@alienplatform/sdk 3.3.28 → 3.3.29

package/dist/dist.js

@@ -2462,6 +2462,138 @@ function handleIntersectionResults(result, left, right) {
 	result.value = merged.data;
 	return result;
 }
+const $ZodRecord = /*@__PURE__*/ $constructor("$ZodRecord", (inst, def) => {
+	$ZodType.init(inst, def);
+	const memo = globalConfig.memoizer;
+	memo?.attach(inst);
+	inst._zod.parse = (payload, ctx) => {
+		const input = payload.value;
+		if (!isPlainObject(input)) {
+			payload.issues.push({
+				expected: "record",
+				code: "invalid_type",
+				input,
+				inst
+			});
+			return payload;
+		}
+		const proms = [];
+		const values = def.keyType._zod.values;
+		if (values && !def.partial) {
+			payload.value = memo ? memo.alloc(inst, payload, {}, ctx) : {};
+			const recordKeys = /* @__PURE__ */ new Set();
+			for (const key of values) if (typeof key === "string" || typeof key === "number" || typeof key === "symbol") {
+				recordKeys.add(typeof key === "number" ? key.toString() : key);
+				if (key === "__proto__") continue;
+				const keyResult = def.keyType._zod.run({
+					value: key,
+					issues: []
+				}, ctx);
+				if (keyResult instanceof Promise) throw new Error("Async schemas not supported in object keys currently");
+				if (keyResult.issues.length) {
+					payload.issues.push({
+						code: "invalid_key",
+						origin: "record",
+						issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),
+						input: key,
+						path: [key],
+						inst
+					});
+					continue;
+				}
+				const outKey = keyResult.value;
+				if (outKey === "__proto__") continue;
+				const result = def.valueType._zod.run({
+					value: input[key],
+					issues: []
+				}, ctx);
+				if (result instanceof Promise) proms.push(result.then((result) => {
+					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));
+					payload.value[outKey] = result.value;
+				}));
+				else {
+					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));
+					payload.value[outKey] = result.value;
+				}
+			}
+			let unrecognized;
+			for (const key in input) if (!recordKeys.has(key)) {
+				if (def.mode === "loose") {
+					if (key === "__proto__") continue;
+					payload.value[key] = input[key];
+				} else {
+					unrecognized = unrecognized ?? [];
+					unrecognized.push(key);
+				}
+			}
+			if (unrecognized && unrecognized.length > 0) payload.issues.push({
+				code: "unrecognized_keys",
+				input,
+				inst,
+				keys: unrecognized,
+				continue: true
+			});
+		} else {
+			payload.value = memo ? memo.alloc(inst, payload, {}, ctx) : {};
+			let unrecognized;
+			for (const key of Reflect.ownKeys(input)) {
+				if (key === "__proto__") continue;
+				if (!Object.prototype.propertyIsEnumerable.call(input, key)) continue;
+				let keyResult = def.keyType._zod.run({
+					value: key,
+					issues: []
+				}, ctx);
+				if (keyResult instanceof Promise) throw new Error("Async schemas not supported in object keys currently");
+				if (typeof key === "string" && number$1.test(key) && keyResult.issues.length) {
+					const retryResult = def.keyType._zod.run({
+						value: Number(key),
+						issues: []
+					}, ctx);
+					if (retryResult instanceof Promise) throw new Error("Async schemas not supported in object keys currently");
+					if (retryResult.issues.length === 0) keyResult = retryResult;
+				}
+				if (keyResult.issues.length) {
+					if (def.mode === "loose") payload.value[key] = input[key];
+					else if (values) {
+						unrecognized = unrecognized ?? [];
+						unrecognized.push(key);
+					} else payload.issues.push({
+						code: "invalid_key",
+						origin: "record",
+						issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),
+						input: key,
+						path: [key],
+						inst
+					});
+					continue;
+				}
+				const outKey = keyResult.value;
+				if (outKey === "__proto__") continue;
+				const result = def.valueType._zod.run({
+					value: input[key],
+					issues: []
+				}, ctx);
+				if (result instanceof Promise) proms.push(result.then((result) => {
+					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));
+					payload.value[outKey] = result.value;
+				}));
+				else {
+					if (result.issues.length) payload.issues.push(...prefixIssues(key, result.issues));
+					payload.value[outKey] = result.value;
+				}
+			}
+			if (unrecognized && unrecognized.length > 0) payload.issues.push({
+				code: "unrecognized_keys",
+				input,
+				inst,
+				keys: unrecognized,
+				continue: true
+			});
+		}
+		if (proms.length) return Promise.all(proms).then(() => payload);
+		return payload;
+	};
+});
 const $ZodEnum = /*@__PURE__*/ $constructor("$ZodEnum", (inst, def) => {
 	$ZodType.init(inst, def);
 	const values = getEnumValues(def.entries);
@@ -4153,6 +4285,40 @@ const intersectionProcessor = (schema, ctx, json, params) => {
 	json.allOf = allOf;
 	ctx.intersections.push(allOf);
 };
+const recordProcessor = (schema, ctx, _json, params) => {
+	const json = _json;
+	const def = schema._zod.def;
+	json.type = "object";
+	const keyType = def.keyType;
+	const patterns = keyType._zod.bag?.patterns;
+	if (def.mode === "loose" && patterns && patterns.size > 0) {
+		const valueSchema = process(def.valueType, ctx, {
+			...params,
+			path: [
+				...params.path,
+				"patternProperties",
+				"*"
+			]
+		});
+		json.patternProperties = {};
+		for (const pattern of patterns) assignProp(json.patternProperties, pattern.source, valueSchema);
+	} else {
+		if (ctx.target === "draft-07" || ctx.target === "draft-2020-12") json.propertyNames = process(def.keyType, ctx, {
+			...params,
+			path: [...params.path, "propertyNames"]
+		});
+		json.additionalProperties = process(def.valueType, ctx, {
+			...params,
+			path: [...params.path, "additionalProperties"]
+		});
+	}
+	const keyValues = keyType._zod.values;
+	const omittableOnInput = ctx.io === "input" && inputOptin(def.valueType) !== void 0;
+	if (keyValues && !def.partial && !omittableOnInput) {
+		const validKeyValues = [...keyValues].filter((v) => typeof v === "string" || typeof v === "number");
+		if (validKeyValues.length > 0) json.required = validKeyValues;
+	}
+};
 const nullableProcessor = (schema, ctx, json, params) => {
 	const def = schema._zod.def;
 	const inner = process(def.innerType, ctx, params);
@@ -4950,6 +5116,28 @@ function intersection(left, right) {
 		right
 	});
 }
+const ZodRecord = /*@__PURE__*/ $constructor("ZodRecord", (inst, def) => {
+	_ensureDefaultMemoizer();
+	$ZodRecord.init(inst, def);
+	ZodType.init(inst, def);
+	inst._zod.processJSONSchema = (ctx, json, params) => recordProcessor(inst, ctx, json, params);
+	inst.keyType = def.keyType;
+	inst.valueType = def.valueType;
+});
+function record(keyType, valueType, params) {
+	if (!valueType || !valueType._zod) return new ZodRecord({
+		type: "record",
+		keyType: string(),
+		valueType: keyType,
+		...normalizeParams(valueType)
+	});
+	return new ZodRecord({
+		type: "record",
+		keyType,
+		valueType,
+		...normalizeParams(params)
+	});
+}
 const ZodEnum = /*@__PURE__*/ $constructor("ZodEnum", (inst, def) => {
 	$ZodEnum.init(inst, def);
 	ZodType.init(inst, def);
@@ -5164,6 +5352,19 @@ function refine(fn, _params = {}) {
 function superRefine(fn, params) {
 	return /* @__PURE__ */ _superRefine(fn, params);
 }
+function json(params) {
+	const jsonSchema = lazy(() => {
+		return union([
+			string(params),
+			number(),
+			boolean(),
+			_null(),
+			array(jsonSchema),
+			record(string(), jsonSchema)
+		]);
+	});
+	return jsonSchema;
+}
 //#endregion
 //#region ../../node_modules/.pnpm/zod@4.5.2/node_modules/zod/v4/classic/iso.js
 function datetime(params) {
@@ -5299,6 +5500,54 @@ function isErrorLike(value) {
 * Do not edit manually.
 */
 /**
+* @description Reference to a Kubernetes Secret
+*/
+const SecretReferenceSchema = object({
+	"key": string(),
+	"name": string()
+}).describe("Reference to a Kubernetes Secret");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+const ValueSchema = json();
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret
+*/
+const BindingValueStringSchema = union([
+	lazy(() => ValueSchema),
+	string(),
+	object({ get "secretRef"() {
+		return SecretReferenceSchema.describe("Reference to a Kubernetes Secret");
+	} })
+]).describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Azure Container Registry binding configuration
+*/
+const AcrArtifactRegistryBindingSchema = object({
+	get "registryName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "repositoryPrefix"() {
+		return union([BindingValueStringSchema, _null()]).optional();
+	},
+	get "resourceGroupName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Azure Container Registry binding configuration");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
 * @description Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems.
 */
 const AlienErrorSchema = object({
@@ -5925,6 +6174,84 @@ const ArchitectureSchema = _enum(["arm64", "x86_64"]).describe("CPU architecture
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
+/**
+* @description AWS ECR (Elastic Container Registry) binding configuration
+*/
+const EcrArtifactRegistryBindingSchema = object({
+	get "pullRoleArn"() {
+		return union([BindingValueStringSchema, _null()]).optional();
+	},
+	get "pushRoleArn"() {
+		return union([BindingValueStringSchema, _null()]).optional();
+	},
+	get "repositoryPrefix"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("AWS ECR (Elastic Container Registry) binding configuration");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Google Artifact Registry binding configuration
+*/
+const GarArtifactRegistryBindingSchema = object({
+	get "pullServiceAccountEmail"() {
+		return union([BindingValueStringSchema, _null()]).optional();
+	},
+	get "pushServiceAccountEmail"() {
+		return union([BindingValueStringSchema, _null()]).optional();
+	},
+	get "repositoryName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Google Artifact Registry binding configuration");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret
+*/
+const BindingValueOptionStringSchema = union([
+	union([string(), _null()]),
+	lazy(() => ValueSchema),
+	object({ get "secretRef"() {
+		return SecretReferenceSchema.describe("Reference to a Kubernetes Secret");
+	} })
+]).describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Local container registry binding configuration.\n\nThe local registry runs on localhost only and does not require authentication.\nSecurity boundary is the OS process isolation on the customer\'s machine.\nExternal image access is secured by the manager\'s registry proxy (deployment tokens).
+*/
+const LocalArtifactRegistryBindingSchema = object({
+	get "dataDir"() {
+		return BindingValueOptionStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "registryUrl"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Local container registry binding configuration.\n\nThe local registry runs on localhost only and does not require authentication.\nSecurity boundary is the OS process isolation on the customer's machine.\nExternal image access is secured by the manager's registry proxy (deployment tokens).");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Service-type based artifact registry binding that supports multiple registry providers
+*/
+const ArtifactRegistryBindingSchema = union([
+	lazy(() => EcrArtifactRegistryBindingSchema).and(object({ "service": _enum(["ecr"]) })).describe("AWS ECR (Elastic Container Registry) binding configuration"),
+	lazy(() => AcrArtifactRegistryBindingSchema).and(object({ "service": _enum(["acr"]) })).describe("Azure Container Registry binding configuration"),
+	lazy(() => GarArtifactRegistryBindingSchema).and(object({ "service": _enum(["gar"]) })).describe("Google Artifact Registry binding configuration"),
+	lazy(() => LocalArtifactRegistryBindingSchema).and(object({ "service": _enum(["local"]) })).describe("Local container registry binding configuration.\n\nThe local registry runs on localhost only and does not require authentication.\nSecurity boundary is the OS process isolation on the customer's machine.\nExternal image access is secured by the manager's registry proxy (deployment tokens).")
+]).describe("Service-type based artifact registry binding that supports multiple registry providers");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
 const ArtifactRegistryHeartbeatStatusSchema = object({
 	get "collectionIssues"() {
 		return array(HeartbeatCollectionIssueSchema);
@@ -6073,6 +6400,44 @@ object({
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
+/**
+* @description Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret
+*/
+const BindingValueU16Schema = union([
+	int(),
+	lazy(() => ValueSchema),
+	object({ get "secretRef"() {
+		return SecretReferenceSchema.describe("Reference to a Kubernetes Secret");
+	} })
+]).describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description AWS Aurora Serverless v2 binding.
+*/
+const AuroraPostgresBindingSchema = object({
+	get "clusterEndpoint"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "database"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "passwordSecretArn"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "port"() {
+		return BindingValueU16Schema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "username"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("AWS Aurora Serverless v2 binding.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
 const PostgresHeartbeatStatusSchema = object({
 	get "collectionIssues"() {
 		return array(HeartbeatCollectionIssueSchema);
@@ -6347,6 +6712,7 @@ const AwsComputeClusterHeartbeatDataSchema = object({
 object({
 	"clusterId": string().describe("Cluster identifier used by container orchestration."),
 	"instanceProfileArn": string().describe("IAM instance profile ARN for cluster machines."),
+	"isolatedInstanceProfileArn": string().describe("Optional isolated node instance profile ARN.").nullish(),
 	"securityGroupId": string().describe("Security group ID attached to cluster machines.")
 }).describe("AWS ComputeCluster ImportData.");
 /**
@@ -6358,11 +6724,6 @@ const AwsCustomCertificateConfigSchema = object({ "certificateArn": string() });
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
-const ValueSchema = any();
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
 const ManagedRuntimeEventInvolvedObjectSchema = object({
 	get "details"() {
 		return union([ValueSchema, _null()]).optional();
@@ -7194,6 +7555,9 @@ object({
 	"clusterId": string().describe("Cluster identifier used by the controller."),
 	"clusterIdentityPrincipalId": string().describe("AKS cluster identity principal id (system-assigned identity)."),
 	"identityId": string().describe("Resource ID of the user-assigned identity attached to cluster VMs."),
+	"isolatedIdentityClientId": string().describe("Optional isolated node identity client ID.").nullish(),
+	"isolatedIdentityId": string().describe("Optional isolated node identity resource ID.").nullish(),
+	"isolatedIdentityPrincipalId": string().describe("Optional isolated node identity principal ID.").nullish(),
 	"kubeletIdentityClientId": string().describe("kubelet UAMI client id used by node pools.")
 }).describe("Azure ComputeCluster ImportData — AKS node pool identity / network.");
 /**
@@ -7848,6 +8212,49 @@ const BindingConfigurationGcpBindingSpecSchema = object({
 * Do not edit manually.
 */
 /**
+* @description Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret
+*/
+const BindingValueU8Schema = union([
+	int(),
+	lazy(() => ValueSchema),
+	object({ get "secretRef"() {
+		return SecretReferenceSchema.describe("Reference to a Kubernetes Secret");
+	} })
+]).describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret
+*/
+const BindingValueVecStringSchema = union([
+	array(string()),
+	lazy(() => ValueSchema),
+	object({ get "secretRef"() {
+		return SecretReferenceSchema.describe("Reference to a Kubernetes Secret");
+	} })
+]).describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Azure Blob Storage binding configuration
+*/
+const BlobStorageBindingSchema = object({
+	get "accountName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "containerName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Azure Blob Storage binding configuration");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
 * @description The type of operation a presigned request performs
 */
 const PresignedOperationSchema = _enum([
@@ -8150,6 +8557,33 @@ const CapacityGroupSchema = object({
 		return union([CapacityGroupScalePolicySchema, _null()]).optional();
 	}
 }).describe("Capacity group definition.\n\nA capacity group represents machines with identical hardware profiles.\nEach group becomes a separate Auto Scaling Group (AWS), Managed Instance Group (GCP),\nor VM Scale Set (Azure).");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description GCP Cloud SQL binding.
+*/
+const CloudSqlPostgresBindingSchema = object({
+	get "database"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "host"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "passwordSecretName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "port"() {
+		return BindingValueU16Schema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "serverCaCertificates"() {
+		return BindingValueVecStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "username"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("GCP Cloud SQL binding.");
 _enum(["push", "pull"]).describe("How a command is delivered to its target resource.\n\nThis is a Commands-protocol-specific concept and is intentionally distinct\nfrom `DeploymentModel` (see `stack_settings.rs`), which governs the\ninfrastructure-level push/pull wiring for a deployment. Serialized\nlowercase for consistency with `CommandTargetType`.");
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -8333,6 +8767,71 @@ const ComputeClusterHeartbeatDataSchema = union([
 	lazy(() => MachinesComputeClusterHeartbeatDataSchema).and(object({ "backend": _enum(["machines"]) })),
 	lazy(() => LocalComputeClusterHeartbeatDataSchema).and(object({ "backend": _enum(["local"]) }))
 ]);
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description GCP-specific platform permission configuration
+*/
+const GcpPlatformPermissionSchema = object({
+	get "binding"() {
+		return BindingConfigurationGcpBindingSpecSchema.describe("Generic binding configuration for permissions");
+	},
+	"description": string().describe("Short admin-facing description of why this entry exists.").nullish(),
+	get "grant"() {
+		return PermissionGrantSchema.describe("Grant permissions for a specific cloud platform");
+	},
+	"label": string().describe("Stable admin-facing label for this permission entry.").nullish()
+}).describe("GCP-specific platform permission configuration");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Platform-specific permission configurations
+*/
+const PlatformPermissionsSchema = object({
+	get "aws"() {
+		return array(AwsPlatformPermissionSchema.describe("AWS-specific platform permission configuration")).describe("AWS permission configurations").nullish();
+	},
+	get "azure"() {
+		return array(AzurePlatformPermissionSchema.describe("Azure-specific platform permission configuration")).describe("Azure permission configurations").nullish();
+	},
+	get "gcp"() {
+		return array(GcpPlatformPermissionSchema.describe("GCP-specific platform permission configuration")).describe("GCP permission configurations").nullish();
+	}
+}).describe("Platform-specific permission configurations");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description A permission set that can be applied across different cloud platforms
+*/
+const PermissionSetSchema = object({
+	"description": string().describe("Human-readable description of what this permission set allows"),
+	"id": string().describe("Unique identifier for the permission set (e.g., \"storage/data-read\")"),
+	get "platforms"() {
+		return PlatformPermissionsSchema.describe("Platform-specific permission configurations");
+	}
+}).describe("A permission set that can be applied across different cloud platforms");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Reference to a permission set - either by name or inline definition
+*/
+const PermissionSetReferenceSchema = union([lazy(() => PermissionSetSchema), string()]).describe("Reference to a permission set - either by name or inline definition");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource
+*/
+const PermissionProfileSchema = object({}).catchall(array(lazy(() => PermissionSetReferenceSchema).describe("Reference to a permission set - either by name or inline definition"))).describe("Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource");
 object({
 	get "capacityGroups"() {
 		return array(CapacityGroupSchema.describe("Capacity group definition.\n\nA capacity group represents machines with identical hardware profiles.\nEach group becomes a separate Auto Scaling Group (AWS), Managed Instance Group (GCP),\nor VM Scale Set (Azure).")).describe("Capacity groups defining the machine pools for this cluster.\nEach group becomes a separate ASG/MIG/VMSS.");
@@ -8341,6 +8840,12 @@ object({
 	"dynamicContainerPool": string().describe("Pool reserved for containers created after a deployment is installed.\nIf absent, the runtime uses the `general` pool when it exists.").nullish(),
 	"failureDomainSpread": optional(object({}).catchall(int().min(0)).describe("Requested failure-domain spread keyed by capacity group.\nEmpty preserves the existing aggregate layout.")),
 	"id": string().describe("Unique identifier for the container cluster.\nMust contain only alphanumeric characters, hyphens, and underscores."),
+	get "nodePermissions"() {
+		return union([PermissionProfileSchema, _null()]).optional();
+	},
+	get "nodePermissionsPlatforms"() {
+		return array(PlatformSchema.describe("Represents the target cloud platform.")).describe("Cloud platforms on which the explicit node grants apply; absent applies everywhere.").nullish();
+	},
 	"selectedFailureDomains": optional(object({}).catchall(array(string())).describe("Concrete provider failure domains selected during setup, keyed by capacity group.\nEmpty preserves the existing aggregate layout when no spread policy is configured."))
 }).describe("ComputeCluster resource for running long-running container workloads.\n\nA ComputeCluster provides the setup-owned machine boundary for containers.\nAlien may manage the worker fleet inside that boundary when setup grants\n`compute-cluster/management`.\n\n## Architecture\n\n- **Setup** creates cloud resources: ASGs/MIGs/VMSSs, IAM roles, security groups\n- **Alien** manages allowed fleet operations: machine count, runtime\n  machine image rollout and, on AWS, the machine type within one CPU architecture\n- A node agent runs on each machine from the selected runtime image channel\n\n## Example\n\n```rust\nuse alien_core::{CapacityGroup, ComputeCluster, MachineProfile};\n\nlet cluster = ComputeCluster::new(\"compute\".to_string())\n    .capacity_group(CapacityGroup {\n        group_id: \"general\".to_string(),\n        instance_type: None,\n        profile: Some(MachineProfile {\n            cpu: \"4.0\".to_string(),\n            memory_bytes: 16 * 1024 * 1024 * 1024,\n            ephemeral_storage_bytes: 20 * 1024 * 1024 * 1024,\n            architecture: None,\n            gpu: None,\n        }),\n        min_size: 1,\n        max_size: 5,\n        scale_policy: None,\n        nested_virtualization: None,\n    })\n    .build();\n```");
 /**
@@ -8390,6 +8895,30 @@ const ComputeSettingsSchema = object({ "pools": optional(object({}).catchall(laz
 * Do not edit manually.
 */
 /**
+* @description Binding configuration for a pre-existing Azure Container Apps Environment.\n\nUsed when deploying to an existing environment instead of having Alien provision one.\nThis is useful for shared environments (e.g., test infrastructure) or enterprise\nsetups where environments are managed by a separate team.
+*/
+const ContainerAppsEnvironmentBindingSchema = object({
+	get "defaultDomain"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "environmentName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "resourceGroupName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "resourceId"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "staticIp"() {
+		return union([BindingValueStringSchema, _null()]).optional();
+	}
+}).describe("Binding configuration for a pre-existing Azure Container Apps Environment.\n\nUsed when deploying to an existing environment instead of having Alien provision one.\nThis is useful for shared environments (e.g., test infrastructure) or enterprise\nsetups where environments are managed by a separate team.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
 * @description Autoscaling configuration for stateless containers.
 */
 const ContainerAutoscalingSchema = object({
@@ -8792,9 +9321,64 @@ const ReplicaStatusSchema = object({
 	"ordinal": int().min(0).describe("Ordinal (for stateful containers)").nullish(),
 	"replicaId": string().describe("Replica ID (e.g., \"api-0\", \"api-1\")")
 }).describe("Status of a single container replica.");
-object({
-	"currentReplicas": int().min(0).describe("Number of current replicas"),
-	"desiredReplicas": int().min(0).describe("Desired number of replicas"),
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description State of a container\'s snapshot schedule.
+*/
+const VolumeBackupsStateSchema = _enum([
+	"active",
+	"disabled",
+	"setupRequired"
+]).describe("State of a container's snapshot schedule.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Whether a container\'s snapshot schedule is in place.
+*/
+const VolumeBackupsStatusSchema = object({
+	"message": string().describe("What is missing when the state is `setupRequired`").nullish(),
+	get "state"() {
+		return VolumeBackupsStateSchema.describe("State of a container's snapshot schedule.");
+	}
+}).describe("Whether a container's snapshot schedule is in place.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description A completed volume restore.
+*/
+const VolumeRestoreOutputSchema = object({
+	"completedAt": string().describe("When the restored volume was put in place (RFC 3339)"),
+	"replacedVolumeSnapshotId": string().describe("Snapshot of the replaced volume, taken just before it was deleted"),
+	"requestId": string().describe("ID of the restore request"),
+	"snapshotId": string().describe("Snapshot the volume was restored from")
+}).describe("A completed volume restore.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description A replica\'s persistent volume and its latest completed snapshot.
+*/
+const VolumeOutputSchema = object({
+	get "lastRestore"() {
+		return union([VolumeRestoreOutputSchema, _null()]).optional();
+	},
+	"lastSnapshotAt": string().describe("When the latest completed snapshot was started (RFC 3339)").nullish(),
+	"lastSnapshotId": string().describe("Cloud ID of the latest completed snapshot, if any").nullish(),
+	"ordinal": int().min(0).describe("Replica ordinal the volume belongs to"),
+	"volumeId": string().describe("Cloud ID of the volume (EBS volume ID, Persistent Disk name, or Managed Disk ID)"),
+	"zone": string().describe("Zone the volume lives in")
+}).describe("A replica's persistent volume and its latest completed snapshot.");
+object({
+	"currentReplicas": int().min(0).describe("Number of current replicas"),
+	"desiredReplicas": int().min(0).describe("Desired number of replicas"),
 	"internalDns": string().describe("Internal DNS name (e.g., \"api.svc\")"),
 	"name": string().describe("Container name in the managed container backend"),
 	"publicEndpoints": optional(object({}).catchall(lazy(() => PublicEndpointOutputSchema).describe("Runtime-resolved public endpoint metadata.")).describe("Public endpoints resolved for this container.")),
@@ -8803,6 +9387,12 @@ object({
 	},
 	get "status"() {
 		return ContainerStatusSchema.describe("Container status in the managed container backend.");
+	},
+	get "volumeBackups"() {
+		return union([VolumeBackupsStatusSchema, _null()]).optional();
+	},
+	get "volumes"() {
+		return array(VolumeOutputSchema.describe("A replica's persistent volume and its latest completed snapshot.")).describe("Persistent volumes, one per replica ordinal, with their latest snapshot.").optional();
 	}
 }).describe("Outputs generated by a successfully provisioned Container.");
 /**
@@ -8885,9 +9475,24 @@ const KubernetesSecretMountSchema = object({
 * Do not edit manually.
 */
 /**
+* @description Scheduled snapshots of a persistent volume.\n\nThe cloud\'s own scheduler takes the snapshots (AWS Data Lifecycle Manager,\na Compute Engine snapshot schedule, or Azure Disk Backup), so they keep being\ntaken while the deployment is unreachable. Snapshots are crash-consistent:\nthe volume as it would be after a sudden power loss. When a container is\ndeleted, Alien keeps one final snapshot of each volume.\n\nKubernetes deployments leave volume backups to the cluster\'s own tooling,\nand local deployments don\'t snapshot volumes. Neither reports volumes in\n`ContainerOutputs.volumes` or a `volumeBackups` status.
+*/
+const VolumeBackupsSchema = object({
+	"enabled": optional(boolean().describe("Whether snapshots are taken. Defaults to true.")),
+	"intervalHours": optional(int().min(0).describe("Hours between snapshots: 1, 2, 4, 6, 8, 12 or 24. Defaults to 24.")),
+	"retentionDays": optional(int().min(0).describe("Days each snapshot is kept, at most 365. Defaults to 7."))
+}).describe("Scheduled snapshots of a persistent volume.\n\nThe cloud's own scheduler takes the snapshots (AWS Data Lifecycle Manager,\na Compute Engine snapshot schedule, or Azure Disk Backup), so they keep being\ntaken while the deployment is unreachable. Snapshots are crash-consistent:\nthe volume as it would be after a sudden power loss. When a container is\ndeleted, Alien keeps one final snapshot of each volume.\n\nKubernetes deployments leave volume backups to the cluster's own tooling,\nand local deployments don't snapshot volumes. Neither reports volumes in\n`ContainerOutputs.volumes` or a `volumeBackups` status.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
 * @description Persistent storage configuration for stateful containers.
 */
 const PersistentStorageSchema = object({
+	get "backups"() {
+		return VolumeBackupsSchema.describe("Scheduled snapshots of a persistent volume.\n\nThe cloud's own scheduler takes the snapshots (AWS Data Lifecycle Manager,\na Compute Engine snapshot schedule, or Azure Disk Backup), so they keep being\ntaken while the deployment is unreachable. Snapshots are crash-consistent:\nthe volume as it would be after a sudden power loss. When a container is\ndeleted, Alien keeps one final snapshot of each volume.\n\nKubernetes deployments leave volume backups to the cluster's own tooling,\nand local deployments don't snapshot volumes. Neither reports volumes in\n`ContainerOutputs.volumes` or a `volumeBackups` status.").optional();
+	},
 	"mountPath": string().describe("Mount path inside the container"),
 	"size": string().describe("Storage size (e.g., \"100Gi\", \"500Gi\")")
 }).describe("Persistent storage configuration for stateful containers.");
@@ -9252,7 +9857,7 @@ object({
 	get "memory"() {
 		return ResourceSpecSchema.describe("Resource specification with min/desired values.").optional();
 	},
-	"permissions": string(),
+	"permissions": string().describe("Named workload permission profile. Absent means no workload cloud identity.").nullish(),
 	"pool": string().describe("Capacity group/pool to run on for backends that expose machine pools.").nullish(),
 	get "publicEndpoints"() {
 		return array(PublicEndpointSchema.describe("Public endpoint configuration for port-backed workload resources.")).describe("Public endpoints exposed by the daemon.").optional();
@@ -9286,6 +9891,7 @@ const DeployerSecretStoreSchema = _enum([
 const DeployerSecretLocationSchema = object({
 	"cliCommand": string().describe("Command that writes the value, with `<VALUE>` in place of the secret."),
 	"consoleUrl": string().describe("Cloud console page where the secret is created, when the store has one.").nullish(),
+	"deleteCommand": string().describe("Command that deletes the secret. Deleting a deployment keeps the\nsecrets the deployer wrote, since Alien never owned their values.").nullish(),
 	"name": string().describe("Full name of the secret in that store."),
 	get "store"() {
 		return DeployerSecretStoreSchema.describe("The secret store a deployer writes a vault-native secret into.");
@@ -9314,7 +9920,8 @@ object({
 	"required": boolean().describe("Whether the workload cannot start without it."),
 	get "status"() {
 		return DeployerSecretStatusSchema.describe("Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value.");
-	}
+	},
+	"version": string().describe("The secret store's version of the present value (never the value or a\nhash of it). A new version reaches workloads with the next update.").nullish()
 }).describe("The state of one deployer secret slot, reported with the deployment.");
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -9408,6 +10015,24 @@ object({
 * Do not edit manually.
 */
 /**
+* @description AWS DynamoDB KV binding configuration
+*/
+const DynamodbKvBindingSchema = object({
+	get "endpointUrl"() {
+		return union([BindingValueStringSchema, _null()]).optional();
+	},
+	get "region"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "tableName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("AWS DynamoDB KV binding configuration");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
 * @description A single DKIM CNAME record the operator must create in DNS.
 */
 const EmailDkimTokenSchema = object({
@@ -9564,6 +10189,413 @@ union([
 		"updatedAt": datetime().describe("Timestamp when the state changed")
 	})
 ]).describe("Represents a change to an event");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description External AI provider binding configuration (BYO-key).\n\nThe operator-supplied secret rides inside the binding via\n`BindingValue<String>`, so it is a literal on cloud platforms and gains\nKubernetes SecretRef resolution for free (`extract_binding_secrets` walks\nthe binding JSON for `secretRef`).
+*/
+const ExternalAiBindingSchema = object({
+	get "apiKey"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	"provider": string().describe("The external AI provider name (e.g., \"openai\", \"anthropic\")")
+}).describe("External AI provider binding configuration (BYO-key).\n\nThe operator-supplied secret rides inside the binding via\n`BindingValue<String>`, so it is a literal on cloud platforms and gains\nKubernetes SecretRef resolution for free (`extract_binding_secrets` walks\nthe binding JSON for `secretRef`).");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description GCP Firestore KV binding configuration
+*/
+const FirestoreKvBindingSchema = object({
+	get "collectionName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "databaseId"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "projectId"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("GCP Firestore KV binding configuration");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Local development KV binding configuration
+*/
+const LocalKvBindingSchema = object({
+	get "dataDir"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "keyPrefix"() {
+		return union([BindingValueStringSchema, _null()]).optional();
+	}
+}).describe("Local development KV binding configuration");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Redis KV binding configuration
+*/
+const RedisKvBindingSchema = object({
+	get "connectionUrl"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "database"() {
+		return union([BindingValueU8Schema, _null()]).optional();
+	},
+	get "keyPrefix"() {
+		return union([BindingValueStringSchema, _null()]).optional();
+	}
+}).describe("Redis KV binding configuration");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Azure Table Storage KV binding configuration
+*/
+const TableStorageKvBindingSchema = object({
+	get "accountName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "resourceGroupName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "tableName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Azure Table Storage KV binding configuration");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Represents a KV binding for key-value storage across platforms
+*/
+const KvBindingSchema = union([
+	lazy(() => DynamodbKvBindingSchema).and(object({ "service": _enum(["dynamodb"]) })).describe("AWS DynamoDB KV binding configuration"),
+	lazy(() => FirestoreKvBindingSchema).and(object({ "service": _enum(["firestore"]) })).describe("GCP Firestore KV binding configuration"),
+	lazy(() => TableStorageKvBindingSchema).and(object({ "service": _enum(["tablestorage"]) })).describe("Azure Table Storage KV binding configuration"),
+	lazy(() => RedisKvBindingSchema).and(object({ "service": _enum(["redis"]) })).describe("Redis KV binding configuration"),
+	lazy(() => LocalKvBindingSchema).and(object({ "service": _enum(["local-kv"]) })).describe("Local development KV binding configuration")
+]).describe("Represents a KV binding for key-value storage across platforms");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description TLS policy for an operator-provided / BYO Postgres database.\n\nUnlike libpq\'s ambiguous `prefer` mode, both choices map exactly to the\nconnection settings exposed by every supported SDK.
+*/
+const ExternalPostgresSslModeSchema = _enum(["verify-full", "disable"]).describe("TLS policy for an operator-provided / BYO Postgres database.\n\nUnlike libpq's ambiguous `prefer` mode, both choices map exactly to the\nconnection settings exposed by every supported SDK.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Operator-provided / BYO database binding.
+*/
+const ExternalPostgresBindingSchema = object({
+	get "database"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "host"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	"password": string().describe("Connection password as a concrete value, never an unresolved `SecretRef`: the platform\nmaterializes the Kubernetes secret into the pod env. The cloud variants carry a secret\nlocator instead."),
+	get "port"() {
+		return BindingValueU16Schema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "sslMode"() {
+		return ExternalPostgresSslModeSchema.describe("TLS policy for an operator-provided / BYO Postgres database.\n\nUnlike libpq's ambiguous `prefer` mode, both choices map exactly to the\nconnection settings exposed by every supported SDK.").optional();
+	},
+	get "username"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Operator-provided / BYO database binding.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Azure Flexible Server binding.
+*/
+const FlexibleServerPostgresBindingSchema = object({
+	get "database"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "host"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "passwordSecretUri"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "port"() {
+		return BindingValueU16Schema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "username"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Azure Flexible Server binding.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Local embedded Postgres binding.
+*/
+const LocalPostgresBindingSchema = object({
+	get "database"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "host"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	"password": string(),
+	get "port"() {
+		return BindingValueU16Schema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "username"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Local embedded Postgres binding.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Connection details for a Postgres database, one variant per backend.
+*/
+const PostgresBindingSchema = union([
+	lazy(() => AuroraPostgresBindingSchema).and(object({ "service": _enum(["aurora"]) })).describe("AWS Aurora Serverless v2 binding."),
+	lazy(() => CloudSqlPostgresBindingSchema).and(object({ "service": _enum(["cloud-sql"]) })).describe("GCP Cloud SQL binding."),
+	lazy(() => FlexibleServerPostgresBindingSchema).and(object({ "service": _enum(["flexible-server"]) })).describe("Azure Flexible Server binding."),
+	lazy(() => ExternalPostgresBindingSchema).and(object({ "service": _enum(["external"]) })).describe("Operator-provided / BYO database binding."),
+	lazy(() => LocalPostgresBindingSchema).and(object({ "service": _enum(["local-postgres"]) })).describe("Local embedded Postgres binding.")
+]).describe("Connection details for a Postgres database, one variant per backend.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Local queue parameters
+*/
+const LocalQueueBindingSchema = object({ get "queuePath"() {
+	return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+} }).describe("Local queue parameters");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description GCP Pub/Sub parameters
+*/
+const PubSubQueueBindingSchema = object({
+	get "subscription"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "topic"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("GCP Pub/Sub parameters");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Azure Service Bus parameters
+*/
+const ServiceBusQueueBindingSchema = object({
+	get "namespace"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "queueName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Azure Service Bus parameters");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description AWS SQS queue parameters
+*/
+const SqsQueueBindingSchema = object({ get "queueUrl"() {
+	return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+} }).describe("AWS SQS queue parameters");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Binding parameters for Queue at runtime or in templates.
+*/
+const QueueBindingSchema = union([
+	lazy(() => SqsQueueBindingSchema).and(object({ "service": _enum(["sqs"]) })).describe("AWS SQS queue parameters"),
+	lazy(() => PubSubQueueBindingSchema).and(object({ "service": _enum(["pubsub"]) })).describe("GCP Pub/Sub parameters"),
+	lazy(() => ServiceBusQueueBindingSchema).and(object({ "service": _enum(["servicebus"]) })).describe("Azure Service Bus parameters"),
+	lazy(() => LocalQueueBindingSchema).and(object({ "service": _enum(["local-queue"]) })).describe("Local queue parameters")
+]).describe("Binding parameters for Queue at runtime or in templates.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Google Cloud Storage binding configuration
+*/
+const GcsStorageBindingSchema = object({ get "bucketName"() {
+	return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+} }).describe("Google Cloud Storage binding configuration");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Local filesystem storage binding configuration
+*/
+const LocalStorageBindingSchema = object({ get "storagePath"() {
+	return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+} }).describe("Local filesystem storage binding configuration");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description S3 storage binding configuration.\n\nTargets AWS S3 by default. Setting `endpoint` targets any S3-compatible\nstore instead (MinIO, Ceph RGW, NetApp StorageGRID, Cloudflare R2, ...),\nwhich is how Kubernetes deployments outside a cloud account attach the\ncustomer\'s existing object storage.
+*/
+const S3StorageBindingSchema = object({
+	get "accessKeyId"() {
+		return union([BindingValueStringSchema, _null()]).optional();
+	},
+	get "bucketName"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "endpoint"() {
+		return union([BindingValueStringSchema, _null()]).optional();
+	},
+	"forcePathStyle": boolean().describe("Use path-style URLs (`endpoint/bucket/key`) instead of virtual-hosted\nones (`bucket.endpoint/key`). Defaults to `true` when `endpoint` is\nset, since most S3-compatible stores require it.").nullish(),
+	get "region"() {
+		return union([BindingValueStringSchema, _null()]).optional();
+	},
+	get "secretAccessKey"() {
+		return union([BindingValueStringSchema, _null()]).optional();
+	}
+}).describe("S3 storage binding configuration.\n\nTargets AWS S3 by default. Setting `endpoint` targets any S3-compatible\nstore instead (MinIO, Ceph RGW, NetApp StorageGRID, Cloudflare R2, ...),\nwhich is how Kubernetes deployments outside a cloud account attach the\ncustomer's existing object storage.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Service-type based storage binding that supports multiple storage providers
+*/
+const StorageBindingSchema = union([
+	lazy(() => S3StorageBindingSchema).and(object({ "service": _enum(["s3"]) })).describe("S3 storage binding configuration.\n\nTargets AWS S3 by default. Setting `endpoint` targets any S3-compatible\nstore instead (MinIO, Ceph RGW, NetApp StorageGRID, Cloudflare R2, ...),\nwhich is how Kubernetes deployments outside a cloud account attach the\ncustomer's existing object storage."),
+	lazy(() => BlobStorageBindingSchema).and(object({ "service": _enum(["blob"]) })).describe("Azure Blob Storage binding configuration"),
+	lazy(() => GcsStorageBindingSchema).and(object({ "service": _enum(["gcs"]) })).describe("Google Cloud Storage binding configuration"),
+	lazy(() => LocalStorageBindingSchema).and(object({ "service": _enum(["local-storage"]) })).describe("Local filesystem storage binding configuration")
+]).describe("Service-type based storage binding that supports multiple storage providers");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Azure Key Vault binding configuration
+*/
+const KeyVaultBindingSchema = object({ get "vaultName"() {
+	return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+} }).describe("Azure Key Vault binding configuration");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Kubernetes Secrets vault binding configuration
+*/
+const KubernetesSecretVaultBindingSchema = object({
+	get "namespace"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	get "vaultPrefix"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	}
+}).describe("Kubernetes Secrets vault binding configuration");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Local development vault binding (for testing/development)
+*/
+const LocalVaultBindingSchema = object({
+	get "dataDir"() {
+		return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+	},
+	"vaultName": string().describe("The vault name for local storage")
+}).describe("Local development vault binding (for testing/development)");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description AWS SSM Parameter Store vault binding configuration
+*/
+const ParameterStoreVaultBindingSchema = object({ get "vaultPrefix"() {
+	return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+} }).describe("AWS SSM Parameter Store vault binding configuration");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description GCP Secret Manager vault binding configuration
+*/
+const SecretManagerVaultBindingSchema = object({ get "vaultPrefix"() {
+	return BindingValueStringSchema.describe("Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret");
+} }).describe("GCP Secret Manager vault binding configuration");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Represents a vault binding for secure secret management
+*/
+const VaultBindingSchema = union([
+	lazy(() => ParameterStoreVaultBindingSchema).and(object({ "service": _enum(["parameter-store"]) })).describe("AWS SSM Parameter Store vault binding configuration"),
+	lazy(() => SecretManagerVaultBindingSchema).and(object({ "service": _enum(["secret-manager"]) })).describe("GCP Secret Manager vault binding configuration"),
+	lazy(() => KeyVaultBindingSchema).and(object({ "service": _enum(["key-vault"]) })).describe("Azure Key Vault binding configuration"),
+	lazy(() => KubernetesSecretVaultBindingSchema).and(object({ "service": _enum(["kubernetes-secret"]) })).describe("Kubernetes Secrets vault binding configuration"),
+	lazy(() => LocalVaultBindingSchema).and(object({ "service": _enum(["local-vault"]) })).describe("Local development vault binding (for testing/development)")
+]).describe("Represents a vault binding for secure secret management");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Represents a binding to pre-existing infrastructure.\n\nThe binding type must match the resource type it\'s applied to.\nValidated at runtime by the executor.
+*/
+const ExternalBindingSchema = union([
+	lazy(() => StorageBindingSchema).and(object({ "type": _enum(["storage"]) })).describe("Service-type based storage binding that supports multiple storage providers"),
+	lazy(() => QueueBindingSchema).and(object({ "type": _enum(["queue"]) })).describe("Binding parameters for Queue at runtime or in templates."),
+	lazy(() => KvBindingSchema).and(object({ "type": _enum(["kv"]) })).describe("Represents a KV binding for key-value storage across platforms"),
+	lazy(() => ArtifactRegistryBindingSchema).and(object({ "type": _enum(["artifact_registry"]) })).describe("Service-type based artifact registry binding that supports multiple registry providers"),
+	lazy(() => VaultBindingSchema).and(object({ "type": _enum(["vault"]) })).describe("Represents a vault binding for secure secret management"),
+	lazy(() => ContainerAppsEnvironmentBindingSchema).and(object({ "type": _enum(["container_apps_environment"]) })).describe("Binding configuration for a pre-existing Azure Container Apps Environment.\n\nUsed when deploying to an existing environment instead of having Alien provision one.\nThis is useful for shared environments (e.g., test infrastructure) or enterprise\nsetups where environments are managed by a separate team."),
+	lazy(() => PostgresBindingSchema).and(object({ "type": _enum(["postgres"]) })).describe("Connection details for a Postgres database, one variant per backend."),
+	lazy(() => ExternalAiBindingSchema).and(object({ "type": _enum(["ai"]) })).describe("External AI provider binding configuration (BYO-key).\n\nThe operator-supplied secret rides inside the binding via\n`BindingValue<String>`, so it is a literal on cloud platforms and gains\nKubernetes SecretRef resolution for free (`extract_binding_secrets` walks\nthe binding JSON for `secretRef`).")
+]).describe("Represents a binding to pre-existing infrastructure.\n\nThe binding type must match the resource type it's applied to.\nValidated at runtime by the executor.");
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Map from resource ID to external binding.\n\nValidated at runtime: binding type must match resource type.
+*/
+const ExternalBindingsSchema = object({}).catchall(lazy(() => ExternalBindingSchema).describe("Represents a binding to pre-existing infrastructure.\n\nThe binding type must match the resource type it's applied to.\nValidated at runtime by the executor.")).describe("Map from resource ID to external binding.\n\nValidated at runtime: binding type must match resource type.");
 object({ "engineId": string().describe("The engine's resource name, or the bare id it ends with.") }).describe("GCP Agent Platform reasoning-engine ImportData.\n\nEmitted only for a Frozen engine, which the setup stack creates. Vertex assigns the id, so it\nis read off the created resource rather than derived: the controller and the template beneath\nit address the engine by exactly this segment.");
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -9730,23 +10762,6 @@ object({
 	"vpcName": string().describe("VPC short name.").nullish(),
 	"vpcSelfLink": string().describe("VPC self-link. Absent when the controller will look up the\ndefault network at runtime.").nullish()
 }).describe("GCP Network ImportData — VPC + subnetwork + Cloud NAT topology.");
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
-/**
-* @description GCP-specific platform permission configuration
-*/
-const GcpPlatformPermissionSchema = object({
-	get "binding"() {
-		return BindingConfigurationGcpBindingSpecSchema.describe("Generic binding configuration for permissions");
-	},
-	"description": string().describe("Short admin-facing description of why this entry exists.").nullish(),
-	get "grant"() {
-		return PermissionGrantSchema.describe("Grant permissions for a specific cloud platform");
-	},
-	"label": string().describe("Stable admin-facing label for this permission entry.").nullish()
-}).describe("GCP-specific platform permission configuration");
 object({
 	"database": string().describe("Default database name."),
 	"databaseVersion": string().describe("Engine version the instance reports."),
@@ -10575,54 +11590,6 @@ const ManagementConfigSchema = union([
 * Do not edit manually.
 */
 /**
-* @description Platform-specific permission configurations
-*/
-const PlatformPermissionsSchema = object({
-	get "aws"() {
-		return array(AwsPlatformPermissionSchema.describe("AWS-specific platform permission configuration")).describe("AWS permission configurations").nullish();
-	},
-	get "azure"() {
-		return array(AzurePlatformPermissionSchema.describe("Azure-specific platform permission configuration")).describe("Azure permission configurations").nullish();
-	},
-	get "gcp"() {
-		return array(GcpPlatformPermissionSchema.describe("GCP-specific platform permission configuration")).describe("GCP permission configurations").nullish();
-	}
-}).describe("Platform-specific permission configurations");
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
-/**
-* @description A permission set that can be applied across different cloud platforms
-*/
-const PermissionSetSchema = object({
-	"description": string().describe("Human-readable description of what this permission set allows"),
-	"id": string().describe("Unique identifier for the permission set (e.g., \"storage/data-read\")"),
-	get "platforms"() {
-		return PlatformPermissionsSchema.describe("Platform-specific permission configurations");
-	}
-}).describe("A permission set that can be applied across different cloud platforms");
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
-/**
-* @description Reference to a permission set - either by name or inline definition
-*/
-const PermissionSetReferenceSchema = union([lazy(() => PermissionSetSchema), string()]).describe("Reference to a permission set - either by name or inline definition");
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
-/**
-* @description Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource
-*/
-const PermissionProfileSchema = object({}).catchall(array(lazy(() => PermissionSetReferenceSchema).describe("Reference to a permission set - either by name or inline definition"))).describe("Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource");
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
-/**
 * @description Management permissions configuration for stack management access
 */
 const ManagementPermissionsSchema = union([
@@ -11333,6 +12300,7 @@ object({
 }).describe("Outputs generated by a successfully provisioned ServiceAccount.");
 object({
 	"id": string().describe("Identifier for the service account. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]).\nMaximum 64 characters."),
+	"resourcePermissionSets": optional(object({}).catchall(array(lazy(() => PermissionSetSchema).describe("A permission set that can be applied across different cloud platforms"))).describe("Resolved grants for concrete resource IDs, captured for setup comparison.")),
 	get "stackPermissionSets"() {
 		return array(PermissionSetSchema.describe("A permission set that can be applied across different cloud platforms")).describe("Stack-level permission sets that apply to all resources in the stack.\nThese are derived from the \"*\" scope in the permission profile.\nResource-scoped permissions are handled by individual resource controllers.");
 	}
@@ -11377,7 +12345,9 @@ const StackSettingsSchema = object({
 	get "endpointAccess"() {
 		return EndpointAccessSchema.describe("Reachability of the deployment's public endpoints, fixed at setup.").optional();
 	},
-	"externalBindings": object({}).describe("External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms.").nullish(),
+	get "externalBindings"() {
+		return union([ExternalBindingsSchema, _null()]).optional();
+	},
 	get "heartbeats"() {
 		return HeartbeatsModeSchema.describe("How heartbeat health checks are handled.").optional();
 	},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alienplatform/sdk",
-  "version": "3.3.28",
+  "version": "3.3.29",
   "type": "module",
   "files": [
     "dist"
@@ -57,9 +57,9 @@
     "nice-grpc": "^2.1.11",
     "nice-grpc-common": "^2.0.2",
     "zod": "^4.5.2",
-    "@alienplatform/ai-gateway": "^3.3.28",
-    "@alienplatform/bindings": "^3.3.28",
-    "@alienplatform/core": "^3.3.28"
+    "@alienplatform/ai-gateway": "^3.3.29",
+    "@alienplatform/bindings": "^3.3.29",
+    "@alienplatform/core": "^3.3.29"
   },
   "scripts": {
     "build": "tsdown && tsc --emitDeclarationOnly",