@alienplatform/platform-api 3.3.40 → 3.3.42-dev.6e3a661b219b3886d55014b3cef8af0ecdcc65fe

package/src/funcs/webhooksUpdateWebhookEndpoint.ts

@@ -0,0 +1,180 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { AlienCore } from "../core.js";
+import { encodeFormQuery, encodeJSON, encodeSimple } from "../lib/encodings.js";
+import { matchStatusCode } from "../lib/http.js";
+import * as M from "../lib/matchers.js";
+import { compactMap } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+import { RequestOptions } from "../lib/sdks.js";
+import { extractSecurity, resolveGlobalSecurity } from "../lib/security.js";
+import { pathToFunc } from "../lib/url.js";
+import { AlienError } from "../models/errors/alienerror.js";
+import {
+  ConnectionError,
+  InvalidRequestError,
+  RequestAbortedError,
+  RequestTimeoutError,
+  UnexpectedClientError,
+} from "../models/errors/httpclienterrors.js";
+import * as errors from "../models/errors/index.js";
+import { ResponseValidationError } from "../models/errors/responsevalidationerror.js";
+import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
+import * as models from "../models/index.js";
+import * as operations from "../models/operations/index.js";
+import { APICall, APIPromise } from "../types/async.js";
+import { Result } from "../types/fp.js";
+
+export function webhooksUpdateWebhookEndpoint(
+  client: AlienCore,
+  request: operations.UpdateWebhookEndpointRequest,
+  options?: RequestOptions,
+): APIPromise<
+  Result<
+    models.WebhookEndpoint,
+    | errors.APIError
+    | AlienError
+    | ResponseValidationError
+    | ConnectionError
+    | RequestAbortedError
+    | RequestTimeoutError
+    | InvalidRequestError
+    | UnexpectedClientError
+    | SDKValidationError
+  >
+> {
+  return new APIPromise($do(
+    client,
+    request,
+    options,
+  ));
+}
+
+async function $do(
+  client: AlienCore,
+  request: operations.UpdateWebhookEndpointRequest,
+  options?: RequestOptions,
+): Promise<
+  [
+    Result<
+      models.WebhookEndpoint,
+      | errors.APIError
+      | AlienError
+      | ResponseValidationError
+      | ConnectionError
+      | RequestAbortedError
+      | RequestTimeoutError
+      | InvalidRequestError
+      | UnexpectedClientError
+      | SDKValidationError
+    >,
+    APICall,
+  ]
+> {
+  const parsed = safeParse(
+    request,
+    (value) =>
+      operations.UpdateWebhookEndpointRequest$outboundSchema.parse(value),
+    "Input validation failed",
+  );
+  if (!parsed.ok) {
+    return [parsed, { status: "invalid" }];
+  }
+  const payload = parsed.value;
+  const body = encodeJSON("body", payload.RequestBody, { explode: true });
+
+  const pathParams = {
+    id: encodeSimple("id", payload.id, {
+      explode: false,
+      charEncoding: "percent",
+    }),
+  };
+  const path = pathToFunc("/v1/webhooks/endpoints/{id}")(pathParams);
+
+  const query = encodeFormQuery({
+    "projectId": payload.projectId,
+    "workspace": client._options.workspace,
+  });
+
+  const headers = new Headers(compactMap({
+    "Content-Type": "application/json",
+    Accept: "application/json",
+  }));
+
+  const secConfig = await extractSecurity(client._options.apiKey);
+  const securityInput = secConfig == null ? {} : { apiKey: secConfig };
+  const requestSecurity = resolveGlobalSecurity(securityInput);
+
+  const context = {
+    options: client._options,
+    baseURL: options?.serverURL ?? client._baseURL ?? "",
+    operationID: "updateWebhookEndpoint",
+    oAuth2Scopes: null,
+
+    resolvedSecurity: requestSecurity,
+
+    securitySource: client._options.apiKey,
+    retryConfig: options?.retries
+      || client._options.retryConfig
+      || { strategy: "none" },
+    retryCodes: options?.retryCodes || ["429", "500", "502", "503", "504"],
+  };
+
+  const requestRes = client._createRequest(context, {
+    security: requestSecurity,
+    method: "PATCH",
+    baseURL: options?.serverURL,
+    path: path,
+    headers: headers,
+    query: query,
+    body: body,
+    userAgent: client._options.userAgent,
+    timeoutMs: options?.timeoutMs || client._options.timeoutMs || -1,
+  }, options);
+  if (!requestRes.ok) {
+    return [requestRes, { status: "invalid" }];
+  }
+  const req = requestRes.value;
+
+  const doResult = await client._do(req, {
+    context,
+    isErrorStatusCode: (statusCode: number) =>
+      matchStatusCode({ status: statusCode } as Response, ["4XX", "5XX"]),
+    retryConfig: context.retryConfig,
+    retryCodes: context.retryCodes,
+  });
+  if (!doResult.ok) {
+    return [doResult, { status: "request-error", request: req }];
+  }
+  const response = doResult.value;
+
+  const responseFields = {
+    HttpMeta: { Response: response, Request: req },
+  };
+
+  const [result] = await M.match<
+    models.WebhookEndpoint,
+    | errors.APIError
+    | AlienError
+    | ResponseValidationError
+    | ConnectionError
+    | RequestAbortedError
+    | RequestTimeoutError
+    | InvalidRequestError
+    | UnexpectedClientError
+    | SDKValidationError
+  >(
+    M.json(200, models.WebhookEndpoint$inboundSchema),
+    M.jsonErr([400, 403, 404], errors.APIError$inboundSchema),
+    M.jsonErr([500, 502, 503], errors.APIError$inboundSchema),
+    M.fail("4XX"),
+    M.fail("5XX"),
+  )(response, req, { extraFields: responseFields });
+  if (!result.ok) {
+    return [result, { status: "complete", request: req, response }];
+  }
+
+  return [result, { status: "complete", request: req, response }];
+}

package/src/funcs/workspacesDelete.ts

@@ -28,7 +28,7 @@ import { APICall, APIPromise } from "../types/async.js";
 import { Result } from "../types/fp.js";
 
 /**
- * Delete a workspace. The workspace must have no projects.
+ * Delete a workspace. The workspace must have no projects and must not be on pay as you go or a contract.
  */
 export function workspacesDelete(
   client: AlienCore,

package/src/lib/config.ts

@@ -66,8 +66,8 @@ export function serverURLFromOptions(options: SDKOptions): URL | null {
 export const SDK_METADATA = {
   language: "typescript",
   openapiDocVersion: "1.0.0",
-  sdkVersion: "3.3.40",
+  sdkVersion: "3.3.42",
   genVersion: "2.941.0",
   userAgent:
-    "speakeasy-sdk/typescript 3.3.40 2.941.0 1.0.0 @alienplatform/platform-api",
+    "speakeasy-sdk/typescript 3.3.42 2.941.0 1.0.0 @alienplatform/platform-api",
 } as const;

package/src/models/apikeydeploymentsetupconfig.ts

@@ -124,6 +124,14 @@ export type APIKeyDeploymentSetupConfigItem = {
 };
 
 export type APIKeyDeploymentSetupConfig = {
+  /**
+   * Vendor destination when leaving or completing setup. Must be an absolute HTTPS URL without userinfo (embedded credentials), at most 2048 characters. Null clears the destination; omit to keep it unchanged.
+   */
+  returnUrl?: string | null | undefined;
+  /**
+   * Vendor destination for expired, revoked or disabled setup links. This URL remains available for unusable links; the endpoint must authenticate the user before minting a new link. Must be an absolute HTTPS URL without userinfo (embedded credentials), at most 2048 characters. Null clears the destination; omit to keep it unchanged.
+   */
+  refreshUrl?: string | null | undefined;
   metadata: { [k: string]: any | null };
   policy: DeploymentSetupPolicy;
   environmentVariables: Array<APIKeyDeploymentSetupEnvironmentVariable>;
@@ -317,6 +325,8 @@ export const APIKeyDeploymentSetupConfig$inboundSchema: z.ZodType<
   APIKeyDeploymentSetupConfig,
   unknown
 > = z.object({
+  returnUrl: z.nullable(z.string()).optional(),
+  refreshUrl: z.nullable(z.string()).optional(),
   metadata: z.record(z.string(), z.nullable(z.any())),
   policy: DeploymentSetupPolicy$inboundSchema,
   environmentVariables: z.array(

package/src/models/billinglimits.ts

@@ -12,6 +12,9 @@ export type BillingLimits = {
   maxProjects: number | null;
   maxSeats: number | null;
   maxCustomDomains: number | null;
+  /**
+   * Deprecated. Always null: no plan includes a usage credit.
+   */
   creditUsd: number | null;
   seatsIncluded: number | null;
 };

package/src/models/createaccessrequest.ts

@@ -39,7 +39,7 @@ export type CreateAccessRequestCommand = {
 /**
  * Required with `operationPattern`: the highest risk tier the wildcard grant may cover.
  */
-export const CreateAccessRequestMaxRisk = {
+export const MaxRisk = {
   ReadOnly: "read-only",
   Mutating: "mutating",
   Destructive: "destructive",
@@ -47,9 +47,7 @@ export const CreateAccessRequestMaxRisk = {
 /**
  * Required with `operationPattern`: the highest risk tier the wildcard grant may cover.
  */
-export type CreateAccessRequestMaxRisk = ClosedEnum<
-  typeof CreateAccessRequestMaxRisk
->;
+export type MaxRisk = ClosedEnum<typeof MaxRisk>;
 
 export type CreateAccessRequest = {
   /**
@@ -89,7 +87,7 @@ export type CreateAccessRequest = {
   /**
    * Required with `operationPattern`: the highest risk tier the wildcard grant may cover.
    */
-  maxRisk?: CreateAccessRequestMaxRisk | undefined;
+  maxRisk?: MaxRisk | undefined;
   debugTool?: DebugGrantTool | undefined;
   /**
    * Scopes a `kubectl` debug grant to one Kubernetes namespace. Requires `debugTool: kubectl`.
@@ -138,9 +136,9 @@ export function createAccessRequestCommandToJSON(
 }
 
 /** @internal */
-export const CreateAccessRequestMaxRisk$outboundSchema: z.ZodEnum<
-  typeof CreateAccessRequestMaxRisk
-> = z.enum(CreateAccessRequestMaxRisk);
+export const MaxRisk$outboundSchema: z.ZodEnum<typeof MaxRisk> = z.enum(
+  MaxRisk,
+);
 
 /** @internal */
 export type CreateAccessRequest$Outbound = {
@@ -176,7 +174,7 @@ export const CreateAccessRequest$outboundSchema: z.ZodType<
   operation: z.string().optional(),
   operationPattern: z.string().optional(),
   params: z.nullable(z.any()).optional(),
-  maxRisk: CreateAccessRequestMaxRisk$outboundSchema.optional(),
+  maxRisk: MaxRisk$outboundSchema.optional(),
   debugTool: DebugGrantTool$outboundSchema.optional(),
   debugNamespace: z.string().optional(),
   debugCloudScope: z.string().optional(),
@@ -189,3 +187,8 @@ export function createAccessRequestToJSON(
     CreateAccessRequest$outboundSchema.parse(createAccessRequest),
   );
 }
+
+// Published access-request risk compatibility exports.
+export const CreateAccessRequestMaxRisk = MaxRisk;
+export type CreateAccessRequestMaxRisk = MaxRisk;
+export const CreateAccessRequestMaxRisk$outboundSchema = MaxRisk$outboundSchema;

package/src/models/createdeploymentgrouptokenrequest.ts

@@ -40,6 +40,14 @@ export type CreateDeploymentGroupTokenRequestSetupItemsUnion =
   | Array<DeploymentSetupItemSelection>;
 
 export type CreateDeploymentGroupTokenRequest = {
+  /**
+   * Vendor destination when leaving or completing setup. Must be an absolute HTTPS URL without userinfo (embedded credentials), at most 2048 characters. Null clears the destination; omit to keep it unchanged.
+   */
+  returnUrl?: string | null | undefined;
+  /**
+   * Vendor destination for expired, revoked or disabled setup links. This URL remains available for unusable links; the endpoint must authenticate the user before minting a new link. Must be an absolute HTTPS URL without userinfo (embedded credentials), at most 2048 characters. Null clears the destination; omit to keep it unchanged.
+   */
+  refreshUrl?: string | null | undefined;
   /**
    * Description for the API key
    */
@@ -97,6 +105,8 @@ export function createDeploymentGroupTokenRequestSetupItemsUnionToJSON(
 
 /** @internal */
 export type CreateDeploymentGroupTokenRequest$Outbound = {
+  returnUrl?: string | null | undefined;
+  refreshUrl?: string | null | undefined;
   description?: string | undefined;
   expiresAt?: string | null | undefined;
   deploymentSetupConfig?: DeploymentSetupConfigInput$Outbound | undefined;
@@ -113,6 +123,8 @@ export const CreateDeploymentGroupTokenRequest$outboundSchema: z.ZodType<
   CreateDeploymentGroupTokenRequest$Outbound,
   CreateDeploymentGroupTokenRequest
 > = z.object({
+  returnUrl: z.nullable(z.string()).optional(),
+  refreshUrl: z.nullable(z.string()).optional(),
   description: z.string().optional(),
   expiresAt: z.nullable(z.date().transform(v => v.toISOString())).optional(),
   deploymentSetupConfig: DeploymentSetupConfigInput$outboundSchema.optional(),

package/src/models/createdeploymentresponse.ts

@@ -7,6 +7,10 @@ import { safeParse } from "../lib/schemas.js";
 import { ClosedEnum } from "../types/enums.js";
 import { Result as SafeParseResult } from "../types/fp.js";
 import { Deployment, Deployment$inboundSchema } from "./deployment.js";
+import {
+  DeploymentInstallation,
+  DeploymentInstallation$inboundSchema,
+} from "./deploymentinstallation.js";
 import { SDKValidationError } from "./errors/sdkvalidationerror.js";
 
 /**
@@ -29,8 +33,11 @@ export type CreateDeploymentResponse = {
    * Effective deployment model persisted for the deployment.
    */
   deploymentModel: CreateDeploymentResponseDeploymentModel;
+  installation?: DeploymentInstallation | undefined;
+  managementExternalId?: string | undefined;
+  runtimeEncryptionKey?: string | undefined;
   /**
-   * Deployment token (only returned when using deployment group token)
+   * Deployment token (returned for deployment-group creation and await-registration reservations)
    */
   token?: string | undefined;
 };
@@ -47,6 +54,9 @@ export const CreateDeploymentResponse$inboundSchema: z.ZodType<
 > = z.object({
   deployment: Deployment$inboundSchema,
   deploymentModel: CreateDeploymentResponseDeploymentModel$inboundSchema,
+  installation: DeploymentInstallation$inboundSchema.optional(),
+  managementExternalId: z.string().optional(),
+  runtimeEncryptionKey: z.string().optional(),
   token: z.string().optional(),
 });
 

package/src/models/createmanagerresponsepublicendpointtargetmachineaddresses2.ts

@@ -178,6 +178,14 @@ export type CreateManagerResponseEnvironmentVariable = {
 };
 
 export type CreateManagerResponseSetupConfig = {
+  /**
+   * Vendor destination when leaving or completing setup. Must be an absolute HTTPS URL without userinfo (embedded credentials), at most 2048 characters. Null clears the destination; omit to keep it unchanged.
+   */
+  returnUrl?: string | null | undefined;
+  /**
+   * Vendor destination for expired, revoked or disabled setup links. This URL remains available for unusable links; the endpoint must authenticate the user before minting a new link. Must be an absolute HTTPS URL without userinfo (embedded credentials), at most 2048 characters. Null clears the destination; omit to keep it unchanged.
+   */
+  refreshUrl?: string | null | undefined;
   metadata: { [k: string]: any | null };
   policy: DeploymentSetupPolicy;
   inputValues?: { [k: string]: EncryptedStackInputValue } | undefined;
@@ -1973,6 +1981,8 @@ export const CreateManagerResponseSetupConfig$inboundSchema: z.ZodType<
   CreateManagerResponseSetupConfig,
   unknown
 > = z.object({
+  returnUrl: z.nullable(z.string()).optional(),
+  refreshUrl: z.nullable(z.string()).optional(),
   metadata: z.record(z.string(), z.nullable(z.any())),
   policy: DeploymentSetupPolicy$inboundSchema,
   inputValues: z.record(z.string(), EncryptedStackInputValue$inboundSchema)

package/src/models/createsetuplinkrequest.ts

@@ -56,6 +56,14 @@ export type CreateSetupLinkRequest = {
    * Maximum number of deployments for newly created groups
    */
   maxDeployments?: number | undefined;
+  /**
+   * Vendor destination when leaving or completing setup. Must be an absolute HTTPS URL without userinfo (embedded credentials), at most 2048 characters. Null clears the destination; omit to keep it unchanged.
+   */
+  returnUrl?: string | null | undefined;
+  /**
+   * Vendor destination for expired, revoked or disabled setup links. This URL remains available for unusable links; the endpoint must authenticate the user before minting a new link. Must be an absolute HTTPS URL without userinfo (embedded credentials), at most 2048 characters. Null clears the destination; omit to keep it unchanged.
+   */
+  refreshUrl?: string | null | undefined;
   /**
    * Description for the API key
    */
@@ -118,6 +126,8 @@ export type CreateSetupLinkRequest$Outbound = {
   name: string;
   project: string;
   maxDeployments: number;
+  returnUrl?: string | null | undefined;
+  refreshUrl?: string | null | undefined;
   description?: string | undefined;
   expiresAt?: string | null | undefined;
   deploymentSetupConfig?: DeploymentSetupConfigInput$Outbound | undefined;
@@ -139,6 +149,8 @@ export const CreateSetupLinkRequest$outboundSchema: z.ZodType<
   name: z.string(),
   project: z.string(),
   maxDeployments: z.int().default(100),
+  returnUrl: z.nullable(z.string()).optional(),
+  refreshUrl: z.nullable(z.string()).optional(),
   description: z.string().optional(),
   expiresAt: z.nullable(z.date().transform(v => v.toISOString())).optional(),
   deploymentSetupConfig: DeploymentSetupConfigInput$outboundSchema.optional(),

package/src/models/createsetupregistrationoperationrequest.ts

@@ -1550,6 +1550,10 @@ export type CreateSetupRegistrationOperationRequest = {
   deploymentId?: string | null | undefined;
   idempotencyKey?: string | undefined;
   cloudFormation?: SetupRegistrationCloudFormationTarget | null | undefined;
+  /**
+   * ManagementExternalId the stack was created or updated with. Absent when the template predates the parameter; empty when the installer left it blank. Compared with the deployment group's value and never stored.
+   */
+  managementExternalId?: string | undefined;
 };
 
 /** @internal */
@@ -4810,6 +4814,7 @@ export type CreateSetupRegistrationOperationRequest$Outbound = {
     | SetupRegistrationCloudFormationTarget$Outbound
     | null
     | undefined;
+  managementExternalId?: string | undefined;
 };
 
 /** @internal */
@@ -4829,6 +4834,7 @@ export const CreateSetupRegistrationOperationRequest$outboundSchema: z.ZodType<
   cloudFormation: z.nullable(
     SetupRegistrationCloudFormationTarget$outboundSchema,
   ).optional(),
+  managementExternalId: z.string().optional(),
 });
 
 export function createSetupRegistrationOperationRequestToJSON(

package/src/models/deletedeploymentrequest.ts

@@ -7,6 +7,8 @@ import { ClosedEnum } from "../types/enums.js";
 
 export const DeleteDeploymentRequestAction = {
   Cleanup: "cleanup",
+  Retain: "retain",
+  Erase: "erase",
   Detach: "detach",
   Forget: "forget",
 } as const;

package/src/models/deletedeploymentresponse.ts

@@ -10,6 +10,8 @@ import { SDKValidationError } from "./errors/sdkvalidationerror.js";
 
 export const DeleteDeploymentResponseAction = {
   Cleanup: "cleanup",
+  Retain: "retain",
+  Erase: "erase",
   Detach: "detach",
   Forget: "forget",
 } as const;

package/src/models/deployment.ts

@@ -14,6 +14,8 @@ import {
   DeploymentBasePlatform$inboundSchema,
   DeploymentCredentialRetryUnion,
   DeploymentCredentialRetryUnion$inboundSchema,
+  DeploymentDeletionPolicy,
+  DeploymentDeletionPolicy$inboundSchema,
   DeploymentDeployerSecret,
   DeploymentDeployerSecret$inboundSchema,
   DeploymentEnvironmentInfoUnion,
@@ -28,17 +30,17 @@ import {
   DeploymentStackState$inboundSchema,
   DeploymentStatus,
   DeploymentStatus$inboundSchema,
-} from "./deploymentpendingpreparedstackdefaultstringlist.js";
+} from "./deploymentpendingpreparedstacktypestringlist.js";
 import {
   DeploymentPendingPreparedStackUnion,
   DeploymentPendingPreparedStackUnion$inboundSchema,
-  DeploymentPreparedStackApprovalPlugins,
-  DeploymentPreparedStackApprovalPlugins$inboundSchema,
   DeploymentPreparedStackCustom,
   DeploymentPreparedStackCustom$inboundSchema,
   DeploymentPreparedStackInput,
   DeploymentPreparedStackInput$inboundSchema,
-} from "./deploymentpreparedstackapprovalplugins.js";
+  DeploymentPreparedStackPluginsDecision,
+  DeploymentPreparedStackPluginsDecision$inboundSchema,
+} from "./deploymentpreparedstackpluginsdecision.js";
 import {
   DeploymentPurpose,
   DeploymentPurpose$inboundSchema,
@@ -57,6 +59,20 @@ import {
   ReportedOperation$inboundSchema,
 } from "./reportedoperation.js";
 
+export type DeploymentPreparedStackApprovalPlugins = {
+  /**
+   * Whether matching operations run without approval.
+   */
+  decision: DeploymentPreparedStackPluginsDecision;
+  /**
+   * Highest risk tier (`read-only`, `mutating`, `destructive`) a wildcard
+   *
+   * @remarks
+   * access request for these operations may cover.
+   */
+  maxRisk?: string | null | undefined;
+};
+
 /**
  * Whether matching operations run without approval.
  */
@@ -1360,6 +1376,14 @@ export type DeploymentPreparedStackResources = {
    * The total dependencies are: resource.get_dependencies() + this list
    */
   dependencies: Array<DeploymentPreparedStackDependency>;
+  /**
+   * Authored purpose, displayed as plain text. Does not affect resource configuration.
+   */
+  description?: string | null | undefined;
+  /**
+   * Optional human-readable name. The stable resource ID is the display fallback.
+   */
+  displayName?: string | null | undefined;
   /**
    * Id of the boolean stack input that decides whether this resource is
    *
@@ -1584,6 +1608,13 @@ export type DeploymentRuntimeMetadata = {
    * Bounded credential retry state shared by all deployment drivers.
    */
   credentialRetry?: DeploymentCredentialRetryUnion | null | undefined;
+  /**
+   * Explicit disposition of durable data when deleting a deployment.
+   *
+   * @remarks
+   * Missing values from older checkpoints always preserve data.
+   */
+  deletionPolicy?: DeploymentDeletionPolicy | undefined;
   /**
    * Whether each vault-native deployer secret is in the customer's secret
    *
@@ -1652,6 +1683,29 @@ export type DeploymentRuntimeMetadata = {
    * every reconcile tick.
    */
   registryAccessGranted?: boolean | undefined;
+  /**
+   * Start of the bounded wait for retained data's expiry controls to disable.
+   *
+   * @remarks
+   * Cleared on confirmation, explicit retry, or returning to normal execution.
+   */
+  retainedDataProtectionStartedAt?: Date | null | undefined;
+  /**
+   * UTC API-confirmation time for the matching data protection digest.
+   *
+   * @remarks
+   * Provider propagation must be qualified separately before final retention.
+   */
+  retainedStorageProtectionConfirmedAt?: Date | null | undefined;
+  /**
+   * Digest of the installed data inventory whose runtime public-access and
+   *
+   * @remarks
+   * expiry configuration was protected before cleanup. The serialized field
+   * name is retained for compatibility. This is not a
+   * receipt for effective expiry propagation or privileged setup teardown.
+   */
+  retainedStorageProtectionHash?: string | null | undefined;
   /**
    * What a direct setup created for resources it does not own, keyed by resource id. Setup
    *
@@ -1664,6 +1718,14 @@ export type DeploymentRuntimeMetadata = {
     | string
     | null
     | undefined;
+  /**
+   * Credential revocation completed before resource teardown. A delete retry
+   *
+   * @remarks
+   * can use this receipt after the vault or its binding is gone. Secret sync
+   * clears it before a deployment can write runtime credentials again.
+   */
+  vaultCredentialsRevoked?: boolean | undefined;
 };
 
 /**
@@ -1844,7 +1906,7 @@ export type Deployment = {
    */
   stackSettings: DeploymentStackSettings;
   /**
-   * State of infrastructure components managed by this deployment
+   * Raw engine state for installers and the CLI to resume, update, and destroy deployments. UIs should read resources[] for resource status and errors.
    */
   stackState?: DeploymentStackState | null | undefined;
   /**
@@ -1941,6 +2003,26 @@ export type Deployment = {
   customerKeyUnavailable?: boolean | undefined;
 };
 
+/** @internal */
+export const DeploymentPreparedStackApprovalPlugins$inboundSchema: z.ZodType<
+  DeploymentPreparedStackApprovalPlugins,
+  unknown
+> = z.object({
+  decision: DeploymentPreparedStackPluginsDecision$inboundSchema,
+  maxRisk: z.nullable(z.string()).optional(),
+});
+
+export function deploymentPreparedStackApprovalPluginsFromJSON(
+  jsonString: string,
+): SafeParseResult<DeploymentPreparedStackApprovalPlugins, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) =>
+      DeploymentPreparedStackApprovalPlugins$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'DeploymentPreparedStackApprovalPlugins' from JSON`,
+  );
+}
+
 /** @internal */
 export const DeploymentPreparedStackApprovalPluginsEnum$inboundSchema:
   z.ZodEnum<typeof DeploymentPreparedStackApprovalPluginsEnum> = z.enum(
@@ -1950,7 +2032,7 @@ export const DeploymentPreparedStackApprovalPluginsEnum$inboundSchema:
 /** @internal */
 export const DeploymentPreparedStackPluginsApprovalUnion$inboundSchema:
   z.ZodType<DeploymentPreparedStackPluginsApprovalUnion, unknown> = z.union([
-    DeploymentPreparedStackApprovalPlugins$inboundSchema,
+    z.lazy(() => DeploymentPreparedStackApprovalPlugins$inboundSchema),
     DeploymentPreparedStackApprovalPluginsEnum$inboundSchema,
   ]);
 
@@ -2075,7 +2157,7 @@ export const DeploymentPreparedStackPlugins$inboundSchema: z.ZodType<
   approval: z.record(
     z.string(),
     z.union([
-      DeploymentPreparedStackApprovalPlugins$inboundSchema,
+      z.lazy(() => DeploymentPreparedStackApprovalPlugins$inboundSchema),
       DeploymentPreparedStackApprovalPluginsEnum$inboundSchema,
     ]),
   ).optional(),
@@ -3961,6 +4043,8 @@ export const DeploymentPreparedStackResources$inboundSchema: z.ZodType<
   dependencies: z.array(
     z.lazy(() => DeploymentPreparedStackDependency$inboundSchema),
   ),
+  description: z.nullable(z.string()).optional(),
+  displayName: z.nullable(z.string()).optional(),
   enabledWhen: z.nullable(z.string()).optional(),
   lifecycle: DeploymentPreparedStackLifecycle$inboundSchema,
   remoteAccess: z.boolean().optional(),
@@ -4191,6 +4275,7 @@ export const DeploymentRuntimeMetadata$inboundSchema: z.ZodType<
   automaticSetup: z.boolean().optional(),
   credentialRetry: z.nullable(DeploymentCredentialRetryUnion$inboundSchema)
     .optional(),
+  deletionPolicy: DeploymentDeletionPolicy$inboundSchema.optional(),
   deployerSecrets: z.array(DeploymentDeployerSecret$inboundSchema).optional(),
   directSetupRevision: z.nullable(z.string()).optional(),
   initialSetupAuthority: DeploymentInitialSetupAuthority$inboundSchema
@@ -4209,6 +4294,13 @@ export const DeploymentRuntimeMetadata$inboundSchema: z.ZodType<
     z.union([z.lazy(() => DeploymentRegistryAccess$inboundSchema), z.string()]),
   ).optional(),
   registryAccessGranted: z.boolean().optional(),
+  retainedDataProtectionStartedAt: z.nullable(
+    z.iso.datetime({ offset: true }).transform(v => new Date(v)),
+  ).optional(),
+  retainedStorageProtectionConfirmedAt: z.nullable(
+    z.iso.datetime({ offset: true }).transform(v => new Date(v)),
+  ).optional(),
+  retainedStorageProtectionHash: z.nullable(z.string()).optional(),
   setupScaffolding: z.record(
     z.string(),
     z.lazy(() => DeploymentSetupScaffolding$inboundSchema),
@@ -4219,6 +4311,7 @@ export const DeploymentRuntimeMetadata$inboundSchema: z.ZodType<
       z.string(),
     ]),
   ).optional(),
+  vaultCredentialsRevoked: z.boolean().optional(),
 });
 
 export function deploymentRuntimeMetadataFromJSON(