type Deployment = {
+  /**
+   * Unique identifier for the deployment.
+   */
+  id: string;
+  /**
+   * Deployment name.
+   */
+  name: string;
+  /**
+   * Public subdomain for auto-generated domains
+   */
+  publicSubdomain?: string | null | undefined;
+  /**
+   * Deployment status in the deployment lifecycle.
+   *
+   * @remarks
+   *
+   * For observe-only deployments with no release or stack state, `Running`
+   * means the Operator is attached. Connectivity comes from `lastHeartbeatAt`;
+   * resource health comes from inventory and resource heartbeat data.
+   */
+  status: DeploymentStatus;
+  /**
+   * Unique identifier for the project.
+   */
+  projectId: string;
+  /**
+   * Target platform for the deployment
+   */
+  platform: DeploymentPlatform;
+  /**
+   * Underlying cloud platform for Kubernetes deployments.
+   */
+  basePlatform?: DeploymentBasePlatform | null | undefined;
+  /**
+   * Cloud region or location for the deployment.
+   */
+  region?: string | null | undefined;
+  /**
+   * DeploymentState protocol version owned by the runtime/manager
+   */
+  deploymentProtocolVersion: number;
+  /**
+   * ID of deployment group this deployment belongs to
+   */
+  deploymentGroupId: string;
+  membershipRevision: number;
+  membershipProjectionRevision: number | null;
+  /**
+   * Operational purpose of this deployment within its customer environment.
+   */
+  purpose: DeploymentPurpose;
+  /**
+   * Cloud environment information
+   */
+  environmentInfo?: DeploymentEnvironmentInfoUnion | null | undefined;
+  /**
+   * User-provided configuration (network, deployment model, approvals)
+   */
+  stackSettings: DeploymentStackSettings;
+  /**
+   * State of infrastructure components managed by this deployment
+   */
+  stackState?: DeploymentStackState | null | undefined;
+  /**
+   * Runtime metadata for deployment state persistence
+   */
+  runtimeMetadata?: DeploymentRuntimeMetadata | null | undefined;
+  /**
+   * ID of the currently deployed release (actual state)
+   */
+  currentReleaseId?: string | null | undefined;
+  /**
+   * ID of the desired release for deployment/update (desired state)
+   */
+  desiredReleaseId?: string | null | undefined;
+  /**
+   * ID of the pinned release
+   */
+  pinnedReleaseId?: string | null | undefined;
+  releaseChannel: string;
+  /**
+   * Setup source that imported this deployment
+   */
+  importSource?: DeploymentImportSource | null | undefined;
+  /**
+   * Setup method that created the deployment record and owns setup-time resources.
+   */
+  setupMethod?: DeploymentSetupMethod1 | null | undefined;
+  /**
+   * Setup method metadata needed to guide privileged teardown.
+   */
+  setupMetadata?: { [k: string]: any | null } | null | undefined;
+  /**
+   * Imported setup target for compatibility checks
+   */
+  setupTarget?: string | null | undefined;
+  /**
+   * Imported setup compatibility fingerprint
+   */
+  setupFingerprint?: string | null | undefined;
+  /**
+   * Imported setup fingerprint algorithm version
+   */
+  setupFingerprintVersion?: number | null | undefined;
+  /**
+   * Display-only scope reported by the Operator manifest
+   */
+  operatorScope?: string | null | undefined;
+  /**
+   * Display-only permission tier reported by the Operator manifest
+   */
+  operatorPermission?: string | null | undefined;
+  /**
+   * Version reported by the Operator
+   */
+  operatorVersion?: string | null | undefined;
+  /**
+   * Capability state reported by the Operator
+   */
+  capabilities?: Array<OperatorCapabilityReport> | null | undefined;
+  /**
+   * Plugin bundle set hash the Operator reports having loaded
+   */
+  observedOperationsBundleHash?: string | null | undefined;
+  /**
+   * Operations the Operator reports as currently loaded
+   */
+  observedOperations?: Array<ReportedOperation> | null | undefined;
+  /**
+   * Whether a retry has been requested for a failed deployment
+   */
+  retryRequested: boolean;
+  /**
+   * Timestamp of the last received heartbeat from the deployment
+   */
+  lastHeartbeatAt?: Date | null | undefined;
+  /**
+   * Latest error information if the deployment is in a failed state
+   */
+  error?: DeploymentError | null | undefined;
+  /**
+   * Durable progress for deployment updates
+   */
+  updateState?: DeploymentUpdateState | undefined;
+  createdAt: Date;
+  updatedAt: Date;
+  managerId: string;
+  /**
+   * Unique identifier for the workspace.
+   */
+  workspaceId: string;
+};
+
+/** @internal */
+export const DeploymentPreparedStackOperationsUnion$inboundSchema: z.ZodType<
+  DeploymentPreparedStackOperationsUnion,
+  unknown
+> = z.union([DeploymentPreparedStackOperations$inboundSchema, z.string()]);
+
+export function deploymentPreparedStackOperationsUnionFromJSON(
+  jsonString: string,
+): SafeParseResult<DeploymentPreparedStackOperationsUnion, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOperationsUnion$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentPreparedStackOperationsUnion' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackManagementEnum$inboundSchema: z.ZodEnum<
+  typeof DeploymentPreparedStackManagementEnum
+> = z.enum(DeploymentPreparedStackManagementEnum);
+
+/** @internal */
+export const DeploymentPreparedStackOverrideAwResource$inboundSchema: z.ZodType<
+  DeploymentPreparedStackOverrideAwResource,
+  unknown
+> = z.object({
+  condition: z.nullable(z.record(z.string(), z.record(z.string(), z.string())))
+    .optional(),
+  notResources: z.array(z.string()).optional(),
+  resources: z.array(z.string()),
+});
+
+export function deploymentPreparedStackOverrideAwResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackOverrideAwResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideAwResource$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackOverrideAwResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideAwStack$inboundSchema: z.ZodType<
+  DeploymentPreparedStackOverrideAwStack,
+  unknown
+> = z.object({
+  condition: z.nullable(z.record(z.string(), z.record(z.string(), z.string())))
+    .optional(),
+  notResources: z.array(z.string()).optional(),
+  resources: z.array(z.string()),
+});
+
+export function deploymentPreparedStackOverrideAwStackFromJSON(
+  jsonString: string,
+): SafeParseResult<DeploymentPreparedStackOverrideAwStack, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideAwStack$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentPreparedStackOverrideAwStack' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideAwBinding$inboundSchema: z.ZodType<
+  DeploymentPreparedStackOverrideAwBinding,
+  unknown
+> = z.object({
+  resource: z.lazy(() =>
+    DeploymentPreparedStackOverrideAwResource$inboundSchema
+  ).optional(),
+  stack: z.lazy(() => DeploymentPreparedStackOverrideAwStack$inboundSchema)
+    .optional(),
+});
+
+export function deploymentPreparedStackOverrideAwBindingFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackOverrideAwBinding,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideAwBinding$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackOverrideAwBinding' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideEffect$inboundSchema: z.ZodEnum<
+  typeof DeploymentPreparedStackOverrideEffect
+> = z.enum(DeploymentPreparedStackOverrideEffect);
+
+/** @internal */
+export const DeploymentPreparedStackOverrideAwGrant$inboundSchema: z.ZodType<
+  DeploymentPreparedStackOverrideAwGrant,
+  unknown
+> = z.object({
+  actions: z.nullable(z.array(z.string())).optional(),
+  dataActions: z.nullable(z.array(z.string())).optional(),
+  permissions: z.nullable(z.array(z.string())).optional(),
+  predefinedRoles: z.nullable(z.array(z.string())).optional(),
+  residualPermissions: z.nullable(z.array(z.string())).optional(),
+});
+
+export function deploymentPreparedStackOverrideAwGrantFromJSON(
+  jsonString: string,
+): SafeParseResult<DeploymentPreparedStackOverrideAwGrant, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideAwGrant$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentPreparedStackOverrideAwGrant' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideAw$inboundSchema: z.ZodType<
+  DeploymentPreparedStackOverrideAw,
+  unknown
+> = z.object({
+  binding: z.lazy(() => DeploymentPreparedStackOverrideAwBinding$inboundSchema),
+  description: z.nullable(z.string()).optional(),
+  effect: DeploymentPreparedStackOverrideEffect$inboundSchema.optional(),
+  grant: z.lazy(() => DeploymentPreparedStackOverrideAwGrant$inboundSchema),
+  label: z.nullable(z.string()).optional(),
+});
+
+export function deploymentPreparedStackOverrideAwFromJSON(
+  jsonString: string,
+): SafeParseResult<DeploymentPreparedStackOverrideAw, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => DeploymentPreparedStackOverrideAw$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentPreparedStackOverrideAw' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideAzureResource$inboundSchema:
+  z.ZodType<DeploymentPreparedStackOverrideAzureResource, unknown> = z.object({
+    scope: z.string(),
+  });
+
+export function deploymentPreparedStackOverrideAzureResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackOverrideAzureResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideAzureResource$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackOverrideAzureResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideAzureStack$inboundSchema: z.ZodType<
+  DeploymentPreparedStackOverrideAzureStack,
+  unknown
+> = z.object({
+  scope: z.string(),
+});
+
+export function deploymentPreparedStackOverrideAzureStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackOverrideAzureStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideAzureStack$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackOverrideAzureStack' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideAzureBinding$inboundSchema:
+  z.ZodType<DeploymentPreparedStackOverrideAzureBinding, unknown> = z.object({
+    resource: z.lazy(() =>
+      DeploymentPreparedStackOverrideAzureResource$inboundSchema
+    ).optional(),
+    stack: z.lazy(() => DeploymentPreparedStackOverrideAzureStack$inboundSchema)
+      .optional(),
+  });
+
+export function deploymentPreparedStackOverrideAzureBindingFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackOverrideAzureBinding,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideAzureBinding$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackOverrideAzureBinding' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideAzureGrant$inboundSchema: z.ZodType<
+  DeploymentPreparedStackOverrideAzureGrant,
+  unknown
+> = z.object({
+  actions: z.nullable(z.array(z.string())).optional(),
+  dataActions: z.nullable(z.array(z.string())).optional(),
+  permissions: z.nullable(z.array(z.string())).optional(),
+  predefinedRoles: z.nullable(z.array(z.string())).optional(),
+  residualPermissions: z.nullable(z.array(z.string())).optional(),
+});
+
+export function deploymentPreparedStackOverrideAzureGrantFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackOverrideAzureGrant,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideAzureGrant$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackOverrideAzureGrant' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideAzure$inboundSchema: z.ZodType<
+  DeploymentPreparedStackOverrideAzure,
+  unknown
+> = z.object({
+  binding: z.lazy(() =>
+    DeploymentPreparedStackOverrideAzureBinding$inboundSchema
+  ),
+  description: z.nullable(z.string()).optional(),
+  grant: z.lazy(() => DeploymentPreparedStackOverrideAzureGrant$inboundSchema),
+  label: z.nullable(z.string()).optional(),
+});
+
+export function deploymentPreparedStackOverrideAzureFromJSON(
+  jsonString: string,
+): SafeParseResult<DeploymentPreparedStackOverrideAzure, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideAzure$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentPreparedStackOverrideAzure' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideConditionResource$inboundSchema:
+  z.ZodType<DeploymentPreparedStackOverrideConditionResource, unknown> = z
+    .object({
+      expression: z.string(),
+      title: z.string(),
+    });
+
+export function deploymentPreparedStackOverrideConditionResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackOverrideConditionResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideConditionResource$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackOverrideConditionResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideResourceConditionUnion$inboundSchema:
+  z.ZodType<DeploymentPreparedStackOverrideResourceConditionUnion, unknown> = z
+    .union([
+      z.lazy(() =>
+        DeploymentPreparedStackOverrideConditionResource$inboundSchema
+      ),
+      z.string(),
+    ]);
+
+export function deploymentPreparedStackOverrideResourceConditionUnionFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackOverrideResourceConditionUnion,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideResourceConditionUnion$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackOverrideResourceConditionUnion' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideGcpResource$inboundSchema:
+  z.ZodType<DeploymentPreparedStackOverrideGcpResource, unknown> = z.object({
+    condition: z.nullable(
+      z.union([
+        z.lazy(() =>
+          DeploymentPreparedStackOverrideConditionResource$inboundSchema
+        ),
+        z.string(),
+      ]),
+    ).optional(),
+    scope: z.string(),
+  });
+
+export function deploymentPreparedStackOverrideGcpResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackOverrideGcpResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideGcpResource$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackOverrideGcpResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideConditionStack$inboundSchema:
+  z.ZodType<DeploymentPreparedStackOverrideConditionStack, unknown> = z.object({
+    expression: z.string(),
+    title: z.string(),
+  });
+
+export function deploymentPreparedStackOverrideConditionStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackOverrideConditionStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideConditionStack$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackOverrideConditionStack' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideStackConditionUnion$inboundSchema:
+  z.ZodType<DeploymentPreparedStackOverrideStackConditionUnion, unknown> = z
+    .union([
+      z.lazy(() => DeploymentPreparedStackOverrideConditionStack$inboundSchema),
+      z.string(),
+    ]);
+
+export function deploymentPreparedStackOverrideStackConditionUnionFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackOverrideStackConditionUnion,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideStackConditionUnion$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackOverrideStackConditionUnion' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideGcpStack$inboundSchema: z.ZodType<
+  DeploymentPreparedStackOverrideGcpStack,
+  unknown
+> = z.object({
+  condition: z.nullable(
+    z.union([
+      z.lazy(() => DeploymentPreparedStackOverrideConditionStack$inboundSchema),
+      z.string(),
+    ]),
+  ).optional(),
+  scope: z.string(),
+});
+
+export function deploymentPreparedStackOverrideGcpStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackOverrideGcpStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideGcpStack$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackOverrideGcpStack' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideGcpBinding$inboundSchema: z.ZodType<
+  DeploymentPreparedStackOverrideGcpBinding,
+  unknown
+> = z.object({
+  resource: z.lazy(() =>
+    DeploymentPreparedStackOverrideGcpResource$inboundSchema
+  ).optional(),
+  stack: z.lazy(() => DeploymentPreparedStackOverrideGcpStack$inboundSchema)
+    .optional(),
+});
+
+export function deploymentPreparedStackOverrideGcpBindingFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackOverrideGcpBinding,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideGcpBinding$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackOverrideGcpBinding' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideGcpGrant$inboundSchema: z.ZodType<
+  DeploymentPreparedStackOverrideGcpGrant,
+  unknown
+> = z.object({
+  actions: z.nullable(z.array(z.string())).optional(),
+  dataActions: z.nullable(z.array(z.string())).optional(),
+  permissions: z.nullable(z.array(z.string())).optional(),
+  predefinedRoles: z.nullable(z.array(z.string())).optional(),
+  residualPermissions: z.nullable(z.array(z.string())).optional(),
+});
+
+export function deploymentPreparedStackOverrideGcpGrantFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackOverrideGcpGrant,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideGcpGrant$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackOverrideGcpGrant' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideGcp$inboundSchema: z.ZodType<
+  DeploymentPreparedStackOverrideGcp,
+  unknown
+> = z.object({
+  binding: z.lazy(() =>
+    DeploymentPreparedStackOverrideGcpBinding$inboundSchema
+  ),
+  description: z.nullable(z.string()).optional(),
+  grant: z.lazy(() => DeploymentPreparedStackOverrideGcpGrant$inboundSchema),
+  label: z.nullable(z.string()).optional(),
+});
+
+export function deploymentPreparedStackOverrideGcpFromJSON(
+  jsonString: string,
+): SafeParseResult<DeploymentPreparedStackOverrideGcp, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideGcp$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentPreparedStackOverrideGcp' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverridePlatforms$inboundSchema: z.ZodType<
+  DeploymentPreparedStackOverridePlatforms,
+  unknown
+> = z.object({
+  aws: z.nullable(
+    z.array(z.lazy(() => DeploymentPreparedStackOverrideAw$inboundSchema)),
+  ).optional(),
+  azure: z.nullable(
+    z.array(z.lazy(() => DeploymentPreparedStackOverrideAzure$inboundSchema)),
+  ).optional(),
+  gcp: z.nullable(
+    z.array(z.lazy(() => DeploymentPreparedStackOverrideGcp$inboundSchema)),
+  ).optional(),
+});
+
+export function deploymentPreparedStackOverridePlatformsFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackOverridePlatforms,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverridePlatforms$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackOverridePlatforms' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverride$inboundSchema: z.ZodType<
+  DeploymentPreparedStackOverride,
+  unknown
+> = z.object({
+  description: z.string(),
+  id: z.string(),
+  platforms: z.lazy(() =>
+    DeploymentPreparedStackOverridePlatforms$inboundSchema
+  ),
+});
+
+export function deploymentPreparedStackOverrideFromJSON(
+  jsonString: string,
+): SafeParseResult<DeploymentPreparedStackOverride, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => DeploymentPreparedStackOverride$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentPreparedStackOverride' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackOverrideUnion$inboundSchema: z.ZodType<
+  DeploymentPreparedStackOverrideUnion,
+  unknown
+> = z.union([
+  z.lazy(() => DeploymentPreparedStackOverride$inboundSchema),
+  z.string(),
+]);
+
+export function deploymentPreparedStackOverrideUnionFromJSON(
+  jsonString: string,
+): SafeParseResult<DeploymentPreparedStackOverrideUnion, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackOverrideUnion$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentPreparedStackOverrideUnion' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackManagement2$inboundSchema: z.ZodType<
+  DeploymentPreparedStackManagement2,
+  unknown
+> = z.object({
+  override: z.record(
+    z.string(),
+    z.array(z.union([
+      z.lazy(() => DeploymentPreparedStackOverride$inboundSchema),
+      z.string(),
+    ])),
+  ),
+});
+
+export function deploymentPreparedStackManagement2FromJSON(
+  jsonString: string,
+): SafeParseResult<DeploymentPreparedStackManagement2, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackManagement2$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentPreparedStackManagement2' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackExtendAwResource$inboundSchema: z.ZodType<
+  DeploymentPreparedStackExtendAwResource,
+  unknown
+> = z.object({
+  condition: z.nullable(z.record(z.string(), z.record(z.string(), z.string())))
+    .optional(),
+  notResources: z.array(z.string()).optional(),
+  resources: z.array(z.string()),
+});
+
+export function deploymentPreparedStackExtendAwResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackExtendAwResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackExtendAwResource$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackExtendAwResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackExtendAwStack$inboundSchema: z.ZodType<
+  DeploymentPreparedStackExtendAwStack,
+  unknown
+> = z.object({
+  condition: z.nullable(z.record(z.string(), z.record(z.string(), z.string())))
+    .optional(),
+  notResources: z.array(z.string()).optional(),
+  resources: z.array(z.string()),
+});
+
+export function deploymentPreparedStackExtendAwStackFromJSON(
+  jsonString: string,
+): SafeParseResult<DeploymentPreparedStackExtendAwStack, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackExtendAwStack$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentPreparedStackExtendAwStack' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackExtendAwBinding$inboundSchema: z.ZodType<
+  DeploymentPreparedStackExtendAwBinding,
+  unknown
+> = z.object({
+  resource: z.lazy(() => DeploymentPreparedStackExtendAwResource$inboundSchema)
+    .optional(),
+  stack: z.lazy(() => DeploymentPreparedStackExtendAwStack$inboundSchema)
+    .optional(),
+});
+
+export function deploymentPreparedStackExtendAwBindingFromJSON(
+  jsonString: string,
+): SafeParseResult<DeploymentPreparedStackExtendAwBinding, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackExtendAwBinding$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentPreparedStackExtendAwBinding' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackExtendEffect$inboundSchema: z.ZodEnum<
+  typeof DeploymentPreparedStackExtendEffect
+> = z.enum(DeploymentPreparedStackExtendEffect);
+
+/** @internal */
+export const DeploymentPreparedStackExtendAwGrant$inboundSchema: z.ZodType<
+  DeploymentPreparedStackExtendAwGrant,
+  unknown
+> = z.object({
+  actions: z.nullable(z.array(z.string())).optional(),
+  dataActions: z.nullable(z.array(z.string())).optional(),
+  permissions: z.nullable(z.array(z.string())).optional(),
+  predefinedRoles: z.nullable(z.array(z.string())).optional(),
+  residualPermissions: z.nullable(z.array(z.string())).optional(),
+});
+
+export function deploymentPreparedStackExtendAwGrantFromJSON(
+  jsonString: string,
+): SafeParseResult<DeploymentPreparedStackExtendAwGrant, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackExtendAwGrant$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentPreparedStackExtendAwGrant' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackExtendAw$inboundSchema: z.ZodType<
+  DeploymentPreparedStackExtendAw,
+  unknown
+> = z.object({
+  binding: z.lazy(() => DeploymentPreparedStackExtendAwBinding$inboundSchema),
+  description: z.nullable(z.string()).optional(),
+  effect: DeploymentPreparedStackExtendEffect$inboundSchema.optional(),
+  grant: z.lazy(() => DeploymentPreparedStackExtendAwGrant$inboundSchema),
+  label: z.nullable(z.string()).optional(),
+});
+
+export function deploymentPreparedStackExtendAwFromJSON(
+  jsonString: string,
+): SafeParseResult<DeploymentPreparedStackExtendAw, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => DeploymentPreparedStackExtendAw$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentPreparedStackExtendAw' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackExtendAzureResource$inboundSchema:
+  z.ZodType<DeploymentPreparedStackExtendAzureResource, unknown> = z.object({
+    scope: z.string(),
+  });
+
+export function deploymentPreparedStackExtendAzureResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackExtendAzureResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackExtendAzureResource$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackExtendAzureResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackExtendAzureStack$inboundSchema: z.ZodType<
+  DeploymentPreparedStackExtendAzureStack,
+  unknown
+> = z.object({
+  scope: z.string(),
+});
+
+export function deploymentPreparedStackExtendAzureStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackExtendAzureStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackExtendAzureStack$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackExtendAzureStack' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackExtendAzureBinding$inboundSchema: z.ZodType<
+  DeploymentPreparedStackExtendAzureBinding,
+  unknown
+> = z.object({
+  resource: z.lazy(() =>
+    DeploymentPreparedStackExtendAzureResource$inboundSchema
+  ).optional(),
+  stack: z.lazy(() => DeploymentPreparedStackExtendAzureStack$inboundSchema)
+    .optional(),
+});
+
+export function deploymentPreparedStackExtendAzureBindingFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackExtendAzureBinding,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackExtendAzureBinding$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackExtendAzureBinding' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackExtendAzureGrant$inboundSchema: z.ZodType<
+  DeploymentPreparedStackExtendAzureGrant,
+  unknown
+> = z.object({
+  actions: z.nullable(z.array(z.string())).optional(),
+  dataActions: z.nullable(z.array(z.string())).optional(),
+  permissions: z.nullable(z.array(z.string())).optional(),
+  predefinedRoles: z.nullable(z.array(z.string())).optional(),
+  residualPermissions: z.nullable(z.array(z.string())).optional(),
+});
+
+export function deploymentPreparedStackExtendAzureGrantFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackExtendAzureGrant,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackExtendAzureGrant$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackExtendAzureGrant' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackExtendAzure$inboundSchema: z.ZodType<
+  DeploymentPreparedStackExtendAzure,
+  unknown
+> = z.object({
+  binding: z.lazy(() =>
+    DeploymentPreparedStackExtendAzureBinding$inboundSchema
+  ),
+  description: z.nullable(z.string()).optional(),
+  grant: z.lazy(() => DeploymentPreparedStackExtendAzureGrant$inboundSchema),
+  label: z.nullable(z.string()).optional(),
+});
+
+export function deploymentPreparedStackExtendAzureFromJSON(
+  jsonString: string,
+): SafeParseResult<DeploymentPreparedStackExtendAzure, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackExtendAzure$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentPreparedStackExtendAzure' from JSON`,
+  );
+}
 
-export type Deployment = {
-  /**
-   * Unique identifier for the deployment.
-   */
-  id: string;
-  /**
-   * Deployment name.
-   */
-  name: string;
-  /**
-   * Public subdomain for auto-generated domains
-   */
-  publicSubdomain?: string | null | undefined;
-  /**
-   * Deployment status in the deployment lifecycle.
-   *
-   * @remarks
-   *
-   * For observe-only deployments with no release or stack state, `Running`
-   * means the Operator is attached. Connectivity comes from `lastHeartbeatAt`;
-   * resource health comes from inventory and resource heartbeat data.
-   */
-  status: DeploymentStatus;
-  /**
-   * Unique identifier for the project.
-   */
-  projectId: string;
-  /**
-   * Target platform for the deployment
-   */
-  platform: DeploymentPlatform;
-  /**
-   * Underlying cloud platform for Kubernetes deployments.
-   */
-  basePlatform?: DeploymentBasePlatform | null | undefined;
-  /**
-   * Cloud region or location for the deployment.
-   */
-  region?: string | null | undefined;
-  /**
-   * DeploymentState protocol version owned by the runtime/manager
-   */
-  deploymentProtocolVersion: number;
-  /**
-   * ID of deployment group this deployment belongs to
-   */
-  deploymentGroupId: string;
-  /**
-   * Operational purpose of this deployment within its customer environment.
-   */
-  purpose: DeploymentPurpose;
-  /**
-   * Cloud environment information
-   */
-  environmentInfo?: DeploymentEnvironmentInfoUnion | null | undefined;
-  /**
-   * User-provided configuration (network, deployment model, approvals)
-   */
-  stackSettings: DeploymentStackSettings;
-  /**
-   * State of infrastructure components managed by this deployment
-   */
-  stackState?: DeploymentStackState | null | undefined;
-  /**
-   * Runtime metadata for deployment state persistence
-   */
-  runtimeMetadata?: DeploymentRuntimeMetadata | null | undefined;
-  /**
-   * ID of the currently deployed release (actual state)
-   */
-  currentReleaseId?: string | null | undefined;
-  /**
-   * ID of the desired release for deployment/update (desired state)
-   */
-  desiredReleaseId?: string | null | undefined;
-  /**
-   * ID of the pinned release
-   */
-  pinnedReleaseId?: string | null | undefined;
-  releaseChannel: string;
-  /**
-   * Setup source that imported this deployment
-   */
-  importSource?: DeploymentImportSource | null | undefined;
-  /**
-   * Setup method that created the deployment record and owns setup-time resources.
-   */
-  setupMethod?: DeploymentSetupMethod1 | null | undefined;
-  /**
-   * Setup method metadata needed to guide privileged teardown.
-   */
-  setupMetadata?: { [k: string]: any | null } | null | undefined;
-  /**
-   * Imported setup target for compatibility checks
-   */
-  setupTarget?: string | null | undefined;
-  /**
-   * Imported setup compatibility fingerprint
-   */
-  setupFingerprint?: string | null | undefined;
-  /**
-   * Imported setup fingerprint algorithm version
-   */
-  setupFingerprintVersion?: number | null | undefined;
-  /**
-   * Display-only scope reported by the Operator manifest
-   */
-  operatorScope?: string | null | undefined;
-  /**
-   * Display-only permission tier reported by the Operator manifest
-   */
-  operatorPermission?: string | null | undefined;
-  /**
-   * Version reported by the Operator
-   */
-  operatorVersion?: string | null | undefined;
-  /**
-   * Capability state reported by the Operator
-   */
-  capabilities?: Array<OperatorCapabilityReport> | null | undefined;
-  /**
-   * Enabled-plugin-bundle-set hash the Operator reports having loaded
-   */
-  observedOperationsBundleHash?: string | null | undefined;
-  /**
-   * Operations the Operator reports as currently loaded
-   */
-  observedOperations?: Array<ReportedOperation> | null | undefined;
-  /**
-   * Whether a retry has been requested for a failed deployment
-   */
-  retryRequested: boolean;
-  /**
-   * Timestamp of the last received heartbeat from the deployment
-   */
-  lastHeartbeatAt?: Date | null | undefined;
-  /**
-   * Latest error information if the deployment is in a failed state
-   */
-  error?: DeploymentError | null | undefined;
-  /**
-   * Durable progress for deployment updates
-   */
-  updateState?: DeploymentUpdateState | undefined;
-  createdAt: Date;
-  updatedAt: Date;
-  managerId: string;
-  /**
-   * Unique identifier for the workspace.
-   */
-  workspaceId: string;
-};
+/** @internal */
+export const DeploymentPreparedStackExtendConditionResource$inboundSchema:
+  z.ZodType<DeploymentPreparedStackExtendConditionResource, unknown> = z.object(
+    {
+      expression: z.string(),
+      title: z.string(),
+    },
+  );
+
+export function deploymentPreparedStackExtendConditionResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackExtendConditionResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackExtendConditionResource$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackExtendConditionResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackExtendResourceConditionUnion$inboundSchema:
+  z.ZodType<DeploymentPreparedStackExtendResourceConditionUnion, unknown> = z
+    .union([
+      z.lazy(() =>
+        DeploymentPreparedStackExtendConditionResource$inboundSchema
+      ),
+      z.string(),
+    ]);
+
+export function deploymentPreparedStackExtendResourceConditionUnionFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackExtendResourceConditionUnion,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackExtendResourceConditionUnion$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackExtendResourceConditionUnion' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackExtendGcpResource$inboundSchema: z.ZodType<
+  DeploymentPreparedStackExtendGcpResource,
+  unknown
+> = z.object({
+  condition: z.nullable(
+    z.union([
+      z.lazy(() =>
+        DeploymentPreparedStackExtendConditionResource$inboundSchema
+      ),
+      z.string(),
+    ]),
+  ).optional(),
+  scope: z.string(),
+});
+
+export function deploymentPreparedStackExtendGcpResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackExtendGcpResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackExtendGcpResource$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackExtendGcpResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentPreparedStackExtendConditionStack$inboundSchema:
+  z.ZodType<DeploymentPreparedStackExtendConditionStack, unknown> = z.object({
+    expression: z.string(),
+    title: z.string(),
+  });
+
+export function deploymentPreparedStackExtendConditionStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentPreparedStackExtendConditionStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackExtendConditionStack$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentPreparedStackExtendConditionStack' from JSON`,
+  );
+}
 
 /** @internal */
 export const DeploymentPreparedStackExtendStackConditionUnion$inboundSchema:
   z.ZodType<DeploymentPreparedStackExtendStackConditionUnion, unknown> = z
     .union([
-      DeploymentPreparedStackExtendConditionStack$inboundSchema,
+      z.lazy(() => DeploymentPreparedStackExtendConditionStack$inboundSchema),
       z.string(),
     ]);
 
@@ -1234,7 +2816,7 @@ export const DeploymentPreparedStackExtendGcpStack$inboundSchema: z.ZodType<
 > = z.object({
   condition: z.nullable(
     z.union([
-      DeploymentPreparedStackExtendConditionStack$inboundSchema,
+      z.lazy(() => DeploymentPreparedStackExtendConditionStack$inboundSchema),
       z.string(),
     ]),
   ).optional(),
@@ -1257,7 +2839,8 @@ export const DeploymentPreparedStackExtendGcpBinding$inboundSchema: z.ZodType<
   DeploymentPreparedStackExtendGcpBinding,
   unknown
 > = z.object({
-  resource: DeploymentPreparedStackExtendGcpResource$inboundSchema.optional(),
+  resource: z.lazy(() => DeploymentPreparedStackExtendGcpResource$inboundSchema)
+    .optional(),
   stack: z.lazy(() => DeploymentPreparedStackExtendGcpStack$inboundSchema)
     .optional(),
 });
@@ -1327,10 +2910,12 @@ export const DeploymentPreparedStackExtendPlatforms$inboundSchema: z.ZodType<
   DeploymentPreparedStackExtendPlatforms,
   unknown
 > = z.object({
-  aws: z.nullable(z.array(DeploymentPreparedStackExtendAw$inboundSchema))
-    .optional(),
-  azure: z.nullable(z.array(DeploymentPreparedStackExtendAzure$inboundSchema))
-    .optional(),
+  aws: z.nullable(
+    z.array(z.lazy(() => DeploymentPreparedStackExtendAw$inboundSchema)),
+  ).optional(),
+  azure: z.nullable(
+    z.array(z.lazy(() => DeploymentPreparedStackExtendAzure$inboundSchema)),
+  ).optional(),
   gcp: z.nullable(
     z.array(z.lazy(() => DeploymentPreparedStackExtendGcp$inboundSchema)),
   ).optional(),
@@ -1418,7 +3003,7 @@ export const DeploymentPreparedStackManagementUnion$inboundSchema: z.ZodType<
   unknown
 > = z.union([
   z.lazy(() => DeploymentPreparedStackManagement1$inboundSchema),
-  DeploymentPreparedStackManagement2$inboundSchema,
+  z.lazy(() => DeploymentPreparedStackManagement2$inboundSchema),
   DeploymentPreparedStackManagementEnum$inboundSchema,
 ]);
 
@@ -1990,7 +3575,7 @@ export const DeploymentPreparedStackPermissions$inboundSchema: z.ZodType<
 > = z.object({
   management: z.union([
     z.lazy(() => DeploymentPreparedStackManagement1$inboundSchema),
-    DeploymentPreparedStackManagement2$inboundSchema,
+    z.lazy(() => DeploymentPreparedStackManagement2$inboundSchema),
     DeploymentPreparedStackManagementEnum$inboundSchema,
   ]).optional(),
   profiles: z.record(
@@ -2103,6 +3688,9 @@ export const DeploymentPreparedStack$inboundSchema: z.ZodType<
   dynamicContainerRepositories: z.array(z.string()).optional(),
   id: z.string(),
   inputs: z.array(DeploymentPreparedStackInput$inboundSchema).optional(),
+  operations: z.nullable(
+    z.union([DeploymentPreparedStackOperations$inboundSchema, z.string()]),
+  ).optional(),
   permissions: z.lazy(() => DeploymentPreparedStackPermissions$inboundSchema)
     .optional(),
   resources: z.record(
@@ -2403,6 +3991,8 @@ export const Deployment$inboundSchema: z.ZodType<Deployment, unknown> = z
     region: z.nullable(z.string()).optional(),
     deploymentProtocolVersion: z.int(),
     deploymentGroupId: z.string(),
+    membershipRevision: z.int().default(0),
+    membershipProjectionRevision: z.nullable(z.int()).default(null),
     purpose: DeploymentPurpose$inboundSchema,
     environmentInfo: z.nullable(DeploymentEnvironmentInfoUnion$inboundSchema)
       .optional(),