@alienplatform/platform-api 3.3.30 → 3.3.32

package/src/models/deploymentdetailresponse.ts

@@ -26,25 +26,15 @@ import {
   DeploymentDetailResponseStackState$inboundSchema,
   DeploymentDetailResponseStatus,
   DeploymentDetailResponseStatus$inboundSchema,
-} from "./deploymentdetailresponsependingpreparedstacktypeunion.js";
+} from "./deploymentdetailresponsependingpreparedstacktypeenvenum.js";
 import {
   DeploymentDetailResponsePendingPreparedStackUnion,
   DeploymentDetailResponsePendingPreparedStackUnion$inboundSchema,
-  DeploymentDetailResponsePreparedStackExtendAw,
-  DeploymentDetailResponsePreparedStackExtendAw$inboundSchema,
-  DeploymentDetailResponsePreparedStackExtendAzure,
-  DeploymentDetailResponsePreparedStackExtendAzure$inboundSchema,
-  DeploymentDetailResponsePreparedStackExtendConditionStack,
-  DeploymentDetailResponsePreparedStackExtendConditionStack$inboundSchema,
-  DeploymentDetailResponsePreparedStackExtendGcpResource,
-  DeploymentDetailResponsePreparedStackExtendGcpResource$inboundSchema,
   DeploymentDetailResponsePreparedStackInput,
   DeploymentDetailResponsePreparedStackInput$inboundSchema,
-  DeploymentDetailResponsePreparedStackManagement2,
-  DeploymentDetailResponsePreparedStackManagement2$inboundSchema,
-  DeploymentDetailResponsePreparedStackManagementEnum,
-  DeploymentDetailResponsePreparedStackManagementEnum$inboundSchema,
-} from "./deploymentdetailresponsepreparedstackextendconditionstack.js";
+  DeploymentDetailResponsePreparedStackOperations,
+  DeploymentDetailResponsePreparedStackOperations$inboundSchema,
+} from "./deploymentdetailresponsepreparedstackoperations.js";
 import {
   DeploymentGroupInfo,
   DeploymentGroupInfo$inboundSchema,
@@ -87,160 +77,21 @@ import {
   ReportedOperation$inboundSchema,
 } from "./reportedoperation.js";
 
-export type DeploymentDetailResponsePreparedStackExtendStackConditionUnion =
-  | DeploymentDetailResponsePreparedStackExtendConditionStack
-  | string;
-
-/**
- * GCP-specific binding specification
- */
-export type DeploymentDetailResponsePreparedStackExtendGcpStack = {
-  condition?:
-    | DeploymentDetailResponsePreparedStackExtendConditionStack
-    | string
-    | null
-    | undefined;
-  /**
-   * Scope (project/resource level)
-   */
-  scope: string;
-};
-
-/**
- * Generic binding configuration for permissions
- */
-export type DeploymentDetailResponsePreparedStackExtendGcpBinding = {
-  /**
-   * GCP-specific binding specification
-   */
-  resource?: DeploymentDetailResponsePreparedStackExtendGcpResource | undefined;
-  /**
-   * GCP-specific binding specification
-   */
-  stack?: DeploymentDetailResponsePreparedStackExtendGcpStack | undefined;
-};
-
-/**
- * Grant permissions for a specific cloud platform
- */
-export type DeploymentDetailResponsePreparedStackExtendGcpGrant = {
-  /**
-   * AWS IAM actions (only for AWS)
-   */
-  actions?: Array<string> | null | undefined;
-  /**
-   * Azure actions (only for Azure)
-   */
-  dataActions?: Array<string> | null | undefined;
-  /**
-   * GCP permissions that require an exact residual custom role.
-   */
-  permissions?: Array<string> | null | undefined;
-  /**
-   * Provider predefined roles to bind directly.
-   */
-  predefinedRoles?: Array<string> | null | undefined;
-  /**
-   * GCP residual custom permissions to pair with predefined roles.
-   */
-  residualPermissions?: Array<string> | null | undefined;
-};
-
-/**
- * GCP-specific platform permission configuration
- */
-export type DeploymentDetailResponsePreparedStackExtendGcp = {
-  /**
-   * Generic binding configuration for permissions
-   */
-  binding: DeploymentDetailResponsePreparedStackExtendGcpBinding;
-  /**
-   * Short admin-facing description of why this entry exists.
-   */
-  description?: string | null | undefined;
-  /**
-   * Grant permissions for a specific cloud platform
-   */
-  grant: DeploymentDetailResponsePreparedStackExtendGcpGrant;
-  /**
-   * Stable admin-facing label for this permission entry.
-   */
-  label?: string | null | undefined;
-};
-
-/**
- * Platform-specific permission configurations
- */
-export type DeploymentDetailResponsePreparedStackExtendPlatforms = {
-  /**
-   * AWS permission configurations
-   */
-  aws?: Array<DeploymentDetailResponsePreparedStackExtendAw> | null | undefined;
-  /**
-   * Azure permission configurations
-   */
-  azure?:
-    | Array<DeploymentDetailResponsePreparedStackExtendAzure>
-    | null
-    | undefined;
-  /**
-   * GCP permission configurations
-   */
-  gcp?:
-    | Array<DeploymentDetailResponsePreparedStackExtendGcp>
-    | null
-    | undefined;
-};
-
-/**
- * A permission set that can be applied across different cloud platforms
- */
-export type DeploymentDetailResponsePreparedStackExtend = {
-  /**
-   * Human-readable description of what this permission set allows
-   */
-  description: string;
-  /**
-   * Unique identifier for the permission set (e.g., "storage/data-read")
-   */
-  id: string;
-  /**
-   * Platform-specific permission configurations
-   */
-  platforms: DeploymentDetailResponsePreparedStackExtendPlatforms;
-};
-
-/**
- * Reference to a permission set - either by name or inline definition
- */
-export type DeploymentDetailResponsePreparedStackExtendUnion =
-  | DeploymentDetailResponsePreparedStackExtend
+export type DeploymentDetailResponsePreparedStackOperationsUnion =
+  | DeploymentDetailResponsePreparedStackOperations
   | string;
 
-export type DeploymentDetailResponsePreparedStackManagement1 = {
-  /**
-   * Permission profile that maps resources to permission sets
-   *
-   * @remarks
-   * Key can be "*" for all resources or resource name for specific resource
-   */
-  extend: {
-    [k: string]: Array<DeploymentDetailResponsePreparedStackExtend | string>;
-  };
-};
-
-/**
- * Management permissions configuration for stack management access
- */
-export type DeploymentDetailResponsePreparedStackManagementUnion =
-  | DeploymentDetailResponsePreparedStackManagement1
-  | DeploymentDetailResponsePreparedStackManagement2
-  | DeploymentDetailResponsePreparedStackManagementEnum;
+export const DeploymentDetailResponsePreparedStackManagementEnum = {
+  Auto: "auto",
+} as const;
+export type DeploymentDetailResponsePreparedStackManagementEnum = ClosedEnum<
+  typeof DeploymentDetailResponsePreparedStackManagementEnum
+>;
 
 /**
  * AWS-specific binding specification
  */
-export type DeploymentDetailResponsePreparedStackProfileAwResource = {
+export type DeploymentDetailResponsePreparedStackOverrideAwResource = {
   /**
    * Optional condition for additional filtering (rare)
    */
@@ -262,7 +113,7 @@ export type DeploymentDetailResponsePreparedStackProfileAwResource = {
 /**
  * AWS-specific binding specification
  */
-export type DeploymentDetailResponsePreparedStackProfileAwStack = {
+export type DeploymentDetailResponsePreparedStackOverrideAwStack = {
   /**
    * Optional condition for additional filtering (rare)
    */
@@ -284,35 +135,37 @@ export type DeploymentDetailResponsePreparedStackProfileAwStack = {
 /**
  * Generic binding configuration for permissions
  */
-export type DeploymentDetailResponsePreparedStackProfileAwBinding = {
+export type DeploymentDetailResponsePreparedStackOverrideAwBinding = {
   /**
    * AWS-specific binding specification
    */
-  resource?: DeploymentDetailResponsePreparedStackProfileAwResource | undefined;
+  resource?:
+    | DeploymentDetailResponsePreparedStackOverrideAwResource
+    | undefined;
   /**
    * AWS-specific binding specification
    */
-  stack?: DeploymentDetailResponsePreparedStackProfileAwStack | undefined;
+  stack?: DeploymentDetailResponsePreparedStackOverrideAwStack | undefined;
 };
 
 /**
  * IAM effect. Defaults to Allow.
  */
-export const DeploymentDetailResponsePreparedStackProfileEffect = {
+export const DeploymentDetailResponsePreparedStackOverrideEffect = {
   Allow: "Allow",
   Deny: "Deny",
 } as const;
 /**
  * IAM effect. Defaults to Allow.
  */
-export type DeploymentDetailResponsePreparedStackProfileEffect = ClosedEnum<
-  typeof DeploymentDetailResponsePreparedStackProfileEffect
+export type DeploymentDetailResponsePreparedStackOverrideEffect = ClosedEnum<
+  typeof DeploymentDetailResponsePreparedStackOverrideEffect
 >;
 
 /**
  * Grant permissions for a specific cloud platform
  */
-export type DeploymentDetailResponsePreparedStackProfileAwGrant = {
+export type DeploymentDetailResponsePreparedStackOverrideAwGrant = {
   /**
    * AWS IAM actions (only for AWS)
    */
@@ -338,11 +191,11 @@ export type DeploymentDetailResponsePreparedStackProfileAwGrant = {
 /**
  * AWS-specific platform permission configuration
  */
-export type DeploymentDetailResponsePreparedStackProfileAw = {
+export type DeploymentDetailResponsePreparedStackOverrideAw = {
   /**
    * Generic binding configuration for permissions
    */
-  binding: DeploymentDetailResponsePreparedStackProfileAwBinding;
+  binding: DeploymentDetailResponsePreparedStackOverrideAwBinding;
   /**
    * Short admin-facing description of why this entry exists.
    */
@@ -350,11 +203,11 @@ export type DeploymentDetailResponsePreparedStackProfileAw = {
   /**
    * IAM effect. Defaults to Allow.
    */
-  effect?: DeploymentDetailResponsePreparedStackProfileEffect | undefined;
+  effect?: DeploymentDetailResponsePreparedStackOverrideEffect | undefined;
   /**
    * Grant permissions for a specific cloud platform
    */
-  grant: DeploymentDetailResponsePreparedStackProfileAwGrant;
+  grant: DeploymentDetailResponsePreparedStackOverrideAwGrant;
   /**
    * Stable admin-facing label for this permission entry.
    */
@@ -364,7 +217,7 @@ export type DeploymentDetailResponsePreparedStackProfileAw = {
 /**
  * Azure-specific binding specification
  */
-export type DeploymentDetailResponsePreparedStackProfileAzureResource = {
+export type DeploymentDetailResponsePreparedStackOverrideAzureResource = {
   /**
    * Scope (subscription/resource group/resource level)
    */
@@ -374,7 +227,7 @@ export type DeploymentDetailResponsePreparedStackProfileAzureResource = {
 /**
  * Azure-specific binding specification
  */
-export type DeploymentDetailResponsePreparedStackProfileAzureStack = {
+export type DeploymentDetailResponsePreparedStackOverrideAzureStack = {
   /**
    * Scope (subscription/resource group/resource level)
    */
@@ -384,23 +237,23 @@ export type DeploymentDetailResponsePreparedStackProfileAzureStack = {
 /**
  * Generic binding configuration for permissions
  */
-export type DeploymentDetailResponsePreparedStackProfileAzureBinding = {
+export type DeploymentDetailResponsePreparedStackOverrideAzureBinding = {
   /**
    * Azure-specific binding specification
    */
   resource?:
-    | DeploymentDetailResponsePreparedStackProfileAzureResource
+    | DeploymentDetailResponsePreparedStackOverrideAzureResource
     | undefined;
   /**
    * Azure-specific binding specification
    */
-  stack?: DeploymentDetailResponsePreparedStackProfileAzureStack | undefined;
+  stack?: DeploymentDetailResponsePreparedStackOverrideAzureStack | undefined;
 };
 
 /**
  * Grant permissions for a specific cloud platform
  */
-export type DeploymentDetailResponsePreparedStackProfileAzureGrant = {
+export type DeploymentDetailResponsePreparedStackOverrideAzureGrant = {
   /**
    * AWS IAM actions (only for AWS)
    */
@@ -426,11 +279,11 @@ export type DeploymentDetailResponsePreparedStackProfileAzureGrant = {
 /**
  * Azure-specific platform permission configuration
  */
-export type DeploymentDetailResponsePreparedStackProfileAzure = {
+export type DeploymentDetailResponsePreparedStackOverrideAzure = {
   /**
    * Generic binding configuration for permissions
    */
-  binding: DeploymentDetailResponsePreparedStackProfileAzureBinding;
+  binding: DeploymentDetailResponsePreparedStackOverrideAzureBinding;
   /**
    * Short admin-facing description of why this entry exists.
    */
@@ -438,7 +291,7 @@ export type DeploymentDetailResponsePreparedStackProfileAzure = {
   /**
    * Grant permissions for a specific cloud platform
    */
-  grant: DeploymentDetailResponsePreparedStackProfileAzureGrant;
+  grant: DeploymentDetailResponsePreparedStackOverrideAzureGrant;
   /**
    * Stable admin-facing label for this permission entry.
    */
@@ -448,21 +301,21 @@ export type DeploymentDetailResponsePreparedStackProfileAzure = {
 /**
  * GCP IAM condition
  */
-export type DeploymentDetailResponsePreparedStackProfileConditionResource = {
+export type DeploymentDetailResponsePreparedStackOverrideConditionResource = {
   expression: string;
   title: string;
 };
 
-export type DeploymentDetailResponsePreparedStackProfileResourceConditionUnion =
-  | DeploymentDetailResponsePreparedStackProfileConditionResource
+export type DeploymentDetailResponsePreparedStackOverrideResourceConditionUnion =
+  | DeploymentDetailResponsePreparedStackOverrideConditionResource
   | string;
 
 /**
  * GCP-specific binding specification
  */
-export type DeploymentDetailResponsePreparedStackProfileGcpResource = {
+export type DeploymentDetailResponsePreparedStackOverrideGcpResource = {
   condition?:
-    | DeploymentDetailResponsePreparedStackProfileConditionResource
+    | DeploymentDetailResponsePreparedStackOverrideConditionResource
     | string
     | null
     | undefined;
@@ -475,21 +328,21 @@ export type DeploymentDetailResponsePreparedStackProfileGcpResource = {
 /**
  * GCP IAM condition
  */
-export type DeploymentDetailResponsePreparedStackProfileConditionStack = {
+export type DeploymentDetailResponsePreparedStackOverrideConditionStack = {
   expression: string;
   title: string;
 };
 
-export type DeploymentDetailResponsePreparedStackProfileStackConditionUnion =
-  | DeploymentDetailResponsePreparedStackProfileConditionStack
+export type DeploymentDetailResponsePreparedStackOverrideStackConditionUnion =
+  | DeploymentDetailResponsePreparedStackOverrideConditionStack
   | string;
 
 /**
  * GCP-specific binding specification
  */
-export type DeploymentDetailResponsePreparedStackProfileGcpStack = {
+export type DeploymentDetailResponsePreparedStackOverrideGcpStack = {
   condition?:
-    | DeploymentDetailResponsePreparedStackProfileConditionStack
+    | DeploymentDetailResponsePreparedStackOverrideConditionStack
     | string
     | null
     | undefined;
@@ -502,23 +355,23 @@ export type DeploymentDetailResponsePreparedStackProfileGcpStack = {
 /**
  * Generic binding configuration for permissions
  */
-export type DeploymentDetailResponsePreparedStackProfileGcpBinding = {
+export type DeploymentDetailResponsePreparedStackOverrideGcpBinding = {
   /**
    * GCP-specific binding specification
    */
   resource?:
-    | DeploymentDetailResponsePreparedStackProfileGcpResource
+    | DeploymentDetailResponsePreparedStackOverrideGcpResource
     | undefined;
   /**
    * GCP-specific binding specification
    */
-  stack?: DeploymentDetailResponsePreparedStackProfileGcpStack | undefined;
+  stack?: DeploymentDetailResponsePreparedStackOverrideGcpStack | undefined;
 };
 
 /**
  * Grant permissions for a specific cloud platform
  */
-export type DeploymentDetailResponsePreparedStackProfileGcpGrant = {
+export type DeploymentDetailResponsePreparedStackOverrideGcpGrant = {
   /**
    * AWS IAM actions (only for AWS)
    */
@@ -544,11 +397,11 @@ export type DeploymentDetailResponsePreparedStackProfileGcpGrant = {
 /**
  * GCP-specific platform permission configuration
  */
-export type DeploymentDetailResponsePreparedStackProfileGcp = {
+export type DeploymentDetailResponsePreparedStackOverrideGcp = {
   /**
    * Generic binding configuration for permissions
    */
-  binding: DeploymentDetailResponsePreparedStackProfileGcpBinding;
+  binding: DeploymentDetailResponsePreparedStackOverrideGcpBinding;
   /**
    * Short admin-facing description of why this entry exists.
    */
@@ -556,7 +409,7 @@ export type DeploymentDetailResponsePreparedStackProfileGcp = {
   /**
    * Grant permissions for a specific cloud platform
    */
-  grant: DeploymentDetailResponsePreparedStackProfileGcpGrant;
+  grant: DeploymentDetailResponsePreparedStackOverrideGcpGrant;
   /**
    * Stable admin-facing label for this permission entry.
    */
@@ -566,26 +419,26 @@ export type DeploymentDetailResponsePreparedStackProfileGcp = {
 /**
  * Platform-specific permission configurations
  */
-export type DeploymentDetailResponsePreparedStackProfilePlatforms = {
+export type DeploymentDetailResponsePreparedStackOverridePlatforms = {
   /**
    * AWS permission configurations
    */
   aws?:
-    | Array<DeploymentDetailResponsePreparedStackProfileAw>
+    | Array<DeploymentDetailResponsePreparedStackOverrideAw>
     | null
     | undefined;
   /**
    * Azure permission configurations
    */
   azure?:
-    | Array<DeploymentDetailResponsePreparedStackProfileAzure>
+    | Array<DeploymentDetailResponsePreparedStackOverrideAzure>
     | null
     | undefined;
   /**
    * GCP permission configurations
    */
   gcp?:
-    | Array<DeploymentDetailResponsePreparedStackProfileGcp>
+    | Array<DeploymentDetailResponsePreparedStackOverrideGcp>
     | null
     | undefined;
 };
@@ -593,7 +446,7 @@ export type DeploymentDetailResponsePreparedStackProfilePlatforms = {
 /**
  * A permission set that can be applied across different cloud platforms
  */
-export type DeploymentDetailResponsePreparedStackProfile = {
+export type DeploymentDetailResponsePreparedStackOverride = {
   /**
    * Human-readable description of what this permission set allows
    */
@@ -605,714 +458,2556 @@ export type DeploymentDetailResponsePreparedStackProfile = {
   /**
    * Platform-specific permission configurations
    */
-  platforms: DeploymentDetailResponsePreparedStackProfilePlatforms;
+  platforms: DeploymentDetailResponsePreparedStackOverridePlatforms;
 };
 
 /**
  * Reference to a permission set - either by name or inline definition
  */
-export type DeploymentDetailResponsePreparedStackProfileUnion =
-  | DeploymentDetailResponsePreparedStackProfile
+export type DeploymentDetailResponsePreparedStackOverrideUnion =
+  | DeploymentDetailResponsePreparedStackOverride
   | string;
 
-/**
- * Combined permissions configuration that contains both profiles and management
- */
-export type DeploymentDetailResponsePreparedStackPermissions = {
-  /**
-   * Management permissions configuration for stack management access
-   */
-  management?:
-    | DeploymentDetailResponsePreparedStackManagement1
-    | DeploymentDetailResponsePreparedStackManagement2
-    | DeploymentDetailResponsePreparedStackManagementEnum
-    | undefined;
+export type DeploymentDetailResponsePreparedStackManagement2 = {
   /**
-   * Permission profiles that define access control for compute services
+   * Permission profile that maps resources to permission sets
    *
    * @remarks
-   * Key is the profile name, value is the permission configuration
+   * Key can be "*" for all resources or resource name for specific resource
    */
-  profiles: {
-    [k: string]: {
-      [k: string]: Array<DeploymentDetailResponsePreparedStackProfile | string>;
-    };
+  override: {
+    [k: string]: Array<DeploymentDetailResponsePreparedStackOverride | string>;
   };
 };
 
 /**
- * Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties.
+ * AWS-specific binding specification
  */
-export type DeploymentDetailResponsePreparedStackConfig = {
+export type DeploymentDetailResponsePreparedStackExtendAwResource = {
   /**
-   * The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+   * Optional condition for additional filtering (rare)
    */
-  id: string;
+  condition?: { [k: string]: { [k: string]: string } } | null | undefined;
   /**
-   * Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.
+   * ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a
+   *
+   * @remarks
+   * tag-on-create grant whose implied check AWS authorizes against no resource; the build
+   * refuses it anywhere else.
    */
-  type: string;
-  additionalProperties?: { [k: string]: any | null } | undefined;
-};
-
-/**
- * Reference to a resource by its stable id and resource type.
- */
-export type DeploymentDetailResponsePreparedStackDependency = {
-  id: string;
+  notResources?: Array<string> | undefined;
   /**
-   * Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.
+   * Resource ARNs to bind to
    */
-  type: string;
+  resources: Array<string>;
 };
 
 /**
- * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+ * AWS-specific binding specification
  */
-export const DeploymentDetailResponsePreparedStackLifecycle = {
-  Frozen: "frozen",
-  Live: "live",
-} as const;
-/**
- * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
- */
-export type DeploymentDetailResponsePreparedStackLifecycle = ClosedEnum<
-  typeof DeploymentDetailResponsePreparedStackLifecycle
->;
-
-export type DeploymentDetailResponsePreparedStackResources = {
+export type DeploymentDetailResponsePreparedStackExtendAwStack = {
   /**
-   * Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties.
+   * Optional condition for additional filtering (rare)
    */
-  config: DeploymentDetailResponsePreparedStackConfig;
+  condition?: { [k: string]: { [k: string]: string } } | null | undefined;
   /**
-   * Additional dependencies for this resource beyond those defined in the resource itself.
+   * ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a
    *
    * @remarks
-   * The total dependencies are: resource.get_dependencies() + this list
+   * tag-on-create grant whose implied check AWS authorizes against no resource; the build
+   * refuses it anywhere else.
    */
-  dependencies: Array<DeploymentDetailResponsePreparedStackDependency>;
+  notResources?: Array<string> | undefined;
   /**
-   * Id of the boolean stack input that decides whether this resource is
-   *
-   * @remarks
-   * created at all. `None` means always create it.
-   *
-   * Set by `.enabled(input)` in the SDK. Setup emitters render the resource
-   * conditionally on the matching template variable, so a deployer who says no
-   * never gets the resource, its outputs, or anything derived from it.
+   * Resource ARNs to bind to
    */
-  enabledWhen?: string | null | undefined;
+  resources: Array<string>;
+};
+
+/**
+ * Generic binding configuration for permissions
+ */
+export type DeploymentDetailResponsePreparedStackExtendAwBinding = {
   /**
-   * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+   * AWS-specific binding specification
    */
-  lifecycle: DeploymentDetailResponsePreparedStackLifecycle;
+  resource?: DeploymentDetailResponsePreparedStackExtendAwResource | undefined;
   /**
-   * Enable remote bindings for this resource (BYOB use case).
-   *
-   * @remarks
-   * When true, binding params are synced to StackState's `remote_binding_params`.
-   * Default: false (prevents sensitive data in synced state).
+   * AWS-specific binding specification
    */
-  remoteAccess?: boolean | undefined;
+  stack?: DeploymentDetailResponsePreparedStackExtendAwStack | undefined;
 };
 
 /**
- * Represents the target cloud platform.
+ * IAM effect. Defaults to Allow.
  */
-export const DeploymentDetailResponsePreparedStackSupportedPlatform = {
-  Aws: "aws",
-  Gcp: "gcp",
-  Azure: "azure",
-  Kubernetes: "kubernetes",
-  Machines: "machines",
-  Local: "local",
-  Test: "test",
+export const DeploymentDetailResponsePreparedStackExtendEffect = {
+  Allow: "Allow",
+  Deny: "Deny",
 } as const;
 /**
- * Represents the target cloud platform.
+ * IAM effect. Defaults to Allow.
  */
-export type DeploymentDetailResponsePreparedStackSupportedPlatform = ClosedEnum<
-  typeof DeploymentDetailResponsePreparedStackSupportedPlatform
+export type DeploymentDetailResponsePreparedStackExtendEffect = ClosedEnum<
+  typeof DeploymentDetailResponsePreparedStackExtendEffect
 >;
 
 /**
- * A bag of resources, unaware of any cloud.
+ * Grant permissions for a specific cloud platform
  */
-export type DeploymentDetailResponsePreparedStack = {
+export type DeploymentDetailResponsePreparedStackExtendAwGrant = {
   /**
-   * Released Container resources whose image repositories are approved for
-   *
-   * @remarks
-   * containers created after installation.
-   */
-  dynamicContainerImageResources?: Array<string> | undefined;
-  /**
-   * Exact image repositories approved for containers created after installation.
-   *
-   * @remarks
-   * The runtime API also requires an immutable SHA-256 digest.
-   */
-  dynamicContainerRepositories?: Array<string> | undefined;
-  /**
-   * Unique identifier for the stack
+   * AWS IAM actions (only for AWS)
    */
-  id: string;
+  actions?: Array<string> | null | undefined;
   /**
-   * Input definitions required before setup or deployment can proceed.
+   * Azure actions (only for Azure)
    */
-  inputs?: Array<DeploymentDetailResponsePreparedStackInput> | undefined;
+  dataActions?: Array<string> | null | undefined;
   /**
-   * Combined permissions configuration that contains both profiles and management
+   * GCP permissions that require an exact residual custom role.
    */
-  permissions?: DeploymentDetailResponsePreparedStackPermissions | undefined;
+  permissions?: Array<string> | null | undefined;
   /**
-   * Map of resource IDs to their configurations and lifecycle settings
+   * Provider predefined roles to bind directly.
    */
-  resources: { [k: string]: DeploymentDetailResponsePreparedStackResources };
+  predefinedRoles?: Array<string> | null | undefined;
   /**
-   * Which platforms this stack supports. When None, all platforms are supported.
+   * GCP residual custom permissions to pair with predefined roles.
    */
-  supportedPlatforms?:
-    | Array<DeploymentDetailResponsePreparedStackSupportedPlatform>
-    | null
-    | undefined;
+  residualPermissions?: Array<string> | null | undefined;
 };
 
-export type DeploymentDetailResponsePreparedStackUnion =
-  | DeploymentDetailResponsePreparedStack
-  | string;
-
 /**
- * The cross-account read a manager opened on Alien's registry for one deployment.
+ * AWS-specific platform permission configuration
  */
-export type DeploymentDetailResponseRegistryAccess = {
-  /**
-   * Repository identifiers the grant names, sorted.
-   */
-  repositories?: Array<string> | undefined;
+export type DeploymentDetailResponsePreparedStackExtendAw = {
   /**
-   * Compute services the grant admits, sorted. Each pulls as its own principal, so a service
-   *
-   * @remarks
-   * added later needs the policy rewritten.
+   * Generic binding configuration for permissions
    */
-  serviceTypes?: Array<string> | undefined;
-};
-
-export type DeploymentDetailResponseRegistryAccessUnion =
-  | DeploymentDetailResponseRegistryAccess
-  | string;
-
-/**
- * The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as
- *
- * @remarks
- * soon as the object exists and cleared once it is deleted.
- */
-export type DeploymentDetailResponseEgress = {
+  binding: DeploymentDetailResponsePreparedStackExtendAwBinding;
   /**
-   * `AWS::Lambda::NetworkConnector` the sessions start with.
+   * Short admin-facing description of why this entry exists.
    */
-  connectorArn?: string | null | undefined;
+  description?: string | null | undefined;
   /**
-   * Cloud Control request creating or deleting the connector that AWS has not finished. Kept
-   *
-   * @remarks
-   * so the request's outcome, and AWS's reason when it fails, is read on a later call.
+   * IAM effect. Defaults to Allow.
    */
-  connectorRequest?: string | null | undefined;
+  effect?: DeploymentDetailResponsePreparedStackExtendEffect | undefined;
   /**
-   * IAM role Lambda assumes to place the connector's network interfaces.
+   * Grant permissions for a specific cloud platform
    */
-  operatorRoleName: string;
+  grant: DeploymentDetailResponsePreparedStackExtendAwGrant;
   /**
-   * Security group permitting egress to loopback only.
+   * Stable admin-facing label for this permission entry.
    */
-  securityGroupId?: string | null | undefined;
+  label?: string | null | undefined;
 };
 
-export type DeploymentDetailResponseEgressUnion =
-  | DeploymentDetailResponseEgress
-  | string;
-
-export const DeploymentDetailResponseTypeAwsSandbox = {
-  AwsSandbox: "awsSandbox",
-} as const;
-export type DeploymentDetailResponseTypeAwsSandbox = ClosedEnum<
-  typeof DeploymentDetailResponseTypeAwsSandbox
->;
-
 /**
- * Cloud objects a direct setup created so a runtime-owned resource can run.
+ * Azure-specific binding specification
  */
-export type DeploymentDetailResponseSetupScaffolding = {
+export type DeploymentDetailResponsePreparedStackExtendAzureResource = {
   /**
-   * IAM role the image build runs as.
+   * Scope (subscription/resource group/resource level)
    */
-  buildRoleName: string;
-  egress?: DeploymentDetailResponseEgress | string | null | undefined;
+  scope: string;
+};
+
+/**
+ * Azure-specific binding specification
+ */
+export type DeploymentDetailResponsePreparedStackExtendAzureStack = {
   /**
-   * A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its
-   *
-   * @remarks
-   * runtime controller.
+   * Scope (subscription/resource group/resource level)
    */
-  imageArn?: string | null | undefined;
-  type: DeploymentDetailResponseTypeAwsSandbox;
+  scope: string;
 };
 
 /**
- * One-shot authority for a setup re-import to replace setup-owned resources.
+ * Generic binding configuration for permissions
  */
-export type DeploymentDetailResponseSetupUpdateAuthorization = {
+export type DeploymentDetailResponsePreparedStackExtendAzureBinding = {
   /**
-   * Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment.
+   * Azure-specific binding specification
    */
-  baselineFrozenDigest: string;
+  resource?:
+    | DeploymentDetailResponsePreparedStackExtendAzureResource
+    | undefined;
   /**
-   * Unique revision used by persistence layers for compare-and-swap updates.
+   * Azure-specific binding specification
    */
-  nonce: string;
+  stack?: DeploymentDetailResponsePreparedStackExtendAzureStack | undefined;
+};
+
+/**
+ * Grant permissions for a specific cloud platform
+ */
+export type DeploymentDetailResponsePreparedStackExtendAzureGrant = {
   /**
-   * Release whose stack was prepared by setup.
+   * AWS IAM actions (only for AWS)
    */
-  releaseId: string;
+  actions?: Array<string> | null | undefined;
   /**
-   * Exact setup artifact revision that authored this authority.
+   * Azure actions (only for Azure)
    */
-  setupFingerprint: string;
+  dataActions?: Array<string> | null | undefined;
   /**
-   * Setup fingerprint contract version.
+   * GCP permissions that require an exact residual custom role.
    */
-  setupFingerprintVersion: number;
+  permissions?: Array<string> | null | undefined;
   /**
-   * Stable setup target recorded on the imported deployment.
+   * Provider predefined roles to bind directly.
    */
-  setupTarget: string;
+  predefinedRoles?: Array<string> | null | undefined;
   /**
-   * Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared.
+   * GCP residual custom permissions to pair with predefined roles.
    */
-  targetFrozenDigest: string;
+  residualPermissions?: Array<string> | null | undefined;
 };
 
-export type DeploymentDetailResponseSetupUpdateAuthorizationUnion =
-  | DeploymentDetailResponseSetupUpdateAuthorization
-  | string;
-
 /**
- * Runtime metadata for deployment state persistence
+ * Azure-specific platform permission configuration
  */
-export type DeploymentDetailResponseRuntimeMetadata = {
-  /**
-   * Whether each vault-native deployer secret is in the customer's secret
-   *
-   * @remarks
-   * store, with where it goes. Checked from metadata only; no value is ever
-   * read or recorded here.
-   */
-  deployerSecrets?: Array<DeploymentDetailResponseDeployerSecret> | undefined;
+export type DeploymentDetailResponsePreparedStackExtendAzure = {
   /**
-   * Last generated CLI package revision whose direct setup was applied.
-   *
-   * @remarks
-   * This lets a newer generated CLI refresh setup-owned infrastructure once
-   * before handing runtime changes back to the hosted manager.
+   * Generic binding configuration for permissions
    */
-  directSetupRevision?: string | null | undefined;
+  binding: DeploymentDetailResponsePreparedStackExtendAzureBinding;
   /**
-   * Actor that owns structural work during the initial setup phase.
+   * Short admin-facing description of why this entry exists.
    */
-  initialSetupAuthority?:
-    | DeploymentDetailResponseInitialSetupAuthority
-    | undefined;
+  description?: string | null | undefined;
   /**
-   * Hash of the environment variables snapshot that was last synced to the vault
-   *
-   * @remarks
-   * Used to avoid redundant sync operations during incremental deployment
+   * Grant permissions for a specific cloud platform
    */
-  lastSyncedEnvVarsHash?: string | null | undefined;
+  grant: DeploymentDetailResponsePreparedStackExtendAzureGrant;
   /**
-   * Exact vault keys owned by the deployment secret synchronizer. This
-   *
-   * @remarks
-   * inventory lets a later snapshot delete removed keys without listing or
-   * touching unrelated values in the same vault.
+   * Stable admin-facing label for this permission entry.
    */
-  lastSyncedSecretNames?: Array<string> | undefined;
-  /**
-   * Release `pending_prepared_stack` was prepared from. The target can move
-   *
-   * @remarks
-   * to a newer release while that stack is still being applied; this tells
-   * the update which release actually converged.
-   */
-  pendingPreparedReleaseId?: string | null | undefined;
-  pendingPreparedStack?:
-    | DeploymentDetailResponsePendingPreparedStackUnion
+  label?: string | null | undefined;
+};
+
+/**
+ * GCP IAM condition
+ */
+export type DeploymentDetailResponsePreparedStackExtendConditionResource = {
+  expression: string;
+  title: string;
+};
+
+export type DeploymentDetailResponsePreparedStackExtendResourceConditionUnion =
+  | DeploymentDetailResponsePreparedStackExtendConditionResource
+  | string;
+
+/**
+ * GCP-specific binding specification
+ */
+export type DeploymentDetailResponsePreparedStackExtendGcpResource = {
+  condition?:
+    | DeploymentDetailResponsePreparedStackExtendConditionResource
+    | string
     | null
     | undefined;
   /**
-   * Canonical resolved answers for inputs that gate Frozen resources,
-   *
-   * @remarks
-   * keyed by input id, recorded when the deployment is created or its
-   * setup import registers.
-   *
-   * A frozen gate's answer is fixed for the deployment's lifetime: the
-   * update path refuses input values that conflict with these, and a Live
-   * resource sharing such an input resolves the persisted answer forever.
+   * Scope (project/resource level)
    */
-  persistedGateAnswers?: { [k: string]: boolean } | undefined;
-  preparedStack?:
-    | DeploymentDetailResponsePreparedStack
-    | string
-    | null
-    | undefined;
-  registryAccess?:
-    | DeploymentDetailResponseRegistryAccess
+  scope: string;
+};
+
+/**
+ * GCP IAM condition
+ */
+export type DeploymentDetailResponsePreparedStackExtendConditionStack = {
+  expression: string;
+  title: string;
+};
+
+export type DeploymentDetailResponsePreparedStackExtendStackConditionUnion =
+  | DeploymentDetailResponsePreparedStackExtendConditionStack
+  | string;
+
+/**
+ * GCP-specific binding specification
+ */
+export type DeploymentDetailResponsePreparedStackExtendGcpStack = {
+  condition?:
+    | DeploymentDetailResponsePreparedStackExtendConditionStack
     | string
     | null
     | undefined;
   /**
-   * Whether cross-account registry access has been successfully granted.
-   *
-   * @remarks
-   * Set to true after the manager successfully sets the ECR/GAR repo policy
-   * for this deployment's target account. Prevents redundant API calls on
-   * every reconcile tick.
-   */
-  registryAccessGranted?: boolean | undefined;
-  /**
-   * What a direct setup created for resources it does not own, keyed by resource id. Setup
-   *
-   * @remarks
-   * teardown removes exactly what is recorded here.
+   * Scope (project/resource level)
    */
-  setupScaffolding?:
-    | { [k: string]: DeploymentDetailResponseSetupScaffolding }
-    | undefined;
-  setupUpdateAuthorization?:
-    | DeploymentDetailResponseSetupUpdateAuthorization
-    | string
-    | null
-    | undefined;
+  scope: string;
 };
 
 /**
- * Setup source that imported this deployment
- */
-export const DeploymentDetailResponseImportSource = {
-  Cloudformation: "cloudformation",
-  Terraform: "terraform",
-  Helm: "helm",
-} as const;
-/**
- * Setup source that imported this deployment
+ * Generic binding configuration for permissions
  */
-export type DeploymentDetailResponseImportSource = ClosedEnum<
-  typeof DeploymentDetailResponseImportSource
->;
+export type DeploymentDetailResponsePreparedStackExtendGcpBinding = {
+  /**
+   * GCP-specific binding specification
+   */
+  resource?: DeploymentDetailResponsePreparedStackExtendGcpResource | undefined;
+  /**
+   * GCP-specific binding specification
+   */
+  stack?: DeploymentDetailResponsePreparedStackExtendGcpStack | undefined;
+};
 
 /**
- * Setup method that created the deployment record and owns setup-time resources.
+ * Grant permissions for a specific cloud platform
  */
-export const DeploymentDetailResponseSetupMethod = {
-  Cloudformation: "cloudformation",
-  GoogleOauth: "google-oauth",
-  Terraform: "terraform",
-  Helm: "helm",
-  Cli: "cli",
-  Manual: "manual",
-} as const;
+export type DeploymentDetailResponsePreparedStackExtendGcpGrant = {
+  /**
+   * AWS IAM actions (only for AWS)
+   */
+  actions?: Array<string> | null | undefined;
+  /**
+   * Azure actions (only for Azure)
+   */
+  dataActions?: Array<string> | null | undefined;
+  /**
+   * GCP permissions that require an exact residual custom role.
+   */
+  permissions?: Array<string> | null | undefined;
+  /**
+   * Provider predefined roles to bind directly.
+   */
+  predefinedRoles?: Array<string> | null | undefined;
+  /**
+   * GCP residual custom permissions to pair with predefined roles.
+   */
+  residualPermissions?: Array<string> | null | undefined;
+};
+
 /**
- * Setup method that created the deployment record and owns setup-time resources.
+ * GCP-specific platform permission configuration
  */
-export type DeploymentDetailResponseSetupMethod = ClosedEnum<
-  typeof DeploymentDetailResponseSetupMethod
->;
+export type DeploymentDetailResponsePreparedStackExtendGcp = {
+  /**
+   * Generic binding configuration for permissions
+   */
+  binding: DeploymentDetailResponsePreparedStackExtendGcpBinding;
+  /**
+   * Short admin-facing description of why this entry exists.
+   */
+  description?: string | null | undefined;
+  /**
+   * Grant permissions for a specific cloud platform
+   */
+  grant: DeploymentDetailResponsePreparedStackExtendGcpGrant;
+  /**
+   * Stable admin-facing label for this permission entry.
+   */
+  label?: string | null | undefined;
+};
 
 /**
- * Latest error information if the deployment is in a failed state
+ * Platform-specific permission configurations
  */
-export type DeploymentDetailResponseError = {
+export type DeploymentDetailResponsePreparedStackExtendPlatforms = {
   /**
-   * A unique identifier for the type of error.
-   *
-   * @remarks
-   *
-   * This should be a short, machine-readable string that can be used
-   * by clients to programmatically handle different error types.
-   * Examples: "NOT_FOUND", "VALIDATION_ERROR", "TIMEOUT"
+   * AWS permission configurations
    */
-  code: string;
+  aws?: Array<DeploymentDetailResponsePreparedStackExtendAw> | null | undefined;
   /**
-   * Additional diagnostic information about the error context.
-   *
-   * @remarks
-   *
-   * This optional field can contain structured data providing more details
-   * about the error, such as validation errors, request parameters that
-   * caused the issue, or other relevant context information.
+   * Azure permission configurations
    */
-  context?: any | null | undefined;
+  azure?:
+    | Array<DeploymentDetailResponsePreparedStackExtendAzure>
+    | null
+    | undefined;
   /**
-   * Optional human-facing remediation hint.
+   * GCP permission configurations
    */
-  hint?: string | null | undefined;
+  gcp?:
+    | Array<DeploymentDetailResponsePreparedStackExtendGcp>
+    | null
+    | undefined;
+};
+
+/**
+ * A permission set that can be applied across different cloud platforms
+ */
+export type DeploymentDetailResponsePreparedStackExtend = {
   /**
-   * HTTP status code for this error.
-   *
-   * @remarks
-   *
-   * Used when converting the error to an HTTP response. If None, falls back to
-   * the error type's default status code or 500.
+   * Human-readable description of what this permission set allows
    */
-  httpStatusCode?: number | null | undefined;
+  description: string;
   /**
-   * Indicates if this is an internal error that should not be exposed to users.
-   *
-   * @remarks
-   *
-   * When `true`, this error contains sensitive information or implementation
-   * details that should not be shown to end-users. Such errors should be
-   * logged for debugging but replaced with generic error messages in responses.
+   * Unique identifier for the permission set (e.g., "storage/data-read")
    */
-  internal: boolean;
+  id: string;
   /**
-   * Human-readable error message.
-   *
-   * @remarks
-   *
-   * This message should be clear and actionable for developers or end-users,
-   * providing context about what went wrong and potentially how to fix it.
+   * Platform-specific permission configurations
    */
-  message: string;
+  platforms: DeploymentDetailResponsePreparedStackExtendPlatforms;
+};
+
+/**
+ * Reference to a permission set - either by name or inline definition
+ */
+export type DeploymentDetailResponsePreparedStackExtendUnion =
+  | DeploymentDetailResponsePreparedStackExtend
+  | string;
+
+export type DeploymentDetailResponsePreparedStackManagement1 = {
   /**
-   * Indicates whether the operation that caused the error should be retried.
+   * Permission profile that maps resources to permission sets
    *
    * @remarks
-   *
-   * When `true`, the error is transient and the operation might succeed
-   * if attempted again. When `false`, retrying the same operation is
-   * unlikely to succeed without changes.
+   * Key can be "*" for all resources or resource name for specific resource
    */
-  retryable: boolean;
-  /**
-   * The underlying error that caused this error, creating an error chain.
+  extend: {
+    [k: string]: Array<DeploymentDetailResponsePreparedStackExtend | string>;
+  };
+};
+
+/**
+ * Management permissions configuration for stack management access
+ */
+export type DeploymentDetailResponsePreparedStackManagementUnion =
+  | DeploymentDetailResponsePreparedStackManagement1
+  | DeploymentDetailResponsePreparedStackManagement2
+  | DeploymentDetailResponsePreparedStackManagementEnum;
+
+/**
+ * AWS-specific binding specification
+ */
+export type DeploymentDetailResponsePreparedStackProfileAwResource = {
+  /**
+   * Optional condition for additional filtering (rare)
+   */
+  condition?: { [k: string]: { [k: string]: string } } | null | undefined;
+  /**
+   * ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a
    *
    * @remarks
+   * tag-on-create grant whose implied check AWS authorizes against no resource; the build
+   * refuses it anywhere else.
+   */
+  notResources?: Array<string> | undefined;
+  /**
+   * Resource ARNs to bind to
+   */
+  resources: Array<string>;
+};
+
+/**
+ * AWS-specific binding specification
+ */
+export type DeploymentDetailResponsePreparedStackProfileAwStack = {
+  /**
+   * Optional condition for additional filtering (rare)
+   */
+  condition?: { [k: string]: { [k: string]: string } } | null | undefined;
+  /**
+   * ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a
    *
-   * This allows for proper error propagation and debugging by maintaining
-   * the full context of how an error occurred through multiple layers
-   * of an application.
+   * @remarks
+   * tag-on-create grant whose implied check AWS authorizes against no resource; the build
+   * refuses it anywhere else.
    */
-  source?: any | null | undefined;
+  notResources?: Array<string> | undefined;
+  /**
+   * Resource ARNs to bind to
+   */
+  resources: Array<string>;
+};
+
+/**
+ * Generic binding configuration for permissions
+ */
+export type DeploymentDetailResponsePreparedStackProfileAwBinding = {
+  /**
+   * AWS-specific binding specification
+   */
+  resource?: DeploymentDetailResponsePreparedStackProfileAwResource | undefined;
+  /**
+   * AWS-specific binding specification
+   */
+  stack?: DeploymentDetailResponsePreparedStackProfileAwStack | undefined;
+};
+
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export const DeploymentDetailResponsePreparedStackProfileEffect = {
+  Allow: "Allow",
+  Deny: "Deny",
+} as const;
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export type DeploymentDetailResponsePreparedStackProfileEffect = ClosedEnum<
+  typeof DeploymentDetailResponsePreparedStackProfileEffect
+>;
+
+/**
+ * Grant permissions for a specific cloud platform
+ */
+export type DeploymentDetailResponsePreparedStackProfileAwGrant = {
+  /**
+   * AWS IAM actions (only for AWS)
+   */
+  actions?: Array<string> | null | undefined;
+  /**
+   * Azure actions (only for Azure)
+   */
+  dataActions?: Array<string> | null | undefined;
+  /**
+   * GCP permissions that require an exact residual custom role.
+   */
+  permissions?: Array<string> | null | undefined;
+  /**
+   * Provider predefined roles to bind directly.
+   */
+  predefinedRoles?: Array<string> | null | undefined;
+  /**
+   * GCP residual custom permissions to pair with predefined roles.
+   */
+  residualPermissions?: Array<string> | null | undefined;
+};
+
+/**
+ * AWS-specific platform permission configuration
+ */
+export type DeploymentDetailResponsePreparedStackProfileAw = {
+  /**
+   * Generic binding configuration for permissions
+   */
+  binding: DeploymentDetailResponsePreparedStackProfileAwBinding;
+  /**
+   * Short admin-facing description of why this entry exists.
+   */
+  description?: string | null | undefined;
+  /**
+   * IAM effect. Defaults to Allow.
+   */
+  effect?: DeploymentDetailResponsePreparedStackProfileEffect | undefined;
+  /**
+   * Grant permissions for a specific cloud platform
+   */
+  grant: DeploymentDetailResponsePreparedStackProfileAwGrant;
+  /**
+   * Stable admin-facing label for this permission entry.
+   */
+  label?: string | null | undefined;
+};
+
+/**
+ * Azure-specific binding specification
+ */
+export type DeploymentDetailResponsePreparedStackProfileAzureResource = {
+  /**
+   * Scope (subscription/resource group/resource level)
+   */
+  scope: string;
+};
+
+/**
+ * Azure-specific binding specification
+ */
+export type DeploymentDetailResponsePreparedStackProfileAzureStack = {
+  /**
+   * Scope (subscription/resource group/resource level)
+   */
+  scope: string;
+};
+
+/**
+ * Generic binding configuration for permissions
+ */
+export type DeploymentDetailResponsePreparedStackProfileAzureBinding = {
+  /**
+   * Azure-specific binding specification
+   */
+  resource?:
+    | DeploymentDetailResponsePreparedStackProfileAzureResource
+    | undefined;
+  /**
+   * Azure-specific binding specification
+   */
+  stack?: DeploymentDetailResponsePreparedStackProfileAzureStack | undefined;
+};
+
+/**
+ * Grant permissions for a specific cloud platform
+ */
+export type DeploymentDetailResponsePreparedStackProfileAzureGrant = {
+  /**
+   * AWS IAM actions (only for AWS)
+   */
+  actions?: Array<string> | null | undefined;
+  /**
+   * Azure actions (only for Azure)
+   */
+  dataActions?: Array<string> | null | undefined;
+  /**
+   * GCP permissions that require an exact residual custom role.
+   */
+  permissions?: Array<string> | null | undefined;
+  /**
+   * Provider predefined roles to bind directly.
+   */
+  predefinedRoles?: Array<string> | null | undefined;
+  /**
+   * GCP residual custom permissions to pair with predefined roles.
+   */
+  residualPermissions?: Array<string> | null | undefined;
+};
+
+/**
+ * Azure-specific platform permission configuration
+ */
+export type DeploymentDetailResponsePreparedStackProfileAzure = {
+  /**
+   * Generic binding configuration for permissions
+   */
+  binding: DeploymentDetailResponsePreparedStackProfileAzureBinding;
+  /**
+   * Short admin-facing description of why this entry exists.
+   */
+  description?: string | null | undefined;
+  /**
+   * Grant permissions for a specific cloud platform
+   */
+  grant: DeploymentDetailResponsePreparedStackProfileAzureGrant;
+  /**
+   * Stable admin-facing label for this permission entry.
+   */
+  label?: string | null | undefined;
+};
+
+/**
+ * GCP IAM condition
+ */
+export type DeploymentDetailResponsePreparedStackProfileConditionResource = {
+  expression: string;
+  title: string;
+};
+
+export type DeploymentDetailResponsePreparedStackProfileResourceConditionUnion =
+  | DeploymentDetailResponsePreparedStackProfileConditionResource
+  | string;
+
+/**
+ * GCP-specific binding specification
+ */
+export type DeploymentDetailResponsePreparedStackProfileGcpResource = {
+  condition?:
+    | DeploymentDetailResponsePreparedStackProfileConditionResource
+    | string
+    | null
+    | undefined;
+  /**
+   * Scope (project/resource level)
+   */
+  scope: string;
+};
+
+/**
+ * GCP IAM condition
+ */
+export type DeploymentDetailResponsePreparedStackProfileConditionStack = {
+  expression: string;
+  title: string;
 };
 
-/**
- * Durable progress for deployment updates
- */
-export type DeploymentDetailResponseUpdateState = {
-  active: DeploymentUpdateOperationSummary | null;
-  next: DeploymentUpdateOperationSummary | null;
-  latest: DeploymentUpdateOperationSummary | null;
-};
+export type DeploymentDetailResponsePreparedStackProfileStackConditionUnion =
+  | DeploymentDetailResponsePreparedStackProfileConditionStack
+  | string;
+
+/**
+ * GCP-specific binding specification
+ */
+export type DeploymentDetailResponsePreparedStackProfileGcpStack = {
+  condition?:
+    | DeploymentDetailResponsePreparedStackProfileConditionStack
+    | string
+    | null
+    | undefined;
+  /**
+   * Scope (project/resource level)
+   */
+  scope: string;
+};
+
+/**
+ * Generic binding configuration for permissions
+ */
+export type DeploymentDetailResponsePreparedStackProfileGcpBinding = {
+  /**
+   * GCP-specific binding specification
+   */
+  resource?:
+    | DeploymentDetailResponsePreparedStackProfileGcpResource
+    | undefined;
+  /**
+   * GCP-specific binding specification
+   */
+  stack?: DeploymentDetailResponsePreparedStackProfileGcpStack | undefined;
+};
+
+/**
+ * Grant permissions for a specific cloud platform
+ */
+export type DeploymentDetailResponsePreparedStackProfileGcpGrant = {
+  /**
+   * AWS IAM actions (only for AWS)
+   */
+  actions?: Array<string> | null | undefined;
+  /**
+   * Azure actions (only for Azure)
+   */
+  dataActions?: Array<string> | null | undefined;
+  /**
+   * GCP permissions that require an exact residual custom role.
+   */
+  permissions?: Array<string> | null | undefined;
+  /**
+   * Provider predefined roles to bind directly.
+   */
+  predefinedRoles?: Array<string> | null | undefined;
+  /**
+   * GCP residual custom permissions to pair with predefined roles.
+   */
+  residualPermissions?: Array<string> | null | undefined;
+};
+
+/**
+ * GCP-specific platform permission configuration
+ */
+export type DeploymentDetailResponsePreparedStackProfileGcp = {
+  /**
+   * Generic binding configuration for permissions
+   */
+  binding: DeploymentDetailResponsePreparedStackProfileGcpBinding;
+  /**
+   * Short admin-facing description of why this entry exists.
+   */
+  description?: string | null | undefined;
+  /**
+   * Grant permissions for a specific cloud platform
+   */
+  grant: DeploymentDetailResponsePreparedStackProfileGcpGrant;
+  /**
+   * Stable admin-facing label for this permission entry.
+   */
+  label?: string | null | undefined;
+};
+
+/**
+ * Platform-specific permission configurations
+ */
+export type DeploymentDetailResponsePreparedStackProfilePlatforms = {
+  /**
+   * AWS permission configurations
+   */
+  aws?:
+    | Array<DeploymentDetailResponsePreparedStackProfileAw>
+    | null
+    | undefined;
+  /**
+   * Azure permission configurations
+   */
+  azure?:
+    | Array<DeploymentDetailResponsePreparedStackProfileAzure>
+    | null
+    | undefined;
+  /**
+   * GCP permission configurations
+   */
+  gcp?:
+    | Array<DeploymentDetailResponsePreparedStackProfileGcp>
+    | null
+    | undefined;
+};
+
+/**
+ * A permission set that can be applied across different cloud platforms
+ */
+export type DeploymentDetailResponsePreparedStackProfile = {
+  /**
+   * Human-readable description of what this permission set allows
+   */
+  description: string;
+  /**
+   * Unique identifier for the permission set (e.g., "storage/data-read")
+   */
+  id: string;
+  /**
+   * Platform-specific permission configurations
+   */
+  platforms: DeploymentDetailResponsePreparedStackProfilePlatforms;
+};
+
+/**
+ * Reference to a permission set - either by name or inline definition
+ */
+export type DeploymentDetailResponsePreparedStackProfileUnion =
+  | DeploymentDetailResponsePreparedStackProfile
+  | string;
+
+/**
+ * Combined permissions configuration that contains both profiles and management
+ */
+export type DeploymentDetailResponsePreparedStackPermissions = {
+  /**
+   * Management permissions configuration for stack management access
+   */
+  management?:
+    | DeploymentDetailResponsePreparedStackManagement1
+    | DeploymentDetailResponsePreparedStackManagement2
+    | DeploymentDetailResponsePreparedStackManagementEnum
+    | undefined;
+  /**
+   * Permission profiles that define access control for compute services
+   *
+   * @remarks
+   * Key is the profile name, value is the permission configuration
+   */
+  profiles: {
+    [k: string]: {
+      [k: string]: Array<DeploymentDetailResponsePreparedStackProfile | string>;
+    };
+  };
+};
+
+/**
+ * Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties.
+ */
+export type DeploymentDetailResponsePreparedStackConfig = {
+  /**
+   * The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+   */
+  id: string;
+  /**
+   * Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.
+   */
+  type: string;
+  additionalProperties?: { [k: string]: any | null } | undefined;
+};
+
+/**
+ * Reference to a resource by its stable id and resource type.
+ */
+export type DeploymentDetailResponsePreparedStackDependency = {
+  id: string;
+  /**
+   * Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.
+   */
+  type: string;
+};
+
+/**
+ * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+ */
+export const DeploymentDetailResponsePreparedStackLifecycle = {
+  Frozen: "frozen",
+  Live: "live",
+} as const;
+/**
+ * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+ */
+export type DeploymentDetailResponsePreparedStackLifecycle = ClosedEnum<
+  typeof DeploymentDetailResponsePreparedStackLifecycle
+>;
+
+export type DeploymentDetailResponsePreparedStackResources = {
+  /**
+   * Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties.
+   */
+  config: DeploymentDetailResponsePreparedStackConfig;
+  /**
+   * Additional dependencies for this resource beyond those defined in the resource itself.
+   *
+   * @remarks
+   * The total dependencies are: resource.get_dependencies() + this list
+   */
+  dependencies: Array<DeploymentDetailResponsePreparedStackDependency>;
+  /**
+   * Id of the boolean stack input that decides whether this resource is
+   *
+   * @remarks
+   * created at all. `None` means always create it.
+   *
+   * Set by `.enabled(input)` in the SDK. Setup emitters render the resource
+   * conditionally on the matching template variable, so a deployer who says no
+   * never gets the resource, its outputs, or anything derived from it.
+   */
+  enabledWhen?: string | null | undefined;
+  /**
+   * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+   */
+  lifecycle: DeploymentDetailResponsePreparedStackLifecycle;
+  /**
+   * Enable remote bindings for this resource (BYOB use case).
+   *
+   * @remarks
+   * When true, binding params are synced to StackState's `remote_binding_params`.
+   * Default: false (prevents sensitive data in synced state).
+   */
+  remoteAccess?: boolean | undefined;
+};
+
+/**
+ * Represents the target cloud platform.
+ */
+export const DeploymentDetailResponsePreparedStackSupportedPlatform = {
+  Aws: "aws",
+  Gcp: "gcp",
+  Azure: "azure",
+  Kubernetes: "kubernetes",
+  Machines: "machines",
+  Local: "local",
+  Test: "test",
+} as const;
+/**
+ * Represents the target cloud platform.
+ */
+export type DeploymentDetailResponsePreparedStackSupportedPlatform = ClosedEnum<
+  typeof DeploymentDetailResponsePreparedStackSupportedPlatform
+>;
+
+/**
+ * A bag of resources, unaware of any cloud.
+ */
+export type DeploymentDetailResponsePreparedStack = {
+  /**
+   * Released Container resources whose image repositories are approved for
+   *
+   * @remarks
+   * containers created after installation.
+   */
+  dynamicContainerImageResources?: Array<string> | undefined;
+  /**
+   * Exact image repositories approved for containers created after installation.
+   *
+   * @remarks
+   * The runtime API also requires an immutable SHA-256 digest.
+   */
+  dynamicContainerRepositories?: Array<string> | undefined;
+  /**
+   * Unique identifier for the stack
+   */
+  id: string;
+  /**
+   * Input definitions required before setup or deployment can proceed.
+   */
+  inputs?: Array<DeploymentDetailResponsePreparedStackInput> | undefined;
+  operations?:
+    | DeploymentDetailResponsePreparedStackOperations
+    | string
+    | null
+    | undefined;
+  /**
+   * Combined permissions configuration that contains both profiles and management
+   */
+  permissions?: DeploymentDetailResponsePreparedStackPermissions | undefined;
+  /**
+   * Map of resource IDs to their configurations and lifecycle settings
+   */
+  resources: { [k: string]: DeploymentDetailResponsePreparedStackResources };
+  /**
+   * Which platforms this stack supports. When None, all platforms are supported.
+   */
+  supportedPlatforms?:
+    | Array<DeploymentDetailResponsePreparedStackSupportedPlatform>
+    | null
+    | undefined;
+};
+
+export type DeploymentDetailResponsePreparedStackUnion =
+  | DeploymentDetailResponsePreparedStack
+  | string;
+
+/**
+ * The cross-account read a manager opened on Alien's registry for one deployment.
+ */
+export type DeploymentDetailResponseRegistryAccess = {
+  /**
+   * Repository identifiers the grant names, sorted.
+   */
+  repositories?: Array<string> | undefined;
+  /**
+   * Compute services the grant admits, sorted. Each pulls as its own principal, so a service
+   *
+   * @remarks
+   * added later needs the policy rewritten.
+   */
+  serviceTypes?: Array<string> | undefined;
+};
+
+export type DeploymentDetailResponseRegistryAccessUnion =
+  | DeploymentDetailResponseRegistryAccess
+  | string;
+
+/**
+ * The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as
+ *
+ * @remarks
+ * soon as the object exists and cleared once it is deleted.
+ */
+export type DeploymentDetailResponseEgress = {
+  /**
+   * `AWS::Lambda::NetworkConnector` the sessions start with.
+   */
+  connectorArn?: string | null | undefined;
+  /**
+   * Cloud Control request creating or deleting the connector that AWS has not finished. Kept
+   *
+   * @remarks
+   * so the request's outcome, and AWS's reason when it fails, is read on a later call.
+   */
+  connectorRequest?: string | null | undefined;
+  /**
+   * IAM role Lambda assumes to place the connector's network interfaces.
+   */
+  operatorRoleName: string;
+  /**
+   * Security group permitting egress to loopback only.
+   */
+  securityGroupId?: string | null | undefined;
+};
+
+export type DeploymentDetailResponseEgressUnion =
+  | DeploymentDetailResponseEgress
+  | string;
+
+export const DeploymentDetailResponseTypeAwsSandbox = {
+  AwsSandbox: "awsSandbox",
+} as const;
+export type DeploymentDetailResponseTypeAwsSandbox = ClosedEnum<
+  typeof DeploymentDetailResponseTypeAwsSandbox
+>;
+
+/**
+ * Cloud objects a direct setup created so a runtime-owned resource can run.
+ */
+export type DeploymentDetailResponseSetupScaffolding = {
+  /**
+   * IAM role the image build runs as.
+   */
+  buildRoleName: string;
+  egress?: DeploymentDetailResponseEgress | string | null | undefined;
+  /**
+   * A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its
+   *
+   * @remarks
+   * runtime controller.
+   */
+  imageArn?: string | null | undefined;
+  type: DeploymentDetailResponseTypeAwsSandbox;
+};
+
+/**
+ * One-shot authority for a setup re-import to replace setup-owned resources.
+ */
+export type DeploymentDetailResponseSetupUpdateAuthorization = {
+  /**
+   * Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment.
+   */
+  baselineFrozenDigest: string;
+  /**
+   * Unique revision used by persistence layers for compare-and-swap updates.
+   */
+  nonce: string;
+  /**
+   * Release whose stack was prepared by setup.
+   */
+  releaseId: string;
+  /**
+   * Exact setup artifact revision that authored this authority.
+   */
+  setupFingerprint: string;
+  /**
+   * Setup fingerprint contract version.
+   */
+  setupFingerprintVersion: number;
+  /**
+   * Stable setup target recorded on the imported deployment.
+   */
+  setupTarget: string;
+  /**
+   * Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared.
+   */
+  targetFrozenDigest: string;
+};
+
+export type DeploymentDetailResponseSetupUpdateAuthorizationUnion =
+  | DeploymentDetailResponseSetupUpdateAuthorization
+  | string;
+
+/**
+ * Runtime metadata for deployment state persistence
+ */
+export type DeploymentDetailResponseRuntimeMetadata = {
+  /**
+   * Whether each vault-native deployer secret is in the customer's secret
+   *
+   * @remarks
+   * store, with where it goes. Checked from metadata only; no value is ever
+   * read or recorded here.
+   */
+  deployerSecrets?: Array<DeploymentDetailResponseDeployerSecret> | undefined;
+  /**
+   * Last generated CLI package revision whose direct setup was applied.
+   *
+   * @remarks
+   * This lets a newer generated CLI refresh setup-owned infrastructure once
+   * before handing runtime changes back to the hosted manager.
+   */
+  directSetupRevision?: string | null | undefined;
+  /**
+   * Actor that owns structural work during the initial setup phase.
+   */
+  initialSetupAuthority?:
+    | DeploymentDetailResponseInitialSetupAuthority
+    | undefined;
+  /**
+   * Hash of the environment variables snapshot that was last synced to the vault
+   *
+   * @remarks
+   * Used to avoid redundant sync operations during incremental deployment
+   */
+  lastSyncedEnvVarsHash?: string | null | undefined;
+  /**
+   * Exact vault keys owned by the deployment secret synchronizer. This
+   *
+   * @remarks
+   * inventory lets a later snapshot delete removed keys without listing or
+   * touching unrelated values in the same vault.
+   */
+  lastSyncedSecretNames?: Array<string> | undefined;
+  /**
+   * Release `pending_prepared_stack` was prepared from. The target can move
+   *
+   * @remarks
+   * to a newer release while that stack is still being applied; this tells
+   * the update which release actually converged.
+   */
+  pendingPreparedReleaseId?: string | null | undefined;
+  pendingPreparedStack?:
+    | DeploymentDetailResponsePendingPreparedStackUnion
+    | null
+    | undefined;
+  /**
+   * Canonical resolved answers for inputs that gate Frozen resources,
+   *
+   * @remarks
+   * keyed by input id, recorded when the deployment is created or its
+   * setup import registers.
+   *
+   * A frozen gate's answer is fixed for the deployment's lifetime: the
+   * update path refuses input values that conflict with these, and a Live
+   * resource sharing such an input resolves the persisted answer forever.
+   */
+  persistedGateAnswers?: { [k: string]: boolean } | undefined;
+  preparedStack?:
+    | DeploymentDetailResponsePreparedStack
+    | string
+    | null
+    | undefined;
+  registryAccess?:
+    | DeploymentDetailResponseRegistryAccess
+    | string
+    | null
+    | undefined;
+  /**
+   * Whether cross-account registry access has been successfully granted.
+   *
+   * @remarks
+   * Set to true after the manager successfully sets the ECR/GAR repo policy
+   * for this deployment's target account. Prevents redundant API calls on
+   * every reconcile tick.
+   */
+  registryAccessGranted?: boolean | undefined;
+  /**
+   * What a direct setup created for resources it does not own, keyed by resource id. Setup
+   *
+   * @remarks
+   * teardown removes exactly what is recorded here.
+   */
+  setupScaffolding?:
+    | { [k: string]: DeploymentDetailResponseSetupScaffolding }
+    | undefined;
+  setupUpdateAuthorization?:
+    | DeploymentDetailResponseSetupUpdateAuthorization
+    | string
+    | null
+    | undefined;
+};
+
+/**
+ * Setup source that imported this deployment
+ */
+export const DeploymentDetailResponseImportSource = {
+  Cloudformation: "cloudformation",
+  Terraform: "terraform",
+  Helm: "helm",
+} as const;
+/**
+ * Setup source that imported this deployment
+ */
+export type DeploymentDetailResponseImportSource = ClosedEnum<
+  typeof DeploymentDetailResponseImportSource
+>;
+
+/**
+ * Setup method that created the deployment record and owns setup-time resources.
+ */
+export const DeploymentDetailResponseSetupMethod = {
+  Cloudformation: "cloudformation",
+  GoogleOauth: "google-oauth",
+  Terraform: "terraform",
+  Helm: "helm",
+  Cli: "cli",
+  Manual: "manual",
+} as const;
+/**
+ * Setup method that created the deployment record and owns setup-time resources.
+ */
+export type DeploymentDetailResponseSetupMethod = ClosedEnum<
+  typeof DeploymentDetailResponseSetupMethod
+>;
+
+/**
+ * Latest error information if the deployment is in a failed state
+ */
+export type DeploymentDetailResponseError = {
+  /**
+   * A unique identifier for the type of error.
+   *
+   * @remarks
+   *
+   * This should be a short, machine-readable string that can be used
+   * by clients to programmatically handle different error types.
+   * Examples: "NOT_FOUND", "VALIDATION_ERROR", "TIMEOUT"
+   */
+  code: string;
+  /**
+   * Additional diagnostic information about the error context.
+   *
+   * @remarks
+   *
+   * This optional field can contain structured data providing more details
+   * about the error, such as validation errors, request parameters that
+   * caused the issue, or other relevant context information.
+   */
+  context?: any | null | undefined;
+  /**
+   * Optional human-facing remediation hint.
+   */
+  hint?: string | null | undefined;
+  /**
+   * HTTP status code for this error.
+   *
+   * @remarks
+   *
+   * Used when converting the error to an HTTP response. If None, falls back to
+   * the error type's default status code or 500.
+   */
+  httpStatusCode?: number | null | undefined;
+  /**
+   * Indicates if this is an internal error that should not be exposed to users.
+   *
+   * @remarks
+   *
+   * When `true`, this error contains sensitive information or implementation
+   * details that should not be shown to end-users. Such errors should be
+   * logged for debugging but replaced with generic error messages in responses.
+   */
+  internal: boolean;
+  /**
+   * Human-readable error message.
+   *
+   * @remarks
+   *
+   * This message should be clear and actionable for developers or end-users,
+   * providing context about what went wrong and potentially how to fix it.
+   */
+  message: string;
+  /**
+   * Indicates whether the operation that caused the error should be retried.
+   *
+   * @remarks
+   *
+   * When `true`, the error is transient and the operation might succeed
+   * if attempted again. When `false`, retrying the same operation is
+   * unlikely to succeed without changes.
+   */
+  retryable: boolean;
+  /**
+   * The underlying error that caused this error, creating an error chain.
+   *
+   * @remarks
+   *
+   * This allows for proper error propagation and debugging by maintaining
+   * the full context of how an error occurred through multiple layers
+   * of an application.
+   */
+  source?: any | null | undefined;
+};
+
+/**
+ * Durable progress for deployment updates
+ */
+export type DeploymentDetailResponseUpdateState = {
+  active: DeploymentUpdateOperationSummary | null;
+  next: DeploymentUpdateOperationSummary | null;
+  latest: DeploymentUpdateOperationSummary | null;
+};
+
+/**
+ * Plugin/operations-bundle sync status for this deployment's Operator. Null for non-pull deployments.
+ */
+export type OperatorSync = {
+  /**
+   * Unique identifier for the deployment operator sync.
+   */
+  id: string;
+  status: DeploymentOperatorSyncStatus;
+  stuckReason?: DeploymentOperatorSyncStuckReason | null | undefined;
+  /**
+   * Human-readable explanation of the status
+   */
+  statusMessage?: string | null | undefined;
+  targetBundleHash: string;
+  /**
+   * Plugin bundle set hash last reported by the Operator
+   */
+  observedBundleHash?: string | null | undefined;
+  /**
+   * Expected `plugin/operation` names not reported by the Operator (catalog-mismatch only)
+   */
+  missingOperations?: Array<string> | null | undefined;
+  /**
+   * Declared plugins compared with what the Operator last reported loading. Null when the sync fingerprints cannot be read.
+   */
+  plugins?: Array<DeploymentOperatorSyncPlugin> | null | undefined;
+  targetSetAt: Date;
+  observedAt?: Date | null | undefined;
+};
+
+export type DeploymentDetailResponse = {
+  /**
+   * Unique identifier for the deployment.
+   */
+  id: string;
+  /**
+   * Deployment name.
+   */
+  name: string;
+  /**
+   * Public subdomain for auto-generated domains
+   */
+  publicSubdomain?: string | null | undefined;
+  /**
+   * Deployment status in the deployment lifecycle.
+   *
+   * @remarks
+   *
+   * For observe-only deployments with no release or stack state, `Running`
+   * means the Operator is attached. Connectivity comes from `lastHeartbeatAt`;
+   * resource health comes from inventory and resource heartbeat data.
+   */
+  status: DeploymentDetailResponseStatus;
+  /**
+   * Unique identifier for the project.
+   */
+  projectId: string;
+  /**
+   * Target platform for the deployment
+   */
+  platform: DeploymentDetailResponsePlatform;
+  /**
+   * Underlying cloud platform for Kubernetes deployments.
+   */
+  basePlatform?: DeploymentDetailResponseBasePlatform | null | undefined;
+  /**
+   * Cloud region or location for the deployment.
+   */
+  region?: string | null | undefined;
+  /**
+   * DeploymentState protocol version owned by the runtime/manager
+   */
+  deploymentProtocolVersion: number;
+  /**
+   * ID of deployment group this deployment belongs to
+   */
+  deploymentGroupId: string;
+  membershipRevision: number;
+  membershipProjectionRevision: number | null;
+  /**
+   * Operational purpose of this deployment within its customer environment.
+   */
+  purpose: DeploymentPurpose;
+  /**
+   * Cloud environment information
+   */
+  environmentInfo?:
+    | DeploymentDetailResponseEnvironmentInfoUnion
+    | null
+    | undefined;
+  /**
+   * User-provided configuration (network, deployment model, approvals)
+   */
+  stackSettings: DeploymentDetailResponseStackSettings;
+  /**
+   * State of infrastructure components managed by this deployment
+   */
+  stackState?: DeploymentDetailResponseStackState | null | undefined;
+  /**
+   * Runtime metadata for deployment state persistence
+   */
+  runtimeMetadata?: DeploymentDetailResponseRuntimeMetadata | null | undefined;
+  /**
+   * ID of the currently deployed release (actual state)
+   */
+  currentReleaseId?: string | null | undefined;
+  /**
+   * ID of the desired release for deployment/update (desired state)
+   */
+  desiredReleaseId?: string | null | undefined;
+  /**
+   * ID of the pinned release
+   */
+  pinnedReleaseId?: string | null | undefined;
+  releaseChannel: string;
+  /**
+   * Setup source that imported this deployment
+   */
+  importSource?: DeploymentDetailResponseImportSource | null | undefined;
+  /**
+   * Setup method that created the deployment record and owns setup-time resources.
+   */
+  setupMethod?: DeploymentDetailResponseSetupMethod | null | undefined;
+  /**
+   * Setup method metadata needed to guide privileged teardown.
+   */
+  setupMetadata?: { [k: string]: any | null } | null | undefined;
+  /**
+   * Imported setup target for compatibility checks
+   */
+  setupTarget?: string | null | undefined;
+  /**
+   * Imported setup compatibility fingerprint
+   */
+  setupFingerprint?: string | null | undefined;
+  /**
+   * Imported setup fingerprint algorithm version
+   */
+  setupFingerprintVersion?: number | null | undefined;
+  /**
+   * Display-only scope reported by the Operator manifest
+   */
+  operatorScope?: string | null | undefined;
+  /**
+   * Display-only permission tier reported by the Operator manifest
+   */
+  operatorPermission?: string | null | undefined;
+  /**
+   * Version reported by the Operator
+   */
+  operatorVersion?: string | null | undefined;
+  /**
+   * Capability state reported by the Operator
+   */
+  capabilities?: Array<OperatorCapabilityReport> | null | undefined;
+  /**
+   * Plugin bundle set hash the Operator reports having loaded
+   */
+  observedOperationsBundleHash?: string | null | undefined;
+  /**
+   * Operations the Operator reports as currently loaded
+   */
+  observedOperations?: Array<ReportedOperation> | null | undefined;
+  /**
+   * Whether a retry has been requested for a failed deployment
+   */
+  retryRequested: boolean;
+  /**
+   * Timestamp of the last received heartbeat from the deployment
+   */
+  lastHeartbeatAt?: Date | null | undefined;
+  /**
+   * Latest error information if the deployment is in a failed state
+   */
+  error?: DeploymentDetailResponseError | null | undefined;
+  /**
+   * Durable progress for deployment updates
+   */
+  updateState?: DeploymentDetailResponseUpdateState | undefined;
+  createdAt: Date;
+  updatedAt: Date;
+  managerId: string;
+  /**
+   * Unique identifier for the workspace.
+   */
+  workspaceId: string;
+  release?: DeploymentReleaseInfo | null | undefined;
+  deploymentGroup?: DeploymentGroupInfo | undefined;
+  project?: DeploymentProjectInfo | undefined;
+  /**
+   * Plugin/operations-bundle sync status for this deployment's Operator. Null for non-pull deployments.
+   */
+  operatorSync?: OperatorSync | null | undefined;
+};
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOperationsUnion$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackOperationsUnion, unknown> = z
+    .union([
+      DeploymentDetailResponsePreparedStackOperations$inboundSchema,
+      z.string(),
+    ]);
+
+export function deploymentDetailResponsePreparedStackOperationsUnionFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOperationsUnion,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOperationsUnion$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOperationsUnion' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackManagementEnum$inboundSchema:
+  z.ZodEnum<typeof DeploymentDetailResponsePreparedStackManagementEnum> = z
+    .enum(DeploymentDetailResponsePreparedStackManagementEnum);
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideAwResource$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackOverrideAwResource, unknown> =
+    z.object({
+      condition: z.nullable(
+        z.record(z.string(), z.record(z.string(), z.string())),
+      ).optional(),
+      notResources: z.array(z.string()).optional(),
+      resources: z.array(z.string()),
+    });
+
+export function deploymentDetailResponsePreparedStackOverrideAwResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideAwResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideAwResource$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideAwResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideAwStack$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackOverrideAwStack, unknown> = z
+    .object({
+      condition: z.nullable(
+        z.record(z.string(), z.record(z.string(), z.string())),
+      ).optional(),
+      notResources: z.array(z.string()).optional(),
+      resources: z.array(z.string()),
+    });
+
+export function deploymentDetailResponsePreparedStackOverrideAwStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideAwStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideAwStack$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideAwStack' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideAwBinding$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackOverrideAwBinding, unknown> = z
+    .object({
+      resource: z.lazy(() =>
+        DeploymentDetailResponsePreparedStackOverrideAwResource$inboundSchema
+      ).optional(),
+      stack: z.lazy(() =>
+        DeploymentDetailResponsePreparedStackOverrideAwStack$inboundSchema
+      ).optional(),
+    });
+
+export function deploymentDetailResponsePreparedStackOverrideAwBindingFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideAwBinding,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideAwBinding$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideAwBinding' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideEffect$inboundSchema:
+  z.ZodEnum<typeof DeploymentDetailResponsePreparedStackOverrideEffect> = z
+    .enum(DeploymentDetailResponsePreparedStackOverrideEffect);
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideAwGrant$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackOverrideAwGrant, unknown> = z
+    .object({
+      actions: z.nullable(z.array(z.string())).optional(),
+      dataActions: z.nullable(z.array(z.string())).optional(),
+      permissions: z.nullable(z.array(z.string())).optional(),
+      predefinedRoles: z.nullable(z.array(z.string())).optional(),
+      residualPermissions: z.nullable(z.array(z.string())).optional(),
+    });
+
+export function deploymentDetailResponsePreparedStackOverrideAwGrantFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideAwGrant,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideAwGrant$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideAwGrant' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideAw$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackOverrideAw, unknown> = z
+    .object({
+      binding: z.lazy(() =>
+        DeploymentDetailResponsePreparedStackOverrideAwBinding$inboundSchema
+      ),
+      description: z.nullable(z.string()).optional(),
+      effect: DeploymentDetailResponsePreparedStackOverrideEffect$inboundSchema
+        .optional(),
+      grant: z.lazy(() =>
+        DeploymentDetailResponsePreparedStackOverrideAwGrant$inboundSchema
+      ),
+      label: z.nullable(z.string()).optional(),
+    });
+
+export function deploymentDetailResponsePreparedStackOverrideAwFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideAw,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideAw$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideAw' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideAzureResource$inboundSchema:
+  z.ZodType<
+    DeploymentDetailResponsePreparedStackOverrideAzureResource,
+    unknown
+  > = z.object({
+    scope: z.string(),
+  });
+
+export function deploymentDetailResponsePreparedStackOverrideAzureResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideAzureResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideAzureResource$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideAzureResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideAzureStack$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackOverrideAzureStack, unknown> =
+    z.object({
+      scope: z.string(),
+    });
+
+export function deploymentDetailResponsePreparedStackOverrideAzureStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideAzureStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideAzureStack$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideAzureStack' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideAzureBinding$inboundSchema:
+  z.ZodType<
+    DeploymentDetailResponsePreparedStackOverrideAzureBinding,
+    unknown
+  > = z.object({
+    resource: z.lazy(() =>
+      DeploymentDetailResponsePreparedStackOverrideAzureResource$inboundSchema
+    ).optional(),
+    stack: z.lazy(() =>
+      DeploymentDetailResponsePreparedStackOverrideAzureStack$inboundSchema
+    ).optional(),
+  });
+
+export function deploymentDetailResponsePreparedStackOverrideAzureBindingFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideAzureBinding,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideAzureBinding$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideAzureBinding' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideAzureGrant$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackOverrideAzureGrant, unknown> =
+    z.object({
+      actions: z.nullable(z.array(z.string())).optional(),
+      dataActions: z.nullable(z.array(z.string())).optional(),
+      permissions: z.nullable(z.array(z.string())).optional(),
+      predefinedRoles: z.nullable(z.array(z.string())).optional(),
+      residualPermissions: z.nullable(z.array(z.string())).optional(),
+    });
+
+export function deploymentDetailResponsePreparedStackOverrideAzureGrantFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideAzureGrant,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideAzureGrant$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideAzureGrant' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideAzure$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackOverrideAzure, unknown> = z
+    .object({
+      binding: z.lazy(() =>
+        DeploymentDetailResponsePreparedStackOverrideAzureBinding$inboundSchema
+      ),
+      description: z.nullable(z.string()).optional(),
+      grant: z.lazy(() =>
+        DeploymentDetailResponsePreparedStackOverrideAzureGrant$inboundSchema
+      ),
+      label: z.nullable(z.string()).optional(),
+    });
+
+export function deploymentDetailResponsePreparedStackOverrideAzureFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideAzure,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideAzure$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideAzure' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideConditionResource$inboundSchema:
+  z.ZodType<
+    DeploymentDetailResponsePreparedStackOverrideConditionResource,
+    unknown
+  > = z.object({
+    expression: z.string(),
+    title: z.string(),
+  });
+
+export function deploymentDetailResponsePreparedStackOverrideConditionResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideConditionResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideConditionResource$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideConditionResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideResourceConditionUnion$inboundSchema:
+  z.ZodType<
+    DeploymentDetailResponsePreparedStackOverrideResourceConditionUnion,
+    unknown
+  > = z.union([
+    z.lazy(() =>
+      DeploymentDetailResponsePreparedStackOverrideConditionResource$inboundSchema
+    ),
+    z.string(),
+  ]);
+
+export function deploymentDetailResponsePreparedStackOverrideResourceConditionUnionFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideResourceConditionUnion,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideResourceConditionUnion$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideResourceConditionUnion' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideGcpResource$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackOverrideGcpResource, unknown> =
+    z.object({
+      condition: z.nullable(
+        z.union([
+          z.lazy(() =>
+            DeploymentDetailResponsePreparedStackOverrideConditionResource$inboundSchema
+          ),
+          z.string(),
+        ]),
+      ).optional(),
+      scope: z.string(),
+    });
+
+export function deploymentDetailResponsePreparedStackOverrideGcpResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideGcpResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideGcpResource$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideGcpResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideConditionStack$inboundSchema:
+  z.ZodType<
+    DeploymentDetailResponsePreparedStackOverrideConditionStack,
+    unknown
+  > = z.object({
+    expression: z.string(),
+    title: z.string(),
+  });
+
+export function deploymentDetailResponsePreparedStackOverrideConditionStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideConditionStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideConditionStack$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideConditionStack' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideStackConditionUnion$inboundSchema:
+  z.ZodType<
+    DeploymentDetailResponsePreparedStackOverrideStackConditionUnion,
+    unknown
+  > = z.union([
+    z.lazy(() =>
+      DeploymentDetailResponsePreparedStackOverrideConditionStack$inboundSchema
+    ),
+    z.string(),
+  ]);
+
+export function deploymentDetailResponsePreparedStackOverrideStackConditionUnionFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideStackConditionUnion,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideStackConditionUnion$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideStackConditionUnion' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideGcpStack$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackOverrideGcpStack, unknown> = z
+    .object({
+      condition: z.nullable(
+        z.union([
+          z.lazy(() =>
+            DeploymentDetailResponsePreparedStackOverrideConditionStack$inboundSchema
+          ),
+          z.string(),
+        ]),
+      ).optional(),
+      scope: z.string(),
+    });
+
+export function deploymentDetailResponsePreparedStackOverrideGcpStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideGcpStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideGcpStack$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideGcpStack' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideGcpBinding$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackOverrideGcpBinding, unknown> =
+    z.object({
+      resource: z.lazy(() =>
+        DeploymentDetailResponsePreparedStackOverrideGcpResource$inboundSchema
+      ).optional(),
+      stack: z.lazy(() =>
+        DeploymentDetailResponsePreparedStackOverrideGcpStack$inboundSchema
+      ).optional(),
+    });
+
+export function deploymentDetailResponsePreparedStackOverrideGcpBindingFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideGcpBinding,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideGcpBinding$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideGcpBinding' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideGcpGrant$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackOverrideGcpGrant, unknown> = z
+    .object({
+      actions: z.nullable(z.array(z.string())).optional(),
+      dataActions: z.nullable(z.array(z.string())).optional(),
+      permissions: z.nullable(z.array(z.string())).optional(),
+      predefinedRoles: z.nullable(z.array(z.string())).optional(),
+      residualPermissions: z.nullable(z.array(z.string())).optional(),
+    });
+
+export function deploymentDetailResponsePreparedStackOverrideGcpGrantFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideGcpGrant,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideGcpGrant$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideGcpGrant' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideGcp$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackOverrideGcp, unknown> = z
+    .object({
+      binding: z.lazy(() =>
+        DeploymentDetailResponsePreparedStackOverrideGcpBinding$inboundSchema
+      ),
+      description: z.nullable(z.string()).optional(),
+      grant: z.lazy(() =>
+        DeploymentDetailResponsePreparedStackOverrideGcpGrant$inboundSchema
+      ),
+      label: z.nullable(z.string()).optional(),
+    });
+
+export function deploymentDetailResponsePreparedStackOverrideGcpFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideGcp,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideGcp$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideGcp' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverridePlatforms$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackOverridePlatforms, unknown> = z
+    .object({
+      aws: z.nullable(
+        z.array(z.lazy(() =>
+          DeploymentDetailResponsePreparedStackOverrideAw$inboundSchema
+        )),
+      ).optional(),
+      azure: z.nullable(
+        z.array(z.lazy(() =>
+          DeploymentDetailResponsePreparedStackOverrideAzure$inboundSchema
+        )),
+      ).optional(),
+      gcp: z.nullable(
+        z.array(z.lazy(() =>
+          DeploymentDetailResponsePreparedStackOverrideGcp$inboundSchema
+        )),
+      ).optional(),
+    });
+
+export function deploymentDetailResponsePreparedStackOverridePlatformsFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverridePlatforms,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverridePlatforms$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverridePlatforms' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverride$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackOverride, unknown> = z.object({
+    description: z.string(),
+    id: z.string(),
+    platforms: z.lazy(() =>
+      DeploymentDetailResponsePreparedStackOverridePlatforms$inboundSchema
+    ),
+  });
+
+export function deploymentDetailResponsePreparedStackOverrideFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverride,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverride$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverride' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackOverrideUnion$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackOverrideUnion, unknown> = z
+    .union([
+      z.lazy(() => DeploymentDetailResponsePreparedStackOverride$inboundSchema),
+      z.string(),
+    ]);
+
+export function deploymentDetailResponsePreparedStackOverrideUnionFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackOverrideUnion,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackOverrideUnion$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackOverrideUnion' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackManagement2$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackManagement2, unknown> = z
+    .object({
+      override: z.record(
+        z.string(),
+        z.array(z.union([
+          z.lazy(() =>
+            DeploymentDetailResponsePreparedStackOverride$inboundSchema
+          ),
+          z.string(),
+        ])),
+      ),
+    });
+
+export function deploymentDetailResponsePreparedStackManagement2FromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackManagement2,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackManagement2$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackManagement2' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackExtendAwResource$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackExtendAwResource, unknown> = z
+    .object({
+      condition: z.nullable(
+        z.record(z.string(), z.record(z.string(), z.string())),
+      ).optional(),
+      notResources: z.array(z.string()).optional(),
+      resources: z.array(z.string()),
+    });
+
+export function deploymentDetailResponsePreparedStackExtendAwResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackExtendAwResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackExtendAwResource$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackExtendAwResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackExtendAwStack$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackExtendAwStack, unknown> = z
+    .object({
+      condition: z.nullable(
+        z.record(z.string(), z.record(z.string(), z.string())),
+      ).optional(),
+      notResources: z.array(z.string()).optional(),
+      resources: z.array(z.string()),
+    });
+
+export function deploymentDetailResponsePreparedStackExtendAwStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackExtendAwStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackExtendAwStack$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackExtendAwStack' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackExtendAwBinding$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackExtendAwBinding, unknown> = z
+    .object({
+      resource: z.lazy(() =>
+        DeploymentDetailResponsePreparedStackExtendAwResource$inboundSchema
+      ).optional(),
+      stack: z.lazy(() =>
+        DeploymentDetailResponsePreparedStackExtendAwStack$inboundSchema
+      ).optional(),
+    });
+
+export function deploymentDetailResponsePreparedStackExtendAwBindingFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackExtendAwBinding,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackExtendAwBinding$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackExtendAwBinding' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackExtendEffect$inboundSchema:
+  z.ZodEnum<typeof DeploymentDetailResponsePreparedStackExtendEffect> = z.enum(
+    DeploymentDetailResponsePreparedStackExtendEffect,
+  );
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackExtendAwGrant$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackExtendAwGrant, unknown> = z
+    .object({
+      actions: z.nullable(z.array(z.string())).optional(),
+      dataActions: z.nullable(z.array(z.string())).optional(),
+      permissions: z.nullable(z.array(z.string())).optional(),
+      predefinedRoles: z.nullable(z.array(z.string())).optional(),
+      residualPermissions: z.nullable(z.array(z.string())).optional(),
+    });
+
+export function deploymentDetailResponsePreparedStackExtendAwGrantFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackExtendAwGrant,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackExtendAwGrant$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackExtendAwGrant' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackExtendAw$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackExtendAw, unknown> = z.object({
+    binding: z.lazy(() =>
+      DeploymentDetailResponsePreparedStackExtendAwBinding$inboundSchema
+    ),
+    description: z.nullable(z.string()).optional(),
+    effect: DeploymentDetailResponsePreparedStackExtendEffect$inboundSchema
+      .optional(),
+    grant: z.lazy(() =>
+      DeploymentDetailResponsePreparedStackExtendAwGrant$inboundSchema
+    ),
+    label: z.nullable(z.string()).optional(),
+  });
+
+export function deploymentDetailResponsePreparedStackExtendAwFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackExtendAw,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackExtendAw$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackExtendAw' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackExtendAzureResource$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackExtendAzureResource, unknown> =
+    z.object({
+      scope: z.string(),
+    });
+
+export function deploymentDetailResponsePreparedStackExtendAzureResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackExtendAzureResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackExtendAzureResource$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackExtendAzureResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackExtendAzureStack$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackExtendAzureStack, unknown> = z
+    .object({
+      scope: z.string(),
+    });
+
+export function deploymentDetailResponsePreparedStackExtendAzureStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackExtendAzureStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackExtendAzureStack$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackExtendAzureStack' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackExtendAzureBinding$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackExtendAzureBinding, unknown> =
+    z.object({
+      resource: z.lazy(() =>
+        DeploymentDetailResponsePreparedStackExtendAzureResource$inboundSchema
+      ).optional(),
+      stack: z.lazy(() =>
+        DeploymentDetailResponsePreparedStackExtendAzureStack$inboundSchema
+      ).optional(),
+    });
+
+export function deploymentDetailResponsePreparedStackExtendAzureBindingFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackExtendAzureBinding,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackExtendAzureBinding$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackExtendAzureBinding' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackExtendAzureGrant$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackExtendAzureGrant, unknown> = z
+    .object({
+      actions: z.nullable(z.array(z.string())).optional(),
+      dataActions: z.nullable(z.array(z.string())).optional(),
+      permissions: z.nullable(z.array(z.string())).optional(),
+      predefinedRoles: z.nullable(z.array(z.string())).optional(),
+      residualPermissions: z.nullable(z.array(z.string())).optional(),
+    });
+
+export function deploymentDetailResponsePreparedStackExtendAzureGrantFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackExtendAzureGrant,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackExtendAzureGrant$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackExtendAzureGrant' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackExtendAzure$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackExtendAzure, unknown> = z
+    .object({
+      binding: z.lazy(() =>
+        DeploymentDetailResponsePreparedStackExtendAzureBinding$inboundSchema
+      ),
+      description: z.nullable(z.string()).optional(),
+      grant: z.lazy(() =>
+        DeploymentDetailResponsePreparedStackExtendAzureGrant$inboundSchema
+      ),
+      label: z.nullable(z.string()).optional(),
+    });
+
+export function deploymentDetailResponsePreparedStackExtendAzureFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackExtendAzure,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackExtendAzure$inboundSchema.parse(
+        JSON.parse(x),
+      ),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackExtendAzure' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackExtendConditionResource$inboundSchema:
+  z.ZodType<
+    DeploymentDetailResponsePreparedStackExtendConditionResource,
+    unknown
+  > = z.object({
+    expression: z.string(),
+    title: z.string(),
+  });
+
+export function deploymentDetailResponsePreparedStackExtendConditionResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackExtendConditionResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackExtendConditionResource$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackExtendConditionResource' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackExtendResourceConditionUnion$inboundSchema:
+  z.ZodType<
+    DeploymentDetailResponsePreparedStackExtendResourceConditionUnion,
+    unknown
+  > = z.union([
+    z.lazy(() =>
+      DeploymentDetailResponsePreparedStackExtendConditionResource$inboundSchema
+    ),
+    z.string(),
+  ]);
+
+export function deploymentDetailResponsePreparedStackExtendResourceConditionUnionFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackExtendResourceConditionUnion,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackExtendResourceConditionUnion$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackExtendResourceConditionUnion' from JSON`,
+  );
+}
+
+/** @internal */
+export const DeploymentDetailResponsePreparedStackExtendGcpResource$inboundSchema:
+  z.ZodType<DeploymentDetailResponsePreparedStackExtendGcpResource, unknown> = z
+    .object({
+      condition: z.nullable(
+        z.union([
+          z.lazy(() =>
+            DeploymentDetailResponsePreparedStackExtendConditionResource$inboundSchema
+          ),
+          z.string(),
+        ]),
+      ).optional(),
+      scope: z.string(),
+    });
 
-/**
- * Plugin/operations-bundle sync status for this deployment's Operator. Null for non-pull deployments.
- */
-export type OperatorSync = {
-  /**
-   * Unique identifier for the deployment operator sync.
-   */
-  id: string;
-  status: DeploymentOperatorSyncStatus;
-  stuckReason?: DeploymentOperatorSyncStuckReason | null | undefined;
-  /**
-   * Human-readable explanation of the status
-   */
-  statusMessage?: string | null | undefined;
-  targetBundleHash: string;
-  /**
-   * Enabled-plugin-bundle-set hash last reported by the Operator
-   */
-  observedBundleHash?: string | null | undefined;
-  /**
-   * Expected `plugin/operation` names not reported by the Operator (catalog-mismatch only)
-   */
-  missingOperations?: Array<string> | null | undefined;
-  /**
-   * Enabled plugins compared with what the Operator last reported loading. Null when the sync fingerprints cannot be read.
-   */
-  plugins?: Array<DeploymentOperatorSyncPlugin> | null | undefined;
-  targetSetAt: Date;
-  observedAt?: Date | null | undefined;
-};
+export function deploymentDetailResponsePreparedStackExtendGcpResourceFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackExtendGcpResource,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackExtendGcpResource$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackExtendGcpResource' from JSON`,
+  );
+}
 
-export type DeploymentDetailResponse = {
-  /**
-   * Unique identifier for the deployment.
-   */
-  id: string;
-  /**
-   * Deployment name.
-   */
-  name: string;
-  /**
-   * Public subdomain for auto-generated domains
-   */
-  publicSubdomain?: string | null | undefined;
-  /**
-   * Deployment status in the deployment lifecycle.
-   *
-   * @remarks
-   *
-   * For observe-only deployments with no release or stack state, `Running`
-   * means the Operator is attached. Connectivity comes from `lastHeartbeatAt`;
-   * resource health comes from inventory and resource heartbeat data.
-   */
-  status: DeploymentDetailResponseStatus;
-  /**
-   * Unique identifier for the project.
-   */
-  projectId: string;
-  /**
-   * Target platform for the deployment
-   */
-  platform: DeploymentDetailResponsePlatform;
-  /**
-   * Underlying cloud platform for Kubernetes deployments.
-   */
-  basePlatform?: DeploymentDetailResponseBasePlatform | null | undefined;
-  /**
-   * Cloud region or location for the deployment.
-   */
-  region?: string | null | undefined;
-  /**
-   * DeploymentState protocol version owned by the runtime/manager
-   */
-  deploymentProtocolVersion: number;
-  /**
-   * ID of deployment group this deployment belongs to
-   */
-  deploymentGroupId: string;
-  /**
-   * Operational purpose of this deployment within its customer environment.
-   */
-  purpose: DeploymentPurpose;
-  /**
-   * Cloud environment information
-   */
-  environmentInfo?:
-    | DeploymentDetailResponseEnvironmentInfoUnion
-    | null
-    | undefined;
-  /**
-   * User-provided configuration (network, deployment model, approvals)
-   */
-  stackSettings: DeploymentDetailResponseStackSettings;
-  /**
-   * State of infrastructure components managed by this deployment
-   */
-  stackState?: DeploymentDetailResponseStackState | null | undefined;
-  /**
-   * Runtime metadata for deployment state persistence
-   */
-  runtimeMetadata?: DeploymentDetailResponseRuntimeMetadata | null | undefined;
-  /**
-   * ID of the currently deployed release (actual state)
-   */
-  currentReleaseId?: string | null | undefined;
-  /**
-   * ID of the desired release for deployment/update (desired state)
-   */
-  desiredReleaseId?: string | null | undefined;
-  /**
-   * ID of the pinned release
-   */
-  pinnedReleaseId?: string | null | undefined;
-  releaseChannel: string;
-  /**
-   * Setup source that imported this deployment
-   */
-  importSource?: DeploymentDetailResponseImportSource | null | undefined;
-  /**
-   * Setup method that created the deployment record and owns setup-time resources.
-   */
-  setupMethod?: DeploymentDetailResponseSetupMethod | null | undefined;
-  /**
-   * Setup method metadata needed to guide privileged teardown.
-   */
-  setupMetadata?: { [k: string]: any | null } | null | undefined;
-  /**
-   * Imported setup target for compatibility checks
-   */
-  setupTarget?: string | null | undefined;
-  /**
-   * Imported setup compatibility fingerprint
-   */
-  setupFingerprint?: string | null | undefined;
-  /**
-   * Imported setup fingerprint algorithm version
-   */
-  setupFingerprintVersion?: number | null | undefined;
-  /**
-   * Display-only scope reported by the Operator manifest
-   */
-  operatorScope?: string | null | undefined;
-  /**
-   * Display-only permission tier reported by the Operator manifest
-   */
-  operatorPermission?: string | null | undefined;
-  /**
-   * Version reported by the Operator
-   */
-  operatorVersion?: string | null | undefined;
-  /**
-   * Capability state reported by the Operator
-   */
-  capabilities?: Array<OperatorCapabilityReport> | null | undefined;
-  /**
-   * Enabled-plugin-bundle-set hash the Operator reports having loaded
-   */
-  observedOperationsBundleHash?: string | null | undefined;
-  /**
-   * Operations the Operator reports as currently loaded
-   */
-  observedOperations?: Array<ReportedOperation> | null | undefined;
-  /**
-   * Whether a retry has been requested for a failed deployment
-   */
-  retryRequested: boolean;
-  /**
-   * Timestamp of the last received heartbeat from the deployment
-   */
-  lastHeartbeatAt?: Date | null | undefined;
-  /**
-   * Latest error information if the deployment is in a failed state
-   */
-  error?: DeploymentDetailResponseError | null | undefined;
-  /**
-   * Durable progress for deployment updates
-   */
-  updateState?: DeploymentDetailResponseUpdateState | undefined;
-  createdAt: Date;
-  updatedAt: Date;
-  managerId: string;
-  /**
-   * Unique identifier for the workspace.
-   */
-  workspaceId: string;
-  release?: DeploymentReleaseInfo | null | undefined;
-  deploymentGroup?: DeploymentGroupInfo | undefined;
-  project?: DeploymentProjectInfo | undefined;
-  /**
-   * Plugin/operations-bundle sync status for this deployment's Operator. Null for non-pull deployments.
-   */
-  operatorSync?: OperatorSync | null | undefined;
-};
+/** @internal */
+export const DeploymentDetailResponsePreparedStackExtendConditionStack$inboundSchema:
+  z.ZodType<
+    DeploymentDetailResponsePreparedStackExtendConditionStack,
+    unknown
+  > = z.object({
+    expression: z.string(),
+    title: z.string(),
+  });
+
+export function deploymentDetailResponsePreparedStackExtendConditionStackFromJSON(
+  jsonString: string,
+): SafeParseResult<
+  DeploymentDetailResponsePreparedStackExtendConditionStack,
+  SDKValidationError
+> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentDetailResponsePreparedStackExtendConditionStack$inboundSchema
+        .parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentDetailResponsePreparedStackExtendConditionStack' from JSON`,
+  );
+}
 
 /** @internal */
 export const DeploymentDetailResponsePreparedStackExtendStackConditionUnion$inboundSchema:
@@ -1320,7 +3015,9 @@ export const DeploymentDetailResponsePreparedStackExtendStackConditionUnion$inbo
     DeploymentDetailResponsePreparedStackExtendStackConditionUnion,
     unknown
   > = z.union([
-    DeploymentDetailResponsePreparedStackExtendConditionStack$inboundSchema,
+    z.lazy(() =>
+      DeploymentDetailResponsePreparedStackExtendConditionStack$inboundSchema
+    ),
     z.string(),
   ]);
 
@@ -1345,7 +3042,9 @@ export const DeploymentDetailResponsePreparedStackExtendGcpStack$inboundSchema:
     .object({
       condition: z.nullable(
         z.union([
-          DeploymentDetailResponsePreparedStackExtendConditionStack$inboundSchema,
+          z.lazy(() =>
+            DeploymentDetailResponsePreparedStackExtendConditionStack$inboundSchema
+          ),
           z.string(),
         ]),
       ).optional(),
@@ -1372,9 +3071,9 @@ export function deploymentDetailResponsePreparedStackExtendGcpStackFromJSON(
 export const DeploymentDetailResponsePreparedStackExtendGcpBinding$inboundSchema:
   z.ZodType<DeploymentDetailResponsePreparedStackExtendGcpBinding, unknown> = z
     .object({
-      resource:
+      resource: z.lazy(() =>
         DeploymentDetailResponsePreparedStackExtendGcpResource$inboundSchema
-          .optional(),
+      ).optional(),
       stack: z.lazy(() =>
         DeploymentDetailResponsePreparedStackExtendGcpStack$inboundSchema
       ).optional(),
@@ -1459,10 +3158,14 @@ export const DeploymentDetailResponsePreparedStackExtendPlatforms$inboundSchema:
   z.ZodType<DeploymentDetailResponsePreparedStackExtendPlatforms, unknown> = z
     .object({
       aws: z.nullable(
-        z.array(DeploymentDetailResponsePreparedStackExtendAw$inboundSchema),
+        z.array(z.lazy(() =>
+          DeploymentDetailResponsePreparedStackExtendAw$inboundSchema
+        )),
       ).optional(),
       azure: z.nullable(
-        z.array(DeploymentDetailResponsePreparedStackExtendAzure$inboundSchema),
+        z.array(z.lazy(() =>
+          DeploymentDetailResponsePreparedStackExtendAzure$inboundSchema
+        )),
       ).optional(),
       gcp: z.nullable(
         z.array(z.lazy(() =>
@@ -1575,7 +3278,9 @@ export const DeploymentDetailResponsePreparedStackManagementUnion$inboundSchema:
       z.lazy(() =>
         DeploymentDetailResponsePreparedStackManagement1$inboundSchema
       ),
-      DeploymentDetailResponsePreparedStackManagement2$inboundSchema,
+      z.lazy(() =>
+        DeploymentDetailResponsePreparedStackManagement2$inboundSchema
+      ),
       DeploymentDetailResponsePreparedStackManagementEnum$inboundSchema,
     ]);
 
@@ -2215,7 +3920,9 @@ export const DeploymentDetailResponsePreparedStackPermissions$inboundSchema:
         z.lazy(() =>
           DeploymentDetailResponsePreparedStackManagement1$inboundSchema
         ),
-        DeploymentDetailResponsePreparedStackManagement2$inboundSchema,
+        z.lazy(() =>
+          DeploymentDetailResponsePreparedStackManagement2$inboundSchema
+        ),
         DeploymentDetailResponsePreparedStackManagementEnum$inboundSchema,
       ]).optional(),
       profiles: z.record(
@@ -2355,6 +4062,12 @@ export const DeploymentDetailResponsePreparedStack$inboundSchema: z.ZodType<
   id: z.string(),
   inputs: z.array(DeploymentDetailResponsePreparedStackInput$inboundSchema)
     .optional(),
+  operations: z.nullable(
+    z.union([
+      DeploymentDetailResponsePreparedStackOperations$inboundSchema,
+      z.string(),
+    ]),
+  ).optional(),
   permissions: z.lazy(() =>
     DeploymentDetailResponsePreparedStackPermissions$inboundSchema
   ).optional(),
@@ -2740,6 +4453,8 @@ export const DeploymentDetailResponse$inboundSchema: z.ZodType<
   region: z.nullable(z.string()).optional(),
   deploymentProtocolVersion: z.int(),
   deploymentGroupId: z.string(),
+  membershipRevision: z.int().default(0),
+  membershipProjectionRevision: z.nullable(z.int()).default(null),
   purpose: DeploymentPurpose$inboundSchema,
   environmentInfo: z.nullable(
     DeploymentDetailResponseEnvironmentInfoUnion$inboundSchema,