@cat-factory/contracts 0.283.0 → 0.284.0

package/dist/environments.d.ts

@@ -1,12 +1,4 @@
 import * as v from 'valibot';
-/**
- * A reference to a credential by logical key. Resolves against the workspace's
- * encrypted secret bundle (supplied at registration), not an env var.
- */
-export declare const environmentSecretRefSchema: v.ObjectSchema<{
-    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-}, undefined>;
-export type EnvironmentSecretRef = v.InferOutput<typeof environmentSecretRefSchema>;
 /**
  * How the worker authenticates to the org's *management* API (the one we call to
  * provision/status/teardown). Covers the common schemes; each references its
@@ -260,733 +252,82 @@ export declare const environmentManifestSchema: v.ObjectSchema<{
             readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
             readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
             readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-        }, undefined>, undefined>;
-    }, undefined>;
-    /** Fallback TTL (ms) when the response carries no explicit expiry. */
-    readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
-    /**
-     * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a project
-     * reference, link-selection key, status map). The generic HttpEnvironmentProvider ignores it
-     * entirely; a custom backend — registered by reference into the app-owned
-     * `EnvironmentBackendRegistry` (see `backend/docs/native-environment-adapter.md`) — reads
-     * + validates it off the per-call
-     * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
-     * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
-     * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
-     * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
-     * (reuse the exported `UrlSafetyPolicy`).
-     */
-    readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-}, undefined>;
-export type EnvironmentManifest = v.InferOutput<typeof environmentManifestSchema>;
-/**
- * The provision type a service declares — the INPUT SHAPE it produces. `infraless` means
- * the service stands up no environment (the Tester runs with no infra). A `custom` service
- * additionally pins a `manifestId` (see {@link serviceProvisioningSchema}).
- *
- * `cloudflare` is the per-PR Cloudflare Workers preview: unlike every other type the service
- * declares NOTHING repo-specific here, because the recipe lives in the repo's own preview
- * workflow rather than in a compose file or a manifest tree the platform reads. Declaring the
- * type is the whole service side of it.
- */
-export declare const provisionTypeSchema: v.PicklistSchema<["kubernetes", "docker-compose", "cloudflare", "custom", "infraless"], undefined>;
-export type ProvisionType = v.InferOutput<typeof provisionTypeSchema>;
-/**
- * Machine-readable cause of an environment-provisioning failure, surfaced on the run's
- * {@link AgentFailure.reason} so the SPA can render precise, actionable guidance instead of
- * string-matching the provider prose (the failure analogue of {@link ConflictReason}).
- *  - `deploy_runner_unwired` — the service's provider needs a container-backed deploy (a real
- *    render/apply) but no deploy runner is wired on this deployment. The fix is deployment-level
- *    config (a runner pool / `LOCAL_DEPLOY_RUNTIME` / the Cloudflare DeployContainer binding), so
- *    the SPA gates its runtime-specific hint on this reason rather than on the prose.
- */
-export declare const environmentFailureReasonSchema: v.PicklistSchema<["deploy_runner_unwired"], undefined>;
-export type EnvironmentFailureReason = v.InferOutput<typeof environmentFailureReasonSchema>;
-/**
- * The engine a workspace/user handler uses to stand up / connect to an environment for a
- * provision type. `none` is the synthetic engine for `infraless`. `local-docker` runs a
- * compose stack locally; `local-k3s`/`remote-kubernetes` drive a kube apiserver;
- * `cloudflare` drives a repo's preview workflow over the VCS deployments API;
- * `remote-custom` is the generic BYO HTTP management API.
- */
-export declare const infraEngineSchema: v.PicklistSchema<["local-docker", "local-k3s", "remote-kubernetes", "cloudflare", "remote-custom", "none"], undefined>;
-export type InfraEngine = v.InferOutput<typeof infraEngineSchema>;
-/** A custom-manifest-type identifier (lower-kebab slug). */
-export declare const manifestIdSchema: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-export type ManifestId = v.InferOutput<typeof manifestIdSchema>;
-/** The secret-bundle key the Kubernetes env backend reads the ServiceAccount token from. */
-export declare const KUBERNETES_ENV_TOKEN_SECRET_KEY = "apiToken";
-/**
- * How the manifests at `path` are turned into apiserver-ready resources. `raw` (the
- * default, and the only one the in-Worker native REST adapter handles) treats `path` as
- * a single manifest file or a flat directory of already-valid YAML docs. `kustomize`
- * treats `path` as an overlay directory (`kustomization.yaml` + `resources`/`components`/
- * `bases`) that must be `kustomize build`-rendered before apply — which only the
- * container-backed deploy adapter can do (it shells out to real `kustomize`/`helm`).
- */
-export declare const kubernetesRendererSchema: v.PicklistSchema<["raw", "kustomize"], undefined>;
-export type KubernetesRenderer = v.InferOutput<typeof kubernetesRendererSchema>;
-/**
- * Where the per-PR manifests are read from. `colocated` reads them from the block's
- * own repo at the PR head branch; `separate` reads them from a different repo (the
- * Kubernetes definition often lives outside the service repo). `renderer` (absent ⇒
- * `raw`) selects how `path` is turned into resources; `kustomize` requires the
- * container-backed deploy adapter.
- */
-export declare const kubernetesManifestSourceSchema: v.VariantSchema<"type", [v.ObjectSchema<{
-    readonly type: v.LiteralSchema<"colocated", undefined>;
-    /** File or directory path within the PR repo (read at the PR head branch). */
-    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
-    readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
-}, undefined>, v.ObjectSchema<{
-    readonly type: v.LiteralSchema<"separate", undefined>;
-    /** `owner/repo` of the manifests repo. */
-    readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
-    /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
-    readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-    /** File or directory path within the manifests repo. */
-    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
-    readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
-}, undefined>], undefined>;
-export type KubernetesManifestSource = v.InferOutput<typeof kubernetesManifestSourceSchema>;
-/** How the environment URL is derived once the manifests are applied. */
-export declare const kubernetesUrlSourceSchema: v.VariantSchema<"source", [v.ObjectSchema<{
-    readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-    /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
-    readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
-    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-}, undefined>, v.ObjectSchema<{
-    readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-    /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
-    readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-}, undefined>, v.ObjectSchema<{
-    readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-    /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
-    readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
-    readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
-    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-}, undefined>, v.ObjectSchema<{
-    readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-    /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
-    readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-}, undefined>, v.ObjectSchema<{
-    readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-    /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
-    readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-}, undefined>], undefined>;
-export type KubernetesUrlSource = v.InferOutput<typeof kubernetesUrlSourceSchema>;
-export declare const kubernetesEnvironmentConfigSchema: v.ObjectSchema<{
-    /** Human label for the connection (shown in the UI). */
-    readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
-    /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
-    readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-    /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
-    readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-    /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
-    readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
-    /**
-     * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
-     * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
-     * default derived from the PR number / block id.
-     */
-    readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
-    /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
-    readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
-        readonly type: v.LiteralSchema<"colocated", undefined>;
-        /** File or directory path within the PR repo (read at the PR head branch). */
-        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
-        readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
-    }, undefined>, v.ObjectSchema<{
-        readonly type: v.LiteralSchema<"separate", undefined>;
-        /** `owner/repo` of the manifests repo. */
-        readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
-        /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
-        readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-        /** File or directory path within the manifests repo. */
-        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
-        readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
-    }, undefined>], undefined>;
-    /** How the environment URL is derived once applied. */
-    readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
-        readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-        /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
-        readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
-        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-    }, undefined>, v.ObjectSchema<{
-        readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-        /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
-        readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-    }, undefined>, v.ObjectSchema<{
-        readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-        /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
-        readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
-        readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
-        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-    }, undefined>, v.ObjectSchema<{
-        readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-        /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
-        readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-    }, undefined>, v.ObjectSchema<{
-        readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-        /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
-        readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-    }, undefined>], undefined>;
-    /**
-     * Optional image reference made available to the manifests as `{{image}}` (e.g. a
-     * CI-built image tagged by branch/sha). Itself a template over the provision vars.
-     */
-    readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-    /** Fallback TTL (ms) after which the env is swept + torn down. */
-    readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
-    /**
-     * How long (seconds) the container deploy adapter waits for each Deployment to roll out
-     * before reporting the env still `provisioning` (the backend keeps polling). Only the
-     * container-backed render path honors it; absent ⇒ the harness default (180s).
-     */
-    readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
-    /** Extra labels stamped on the namespace + every applied resource. */
-    readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-    /** Extra annotations stamped on the namespace. */
-    readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-}, undefined>;
-export type KubernetesEnvironmentConfig = v.InferOutput<typeof kubernetesEnvironmentConfigSchema>;
-/**
- * A structured image override (the kustomize `images:` equivalent, generalizing the
- * legacy `{{image}}` text substitution). Matches a container image by `name` and
- * overrides its repo and/or tag/digest; the override values are templated over the
- * provision vars (e.g. `newTagTemplate: '{{branch}}'`).
- */
-export declare const kubernetesImageOverrideSchema: v.SchemaWithPipe<readonly [v.ObjectSchema<{
-    /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
-    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-    /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
-    readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-    /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
-    readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-    /** Replacement digest, templated; alternative to a tag. */
-    readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-}, undefined>, v.CheckAction<{
-    name: string;
-    newNameTemplate?: string | undefined;
-    newTagTemplate?: string | undefined;
-    digestTemplate?: string | undefined;
-}, "an image override must set at least one of newNameTemplate, newTagTemplate, or digestTemplate.">, v.CheckAction<{
-    name: string;
-    newNameTemplate?: string | undefined;
-    newTagTemplate?: string | undefined;
-    digestTemplate?: string | undefined;
-}, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>;
-export type KubernetesImageOverride = v.InferOutput<typeof kubernetesImageOverrideSchema>;
-/** A single templated `--set path=value` for a helm release. */
-export declare const kubernetesHelmSetSchema: v.ObjectSchema<{
-    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
-    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-    /** The value, templated over the provision vars. */
-    readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
-}, undefined>;
-export type KubernetesHelmSet = v.InferOutput<typeof kubernetesHelmSetSchema>;
-/**
- * A helm release the deploy adapter installs/upgrades (`helm upgrade --install`).
- * `scope: 'shared'` is a cluster singleton (installed once, never torn down per-PR —
- * e.g. an ingress/gateway controller); `per-environment` (the default) re-installs in
- * each per-PR namespace. The `version` pin is required so provisioning is deterministic.
- */
-export declare const kubernetesHelmReleaseSchema: v.ObjectSchema<{
-    /** Release name. */
-    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-    /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
-    readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-    /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
-    readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-    /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
-    readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-    /** Namespace to install into, templated; absent ⇒ the environment namespace. */
-    readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-    /** Inline `--values` overrides. */
-    readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-    /** Templated `--set` overrides. */
-    readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-        /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
-        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-        /** The value, templated over the provision vars. */
-        readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
-    }, undefined>, undefined>, undefined>;
-    /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
-    readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-        readonly secretRef: v.ObjectSchema<{
-            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-        }, undefined>;
-    }, undefined>, undefined>, undefined>;
-    readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
-}, undefined>;
-export type KubernetesHelmRelease = v.InferOutput<typeof kubernetesHelmReleaseSchema>;
-/** One entry inside an injected Secret: a logical key mapped to a secret-bundle ref OR a templated value. */
-export declare const kubernetesSecretEntrySchema: v.SchemaWithPipe<readonly [v.ObjectSchema<{
-    /** Key inside the rendered Secret / `.env`. */
-    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-    /** Resolve the value from the workspace encrypted bundle by key. */
-    readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
-        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-    }, undefined>, undefined>;
-    /** OR a non-secret value, templated over the provision vars. */
-    readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-}, undefined>, v.CheckAction<{
-    key: string;
-    secretRef?: {
-        key: string;
-    } | undefined;
-    valueTemplate?: string | undefined;
-}, "a secret entry must set exactly one of secretRef or valueTemplate.">]>;
-export type KubernetesSecretEntry = v.InferOutput<typeof kubernetesSecretEntrySchema>;
-/**
- * How the deploy adapter feeds resolved secret values in before apply, discriminated by
- * `mode`. The mapping of logical keys is in-repo intent; the values resolve from the
- * encrypted bundle at provision time (the config carries secret KEYS, never values).
- *
- * - `secret`: materialize a `Secret` resource named `secretName` directly in the namespace.
- * - `generatorEnvFile`: write the entries as a `KEY=value` `.env` file at `envFilePath`
- *   (repo-relative, inside the overlay tree) BEFORE `kustomize build`, so the overlay's own
- *   existing `secretGenerator` consumes it. This is the common ephemeral-environment shape
- *   where a Component declares `secretGenerator: { envs: ['.env'] }`, the Secret is named by
- *   the overlay, and the real `.env` is supplied at deploy time (e.g. from a secrets manager).
- *   Use this instead of `secret` when the manifests already declare a `secretGenerator`, so
- *   the two don't collide.
- */
-export declare const kubernetesSecretInjectionSchema: v.VariantSchema<"mode", [v.ObjectSchema<{
-    readonly mode: v.LiteralSchema<"secret", undefined>;
-    /** Target Secret name in the namespace. */
-    readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-    /** Secret `type`; absent ⇒ `Opaque`. */
-    readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-    readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-        /** Key inside the rendered Secret / `.env`. */
-        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-        /** Resolve the value from the workspace encrypted bundle by key. */
-        readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
-            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-        }, undefined>, undefined>;
-        /** OR a non-secret value, templated over the provision vars. */
-        readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-    }, undefined>, v.CheckAction<{
-        key: string;
-        secretRef?: {
-            key: string;
-        } | undefined;
-        valueTemplate?: string | undefined;
-    }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
-}, undefined>, v.ObjectSchema<{
-    readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
-    /**
-     * Repo-relative path within the overlay tree to write the `KEY=value` env file the
-     * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
-     * overlay names the Secret.
-     */
-    readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
-    readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-        /** Key inside the rendered Secret / `.env`. */
-        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-        /** Resolve the value from the workspace encrypted bundle by key. */
-        readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
-            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-        }, undefined>, undefined>;
-        /** OR a non-secret value, templated over the provision vars. */
-        readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-    }, undefined>, v.CheckAction<{
-        key: string;
-        secretRef?: {
-            key: string;
-        } | undefined;
-        valueTemplate?: string | undefined;
-    }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
-}, undefined>], undefined>;
-export type KubernetesSecretInjection = v.InferOutput<typeof kubernetesSecretInjectionSchema>;
-/**
- * The full Kubernetes provision config the deploy adapter consumes: the combined cluster +
- * URL + manifest-source config PLUS the kustomize/helm render inputs (image overrides, helm
- * releases, secret injections). It is assembled at provision time by MERGING the workspace
- * kube engine config (the "how": apiserver, sizing, shared helm releases) with the service's
- * own provisioning (the "what/where": manifest source, per-environment helm releases, image
- * overrides, secret injections) — so the provider reads everything it needs from one place.
- * The native in-Worker REST adapter ignores the render fields (raw manifests only); the
- * container-backed deploy adapter consumes them. Carries secret KEYS, never values.
- */
-export declare const kubernetesProvisionConfigSchema: v.ObjectSchema<{
-    /** Human label for the connection (shown in the UI). */
-    readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
-    /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
-    readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-    /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
-    readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-    /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
-    readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
-    /**
-     * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
-     * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
-     * default derived from the PR number / block id.
-     */
-    readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
-    /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
-    readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
-        readonly type: v.LiteralSchema<"colocated", undefined>;
-        /** File or directory path within the PR repo (read at the PR head branch). */
-        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
-        readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
-    }, undefined>, v.ObjectSchema<{
-        readonly type: v.LiteralSchema<"separate", undefined>;
-        /** `owner/repo` of the manifests repo. */
-        readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
-        /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
-        readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-        /** File or directory path within the manifests repo. */
-        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
-        readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
-    }, undefined>], undefined>;
-    /** How the environment URL is derived once applied. */
-    readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
-        readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-        /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
-        readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
-        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-    }, undefined>, v.ObjectSchema<{
-        readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-        /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
-        readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-    }, undefined>, v.ObjectSchema<{
-        readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-        /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
-        readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
-        readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
-        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-    }, undefined>, v.ObjectSchema<{
-        readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-        /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
-        readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-    }, undefined>, v.ObjectSchema<{
-        readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-        /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
-        readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-    }, undefined>], undefined>;
-    /**
-     * Optional image reference made available to the manifests as `{{image}}` (e.g. a
-     * CI-built image tagged by branch/sha). Itself a template over the provision vars.
-     */
-    readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-    /** Fallback TTL (ms) after which the env is swept + torn down. */
-    readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
-    /**
-     * How long (seconds) the container deploy adapter waits for each Deployment to roll out
-     * before reporting the env still `provisioning` (the backend keeps polling). Only the
-     * container-backed render path honors it; absent ⇒ the harness default (180s).
-     */
-    readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
-    /** Extra labels stamped on the namespace + every applied resource. */
-    readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-    /** Extra annotations stamped on the namespace. */
-    readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-    /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
-    readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-        /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
-        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-        /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
-        readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-        /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
-        readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-        /** Replacement digest, templated; alternative to a tag. */
-        readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-    }, undefined>, v.CheckAction<{
-        name: string;
-        newNameTemplate?: string | undefined;
-        newTagTemplate?: string | undefined;
-        digestTemplate?: string | undefined;
-    }, "an image override must set at least one of newNameTemplate, newTagTemplate, or digestTemplate.">, v.CheckAction<{
-        name: string;
-        newNameTemplate?: string | undefined;
-        newTagTemplate?: string | undefined;
-        digestTemplate?: string | undefined;
-    }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
-    /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
-    readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-        /** Release name. */
-        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-        /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
-        readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-        /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
-        readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-        /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
-        readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-        /** Namespace to install into, templated; absent ⇒ the environment namespace. */
-        readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-        /** Inline `--values` overrides. */
-        readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-        /** Templated `--set` overrides. */
-        readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-            /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
-            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** The value, templated over the provision vars. */
-            readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
-        }, undefined>, undefined>, undefined>;
-        /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
-        readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            readonly secretRef: v.ObjectSchema<{
-                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-            }, undefined>;
-        }, undefined>, undefined>, undefined>;
-        readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
-    }, undefined>, undefined>, undefined>;
-    /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
-    readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
-        readonly mode: v.LiteralSchema<"secret", undefined>;
-        /** Target Secret name in the namespace. */
-        readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-        /** Secret `type`; absent ⇒ `Opaque`. */
-        readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-        readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-            /** Key inside the rendered Secret / `.env`. */
-            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-            /** Resolve the value from the workspace encrypted bundle by key. */
-            readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
-                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-            }, undefined>, undefined>;
-            /** OR a non-secret value, templated over the provision vars. */
-            readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-        }, undefined>, v.CheckAction<{
-            key: string;
-            secretRef?: {
-                key: string;
-            } | undefined;
-            valueTemplate?: string | undefined;
-        }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
-    }, undefined>, v.ObjectSchema<{
-        readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
-        /**
-         * Repo-relative path within the overlay tree to write the `KEY=value` env file the
-         * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
-         * overlay names the Secret.
-         */
-        readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
-        readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-            /** Key inside the rendered Secret / `.env`. */
-            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-            /** Resolve the value from the workspace encrypted bundle by key. */
-            readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
-                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-            }, undefined>, undefined>;
-            /** OR a non-secret value, templated over the provision vars. */
-            readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-        }, undefined>, v.CheckAction<{
-            key: string;
-            secretRef?: {
-                key: string;
-            } | undefined;
-            valueTemplate?: string | undefined;
-        }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
-    }, undefined>], undefined>, undefined>, undefined>;
-}, undefined>;
-export type KubernetesProvisionConfig = v.InferOutput<typeof kubernetesProvisionConfigSchema>;
-/**
- * The AWS EKS provision config: the full Kubernetes provision config (an EKS apiserver is a
- * standard apiserver, so per-PR namespaces + manifest apply are identical) PLUS the AWS
- * `region` + `clusterName` needed to mint the IAM apiserver token. The AWS credentials ride
- * the secret bundle; the SigV4/STS minting lives in `@cat-factory/eks`.
- */
-export declare const eksProvisionConfigSchema: v.ObjectSchema<{
-    readonly region: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be an AWS region slug">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-    readonly clusterName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
-    readonly stsHost: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a bare host or host:port">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 255, undefined>]>, undefined>;
-    /** Human label for the connection (shown in the UI). */
-    readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
-    /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
-    readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-    /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
-    readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-    /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
-    readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
-    /**
-     * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
-     * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
-     * default derived from the PR number / block id.
-     */
-    readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
-    /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
-    readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
-        readonly type: v.LiteralSchema<"colocated", undefined>;
-        /** File or directory path within the PR repo (read at the PR head branch). */
-        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
-        readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
-    }, undefined>, v.ObjectSchema<{
-        readonly type: v.LiteralSchema<"separate", undefined>;
-        /** `owner/repo` of the manifests repo. */
-        readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
-        /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
-        readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-        /** File or directory path within the manifests repo. */
-        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
-        readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
-    }, undefined>], undefined>;
-    /** How the environment URL is derived once applied. */
-    readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
-        readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-        /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
-        readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
-        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-    }, undefined>, v.ObjectSchema<{
-        readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-        /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
-        readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-    }, undefined>, v.ObjectSchema<{
-        readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-        /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
-        readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
-        readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
-        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-    }, undefined>, v.ObjectSchema<{
-        readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-        /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
-        readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-    }, undefined>, v.ObjectSchema<{
-        readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-        /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
-        readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
-    }, undefined>], undefined>;
-    /**
-     * Optional image reference made available to the manifests as `{{image}}` (e.g. a
-     * CI-built image tagged by branch/sha). Itself a template over the provision vars.
-     */
-    readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-    /** Fallback TTL (ms) after which the env is swept + torn down. */
-    readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
-    /**
-     * How long (seconds) the container deploy adapter waits for each Deployment to roll out
-     * before reporting the env still `provisioning` (the backend keeps polling). Only the
-     * container-backed render path honors it; absent ⇒ the harness default (180s).
-     */
-    readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
-    /** Extra labels stamped on the namespace + every applied resource. */
-    readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-    /** Extra annotations stamped on the namespace. */
-    readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-    /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
-    readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-        /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
-        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-        /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
-        readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-        /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
-        readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-        /** Replacement digest, templated; alternative to a tag. */
-        readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-    }, undefined>, v.CheckAction<{
-        name: string;
-        newNameTemplate?: string | undefined;
-        newTagTemplate?: string | undefined;
-        digestTemplate?: string | undefined;
-    }, "an image override must set at least one of newNameTemplate, newTagTemplate, or digestTemplate.">, v.CheckAction<{
-        name: string;
-        newNameTemplate?: string | undefined;
-        newTagTemplate?: string | undefined;
-        digestTemplate?: string | undefined;
-    }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
-    /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
-    readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-        /** Release name. */
-        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-        /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
-        readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-        /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
-        readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-        /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
-        readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-        /** Namespace to install into, templated; absent ⇒ the environment namespace. */
-        readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-        /** Inline `--values` overrides. */
-        readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-        /** Templated `--set` overrides. */
-        readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-            /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
-            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** The value, templated over the provision vars. */
-            readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
-        }, undefined>, undefined>, undefined>;
-        /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
-        readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            readonly secretRef: v.ObjectSchema<{
-                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-            }, undefined>;
-        }, undefined>, undefined>, undefined>;
-        readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
-    }, undefined>, undefined>, undefined>;
-    /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
-    readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
-        readonly mode: v.LiteralSchema<"secret", undefined>;
-        /** Target Secret name in the namespace. */
-        readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-        /** Secret `type`; absent ⇒ `Opaque`. */
-        readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-        readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-            /** Key inside the rendered Secret / `.env`. */
-            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-            /** Resolve the value from the workspace encrypted bundle by key. */
-            readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
-                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-            }, undefined>, undefined>;
-            /** OR a non-secret value, templated over the provision vars. */
-            readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-        }, undefined>, v.CheckAction<{
-            key: string;
-            secretRef?: {
-                key: string;
-            } | undefined;
-            valueTemplate?: string | undefined;
-        }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
-    }, undefined>, v.ObjectSchema<{
-        readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
-        /**
-         * Repo-relative path within the overlay tree to write the `KEY=value` env file the
-         * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
-         * overlay names the Secret.
-         */
-        readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
-        readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-            /** Key inside the rendered Secret / `.env`. */
-            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-            /** Resolve the value from the workspace encrypted bundle by key. */
-            readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
-                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
-            }, undefined>, undefined>;
-            /** OR a non-secret value, templated over the provision vars. */
-            readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-        }, undefined>, v.CheckAction<{
-            key: string;
-            secretRef?: {
-                key: string;
-            } | undefined;
-            valueTemplate?: string | undefined;
-        }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
-    }, undefined>], undefined>, undefined>, undefined>;
+            readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        }, undefined>, undefined>;
+    }, undefined>;
+    /** Fallback TTL (ms) when the response carries no explicit expiry. */
+    readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+    /**
+     * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a project
+     * reference, link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+     * entirely; a custom backend — registered by reference into the app-owned
+     * `EnvironmentBackendRegistry` (see `backend/docs/native-environment-adapter.md`) — reads
+     * + validates it off the per-call
+     * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+     * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+     * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+     * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+     * (reuse the exported `UrlSafetyPolicy`).
+     */
+    readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
 }, undefined>;
-export type EksProvisionConfig = v.InferOutput<typeof eksProvisionConfigSchema>;
+export type EnvironmentManifest = v.InferOutput<typeof environmentManifestSchema>;
+/**
+ * The provision type a service declares — the INPUT SHAPE it produces. `infraless` means
+ * the service stands up no environment (the Tester runs with no infra). A `custom` service
+ * additionally pins a `manifestId` (see {@link serviceProvisioningSchema}).
+ *
+ * `cloudflare` is the per-PR Cloudflare Workers preview: unlike every other type the service
+ * declares NOTHING repo-specific here, because the recipe lives in the repo's own preview
+ * workflow rather than in a compose file or a manifest tree the platform reads. Declaring the
+ * type is the whole service side of it.
+ */
+export declare const provisionTypeSchema: v.PicklistSchema<["kubernetes", "docker-compose", "cloudflare", "custom", "infraless"], undefined>;
+export type ProvisionType = v.InferOutput<typeof provisionTypeSchema>;
+/**
+ * Machine-readable cause of an environment-provisioning failure, surfaced on the run's
+ * {@link AgentFailure.reason} so the SPA can render precise, actionable guidance instead of
+ * string-matching the provider prose (the failure analogue of {@link ConflictReason}).
+ *  - `deploy_runner_unwired` — the service's provider needs a container-backed deploy (a real
+ *    render/apply) but no deploy runner is wired on this deployment. The fix is deployment-level
+ *    config (a runner pool / `LOCAL_DEPLOY_RUNTIME` / the Cloudflare DeployContainer binding), so
+ *    the SPA gates its runtime-specific hint on this reason rather than on the prose.
+ */
+export declare const environmentFailureReasonSchema: v.PicklistSchema<["deploy_runner_unwired"], undefined>;
+export type EnvironmentFailureReason = v.InferOutput<typeof environmentFailureReasonSchema>;
+/**
+ * The engine a workspace/user handler uses to stand up / connect to an environment for a
+ * provision type. `none` is the synthetic engine for `infraless`. `local-docker` runs a
+ * compose stack locally; `local-k3s`/`remote-kubernetes` drive a kube apiserver;
+ * `cloudflare` drives a repo's preview workflow over the VCS deployments API;
+ * `remote-custom` is the generic BYO HTTP management API.
+ */
+export declare const infraEngineSchema: v.PicklistSchema<["local-docker", "local-k3s", "remote-kubernetes", "cloudflare", "remote-custom", "none"], undefined>;
+export type InfraEngine = v.InferOutput<typeof infraEngineSchema>;
+/** A custom-manifest-type identifier (lower-kebab slug). */
+export declare const manifestIdSchema: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+export type ManifestId = v.InferOutput<typeof manifestIdSchema>;
 /** The secret-bundle key the Cloudflare env backend reads its VCS API token from. */
 export declare const CLOUDFLARE_ENV_TOKEN_SECRET_KEY = "githubToken";
 /** Default templates, exported so the provider, the UI hints and the docs cannot drift apart. */
 export declare const CLOUDFLARE_DEFAULT_WORKER_NAME_TEMPLATE = "cat-factory-pr-{{pullNumber}}";
 export declare const CLOUDFLARE_DEFAULT_ENVIRONMENT_NAME_TEMPLATE = "pr-{{pullNumber}}";
+/**
+ * What it takes to REACH the VCS API this backend drives, split out of the full config for the
+ * reason {@link kubernetesConnectionConfigSchema} states: teardown posts one `inactive`
+ * deployment status and needs nothing else, so a `workersSubdomain` or name template that
+ * stopped matching the contract must not be what strands a live preview.
+ *
+ * `apiBaseUrl` stays validated because the fallback is the PUBLIC API root: silently posting a
+ * GitHub Enterprise deployment's teardown to `api.github.com` is a wrong-host write, not a
+ * degradation. Absent is fine (that IS the documented default); present but unusable is not.
+ */
+export declare const cloudflareConnectionConfigSchema: v.ObjectSchema<{
+    /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
+    readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+}, undefined>;
+export type CloudflareConnectionConfig = v.InferOutput<typeof cloudflareConnectionConfigSchema>;
 /**
  * The Cloudflare preview engine connection (the "how"). Everything here is non-secret; the
  * VCS API token rides the encrypted secret bundle under
@@ -999,6 +340,8 @@ export declare const CLOUDFLARE_DEFAULT_ENVIRONMENT_NAME_TEMPLATE = "pr-{{pullNu
  * deployment that copied `deploy/preview` unmodified sets neither.
  */
 export declare const cloudflareEnvironmentConfigSchema: v.ObjectSchema<{
+    /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
+    readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
     readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
     /**
      * The account's `*.workers.dev` subdomain — the preview URL is
@@ -1007,8 +350,6 @@ export declare const cloudflareEnvironmentConfigSchema: v.ObjectSchema<{
      * takes minutes.
      */
     readonly workersSubdomain: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 63, undefined>, v.RegexAction<string, "must be a bare workers.dev subdomain label, e.g. \"my-account\"">]>;
-    /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
-    readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
     /**
      * `owner/repo` carrying the preview workflow. Absent ⇒ THE BLOCK'S OWN REPO, resolved per
      * provision — which is the point of a built-in backend over a pasted manifest: one handler
@@ -1178,90 +519,53 @@ export declare const environmentBackendConfigSchema: v.VariantSchema<"kind", [v.
 }, undefined>, v.ObjectSchema<{
     readonly kind: v.LiteralSchema<"kubernetes", undefined>;
     readonly kubernetes: v.ObjectSchema<{
-        /** Human label for the connection (shown in the UI). */
-        readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
-        /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
         readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-        /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
         readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-        /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
         readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
-        /**
-         * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
-         * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
-         * default derived from the PR number / block id.
-         */
+        readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
         readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
-        /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
         readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
             readonly type: v.LiteralSchema<"colocated", undefined>;
-            /** File or directory path within the PR repo (read at the PR head branch). */
             readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
             readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly type: v.LiteralSchema<"separate", undefined>;
-            /** `owner/repo` of the manifests repo. */
             readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
-            /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
             readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-            /** File or directory path within the manifests repo. */
             readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
             readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
         }, undefined>], undefined>;
-        /** How the environment URL is derived once applied. */
         readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
             readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-            /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
             readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-            /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
             readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-            /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
             readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
             readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-            /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
             readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-            /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
             readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>], undefined>;
-        /**
-         * Optional image reference made available to the manifests as `{{image}}` (e.g. a
-         * CI-built image tagged by branch/sha). Itself a template over the provision vars.
-         */
         readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-        /** Fallback TTL (ms) after which the env is swept + torn down. */
         readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
-        /**
-         * How long (seconds) the container deploy adapter waits for each Deployment to roll out
-         * before reporting the env still `provisioning` (the backend keeps polling). Only the
-         * container-backed render path honors it; absent ⇒ the harness default (180s).
-         */
         readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
-        /** Extra labels stamped on the namespace + every applied resource. */
         readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-        /** Extra annotations stamped on the namespace. */
         readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-        /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
         readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-            /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
             readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
             readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-            /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
             readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-            /** Replacement digest, templated; alternative to a tag. */
             readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
         }, undefined>, v.CheckAction<{
             name: string;
@@ -1274,28 +578,17 @@ export declare const environmentBackendConfigSchema: v.VariantSchema<"kind", [v.
             newTagTemplate?: string | undefined;
             digestTemplate?: string | undefined;
         }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
-        /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
         readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-            /** Release name. */
             readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
             readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
             readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-            /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
             readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-            /** Namespace to install into, templated; absent ⇒ the environment namespace. */
             readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-            /** Inline `--values` overrides. */
             readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-            /** Templated `--set` overrides. */
             readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** The value, templated over the provision vars. */
                 readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
             }, undefined>, undefined>, undefined>;
-            /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
             readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                 readonly secretRef: v.ObjectSchema<{
@@ -1304,21 +597,15 @@ export declare const environmentBackendConfigSchema: v.VariantSchema<"kind", [v.
             }, undefined>, undefined>, undefined>;
             readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
         }, undefined>, undefined>, undefined>;
-        /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
         readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
             readonly mode: v.LiteralSchema<"secret", undefined>;
-            /** Target Secret name in the namespace. */
             readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** Secret `type`; absent ⇒ `Opaque`. */
             readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
             readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                /** Key inside the rendered Secret / `.env`. */
                 readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-                /** Resolve the value from the workspace encrypted bundle by key. */
                 readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                 }, undefined>, undefined>;
-                /** OR a non-secret value, templated over the provision vars. */
                 readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             }, undefined>, v.CheckAction<{
                 key: string;
@@ -1329,20 +616,12 @@ export declare const environmentBackendConfigSchema: v.VariantSchema<"kind", [v.
             }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
-            /**
-             * Repo-relative path within the overlay tree to write the `KEY=value` env file the
-             * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
-             * overlay names the Secret.
-             */
             readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
             readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                /** Key inside the rendered Secret / `.env`. */
                 readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-                /** Resolve the value from the workspace encrypted bundle by key. */
                 readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                 }, undefined>, undefined>;
-                /** OR a non-secret value, templated over the provision vars. */
                 readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             }, undefined>, v.CheckAction<{
                 key: string;
@@ -1359,90 +638,53 @@ export declare const environmentBackendConfigSchema: v.VariantSchema<"kind", [v.
         readonly region: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be an AWS region slug">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
         readonly clusterName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
         readonly stsHost: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a bare host or host:port">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 255, undefined>]>, undefined>;
-        /** Human label for the connection (shown in the UI). */
-        readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
-        /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
         readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-        /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
         readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-        /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
         readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
-        /**
-         * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
-         * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
-         * default derived from the PR number / block id.
-         */
+        readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
         readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
-        /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
         readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
             readonly type: v.LiteralSchema<"colocated", undefined>;
-            /** File or directory path within the PR repo (read at the PR head branch). */
             readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
             readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly type: v.LiteralSchema<"separate", undefined>;
-            /** `owner/repo` of the manifests repo. */
             readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
-            /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
             readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-            /** File or directory path within the manifests repo. */
             readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
             readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
         }, undefined>], undefined>;
-        /** How the environment URL is derived once applied. */
         readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
             readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-            /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
             readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-            /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
             readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-            /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
             readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
             readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-            /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
             readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-            /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
             readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>], undefined>;
-        /**
-         * Optional image reference made available to the manifests as `{{image}}` (e.g. a
-         * CI-built image tagged by branch/sha). Itself a template over the provision vars.
-         */
         readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-        /** Fallback TTL (ms) after which the env is swept + torn down. */
         readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
-        /**
-         * How long (seconds) the container deploy adapter waits for each Deployment to roll out
-         * before reporting the env still `provisioning` (the backend keeps polling). Only the
-         * container-backed render path honors it; absent ⇒ the harness default (180s).
-         */
         readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
-        /** Extra labels stamped on the namespace + every applied resource. */
         readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-        /** Extra annotations stamped on the namespace. */
         readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-        /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
         readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-            /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
             readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
             readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-            /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
             readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-            /** Replacement digest, templated; alternative to a tag. */
             readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
         }, undefined>, v.CheckAction<{
             name: string;
@@ -1455,28 +697,17 @@ export declare const environmentBackendConfigSchema: v.VariantSchema<"kind", [v.
             newTagTemplate?: string | undefined;
             digestTemplate?: string | undefined;
         }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
-        /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
         readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-            /** Release name. */
             readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
             readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
             readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-            /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
             readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-            /** Namespace to install into, templated; absent ⇒ the environment namespace. */
             readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-            /** Inline `--values` overrides. */
             readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-            /** Templated `--set` overrides. */
             readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** The value, templated over the provision vars. */
                 readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
             }, undefined>, undefined>, undefined>;
-            /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
             readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                 readonly secretRef: v.ObjectSchema<{
@@ -1485,21 +716,15 @@ export declare const environmentBackendConfigSchema: v.VariantSchema<"kind", [v.
             }, undefined>, undefined>, undefined>;
             readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
         }, undefined>, undefined>, undefined>;
-        /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
         readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
             readonly mode: v.LiteralSchema<"secret", undefined>;
-            /** Target Secret name in the namespace. */
             readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** Secret `type`; absent ⇒ `Opaque`. */
             readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
             readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                /** Key inside the rendered Secret / `.env`. */
                 readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-                /** Resolve the value from the workspace encrypted bundle by key. */
                 readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                 }, undefined>, undefined>;
-                /** OR a non-secret value, templated over the provision vars. */
                 readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             }, undefined>, v.CheckAction<{
                 key: string;
@@ -1510,20 +735,12 @@ export declare const environmentBackendConfigSchema: v.VariantSchema<"kind", [v.
             }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
-            /**
-             * Repo-relative path within the overlay tree to write the `KEY=value` env file the
-             * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
-             * overlay names the Secret.
-             */
             readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
             readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                /** Key inside the rendered Secret / `.env`. */
                 readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-                /** Resolve the value from the workspace encrypted bundle by key. */
                 readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                 }, undefined>, undefined>;
-                /** OR a non-secret value, templated over the provision vars. */
                 readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             }, undefined>, v.CheckAction<{
                 key: string;
@@ -1537,6 +754,8 @@ export declare const environmentBackendConfigSchema: v.VariantSchema<"kind", [v.
 }, undefined>, v.ObjectSchema<{
     readonly kind: v.LiteralSchema<"cloudflare", undefined>;
     readonly cloudflare: v.ObjectSchema<{
+        /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
+        readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
         readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
         /**
          * The account's `*.workers.dev` subdomain — the preview URL is
@@ -1545,8 +764,6 @@ export declare const environmentBackendConfigSchema: v.VariantSchema<"kind", [v.
          * takes minutes.
          */
         readonly workersSubdomain: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 63, undefined>, v.RegexAction<string, "must be a bare workers.dev subdomain label, e.g. \"my-account\"">]>;
-        /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
-        readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
         /**
          * `owner/repo` carrying the preview workflow. Absent ⇒ THE BLOCK'S OWN REPO, resolved per
          * provision — which is the point of a built-in backend over a pasted manifest: one handler
@@ -1705,16 +922,12 @@ export declare const serviceProvisioningSchema: v.ObjectSchema<{
     /** `kubernetes`: where the per-PR manifests live (colocated in the PR repo, or a separate repo). */
     readonly manifestSource: v.OptionalSchema<v.VariantSchema<"type", [v.ObjectSchema<{
         readonly type: v.LiteralSchema<"colocated", undefined>;
-        /** File or directory path within the PR repo (read at the PR head branch). */
         readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
         readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
     }, undefined>, v.ObjectSchema<{
         readonly type: v.LiteralSchema<"separate", undefined>;
-        /** `owner/repo` of the manifests repo. */
         readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
-        /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
         readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-        /** File or directory path within the manifests repo. */
         readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
         readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
     }, undefined>], undefined>, undefined>;
@@ -1890,13 +1103,9 @@ export declare const serviceProvisioningSchema: v.ObjectSchema<{
      * native REST adapter ignores these (raw manifests). See the schemas above.
      */
     readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-        /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
         readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-        /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
         readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-        /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
         readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-        /** Replacement digest, templated; alternative to a tag. */
         readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
     }, undefined>, v.CheckAction<{
         name: string;
@@ -1910,26 +1119,16 @@ export declare const serviceProvisioningSchema: v.ObjectSchema<{
         digestTemplate?: string | undefined;
     }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
     readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-        /** Release name. */
         readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-        /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
         readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-        /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
         readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-        /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
         readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-        /** Namespace to install into, templated; absent ⇒ the environment namespace. */
         readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-        /** Inline `--values` overrides. */
         readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-        /** Templated `--set` overrides. */
         readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-            /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
             readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** The value, templated over the provision vars. */
             readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
         }, undefined>, undefined>, undefined>;
-        /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
         readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
             readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
             readonly secretRef: v.ObjectSchema<{
@@ -1940,18 +1139,13 @@ export declare const serviceProvisioningSchema: v.ObjectSchema<{
     }, undefined>, undefined>, undefined>;
     readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
         readonly mode: v.LiteralSchema<"secret", undefined>;
-        /** Target Secret name in the namespace. */
         readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-        /** Secret `type`; absent ⇒ `Opaque`. */
         readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
         readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-            /** Key inside the rendered Secret / `.env`. */
             readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-            /** Resolve the value from the workspace encrypted bundle by key. */
             readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                 readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
             }, undefined>, undefined>;
-            /** OR a non-secret value, templated over the provision vars. */
             readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
         }, undefined>, v.CheckAction<{
             key: string;
@@ -1962,20 +1156,12 @@ export declare const serviceProvisioningSchema: v.ObjectSchema<{
         }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
     }, undefined>, v.ObjectSchema<{
         readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
-        /**
-         * Repo-relative path within the overlay tree to write the `KEY=value` env file the
-         * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
-         * overlay names the Secret.
-         */
         readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
         readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-            /** Key inside the rendered Secret / `.env`. */
             readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-            /** Resolve the value from the workspace encrypted bundle by key. */
             readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                 readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
             }, undefined>, undefined>;
-            /** OR a non-secret value, templated over the provision vars. */
             readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
         }, undefined>, v.CheckAction<{
             key: string;
@@ -2012,28 +1198,23 @@ export declare const kubernetesEngineConfigSchema: v.ObjectSchema<{
     /** How the environment URL is derived once applied. */
     readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
         readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-        /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
         readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
         readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
     }, undefined>, v.ObjectSchema<{
         readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-        /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
         readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
         readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
     }, undefined>, v.ObjectSchema<{
         readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-        /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
         readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
         readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
         readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
     }, undefined>, v.ObjectSchema<{
         readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-        /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
         readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
         readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
     }, undefined>, v.ObjectSchema<{
         readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-        /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
         readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
         readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
     }, undefined>], undefined>;
@@ -2058,26 +1239,16 @@ export declare const kubernetesEngineConfigSchema: v.ObjectSchema<{
      * with the service's own (per-environment) `helmReleases` at provision time.
      */
     readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-        /** Release name. */
         readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-        /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
         readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-        /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
         readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-        /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
         readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-        /** Namespace to install into, templated; absent ⇒ the environment namespace. */
         readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-        /** Inline `--values` overrides. */
         readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-        /** Templated `--set` overrides. */
         readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-            /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
             readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** The value, templated over the provision vars. */
             readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
         }, undefined>, undefined>, undefined>;
-        /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
         readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
             readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
             readonly secretRef: v.ObjectSchema<{
@@ -2247,28 +1418,23 @@ export declare const infraHandlerConfigSchema: v.VariantSchema<"engine", [v.Obje
         /** How the environment URL is derived once applied. */
         readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
             readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-            /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
             readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-            /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
             readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-            /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
             readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
             readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-            /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
             readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-            /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
             readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>], undefined>;
@@ -2293,26 +1459,16 @@ export declare const infraHandlerConfigSchema: v.VariantSchema<"engine", [v.Obje
          * with the service's own (per-environment) `helmReleases` at provision time.
          */
         readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-            /** Release name. */
             readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
             readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
             readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-            /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
             readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-            /** Namespace to install into, templated; absent ⇒ the environment namespace. */
             readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-            /** Inline `--values` overrides. */
             readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-            /** Templated `--set` overrides. */
             readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** The value, templated over the provision vars. */
                 readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
             }, undefined>, undefined>, undefined>;
-            /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
             readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                 readonly secretRef: v.ObjectSchema<{
@@ -2343,28 +1499,23 @@ export declare const infraHandlerConfigSchema: v.VariantSchema<"engine", [v.Obje
         /** How the environment URL is derived once applied. */
         readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
             readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-            /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
             readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-            /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
             readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-            /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
             readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
             readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-            /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
             readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-            /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
             readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
             readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
         }, undefined>], undefined>;
@@ -2389,26 +1540,16 @@ export declare const infraHandlerConfigSchema: v.VariantSchema<"engine", [v.Obje
          * with the service's own (per-environment) `helmReleases` at provision time.
          */
         readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-            /** Release name. */
             readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
             readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
             readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-            /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
             readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-            /** Namespace to install into, templated; absent ⇒ the environment namespace. */
             readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-            /** Inline `--values` overrides. */
             readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-            /** Templated `--set` overrides. */
             readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** The value, templated over the provision vars. */
                 readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
             }, undefined>, undefined>, undefined>;
-            /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
             readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                 readonly secretRef: v.ObjectSchema<{
@@ -2421,6 +1562,8 @@ export declare const infraHandlerConfigSchema: v.VariantSchema<"engine", [v.Obje
 }, undefined>, v.ObjectSchema<{
     readonly engine: v.LiteralSchema<"cloudflare", undefined>;
     readonly cloudflare: v.ObjectSchema<{
+        /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
+        readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
         readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
         /**
          * The account's `*.workers.dev` subdomain — the preview URL is
@@ -2429,8 +1572,6 @@ export declare const infraHandlerConfigSchema: v.VariantSchema<"engine", [v.Obje
          * takes minutes.
          */
         readonly workersSubdomain: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 63, undefined>, v.RegexAction<string, "must be a bare workers.dev subdomain label, e.g. \"my-account\"">]>;
-        /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
-        readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
         /**
          * `owner/repo` carrying the preview workflow. Absent ⇒ THE BLOCK'S OWN REPO, resolved per
          * provision — which is the point of a built-in backend over a pasted manifest: one handler
@@ -2787,28 +1928,23 @@ export declare const environmentHandlerViewSchema: v.ObjectSchema<{
             /** How the environment URL is derived once applied. */
             readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
                 readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
                 readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
                 readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
                 readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
                 readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
                 readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>], undefined>;
@@ -2833,26 +1969,16 @@ export declare const environmentHandlerViewSchema: v.ObjectSchema<{
              * with the service's own (per-environment) `helmReleases` at provision time.
              */
             readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Release name. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
                 readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
                 readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
                 readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
                 readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Inline `--values` overrides. */
                 readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-                /** Templated `--set` overrides. */
                 readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                    /** The value, templated over the provision vars. */
                     readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
                 }, undefined>, undefined>, undefined>;
-                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
                 readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                     readonly secretRef: v.ObjectSchema<{
@@ -2883,28 +2009,23 @@ export declare const environmentHandlerViewSchema: v.ObjectSchema<{
             /** How the environment URL is derived once applied. */
             readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
                 readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
                 readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
                 readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
                 readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
                 readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
                 readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>], undefined>;
@@ -2929,26 +2050,16 @@ export declare const environmentHandlerViewSchema: v.ObjectSchema<{
              * with the service's own (per-environment) `helmReleases` at provision time.
              */
             readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Release name. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
                 readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
                 readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
                 readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
                 readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Inline `--values` overrides. */
                 readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-                /** Templated `--set` overrides. */
                 readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                    /** The value, templated over the provision vars. */
                     readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
                 }, undefined>, undefined>, undefined>;
-                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
                 readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                     readonly secretRef: v.ObjectSchema<{
@@ -2961,6 +2072,8 @@ export declare const environmentHandlerViewSchema: v.ObjectSchema<{
     }, undefined>, v.ObjectSchema<{
         readonly engine: v.LiteralSchema<"cloudflare", undefined>;
         readonly cloudflare: v.ObjectSchema<{
+            /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
+            readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
             /**
              * The account's `*.workers.dev` subdomain — the preview URL is
@@ -2969,8 +2082,6 @@ export declare const environmentHandlerViewSchema: v.ObjectSchema<{
              * takes minutes.
              */
             readonly workersSubdomain: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 63, undefined>, v.RegexAction<string, "must be a bare workers.dev subdomain label, e.g. \"my-account\"">]>;
-            /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
-            readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             /**
              * `owner/repo` carrying the preview workflow. Absent ⇒ THE BLOCK'S OWN REPO, resolved per
              * provision — which is the point of a built-in backend over a pasted manifest: one handler
@@ -3281,28 +2392,23 @@ export declare const registerEnvironmentHandlerSchema: v.ObjectSchema<{
             /** How the environment URL is derived once applied. */
             readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
                 readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
                 readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
                 readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
                 readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
                 readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
                 readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>], undefined>;
@@ -3327,26 +2433,16 @@ export declare const registerEnvironmentHandlerSchema: v.ObjectSchema<{
              * with the service's own (per-environment) `helmReleases` at provision time.
              */
             readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Release name. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
                 readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
                 readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
                 readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
                 readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Inline `--values` overrides. */
                 readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-                /** Templated `--set` overrides. */
                 readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                    /** The value, templated over the provision vars. */
                     readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
                 }, undefined>, undefined>, undefined>;
-                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
                 readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                     readonly secretRef: v.ObjectSchema<{
@@ -3377,28 +2473,23 @@ export declare const registerEnvironmentHandlerSchema: v.ObjectSchema<{
             /** How the environment URL is derived once applied. */
             readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
                 readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
                 readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
                 readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
                 readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
                 readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
                 readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>], undefined>;
@@ -3423,26 +2514,16 @@ export declare const registerEnvironmentHandlerSchema: v.ObjectSchema<{
              * with the service's own (per-environment) `helmReleases` at provision time.
              */
             readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Release name. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
                 readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
                 readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
                 readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
                 readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Inline `--values` overrides. */
                 readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-                /** Templated `--set` overrides. */
                 readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                    /** The value, templated over the provision vars. */
                     readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
                 }, undefined>, undefined>, undefined>;
-                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
                 readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                     readonly secretRef: v.ObjectSchema<{
@@ -3455,6 +2536,8 @@ export declare const registerEnvironmentHandlerSchema: v.ObjectSchema<{
     }, undefined>, v.ObjectSchema<{
         readonly engine: v.LiteralSchema<"cloudflare", undefined>;
         readonly cloudflare: v.ObjectSchema<{
+            /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
+            readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
             /**
              * The account's `*.workers.dev` subdomain — the preview URL is
@@ -3463,8 +2546,6 @@ export declare const registerEnvironmentHandlerSchema: v.ObjectSchema<{
              * takes minutes.
              */
             readonly workersSubdomain: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 63, undefined>, v.RegexAction<string, "must be a bare workers.dev subdomain label, e.g. \"my-account\"">]>;
-            /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
-            readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             /**
              * `owner/repo` carrying the preview workflow. Absent ⇒ THE BLOCK'S OWN REPO, resolved per
              * provision — which is the point of a built-in backend over a pasted manifest: one handler
@@ -3775,28 +2856,23 @@ export declare const testEnvironmentHandlerSchema: v.ObjectSchema<{
             /** How the environment URL is derived once applied. */
             readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
                 readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
                 readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
                 readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
                 readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
                 readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
                 readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>], undefined>;
@@ -3821,26 +2897,16 @@ export declare const testEnvironmentHandlerSchema: v.ObjectSchema<{
              * with the service's own (per-environment) `helmReleases` at provision time.
              */
             readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Release name. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
                 readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
                 readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
                 readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
                 readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Inline `--values` overrides. */
                 readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-                /** Templated `--set` overrides. */
                 readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                    /** The value, templated over the provision vars. */
                     readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
                 }, undefined>, undefined>, undefined>;
-                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
                 readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                     readonly secretRef: v.ObjectSchema<{
@@ -3871,28 +2937,23 @@ export declare const testEnvironmentHandlerSchema: v.ObjectSchema<{
             /** How the environment URL is derived once applied. */
             readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
                 readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
                 readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
                 readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
                 readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
                 readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
                 readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>], undefined>;
@@ -3917,26 +2978,16 @@ export declare const testEnvironmentHandlerSchema: v.ObjectSchema<{
              * with the service's own (per-environment) `helmReleases` at provision time.
              */
             readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Release name. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
                 readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
                 readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
                 readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
                 readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Inline `--values` overrides. */
                 readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-                /** Templated `--set` overrides. */
                 readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                    /** The value, templated over the provision vars. */
                     readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
                 }, undefined>, undefined>, undefined>;
-                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
                 readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                     readonly secretRef: v.ObjectSchema<{
@@ -3949,6 +3000,8 @@ export declare const testEnvironmentHandlerSchema: v.ObjectSchema<{
     }, undefined>, v.ObjectSchema<{
         readonly engine: v.LiteralSchema<"cloudflare", undefined>;
         readonly cloudflare: v.ObjectSchema<{
+            /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
+            readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
             /**
              * The account's `*.workers.dev` subdomain — the preview URL is
@@ -3957,8 +3010,6 @@ export declare const testEnvironmentHandlerSchema: v.ObjectSchema<{
              * takes minutes.
              */
             readonly workersSubdomain: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 63, undefined>, v.RegexAction<string, "must be a bare workers.dev subdomain label, e.g. \"my-account\"">]>;
-            /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
-            readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             /**
              * `owner/repo` carrying the preview workflow. Absent ⇒ THE BLOCK'S OWN REPO, resolved per
              * provision — which is the point of a built-in backend over a pasted manifest: one handler
@@ -4270,28 +3321,23 @@ export declare const upsertEnvironmentUserHandlerBodySchema: v.ObjectSchema<{
             /** How the environment URL is derived once applied. */
             readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
                 readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
                 readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
                 readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
                 readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
                 readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
                 readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>], undefined>;
@@ -4316,26 +3362,16 @@ export declare const upsertEnvironmentUserHandlerBodySchema: v.ObjectSchema<{
              * with the service's own (per-environment) `helmReleases` at provision time.
              */
             readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Release name. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
                 readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
                 readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
                 readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
                 readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Inline `--values` overrides. */
                 readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-                /** Templated `--set` overrides. */
                 readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                    /** The value, templated over the provision vars. */
                     readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
                 }, undefined>, undefined>, undefined>;
-                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
                 readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                     readonly secretRef: v.ObjectSchema<{
@@ -4366,28 +3402,23 @@ export declare const upsertEnvironmentUserHandlerBodySchema: v.ObjectSchema<{
             /** How the environment URL is derived once applied. */
             readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
                 readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
                 readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
                 readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
                 readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
                 readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
                 readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>], undefined>;
@@ -4412,26 +3443,16 @@ export declare const upsertEnvironmentUserHandlerBodySchema: v.ObjectSchema<{
              * with the service's own (per-environment) `helmReleases` at provision time.
              */
             readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Release name. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
                 readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
                 readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
                 readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
                 readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Inline `--values` overrides. */
                 readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-                /** Templated `--set` overrides. */
                 readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                    /** The value, templated over the provision vars. */
                     readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
                 }, undefined>, undefined>, undefined>;
-                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
                 readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                     readonly secretRef: v.ObjectSchema<{
@@ -4444,6 +3465,8 @@ export declare const upsertEnvironmentUserHandlerBodySchema: v.ObjectSchema<{
     }, undefined>, v.ObjectSchema<{
         readonly engine: v.LiteralSchema<"cloudflare", undefined>;
         readonly cloudflare: v.ObjectSchema<{
+            /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
+            readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
             /**
              * The account's `*.workers.dev` subdomain — the preview URL is
@@ -4452,8 +3475,6 @@ export declare const upsertEnvironmentUserHandlerBodySchema: v.ObjectSchema<{
              * takes minutes.
              */
             readonly workersSubdomain: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 63, undefined>, v.RegexAction<string, "must be a bare workers.dev subdomain label, e.g. \"my-account\"">]>;
-            /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
-            readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             /**
              * `owner/repo` carrying the preview workflow. Absent ⇒ THE BLOCK'S OWN REPO, resolved per
              * provision — which is the point of a built-in backend over a pasted manifest: one handler
@@ -4780,28 +3801,23 @@ export declare const environmentHandlersBundleSchema: v.ObjectSchema<{
                 /** How the environment URL is derived once applied. */
                 readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
                     readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-                    /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
                     readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                     readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
                 }, undefined>, v.ObjectSchema<{
                     readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-                    /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
                     readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                     readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
                 }, undefined>, v.ObjectSchema<{
                     readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-                    /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
                     readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
                     readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
                     readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
                 }, undefined>, v.ObjectSchema<{
                     readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-                    /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
                     readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                     readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
                 }, undefined>, v.ObjectSchema<{
                     readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-                    /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
                     readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                     readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
                 }, undefined>], undefined>;
@@ -4826,26 +3842,16 @@ export declare const environmentHandlersBundleSchema: v.ObjectSchema<{
                  * with the service's own (per-environment) `helmReleases` at provision time.
                  */
                 readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                    /** Release name. */
                     readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                    /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
                     readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                    /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
                     readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-                    /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
                     readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-                    /** Namespace to install into, templated; absent ⇒ the environment namespace. */
                     readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                    /** Inline `--values` overrides. */
                     readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-                    /** Templated `--set` overrides. */
                     readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                        /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                         readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                        /** The value, templated over the provision vars. */
                         readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
                     }, undefined>, undefined>, undefined>;
-                    /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
                     readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                         readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                         readonly secretRef: v.ObjectSchema<{
@@ -4876,28 +3882,23 @@ export declare const environmentHandlersBundleSchema: v.ObjectSchema<{
                 /** How the environment URL is derived once applied. */
                 readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
                     readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-                    /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
                     readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                     readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
                 }, undefined>, v.ObjectSchema<{
                     readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-                    /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
                     readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                     readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
                 }, undefined>, v.ObjectSchema<{
                     readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-                    /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
                     readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
                     readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
                     readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
                 }, undefined>, v.ObjectSchema<{
                     readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-                    /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
                     readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                     readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
                 }, undefined>, v.ObjectSchema<{
                     readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-                    /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
                     readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                     readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
                 }, undefined>], undefined>;
@@ -4922,26 +3923,16 @@ export declare const environmentHandlersBundleSchema: v.ObjectSchema<{
                  * with the service's own (per-environment) `helmReleases` at provision time.
                  */
                 readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                    /** Release name. */
                     readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                    /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
                     readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                    /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
                     readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-                    /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
                     readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-                    /** Namespace to install into, templated; absent ⇒ the environment namespace. */
                     readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                    /** Inline `--values` overrides. */
                     readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-                    /** Templated `--set` overrides. */
                     readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                        /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                         readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                        /** The value, templated over the provision vars. */
                         readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
                     }, undefined>, undefined>, undefined>;
-                    /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
                     readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                         readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                         readonly secretRef: v.ObjectSchema<{
@@ -4954,6 +3945,8 @@ export declare const environmentHandlersBundleSchema: v.ObjectSchema<{
         }, undefined>, v.ObjectSchema<{
             readonly engine: v.LiteralSchema<"cloudflare", undefined>;
             readonly cloudflare: v.ObjectSchema<{
+                /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
+                readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
                 readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
                 /**
                  * The account's `*.workers.dev` subdomain — the preview URL is
@@ -4962,8 +3955,6 @@ export declare const environmentHandlersBundleSchema: v.ObjectSchema<{
                  * takes minutes.
                  */
                 readonly workersSubdomain: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 63, undefined>, v.RegexAction<string, "must be a bare workers.dev subdomain label, e.g. \"my-account\"">]>;
-                /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
-                readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
                 /**
                  * `owner/repo` carrying the preview workflow. Absent ⇒ THE BLOCK'S OWN REPO, resolved per
                  * provision — which is the point of a built-in backend over a pasted manifest: one handler
@@ -5338,90 +4329,53 @@ export declare const environmentConnectionSchema: v.ObjectSchema<{
     }, undefined>, v.ObjectSchema<{
         readonly kind: v.LiteralSchema<"kubernetes", undefined>;
         readonly kubernetes: v.ObjectSchema<{
-            /** Human label for the connection (shown in the UI). */
-            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
-            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
             readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
             readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
             readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
-            /**
-             * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
-             * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
-             * default derived from the PR number / block id.
-             */
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
             readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
-            /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
             readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
                 readonly type: v.LiteralSchema<"colocated", undefined>;
-                /** File or directory path within the PR repo (read at the PR head branch). */
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly type: v.LiteralSchema<"separate", undefined>;
-                /** `owner/repo` of the manifests repo. */
                 readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
-                /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
                 readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-                /** File or directory path within the manifests repo. */
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
             }, undefined>], undefined>;
-            /** How the environment URL is derived once applied. */
             readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
                 readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
                 readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
                 readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
                 readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
                 readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
                 readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>], undefined>;
-            /**
-             * Optional image reference made available to the manifests as `{{image}}` (e.g. a
-             * CI-built image tagged by branch/sha). Itself a template over the provision vars.
-             */
             readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-            /** Fallback TTL (ms) after which the env is swept + torn down. */
             readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
-            /**
-             * How long (seconds) the container deploy adapter waits for each Deployment to roll out
-             * before reporting the env still `provisioning` (the backend keeps polling). Only the
-             * container-backed render path honors it; absent ⇒ the harness default (180s).
-             */
             readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
-            /** Extra labels stamped on the namespace + every applied resource. */
             readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-            /** Extra annotations stamped on the namespace. */
             readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-            /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
             readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
                 readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
                 readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Replacement digest, templated; alternative to a tag. */
                 readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
             }, undefined>, v.CheckAction<{
                 name: string;
@@ -5434,28 +4388,17 @@ export declare const environmentConnectionSchema: v.ObjectSchema<{
                 newTagTemplate?: string | undefined;
                 digestTemplate?: string | undefined;
             }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
-            /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
             readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Release name. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
                 readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
                 readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
                 readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
                 readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Inline `--values` overrides. */
                 readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-                /** Templated `--set` overrides. */
                 readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                    /** The value, templated over the provision vars. */
                     readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
                 }, undefined>, undefined>, undefined>;
-                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
                 readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                     readonly secretRef: v.ObjectSchema<{
@@ -5464,21 +4407,15 @@ export declare const environmentConnectionSchema: v.ObjectSchema<{
                 }, undefined>, undefined>, undefined>;
                 readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
             }, undefined>, undefined>, undefined>;
-            /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
             readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
                 readonly mode: v.LiteralSchema<"secret", undefined>;
-                /** Target Secret name in the namespace. */
                 readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Secret `type`; absent ⇒ `Opaque`. */
                 readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                    /** Key inside the rendered Secret / `.env`. */
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-                    /** Resolve the value from the workspace encrypted bundle by key. */
                     readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                         readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                     }, undefined>, undefined>;
-                    /** OR a non-secret value, templated over the provision vars. */
                     readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
                 }, undefined>, v.CheckAction<{
                     key: string;
@@ -5489,20 +4426,12 @@ export declare const environmentConnectionSchema: v.ObjectSchema<{
                 }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
-                /**
-                 * Repo-relative path within the overlay tree to write the `KEY=value` env file the
-                 * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
-                 * overlay names the Secret.
-                 */
                 readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                    /** Key inside the rendered Secret / `.env`. */
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-                    /** Resolve the value from the workspace encrypted bundle by key. */
                     readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                         readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                     }, undefined>, undefined>;
-                    /** OR a non-secret value, templated over the provision vars. */
                     readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
                 }, undefined>, v.CheckAction<{
                     key: string;
@@ -5519,90 +4448,53 @@ export declare const environmentConnectionSchema: v.ObjectSchema<{
             readonly region: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be an AWS region slug">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
             readonly clusterName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
             readonly stsHost: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a bare host or host:port">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 255, undefined>]>, undefined>;
-            /** Human label for the connection (shown in the UI). */
-            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
-            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
             readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
             readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
             readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
-            /**
-             * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
-             * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
-             * default derived from the PR number / block id.
-             */
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
             readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
-            /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
             readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
                 readonly type: v.LiteralSchema<"colocated", undefined>;
-                /** File or directory path within the PR repo (read at the PR head branch). */
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly type: v.LiteralSchema<"separate", undefined>;
-                /** `owner/repo` of the manifests repo. */
                 readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
-                /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
                 readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-                /** File or directory path within the manifests repo. */
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
             }, undefined>], undefined>;
-            /** How the environment URL is derived once applied. */
             readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
                 readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
                 readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
                 readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
                 readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
                 readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
                 readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>], undefined>;
-            /**
-             * Optional image reference made available to the manifests as `{{image}}` (e.g. a
-             * CI-built image tagged by branch/sha). Itself a template over the provision vars.
-             */
             readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-            /** Fallback TTL (ms) after which the env is swept + torn down. */
             readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
-            /**
-             * How long (seconds) the container deploy adapter waits for each Deployment to roll out
-             * before reporting the env still `provisioning` (the backend keeps polling). Only the
-             * container-backed render path honors it; absent ⇒ the harness default (180s).
-             */
             readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
-            /** Extra labels stamped on the namespace + every applied resource. */
             readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-            /** Extra annotations stamped on the namespace. */
             readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-            /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
             readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
                 readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
                 readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Replacement digest, templated; alternative to a tag. */
                 readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
             }, undefined>, v.CheckAction<{
                 name: string;
@@ -5615,28 +4507,17 @@ export declare const environmentConnectionSchema: v.ObjectSchema<{
                 newTagTemplate?: string | undefined;
                 digestTemplate?: string | undefined;
             }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
-            /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
             readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Release name. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
                 readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
                 readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
                 readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
                 readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Inline `--values` overrides. */
                 readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-                /** Templated `--set` overrides. */
                 readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                    /** The value, templated over the provision vars. */
                     readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
                 }, undefined>, undefined>, undefined>;
-                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
                 readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                     readonly secretRef: v.ObjectSchema<{
@@ -5645,21 +4526,15 @@ export declare const environmentConnectionSchema: v.ObjectSchema<{
                 }, undefined>, undefined>, undefined>;
                 readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
             }, undefined>, undefined>, undefined>;
-            /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
             readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
                 readonly mode: v.LiteralSchema<"secret", undefined>;
-                /** Target Secret name in the namespace. */
                 readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Secret `type`; absent ⇒ `Opaque`. */
                 readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                    /** Key inside the rendered Secret / `.env`. */
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-                    /** Resolve the value from the workspace encrypted bundle by key. */
                     readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                         readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                     }, undefined>, undefined>;
-                    /** OR a non-secret value, templated over the provision vars. */
                     readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
                 }, undefined>, v.CheckAction<{
                     key: string;
@@ -5670,20 +4545,12 @@ export declare const environmentConnectionSchema: v.ObjectSchema<{
                 }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
-                /**
-                 * Repo-relative path within the overlay tree to write the `KEY=value` env file the
-                 * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
-                 * overlay names the Secret.
-                 */
                 readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                    /** Key inside the rendered Secret / `.env`. */
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-                    /** Resolve the value from the workspace encrypted bundle by key. */
                     readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                         readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                     }, undefined>, undefined>;
-                    /** OR a non-secret value, templated over the provision vars. */
                     readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
                 }, undefined>, v.CheckAction<{
                     key: string;
@@ -5697,6 +4564,8 @@ export declare const environmentConnectionSchema: v.ObjectSchema<{
     }, undefined>, v.ObjectSchema<{
         readonly kind: v.LiteralSchema<"cloudflare", undefined>;
         readonly cloudflare: v.ObjectSchema<{
+            /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
+            readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
             /**
              * The account's `*.workers.dev` subdomain — the preview URL is
@@ -5705,8 +4574,6 @@ export declare const environmentConnectionSchema: v.ObjectSchema<{
              * takes minutes.
              */
             readonly workersSubdomain: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 63, undefined>, v.RegexAction<string, "must be a bare workers.dev subdomain label, e.g. \"my-account\"">]>;
-            /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
-            readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             /**
              * `owner/repo` carrying the preview workflow. Absent ⇒ THE BLOCK'S OWN REPO, resolved per
              * provision — which is the point of a built-in backend over a pasted manifest: one handler
@@ -5997,90 +4864,53 @@ export declare const registerEnvironmentProviderSchema: v.ObjectSchema<{
     }, undefined>, v.ObjectSchema<{
         readonly kind: v.LiteralSchema<"kubernetes", undefined>;
         readonly kubernetes: v.ObjectSchema<{
-            /** Human label for the connection (shown in the UI). */
-            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
-            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
             readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
             readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
             readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
-            /**
-             * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
-             * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
-             * default derived from the PR number / block id.
-             */
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
             readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
-            /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
             readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
                 readonly type: v.LiteralSchema<"colocated", undefined>;
-                /** File or directory path within the PR repo (read at the PR head branch). */
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly type: v.LiteralSchema<"separate", undefined>;
-                /** `owner/repo` of the manifests repo. */
                 readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
-                /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
                 readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-                /** File or directory path within the manifests repo. */
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
             }, undefined>], undefined>;
-            /** How the environment URL is derived once applied. */
             readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
                 readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
                 readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
                 readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
                 readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
                 readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
                 readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>], undefined>;
-            /**
-             * Optional image reference made available to the manifests as `{{image}}` (e.g. a
-             * CI-built image tagged by branch/sha). Itself a template over the provision vars.
-             */
             readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-            /** Fallback TTL (ms) after which the env is swept + torn down. */
             readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
-            /**
-             * How long (seconds) the container deploy adapter waits for each Deployment to roll out
-             * before reporting the env still `provisioning` (the backend keeps polling). Only the
-             * container-backed render path honors it; absent ⇒ the harness default (180s).
-             */
             readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
-            /** Extra labels stamped on the namespace + every applied resource. */
             readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-            /** Extra annotations stamped on the namespace. */
             readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-            /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
             readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
                 readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
                 readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Replacement digest, templated; alternative to a tag. */
                 readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
             }, undefined>, v.CheckAction<{
                 name: string;
@@ -6093,28 +4923,17 @@ export declare const registerEnvironmentProviderSchema: v.ObjectSchema<{
                 newTagTemplate?: string | undefined;
                 digestTemplate?: string | undefined;
             }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
-            /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
             readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Release name. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
                 readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
                 readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
                 readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
                 readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Inline `--values` overrides. */
                 readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-                /** Templated `--set` overrides. */
                 readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                    /** The value, templated over the provision vars. */
                     readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
                 }, undefined>, undefined>, undefined>;
-                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
                 readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                     readonly secretRef: v.ObjectSchema<{
@@ -6123,21 +4942,15 @@ export declare const registerEnvironmentProviderSchema: v.ObjectSchema<{
                 }, undefined>, undefined>, undefined>;
                 readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
             }, undefined>, undefined>, undefined>;
-            /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
             readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
                 readonly mode: v.LiteralSchema<"secret", undefined>;
-                /** Target Secret name in the namespace. */
                 readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Secret `type`; absent ⇒ `Opaque`. */
                 readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                    /** Key inside the rendered Secret / `.env`. */
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-                    /** Resolve the value from the workspace encrypted bundle by key. */
                     readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                         readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                     }, undefined>, undefined>;
-                    /** OR a non-secret value, templated over the provision vars. */
                     readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
                 }, undefined>, v.CheckAction<{
                     key: string;
@@ -6148,20 +4961,12 @@ export declare const registerEnvironmentProviderSchema: v.ObjectSchema<{
                 }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
-                /**
-                 * Repo-relative path within the overlay tree to write the `KEY=value` env file the
-                 * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
-                 * overlay names the Secret.
-                 */
                 readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                    /** Key inside the rendered Secret / `.env`. */
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-                    /** Resolve the value from the workspace encrypted bundle by key. */
                     readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                         readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                     }, undefined>, undefined>;
-                    /** OR a non-secret value, templated over the provision vars. */
                     readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
                 }, undefined>, v.CheckAction<{
                     key: string;
@@ -6178,90 +4983,53 @@ export declare const registerEnvironmentProviderSchema: v.ObjectSchema<{
             readonly region: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be an AWS region slug">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
             readonly clusterName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
             readonly stsHost: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a bare host or host:port">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 255, undefined>]>, undefined>;
-            /** Human label for the connection (shown in the UI). */
-            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
-            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
             readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
             readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
             readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
-            /**
-             * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
-             * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
-             * default derived from the PR number / block id.
-             */
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
             readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
-            /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
             readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
                 readonly type: v.LiteralSchema<"colocated", undefined>;
-                /** File or directory path within the PR repo (read at the PR head branch). */
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly type: v.LiteralSchema<"separate", undefined>;
-                /** `owner/repo` of the manifests repo. */
                 readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
-                /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
                 readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-                /** File or directory path within the manifests repo. */
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
             }, undefined>], undefined>;
-            /** How the environment URL is derived once applied. */
             readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
                 readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
                 readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
                 readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
                 readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
                 readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
                 readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>], undefined>;
-            /**
-             * Optional image reference made available to the manifests as `{{image}}` (e.g. a
-             * CI-built image tagged by branch/sha). Itself a template over the provision vars.
-             */
             readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-            /** Fallback TTL (ms) after which the env is swept + torn down. */
             readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
-            /**
-             * How long (seconds) the container deploy adapter waits for each Deployment to roll out
-             * before reporting the env still `provisioning` (the backend keeps polling). Only the
-             * container-backed render path honors it; absent ⇒ the harness default (180s).
-             */
             readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
-            /** Extra labels stamped on the namespace + every applied resource. */
             readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-            /** Extra annotations stamped on the namespace. */
             readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-            /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
             readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
                 readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
                 readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Replacement digest, templated; alternative to a tag. */
                 readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
             }, undefined>, v.CheckAction<{
                 name: string;
@@ -6274,28 +5042,17 @@ export declare const registerEnvironmentProviderSchema: v.ObjectSchema<{
                 newTagTemplate?: string | undefined;
                 digestTemplate?: string | undefined;
             }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
-            /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
             readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Release name. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
                 readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
                 readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
                 readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
                 readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Inline `--values` overrides. */
                 readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-                /** Templated `--set` overrides. */
                 readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                    /** The value, templated over the provision vars. */
                     readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
                 }, undefined>, undefined>, undefined>;
-                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
                 readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                     readonly secretRef: v.ObjectSchema<{
@@ -6304,21 +5061,15 @@ export declare const registerEnvironmentProviderSchema: v.ObjectSchema<{
                 }, undefined>, undefined>, undefined>;
                 readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
             }, undefined>, undefined>, undefined>;
-            /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
             readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
                 readonly mode: v.LiteralSchema<"secret", undefined>;
-                /** Target Secret name in the namespace. */
                 readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Secret `type`; absent ⇒ `Opaque`. */
                 readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                    /** Key inside the rendered Secret / `.env`. */
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-                    /** Resolve the value from the workspace encrypted bundle by key. */
                     readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                         readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                     }, undefined>, undefined>;
-                    /** OR a non-secret value, templated over the provision vars. */
                     readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
                 }, undefined>, v.CheckAction<{
                     key: string;
@@ -6329,20 +5080,12 @@ export declare const registerEnvironmentProviderSchema: v.ObjectSchema<{
                 }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
-                /**
-                 * Repo-relative path within the overlay tree to write the `KEY=value` env file the
-                 * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
-                 * overlay names the Secret.
-                 */
                 readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                    /** Key inside the rendered Secret / `.env`. */
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-                    /** Resolve the value from the workspace encrypted bundle by key. */
                     readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                         readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                     }, undefined>, undefined>;
-                    /** OR a non-secret value, templated over the provision vars. */
                     readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
                 }, undefined>, v.CheckAction<{
                     key: string;
@@ -6356,6 +5099,8 @@ export declare const registerEnvironmentProviderSchema: v.ObjectSchema<{
     }, undefined>, v.ObjectSchema<{
         readonly kind: v.LiteralSchema<"cloudflare", undefined>;
         readonly cloudflare: v.ObjectSchema<{
+            /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
+            readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
             /**
              * The account's `*.workers.dev` subdomain — the preview URL is
@@ -6364,8 +5109,6 @@ export declare const registerEnvironmentProviderSchema: v.ObjectSchema<{
              * takes minutes.
              */
             readonly workersSubdomain: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 63, undefined>, v.RegexAction<string, "must be a bare workers.dev subdomain label, e.g. \"my-account\"">]>;
-            /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
-            readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             /**
              * `owner/repo` carrying the preview workflow. Absent ⇒ THE BLOCK'S OWN REPO, resolved per
              * provision — which is the point of a built-in backend over a pasted manifest: one handler
@@ -6658,90 +5401,53 @@ export declare const testEnvironmentConnectionSchema: v.ObjectSchema<{
     }, undefined>, v.ObjectSchema<{
         readonly kind: v.LiteralSchema<"kubernetes", undefined>;
         readonly kubernetes: v.ObjectSchema<{
-            /** Human label for the connection (shown in the UI). */
-            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
-            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
             readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
             readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
             readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
-            /**
-             * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
-             * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
-             * default derived from the PR number / block id.
-             */
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
             readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
-            /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
             readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
                 readonly type: v.LiteralSchema<"colocated", undefined>;
-                /** File or directory path within the PR repo (read at the PR head branch). */
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly type: v.LiteralSchema<"separate", undefined>;
-                /** `owner/repo` of the manifests repo. */
                 readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
-                /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
                 readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-                /** File or directory path within the manifests repo. */
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
             }, undefined>], undefined>;
-            /** How the environment URL is derived once applied. */
             readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
                 readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
                 readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
                 readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
                 readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
                 readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
                 readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>], undefined>;
-            /**
-             * Optional image reference made available to the manifests as `{{image}}` (e.g. a
-             * CI-built image tagged by branch/sha). Itself a template over the provision vars.
-             */
             readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-            /** Fallback TTL (ms) after which the env is swept + torn down. */
             readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
-            /**
-             * How long (seconds) the container deploy adapter waits for each Deployment to roll out
-             * before reporting the env still `provisioning` (the backend keeps polling). Only the
-             * container-backed render path honors it; absent ⇒ the harness default (180s).
-             */
             readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
-            /** Extra labels stamped on the namespace + every applied resource. */
             readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-            /** Extra annotations stamped on the namespace. */
             readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-            /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
             readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
                 readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
                 readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Replacement digest, templated; alternative to a tag. */
                 readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
             }, undefined>, v.CheckAction<{
                 name: string;
@@ -6754,28 +5460,17 @@ export declare const testEnvironmentConnectionSchema: v.ObjectSchema<{
                 newTagTemplate?: string | undefined;
                 digestTemplate?: string | undefined;
             }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
-            /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
             readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Release name. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
                 readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
                 readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
                 readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
                 readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Inline `--values` overrides. */
                 readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-                /** Templated `--set` overrides. */
                 readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                    /** The value, templated over the provision vars. */
                     readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
                 }, undefined>, undefined>, undefined>;
-                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
                 readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                     readonly secretRef: v.ObjectSchema<{
@@ -6784,21 +5479,15 @@ export declare const testEnvironmentConnectionSchema: v.ObjectSchema<{
                 }, undefined>, undefined>, undefined>;
                 readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
             }, undefined>, undefined>, undefined>;
-            /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
             readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
                 readonly mode: v.LiteralSchema<"secret", undefined>;
-                /** Target Secret name in the namespace. */
                 readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Secret `type`; absent ⇒ `Opaque`. */
                 readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                    /** Key inside the rendered Secret / `.env`. */
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-                    /** Resolve the value from the workspace encrypted bundle by key. */
                     readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                         readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                     }, undefined>, undefined>;
-                    /** OR a non-secret value, templated over the provision vars. */
                     readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
                 }, undefined>, v.CheckAction<{
                     key: string;
@@ -6809,20 +5498,12 @@ export declare const testEnvironmentConnectionSchema: v.ObjectSchema<{
                 }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
-                /**
-                 * Repo-relative path within the overlay tree to write the `KEY=value` env file the
-                 * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
-                 * overlay names the Secret.
-                 */
                 readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                    /** Key inside the rendered Secret / `.env`. */
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-                    /** Resolve the value from the workspace encrypted bundle by key. */
                     readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                         readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                     }, undefined>, undefined>;
-                    /** OR a non-secret value, templated over the provision vars. */
                     readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
                 }, undefined>, v.CheckAction<{
                     key: string;
@@ -6839,90 +5520,53 @@ export declare const testEnvironmentConnectionSchema: v.ObjectSchema<{
             readonly region: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be an AWS region slug">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
             readonly clusterName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
             readonly stsHost: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a bare host or host:port">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 255, undefined>]>, undefined>;
-            /** Human label for the connection (shown in the UI). */
-            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
-            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
             readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
-            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
             readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
             readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
-            /**
-             * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
-             * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
-             * default derived from the PR number / block id.
-             */
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
             readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
-            /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
             readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
                 readonly type: v.LiteralSchema<"colocated", undefined>;
-                /** File or directory path within the PR repo (read at the PR head branch). */
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly type: v.LiteralSchema<"separate", undefined>;
-                /** `owner/repo` of the manifests repo. */
                 readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
-                /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
                 readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-                /** File or directory path within the manifests repo. */
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
             }, undefined>], undefined>;
-            /** How the environment URL is derived once applied. */
             readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
                 readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
                 readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
                 readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
                 readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
                 readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
                 readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
             }, undefined>], undefined>;
-            /**
-             * Optional image reference made available to the manifests as `{{image}}` (e.g. a
-             * CI-built image tagged by branch/sha). Itself a template over the provision vars.
-             */
             readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-            /** Fallback TTL (ms) after which the env is swept + torn down. */
             readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
-            /**
-             * How long (seconds) the container deploy adapter waits for each Deployment to roll out
-             * before reporting the env still `provisioning` (the backend keeps polling). Only the
-             * container-backed render path honors it; absent ⇒ the harness default (180s).
-             */
             readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
-            /** Extra labels stamped on the namespace + every applied resource. */
             readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-            /** Extra annotations stamped on the namespace. */
             readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
-            /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
             readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
                 readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
                 readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Replacement digest, templated; alternative to a tag. */
                 readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
             }, undefined>, v.CheckAction<{
                 name: string;
@@ -6935,28 +5579,17 @@ export declare const testEnvironmentConnectionSchema: v.ObjectSchema<{
                 newTagTemplate?: string | undefined;
                 digestTemplate?: string | undefined;
             }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
-            /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
             readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Release name. */
                 readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
                 readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
                 readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
                 readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
                 readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-                /** Inline `--values` overrides. */
                 readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-                /** Templated `--set` overrides. */
                 readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                    /** The value, templated over the provision vars. */
                     readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
                 }, undefined>, undefined>, undefined>;
-                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
                 readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                     readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                     readonly secretRef: v.ObjectSchema<{
@@ -6965,21 +5598,15 @@ export declare const testEnvironmentConnectionSchema: v.ObjectSchema<{
                 }, undefined>, undefined>, undefined>;
                 readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
             }, undefined>, undefined>, undefined>;
-            /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
             readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
                 readonly mode: v.LiteralSchema<"secret", undefined>;
-                /** Target Secret name in the namespace. */
                 readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** Secret `type`; absent ⇒ `Opaque`. */
                 readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
                 readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                    /** Key inside the rendered Secret / `.env`. */
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-                    /** Resolve the value from the workspace encrypted bundle by key. */
                     readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                         readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                     }, undefined>, undefined>;
-                    /** OR a non-secret value, templated over the provision vars. */
                     readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
                 }, undefined>, v.CheckAction<{
                     key: string;
@@ -6990,20 +5617,12 @@ export declare const testEnvironmentConnectionSchema: v.ObjectSchema<{
                 }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
             }, undefined>, v.ObjectSchema<{
                 readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
-                /**
-                 * Repo-relative path within the overlay tree to write the `KEY=value` env file the
-                 * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
-                 * overlay names the Secret.
-                 */
                 readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
                 readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                    /** Key inside the rendered Secret / `.env`. */
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-                    /** Resolve the value from the workspace encrypted bundle by key. */
                     readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                         readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                     }, undefined>, undefined>;
-                    /** OR a non-secret value, templated over the provision vars. */
                     readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
                 }, undefined>, v.CheckAction<{
                     key: string;
@@ -7017,6 +5636,8 @@ export declare const testEnvironmentConnectionSchema: v.ObjectSchema<{
     }, undefined>, v.ObjectSchema<{
         readonly kind: v.LiteralSchema<"cloudflare", undefined>;
         readonly cloudflare: v.ObjectSchema<{
+            /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
+            readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
             /**
              * The account's `*.workers.dev` subdomain — the preview URL is
@@ -7025,8 +5646,6 @@ export declare const testEnvironmentConnectionSchema: v.ObjectSchema<{
              * takes minutes.
              */
             readonly workersSubdomain: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 63, undefined>, v.RegexAction<string, "must be a bare workers.dev subdomain label, e.g. \"my-account\"">]>;
-            /** VCS API root. Absent ⇒ `https://api.github.com`. Set it for GitHub Enterprise Server. */
-            readonly apiBaseUrl: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             /**
              * `owner/repo` carrying the preview workflow. Absent ⇒ THE BLOCK'S OWN REPO, resolved per
              * provision — which is the point of a built-in backend over a pasted manifest: one handler
@@ -7430,16 +6049,12 @@ export declare const provisioningRecommendationSchema: v.ObjectSchema<{
         /** `kubernetes`: where the per-PR manifests live (colocated in the PR repo, or a separate repo). */
         readonly manifestSource: v.OptionalSchema<v.VariantSchema<"type", [v.ObjectSchema<{
             readonly type: v.LiteralSchema<"colocated", undefined>;
-            /** File or directory path within the PR repo (read at the PR head branch). */
             readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
             readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly type: v.LiteralSchema<"separate", undefined>;
-            /** `owner/repo` of the manifests repo. */
             readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
-            /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
             readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
-            /** File or directory path within the manifests repo. */
             readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
             readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
         }, undefined>], undefined>, undefined>;
@@ -7615,13 +6230,9 @@ export declare const provisioningRecommendationSchema: v.ObjectSchema<{
          * native REST adapter ignores these (raw manifests). See the schemas above.
          */
         readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-            /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
             readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
             readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-            /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
             readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-            /** Replacement digest, templated; alternative to a tag. */
             readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
         }, undefined>, v.CheckAction<{
             name: string;
@@ -7635,26 +6246,16 @@ export declare const provisioningRecommendationSchema: v.ObjectSchema<{
             digestTemplate?: string | undefined;
         }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
         readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-            /** Release name. */
             readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
             readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
             readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
-            /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
             readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
-            /** Namespace to install into, templated; absent ⇒ the environment namespace. */
             readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
-            /** Inline `--values` overrides. */
             readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
-            /** Templated `--set` overrides. */
             readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-                /** The value, templated over the provision vars. */
                 readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
             }, undefined>, undefined>, undefined>;
-            /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
             readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
                 readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                 readonly secretRef: v.ObjectSchema<{
@@ -7665,18 +6266,13 @@ export declare const provisioningRecommendationSchema: v.ObjectSchema<{
         }, undefined>, undefined>, undefined>;
         readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
             readonly mode: v.LiteralSchema<"secret", undefined>;
-            /** Target Secret name in the namespace. */
             readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
-            /** Secret `type`; absent ⇒ `Opaque`. */
             readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
             readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                /** Key inside the rendered Secret / `.env`. */
                 readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-                /** Resolve the value from the workspace encrypted bundle by key. */
                 readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                 }, undefined>, undefined>;
-                /** OR a non-secret value, templated over the provision vars. */
                 readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             }, undefined>, v.CheckAction<{
                 key: string;
@@ -7687,20 +6283,12 @@ export declare const provisioningRecommendationSchema: v.ObjectSchema<{
             }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
         }, undefined>, v.ObjectSchema<{
             readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
-            /**
-             * Repo-relative path within the overlay tree to write the `KEY=value` env file the
-             * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
-             * overlay names the Secret.
-             */
             readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
             readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
-                /** Key inside the rendered Secret / `.env`. */
                 readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
-                /** Resolve the value from the workspace encrypted bundle by key. */
                 readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
                     readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
                 }, undefined>, undefined>;
-                /** OR a non-secret value, templated over the provision vars. */
                 readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
             }, undefined>, v.CheckAction<{
                 key: string;
@@ -7714,28 +6302,23 @@ export declare const provisioningRecommendationSchema: v.ObjectSchema<{
     /** Engine-level URL source inferred from the manifest kinds (workspace handler owns it). */
     readonly urlSource: v.OptionalSchema<v.VariantSchema<"source", [v.ObjectSchema<{
         readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
-        /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
         readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
         readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
     }, undefined>, v.ObjectSchema<{
         readonly source: v.LiteralSchema<"ingressStatus", undefined>;
-        /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
         readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
         readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
     }, undefined>, v.ObjectSchema<{
         readonly source: v.LiteralSchema<"serviceStatus", undefined>;
-        /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
         readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
         readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
         readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
     }, undefined>, v.ObjectSchema<{
         readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
-        /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
         readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
         readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
     }, undefined>, v.ObjectSchema<{
         readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
-        /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
         readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
         readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
     }, undefined>], undefined>, undefined>;
@@ -7898,4 +6481,17 @@ export declare const detectServiceProvisioningSchema: v.ObjectSchema<{
     readonly currentManifestPath: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
 }, undefined>;
 export type DetectServiceProvisioningInput = v.InferOutput<typeof detectServiceProvisioningSchema>;
+/**
+ * Re-validate a native backend's config read back off a stored {@link EnvironmentManifest}'s
+ * `providerConfig`, or throw naming what is wrong with it.
+ *
+ * `providerConfig` is `Record<string, unknown>` on the wire, deliberately: it is the carrier
+ * for whatever settings a backend defines. So reading a config back out used to be an
+ * assertion. The connect controller does validate on the way IN, but the value has been through
+ * storage since: a config written before a schema change, or edited in the database, would flow
+ * on as a fake-valid object and only misbehave deep inside a provision. Parsing here names the
+ * offending field at the boundary instead, and every native backend re-reads its config the
+ * same way rather than each picking its own wording.
+ */
+export declare function parseStoredProviderConfig<T>(schema: v.GenericSchema<unknown, T>, raw: unknown, label: string): T;
 //# sourceMappingURL=environments.d.ts.map