@alienplatform/platform-api 3.3.30 → 3.3.32

package/src/models/persistimporteddeploymentrequest.ts

@@ -29,7 +29,7 @@ import {
   PersistImportedDeploymentRequestStackSettings,
   PersistImportedDeploymentRequestStackSettings$Outbound,
   PersistImportedDeploymentRequestStackSettings$outboundSchema,
-} from "./persistimporteddeploymentrequestpendingpreparedstackoverrideazureresource.js";
+} from "./persistimporteddeploymentrequestpendingpreparedstacksettingscustom1.js";
 import {
   PersistImportedDeploymentRequestPendingPreparedStackUnion,
   PersistImportedDeploymentRequestPendingPreparedStackUnion$Outbound,
@@ -37,26 +37,324 @@ import {
   PersistImportedDeploymentRequestPreparedStackInput,
   PersistImportedDeploymentRequestPreparedStackInput$Outbound,
   PersistImportedDeploymentRequestPreparedStackInput$outboundSchema,
-  PersistImportedDeploymentRequestPreparedStackManagementUnion,
-  PersistImportedDeploymentRequestPreparedStackManagementUnion$Outbound,
-  PersistImportedDeploymentRequestPreparedStackManagementUnion$outboundSchema,
-  PersistImportedDeploymentRequestPreparedStackProfileAw,
-  PersistImportedDeploymentRequestPreparedStackProfileAw$Outbound,
-  PersistImportedDeploymentRequestPreparedStackProfileAw$outboundSchema,
-  PersistImportedDeploymentRequestPreparedStackProfileAzureResource,
-  PersistImportedDeploymentRequestPreparedStackProfileAzureResource$Outbound,
-  PersistImportedDeploymentRequestPreparedStackProfileAzureResource$outboundSchema,
-} from "./persistimporteddeploymentrequestpreparedstackprofileazureresource.js";
+  PersistImportedDeploymentRequestPreparedStackManagementEnum,
+  PersistImportedDeploymentRequestPreparedStackManagementEnum$outboundSchema,
+  PersistImportedDeploymentRequestPreparedStackOperationsUnion,
+  PersistImportedDeploymentRequestPreparedStackOperationsUnion$Outbound,
+  PersistImportedDeploymentRequestPreparedStackOperationsUnion$outboundSchema,
+  PersistImportedDeploymentRequestPreparedStackOverrideAw,
+  PersistImportedDeploymentRequestPreparedStackOverrideAw$Outbound,
+  PersistImportedDeploymentRequestPreparedStackOverrideAw$outboundSchema,
+  PersistImportedDeploymentRequestPreparedStackOverrideAzure,
+  PersistImportedDeploymentRequestPreparedStackOverrideAzure$Outbound,
+  PersistImportedDeploymentRequestPreparedStackOverrideAzure$outboundSchema,
+  PersistImportedDeploymentRequestPreparedStackOverrideConditionStack,
+  PersistImportedDeploymentRequestPreparedStackOverrideConditionStack$Outbound,
+  PersistImportedDeploymentRequestPreparedStackOverrideConditionStack$outboundSchema,
+  PersistImportedDeploymentRequestPreparedStackOverrideGcpResource,
+  PersistImportedDeploymentRequestPreparedStackOverrideGcpResource$Outbound,
+  PersistImportedDeploymentRequestPreparedStackOverrideGcpResource$outboundSchema,
+} from "./persistimporteddeploymentrequestpreparedstackoverrideconditionstack.js";
 import {
   StackInputValueRequest,
   StackInputValueRequest$Outbound,
   StackInputValueRequest$outboundSchema,
 } from "./stackinputvaluerequest.js";
 
+export type PersistImportedDeploymentRequestPreparedStackOverrideStackConditionUnion =
+  | PersistImportedDeploymentRequestPreparedStackOverrideConditionStack
+  | string;
+
+/**
+ * GCP-specific binding specification
+ */
+export type PersistImportedDeploymentRequestPreparedStackOverrideGcpStack = {
+  condition?:
+    | PersistImportedDeploymentRequestPreparedStackOverrideConditionStack
+    | string
+    | null
+    | undefined;
+  /**
+   * Scope (project/resource level)
+   */
+  scope: string;
+};
+
+/**
+ * Generic binding configuration for permissions
+ */
+export type PersistImportedDeploymentRequestPreparedStackOverrideGcpBinding = {
+  /**
+   * GCP-specific binding specification
+   */
+  resource?:
+    | PersistImportedDeploymentRequestPreparedStackOverrideGcpResource
+    | undefined;
+  /**
+   * GCP-specific binding specification
+   */
+  stack?:
+    | PersistImportedDeploymentRequestPreparedStackOverrideGcpStack
+    | undefined;
+};
+
+/**
+ * Grant permissions for a specific cloud platform
+ */
+export type PersistImportedDeploymentRequestPreparedStackOverrideGcpGrant = {
+  /**
+   * AWS IAM actions (only for AWS)
+   */
+  actions?: Array<string> | null | undefined;
+  /**
+   * Azure actions (only for Azure)
+   */
+  dataActions?: Array<string> | null | undefined;
+  /**
+   * GCP permissions that require an exact residual custom role.
+   */
+  permissions?: Array<string> | null | undefined;
+  /**
+   * Provider predefined roles to bind directly.
+   */
+  predefinedRoles?: Array<string> | null | undefined;
+  /**
+   * GCP residual custom permissions to pair with predefined roles.
+   */
+  residualPermissions?: Array<string> | null | undefined;
+};
+
+/**
+ * GCP-specific platform permission configuration
+ */
+export type PersistImportedDeploymentRequestPreparedStackOverrideGcp = {
+  /**
+   * Generic binding configuration for permissions
+   */
+  binding: PersistImportedDeploymentRequestPreparedStackOverrideGcpBinding;
+  /**
+   * Short admin-facing description of why this entry exists.
+   */
+  description?: string | null | undefined;
+  /**
+   * Grant permissions for a specific cloud platform
+   */
+  grant: PersistImportedDeploymentRequestPreparedStackOverrideGcpGrant;
+  /**
+   * Stable admin-facing label for this permission entry.
+   */
+  label?: string | null | undefined;
+};
+
+/**
+ * Platform-specific permission configurations
+ */
+export type PersistImportedDeploymentRequestPreparedStackOverridePlatforms = {
+  /**
+   * AWS permission configurations
+   */
+  aws?:
+    | Array<PersistImportedDeploymentRequestPreparedStackOverrideAw>
+    | null
+    | undefined;
+  /**
+   * Azure permission configurations
+   */
+  azure?:
+    | Array<PersistImportedDeploymentRequestPreparedStackOverrideAzure>
+    | null
+    | undefined;
+  /**
+   * GCP permission configurations
+   */
+  gcp?:
+    | Array<PersistImportedDeploymentRequestPreparedStackOverrideGcp>
+    | null
+    | undefined;
+};
+
+/**
+ * A permission set that can be applied across different cloud platforms
+ */
+export type PersistImportedDeploymentRequestPreparedStackOverride = {
+  /**
+   * Human-readable description of what this permission set allows
+   */
+  description: string;
+  /**
+   * Unique identifier for the permission set (e.g., "storage/data-read")
+   */
+  id: string;
+  /**
+   * Platform-specific permission configurations
+   */
+  platforms: PersistImportedDeploymentRequestPreparedStackOverridePlatforms;
+};
+
+/**
+ * Reference to a permission set - either by name or inline definition
+ */
+export type PersistImportedDeploymentRequestPreparedStackOverrideUnion =
+  | PersistImportedDeploymentRequestPreparedStackOverride
+  | string;
+
+export type PersistImportedDeploymentRequestPreparedStackManagement2 = {
+  /**
+   * Permission profile that maps resources to permission sets
+   *
+   * @remarks
+   * Key can be "*" for all resources or resource name for specific resource
+   */
+  override: {
+    [k: string]: Array<
+      PersistImportedDeploymentRequestPreparedStackOverride | string
+    >;
+  };
+};
+
+/**
+ * AWS-specific binding specification
+ */
+export type PersistImportedDeploymentRequestPreparedStackExtendAwResource = {
+  /**
+   * Optional condition for additional filtering (rare)
+   */
+  condition?: { [k: string]: { [k: string]: string } } | null | undefined;
+  /**
+   * ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a
+   *
+   * @remarks
+   * tag-on-create grant whose implied check AWS authorizes against no resource; the build
+   * refuses it anywhere else.
+   */
+  notResources?: Array<string> | undefined;
+  /**
+   * Resource ARNs to bind to
+   */
+  resources: Array<string>;
+};
+
+/**
+ * AWS-specific binding specification
+ */
+export type PersistImportedDeploymentRequestPreparedStackExtendAwStack = {
+  /**
+   * Optional condition for additional filtering (rare)
+   */
+  condition?: { [k: string]: { [k: string]: string } } | null | undefined;
+  /**
+   * ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a
+   *
+   * @remarks
+   * tag-on-create grant whose implied check AWS authorizes against no resource; the build
+   * refuses it anywhere else.
+   */
+  notResources?: Array<string> | undefined;
+  /**
+   * Resource ARNs to bind to
+   */
+  resources: Array<string>;
+};
+
+/**
+ * Generic binding configuration for permissions
+ */
+export type PersistImportedDeploymentRequestPreparedStackExtendAwBinding = {
+  /**
+   * AWS-specific binding specification
+   */
+  resource?:
+    | PersistImportedDeploymentRequestPreparedStackExtendAwResource
+    | undefined;
+  /**
+   * AWS-specific binding specification
+   */
+  stack?:
+    | PersistImportedDeploymentRequestPreparedStackExtendAwStack
+    | undefined;
+};
+
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export const PersistImportedDeploymentRequestPreparedStackExtendEffect = {
+  Allow: "Allow",
+  Deny: "Deny",
+} as const;
+/**
+ * IAM effect. Defaults to Allow.
+ */
+export type PersistImportedDeploymentRequestPreparedStackExtendEffect =
+  ClosedEnum<typeof PersistImportedDeploymentRequestPreparedStackExtendEffect>;
+
+/**
+ * Grant permissions for a specific cloud platform
+ */
+export type PersistImportedDeploymentRequestPreparedStackExtendAwGrant = {
+  /**
+   * AWS IAM actions (only for AWS)
+   */
+  actions?: Array<string> | null | undefined;
+  /**
+   * Azure actions (only for Azure)
+   */
+  dataActions?: Array<string> | null | undefined;
+  /**
+   * GCP permissions that require an exact residual custom role.
+   */
+  permissions?: Array<string> | null | undefined;
+  /**
+   * Provider predefined roles to bind directly.
+   */
+  predefinedRoles?: Array<string> | null | undefined;
+  /**
+   * GCP residual custom permissions to pair with predefined roles.
+   */
+  residualPermissions?: Array<string> | null | undefined;
+};
+
+/**
+ * AWS-specific platform permission configuration
+ */
+export type PersistImportedDeploymentRequestPreparedStackExtendAw = {
+  /**
+   * Generic binding configuration for permissions
+   */
+  binding: PersistImportedDeploymentRequestPreparedStackExtendAwBinding;
+  /**
+   * Short admin-facing description of why this entry exists.
+   */
+  description?: string | null | undefined;
+  /**
+   * IAM effect. Defaults to Allow.
+   */
+  effect?:
+    | PersistImportedDeploymentRequestPreparedStackExtendEffect
+    | undefined;
+  /**
+   * Grant permissions for a specific cloud platform
+   */
+  grant: PersistImportedDeploymentRequestPreparedStackExtendAwGrant;
+  /**
+   * Stable admin-facing label for this permission entry.
+   */
+  label?: string | null | undefined;
+};
+
 /**
  * Azure-specific binding specification
  */
-export type PersistImportedDeploymentRequestPreparedStackProfileAzureStack = {
+export type PersistImportedDeploymentRequestPreparedStackExtendAzureResource = {
+  /**
+   * Scope (subscription/resource group/resource level)
+   */
+  scope: string;
+};
+
+/**
+ * Azure-specific binding specification
+ */
+export type PersistImportedDeploymentRequestPreparedStackExtendAzureStack = {
   /**
    * Scope (subscription/resource group/resource level)
    */
@@ -66,25 +364,25 @@ export type PersistImportedDeploymentRequestPreparedStackProfileAzureStack = {
 /**
  * Generic binding configuration for permissions
  */
-export type PersistImportedDeploymentRequestPreparedStackProfileAzureBinding = {
+export type PersistImportedDeploymentRequestPreparedStackExtendAzureBinding = {
   /**
    * Azure-specific binding specification
    */
   resource?:
-    | PersistImportedDeploymentRequestPreparedStackProfileAzureResource
+    | PersistImportedDeploymentRequestPreparedStackExtendAzureResource
     | undefined;
   /**
    * Azure-specific binding specification
    */
   stack?:
-    | PersistImportedDeploymentRequestPreparedStackProfileAzureStack
+    | PersistImportedDeploymentRequestPreparedStackExtendAzureStack
     | undefined;
 };
 
 /**
  * Grant permissions for a specific cloud platform
  */
-export type PersistImportedDeploymentRequestPreparedStackProfileAzureGrant = {
+export type PersistImportedDeploymentRequestPreparedStackExtendAzureGrant = {
   /**
    * AWS IAM actions (only for AWS)
    */
@@ -110,11 +408,11 @@ export type PersistImportedDeploymentRequestPreparedStackProfileAzureGrant = {
 /**
  * Azure-specific platform permission configuration
  */
-export type PersistImportedDeploymentRequestPreparedStackProfileAzure = {
+export type PersistImportedDeploymentRequestPreparedStackExtendAzure = {
   /**
    * Generic binding configuration for permissions
    */
-  binding: PersistImportedDeploymentRequestPreparedStackProfileAzureBinding;
+  binding: PersistImportedDeploymentRequestPreparedStackExtendAzureBinding;
   /**
    * Short admin-facing description of why this entry exists.
    */
@@ -122,7 +420,7 @@ export type PersistImportedDeploymentRequestPreparedStackProfileAzure = {
   /**
    * Grant permissions for a specific cloud platform
    */
-  grant: PersistImportedDeploymentRequestPreparedStackProfileAzureGrant;
+  grant: PersistImportedDeploymentRequestPreparedStackExtendAzureGrant;
   /**
    * Stable admin-facing label for this permission entry.
    */
@@ -132,22 +430,22 @@ export type PersistImportedDeploymentRequestPreparedStackProfileAzure = {
 /**
  * GCP IAM condition
  */
-export type PersistImportedDeploymentRequestPreparedStackProfileConditionResource =
+export type PersistImportedDeploymentRequestPreparedStackExtendConditionResource =
   {
     expression: string;
     title: string;
   };
 
-export type PersistImportedDeploymentRequestPreparedStackProfileResourceConditionUnion =
-  | PersistImportedDeploymentRequestPreparedStackProfileConditionResource
+export type PersistImportedDeploymentRequestPreparedStackExtendResourceConditionUnion =
+  | PersistImportedDeploymentRequestPreparedStackExtendConditionResource
   | string;
 
 /**
  * GCP-specific binding specification
  */
-export type PersistImportedDeploymentRequestPreparedStackProfileGcpResource = {
+export type PersistImportedDeploymentRequestPreparedStackExtendGcpResource = {
   condition?:
-    | PersistImportedDeploymentRequestPreparedStackProfileConditionResource
+    | PersistImportedDeploymentRequestPreparedStackExtendConditionResource
     | string
     | null
     | undefined;
@@ -160,22 +458,22 @@ export type PersistImportedDeploymentRequestPreparedStackProfileGcpResource = {
 /**
  * GCP IAM condition
  */
-export type PersistImportedDeploymentRequestPreparedStackProfileConditionStack =
+export type PersistImportedDeploymentRequestPreparedStackExtendConditionStack =
   {
     expression: string;
     title: string;
   };
 
-export type PersistImportedDeploymentRequestPreparedStackProfileStackConditionUnion =
-  | PersistImportedDeploymentRequestPreparedStackProfileConditionStack
+export type PersistImportedDeploymentRequestPreparedStackExtendStackConditionUnion =
+  | PersistImportedDeploymentRequestPreparedStackExtendConditionStack
   | string;
 
 /**
  * GCP-specific binding specification
  */
-export type PersistImportedDeploymentRequestPreparedStackProfileGcpStack = {
+export type PersistImportedDeploymentRequestPreparedStackExtendGcpStack = {
   condition?:
-    | PersistImportedDeploymentRequestPreparedStackProfileConditionStack
+    | PersistImportedDeploymentRequestPreparedStackExtendConditionStack
     | string
     | null
     | undefined;
@@ -188,25 +486,25 @@ export type PersistImportedDeploymentRequestPreparedStackProfileGcpStack = {
 /**
  * Generic binding configuration for permissions
  */
-export type PersistImportedDeploymentRequestPreparedStackProfileGcpBinding = {
+export type PersistImportedDeploymentRequestPreparedStackExtendGcpBinding = {
   /**
    * GCP-specific binding specification
    */
   resource?:
-    | PersistImportedDeploymentRequestPreparedStackProfileGcpResource
+    | PersistImportedDeploymentRequestPreparedStackExtendGcpResource
     | undefined;
   /**
    * GCP-specific binding specification
    */
   stack?:
-    | PersistImportedDeploymentRequestPreparedStackProfileGcpStack
+    | PersistImportedDeploymentRequestPreparedStackExtendGcpStack
     | undefined;
 };
 
 /**
  * Grant permissions for a specific cloud platform
  */
-export type PersistImportedDeploymentRequestPreparedStackProfileGcpGrant = {
+export type PersistImportedDeploymentRequestPreparedStackExtendGcpGrant = {
   /**
    * AWS IAM actions (only for AWS)
    */
@@ -232,11 +530,11 @@ export type PersistImportedDeploymentRequestPreparedStackProfileGcpGrant = {
 /**
  * GCP-specific platform permission configuration
  */
-export type PersistImportedDeploymentRequestPreparedStackProfileGcp = {
+export type PersistImportedDeploymentRequestPreparedStackExtendGcp = {
   /**
    * Generic binding configuration for permissions
    */
-  binding: PersistImportedDeploymentRequestPreparedStackProfileGcpBinding;
+  binding: PersistImportedDeploymentRequestPreparedStackExtendGcpBinding;
   /**
    * Short admin-facing description of why this entry exists.
    */
@@ -244,7 +542,7 @@ export type PersistImportedDeploymentRequestPreparedStackProfileGcp = {
   /**
    * Grant permissions for a specific cloud platform
    */
-  grant: PersistImportedDeploymentRequestPreparedStackProfileGcpGrant;
+  grant: PersistImportedDeploymentRequestPreparedStackExtendGcpGrant;
   /**
    * Stable admin-facing label for this permission entry.
    */
@@ -254,26 +552,26 @@ export type PersistImportedDeploymentRequestPreparedStackProfileGcp = {
 /**
  * Platform-specific permission configurations
  */
-export type PersistImportedDeploymentRequestPreparedStackProfilePlatforms = {
+export type PersistImportedDeploymentRequestPreparedStackExtendPlatforms = {
   /**
    * AWS permission configurations
    */
   aws?:
-    | Array<PersistImportedDeploymentRequestPreparedStackProfileAw>
+    | Array<PersistImportedDeploymentRequestPreparedStackExtendAw>
     | null
     | undefined;
   /**
    * Azure permission configurations
    */
   azure?:
-    | Array<PersistImportedDeploymentRequestPreparedStackProfileAzure>
+    | Array<PersistImportedDeploymentRequestPreparedStackExtendAzure>
     | null
     | undefined;
   /**
    * GCP permission configurations
    */
   gcp?:
-    | Array<PersistImportedDeploymentRequestPreparedStackProfileGcp>
+    | Array<PersistImportedDeploymentRequestPreparedStackExtendGcp>
     | null
     | undefined;
 };
@@ -281,7 +579,7 @@ export type PersistImportedDeploymentRequestPreparedStackProfilePlatforms = {
 /**
  * A permission set that can be applied across different cloud platforms
  */
-export type PersistImportedDeploymentRequestPreparedStackProfile = {
+export type PersistImportedDeploymentRequestPreparedStackExtend = {
   /**
    * Human-readable description of what this permission set allows
    */
@@ -293,623 +591,2358 @@ export type PersistImportedDeploymentRequestPreparedStackProfile = {
   /**
    * Platform-specific permission configurations
    */
-  platforms: PersistImportedDeploymentRequestPreparedStackProfilePlatforms;
+  platforms: PersistImportedDeploymentRequestPreparedStackExtendPlatforms;
 };
 
 /**
  * Reference to a permission set - either by name or inline definition
  */
-export type PersistImportedDeploymentRequestPreparedStackProfileUnion =
-  | PersistImportedDeploymentRequestPreparedStackProfile
+export type PersistImportedDeploymentRequestPreparedStackExtendUnion =
+  | PersistImportedDeploymentRequestPreparedStackExtend
   | string;
 
-/**
- * Combined permissions configuration that contains both profiles and management
- */
-export type PersistImportedDeploymentRequestPreparedStackPermissions = {
-  /**
-   * Management permissions configuration for stack management access
-   */
-  management?:
-    | PersistImportedDeploymentRequestPreparedStackManagementUnion
-    | undefined;
+export type PersistImportedDeploymentRequestPreparedStackManagement1 = {
   /**
-   * Permission profiles that define access control for compute services
+   * Permission profile that maps resources to permission sets
    *
    * @remarks
-   * Key is the profile name, value is the permission configuration
+   * Key can be "*" for all resources or resource name for specific resource
    */
-  profiles: {
-    [k: string]: {
-      [k: string]: Array<
-        PersistImportedDeploymentRequestPreparedStackProfile | string
-      >;
-    };
+  extend: {
+    [k: string]: Array<
+      PersistImportedDeploymentRequestPreparedStackExtend | string
+    >;
   };
 };
 
 /**
- * Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties.
+ * Management permissions configuration for stack management access
  */
-export type PersistImportedDeploymentRequestPreparedStackConfig = {
+export type PersistImportedDeploymentRequestPreparedStackManagementUnion =
+  | PersistImportedDeploymentRequestPreparedStackManagement1
+  | PersistImportedDeploymentRequestPreparedStackManagement2
+  | PersistImportedDeploymentRequestPreparedStackManagementEnum;
+
+/**
+ * AWS-specific binding specification
+ */
+export type PersistImportedDeploymentRequestPreparedStackProfileAwResource = {
   /**
-   * The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+   * Optional condition for additional filtering (rare)
    */
-  id: string;
+  condition?: { [k: string]: { [k: string]: string } } | null | undefined;
   /**
-   * Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.
+   * ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a
+   *
+   * @remarks
+   * tag-on-create grant whose implied check AWS authorizes against no resource; the build
+   * refuses it anywhere else.
    */
-  type: string;
-  additionalProperties?: { [k: string]: any | null } | undefined;
-};
-
-/**
- * Reference to a resource by its stable id and resource type.
- */
-export type PersistImportedDeploymentRequestPreparedStackDependency = {
-  id: string;
+  notResources?: Array<string> | undefined;
   /**
-   * Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.
+   * Resource ARNs to bind to
    */
-  type: string;
+  resources: Array<string>;
 };
 
 /**
- * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
- */
-export const PersistImportedDeploymentRequestPreparedStackLifecycle = {
-  Frozen: "frozen",
-  Live: "live",
-} as const;
-/**
- * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+ * AWS-specific binding specification
  */
-export type PersistImportedDeploymentRequestPreparedStackLifecycle = ClosedEnum<
-  typeof PersistImportedDeploymentRequestPreparedStackLifecycle
->;
-
-export type PersistImportedDeploymentRequestPreparedStackResources = {
+export type PersistImportedDeploymentRequestPreparedStackProfileAwStack = {
   /**
-   * Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties.
+   * Optional condition for additional filtering (rare)
    */
-  config: PersistImportedDeploymentRequestPreparedStackConfig;
+  condition?: { [k: string]: { [k: string]: string } } | null | undefined;
   /**
-   * Additional dependencies for this resource beyond those defined in the resource itself.
+   * ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a
    *
    * @remarks
-   * The total dependencies are: resource.get_dependencies() + this list
+   * tag-on-create grant whose implied check AWS authorizes against no resource; the build
+   * refuses it anywhere else.
    */
-  dependencies: Array<PersistImportedDeploymentRequestPreparedStackDependency>;
+  notResources?: Array<string> | undefined;
   /**
-   * Id of the boolean stack input that decides whether this resource is
-   *
-   * @remarks
-   * created at all. `None` means always create it.
-   *
-   * Set by `.enabled(input)` in the SDK. Setup emitters render the resource
-   * conditionally on the matching template variable, so a deployer who says no
-   * never gets the resource, its outputs, or anything derived from it.
+   * Resource ARNs to bind to
    */
-  enabledWhen?: string | null | undefined;
+  resources: Array<string>;
+};
+
+/**
+ * Generic binding configuration for permissions
+ */
+export type PersistImportedDeploymentRequestPreparedStackProfileAwBinding = {
   /**
-   * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+   * AWS-specific binding specification
    */
-  lifecycle: PersistImportedDeploymentRequestPreparedStackLifecycle;
+  resource?:
+    | PersistImportedDeploymentRequestPreparedStackProfileAwResource
+    | undefined;
   /**
-   * Enable remote bindings for this resource (BYOB use case).
-   *
-   * @remarks
-   * When true, binding params are synced to StackState's `remote_binding_params`.
-   * Default: false (prevents sensitive data in synced state).
+   * AWS-specific binding specification
    */
-  remoteAccess?: boolean | undefined;
+  stack?:
+    | PersistImportedDeploymentRequestPreparedStackProfileAwStack
+    | undefined;
 };
 
 /**
- * Represents the target cloud platform.
+ * IAM effect. Defaults to Allow.
  */
-export const PersistImportedDeploymentRequestPreparedStackSupportedPlatform = {
-  Aws: "aws",
-  Gcp: "gcp",
-  Azure: "azure",
-  Kubernetes: "kubernetes",
-  Machines: "machines",
-  Local: "local",
-  Test: "test",
+export const PersistImportedDeploymentRequestPreparedStackProfileEffect = {
+  Allow: "Allow",
+  Deny: "Deny",
 } as const;
 /**
- * Represents the target cloud platform.
+ * IAM effect. Defaults to Allow.
  */
-export type PersistImportedDeploymentRequestPreparedStackSupportedPlatform =
-  ClosedEnum<
-    typeof PersistImportedDeploymentRequestPreparedStackSupportedPlatform
-  >;
+export type PersistImportedDeploymentRequestPreparedStackProfileEffect =
+  ClosedEnum<typeof PersistImportedDeploymentRequestPreparedStackProfileEffect>;
 
 /**
- * A bag of resources, unaware of any cloud.
+ * Grant permissions for a specific cloud platform
  */
-export type PersistImportedDeploymentRequestPreparedStack = {
-  /**
-   * Released Container resources whose image repositories are approved for
-   *
-   * @remarks
-   * containers created after installation.
-   */
-  dynamicContainerImageResources?: Array<string> | undefined;
-  /**
-   * Exact image repositories approved for containers created after installation.
-   *
-   * @remarks
-   * The runtime API also requires an immutable SHA-256 digest.
-   */
-  dynamicContainerRepositories?: Array<string> | undefined;
+export type PersistImportedDeploymentRequestPreparedStackProfileAwGrant = {
   /**
-   * Unique identifier for the stack
+   * AWS IAM actions (only for AWS)
    */
-  id: string;
+  actions?: Array<string> | null | undefined;
   /**
-   * Input definitions required before setup or deployment can proceed.
+   * Azure actions (only for Azure)
    */
-  inputs?:
-    | Array<PersistImportedDeploymentRequestPreparedStackInput>
-    | undefined;
+  dataActions?: Array<string> | null | undefined;
   /**
-   * Combined permissions configuration that contains both profiles and management
+   * GCP permissions that require an exact residual custom role.
    */
-  permissions?:
-    | PersistImportedDeploymentRequestPreparedStackPermissions
-    | undefined;
+  permissions?: Array<string> | null | undefined;
   /**
-   * Map of resource IDs to their configurations and lifecycle settings
+   * Provider predefined roles to bind directly.
    */
-  resources: {
-    [k: string]: PersistImportedDeploymentRequestPreparedStackResources;
-  };
+  predefinedRoles?: Array<string> | null | undefined;
   /**
-   * Which platforms this stack supports. When None, all platforms are supported.
+   * GCP residual custom permissions to pair with predefined roles.
    */
-  supportedPlatforms?:
-    | Array<PersistImportedDeploymentRequestPreparedStackSupportedPlatform>
-    | null
-    | undefined;
+  residualPermissions?: Array<string> | null | undefined;
 };
 
-export type PersistImportedDeploymentRequestPreparedStackUnion =
-  | PersistImportedDeploymentRequestPreparedStack
-  | string;
-
 /**
- * The cross-account read a manager opened on Alien's registry for one deployment.
+ * AWS-specific platform permission configuration
  */
-export type PersistImportedDeploymentRequestRegistryAccess = {
-  /**
-   * Repository identifiers the grant names, sorted.
-   */
-  repositories?: Array<string> | undefined;
+export type PersistImportedDeploymentRequestPreparedStackProfileAw = {
   /**
-   * Compute services the grant admits, sorted. Each pulls as its own principal, so a service
-   *
-   * @remarks
-   * added later needs the policy rewritten.
+   * Generic binding configuration for permissions
    */
-  serviceTypes?: Array<string> | undefined;
-};
-
-export type PersistImportedDeploymentRequestRegistryAccessUnion =
-  | PersistImportedDeploymentRequestRegistryAccess
-  | string;
-
-/**
- * The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as
- *
- * @remarks
- * soon as the object exists and cleared once it is deleted.
- */
-export type PersistImportedDeploymentRequestEgress = {
+  binding: PersistImportedDeploymentRequestPreparedStackProfileAwBinding;
   /**
-   * `AWS::Lambda::NetworkConnector` the sessions start with.
+   * Short admin-facing description of why this entry exists.
    */
-  connectorArn?: string | null | undefined;
+  description?: string | null | undefined;
   /**
-   * Cloud Control request creating or deleting the connector that AWS has not finished. Kept
-   *
-   * @remarks
-   * so the request's outcome, and AWS's reason when it fails, is read on a later call.
+   * IAM effect. Defaults to Allow.
    */
-  connectorRequest?: string | null | undefined;
+  effect?:
+    | PersistImportedDeploymentRequestPreparedStackProfileEffect
+    | undefined;
   /**
-   * IAM role Lambda assumes to place the connector's network interfaces.
+   * Grant permissions for a specific cloud platform
    */
-  operatorRoleName: string;
+  grant: PersistImportedDeploymentRequestPreparedStackProfileAwGrant;
   /**
-   * Security group permitting egress to loopback only.
+   * Stable admin-facing label for this permission entry.
    */
-  securityGroupId?: string | null | undefined;
+  label?: string | null | undefined;
 };
 
-export type PersistImportedDeploymentRequestEgressUnion =
-  | PersistImportedDeploymentRequestEgress
-  | string;
+/**
+ * Azure-specific binding specification
+ */
+export type PersistImportedDeploymentRequestPreparedStackProfileAzureResource =
+  {
+    /**
+     * Scope (subscription/resource group/resource level)
+     */
+    scope: string;
+  };
 
-export const PersistImportedDeploymentRequestTypeAwsSandbox = {
-  AwsSandbox: "awsSandbox",
-} as const;
-export type PersistImportedDeploymentRequestTypeAwsSandbox = ClosedEnum<
-  typeof PersistImportedDeploymentRequestTypeAwsSandbox
->;
+/**
+ * Azure-specific binding specification
+ */
+export type PersistImportedDeploymentRequestPreparedStackProfileAzureStack = {
+  /**
+   * Scope (subscription/resource group/resource level)
+   */
+  scope: string;
+};
 
 /**
- * Cloud objects a direct setup created so a runtime-owned resource can run.
+ * Generic binding configuration for permissions
  */
-export type PersistImportedDeploymentRequestSetupScaffolding = {
+export type PersistImportedDeploymentRequestPreparedStackProfileAzureBinding = {
   /**
-   * IAM role the image build runs as.
+   * Azure-specific binding specification
    */
-  buildRoleName: string;
-  egress?: PersistImportedDeploymentRequestEgress | string | null | undefined;
+  resource?:
+    | PersistImportedDeploymentRequestPreparedStackProfileAzureResource
+    | undefined;
   /**
-   * A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its
-   *
-   * @remarks
-   * runtime controller.
+   * Azure-specific binding specification
    */
-  imageArn?: string | null | undefined;
-  type: PersistImportedDeploymentRequestTypeAwsSandbox;
+  stack?:
+    | PersistImportedDeploymentRequestPreparedStackProfileAzureStack
+    | undefined;
 };
 
 /**
- * One-shot authority for a setup re-import to replace setup-owned resources.
+ * Grant permissions for a specific cloud platform
  */
-export type PersistImportedDeploymentRequestSetupUpdateAuthorization = {
+export type PersistImportedDeploymentRequestPreparedStackProfileAzureGrant = {
   /**
-   * Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment.
+   * AWS IAM actions (only for AWS)
    */
-  baselineFrozenDigest: string;
+  actions?: Array<string> | null | undefined;
   /**
-   * Unique revision used by persistence layers for compare-and-swap updates.
+   * Azure actions (only for Azure)
    */
-  nonce: string;
+  dataActions?: Array<string> | null | undefined;
   /**
-   * Release whose stack was prepared by setup.
+   * GCP permissions that require an exact residual custom role.
    */
-  releaseId: string;
+  permissions?: Array<string> | null | undefined;
   /**
-   * Exact setup artifact revision that authored this authority.
+   * Provider predefined roles to bind directly.
    */
-  setupFingerprint: string;
+  predefinedRoles?: Array<string> | null | undefined;
   /**
-   * Setup fingerprint contract version.
+   * GCP residual custom permissions to pair with predefined roles.
    */
-  setupFingerprintVersion: number;
+  residualPermissions?: Array<string> | null | undefined;
+};
+
+/**
+ * Azure-specific platform permission configuration
+ */
+export type PersistImportedDeploymentRequestPreparedStackProfileAzure = {
   /**
-   * Stable setup target recorded on the imported deployment.
+   * Generic binding configuration for permissions
    */
-  setupTarget: string;
+  binding: PersistImportedDeploymentRequestPreparedStackProfileAzureBinding;
   /**
-   * Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared.
+   * Short admin-facing description of why this entry exists.
    */
-  targetFrozenDigest: string;
+  description?: string | null | undefined;
+  /**
+   * Grant permissions for a specific cloud platform
+   */
+  grant: PersistImportedDeploymentRequestPreparedStackProfileAzureGrant;
+  /**
+   * Stable admin-facing label for this permission entry.
+   */
+  label?: string | null | undefined;
 };
 
-export type PersistImportedDeploymentRequestSetupUpdateAuthorizationUnion =
-  | PersistImportedDeploymentRequestSetupUpdateAuthorization
+/**
+ * GCP IAM condition
+ */
+export type PersistImportedDeploymentRequestPreparedStackProfileConditionResource =
+  {
+    expression: string;
+    title: string;
+  };
+
+export type PersistImportedDeploymentRequestPreparedStackProfileResourceConditionUnion =
+  | PersistImportedDeploymentRequestPreparedStackProfileConditionResource
   | string;
 
 /**
- * Runtime metadata for deployment
- *
- * @remarks
- *
- * Stores deployment state that needs to persist across step calls.
+ * GCP-specific binding specification
  */
-export type PersistImportedDeploymentRequestRuntimeMetadata = {
+export type PersistImportedDeploymentRequestPreparedStackProfileGcpResource = {
+  condition?:
+    | PersistImportedDeploymentRequestPreparedStackProfileConditionResource
+    | string
+    | null
+    | undefined;
   /**
-   * Whether each vault-native deployer secret is in the customer's secret
-   *
-   * @remarks
-   * store, with where it goes. Checked from metadata only; no value is ever
-   * read or recorded here.
+   * Scope (project/resource level)
    */
-  deployerSecrets?:
-    | Array<PersistImportedDeploymentRequestDeployerSecret>
+  scope: string;
+};
+
+/**
+ * GCP IAM condition
+ */
+export type PersistImportedDeploymentRequestPreparedStackProfileConditionStack =
+  {
+    expression: string;
+    title: string;
+  };
+
+export type PersistImportedDeploymentRequestPreparedStackProfileStackConditionUnion =
+  | PersistImportedDeploymentRequestPreparedStackProfileConditionStack
+  | string;
+
+/**
+ * GCP-specific binding specification
+ */
+export type PersistImportedDeploymentRequestPreparedStackProfileGcpStack = {
+  condition?:
+    | PersistImportedDeploymentRequestPreparedStackProfileConditionStack
+    | string
+    | null
     | undefined;
   /**
-   * Last generated CLI package revision whose direct setup was applied.
-   *
-   * @remarks
-   * This lets a newer generated CLI refresh setup-owned infrastructure once
-   * before handing runtime changes back to the hosted manager.
+   * Scope (project/resource level)
    */
-  directSetupRevision?: string | null | undefined;
+  scope: string;
+};
+
+/**
+ * Generic binding configuration for permissions
+ */
+export type PersistImportedDeploymentRequestPreparedStackProfileGcpBinding = {
   /**
-   * Actor that owns structural work during the initial setup phase.
+   * GCP-specific binding specification
    */
-  initialSetupAuthority?:
-    | PersistImportedDeploymentRequestInitialSetupAuthority
+  resource?:
+    | PersistImportedDeploymentRequestPreparedStackProfileGcpResource
     | undefined;
   /**
-   * Hash of the environment variables snapshot that was last synced to the vault
-   *
-   * @remarks
-   * Used to avoid redundant sync operations during incremental deployment
+   * GCP-specific binding specification
    */
-  lastSyncedEnvVarsHash?: string | null | undefined;
+  stack?:
+    | PersistImportedDeploymentRequestPreparedStackProfileGcpStack
+    | undefined;
+};
+
+/**
+ * Grant permissions for a specific cloud platform
+ */
+export type PersistImportedDeploymentRequestPreparedStackProfileGcpGrant = {
   /**
-   * Exact vault keys owned by the deployment secret synchronizer. This
-   *
-   * @remarks
-   * inventory lets a later snapshot delete removed keys without listing or
-   * touching unrelated values in the same vault.
+   * AWS IAM actions (only for AWS)
    */
-  lastSyncedSecretNames?: Array<string> | undefined;
+  actions?: Array<string> | null | undefined;
   /**
-   * Release `pending_prepared_stack` was prepared from. The target can move
-   *
-   * @remarks
-   * to a newer release while that stack is still being applied; this tells
-   * the update which release actually converged.
+   * Azure actions (only for Azure)
    */
-  pendingPreparedReleaseId?: string | null | undefined;
-  pendingPreparedStack?:
-    | PersistImportedDeploymentRequestPendingPreparedStackUnion
+  dataActions?: Array<string> | null | undefined;
+  /**
+   * GCP permissions that require an exact residual custom role.
+   */
+  permissions?: Array<string> | null | undefined;
+  /**
+   * Provider predefined roles to bind directly.
+   */
+  predefinedRoles?: Array<string> | null | undefined;
+  /**
+   * GCP residual custom permissions to pair with predefined roles.
+   */
+  residualPermissions?: Array<string> | null | undefined;
+};
+
+/**
+ * GCP-specific platform permission configuration
+ */
+export type PersistImportedDeploymentRequestPreparedStackProfileGcp = {
+  /**
+   * Generic binding configuration for permissions
+   */
+  binding: PersistImportedDeploymentRequestPreparedStackProfileGcpBinding;
+  /**
+   * Short admin-facing description of why this entry exists.
+   */
+  description?: string | null | undefined;
+  /**
+   * Grant permissions for a specific cloud platform
+   */
+  grant: PersistImportedDeploymentRequestPreparedStackProfileGcpGrant;
+  /**
+   * Stable admin-facing label for this permission entry.
+   */
+  label?: string | null | undefined;
+};
+
+/**
+ * Platform-specific permission configurations
+ */
+export type PersistImportedDeploymentRequestPreparedStackProfilePlatforms = {
+  /**
+   * AWS permission configurations
+   */
+  aws?:
+    | Array<PersistImportedDeploymentRequestPreparedStackProfileAw>
     | null
     | undefined;
   /**
-   * Canonical resolved answers for inputs that gate Frozen resources,
-   *
-   * @remarks
-   * keyed by input id, recorded when the deployment is created or its
-   * setup import registers.
-   *
-   * A frozen gate's answer is fixed for the deployment's lifetime: the
-   * update path refuses input values that conflict with these, and a Live
-   * resource sharing such an input resolves the persisted answer forever.
+   * Azure permission configurations
    */
-  persistedGateAnswers?: { [k: string]: boolean } | undefined;
-  preparedStack?:
-    | PersistImportedDeploymentRequestPreparedStack
-    | string
+  azure?:
+    | Array<PersistImportedDeploymentRequestPreparedStackProfileAzure>
     | null
     | undefined;
-  registryAccess?:
-    | PersistImportedDeploymentRequestRegistryAccess
-    | string
+  /**
+   * GCP permission configurations
+   */
+  gcp?:
+    | Array<PersistImportedDeploymentRequestPreparedStackProfileGcp>
     | null
     | undefined;
+};
+
+/**
+ * A permission set that can be applied across different cloud platforms
+ */
+export type PersistImportedDeploymentRequestPreparedStackProfile = {
   /**
-   * Whether cross-account registry access has been successfully granted.
-   *
-   * @remarks
-   * Set to true after the manager successfully sets the ECR/GAR repo policy
-   * for this deployment's target account. Prevents redundant API calls on
-   * every reconcile tick.
+   * Human-readable description of what this permission set allows
    */
-  registryAccessGranted?: boolean | undefined;
+  description: string;
   /**
-   * What a direct setup created for resources it does not own, keyed by resource id. Setup
+   * Unique identifier for the permission set (e.g., "storage/data-read")
+   */
+  id: string;
+  /**
+   * Platform-specific permission configurations
+   */
+  platforms: PersistImportedDeploymentRequestPreparedStackProfilePlatforms;
+};
+
+/**
+ * Reference to a permission set - either by name or inline definition
+ */
+export type PersistImportedDeploymentRequestPreparedStackProfileUnion =
+  | PersistImportedDeploymentRequestPreparedStackProfile
+  | string;
+
+/**
+ * Combined permissions configuration that contains both profiles and management
+ */
+export type PersistImportedDeploymentRequestPreparedStackPermissions = {
+  /**
+   * Management permissions configuration for stack management access
+   */
+  management?:
+    | PersistImportedDeploymentRequestPreparedStackManagement1
+    | PersistImportedDeploymentRequestPreparedStackManagement2
+    | PersistImportedDeploymentRequestPreparedStackManagementEnum
+    | undefined;
+  /**
+   * Permission profiles that define access control for compute services
    *
    * @remarks
-   * teardown removes exactly what is recorded here.
+   * Key is the profile name, value is the permission configuration
    */
-  setupScaffolding?: {
-    [k: string]: PersistImportedDeploymentRequestSetupScaffolding;
-  } | undefined;
-  setupUpdateAuthorization?:
-    | PersistImportedDeploymentRequestSetupUpdateAuthorization
-    | string
-    | null
-    | undefined;
+  profiles: {
+    [k: string]: {
+      [k: string]: Array<
+        PersistImportedDeploymentRequestPreparedStackProfile | string
+      >;
+    };
+  };
+};
+
+/**
+ * Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties.
+ */
+export type PersistImportedDeploymentRequestPreparedStackConfig = {
+  /**
+   * The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+   */
+  id: string;
+  /**
+   * Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.
+   */
+  type: string;
+  additionalProperties?: { [k: string]: any | null } | undefined;
+};
+
+/**
+ * Reference to a resource by its stable id and resource type.
+ */
+export type PersistImportedDeploymentRequestPreparedStackDependency = {
+  id: string;
+  /**
+   * Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.
+   */
+  type: string;
+};
+
+/**
+ * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+ */
+export const PersistImportedDeploymentRequestPreparedStackLifecycle = {
+  Frozen: "frozen",
+  Live: "live",
+} as const;
+/**
+ * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+ */
+export type PersistImportedDeploymentRequestPreparedStackLifecycle = ClosedEnum<
+  typeof PersistImportedDeploymentRequestPreparedStackLifecycle
+>;
+
+export type PersistImportedDeploymentRequestPreparedStackResources = {
+  /**
+   * Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties.
+   */
+  config: PersistImportedDeploymentRequestPreparedStackConfig;
+  /**
+   * Additional dependencies for this resource beyond those defined in the resource itself.
+   *
+   * @remarks
+   * The total dependencies are: resource.get_dependencies() + this list
+   */
+  dependencies: Array<PersistImportedDeploymentRequestPreparedStackDependency>;
+  /**
+   * Id of the boolean stack input that decides whether this resource is
+   *
+   * @remarks
+   * created at all. `None` means always create it.
+   *
+   * Set by `.enabled(input)` in the SDK. Setup emitters render the resource
+   * conditionally on the matching template variable, so a deployer who says no
+   * never gets the resource, its outputs, or anything derived from it.
+   */
+  enabledWhen?: string | null | undefined;
+  /**
+   * Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.
+   */
+  lifecycle: PersistImportedDeploymentRequestPreparedStackLifecycle;
+  /**
+   * Enable remote bindings for this resource (BYOB use case).
+   *
+   * @remarks
+   * When true, binding params are synced to StackState's `remote_binding_params`.
+   * Default: false (prevents sensitive data in synced state).
+   */
+  remoteAccess?: boolean | undefined;
+};
+
+/**
+ * Represents the target cloud platform.
+ */
+export const PersistImportedDeploymentRequestPreparedStackSupportedPlatform = {
+  Aws: "aws",
+  Gcp: "gcp",
+  Azure: "azure",
+  Kubernetes: "kubernetes",
+  Machines: "machines",
+  Local: "local",
+  Test: "test",
+} as const;
+/**
+ * Represents the target cloud platform.
+ */
+export type PersistImportedDeploymentRequestPreparedStackSupportedPlatform =
+  ClosedEnum<
+    typeof PersistImportedDeploymentRequestPreparedStackSupportedPlatform
+  >;
+
+/**
+ * A bag of resources, unaware of any cloud.
+ */
+export type PersistImportedDeploymentRequestPreparedStack = {
+  /**
+   * Released Container resources whose image repositories are approved for
+   *
+   * @remarks
+   * containers created after installation.
+   */
+  dynamicContainerImageResources?: Array<string> | undefined;
+  /**
+   * Exact image repositories approved for containers created after installation.
+   *
+   * @remarks
+   * The runtime API also requires an immutable SHA-256 digest.
+   */
+  dynamicContainerRepositories?: Array<string> | undefined;
+  /**
+   * Unique identifier for the stack
+   */
+  id: string;
+  /**
+   * Input definitions required before setup or deployment can proceed.
+   */
+  inputs?:
+    | Array<PersistImportedDeploymentRequestPreparedStackInput>
+    | undefined;
+  operations?:
+    | PersistImportedDeploymentRequestPreparedStackOperationsUnion
+    | null
+    | undefined;
+  /**
+   * Combined permissions configuration that contains both profiles and management
+   */
+  permissions?:
+    | PersistImportedDeploymentRequestPreparedStackPermissions
+    | undefined;
+  /**
+   * Map of resource IDs to their configurations and lifecycle settings
+   */
+  resources: {
+    [k: string]: PersistImportedDeploymentRequestPreparedStackResources;
+  };
+  /**
+   * Which platforms this stack supports. When None, all platforms are supported.
+   */
+  supportedPlatforms?:
+    | Array<PersistImportedDeploymentRequestPreparedStackSupportedPlatform>
+    | null
+    | undefined;
+};
+
+export type PersistImportedDeploymentRequestPreparedStackUnion =
+  | PersistImportedDeploymentRequestPreparedStack
+  | string;
+
+/**
+ * The cross-account read a manager opened on Alien's registry for one deployment.
+ */
+export type PersistImportedDeploymentRequestRegistryAccess = {
+  /**
+   * Repository identifiers the grant names, sorted.
+   */
+  repositories?: Array<string> | undefined;
+  /**
+   * Compute services the grant admits, sorted. Each pulls as its own principal, so a service
+   *
+   * @remarks
+   * added later needs the policy rewritten.
+   */
+  serviceTypes?: Array<string> | undefined;
+};
+
+export type PersistImportedDeploymentRequestRegistryAccessUnion =
+  | PersistImportedDeploymentRequestRegistryAccess
+  | string;
+
+/**
+ * The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as
+ *
+ * @remarks
+ * soon as the object exists and cleared once it is deleted.
+ */
+export type PersistImportedDeploymentRequestEgress = {
+  /**
+   * `AWS::Lambda::NetworkConnector` the sessions start with.
+   */
+  connectorArn?: string | null | undefined;
+  /**
+   * Cloud Control request creating or deleting the connector that AWS has not finished. Kept
+   *
+   * @remarks
+   * so the request's outcome, and AWS's reason when it fails, is read on a later call.
+   */
+  connectorRequest?: string | null | undefined;
+  /**
+   * IAM role Lambda assumes to place the connector's network interfaces.
+   */
+  operatorRoleName: string;
+  /**
+   * Security group permitting egress to loopback only.
+   */
+  securityGroupId?: string | null | undefined;
+};
+
+export type PersistImportedDeploymentRequestEgressUnion =
+  | PersistImportedDeploymentRequestEgress
+  | string;
+
+export const PersistImportedDeploymentRequestTypeAwsSandbox = {
+  AwsSandbox: "awsSandbox",
+} as const;
+export type PersistImportedDeploymentRequestTypeAwsSandbox = ClosedEnum<
+  typeof PersistImportedDeploymentRequestTypeAwsSandbox
+>;
+
+/**
+ * Cloud objects a direct setup created so a runtime-owned resource can run.
+ */
+export type PersistImportedDeploymentRequestSetupScaffolding = {
+  /**
+   * IAM role the image build runs as.
+   */
+  buildRoleName: string;
+  egress?: PersistImportedDeploymentRequestEgress | string | null | undefined;
+  /**
+   * A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its
+   *
+   * @remarks
+   * runtime controller.
+   */
+  imageArn?: string | null | undefined;
+  type: PersistImportedDeploymentRequestTypeAwsSandbox;
+};
+
+/**
+ * One-shot authority for a setup re-import to replace setup-owned resources.
+ */
+export type PersistImportedDeploymentRequestSetupUpdateAuthorization = {
+  /**
+   * Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment.
+   */
+  baselineFrozenDigest: string;
+  /**
+   * Unique revision used by persistence layers for compare-and-swap updates.
+   */
+  nonce: string;
+  /**
+   * Release whose stack was prepared by setup.
+   */
+  releaseId: string;
+  /**
+   * Exact setup artifact revision that authored this authority.
+   */
+  setupFingerprint: string;
+  /**
+   * Setup fingerprint contract version.
+   */
+  setupFingerprintVersion: number;
+  /**
+   * Stable setup target recorded on the imported deployment.
+   */
+  setupTarget: string;
+  /**
+   * Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared.
+   */
+  targetFrozenDigest: string;
+};
+
+export type PersistImportedDeploymentRequestSetupUpdateAuthorizationUnion =
+  | PersistImportedDeploymentRequestSetupUpdateAuthorization
+  | string;
+
+/**
+ * Runtime metadata for deployment
+ *
+ * @remarks
+ *
+ * Stores deployment state that needs to persist across step calls.
+ */
+export type PersistImportedDeploymentRequestRuntimeMetadata = {
+  /**
+   * Whether each vault-native deployer secret is in the customer's secret
+   *
+   * @remarks
+   * store, with where it goes. Checked from metadata only; no value is ever
+   * read or recorded here.
+   */
+  deployerSecrets?:
+    | Array<PersistImportedDeploymentRequestDeployerSecret>
+    | undefined;
+  /**
+   * Last generated CLI package revision whose direct setup was applied.
+   *
+   * @remarks
+   * This lets a newer generated CLI refresh setup-owned infrastructure once
+   * before handing runtime changes back to the hosted manager.
+   */
+  directSetupRevision?: string | null | undefined;
+  /**
+   * Actor that owns structural work during the initial setup phase.
+   */
+  initialSetupAuthority?:
+    | PersistImportedDeploymentRequestInitialSetupAuthority
+    | undefined;
+  /**
+   * Hash of the environment variables snapshot that was last synced to the vault
+   *
+   * @remarks
+   * Used to avoid redundant sync operations during incremental deployment
+   */
+  lastSyncedEnvVarsHash?: string | null | undefined;
+  /**
+   * Exact vault keys owned by the deployment secret synchronizer. This
+   *
+   * @remarks
+   * inventory lets a later snapshot delete removed keys without listing or
+   * touching unrelated values in the same vault.
+   */
+  lastSyncedSecretNames?: Array<string> | undefined;
+  /**
+   * Release `pending_prepared_stack` was prepared from. The target can move
+   *
+   * @remarks
+   * to a newer release while that stack is still being applied; this tells
+   * the update which release actually converged.
+   */
+  pendingPreparedReleaseId?: string | null | undefined;
+  pendingPreparedStack?:
+    | PersistImportedDeploymentRequestPendingPreparedStackUnion
+    | null
+    | undefined;
+  /**
+   * Canonical resolved answers for inputs that gate Frozen resources,
+   *
+   * @remarks
+   * keyed by input id, recorded when the deployment is created or its
+   * setup import registers.
+   *
+   * A frozen gate's answer is fixed for the deployment's lifetime: the
+   * update path refuses input values that conflict with these, and a Live
+   * resource sharing such an input resolves the persisted answer forever.
+   */
+  persistedGateAnswers?: { [k: string]: boolean } | undefined;
+  preparedStack?:
+    | PersistImportedDeploymentRequestPreparedStack
+    | string
+    | null
+    | undefined;
+  registryAccess?:
+    | PersistImportedDeploymentRequestRegistryAccess
+    | string
+    | null
+    | undefined;
+  /**
+   * Whether cross-account registry access has been successfully granted.
+   *
+   * @remarks
+   * Set to true after the manager successfully sets the ECR/GAR repo policy
+   * for this deployment's target account. Prevents redundant API calls on
+   * every reconcile tick.
+   */
+  registryAccessGranted?: boolean | undefined;
+  /**
+   * What a direct setup created for resources it does not own, keyed by resource id. Setup
+   *
+   * @remarks
+   * teardown removes exactly what is recorded here.
+   */
+  setupScaffolding?: {
+    [k: string]: PersistImportedDeploymentRequestSetupScaffolding;
+  } | undefined;
+  setupUpdateAuthorization?:
+    | PersistImportedDeploymentRequestSetupUpdateAuthorization
+    | string
+    | null
+    | undefined;
+};
+
+/**
+ * Deployment status in the deployment lifecycle.
+ *
+ * @remarks
+ *
+ * For observe-only deployments with no release or stack state, `Running`
+ * means the Operator is attached. Connectivity comes from `lastHeartbeatAt`;
+ * resource health comes from inventory and resource heartbeat data.
+ */
+export const PersistImportedDeploymentRequestStatus = {
+  Pending: "pending",
+  PreflightsFailed: "preflights-failed",
+  InitialSetup: "initial-setup",
+  InitialSetupFailed: "initial-setup-failed",
+  Provisioning: "provisioning",
+  WaitingForMachines: "waiting-for-machines",
+  WaitingForSecrets: "waiting-for-secrets",
+  ProvisioningFailed: "provisioning-failed",
+  Running: "running",
+  RefreshFailed: "refresh-failed",
+  UpdatePending: "update-pending",
+  Updating: "updating",
+  UpdateFailed: "update-failed",
+  DeletePending: "delete-pending",
+  Deleting: "deleting",
+  DeleteFailed: "delete-failed",
+  TeardownRequired: "teardown-required",
+  TeardownFailed: "teardown-failed",
+  Deleted: "deleted",
+  Error: "error",
+} as const;
+/**
+ * Deployment status in the deployment lifecycle.
+ *
+ * @remarks
+ *
+ * For observe-only deployments with no release or stack state, `Running`
+ * means the Operator is attached. Connectivity comes from `lastHeartbeatAt`;
+ * resource health comes from inventory and resource heartbeat data.
+ */
+export type PersistImportedDeploymentRequestStatus = ClosedEnum<
+  typeof PersistImportedDeploymentRequestStatus
+>;
+
+export type PersistImportedDeploymentRequestManagementConfigKubernetes = {
+  platform: "kubernetes";
+};
+
+/**
+ * Azure management configuration extracted from stack settings
+ */
+export type PersistImportedDeploymentRequestManagementConfigAzure = {
+  /**
+   * The managing Azure Tenant ID for cross-tenant access
+   */
+  managingTenantId: string;
+  /**
+   * OIDC issuer URL trusted by the target-side managed identity.
+   */
+  oidcIssuer: string;
+  /**
+   * OIDC subject claim trusted by the target-side managed identity.
+   */
+  oidcSubject: string;
+  platform: "azure";
+};
+
+/**
+ * GCP management configuration extracted from stack settings
+ */
+export type PersistImportedDeploymentRequestManagementConfigGcp = {
+  /**
+   * Service account email for management roles
+   */
+  serviceAccountEmail: string;
+  platform: "gcp";
+};
+
+/**
+ * AWS management configuration extracted from stack settings
+ */
+export type PersistImportedDeploymentRequestManagementConfigAws = {
+  /**
+   * The managing AWS IAM role ARN that can assume cross-account roles
+   */
+  managingRoleArn: string;
+  platform: "aws";
+};
+
+/**
+ * Management configuration for different cloud platforms.
+ *
+ * @remarks
+ *
+ * Platform-derived configuration for cross-account/cross-tenant access.
+ * This is NOT user-specified - it's derived from the Manager's ServiceAccount.
+ */
+export type PersistImportedDeploymentRequestManagementConfigUnion =
+  | PersistImportedDeploymentRequestManagementConfigAws
+  | PersistImportedDeploymentRequestManagementConfigGcp
+  | PersistImportedDeploymentRequestManagementConfigAzure
+  | PersistImportedDeploymentRequestManagementConfigKubernetes;
+
+export type PersistImportedDeploymentRequest = {
+  mode: ModePersist;
+  /**
+   * Deployment name. Must be unique within the deployment group.
+   */
+  name: string;
+  /**
+   * Unique identifier for the deployment group.
+   */
+  deploymentGroupId: string;
+  managerId: string;
+  /**
+   * Optional deployment subdomain under the project's generated-domain parent. Operator-only and requires a custom project domain; customer deploy-link tokens and the shared system domain are rejected. Omit to generate a random subdomain.
+   */
+  publicSubdomain?: string | undefined;
+  /**
+   * Represents the target cloud platform.
+   */
+  platform: PersistImportedDeploymentRequestPlatformEnum;
+  /**
+   * Base cloud platform for cloud-backed Kubernetes imports.
+   */
+  basePlatform?: KubernetesBasePlatform | undefined;
+  /**
+   * User-customizable deployment settings specified at deploy time.
+   *
+   * @remarks
+   *
+   * These settings are provided by the customer via CloudFormation parameters,
+   * Terraform attributes, CLI flags, or Helm values. They customize how the
+   * deployment runs and what capabilities are enabled.
+   *
+   * **Key distinction**: StackSettings is user-customizable, while ManagementConfig
+   * is platform-derived (from the Manager's ServiceAccount).
+   */
+  stackSettings: PersistImportedDeploymentRequestStackSettings;
+  stackState?: any | null | undefined;
+  /**
+   * Platform-specific environment information
+   */
+  environmentInfo?:
+    | PersistImportedDeploymentRequestEnvironmentInfoUnion
+    | null
+    | undefined;
+  /**
+   * Runtime metadata for deployment
+   *
+   * @remarks
+   *
+   * Stores deployment state that needs to persist across step calls.
+   */
+  runtimeMetadata: PersistImportedDeploymentRequestRuntimeMetadata;
+  scheduleReconciliation?: boolean | undefined;
+  /**
+   * DeploymentState protocol version owned by the runtime/manager
+   */
+  deploymentProtocolVersion: number;
+  /**
+   * Deployment status in the deployment lifecycle.
+   *
+   * @remarks
+   *
+   * For observe-only deployments with no release or stack state, `Running`
+   * means the Operator is attached. Connectivity comes from `lastHeartbeatAt`;
+   * resource health comes from inventory and resource heartbeat data.
+   */
+  status?: PersistImportedDeploymentRequestStatus | undefined;
+  /**
+   * Unique identifier for the release.
+   */
+  currentReleaseId?: string | undefined;
+  /**
+   * Unique identifier for the release.
+   */
+  desiredReleaseId?: string | undefined;
+  importSource?: ImportSourceKind | undefined;
+  setupMetadata?: { [k: string]: any | null } | undefined;
+  /**
+   * Stable target key for the setup contract, e.g. aws/us-east-1
+   */
+  setupTarget: string;
+  /**
+   * Deterministic setup contract fingerprint for one setup target
+   */
+  setupFingerprint: string;
+  /**
+   * Setup fingerprint algorithm version
+   */
+  setupFingerprintVersion: number;
+  deploymentToken?: string | undefined;
+  /**
+   * Management configuration for different cloud platforms.
+   *
+   * @remarks
+   *
+   * Platform-derived configuration for cross-account/cross-tenant access.
+   * This is NOT user-specified - it's derived from the Manager's ServiceAccount.
+   */
+  managementConfig?:
+    | PersistImportedDeploymentRequestManagementConfigAws
+    | PersistImportedDeploymentRequestManagementConfigGcp
+    | PersistImportedDeploymentRequestManagementConfigAzure
+    | PersistImportedDeploymentRequestManagementConfigKubernetes
+    | undefined;
+  inputValues?: { [k: string]: StackInputValueRequest } | undefined;
+};
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackOverrideStackConditionUnion$Outbound =
+  | PersistImportedDeploymentRequestPreparedStackOverrideConditionStack$Outbound
+  | string;
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackOverrideStackConditionUnion$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackOverrideStackConditionUnion$Outbound,
+    PersistImportedDeploymentRequestPreparedStackOverrideStackConditionUnion
+  > = z.union([
+    PersistImportedDeploymentRequestPreparedStackOverrideConditionStack$outboundSchema,
+    z.string(),
+  ]);
+
+export function persistImportedDeploymentRequestPreparedStackOverrideStackConditionUnionToJSON(
+  persistImportedDeploymentRequestPreparedStackOverrideStackConditionUnion:
+    PersistImportedDeploymentRequestPreparedStackOverrideStackConditionUnion,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackOverrideStackConditionUnion$outboundSchema
+      .parse(
+        persistImportedDeploymentRequestPreparedStackOverrideStackConditionUnion,
+      ),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackOverrideGcpStack$Outbound =
+  {
+    condition?:
+      | PersistImportedDeploymentRequestPreparedStackOverrideConditionStack$Outbound
+      | string
+      | null
+      | undefined;
+    scope: string;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackOverrideGcpStack$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackOverrideGcpStack$Outbound,
+    PersistImportedDeploymentRequestPreparedStackOverrideGcpStack
+  > = z.object({
+    condition: z.nullable(
+      z.union([
+        PersistImportedDeploymentRequestPreparedStackOverrideConditionStack$outboundSchema,
+        z.string(),
+      ]),
+    ).optional(),
+    scope: z.string(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackOverrideGcpStackToJSON(
+  persistImportedDeploymentRequestPreparedStackOverrideGcpStack:
+    PersistImportedDeploymentRequestPreparedStackOverrideGcpStack,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackOverrideGcpStack$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackOverrideGcpStack),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackOverrideGcpBinding$Outbound =
+  {
+    resource?:
+      | PersistImportedDeploymentRequestPreparedStackOverrideGcpResource$Outbound
+      | undefined;
+    stack?:
+      | PersistImportedDeploymentRequestPreparedStackOverrideGcpStack$Outbound
+      | undefined;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackOverrideGcpBinding$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackOverrideGcpBinding$Outbound,
+    PersistImportedDeploymentRequestPreparedStackOverrideGcpBinding
+  > = z.object({
+    resource:
+      PersistImportedDeploymentRequestPreparedStackOverrideGcpResource$outboundSchema
+        .optional(),
+    stack: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackOverrideGcpStack$outboundSchema
+    ).optional(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackOverrideGcpBindingToJSON(
+  persistImportedDeploymentRequestPreparedStackOverrideGcpBinding:
+    PersistImportedDeploymentRequestPreparedStackOverrideGcpBinding,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackOverrideGcpBinding$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackOverrideGcpBinding),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackOverrideGcpGrant$Outbound =
+  {
+    actions?: Array<string> | null | undefined;
+    dataActions?: Array<string> | null | undefined;
+    permissions?: Array<string> | null | undefined;
+    predefinedRoles?: Array<string> | null | undefined;
+    residualPermissions?: Array<string> | null | undefined;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackOverrideGcpGrant$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackOverrideGcpGrant$Outbound,
+    PersistImportedDeploymentRequestPreparedStackOverrideGcpGrant
+  > = z.object({
+    actions: z.nullable(z.array(z.string())).optional(),
+    dataActions: z.nullable(z.array(z.string())).optional(),
+    permissions: z.nullable(z.array(z.string())).optional(),
+    predefinedRoles: z.nullable(z.array(z.string())).optional(),
+    residualPermissions: z.nullable(z.array(z.string())).optional(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackOverrideGcpGrantToJSON(
+  persistImportedDeploymentRequestPreparedStackOverrideGcpGrant:
+    PersistImportedDeploymentRequestPreparedStackOverrideGcpGrant,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackOverrideGcpGrant$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackOverrideGcpGrant),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackOverrideGcp$Outbound =
+  {
+    binding:
+      PersistImportedDeploymentRequestPreparedStackOverrideGcpBinding$Outbound;
+    description?: string | null | undefined;
+    grant:
+      PersistImportedDeploymentRequestPreparedStackOverrideGcpGrant$Outbound;
+    label?: string | null | undefined;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackOverrideGcp$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackOverrideGcp$Outbound,
+    PersistImportedDeploymentRequestPreparedStackOverrideGcp
+  > = z.object({
+    binding: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackOverrideGcpBinding$outboundSchema
+    ),
+    description: z.nullable(z.string()).optional(),
+    grant: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackOverrideGcpGrant$outboundSchema
+    ),
+    label: z.nullable(z.string()).optional(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackOverrideGcpToJSON(
+  persistImportedDeploymentRequestPreparedStackOverrideGcp:
+    PersistImportedDeploymentRequestPreparedStackOverrideGcp,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackOverrideGcp$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackOverrideGcp),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackOverridePlatforms$Outbound =
+  {
+    aws?:
+      | Array<PersistImportedDeploymentRequestPreparedStackOverrideAw$Outbound>
+      | null
+      | undefined;
+    azure?:
+      | Array<
+        PersistImportedDeploymentRequestPreparedStackOverrideAzure$Outbound
+      >
+      | null
+      | undefined;
+    gcp?:
+      | Array<PersistImportedDeploymentRequestPreparedStackOverrideGcp$Outbound>
+      | null
+      | undefined;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackOverridePlatforms$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackOverridePlatforms$Outbound,
+    PersistImportedDeploymentRequestPreparedStackOverridePlatforms
+  > = z.object({
+    aws: z.nullable(
+      z.array(
+        PersistImportedDeploymentRequestPreparedStackOverrideAw$outboundSchema,
+      ),
+    ).optional(),
+    azure: z.nullable(
+      z.array(
+        PersistImportedDeploymentRequestPreparedStackOverrideAzure$outboundSchema,
+      ),
+    ).optional(),
+    gcp: z.nullable(
+      z.array(z.lazy(() =>
+        PersistImportedDeploymentRequestPreparedStackOverrideGcp$outboundSchema
+      )),
+    ).optional(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackOverridePlatformsToJSON(
+  persistImportedDeploymentRequestPreparedStackOverridePlatforms:
+    PersistImportedDeploymentRequestPreparedStackOverridePlatforms,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackOverridePlatforms$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackOverridePlatforms),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackOverride$Outbound = {
+  description: string;
+  id: string;
+  platforms:
+    PersistImportedDeploymentRequestPreparedStackOverridePlatforms$Outbound;
+};
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackOverride$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackOverride$Outbound,
+    PersistImportedDeploymentRequestPreparedStackOverride
+  > = z.object({
+    description: z.string(),
+    id: z.string(),
+    platforms: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackOverridePlatforms$outboundSchema
+    ),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackOverrideToJSON(
+  persistImportedDeploymentRequestPreparedStackOverride:
+    PersistImportedDeploymentRequestPreparedStackOverride,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackOverride$outboundSchema.parse(
+      persistImportedDeploymentRequestPreparedStackOverride,
+    ),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackOverrideUnion$Outbound =
+  | PersistImportedDeploymentRequestPreparedStackOverride$Outbound
+  | string;
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackOverrideUnion$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackOverrideUnion$Outbound,
+    PersistImportedDeploymentRequestPreparedStackOverrideUnion
+  > = z.union([
+    z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackOverride$outboundSchema
+    ),
+    z.string(),
+  ]);
+
+export function persistImportedDeploymentRequestPreparedStackOverrideUnionToJSON(
+  persistImportedDeploymentRequestPreparedStackOverrideUnion:
+    PersistImportedDeploymentRequestPreparedStackOverrideUnion,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackOverrideUnion$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackOverrideUnion),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackManagement2$Outbound =
+  {
+    override: {
+      [k: string]: Array<
+        PersistImportedDeploymentRequestPreparedStackOverride$Outbound | string
+      >;
+    };
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackManagement2$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackManagement2$Outbound,
+    PersistImportedDeploymentRequestPreparedStackManagement2
+  > = z.object({
+    override: z.record(
+      z.string(),
+      z.array(z.union([
+        z.lazy(() =>
+          PersistImportedDeploymentRequestPreparedStackOverride$outboundSchema
+        ),
+        z.string(),
+      ])),
+    ),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackManagement2ToJSON(
+  persistImportedDeploymentRequestPreparedStackManagement2:
+    PersistImportedDeploymentRequestPreparedStackManagement2,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackManagement2$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackManagement2),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendAwResource$Outbound =
+  {
+    condition?: { [k: string]: { [k: string]: string } } | null | undefined;
+    notResources?: Array<string> | undefined;
+    resources: Array<string>;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendAwResource$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendAwResource$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendAwResource
+  > = z.object({
+    condition: z.nullable(
+      z.record(z.string(), z.record(z.string(), z.string())),
+    ).optional(),
+    notResources: z.array(z.string()).optional(),
+    resources: z.array(z.string()),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendAwResourceToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendAwResource:
+    PersistImportedDeploymentRequestPreparedStackExtendAwResource,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendAwResource$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackExtendAwResource),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendAwStack$Outbound =
+  {
+    condition?: { [k: string]: { [k: string]: string } } | null | undefined;
+    notResources?: Array<string> | undefined;
+    resources: Array<string>;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendAwStack$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendAwStack$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendAwStack
+  > = z.object({
+    condition: z.nullable(
+      z.record(z.string(), z.record(z.string(), z.string())),
+    ).optional(),
+    notResources: z.array(z.string()).optional(),
+    resources: z.array(z.string()),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendAwStackToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendAwStack:
+    PersistImportedDeploymentRequestPreparedStackExtendAwStack,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendAwStack$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackExtendAwStack),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendAwBinding$Outbound =
+  {
+    resource?:
+      | PersistImportedDeploymentRequestPreparedStackExtendAwResource$Outbound
+      | undefined;
+    stack?:
+      | PersistImportedDeploymentRequestPreparedStackExtendAwStack$Outbound
+      | undefined;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendAwBinding$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendAwBinding$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendAwBinding
+  > = z.object({
+    resource: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackExtendAwResource$outboundSchema
+    ).optional(),
+    stack: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackExtendAwStack$outboundSchema
+    ).optional(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendAwBindingToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendAwBinding:
+    PersistImportedDeploymentRequestPreparedStackExtendAwBinding,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendAwBinding$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackExtendAwBinding),
+  );
+}
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendEffect$outboundSchema:
+  z.ZodEnum<typeof PersistImportedDeploymentRequestPreparedStackExtendEffect> =
+    z.enum(PersistImportedDeploymentRequestPreparedStackExtendEffect);
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendAwGrant$Outbound =
+  {
+    actions?: Array<string> | null | undefined;
+    dataActions?: Array<string> | null | undefined;
+    permissions?: Array<string> | null | undefined;
+    predefinedRoles?: Array<string> | null | undefined;
+    residualPermissions?: Array<string> | null | undefined;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendAwGrant$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendAwGrant$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendAwGrant
+  > = z.object({
+    actions: z.nullable(z.array(z.string())).optional(),
+    dataActions: z.nullable(z.array(z.string())).optional(),
+    permissions: z.nullable(z.array(z.string())).optional(),
+    predefinedRoles: z.nullable(z.array(z.string())).optional(),
+    residualPermissions: z.nullable(z.array(z.string())).optional(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendAwGrantToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendAwGrant:
+    PersistImportedDeploymentRequestPreparedStackExtendAwGrant,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendAwGrant$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackExtendAwGrant),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendAw$Outbound = {
+  binding:
+    PersistImportedDeploymentRequestPreparedStackExtendAwBinding$Outbound;
+  description?: string | null | undefined;
+  effect?: string | undefined;
+  grant: PersistImportedDeploymentRequestPreparedStackExtendAwGrant$Outbound;
+  label?: string | null | undefined;
+};
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendAw$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendAw$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendAw
+  > = z.object({
+    binding: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackExtendAwBinding$outboundSchema
+    ),
+    description: z.nullable(z.string()).optional(),
+    effect:
+      PersistImportedDeploymentRequestPreparedStackExtendEffect$outboundSchema
+        .optional(),
+    grant: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackExtendAwGrant$outboundSchema
+    ),
+    label: z.nullable(z.string()).optional(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendAwToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendAw:
+    PersistImportedDeploymentRequestPreparedStackExtendAw,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendAw$outboundSchema.parse(
+      persistImportedDeploymentRequestPreparedStackExtendAw,
+    ),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendAzureResource$Outbound =
+  {
+    scope: string;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendAzureResource$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendAzureResource$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendAzureResource
+  > = z.object({
+    scope: z.string(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendAzureResourceToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendAzureResource:
+    PersistImportedDeploymentRequestPreparedStackExtendAzureResource,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendAzureResource$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackExtendAzureResource),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendAzureStack$Outbound =
+  {
+    scope: string;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendAzureStack$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendAzureStack$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendAzureStack
+  > = z.object({
+    scope: z.string(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendAzureStackToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendAzureStack:
+    PersistImportedDeploymentRequestPreparedStackExtendAzureStack,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendAzureStack$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackExtendAzureStack),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendAzureBinding$Outbound =
+  {
+    resource?:
+      | PersistImportedDeploymentRequestPreparedStackExtendAzureResource$Outbound
+      | undefined;
+    stack?:
+      | PersistImportedDeploymentRequestPreparedStackExtendAzureStack$Outbound
+      | undefined;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendAzureBinding$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendAzureBinding$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendAzureBinding
+  > = z.object({
+    resource: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackExtendAzureResource$outboundSchema
+    ).optional(),
+    stack: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackExtendAzureStack$outboundSchema
+    ).optional(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendAzureBindingToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendAzureBinding:
+    PersistImportedDeploymentRequestPreparedStackExtendAzureBinding,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendAzureBinding$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackExtendAzureBinding),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendAzureGrant$Outbound =
+  {
+    actions?: Array<string> | null | undefined;
+    dataActions?: Array<string> | null | undefined;
+    permissions?: Array<string> | null | undefined;
+    predefinedRoles?: Array<string> | null | undefined;
+    residualPermissions?: Array<string> | null | undefined;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendAzureGrant$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendAzureGrant$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendAzureGrant
+  > = z.object({
+    actions: z.nullable(z.array(z.string())).optional(),
+    dataActions: z.nullable(z.array(z.string())).optional(),
+    permissions: z.nullable(z.array(z.string())).optional(),
+    predefinedRoles: z.nullable(z.array(z.string())).optional(),
+    residualPermissions: z.nullable(z.array(z.string())).optional(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendAzureGrantToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendAzureGrant:
+    PersistImportedDeploymentRequestPreparedStackExtendAzureGrant,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendAzureGrant$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackExtendAzureGrant),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendAzure$Outbound =
+  {
+    binding:
+      PersistImportedDeploymentRequestPreparedStackExtendAzureBinding$Outbound;
+    description?: string | null | undefined;
+    grant:
+      PersistImportedDeploymentRequestPreparedStackExtendAzureGrant$Outbound;
+    label?: string | null | undefined;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendAzure$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendAzure$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendAzure
+  > = z.object({
+    binding: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackExtendAzureBinding$outboundSchema
+    ),
+    description: z.nullable(z.string()).optional(),
+    grant: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackExtendAzureGrant$outboundSchema
+    ),
+    label: z.nullable(z.string()).optional(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendAzureToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendAzure:
+    PersistImportedDeploymentRequestPreparedStackExtendAzure,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendAzure$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackExtendAzure),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendConditionResource$Outbound =
+  {
+    expression: string;
+    title: string;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendConditionResource$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendConditionResource$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendConditionResource
+  > = z.object({
+    expression: z.string(),
+    title: z.string(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendConditionResourceToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendConditionResource:
+    PersistImportedDeploymentRequestPreparedStackExtendConditionResource,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendConditionResource$outboundSchema
+      .parse(
+        persistImportedDeploymentRequestPreparedStackExtendConditionResource,
+      ),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendResourceConditionUnion$Outbound =
+  | PersistImportedDeploymentRequestPreparedStackExtendConditionResource$Outbound
+  | string;
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendResourceConditionUnion$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendResourceConditionUnion$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendResourceConditionUnion
+  > = z.union([
+    z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackExtendConditionResource$outboundSchema
+    ),
+    z.string(),
+  ]);
+
+export function persistImportedDeploymentRequestPreparedStackExtendResourceConditionUnionToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendResourceConditionUnion:
+    PersistImportedDeploymentRequestPreparedStackExtendResourceConditionUnion,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendResourceConditionUnion$outboundSchema
+      .parse(
+        persistImportedDeploymentRequestPreparedStackExtendResourceConditionUnion,
+      ),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendGcpResource$Outbound =
+  {
+    condition?:
+      | PersistImportedDeploymentRequestPreparedStackExtendConditionResource$Outbound
+      | string
+      | null
+      | undefined;
+    scope: string;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendGcpResource$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendGcpResource$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendGcpResource
+  > = z.object({
+    condition: z.nullable(
+      z.union([
+        z.lazy(() =>
+          PersistImportedDeploymentRequestPreparedStackExtendConditionResource$outboundSchema
+        ),
+        z.string(),
+      ]),
+    ).optional(),
+    scope: z.string(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendGcpResourceToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendGcpResource:
+    PersistImportedDeploymentRequestPreparedStackExtendGcpResource,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendGcpResource$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackExtendGcpResource),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendConditionStack$Outbound =
+  {
+    expression: string;
+    title: string;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendConditionStack$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendConditionStack$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendConditionStack
+  > = z.object({
+    expression: z.string(),
+    title: z.string(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendConditionStackToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendConditionStack:
+    PersistImportedDeploymentRequestPreparedStackExtendConditionStack,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendConditionStack$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackExtendConditionStack),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendStackConditionUnion$Outbound =
+  | PersistImportedDeploymentRequestPreparedStackExtendConditionStack$Outbound
+  | string;
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendStackConditionUnion$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendStackConditionUnion$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendStackConditionUnion
+  > = z.union([
+    z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackExtendConditionStack$outboundSchema
+    ),
+    z.string(),
+  ]);
+
+export function persistImportedDeploymentRequestPreparedStackExtendStackConditionUnionToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendStackConditionUnion:
+    PersistImportedDeploymentRequestPreparedStackExtendStackConditionUnion,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendStackConditionUnion$outboundSchema
+      .parse(
+        persistImportedDeploymentRequestPreparedStackExtendStackConditionUnion,
+      ),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendGcpStack$Outbound =
+  {
+    condition?:
+      | PersistImportedDeploymentRequestPreparedStackExtendConditionStack$Outbound
+      | string
+      | null
+      | undefined;
+    scope: string;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendGcpStack$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendGcpStack$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendGcpStack
+  > = z.object({
+    condition: z.nullable(
+      z.union([
+        z.lazy(() =>
+          PersistImportedDeploymentRequestPreparedStackExtendConditionStack$outboundSchema
+        ),
+        z.string(),
+      ]),
+    ).optional(),
+    scope: z.string(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendGcpStackToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendGcpStack:
+    PersistImportedDeploymentRequestPreparedStackExtendGcpStack,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendGcpStack$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackExtendGcpStack),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendGcpBinding$Outbound =
+  {
+    resource?:
+      | PersistImportedDeploymentRequestPreparedStackExtendGcpResource$Outbound
+      | undefined;
+    stack?:
+      | PersistImportedDeploymentRequestPreparedStackExtendGcpStack$Outbound
+      | undefined;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendGcpBinding$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendGcpBinding$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendGcpBinding
+  > = z.object({
+    resource: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackExtendGcpResource$outboundSchema
+    ).optional(),
+    stack: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackExtendGcpStack$outboundSchema
+    ).optional(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendGcpBindingToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendGcpBinding:
+    PersistImportedDeploymentRequestPreparedStackExtendGcpBinding,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendGcpBinding$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackExtendGcpBinding),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendGcpGrant$Outbound =
+  {
+    actions?: Array<string> | null | undefined;
+    dataActions?: Array<string> | null | undefined;
+    permissions?: Array<string> | null | undefined;
+    predefinedRoles?: Array<string> | null | undefined;
+    residualPermissions?: Array<string> | null | undefined;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendGcpGrant$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendGcpGrant$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendGcpGrant
+  > = z.object({
+    actions: z.nullable(z.array(z.string())).optional(),
+    dataActions: z.nullable(z.array(z.string())).optional(),
+    permissions: z.nullable(z.array(z.string())).optional(),
+    predefinedRoles: z.nullable(z.array(z.string())).optional(),
+    residualPermissions: z.nullable(z.array(z.string())).optional(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendGcpGrantToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendGcpGrant:
+    PersistImportedDeploymentRequestPreparedStackExtendGcpGrant,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendGcpGrant$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackExtendGcpGrant),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendGcp$Outbound = {
+  binding:
+    PersistImportedDeploymentRequestPreparedStackExtendGcpBinding$Outbound;
+  description?: string | null | undefined;
+  grant: PersistImportedDeploymentRequestPreparedStackExtendGcpGrant$Outbound;
+  label?: string | null | undefined;
+};
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendGcp$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendGcp$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendGcp
+  > = z.object({
+    binding: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackExtendGcpBinding$outboundSchema
+    ),
+    description: z.nullable(z.string()).optional(),
+    grant: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackExtendGcpGrant$outboundSchema
+    ),
+    label: z.nullable(z.string()).optional(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendGcpToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendGcp:
+    PersistImportedDeploymentRequestPreparedStackExtendGcp,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendGcp$outboundSchema.parse(
+      persistImportedDeploymentRequestPreparedStackExtendGcp,
+    ),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendPlatforms$Outbound =
+  {
+    aws?:
+      | Array<PersistImportedDeploymentRequestPreparedStackExtendAw$Outbound>
+      | null
+      | undefined;
+    azure?:
+      | Array<PersistImportedDeploymentRequestPreparedStackExtendAzure$Outbound>
+      | null
+      | undefined;
+    gcp?:
+      | Array<PersistImportedDeploymentRequestPreparedStackExtendGcp$Outbound>
+      | null
+      | undefined;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendPlatforms$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendPlatforms$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendPlatforms
+  > = z.object({
+    aws: z.nullable(
+      z.array(z.lazy(() =>
+        PersistImportedDeploymentRequestPreparedStackExtendAw$outboundSchema
+      )),
+    ).optional(),
+    azure: z.nullable(
+      z.array(z.lazy(() =>
+        PersistImportedDeploymentRequestPreparedStackExtendAzure$outboundSchema
+      )),
+    ).optional(),
+    gcp: z.nullable(
+      z.array(z.lazy(() =>
+        PersistImportedDeploymentRequestPreparedStackExtendGcp$outboundSchema
+      )),
+    ).optional(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendPlatformsToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendPlatforms:
+    PersistImportedDeploymentRequestPreparedStackExtendPlatforms,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendPlatforms$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackExtendPlatforms),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtend$Outbound = {
+  description: string;
+  id: string;
+  platforms:
+    PersistImportedDeploymentRequestPreparedStackExtendPlatforms$Outbound;
 };
 
-/**
- * Deployment status in the deployment lifecycle.
- *
- * @remarks
- *
- * For observe-only deployments with no release or stack state, `Running`
- * means the Operator is attached. Connectivity comes from `lastHeartbeatAt`;
- * resource health comes from inventory and resource heartbeat data.
- */
-export const PersistImportedDeploymentRequestStatus = {
-  Pending: "pending",
-  PreflightsFailed: "preflights-failed",
-  InitialSetup: "initial-setup",
-  InitialSetupFailed: "initial-setup-failed",
-  Provisioning: "provisioning",
-  WaitingForMachines: "waiting-for-machines",
-  WaitingForSecrets: "waiting-for-secrets",
-  ProvisioningFailed: "provisioning-failed",
-  Running: "running",
-  RefreshFailed: "refresh-failed",
-  UpdatePending: "update-pending",
-  Updating: "updating",
-  UpdateFailed: "update-failed",
-  DeletePending: "delete-pending",
-  Deleting: "deleting",
-  DeleteFailed: "delete-failed",
-  TeardownRequired: "teardown-required",
-  TeardownFailed: "teardown-failed",
-  Deleted: "deleted",
-  Error: "error",
-} as const;
-/**
- * Deployment status in the deployment lifecycle.
- *
- * @remarks
- *
- * For observe-only deployments with no release or stack state, `Running`
- * means the Operator is attached. Connectivity comes from `lastHeartbeatAt`;
- * resource health comes from inventory and resource heartbeat data.
- */
-export type PersistImportedDeploymentRequestStatus = ClosedEnum<
-  typeof PersistImportedDeploymentRequestStatus
->;
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtend$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtend$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtend
+  > = z.object({
+    description: z.string(),
+    id: z.string(),
+    platforms: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackExtendPlatforms$outboundSchema
+    ),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackExtendToJSON(
+  persistImportedDeploymentRequestPreparedStackExtend:
+    PersistImportedDeploymentRequestPreparedStackExtend,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtend$outboundSchema.parse(
+      persistImportedDeploymentRequestPreparedStackExtend,
+    ),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackExtendUnion$Outbound =
+  | PersistImportedDeploymentRequestPreparedStackExtend$Outbound
+  | string;
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackExtendUnion$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackExtendUnion$Outbound,
+    PersistImportedDeploymentRequestPreparedStackExtendUnion
+  > = z.union([
+    z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackExtend$outboundSchema
+    ),
+    z.string(),
+  ]);
+
+export function persistImportedDeploymentRequestPreparedStackExtendUnionToJSON(
+  persistImportedDeploymentRequestPreparedStackExtendUnion:
+    PersistImportedDeploymentRequestPreparedStackExtendUnion,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackExtendUnion$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackExtendUnion),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackManagement1$Outbound =
+  {
+    extend: {
+      [k: string]: Array<
+        PersistImportedDeploymentRequestPreparedStackExtend$Outbound | string
+      >;
+    };
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackManagement1$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackManagement1$Outbound,
+    PersistImportedDeploymentRequestPreparedStackManagement1
+  > = z.object({
+    extend: z.record(
+      z.string(),
+      z.array(z.union([
+        z.lazy(() =>
+          PersistImportedDeploymentRequestPreparedStackExtend$outboundSchema
+        ),
+        z.string(),
+      ])),
+    ),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackManagement1ToJSON(
+  persistImportedDeploymentRequestPreparedStackManagement1:
+    PersistImportedDeploymentRequestPreparedStackManagement1,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackManagement1$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackManagement1),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackManagementUnion$Outbound =
+  | PersistImportedDeploymentRequestPreparedStackManagement1$Outbound
+  | PersistImportedDeploymentRequestPreparedStackManagement2$Outbound
+  | string;
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackManagementUnion$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackManagementUnion$Outbound,
+    PersistImportedDeploymentRequestPreparedStackManagementUnion
+  > = z.union([
+    z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackManagement1$outboundSchema
+    ),
+    z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackManagement2$outboundSchema
+    ),
+    PersistImportedDeploymentRequestPreparedStackManagementEnum$outboundSchema,
+  ]);
+
+export function persistImportedDeploymentRequestPreparedStackManagementUnionToJSON(
+  persistImportedDeploymentRequestPreparedStackManagementUnion:
+    PersistImportedDeploymentRequestPreparedStackManagementUnion,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackManagementUnion$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackManagementUnion),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackProfileAwResource$Outbound =
+  {
+    condition?: { [k: string]: { [k: string]: string } } | null | undefined;
+    notResources?: Array<string> | undefined;
+    resources: Array<string>;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackProfileAwResource$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackProfileAwResource$Outbound,
+    PersistImportedDeploymentRequestPreparedStackProfileAwResource
+  > = z.object({
+    condition: z.nullable(
+      z.record(z.string(), z.record(z.string(), z.string())),
+    ).optional(),
+    notResources: z.array(z.string()).optional(),
+    resources: z.array(z.string()),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackProfileAwResourceToJSON(
+  persistImportedDeploymentRequestPreparedStackProfileAwResource:
+    PersistImportedDeploymentRequestPreparedStackProfileAwResource,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackProfileAwResource$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackProfileAwResource),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackProfileAwStack$Outbound =
+  {
+    condition?: { [k: string]: { [k: string]: string } } | null | undefined;
+    notResources?: Array<string> | undefined;
+    resources: Array<string>;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackProfileAwStack$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackProfileAwStack$Outbound,
+    PersistImportedDeploymentRequestPreparedStackProfileAwStack
+  > = z.object({
+    condition: z.nullable(
+      z.record(z.string(), z.record(z.string(), z.string())),
+    ).optional(),
+    notResources: z.array(z.string()).optional(),
+    resources: z.array(z.string()),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackProfileAwStackToJSON(
+  persistImportedDeploymentRequestPreparedStackProfileAwStack:
+    PersistImportedDeploymentRequestPreparedStackProfileAwStack,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackProfileAwStack$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackProfileAwStack),
+  );
+}
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackProfileAwBinding$Outbound =
+  {
+    resource?:
+      | PersistImportedDeploymentRequestPreparedStackProfileAwResource$Outbound
+      | undefined;
+    stack?:
+      | PersistImportedDeploymentRequestPreparedStackProfileAwStack$Outbound
+      | undefined;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackProfileAwBinding$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackProfileAwBinding$Outbound,
+    PersistImportedDeploymentRequestPreparedStackProfileAwBinding
+  > = z.object({
+    resource: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackProfileAwResource$outboundSchema
+    ).optional(),
+    stack: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackProfileAwStack$outboundSchema
+    ).optional(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackProfileAwBindingToJSON(
+  persistImportedDeploymentRequestPreparedStackProfileAwBinding:
+    PersistImportedDeploymentRequestPreparedStackProfileAwBinding,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackProfileAwBinding$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackProfileAwBinding),
+  );
+}
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackProfileEffect$outboundSchema:
+  z.ZodEnum<typeof PersistImportedDeploymentRequestPreparedStackProfileEffect> =
+    z.enum(PersistImportedDeploymentRequestPreparedStackProfileEffect);
+
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackProfileAwGrant$Outbound =
+  {
+    actions?: Array<string> | null | undefined;
+    dataActions?: Array<string> | null | undefined;
+    permissions?: Array<string> | null | undefined;
+    predefinedRoles?: Array<string> | null | undefined;
+    residualPermissions?: Array<string> | null | undefined;
+  };
+
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackProfileAwGrant$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackProfileAwGrant$Outbound,
+    PersistImportedDeploymentRequestPreparedStackProfileAwGrant
+  > = z.object({
+    actions: z.nullable(z.array(z.string())).optional(),
+    dataActions: z.nullable(z.array(z.string())).optional(),
+    permissions: z.nullable(z.array(z.string())).optional(),
+    predefinedRoles: z.nullable(z.array(z.string())).optional(),
+    residualPermissions: z.nullable(z.array(z.string())).optional(),
+  });
+
+export function persistImportedDeploymentRequestPreparedStackProfileAwGrantToJSON(
+  persistImportedDeploymentRequestPreparedStackProfileAwGrant:
+    PersistImportedDeploymentRequestPreparedStackProfileAwGrant,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackProfileAwGrant$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackProfileAwGrant),
+  );
+}
 
-export type PersistImportedDeploymentRequestManagementConfigKubernetes = {
-  platform: "kubernetes";
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackProfileAw$Outbound = {
+  binding:
+    PersistImportedDeploymentRequestPreparedStackProfileAwBinding$Outbound;
+  description?: string | null | undefined;
+  effect?: string | undefined;
+  grant: PersistImportedDeploymentRequestPreparedStackProfileAwGrant$Outbound;
+  label?: string | null | undefined;
 };
 
-/**
- * Azure management configuration extracted from stack settings
- */
-export type PersistImportedDeploymentRequestManagementConfigAzure = {
-  /**
-   * The managing Azure Tenant ID for cross-tenant access
-   */
-  managingTenantId: string;
-  /**
-   * OIDC issuer URL trusted by the target-side managed identity.
-   */
-  oidcIssuer: string;
-  /**
-   * OIDC subject claim trusted by the target-side managed identity.
-   */
-  oidcSubject: string;
-  platform: "azure";
-};
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackProfileAw$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackProfileAw$Outbound,
+    PersistImportedDeploymentRequestPreparedStackProfileAw
+  > = z.object({
+    binding: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackProfileAwBinding$outboundSchema
+    ),
+    description: z.nullable(z.string()).optional(),
+    effect:
+      PersistImportedDeploymentRequestPreparedStackProfileEffect$outboundSchema
+        .optional(),
+    grant: z.lazy(() =>
+      PersistImportedDeploymentRequestPreparedStackProfileAwGrant$outboundSchema
+    ),
+    label: z.nullable(z.string()).optional(),
+  });
 
-/**
- * GCP management configuration extracted from stack settings
- */
-export type PersistImportedDeploymentRequestManagementConfigGcp = {
-  /**
-   * Service account email for management roles
-   */
-  serviceAccountEmail: string;
-  platform: "gcp";
-};
+export function persistImportedDeploymentRequestPreparedStackProfileAwToJSON(
+  persistImportedDeploymentRequestPreparedStackProfileAw:
+    PersistImportedDeploymentRequestPreparedStackProfileAw,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackProfileAw$outboundSchema.parse(
+      persistImportedDeploymentRequestPreparedStackProfileAw,
+    ),
+  );
+}
 
-/**
- * AWS management configuration extracted from stack settings
- */
-export type PersistImportedDeploymentRequestManagementConfigAws = {
-  /**
-   * The managing AWS IAM role ARN that can assume cross-account roles
-   */
-  managingRoleArn: string;
-  platform: "aws";
-};
+/** @internal */
+export type PersistImportedDeploymentRequestPreparedStackProfileAzureResource$Outbound =
+  {
+    scope: string;
+  };
 
-/**
- * Management configuration for different cloud platforms.
- *
- * @remarks
- *
- * Platform-derived configuration for cross-account/cross-tenant access.
- * This is NOT user-specified - it's derived from the Manager's ServiceAccount.
- */
-export type PersistImportedDeploymentRequestManagementConfigUnion =
-  | PersistImportedDeploymentRequestManagementConfigAws
-  | PersistImportedDeploymentRequestManagementConfigGcp
-  | PersistImportedDeploymentRequestManagementConfigAzure
-  | PersistImportedDeploymentRequestManagementConfigKubernetes;
+/** @internal */
+export const PersistImportedDeploymentRequestPreparedStackProfileAzureResource$outboundSchema:
+  z.ZodType<
+    PersistImportedDeploymentRequestPreparedStackProfileAzureResource$Outbound,
+    PersistImportedDeploymentRequestPreparedStackProfileAzureResource
+  > = z.object({
+    scope: z.string(),
+  });
 
-export type PersistImportedDeploymentRequest = {
-  mode: ModePersist;
-  /**
-   * Deployment name. Must be unique within the deployment group.
-   */
-  name: string;
-  /**
-   * Unique identifier for the deployment group.
-   */
-  deploymentGroupId: string;
-  managerId: string;
-  /**
-   * Optional deployment subdomain under the project's generated-domain parent. Operator-only and requires a custom project domain; customer deploy-link tokens and the shared system domain are rejected. Omit to generate a random subdomain.
-   */
-  publicSubdomain?: string | undefined;
-  /**
-   * Represents the target cloud platform.
-   */
-  platform: PersistImportedDeploymentRequestPlatformEnum;
-  /**
-   * Base cloud platform for cloud-backed Kubernetes imports.
-   */
-  basePlatform?: KubernetesBasePlatform | undefined;
-  /**
-   * User-customizable deployment settings specified at deploy time.
-   *
-   * @remarks
-   *
-   * These settings are provided by the customer via CloudFormation parameters,
-   * Terraform attributes, CLI flags, or Helm values. They customize how the
-   * deployment runs and what capabilities are enabled.
-   *
-   * **Key distinction**: StackSettings is user-customizable, while ManagementConfig
-   * is platform-derived (from the Manager's ServiceAccount).
-   */
-  stackSettings: PersistImportedDeploymentRequestStackSettings;
-  stackState?: any | null | undefined;
-  /**
-   * Platform-specific environment information
-   */
-  environmentInfo?:
-    | PersistImportedDeploymentRequestEnvironmentInfoUnion
-    | null
-    | undefined;
-  /**
-   * Runtime metadata for deployment
-   *
-   * @remarks
-   *
-   * Stores deployment state that needs to persist across step calls.
-   */
-  runtimeMetadata: PersistImportedDeploymentRequestRuntimeMetadata;
-  scheduleReconciliation?: boolean | undefined;
-  /**
-   * DeploymentState protocol version owned by the runtime/manager
-   */
-  deploymentProtocolVersion: number;
-  /**
-   * Deployment status in the deployment lifecycle.
-   *
-   * @remarks
-   *
-   * For observe-only deployments with no release or stack state, `Running`
-   * means the Operator is attached. Connectivity comes from `lastHeartbeatAt`;
-   * resource health comes from inventory and resource heartbeat data.
-   */
-  status?: PersistImportedDeploymentRequestStatus | undefined;
-  /**
-   * Unique identifier for the release.
-   */
-  currentReleaseId?: string | undefined;
-  /**
-   * Unique identifier for the release.
-   */
-  desiredReleaseId?: string | undefined;
-  importSource?: ImportSourceKind | undefined;
-  setupMetadata?: { [k: string]: any | null } | undefined;
-  /**
-   * Stable target key for the setup contract, e.g. aws/us-east-1
-   */
-  setupTarget: string;
-  /**
-   * Deterministic setup contract fingerprint for one setup target
-   */
-  setupFingerprint: string;
-  /**
-   * Setup fingerprint algorithm version
-   */
-  setupFingerprintVersion: number;
-  deploymentToken?: string | undefined;
-  /**
-   * Management configuration for different cloud platforms.
-   *
-   * @remarks
-   *
-   * Platform-derived configuration for cross-account/cross-tenant access.
-   * This is NOT user-specified - it's derived from the Manager's ServiceAccount.
-   */
-  managementConfig?:
-    | PersistImportedDeploymentRequestManagementConfigAws
-    | PersistImportedDeploymentRequestManagementConfigGcp
-    | PersistImportedDeploymentRequestManagementConfigAzure
-    | PersistImportedDeploymentRequestManagementConfigKubernetes
-    | undefined;
-  inputValues?: { [k: string]: StackInputValueRequest } | undefined;
-};
+export function persistImportedDeploymentRequestPreparedStackProfileAzureResourceToJSON(
+  persistImportedDeploymentRequestPreparedStackProfileAzureResource:
+    PersistImportedDeploymentRequestPreparedStackProfileAzureResource,
+): string {
+  return JSON.stringify(
+    PersistImportedDeploymentRequestPreparedStackProfileAzureResource$outboundSchema
+      .parse(persistImportedDeploymentRequestPreparedStackProfileAzureResource),
+  );
+}
 
 /** @internal */
 export type PersistImportedDeploymentRequestPreparedStackProfileAzureStack$Outbound =
@@ -953,9 +2986,9 @@ export const PersistImportedDeploymentRequestPreparedStackProfileAzureBinding$ou
     PersistImportedDeploymentRequestPreparedStackProfileAzureBinding$Outbound,
     PersistImportedDeploymentRequestPreparedStackProfileAzureBinding
   > = z.object({
-    resource:
+    resource: z.lazy(() =>
       PersistImportedDeploymentRequestPreparedStackProfileAzureResource$outboundSchema
-        .optional(),
+    ).optional(),
     stack: z.lazy(() =>
       PersistImportedDeploymentRequestPreparedStackProfileAzureStack$outboundSchema
     ).optional(),
@@ -1362,9 +3395,9 @@ export const PersistImportedDeploymentRequestPreparedStackProfilePlatforms$outbo
     PersistImportedDeploymentRequestPreparedStackProfilePlatforms
   > = z.object({
     aws: z.nullable(
-      z.array(
-        PersistImportedDeploymentRequestPreparedStackProfileAw$outboundSchema,
-      ),
+      z.array(z.lazy(() =>
+        PersistImportedDeploymentRequestPreparedStackProfileAw$outboundSchema
+      )),
     ).optional(),
     azure: z.nullable(
       z.array(z.lazy(() =>
@@ -1451,7 +3484,9 @@ export function persistImportedDeploymentRequestPreparedStackProfileUnionToJSON(
 export type PersistImportedDeploymentRequestPreparedStackPermissions$Outbound =
   {
     management?:
-      | PersistImportedDeploymentRequestPreparedStackManagementUnion$Outbound
+      | PersistImportedDeploymentRequestPreparedStackManagement1$Outbound
+      | PersistImportedDeploymentRequestPreparedStackManagement2$Outbound
+      | string
       | undefined;
     profiles: {
       [k: string]: {
@@ -1468,9 +3503,15 @@ export const PersistImportedDeploymentRequestPreparedStackPermissions$outboundSc
     PersistImportedDeploymentRequestPreparedStackPermissions$Outbound,
     PersistImportedDeploymentRequestPreparedStackPermissions
   > = z.object({
-    management:
-      PersistImportedDeploymentRequestPreparedStackManagementUnion$outboundSchema
-        .optional(),
+    management: z.union([
+      z.lazy(() =>
+        PersistImportedDeploymentRequestPreparedStackManagement1$outboundSchema
+      ),
+      z.lazy(() =>
+        PersistImportedDeploymentRequestPreparedStackManagement2$outboundSchema
+      ),
+      PersistImportedDeploymentRequestPreparedStackManagementEnum$outboundSchema,
+    ]).optional(),
     profiles: z.record(
       z.string(),
       z.record(
@@ -1620,6 +3661,10 @@ export type PersistImportedDeploymentRequestPreparedStack$Outbound = {
   inputs?:
     | Array<PersistImportedDeploymentRequestPreparedStackInput$Outbound>
     | undefined;
+  operations?:
+    | PersistImportedDeploymentRequestPreparedStackOperationsUnion$Outbound
+    | null
+    | undefined;
   permissions?:
     | PersistImportedDeploymentRequestPreparedStackPermissions$Outbound
     | undefined;
@@ -1642,6 +3687,9 @@ export const PersistImportedDeploymentRequestPreparedStack$outboundSchema:
     inputs: z.array(
       PersistImportedDeploymentRequestPreparedStackInput$outboundSchema,
     ).optional(),
+    operations: z.nullable(
+      PersistImportedDeploymentRequestPreparedStackOperationsUnion$outboundSchema,
+    ).optional(),
     permissions: z.lazy(() =>
       PersistImportedDeploymentRequestPreparedStackPermissions$outboundSchema
     ).optional(),