@cat-factory/contracts 0.63.0 → 0.65.0

package/dist/environments.d.ts

@@ -403,6 +403,12 @@ export declare const kubernetesEnvironmentConfigSchema: v.ObjectSchema<{
     readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
     /** Fallback TTL (ms) after which the env is swept + torn down. */
     readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+    /**
+     * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+     * before reporting the env still `provisioning` (the backend keeps polling). Only the
+     * container-backed render path honors it; absent ⇒ the harness default (180s).
+     */
+    readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
     /** Extra labels stamped on the namespace + every applied resource. */
     readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
     /** Extra annotations stamped on the namespace. */
@@ -560,6 +566,193 @@ export declare const kubernetesSecretInjectionSchema: v.VariantSchema<"mode", [v
     }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
 }, undefined>], undefined>;
 export type KubernetesSecretInjection = v.InferOutput<typeof kubernetesSecretInjectionSchema>;
+/**
+ * The full Kubernetes provision config the deploy adapter consumes: the combined cluster +
+ * URL + manifest-source config PLUS the kustomize/helm render inputs (image overrides, helm
+ * releases, secret injections). It is assembled at provision time by MERGING the workspace
+ * kube engine config (the "how": apiserver, sizing, shared helm releases) with the service's
+ * own provisioning (the "what/where": manifest source, per-environment helm releases, image
+ * overrides, secret injections) — so the provider reads everything it needs from one place.
+ * The native in-Worker REST adapter ignores the render fields (raw manifests only); the
+ * container-backed deploy adapter consumes them. Carries secret KEYS, never values.
+ */
+export declare const kubernetesProvisionConfigSchema: v.ObjectSchema<{
+    /** Human label for the connection (shown in the UI). */
+    readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+    /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+    readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+    /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+    readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+    readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+    /**
+     * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
+     * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
+     * default derived from the PR number / block id.
+     */
+    readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+    /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
+    readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
+        readonly type: v.LiteralSchema<"colocated", undefined>;
+        /** File or directory path within the PR repo (read at the PR head branch). */
+        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly type: v.LiteralSchema<"separate", undefined>;
+        /** `owner/repo` of the manifests repo. */
+        readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+        /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
+        readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        /** File or directory path within the manifests repo. */
+        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+    }, undefined>], undefined>;
+    /** How the environment URL is derived once applied. */
+    readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+        /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+        readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+        /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+        readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+        /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+        readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+        readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+        /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+        readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+        /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+        readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>], undefined>;
+    /**
+     * Optional image reference made available to the manifests as `{{image}}` (e.g. a
+     * CI-built image tagged by branch/sha). Itself a template over the provision vars.
+     */
+    readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+    /** Fallback TTL (ms) after which the env is swept + torn down. */
+    readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+    /**
+     * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+     * before reporting the env still `provisioning` (the backend keeps polling). Only the
+     * container-backed render path honors it; absent ⇒ the harness default (180s).
+     */
+    readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+    /** Extra labels stamped on the namespace + every applied resource. */
+    readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+    /** Extra annotations stamped on the namespace. */
+    readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+    /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
+    readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+        /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
+        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
+        readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+        /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
+        readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+        /** Replacement digest, templated; alternative to a tag. */
+        readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+    }, undefined>, v.CheckAction<{
+        name: string;
+        newNameTemplate?: string | undefined;
+        newTagTemplate?: string | undefined;
+        digestTemplate?: string | undefined;
+    }, "an image override must set at least one of newNameTemplate, newTagTemplate, or digestTemplate.">, v.CheckAction<{
+        name: string;
+        newNameTemplate?: string | undefined;
+        newTagTemplate?: string | undefined;
+        digestTemplate?: string | undefined;
+    }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
+    /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
+    readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+        /** Release name. */
+        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+        readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+        readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+        /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+        readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+        /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+        readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+        /** Inline `--values` overrides. */
+        readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+        /** Templated `--set` overrides. */
+        readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+            /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            /** The value, templated over the provision vars. */
+            readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+        }, undefined>, undefined>, undefined>;
+        /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+        readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            readonly secretRef: v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>;
+        }, undefined>, undefined>, undefined>;
+        readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+    }, undefined>, undefined>, undefined>;
+    /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
+    readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
+        readonly mode: v.LiteralSchema<"secret", undefined>;
+        /** Target Secret name in the namespace. */
+        readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** Secret `type`; absent ⇒ `Opaque`. */
+        readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+            /** Key inside the rendered Secret / `.env`. */
+            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+            /** Resolve the value from the workspace encrypted bundle by key. */
+            readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>, undefined>;
+            /** OR a non-secret value, templated over the provision vars. */
+            readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+        }, undefined>, v.CheckAction<{
+            key: string;
+            secretRef?: {
+                key: string;
+            } | undefined;
+            valueTemplate?: string | undefined;
+        }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
+        /**
+         * Repo-relative path within the overlay tree to write the `KEY=value` env file the
+         * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
+         * overlay names the Secret.
+         */
+        readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+            /** Key inside the rendered Secret / `.env`. */
+            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+            /** Resolve the value from the workspace encrypted bundle by key. */
+            readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>, undefined>;
+            /** OR a non-secret value, templated over the provision vars. */
+            readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+        }, undefined>, v.CheckAction<{
+            key: string;
+            secretRef?: {
+                key: string;
+            } | undefined;
+            valueTemplate?: string | undefined;
+        }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+    }, undefined>], undefined>, undefined>, undefined>;
+}, undefined>;
+export type KubernetesProvisionConfig = v.InferOutput<typeof kubernetesProvisionConfigSchema>;
 /** Built-in environment backend kinds the contract knows by name. */
 export declare const RESERVED_ENVIRONMENT_BACKEND_KINDS: readonly ['manifest', 'kubernetes'];
 /**
@@ -780,10 +973,115 @@ export declare const environmentBackendConfigSchema: v.VariantSchema<"kind", [v.
         readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
         /** Fallback TTL (ms) after which the env is swept + torn down. */
         readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+        /**
+         * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+         * before reporting the env still `provisioning` (the backend keeps polling). Only the
+         * container-backed render path honors it; absent ⇒ the harness default (180s).
+         */
+        readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
         /** Extra labels stamped on the namespace + every applied resource. */
         readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
         /** Extra annotations stamped on the namespace. */
         readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+        /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
+        readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+            /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
+            readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
+            readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
+            readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Replacement digest, templated; alternative to a tag. */
+            readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+        }, undefined>, v.CheckAction<{
+            name: string;
+            newNameTemplate?: string | undefined;
+            newTagTemplate?: string | undefined;
+            digestTemplate?: string | undefined;
+        }, "an image override must set at least one of newNameTemplate, newTagTemplate, or digestTemplate.">, v.CheckAction<{
+            name: string;
+            newNameTemplate?: string | undefined;
+            newTagTemplate?: string | undefined;
+            digestTemplate?: string | undefined;
+        }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
+        /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
+        readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+            /** Release name. */
+            readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+            readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+            readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+            /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+            readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+            /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+            readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Inline `--values` overrides. */
+            readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+            /** Templated `--set` overrides. */
+            readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+                readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** The value, templated over the provision vars. */
+                readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+            }, undefined>, undefined>, undefined>;
+            /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+            readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, undefined>, undefined>;
+            readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+        }, undefined>, undefined>, undefined>;
+        /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
+        readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
+            readonly mode: v.LiteralSchema<"secret", undefined>;
+            /** Target Secret name in the namespace. */
+            readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            /** Secret `type`; absent ⇒ `Opaque`. */
+            readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+            readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                /** Key inside the rendered Secret / `.env`. */
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+                /** Resolve the value from the workspace encrypted bundle by key. */
+                readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>, undefined>;
+                /** OR a non-secret value, templated over the provision vars. */
+                readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+            }, undefined>, v.CheckAction<{
+                key: string;
+                secretRef?: {
+                    key: string;
+                } | undefined;
+                valueTemplate?: string | undefined;
+            }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
+            /**
+             * Repo-relative path within the overlay tree to write the `KEY=value` env file the
+             * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
+             * overlay names the Secret.
+             */
+            readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                /** Key inside the rendered Secret / `.env`. */
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+                /** Resolve the value from the workspace encrypted bundle by key. */
+                readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>, undefined>;
+                /** OR a non-secret value, templated over the provision vars. */
+                readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+            }, undefined>, v.CheckAction<{
+                key: string;
+                secretRef?: {
+                    key: string;
+                } | undefined;
+                valueTemplate?: string | undefined;
+            }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+        }, undefined>], undefined>, undefined>, undefined>;
     }, undefined>;
 }, undefined>, v.ObjectSchema<{
     readonly kind: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>, v.RegexAction<string, "must be a lower-kebab slug">, v.CheckAction<string, "reserved backend kind">]>;
@@ -1108,6 +1406,12 @@ export declare const kubernetesEngineConfigSchema: v.ObjectSchema<{
     readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
     /** Fallback TTL (ms) after which the env is swept + torn down. */
     readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+    /**
+     * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+     * before reporting the env still `provisioning` (the backend keeps polling). Absent ⇒ the
+     * harness default (180s). Merged into the provision config via `...kube` at provision time.
+     */
+    readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
     /** Extra labels stamped on the namespace + every applied resource. */
     readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
     /** Extra annotations stamped on the namespace. */
@@ -1337,6 +1641,12 @@ export declare const infraHandlerConfigSchema: v.VariantSchema<"engine", [v.Obje
         readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
         /** Fallback TTL (ms) after which the env is swept + torn down. */
         readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+        /**
+         * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+         * before reporting the env still `provisioning` (the backend keeps polling). Absent ⇒ the
+         * harness default (180s). Merged into the provision config via `...kube` at provision time.
+         */
+        readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
         /** Extra labels stamped on the namespace + every applied resource. */
         readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
         /** Extra annotations stamped on the namespace. */
@@ -1427,6 +1737,12 @@ export declare const infraHandlerConfigSchema: v.VariantSchema<"engine", [v.Obje
         readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
         /** Fallback TTL (ms) after which the env is swept + torn down. */
         readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+        /**
+         * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+         * before reporting the env still `provisioning` (the backend keeps polling). Absent ⇒ the
+         * harness default (180s). Merged into the provision config via `...kube` at provision time.
+         */
+        readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
         /** Extra labels stamped on the namespace + every applied resource. */
         readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
         /** Extra annotations stamped on the namespace. */
@@ -1622,43 +1938,1941 @@ export declare const upsertCustomManifestTypeSchema: v.ObjectSchema<{
     readonly description: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
 }, undefined>;
 export type UpsertCustomManifestTypeInput = v.InferOutput<typeof upsertCustomManifestTypeSchema>;
-/** Resolved access creds for a provisioned env, as surfaced to a tester agent. */
-export declare const environmentAccessHandleSchema: v.ObjectSchema<{
-    readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
-    readonly token: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-    readonly username: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-    readonly password: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-    readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-    readonly headerValue: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-}, undefined>;
-export type EnvironmentAccessHandle = v.InferOutput<typeof environmentAccessHandleSchema>;
-/** A provisioned environment, as exposed to clients and downstream agents. */
-export declare const environmentHandleSchema: v.ObjectSchema<{
-    readonly id: v.StringSchema<undefined>;
-    readonly workspaceId: v.StringSchema<undefined>;
-    readonly blockId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
-    readonly executionId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+/** One registered infra handler, as exposed to clients (never secret VALUES). */
+export declare const environmentHandlerViewSchema: v.ObjectSchema<{
+    readonly provisionType: v.PicklistSchema<["kubernetes", "docker-compose", "custom", "infraless"], undefined>;
+    /** For `custom`: the manifest id this handler is keyed to; `null` otherwise. */
+    readonly manifestId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    readonly engine: v.PicklistSchema<["local-docker", "local-k3s", "remote-kubernetes", "remote-custom", "none"], undefined>;
     readonly providerId: v.StringSchema<undefined>;
-    readonly externalId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
-    readonly url: v.NullableSchema<v.StringSchema<undefined>, undefined>;
-    readonly status: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
-    /** Present only on the dedicated access endpoint / in agent context. */
-    readonly access: v.OptionalSchema<v.ObjectSchema<{
-        readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
-        readonly token: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-        readonly username: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-        readonly password: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-        readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-        readonly headerValue: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-    }, undefined>, undefined>;
-    readonly createdAt: v.NumberSchema<undefined>;
-    readonly expiresAt: v.NullableSchema<v.NumberSchema<undefined>, undefined>;
-    readonly lastError: v.NullableSchema<v.StringSchema<undefined>, undefined>;
-    /**
-     * The service's declared provision type this environment was stood up for
-     * (`kubernetes` | `docker-compose` | `custom` | `infraless`). Recorded at provision
-     * time so run details can show exactly what was provisioned. Null for legacy rows.
-     */
+    readonly label: v.StringSchema<undefined>;
+    readonly baseUrl: v.StringSchema<undefined>;
+    readonly connectedAt: v.NumberSchema<undefined>;
+    /** Which secret keys are set (names only), so the UI can show completeness. */
+    readonly secretKeys: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+    /** For `remote-custom`: the manifest id this provider accepts; `null` otherwise. */
+    readonly acceptsManifestId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    /** The stored handler config, sans secrets, for connect-form prefill on edit. */
+    readonly config: v.OptionalSchema<v.VariantSchema<"engine", [v.ObjectSchema<{
+        readonly engine: v.LiteralSchema<"local-docker", undefined>;
+        readonly manifest: v.ObjectSchema<{
+            readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** Management API root; provision/status/teardown paths are appended to it. */
+            readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"none", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"api_key", undefined>;
+                readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                /** Optional prefix prepended to the secret value, e.g. `Token `. */
+                readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"bearer", undefined>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"basic", undefined>;
+                readonly usernameSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly passwordSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly clientIdSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly clientSecretSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                readonly headers: v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>], undefined>;
+            readonly provision: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Optional: polled to observe async provisioning progress. */
+            readonly status: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            /** Optional: called to destroy the environment (manual or on TTL expiry). */
+            readonly teardown: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            readonly response: v.ObjectSchema<{
+                readonly urlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly access: v.OptionalSchema<v.ObjectSchema<{
+                    readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+                    readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>;
+            /** Fallback TTL (ms) when the response carries no explicit expiry. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+             * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+             * entirely; a custom backend — registered by reference into the app-owned
+             * `EnvironmentBackendRegistry` (see `backend/docs/native-environment-adapter.md`) — reads
+             * + validates it off the per-call
+             * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+             * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+             * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+             * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+             * (reuse the exported `UrlSafetyPolicy`).
+             */
+            readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly engine: v.LiteralSchema<"local-k3s", undefined>;
+        readonly kubernetes: v.ObjectSchema<{
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /**
+             * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`. With
+             * `renderer: 'kustomize'`, ABSENT ⇒ honor the overlay's own `namespace:` when it pins one
+             * (the shared-namespace ephemeral-env shape, where base + overlay name a fixed namespace);
+             * SET ⇒ override it (the adapter sets the namespace at build time) for true per-PR
+             * isolation. For raw manifests, absent ⇒ a default derived from the PR number / block id.
+             */
+            readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+            /** How the environment URL is derived once applied. */
+            readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+                readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+                readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+                readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+                readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+                readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+                readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>], undefined>;
+            /** Optional image reference made available to the manifests as `{{image}}`. */
+            readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Fallback TTL (ms) after which the env is swept + torn down. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+             * before reporting the env still `provisioning` (the backend keeps polling). Absent ⇒ the
+             * harness default (180s). Merged into the provision config via `...kube` at provision time.
+             */
+            readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+            /** Extra labels stamped on the namespace + every applied resource. */
+            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Extra annotations stamped on the namespace. */
+            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /**
+             * Workspace-level (cluster-singleton) helm releases the deploy adapter ensures before
+             * applying a service's manifests — e.g. an ingress/gateway controller shared by every
+             * per-PR env. Use `scope: 'shared'`; installed once, never torn down per-PR. Merged
+             * with the service's own (per-environment) `helmReleases` at provision time.
+             */
+            readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                /** Release name. */
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+                readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+                readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+                readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+                readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Inline `--values` overrides. */
+                readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+                /** Templated `--set` overrides. */
+                readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    /** The value, templated over the provision vars. */
+                    readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+                }, undefined>, undefined>, undefined>;
+                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+                readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+            }, undefined>, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly engine: v.LiteralSchema<"remote-kubernetes", undefined>;
+        readonly kubernetes: v.ObjectSchema<{
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /**
+             * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`. With
+             * `renderer: 'kustomize'`, ABSENT ⇒ honor the overlay's own `namespace:` when it pins one
+             * (the shared-namespace ephemeral-env shape, where base + overlay name a fixed namespace);
+             * SET ⇒ override it (the adapter sets the namespace at build time) for true per-PR
+             * isolation. For raw manifests, absent ⇒ a default derived from the PR number / block id.
+             */
+            readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+            /** How the environment URL is derived once applied. */
+            readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+                readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+                readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+                readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+                readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+                readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+                readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>], undefined>;
+            /** Optional image reference made available to the manifests as `{{image}}`. */
+            readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Fallback TTL (ms) after which the env is swept + torn down. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+             * before reporting the env still `provisioning` (the backend keeps polling). Absent ⇒ the
+             * harness default (180s). Merged into the provision config via `...kube` at provision time.
+             */
+            readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+            /** Extra labels stamped on the namespace + every applied resource. */
+            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Extra annotations stamped on the namespace. */
+            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /**
+             * Workspace-level (cluster-singleton) helm releases the deploy adapter ensures before
+             * applying a service's manifests — e.g. an ingress/gateway controller shared by every
+             * per-PR env. Use `scope: 'shared'`; installed once, never torn down per-PR. Merged
+             * with the service's own (per-environment) `helmReleases` at provision time.
+             */
+            readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                /** Release name. */
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+                readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+                readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+                readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+                readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Inline `--values` overrides. */
+                readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+                /** Templated `--set` overrides. */
+                readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    /** The value, templated over the provision vars. */
+                    readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+                }, undefined>, undefined>, undefined>;
+                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+                readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+            }, undefined>, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly engine: v.LiteralSchema<"remote-custom", undefined>;
+        readonly manifest: v.ObjectSchema<{
+            readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** Management API root; provision/status/teardown paths are appended to it. */
+            readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"none", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"api_key", undefined>;
+                readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                /** Optional prefix prepended to the secret value, e.g. `Token `. */
+                readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"bearer", undefined>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"basic", undefined>;
+                readonly usernameSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly passwordSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly clientIdSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly clientSecretSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                readonly headers: v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>], undefined>;
+            readonly provision: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Optional: polled to observe async provisioning progress. */
+            readonly status: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            /** Optional: called to destroy the environment (manual or on TTL expiry). */
+            readonly teardown: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            readonly response: v.ObjectSchema<{
+                readonly urlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly access: v.OptionalSchema<v.ObjectSchema<{
+                    readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+                    readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>;
+            /** Fallback TTL (ms) when the response carries no explicit expiry. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+             * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+             * entirely; a custom backend — registered by reference into the app-owned
+             * `EnvironmentBackendRegistry` (see `backend/docs/native-environment-adapter.md`) — reads
+             * + validates it off the per-call
+             * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+             * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+             * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+             * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+             * (reuse the exported `UrlSafetyPolicy`).
+             */
+            readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+        }, undefined>;
+        /** Which custom manifest shape this remote provider consumes — matched to a service's `manifestId`. */
+        readonly acceptsManifestId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+    }, undefined>], undefined>, undefined>;
+}, undefined>;
+export type EnvironmentHandlerView = v.InferOutput<typeof environmentHandlerViewSchema>;
+/**
+ * Register (or replace) one per-type infra handler: the engine connection config + its
+ * secret bundle (write-only). `manifestId` keys a `custom` handler to a specific manifest
+ * id; `backendKind` pins the registry backend that builds the provider (else resolved from
+ * the engine). Every secret key the chosen backend references must be supplied.
+ */
+export declare const registerEnvironmentHandlerSchema: v.ObjectSchema<{
+    readonly provisionType: v.PicklistSchema<["kubernetes", "docker-compose", "custom", "infraless"], undefined>;
+    readonly manifestId: v.OptionalSchema<v.NullableSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>, undefined>, undefined>;
+    readonly config: v.VariantSchema<"engine", [v.ObjectSchema<{
+        readonly engine: v.LiteralSchema<"local-docker", undefined>;
+        readonly manifest: v.ObjectSchema<{
+            readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** Management API root; provision/status/teardown paths are appended to it. */
+            readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"none", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"api_key", undefined>;
+                readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                /** Optional prefix prepended to the secret value, e.g. `Token `. */
+                readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"bearer", undefined>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"basic", undefined>;
+                readonly usernameSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly passwordSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly clientIdSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly clientSecretSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                readonly headers: v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>], undefined>;
+            readonly provision: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Optional: polled to observe async provisioning progress. */
+            readonly status: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            /** Optional: called to destroy the environment (manual or on TTL expiry). */
+            readonly teardown: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            readonly response: v.ObjectSchema<{
+                readonly urlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly access: v.OptionalSchema<v.ObjectSchema<{
+                    readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+                    readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>;
+            /** Fallback TTL (ms) when the response carries no explicit expiry. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+             * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+             * entirely; a custom backend — registered by reference into the app-owned
+             * `EnvironmentBackendRegistry` (see `backend/docs/native-environment-adapter.md`) — reads
+             * + validates it off the per-call
+             * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+             * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+             * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+             * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+             * (reuse the exported `UrlSafetyPolicy`).
+             */
+            readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly engine: v.LiteralSchema<"local-k3s", undefined>;
+        readonly kubernetes: v.ObjectSchema<{
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /**
+             * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`. With
+             * `renderer: 'kustomize'`, ABSENT ⇒ honor the overlay's own `namespace:` when it pins one
+             * (the shared-namespace ephemeral-env shape, where base + overlay name a fixed namespace);
+             * SET ⇒ override it (the adapter sets the namespace at build time) for true per-PR
+             * isolation. For raw manifests, absent ⇒ a default derived from the PR number / block id.
+             */
+            readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+            /** How the environment URL is derived once applied. */
+            readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+                readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+                readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+                readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+                readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+                readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+                readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>], undefined>;
+            /** Optional image reference made available to the manifests as `{{image}}`. */
+            readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Fallback TTL (ms) after which the env is swept + torn down. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+             * before reporting the env still `provisioning` (the backend keeps polling). Absent ⇒ the
+             * harness default (180s). Merged into the provision config via `...kube` at provision time.
+             */
+            readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+            /** Extra labels stamped on the namespace + every applied resource. */
+            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Extra annotations stamped on the namespace. */
+            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /**
+             * Workspace-level (cluster-singleton) helm releases the deploy adapter ensures before
+             * applying a service's manifests — e.g. an ingress/gateway controller shared by every
+             * per-PR env. Use `scope: 'shared'`; installed once, never torn down per-PR. Merged
+             * with the service's own (per-environment) `helmReleases` at provision time.
+             */
+            readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                /** Release name. */
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+                readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+                readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+                readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+                readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Inline `--values` overrides. */
+                readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+                /** Templated `--set` overrides. */
+                readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    /** The value, templated over the provision vars. */
+                    readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+                }, undefined>, undefined>, undefined>;
+                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+                readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+            }, undefined>, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly engine: v.LiteralSchema<"remote-kubernetes", undefined>;
+        readonly kubernetes: v.ObjectSchema<{
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /**
+             * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`. With
+             * `renderer: 'kustomize'`, ABSENT ⇒ honor the overlay's own `namespace:` when it pins one
+             * (the shared-namespace ephemeral-env shape, where base + overlay name a fixed namespace);
+             * SET ⇒ override it (the adapter sets the namespace at build time) for true per-PR
+             * isolation. For raw manifests, absent ⇒ a default derived from the PR number / block id.
+             */
+            readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+            /** How the environment URL is derived once applied. */
+            readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+                readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+                readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+                readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+                readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+                readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+                readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>], undefined>;
+            /** Optional image reference made available to the manifests as `{{image}}`. */
+            readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Fallback TTL (ms) after which the env is swept + torn down. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+             * before reporting the env still `provisioning` (the backend keeps polling). Absent ⇒ the
+             * harness default (180s). Merged into the provision config via `...kube` at provision time.
+             */
+            readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+            /** Extra labels stamped on the namespace + every applied resource. */
+            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Extra annotations stamped on the namespace. */
+            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /**
+             * Workspace-level (cluster-singleton) helm releases the deploy adapter ensures before
+             * applying a service's manifests — e.g. an ingress/gateway controller shared by every
+             * per-PR env. Use `scope: 'shared'`; installed once, never torn down per-PR. Merged
+             * with the service's own (per-environment) `helmReleases` at provision time.
+             */
+            readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                /** Release name. */
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+                readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+                readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+                readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+                readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Inline `--values` overrides. */
+                readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+                /** Templated `--set` overrides. */
+                readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    /** The value, templated over the provision vars. */
+                    readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+                }, undefined>, undefined>, undefined>;
+                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+                readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+            }, undefined>, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly engine: v.LiteralSchema<"remote-custom", undefined>;
+        readonly manifest: v.ObjectSchema<{
+            readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** Management API root; provision/status/teardown paths are appended to it. */
+            readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"none", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"api_key", undefined>;
+                readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                /** Optional prefix prepended to the secret value, e.g. `Token `. */
+                readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"bearer", undefined>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"basic", undefined>;
+                readonly usernameSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly passwordSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly clientIdSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly clientSecretSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                readonly headers: v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>], undefined>;
+            readonly provision: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Optional: polled to observe async provisioning progress. */
+            readonly status: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            /** Optional: called to destroy the environment (manual or on TTL expiry). */
+            readonly teardown: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            readonly response: v.ObjectSchema<{
+                readonly urlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly access: v.OptionalSchema<v.ObjectSchema<{
+                    readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+                    readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>;
+            /** Fallback TTL (ms) when the response carries no explicit expiry. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+             * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+             * entirely; a custom backend — registered by reference into the app-owned
+             * `EnvironmentBackendRegistry` (see `backend/docs/native-environment-adapter.md`) — reads
+             * + validates it off the per-call
+             * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+             * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+             * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+             * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+             * (reuse the exported `UrlSafetyPolicy`).
+             */
+            readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+        }, undefined>;
+        /** Which custom manifest shape this remote provider consumes — matched to a service's `manifestId`. */
+        readonly acceptsManifestId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+    }, undefined>], undefined>;
+    readonly backendKind: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    readonly secrets: v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>;
+}, undefined>;
+export type RegisterEnvironmentHandlerInput = v.InferOutput<typeof registerEnvironmentHandlerSchema>;
+/**
+ * The body for a per-USER handler override PUT, where the provision type is taken from the
+ * path (`/me/environment-handlers/:workspaceId/:provisionType`) — so the body carries only
+ * the config + secrets (+ optional `manifestId`/`backendKind`), and must NOT re-send a
+ * `provisionType` the handler would ignore.
+ */
+export declare const upsertEnvironmentUserHandlerBodySchema: v.ObjectSchema<{
+    readonly manifestId: v.OptionalSchema<v.NullableSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>, undefined>, undefined>;
+    readonly config: v.VariantSchema<"engine", [v.ObjectSchema<{
+        readonly engine: v.LiteralSchema<"local-docker", undefined>;
+        readonly manifest: v.ObjectSchema<{
+            readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** Management API root; provision/status/teardown paths are appended to it. */
+            readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"none", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"api_key", undefined>;
+                readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                /** Optional prefix prepended to the secret value, e.g. `Token `. */
+                readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"bearer", undefined>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"basic", undefined>;
+                readonly usernameSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly passwordSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly clientIdSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly clientSecretSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                readonly headers: v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>], undefined>;
+            readonly provision: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Optional: polled to observe async provisioning progress. */
+            readonly status: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            /** Optional: called to destroy the environment (manual or on TTL expiry). */
+            readonly teardown: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            readonly response: v.ObjectSchema<{
+                readonly urlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly access: v.OptionalSchema<v.ObjectSchema<{
+                    readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+                    readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>;
+            /** Fallback TTL (ms) when the response carries no explicit expiry. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+             * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+             * entirely; a custom backend — registered by reference into the app-owned
+             * `EnvironmentBackendRegistry` (see `backend/docs/native-environment-adapter.md`) — reads
+             * + validates it off the per-call
+             * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+             * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+             * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+             * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+             * (reuse the exported `UrlSafetyPolicy`).
+             */
+            readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly engine: v.LiteralSchema<"local-k3s", undefined>;
+        readonly kubernetes: v.ObjectSchema<{
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /**
+             * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`. With
+             * `renderer: 'kustomize'`, ABSENT ⇒ honor the overlay's own `namespace:` when it pins one
+             * (the shared-namespace ephemeral-env shape, where base + overlay name a fixed namespace);
+             * SET ⇒ override it (the adapter sets the namespace at build time) for true per-PR
+             * isolation. For raw manifests, absent ⇒ a default derived from the PR number / block id.
+             */
+            readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+            /** How the environment URL is derived once applied. */
+            readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+                readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+                readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+                readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+                readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+                readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+                readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>], undefined>;
+            /** Optional image reference made available to the manifests as `{{image}}`. */
+            readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Fallback TTL (ms) after which the env is swept + torn down. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+             * before reporting the env still `provisioning` (the backend keeps polling). Absent ⇒ the
+             * harness default (180s). Merged into the provision config via `...kube` at provision time.
+             */
+            readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+            /** Extra labels stamped on the namespace + every applied resource. */
+            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Extra annotations stamped on the namespace. */
+            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /**
+             * Workspace-level (cluster-singleton) helm releases the deploy adapter ensures before
+             * applying a service's manifests — e.g. an ingress/gateway controller shared by every
+             * per-PR env. Use `scope: 'shared'`; installed once, never torn down per-PR. Merged
+             * with the service's own (per-environment) `helmReleases` at provision time.
+             */
+            readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                /** Release name. */
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+                readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+                readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+                readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+                readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Inline `--values` overrides. */
+                readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+                /** Templated `--set` overrides. */
+                readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    /** The value, templated over the provision vars. */
+                    readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+                }, undefined>, undefined>, undefined>;
+                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+                readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+            }, undefined>, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly engine: v.LiteralSchema<"remote-kubernetes", undefined>;
+        readonly kubernetes: v.ObjectSchema<{
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /**
+             * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`. With
+             * `renderer: 'kustomize'`, ABSENT ⇒ honor the overlay's own `namespace:` when it pins one
+             * (the shared-namespace ephemeral-env shape, where base + overlay name a fixed namespace);
+             * SET ⇒ override it (the adapter sets the namespace at build time) for true per-PR
+             * isolation. For raw manifests, absent ⇒ a default derived from the PR number / block id.
+             */
+            readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+            /** How the environment URL is derived once applied. */
+            readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+                readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+                readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+                readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+                readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+                readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+                readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>], undefined>;
+            /** Optional image reference made available to the manifests as `{{image}}`. */
+            readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Fallback TTL (ms) after which the env is swept + torn down. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+             * before reporting the env still `provisioning` (the backend keeps polling). Absent ⇒ the
+             * harness default (180s). Merged into the provision config via `...kube` at provision time.
+             */
+            readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+            /** Extra labels stamped on the namespace + every applied resource. */
+            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Extra annotations stamped on the namespace. */
+            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /**
+             * Workspace-level (cluster-singleton) helm releases the deploy adapter ensures before
+             * applying a service's manifests — e.g. an ingress/gateway controller shared by every
+             * per-PR env. Use `scope: 'shared'`; installed once, never torn down per-PR. Merged
+             * with the service's own (per-environment) `helmReleases` at provision time.
+             */
+            readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                /** Release name. */
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+                readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+                readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+                readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+                readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Inline `--values` overrides. */
+                readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+                /** Templated `--set` overrides. */
+                readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    /** The value, templated over the provision vars. */
+                    readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+                }, undefined>, undefined>, undefined>;
+                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+                readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+            }, undefined>, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly engine: v.LiteralSchema<"remote-custom", undefined>;
+        readonly manifest: v.ObjectSchema<{
+            readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** Management API root; provision/status/teardown paths are appended to it. */
+            readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"none", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"api_key", undefined>;
+                readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                /** Optional prefix prepended to the secret value, e.g. `Token `. */
+                readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"bearer", undefined>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"basic", undefined>;
+                readonly usernameSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly passwordSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly clientIdSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly clientSecretSecretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+                readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                readonly headers: v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>], undefined>;
+            readonly provision: v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>;
+            /** Optional: polled to observe async provisioning progress. */
+            readonly status: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            /** Optional: called to destroy the environment (manual or on TTL expiry). */
+            readonly teardown: v.OptionalSchema<v.ObjectSchema<{
+                readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly key: v.StringSchema<undefined>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly value: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            readonly response: v.ObjectSchema<{
+                readonly urlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly access: v.OptionalSchema<v.ObjectSchema<{
+                    readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+                    readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>;
+            /** Fallback TTL (ms) when the response carries no explicit expiry. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+             * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+             * entirely; a custom backend — registered by reference into the app-owned
+             * `EnvironmentBackendRegistry` (see `backend/docs/native-environment-adapter.md`) — reads
+             * + validates it off the per-call
+             * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+             * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+             * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+             * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+             * (reuse the exported `UrlSafetyPolicy`).
+             */
+            readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+        }, undefined>;
+        /** Which custom manifest shape this remote provider consumes — matched to a service's `manifestId`. */
+        readonly acceptsManifestId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+    }, undefined>], undefined>;
+    readonly backendKind: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    readonly secrets: v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>;
+}, undefined>;
+export type UpsertEnvironmentUserHandlerBody = v.InferOutput<typeof upsertEnvironmentUserHandlerBodySchema>;
+/** The batched per-type handler bundle: every workspace handler + the custom-type catalog. */
+export declare const environmentHandlersBundleSchema: v.ObjectSchema<{
+    readonly handlers: v.ArraySchema<v.ObjectSchema<{
+        readonly provisionType: v.PicklistSchema<["kubernetes", "docker-compose", "custom", "infraless"], undefined>;
+        /** For `custom`: the manifest id this handler is keyed to; `null` otherwise. */
+        readonly manifestId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+        readonly engine: v.PicklistSchema<["local-docker", "local-k3s", "remote-kubernetes", "remote-custom", "none"], undefined>;
+        readonly providerId: v.StringSchema<undefined>;
+        readonly label: v.StringSchema<undefined>;
+        readonly baseUrl: v.StringSchema<undefined>;
+        readonly connectedAt: v.NumberSchema<undefined>;
+        /** Which secret keys are set (names only), so the UI can show completeness. */
+        readonly secretKeys: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+        /** For `remote-custom`: the manifest id this provider accepts; `null` otherwise. */
+        readonly acceptsManifestId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+        /** The stored handler config, sans secrets, for connect-form prefill on edit. */
+        readonly config: v.OptionalSchema<v.VariantSchema<"engine", [v.ObjectSchema<{
+            readonly engine: v.LiteralSchema<"local-docker", undefined>;
+            readonly manifest: v.ObjectSchema<{
+                readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+                /** Management API root; provision/status/teardown paths are appended to it. */
+                readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                    readonly type: v.LiteralSchema<"none", undefined>;
+                }, undefined>, v.ObjectSchema<{
+                    readonly type: v.LiteralSchema<"api_key", undefined>;
+                    readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                    /** Optional prefix prepended to the secret value, e.g. `Token `. */
+                    readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, v.ObjectSchema<{
+                    readonly type: v.LiteralSchema<"bearer", undefined>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, v.ObjectSchema<{
+                    readonly type: v.LiteralSchema<"basic", undefined>;
+                    readonly usernameSecretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                    readonly passwordSecretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, v.ObjectSchema<{
+                    readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                    readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                    readonly clientIdSecretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                    readonly clientSecretSecretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                    readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, v.ObjectSchema<{
+                    readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                    readonly headers: v.ArraySchema<v.ObjectSchema<{
+                        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                        readonly secretRef: v.ObjectSchema<{
+                            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                        }, undefined>;
+                    }, undefined>, undefined>;
+                }, undefined>], undefined>;
+                readonly provision: v.ObjectSchema<{
+                    readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                    readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                    readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                        readonly key: v.StringSchema<undefined>;
+                        readonly value: v.StringSchema<undefined>;
+                    }, undefined>, undefined>, undefined>;
+                    readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                        readonly value: v.StringSchema<undefined>;
+                    }, undefined>, undefined>, undefined>;
+                    readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                    readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+                }, undefined>;
+                /** Optional: polled to observe async provisioning progress. */
+                readonly status: v.OptionalSchema<v.ObjectSchema<{
+                    readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                    readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                    readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                        readonly key: v.StringSchema<undefined>;
+                        readonly value: v.StringSchema<undefined>;
+                    }, undefined>, undefined>, undefined>;
+                    readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                        readonly value: v.StringSchema<undefined>;
+                    }, undefined>, undefined>, undefined>;
+                    readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                    readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+                }, undefined>, undefined>;
+                /** Optional: called to destroy the environment (manual or on TTL expiry). */
+                readonly teardown: v.OptionalSchema<v.ObjectSchema<{
+                    readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                    readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                    readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                        readonly key: v.StringSchema<undefined>;
+                        readonly value: v.StringSchema<undefined>;
+                    }, undefined>, undefined>, undefined>;
+                    readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                        readonly value: v.StringSchema<undefined>;
+                    }, undefined>, undefined>, undefined>;
+                    readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                    readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+                }, undefined>, undefined>;
+                readonly response: v.ObjectSchema<{
+                    readonly urlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                        readonly from: v.StringSchema<undefined>;
+                        readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+                    }, undefined>, undefined>, undefined>;
+                    readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly access: v.OptionalSchema<v.ObjectSchema<{
+                        readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+                        readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                        readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                        readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                        readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                        readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    }, undefined>, undefined>;
+                }, undefined>;
+                /** Fallback TTL (ms) when the response carries no explicit expiry. */
+                readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+                /**
+                 * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+                 * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+                 * entirely; a custom backend — registered by reference into the app-owned
+                 * `EnvironmentBackendRegistry` (see `backend/docs/native-environment-adapter.md`) — reads
+                 * + validates it off the per-call
+                 * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+                 * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+                 * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+                 * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+                 * (reuse the exported `UrlSafetyPolicy`).
+                 */
+                readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly engine: v.LiteralSchema<"local-k3s", undefined>;
+            readonly kubernetes: v.ObjectSchema<{
+                readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+                /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+                readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+                readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+                readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+                /**
+                 * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`. With
+                 * `renderer: 'kustomize'`, ABSENT ⇒ honor the overlay's own `namespace:` when it pins one
+                 * (the shared-namespace ephemeral-env shape, where base + overlay name a fixed namespace);
+                 * SET ⇒ override it (the adapter sets the namespace at build time) for true per-PR
+                 * isolation. For raw manifests, absent ⇒ a default derived from the PR number / block id.
+                 */
+                readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+                /** How the environment URL is derived once applied. */
+                readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+                    readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+                    /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+                    readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+                }, undefined>, v.ObjectSchema<{
+                    readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+                    /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+                    readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+                }, undefined>, v.ObjectSchema<{
+                    readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+                    /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+                    readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+                    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+                }, undefined>, v.ObjectSchema<{
+                    readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+                    /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+                    readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+                }, undefined>, v.ObjectSchema<{
+                    readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+                    /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+                    readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+                }, undefined>], undefined>;
+                /** Optional image reference made available to the manifests as `{{image}}`. */
+                readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Fallback TTL (ms) after which the env is swept + torn down. */
+                readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+                /**
+                 * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+                 * before reporting the env still `provisioning` (the backend keeps polling). Absent ⇒ the
+                 * harness default (180s). Merged into the provision config via `...kube` at provision time.
+                 */
+                readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+                /** Extra labels stamped on the namespace + every applied resource. */
+                readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+                /** Extra annotations stamped on the namespace. */
+                readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+                /**
+                 * Workspace-level (cluster-singleton) helm releases the deploy adapter ensures before
+                 * applying a service's manifests — e.g. an ingress/gateway controller shared by every
+                 * per-PR env. Use `scope: 'shared'`; installed once, never torn down per-PR. Merged
+                 * with the service's own (per-environment) `helmReleases` at provision time.
+                 */
+                readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    /** Release name. */
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+                    readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+                    readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                    /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+                    readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+                    /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+                    readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                    /** Inline `--values` overrides. */
+                    readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+                    /** Templated `--set` overrides. */
+                    readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                        /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+                        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                        /** The value, templated over the provision vars. */
+                        readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+                    }, undefined>, undefined>, undefined>;
+                    /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+                    readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                        readonly secretRef: v.ObjectSchema<{
+                            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                        }, undefined>;
+                    }, undefined>, undefined>, undefined>;
+                    readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly engine: v.LiteralSchema<"remote-kubernetes", undefined>;
+            readonly kubernetes: v.ObjectSchema<{
+                readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+                /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+                readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+                readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+                readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+                /**
+                 * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`. With
+                 * `renderer: 'kustomize'`, ABSENT ⇒ honor the overlay's own `namespace:` when it pins one
+                 * (the shared-namespace ephemeral-env shape, where base + overlay name a fixed namespace);
+                 * SET ⇒ override it (the adapter sets the namespace at build time) for true per-PR
+                 * isolation. For raw manifests, absent ⇒ a default derived from the PR number / block id.
+                 */
+                readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+                /** How the environment URL is derived once applied. */
+                readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+                    readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+                    /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+                    readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+                }, undefined>, v.ObjectSchema<{
+                    readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+                    /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+                    readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+                }, undefined>, v.ObjectSchema<{
+                    readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+                    /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+                    readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+                    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+                }, undefined>, v.ObjectSchema<{
+                    readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+                    /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+                    readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+                }, undefined>, v.ObjectSchema<{
+                    readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+                    /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+                    readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                    readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+                }, undefined>], undefined>;
+                /** Optional image reference made available to the manifests as `{{image}}`. */
+                readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Fallback TTL (ms) after which the env is swept + torn down. */
+                readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+                /**
+                 * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+                 * before reporting the env still `provisioning` (the backend keeps polling). Absent ⇒ the
+                 * harness default (180s). Merged into the provision config via `...kube` at provision time.
+                 */
+                readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+                /** Extra labels stamped on the namespace + every applied resource. */
+                readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+                /** Extra annotations stamped on the namespace. */
+                readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+                /**
+                 * Workspace-level (cluster-singleton) helm releases the deploy adapter ensures before
+                 * applying a service's manifests — e.g. an ingress/gateway controller shared by every
+                 * per-PR env. Use `scope: 'shared'`; installed once, never torn down per-PR. Merged
+                 * with the service's own (per-environment) `helmReleases` at provision time.
+                 */
+                readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    /** Release name. */
+                    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+                    readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+                    readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                    /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+                    readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+                    /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+                    readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                    /** Inline `--values` overrides. */
+                    readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+                    /** Templated `--set` overrides. */
+                    readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                        /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+                        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                        /** The value, templated over the provision vars. */
+                        readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+                    }, undefined>, undefined>, undefined>;
+                    /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+                    readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                        readonly secretRef: v.ObjectSchema<{
+                            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                        }, undefined>;
+                    }, undefined>, undefined>, undefined>;
+                    readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly engine: v.LiteralSchema<"remote-custom", undefined>;
+            readonly manifest: v.ObjectSchema<{
+                readonly providerId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+                /** Management API root; provision/status/teardown paths are appended to it. */
+                readonly baseUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly auth: v.VariantSchema<"type", [v.ObjectSchema<{
+                    readonly type: v.LiteralSchema<"none", undefined>;
+                }, undefined>, v.ObjectSchema<{
+                    readonly type: v.LiteralSchema<"api_key", undefined>;
+                    readonly headerName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                    /** Optional prefix prepended to the secret value, e.g. `Token `. */
+                    readonly valuePrefix: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, v.ObjectSchema<{
+                    readonly type: v.LiteralSchema<"bearer", undefined>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, v.ObjectSchema<{
+                    readonly type: v.LiteralSchema<"basic", undefined>;
+                    readonly usernameSecretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                    readonly passwordSecretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, v.ObjectSchema<{
+                    readonly type: v.LiteralSchema<"oauth2_client_credentials", undefined>;
+                    readonly tokenUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                    readonly clientIdSecretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                    readonly clientSecretSecretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                    readonly scope: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly audience: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, v.ObjectSchema<{
+                    readonly type: v.LiteralSchema<"custom_headers", undefined>;
+                    readonly headers: v.ArraySchema<v.ObjectSchema<{
+                        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                        readonly secretRef: v.ObjectSchema<{
+                            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                        }, undefined>;
+                    }, undefined>, undefined>;
+                }, undefined>], undefined>;
+                readonly provision: v.ObjectSchema<{
+                    readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                    readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                    readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                        readonly key: v.StringSchema<undefined>;
+                        readonly value: v.StringSchema<undefined>;
+                    }, undefined>, undefined>, undefined>;
+                    readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                        readonly value: v.StringSchema<undefined>;
+                    }, undefined>, undefined>, undefined>;
+                    readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                    readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+                }, undefined>;
+                /** Optional: polled to observe async provisioning progress. */
+                readonly status: v.OptionalSchema<v.ObjectSchema<{
+                    readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                    readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                    readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                        readonly key: v.StringSchema<undefined>;
+                        readonly value: v.StringSchema<undefined>;
+                    }, undefined>, undefined>, undefined>;
+                    readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                        readonly value: v.StringSchema<undefined>;
+                    }, undefined>, undefined>, undefined>;
+                    readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                    readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+                }, undefined>, undefined>;
+                /** Optional: called to destroy the environment (manual or on TTL expiry). */
+                readonly teardown: v.OptionalSchema<v.ObjectSchema<{
+                    readonly method: v.PicklistSchema<["GET", "POST", "PUT", "PATCH", "DELETE"], undefined>;
+                    readonly pathTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                    readonly query: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                        readonly key: v.StringSchema<undefined>;
+                        readonly value: v.StringSchema<undefined>;
+                    }, undefined>, undefined>, undefined>;
+                    readonly headers: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                        readonly value: v.StringSchema<undefined>;
+                    }, undefined>, undefined>, undefined>;
+                    readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                    readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+                }, undefined>, undefined>;
+                readonly response: v.ObjectSchema<{
+                    readonly urlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                        readonly from: v.StringSchema<undefined>;
+                        readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+                    }, undefined>, undefined>, undefined>;
+                    readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly access: v.OptionalSchema<v.ObjectSchema<{
+                        readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+                        readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                        readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                        readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                        readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                        readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    }, undefined>, undefined>;
+                }, undefined>;
+                /** Fallback TTL (ms) when the response carries no explicit expiry. */
+                readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+                /**
+                 * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+                 * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+                 * entirely; a custom backend — registered by reference into the app-owned
+                 * `EnvironmentBackendRegistry` (see `backend/docs/native-environment-adapter.md`) — reads
+                 * + validates it off the per-call
+                 * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+                 * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+                 * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+                 * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+                 * (reuse the exported `UrlSafetyPolicy`).
+                 */
+                readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+            }, undefined>;
+            /** Which custom manifest shape this remote provider consumes — matched to a service's `manifestId`. */
+            readonly acceptsManifestId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+        }, undefined>], undefined>, undefined>;
+    }, undefined>, undefined>;
+    readonly customTypes: v.ArraySchema<v.ObjectSchema<{
+        readonly manifestId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+        readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+        /** `registered` (from a code provider) or `workspace` (UI-defined). */
+        readonly source: v.PicklistSchema<["registered", "workspace"], undefined>;
+        /** Optional hint describing the input shape the provider expects. */
+        readonly acceptsInputHint: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+        readonly description: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+    }, undefined>, undefined>;
+}, undefined>;
+export type EnvironmentHandlersBundle = v.InferOutput<typeof environmentHandlersBundleSchema>;
+/** Resolved access creds for a provisioned env, as surfaced to a tester agent. */
+export declare const environmentAccessHandleSchema: v.ObjectSchema<{
+    readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+    readonly token: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    readonly username: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    readonly password: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    readonly headerValue: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+}, undefined>;
+export type EnvironmentAccessHandle = v.InferOutput<typeof environmentAccessHandleSchema>;
+/** A provisioned environment, as exposed to clients and downstream agents. */
+export declare const environmentHandleSchema: v.ObjectSchema<{
+    readonly id: v.StringSchema<undefined>;
+    readonly workspaceId: v.StringSchema<undefined>;
+    readonly blockId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    readonly executionId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    readonly providerId: v.StringSchema<undefined>;
+    readonly externalId: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    readonly url: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    readonly status: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+    /** Present only on the dedicated access endpoint / in agent context. */
+    readonly access: v.OptionalSchema<v.ObjectSchema<{
+        readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+        readonly token: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        readonly username: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        readonly password: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        readonly headerValue: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    }, undefined>, undefined>;
+    readonly createdAt: v.NumberSchema<undefined>;
+    readonly expiresAt: v.NullableSchema<v.NumberSchema<undefined>, undefined>;
+    readonly lastError: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    /**
+     * The service's declared provision type this environment was stood up for
+     * (`kubernetes` | `docker-compose` | `custom` | `infraless`). Recorded at provision
+     * time so run details can show exactly what was provisioned. Null for legacy rows.
+     */
     readonly provisionType: v.OptionalSchema<v.NullableSchema<v.PicklistSchema<["kubernetes", "docker-compose", "custom", "infraless"], undefined>, undefined>, undefined>;
     /**
      * The resolved engine that handled the provisioning (`local-docker` | `local-k3s` |
@@ -1882,10 +4096,115 @@ export declare const environmentConnectionSchema: v.ObjectSchema<{
             readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
             /** Fallback TTL (ms) after which the env is swept + torn down. */
             readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+             * before reporting the env still `provisioning` (the backend keeps polling). Only the
+             * container-backed render path honors it; absent ⇒ the harness default (180s).
+             */
+            readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
             /** Extra labels stamped on the namespace + every applied resource. */
             readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
             /** Extra annotations stamped on the namespace. */
             readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
+            readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
+                readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
+                readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Replacement digest, templated; alternative to a tag. */
+                readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            }, undefined>, v.CheckAction<{
+                name: string;
+                newNameTemplate?: string | undefined;
+                newTagTemplate?: string | undefined;
+                digestTemplate?: string | undefined;
+            }, "an image override must set at least one of newNameTemplate, newTagTemplate, or digestTemplate.">, v.CheckAction<{
+                name: string;
+                newNameTemplate?: string | undefined;
+                newTagTemplate?: string | undefined;
+                digestTemplate?: string | undefined;
+            }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
+            /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
+            readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                /** Release name. */
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+                readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+                readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+                readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+                readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Inline `--values` overrides. */
+                readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+                /** Templated `--set` overrides. */
+                readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    /** The value, templated over the provision vars. */
+                    readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+                }, undefined>, undefined>, undefined>;
+                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+                readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+            }, undefined>, undefined>, undefined>;
+            /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
+            readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
+                readonly mode: v.LiteralSchema<"secret", undefined>;
+                /** Target Secret name in the namespace. */
+                readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Secret `type`; absent ⇒ `Opaque`. */
+                readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                    /** Key inside the rendered Secret / `.env`. */
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+                    /** Resolve the value from the workspace encrypted bundle by key. */
+                    readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>, undefined>;
+                    /** OR a non-secret value, templated over the provision vars. */
+                    readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                }, undefined>, v.CheckAction<{
+                    key: string;
+                    secretRef?: {
+                        key: string;
+                    } | undefined;
+                    valueTemplate?: string | undefined;
+                }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
+                /**
+                 * Repo-relative path within the overlay tree to write the `KEY=value` env file the
+                 * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
+                 * overlay names the Secret.
+                 */
+                readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                    /** Key inside the rendered Secret / `.env`. */
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+                    /** Resolve the value from the workspace encrypted bundle by key. */
+                    readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>, undefined>;
+                    /** OR a non-secret value, templated over the provision vars. */
+                    readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                }, undefined>, v.CheckAction<{
+                    key: string;
+                    secretRef?: {
+                        key: string;
+                    } | undefined;
+                    valueTemplate?: string | undefined;
+                }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+            }, undefined>], undefined>, undefined>, undefined>;
         }, undefined>;
     }, undefined>, v.ObjectSchema<{
         readonly kind: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>, v.RegexAction<string, "must be a lower-kebab slug">, v.CheckAction<string, "reserved backend kind">]>;
@@ -2229,10 +4548,115 @@ export declare const registerEnvironmentProviderSchema: v.ObjectSchema<{
             readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
             /** Fallback TTL (ms) after which the env is swept + torn down. */
             readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+             * before reporting the env still `provisioning` (the backend keeps polling). Only the
+             * container-backed render path honors it; absent ⇒ the harness default (180s).
+             */
+            readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
             /** Extra labels stamped on the namespace + every applied resource. */
             readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
             /** Extra annotations stamped on the namespace. */
             readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
+            readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
+                readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
+                readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Replacement digest, templated; alternative to a tag. */
+                readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            }, undefined>, v.CheckAction<{
+                name: string;
+                newNameTemplate?: string | undefined;
+                newTagTemplate?: string | undefined;
+                digestTemplate?: string | undefined;
+            }, "an image override must set at least one of newNameTemplate, newTagTemplate, or digestTemplate.">, v.CheckAction<{
+                name: string;
+                newNameTemplate?: string | undefined;
+                newTagTemplate?: string | undefined;
+                digestTemplate?: string | undefined;
+            }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
+            /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
+            readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                /** Release name. */
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+                readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+                readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+                readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+                readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Inline `--values` overrides. */
+                readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+                /** Templated `--set` overrides. */
+                readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    /** The value, templated over the provision vars. */
+                    readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+                }, undefined>, undefined>, undefined>;
+                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+                readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+            }, undefined>, undefined>, undefined>;
+            /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
+            readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
+                readonly mode: v.LiteralSchema<"secret", undefined>;
+                /** Target Secret name in the namespace. */
+                readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Secret `type`; absent ⇒ `Opaque`. */
+                readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                    /** Key inside the rendered Secret / `.env`. */
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+                    /** Resolve the value from the workspace encrypted bundle by key. */
+                    readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>, undefined>;
+                    /** OR a non-secret value, templated over the provision vars. */
+                    readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                }, undefined>, v.CheckAction<{
+                    key: string;
+                    secretRef?: {
+                        key: string;
+                    } | undefined;
+                    valueTemplate?: string | undefined;
+                }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
+                /**
+                 * Repo-relative path within the overlay tree to write the `KEY=value` env file the
+                 * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
+                 * overlay names the Secret.
+                 */
+                readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                    /** Key inside the rendered Secret / `.env`. */
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+                    /** Resolve the value from the workspace encrypted bundle by key. */
+                    readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>, undefined>;
+                    /** OR a non-secret value, templated over the provision vars. */
+                    readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                }, undefined>, v.CheckAction<{
+                    key: string;
+                    secretRef?: {
+                        key: string;
+                    } | undefined;
+                    valueTemplate?: string | undefined;
+                }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+            }, undefined>], undefined>, undefined>, undefined>;
         }, undefined>;
     }, undefined>, v.ObjectSchema<{
         readonly kind: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>, v.RegexAction<string, "must be a lower-kebab slug">, v.CheckAction<string, "reserved backend kind">]>;
@@ -2578,10 +5002,115 @@ export declare const testEnvironmentConnectionSchema: v.ObjectSchema<{
             readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
             /** Fallback TTL (ms) after which the env is swept + torn down. */
             readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+             * before reporting the env still `provisioning` (the backend keeps polling). Only the
+             * container-backed render path honors it; absent ⇒ the harness default (180s).
+             */
+            readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
             /** Extra labels stamped on the namespace + every applied resource. */
             readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
             /** Extra annotations stamped on the namespace. */
             readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
+            readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
+                readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
+                readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Replacement digest, templated; alternative to a tag. */
+                readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            }, undefined>, v.CheckAction<{
+                name: string;
+                newNameTemplate?: string | undefined;
+                newTagTemplate?: string | undefined;
+                digestTemplate?: string | undefined;
+            }, "an image override must set at least one of newNameTemplate, newTagTemplate, or digestTemplate.">, v.CheckAction<{
+                name: string;
+                newNameTemplate?: string | undefined;
+                newTagTemplate?: string | undefined;
+                digestTemplate?: string | undefined;
+            }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
+            /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
+            readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                /** Release name. */
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+                readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+                readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+                readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+                readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Inline `--values` overrides. */
+                readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+                /** Templated `--set` overrides. */
+                readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    /** The value, templated over the provision vars. */
+                    readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+                }, undefined>, undefined>, undefined>;
+                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+                readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+            }, undefined>, undefined>, undefined>;
+            /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
+            readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
+                readonly mode: v.LiteralSchema<"secret", undefined>;
+                /** Target Secret name in the namespace. */
+                readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Secret `type`; absent ⇒ `Opaque`. */
+                readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                    /** Key inside the rendered Secret / `.env`. */
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+                    /** Resolve the value from the workspace encrypted bundle by key. */
+                    readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>, undefined>;
+                    /** OR a non-secret value, templated over the provision vars. */
+                    readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                }, undefined>, v.CheckAction<{
+                    key: string;
+                    secretRef?: {
+                        key: string;
+                    } | undefined;
+                    valueTemplate?: string | undefined;
+                }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
+                /**
+                 * Repo-relative path within the overlay tree to write the `KEY=value` env file the
+                 * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
+                 * overlay names the Secret.
+                 */
+                readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                    /** Key inside the rendered Secret / `.env`. */
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+                    /** Resolve the value from the workspace encrypted bundle by key. */
+                    readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>, undefined>;
+                    /** OR a non-secret value, templated over the provision vars. */
+                    readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                }, undefined>, v.CheckAction<{
+                    key: string;
+                    secretRef?: {
+                        key: string;
+                    } | undefined;
+                    valueTemplate?: string | undefined;
+                }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+            }, undefined>], undefined>, undefined>, undefined>;
         }, undefined>;
     }, undefined>, v.ObjectSchema<{
         readonly kind: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>, v.RegexAction<string, "must be a lower-kebab slug">, v.CheckAction<string, "reserved backend kind">]>;