@cat-factory/contracts 0.97.0 → 0.99.0

package/dist/environments.d.ts

@@ -753,8 +753,194 @@ export declare const kubernetesProvisionConfigSchema: v.ObjectSchema<{
     }, undefined>], undefined>, undefined>, undefined>;
 }, undefined>;
 export type KubernetesProvisionConfig = v.InferOutput<typeof kubernetesProvisionConfigSchema>;
+/**
+ * The AWS EKS provision config: the full Kubernetes provision config (an EKS apiserver is a
+ * standard apiserver, so per-PR namespaces + manifest apply are identical) PLUS the AWS
+ * `region` + `clusterName` needed to mint the IAM apiserver token. The AWS credentials ride
+ * the secret bundle; the SigV4/STS minting lives in `@cat-factory/eks`.
+ */
+export declare const eksProvisionConfigSchema: v.ObjectSchema<{
+    readonly region: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be an AWS region slug">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+    readonly clusterName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+    readonly stsHost: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a bare host or host:port">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 255, undefined>]>, undefined>;
+    /** Human label for the connection (shown in the UI). */
+    readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+    /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+    readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+    /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+    readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+    readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+    /**
+     * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
+     * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
+     * default derived from the PR number / block id.
+     */
+    readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+    /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
+    readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
+        readonly type: v.LiteralSchema<"colocated", undefined>;
+        /** File or directory path within the PR repo (read at the PR head branch). */
+        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly type: v.LiteralSchema<"separate", undefined>;
+        /** `owner/repo` of the manifests repo. */
+        readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+        /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
+        readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        /** File or directory path within the manifests repo. */
+        readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+    }, undefined>], undefined>;
+    /** How the environment URL is derived once applied. */
+    readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+        /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+        readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+        /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+        readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+        /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+        readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+        readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+        /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+        readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+        /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+        readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+    }, undefined>], undefined>;
+    /**
+     * Optional image reference made available to the manifests as `{{image}}` (e.g. a
+     * CI-built image tagged by branch/sha). Itself a template over the provision vars.
+     */
+    readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+    /** Fallback TTL (ms) after which the env is swept + torn down. */
+    readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+    /**
+     * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+     * before reporting the env still `provisioning` (the backend keeps polling). Only the
+     * container-backed render path honors it; absent ⇒ the harness default (180s).
+     */
+    readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+    /** Extra labels stamped on the namespace + every applied resource. */
+    readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+    /** Extra annotations stamped on the namespace. */
+    readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+    /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
+    readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+        /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
+        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
+        readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+        /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
+        readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+        /** Replacement digest, templated; alternative to a tag. */
+        readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+    }, undefined>, v.CheckAction<{
+        name: string;
+        newNameTemplate?: string | undefined;
+        newTagTemplate?: string | undefined;
+        digestTemplate?: string | undefined;
+    }, "an image override must set at least one of newNameTemplate, newTagTemplate, or digestTemplate.">, v.CheckAction<{
+        name: string;
+        newNameTemplate?: string | undefined;
+        newTagTemplate?: string | undefined;
+        digestTemplate?: string | undefined;
+    }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
+    /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
+    readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+        /** Release name. */
+        readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+        readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+        readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+        /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+        readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+        /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+        readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+        /** Inline `--values` overrides. */
+        readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+        /** Templated `--set` overrides. */
+        readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+            /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            /** The value, templated over the provision vars. */
+            readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+        }, undefined>, undefined>, undefined>;
+        /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+        readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            readonly secretRef: v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>;
+        }, undefined>, undefined>, undefined>;
+        readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+    }, undefined>, undefined>, undefined>;
+    /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
+    readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
+        readonly mode: v.LiteralSchema<"secret", undefined>;
+        /** Target Secret name in the namespace. */
+        readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** Secret `type`; absent ⇒ `Opaque`. */
+        readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+            /** Key inside the rendered Secret / `.env`. */
+            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+            /** Resolve the value from the workspace encrypted bundle by key. */
+            readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>, undefined>;
+            /** OR a non-secret value, templated over the provision vars. */
+            readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+        }, undefined>, v.CheckAction<{
+            key: string;
+            secretRef?: {
+                key: string;
+            } | undefined;
+            valueTemplate?: string | undefined;
+        }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
+        /**
+         * Repo-relative path within the overlay tree to write the `KEY=value` env file the
+         * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
+         * overlay names the Secret.
+         */
+        readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+            /** Key inside the rendered Secret / `.env`. */
+            readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+            /** Resolve the value from the workspace encrypted bundle by key. */
+            readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            }, undefined>, undefined>;
+            /** OR a non-secret value, templated over the provision vars. */
+            readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+        }, undefined>, v.CheckAction<{
+            key: string;
+            secretRef?: {
+                key: string;
+            } | undefined;
+            valueTemplate?: string | undefined;
+        }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+    }, undefined>], undefined>, undefined>, undefined>;
+}, undefined>;
+export type EksProvisionConfig = v.InferOutput<typeof eksProvisionConfigSchema>;
 /** Built-in environment backend kinds the contract knows by name. */
-export declare const RESERVED_ENVIRONMENT_BACKEND_KINDS: readonly ['manifest', 'kubernetes'];
+export declare const RESERVED_ENVIRONMENT_BACKEND_KINDS: readonly ['manifest', 'kubernetes', 'eks'];
 /**
  * The `kind` slug of a CUSTOM (third-party, programmatically-registered) environment
  * backend: any lower-kebab slug that isn't a reserved built-in. A custom backend stores
@@ -878,36 +1064,217 @@ export declare const environmentBackendConfigSchema: v.VariantSchema<"kind", [v.
                 readonly from: v.StringSchema<undefined>;
                 readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
             }, undefined>, undefined>, undefined>;
-            readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            readonly access: v.OptionalSchema<v.ObjectSchema<{
-                readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
-                readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-            }, undefined>, undefined>;
-        }, undefined>;
-        /** Fallback TTL (ms) when the response carries no explicit expiry. */
-        readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
-        /**
-         * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
-         * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
-         * entirely; a custom backend — registered by reference into the app-owned
-         * `EnvironmentBackendRegistry` (see `backend/docs/native-environment-adapter.md`) — reads
-         * + validates it off the per-call
-         * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
-         * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
-         * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
-         * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
-         * (reuse the exported `UrlSafetyPolicy`).
-         */
-        readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+            readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            readonly access: v.OptionalSchema<v.ObjectSchema<{
+                readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+                readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+        /** Fallback TTL (ms) when the response carries no explicit expiry. */
+        readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+        /**
+         * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+         * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+         * entirely; a custom backend — registered by reference into the app-owned
+         * `EnvironmentBackendRegistry` (see `backend/docs/native-environment-adapter.md`) — reads
+         * + validates it off the per-call
+         * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+         * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+         * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+         * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+         * (reuse the exported `UrlSafetyPolicy`).
+         */
+        readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+    }, undefined>;
+}, undefined>, v.ObjectSchema<{
+    readonly kind: v.LiteralSchema<"kubernetes", undefined>;
+    readonly kubernetes: v.ObjectSchema<{
+        /** Human label for the connection (shown in the UI). */
+        readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+        /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+        readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+        /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+        readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+        readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+        /**
+         * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
+         * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
+         * default derived from the PR number / block id.
+         */
+        readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+        /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
+        readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"colocated", undefined>;
+            /** File or directory path within the PR repo (read at the PR head branch). */
+            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly type: v.LiteralSchema<"separate", undefined>;
+            /** `owner/repo` of the manifests repo. */
+            readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+            /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
+            readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+            /** File or directory path within the manifests repo. */
+            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+        }, undefined>], undefined>;
+        /** How the environment URL is derived once applied. */
+        readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+            readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+            /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+            readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+            /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+            readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+            readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+            /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+            readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+            readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+            readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+            /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+            readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+            readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+            /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+            readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+            readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+        }, undefined>], undefined>;
+        /**
+         * Optional image reference made available to the manifests as `{{image}}` (e.g. a
+         * CI-built image tagged by branch/sha). Itself a template over the provision vars.
+         */
+        readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+        /** Fallback TTL (ms) after which the env is swept + torn down. */
+        readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+        /**
+         * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+         * before reporting the env still `provisioning` (the backend keeps polling). Only the
+         * container-backed render path honors it; absent ⇒ the harness default (180s).
+         */
+        readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+        /** Extra labels stamped on the namespace + every applied resource. */
+        readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+        /** Extra annotations stamped on the namespace. */
+        readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+        /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
+        readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+            /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
+            readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
+            readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
+            readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Replacement digest, templated; alternative to a tag. */
+            readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+        }, undefined>, v.CheckAction<{
+            name: string;
+            newNameTemplate?: string | undefined;
+            newTagTemplate?: string | undefined;
+            digestTemplate?: string | undefined;
+        }, "an image override must set at least one of newNameTemplate, newTagTemplate, or digestTemplate.">, v.CheckAction<{
+            name: string;
+            newNameTemplate?: string | undefined;
+            newTagTemplate?: string | undefined;
+            digestTemplate?: string | undefined;
+        }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
+        /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
+        readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+            /** Release name. */
+            readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+            readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+            readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+            /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+            readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+            /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+            readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Inline `--values` overrides. */
+            readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+            /** Templated `--set` overrides. */
+            readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+                readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** The value, templated over the provision vars. */
+                readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+            }, undefined>, undefined>, undefined>;
+            /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+            readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                readonly secretRef: v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>;
+            }, undefined>, undefined>, undefined>;
+            readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+        }, undefined>, undefined>, undefined>;
+        /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
+        readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
+            readonly mode: v.LiteralSchema<"secret", undefined>;
+            /** Target Secret name in the namespace. */
+            readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+            /** Secret `type`; absent ⇒ `Opaque`. */
+            readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+            readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                /** Key inside the rendered Secret / `.env`. */
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+                /** Resolve the value from the workspace encrypted bundle by key. */
+                readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>, undefined>;
+                /** OR a non-secret value, templated over the provision vars. */
+                readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+            }, undefined>, v.CheckAction<{
+                key: string;
+                secretRef?: {
+                    key: string;
+                } | undefined;
+                valueTemplate?: string | undefined;
+            }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
+            /**
+             * Repo-relative path within the overlay tree to write the `KEY=value` env file the
+             * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
+             * overlay names the Secret.
+             */
+            readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                /** Key inside the rendered Secret / `.env`. */
+                readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+                /** Resolve the value from the workspace encrypted bundle by key. */
+                readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                }, undefined>, undefined>;
+                /** OR a non-secret value, templated over the provision vars. */
+                readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+            }, undefined>, v.CheckAction<{
+                key: string;
+                secretRef?: {
+                    key: string;
+                } | undefined;
+                valueTemplate?: string | undefined;
+            }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+        }, undefined>], undefined>, undefined>, undefined>;
     }, undefined>;
 }, undefined>, v.ObjectSchema<{
-    readonly kind: v.LiteralSchema<"kubernetes", undefined>;
-    readonly kubernetes: v.ObjectSchema<{
+    readonly kind: v.LiteralSchema<"eks", undefined>;
+    readonly eks: v.ObjectSchema<{
+        readonly region: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be an AWS region slug">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+        readonly clusterName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+        readonly stsHost: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a bare host or host:port">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 255, undefined>]>, undefined>;
         /** Human label for the connection (shown in the UI). */
         readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
         /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
@@ -1252,6 +1619,113 @@ export declare const serviceProvisioningSchema: v.ObjectSchema<{
      * contexts, in-checkout bind mounts, and relative `env_file`s resolve.
      */
     readonly composeBuild: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+    /**
+     * `docker-compose`: the declarative STACK RECIPE for a complex multi-step bring-up —
+     * multi-`-f` layering, profiles, env-file materialization, external networks / shared-stack
+     * refs, ordered setup/teardown steps + a terminal health gate. Absent ⇒ the simple
+     * single-file `composePath` + `up --wait` path (when set, `recipe.composeFiles` supersedes
+     * `composePath`). See {@link stackRecipeSchema}.
+     */
+    readonly recipe: v.OptionalSchema<v.ObjectSchema<{
+        readonly composeFiles: v.OptionalSchema<v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>, v.MinLengthAction<string[], 1, undefined>]>, undefined>;
+        readonly composeProfiles: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>, undefined>;
+        readonly envFiles: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+            readonly template: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            readonly target: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+        }, undefined>, undefined>, undefined>;
+        readonly externalNetworks: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>, undefined>;
+        readonly sharedStackRefs: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>, undefined>;
+        readonly setupSteps: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"kind", [v.ObjectSchema<{
+            readonly kind: v.LiteralSchema<"compose-exec", undefined>;
+            readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            readonly service: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>;
+            readonly command: v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>, v.MinLengthAction<string[], 1, undefined>]>;
+            readonly stdinFile: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            readonly user: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+            readonly workdir: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly kind: v.LiteralSchema<"copy-file", undefined>;
+            readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            readonly from: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            readonly to: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly kind: v.LiteralSchema<"wait-http", undefined>;
+            readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            readonly url: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly expectStatus: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 100, undefined>, v.MaxValueAction<number, 599, undefined>]>, undefined>;
+            readonly expectBodyContains: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            readonly intervalMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 250, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly kind: v.LiteralSchema<"wait-file", undefined>;
+            readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            readonly service: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+            readonly intervalMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 250, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly kind: v.LiteralSchema<"host-command", undefined>;
+            readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            readonly command: v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>, v.MinLengthAction<string[], 1, undefined>]>;
+            readonly workdir: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+        }, undefined>], undefined>, undefined>, undefined>;
+        readonly healthGate: v.OptionalSchema<v.VariantSchema<"kind", [v.ObjectSchema<{
+            readonly kind: v.LiteralSchema<"compose-healthy", undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly kind: v.LiteralSchema<"http", undefined>;
+            readonly url: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly expectStatus: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 100, undefined>, v.MaxValueAction<number, 599, undefined>]>, undefined>;
+            readonly expectBodyContains: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            readonly intervalMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 250, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly kind: v.LiteralSchema<"compose-exec", undefined>;
+            readonly service: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>;
+            readonly command: v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>, v.MinLengthAction<string[], 1, undefined>]>;
+            readonly intervalMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 250, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+        }, undefined>], undefined>, undefined>;
+        readonly teardownSteps: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"kind", [v.ObjectSchema<{
+            readonly kind: v.LiteralSchema<"compose-exec", undefined>;
+            readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            readonly service: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>;
+            readonly command: v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>, v.MinLengthAction<string[], 1, undefined>]>;
+            readonly stdinFile: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            readonly user: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+            readonly workdir: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly kind: v.LiteralSchema<"copy-file", undefined>;
+            readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            readonly from: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            readonly to: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly kind: v.LiteralSchema<"wait-http", undefined>;
+            readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            readonly url: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            readonly expectStatus: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 100, undefined>, v.MaxValueAction<number, 599, undefined>]>, undefined>;
+            readonly expectBodyContains: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            readonly intervalMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 250, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly kind: v.LiteralSchema<"wait-file", undefined>;
+            readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            readonly service: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+            readonly intervalMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 250, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+        }, undefined>, v.ObjectSchema<{
+            readonly kind: v.LiteralSchema<"host-command", undefined>;
+            readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            readonly command: v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>, v.MinLengthAction<string[], 1, undefined>]>;
+            readonly workdir: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+        }, undefined>], undefined>, undefined>, undefined>;
+    }, undefined>, undefined>;
     /** `custom`: the custom-manifest-type id this service produces (matched to a remote-custom handler). */
     readonly manifestId: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>, undefined>;
     /** `custom`: optional path to the custom manifest within the repo. */
@@ -4513,47 +4987,228 @@ export declare const environmentConnectionSchema: v.ObjectSchema<{
                     readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
                     readonly value: v.StringSchema<undefined>;
                 }, undefined>, undefined>, undefined>;
-                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
-                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
-            }, undefined>, undefined>;
-            readonly response: v.ObjectSchema<{
-                readonly urlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
-                    readonly from: v.StringSchema<undefined>;
-                    readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+                readonly bodyTemplate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                /** Per-call timeout (ms). Bounded; defaults applied by the adapter. */
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+            }, undefined>, undefined>;
+            readonly response: v.ObjectSchema<{
+                readonly urlPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly statusMap: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly from: v.StringSchema<undefined>;
+                    readonly to: v.PicklistSchema<["provisioning", "ready", "failed", "expired", "tearing_down", "torn_down"], undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                readonly access: v.OptionalSchema<v.ObjectSchema<{
+                    readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
+                    readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>;
+            /** Fallback TTL (ms) when the response carries no explicit expiry. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
+             * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
+             * entirely; a custom backend — registered by reference into the app-owned
+             * `EnvironmentBackendRegistry` (see `backend/docs/native-environment-adapter.md`) — reads
+             * + validates it off the per-call
+             * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
+             * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
+             * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
+             * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
+             * (reuse the exported `UrlSafetyPolicy`).
+             */
+            readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"kubernetes", undefined>;
+        readonly kubernetes: v.ObjectSchema<{
+            /** Human label for the connection (shown in the UI). */
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /**
+             * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
+             * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
+             * default derived from the PR number / block id.
+             */
+            readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+            /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
+            readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"colocated", undefined>;
+                /** File or directory path within the PR repo (read at the PR head branch). */
+                readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"separate", undefined>;
+                /** `owner/repo` of the manifests repo. */
+                readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+                /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
+                readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                /** File or directory path within the manifests repo. */
+                readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+            }, undefined>], undefined>;
+            /** How the environment URL is derived once applied. */
+            readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+                readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+                readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+                readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+                readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+                readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+                readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>], undefined>;
+            /**
+             * Optional image reference made available to the manifests as `{{image}}` (e.g. a
+             * CI-built image tagged by branch/sha). Itself a template over the provision vars.
+             */
+            readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Fallback TTL (ms) after which the env is swept + torn down. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+             * before reporting the env still `provisioning` (the backend keeps polling). Only the
+             * container-backed render path honors it; absent ⇒ the harness default (180s).
+             */
+            readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+            /** Extra labels stamped on the namespace + every applied resource. */
+            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Extra annotations stamped on the namespace. */
+            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
+            readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
+                readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
+                readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Replacement digest, templated; alternative to a tag. */
+                readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            }, undefined>, v.CheckAction<{
+                name: string;
+                newNameTemplate?: string | undefined;
+                newTagTemplate?: string | undefined;
+                digestTemplate?: string | undefined;
+            }, "an image override must set at least one of newNameTemplate, newTagTemplate, or digestTemplate.">, v.CheckAction<{
+                name: string;
+                newNameTemplate?: string | undefined;
+                newTagTemplate?: string | undefined;
+                digestTemplate?: string | undefined;
+            }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
+            /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
+            readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                /** Release name. */
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+                readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+                readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+                readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+                readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Inline `--values` overrides. */
+                readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+                /** Templated `--set` overrides. */
+                readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    /** The value, templated over the provision vars. */
+                    readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+                }, undefined>, undefined>, undefined>;
+                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+                readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
                 }, undefined>, undefined>, undefined>;
-                readonly expiresAtPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                readonly externalIdPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                readonly access: v.OptionalSchema<v.ObjectSchema<{
-                    readonly scheme: v.PicklistSchema<["none", "bearer", "basic", "custom_header"], undefined>;
-                    readonly tokenPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                    readonly usernamePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                    readonly passwordPath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                    readonly headerName: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                    readonly headerValuePath: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-                }, undefined>, undefined>;
-            }, undefined>;
-            /** Fallback TTL (ms) when the response carries no explicit expiry. */
-            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
-            /**
-             * Opaque, provider-specific configuration for a CUSTOM backend (e.g. a Kargo project,
-             * link-selection key, status map). The generic HttpEnvironmentProvider ignores it
-             * entirely; a custom backend — registered by reference into the app-owned
-             * `EnvironmentBackendRegistry` (see `backend/docs/native-environment-adapter.md`) — reads
-             * + validates it off the per-call
-             * `manifest`. This is the per-WORKSPACE config carrier: a custom backend rides the generic
-             * manifest member of `environmentBackendConfigSchema`, so its bespoke settings live here and
-             * its credentials in the secret bundle. NOT covered by the manifest URL/SSRF checks (which
-             * only guard `baseUrl`/`tokenUrl`); a backend that puts a URL here must guard it itself
-             * (reuse the exported `UrlSafetyPolicy`).
-             */
-            readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+                readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+            }, undefined>, undefined>, undefined>;
+            /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
+            readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
+                readonly mode: v.LiteralSchema<"secret", undefined>;
+                /** Target Secret name in the namespace. */
+                readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Secret `type`; absent ⇒ `Opaque`. */
+                readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                    /** Key inside the rendered Secret / `.env`. */
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+                    /** Resolve the value from the workspace encrypted bundle by key. */
+                    readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>, undefined>;
+                    /** OR a non-secret value, templated over the provision vars. */
+                    readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                }, undefined>, v.CheckAction<{
+                    key: string;
+                    secretRef?: {
+                        key: string;
+                    } | undefined;
+                    valueTemplate?: string | undefined;
+                }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
+                /**
+                 * Repo-relative path within the overlay tree to write the `KEY=value` env file the
+                 * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
+                 * overlay names the Secret.
+                 */
+                readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                    /** Key inside the rendered Secret / `.env`. */
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+                    /** Resolve the value from the workspace encrypted bundle by key. */
+                    readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>, undefined>;
+                    /** OR a non-secret value, templated over the provision vars. */
+                    readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                }, undefined>, v.CheckAction<{
+                    key: string;
+                    secretRef?: {
+                        key: string;
+                    } | undefined;
+                    valueTemplate?: string | undefined;
+                }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+            }, undefined>], undefined>, undefined>, undefined>;
         }, undefined>;
     }, undefined>, v.ObjectSchema<{
-        readonly kind: v.LiteralSchema<"kubernetes", undefined>;
-        readonly kubernetes: v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"eks", undefined>;
+        readonly eks: v.ObjectSchema<{
+            readonly region: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be an AWS region slug">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly clusterName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            readonly stsHost: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a bare host or host:port">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 255, undefined>]>, undefined>;
             /** Human label for the connection (shown in the UI). */
             readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
             /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
@@ -5004,8 +5659,189 @@ export declare const registerEnvironmentProviderSchema: v.ObjectSchema<{
             readonly providerConfig: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
         }, undefined>;
     }, undefined>, v.ObjectSchema<{
-        readonly kind: v.LiteralSchema<"kubernetes", undefined>;
-        readonly kubernetes: v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"kubernetes", undefined>;
+        readonly kubernetes: v.ObjectSchema<{
+            /** Human label for the connection (shown in the UI). */
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /**
+             * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
+             * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
+             * default derived from the PR number / block id.
+             */
+            readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+            /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
+            readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"colocated", undefined>;
+                /** File or directory path within the PR repo (read at the PR head branch). */
+                readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"separate", undefined>;
+                /** `owner/repo` of the manifests repo. */
+                readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+                /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
+                readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                /** File or directory path within the manifests repo. */
+                readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+            }, undefined>], undefined>;
+            /** How the environment URL is derived once applied. */
+            readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+                readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+                readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+                readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+                readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+                readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+                readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>], undefined>;
+            /**
+             * Optional image reference made available to the manifests as `{{image}}` (e.g. a
+             * CI-built image tagged by branch/sha). Itself a template over the provision vars.
+             */
+            readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Fallback TTL (ms) after which the env is swept + torn down. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+             * before reporting the env still `provisioning` (the backend keeps polling). Only the
+             * container-backed render path honors it; absent ⇒ the harness default (180s).
+             */
+            readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+            /** Extra labels stamped on the namespace + every applied resource. */
+            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Extra annotations stamped on the namespace. */
+            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
+            readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
+                readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
+                readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Replacement digest, templated; alternative to a tag. */
+                readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            }, undefined>, v.CheckAction<{
+                name: string;
+                newNameTemplate?: string | undefined;
+                newTagTemplate?: string | undefined;
+                digestTemplate?: string | undefined;
+            }, "an image override must set at least one of newNameTemplate, newTagTemplate, or digestTemplate.">, v.CheckAction<{
+                name: string;
+                newNameTemplate?: string | undefined;
+                newTagTemplate?: string | undefined;
+                digestTemplate?: string | undefined;
+            }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
+            /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
+            readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                /** Release name. */
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+                readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+                readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+                readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+                readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Inline `--values` overrides. */
+                readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+                /** Templated `--set` overrides. */
+                readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    /** The value, templated over the provision vars. */
+                    readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+                }, undefined>, undefined>, undefined>;
+                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+                readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+            }, undefined>, undefined>, undefined>;
+            /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
+            readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
+                readonly mode: v.LiteralSchema<"secret", undefined>;
+                /** Target Secret name in the namespace. */
+                readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Secret `type`; absent ⇒ `Opaque`. */
+                readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                    /** Key inside the rendered Secret / `.env`. */
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+                    /** Resolve the value from the workspace encrypted bundle by key. */
+                    readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>, undefined>;
+                    /** OR a non-secret value, templated over the provision vars. */
+                    readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                }, undefined>, v.CheckAction<{
+                    key: string;
+                    secretRef?: {
+                        key: string;
+                    } | undefined;
+                    valueTemplate?: string | undefined;
+                }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
+                /**
+                 * Repo-relative path within the overlay tree to write the `KEY=value` env file the
+                 * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
+                 * overlay names the Secret.
+                 */
+                readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                    /** Key inside the rendered Secret / `.env`. */
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+                    /** Resolve the value from the workspace encrypted bundle by key. */
+                    readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>, undefined>;
+                    /** OR a non-secret value, templated over the provision vars. */
+                    readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                }, undefined>, v.CheckAction<{
+                    key: string;
+                    secretRef?: {
+                        key: string;
+                    } | undefined;
+                    valueTemplate?: string | undefined;
+                }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+            }, undefined>], undefined>, undefined>, undefined>;
+        }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"eks", undefined>;
+        readonly eks: v.ObjectSchema<{
+            readonly region: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be an AWS region slug">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly clusterName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            readonly stsHost: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a bare host or host:port">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 255, undefined>]>, undefined>;
             /** Human label for the connection (shown in the UI). */
             readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
             /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
@@ -5635,6 +6471,187 @@ export declare const testEnvironmentConnectionSchema: v.ObjectSchema<{
                 }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
             }, undefined>], undefined>, undefined>, undefined>;
         }, undefined>;
+    }, undefined>, v.ObjectSchema<{
+        readonly kind: v.LiteralSchema<"eks", undefined>;
+        readonly eks: v.ObjectSchema<{
+            readonly region: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be an AWS region slug">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+            readonly clusterName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            readonly stsHost: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be a bare host or host:port">, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 255, undefined>]>, undefined>;
+            /** Human label for the connection (shown in the UI). */
+            readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+            /** kube-apiserver root URL, e.g. `https://my-cluster.example:6443`. */
+            readonly apiServerUrl: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+            /** PEM CA bundle to verify the apiserver TLS cert (omit only for a publicly-trusted CA). */
+            readonly caCertPem: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** Skip apiserver TLS verification — strongly discouraged; kind/dev clusters only. */
+            readonly insecureSkipTlsVerify: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /**
+             * Namespace name template for the per-PR environment, e.g. `cf-env-{{pullNumber}}`.
+             * Rendered with the provision vars then sanitized to an RFC1123 label; absent ⇒ a
+             * default derived from the PR number / block id.
+             */
+            readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+            /** Where the manifests are read from (co-located in the PR repo, or a separate repo). */
+            readonly manifestSource: v.VariantSchema<"type", [v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"colocated", undefined>;
+                /** File or directory path within the PR repo (read at the PR head branch). */
+                readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly type: v.LiteralSchema<"separate", undefined>;
+                /** `owner/repo` of the manifests repo. */
+                readonly repo: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "must be \"owner/repo\"">]>;
+                /** Branch/tag/sha to read at; absent ⇒ that repo's default branch. */
+                readonly ref: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                /** File or directory path within the manifests repo. */
+                readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly renderer: v.OptionalSchema<v.PicklistSchema<["raw", "kustomize"], undefined>, undefined>;
+            }, undefined>], undefined>;
+            /** How the environment URL is derived once applied. */
+            readonly url: v.VariantSchema<"source", [v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressTemplate", undefined>;
+                /** Host template, e.g. `{{branch}}.preview.example.com`; rendered with the provision vars. */
+                readonly hostTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"ingressStatus", undefined>;
+                /** Ingress object to read `.status.loadBalancer` from; absent ⇒ the only Ingress applied. */
+                readonly ingressName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"serviceStatus", undefined>;
+                /** Service object to read `.status.loadBalancer` (k3s ServiceLB) from. */
+                readonly serviceName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+                readonly port: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, 65535, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"gatewayStatus", undefined>;
+                /** Gateway-API `Gateway` to read `.status.addresses[]` from; absent ⇒ the only one applied. */
+                readonly gatewayName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly source: v.LiteralSchema<"httpRouteStatus", undefined>;
+                /** `HTTPRoute` whose `parentRefs` resolve to the Gateway address; absent ⇒ the only one applied. */
+                readonly httpRouteName: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly scheme: v.OptionalSchema<v.PicklistSchema<["http", "https"], undefined>, undefined>;
+            }, undefined>], undefined>;
+            /**
+             * Optional image reference made available to the manifests as `{{image}}` (e.g. a
+             * CI-built image tagged by branch/sha). Itself a template over the provision vars.
+             */
+            readonly imageTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            /** Fallback TTL (ms) after which the env is swept + torn down. */
+            readonly defaultTtlMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.MinValueAction<number, 60000, undefined>]>, undefined>;
+            /**
+             * How long (seconds) the container deploy adapter waits for each Deployment to roll out
+             * before reporting the env still `provisioning` (the backend keeps polling). Only the
+             * container-backed render path honors it; absent ⇒ the harness default (180s).
+             */
+            readonly rolloutTimeoutSeconds: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+            /** Extra labels stamped on the namespace + every applied resource. */
+            readonly labels: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Extra annotations stamped on the namespace. */
+            readonly annotations: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.StringSchema<undefined>, undefined>, undefined>;
+            /** Structured image overrides (the kustomize `images:` shape), templated over provision vars. */
+            readonly images: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                /** The image to match (the `name:` in a kustomization `images:` entry), e.g. `registry/app`. */
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Optional replacement repo, templated; absent ⇒ keep the original repo. */
+                readonly newNameTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Replacement tag, templated (e.g. `{{branch}}` / `{{sha}}`); mutually exclusive with digest. */
+                readonly newTagTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Replacement digest, templated; alternative to a tag. */
+                readonly digestTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+            }, undefined>, v.CheckAction<{
+                name: string;
+                newNameTemplate?: string | undefined;
+                newTagTemplate?: string | undefined;
+                digestTemplate?: string | undefined;
+            }, "an image override must set at least one of newNameTemplate, newTagTemplate, or digestTemplate.">, v.CheckAction<{
+                name: string;
+                newNameTemplate?: string | undefined;
+                newTagTemplate?: string | undefined;
+                digestTemplate?: string | undefined;
+            }, "newTagTemplate and digestTemplate are mutually exclusive on an image override.">]>, undefined>, undefined>;
+            /** Helm releases to install — workspace-shared singletons merged with the service's per-env ones. */
+            readonly helmReleases: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                /** Release name. */
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart ref: an OCI ref (`oci://…`) or, with `repo`, a `repo/chart` name. */
+                readonly chart: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Chart repo URL; absent ⇒ `chart` is an OCI ref. */
+                readonly repo: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                /** PINNED chart version, e.g. `1.2.3` / `v1.2.3` (floating tags like `latest`/`^1.0` rejected). */
+                readonly version: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.RegexAction<string, "version must be a pinned semver (e.g. 1.2.3), not a floating tag like latest or ^1.0.">]>;
+                /** Namespace to install into, templated; absent ⇒ the environment namespace. */
+                readonly namespaceTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                /** Inline `--values` overrides. */
+                readonly values: v.OptionalSchema<v.RecordSchema<v.StringSchema<undefined>, v.UnknownSchema, undefined>, undefined>;
+                /** Templated `--set` overrides. */
+                readonly set: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    /** Dotted `--set` path, e.g. `config.rateLimit.enabled`. */
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    /** The value, templated over the provision vars. */
+                    readonly valueTemplate: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 2000, undefined>]>;
+                }, undefined>, undefined>, undefined>;
+                /** Secret-bundle-backed values folded in at provision time (`--set <path>=<secret>`). */
+                readonly valuesSecretRefs: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                    readonly secretRef: v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>;
+                }, undefined>, undefined>, undefined>;
+                readonly scope: v.OptionalSchema<v.PicklistSchema<["per-environment", "shared"], undefined>, undefined>;
+            }, undefined>, undefined>, undefined>;
+            /** Secrets fed in before apply (a `Secret` resource or a `secretGenerator` `.env`). */
+            readonly secretInjections: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"mode", [v.ObjectSchema<{
+                readonly mode: v.LiteralSchema<"secret", undefined>;
+                /** Target Secret name in the namespace. */
+                readonly secretName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+                /** Secret `type`; absent ⇒ `Opaque`. */
+                readonly secretType: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+                readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                    /** Key inside the rendered Secret / `.env`. */
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+                    /** Resolve the value from the workspace encrypted bundle by key. */
+                    readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>, undefined>;
+                    /** OR a non-secret value, templated over the provision vars. */
+                    readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                }, undefined>, v.CheckAction<{
+                    key: string;
+                    secretRef?: {
+                        key: string;
+                    } | undefined;
+                    valueTemplate?: string | undefined;
+                }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly mode: v.LiteralSchema<"generatorEnvFile", undefined>;
+                /**
+                 * Repo-relative path within the overlay tree to write the `KEY=value` env file the
+                 * overlay's `secretGenerator` reads (e.g. `overlays/<env>/<component>/.env`). The
+                 * overlay names the Secret.
+                 */
+                readonly envFilePath: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly entries: v.ArraySchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+                    /** Key inside the rendered Secret / `.env`. */
+                    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 256, undefined>]>;
+                    /** Resolve the value from the workspace encrypted bundle by key. */
+                    readonly secretRef: v.OptionalSchema<v.ObjectSchema<{
+                        readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>;
+                    }, undefined>, undefined>;
+                    /** OR a non-secret value, templated over the provision vars. */
+                    readonly valueTemplate: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+                }, undefined>, v.CheckAction<{
+                    key: string;
+                    secretRef?: {
+                        key: string;
+                    } | undefined;
+                    valueTemplate?: string | undefined;
+                }, "a secret entry must set exactly one of secretRef or valueTemplate.">]>, undefined>;
+            }, undefined>], undefined>, undefined>, undefined>;
+        }, undefined>;
     }, undefined>, v.ObjectSchema<{
         readonly kind: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>, v.RegexAction<string, "must be a lower-kebab slug">, v.CheckAction<string, "reserved backend kind">]>;
         readonly manifest: v.ObjectSchema<{
@@ -5836,7 +6853,13 @@ export declare const provisioningDetectionConfidenceSchema: v.PicklistSchema<["h
 export type ProvisioningDetectionConfidence = v.InferOutput<typeof provisioningDetectionConfidenceSchema>;
 /** One inferred aspect of the recommendation, with its confidence + a human-readable rationale. */
 export declare const provisioningDetectionNoteSchema: v.ObjectSchema<{
-    /** Which field this note explains: `provisionType` | `renderer` | `url` | `namespace` | `secretInjections` | `images` | `overlay` | `helmReleases` | `compose` | `serviceDir` | `manifestRoot` | `composeService` | `composeBuild`. */
+    /**
+     * Which field this note explains: `provisionType` | `renderer` | `url` | `namespace` |
+     * `secretInjections` | `images` | `overlay` | `helmReleases` | `compose` | `serviceDir` |
+     * `manifestRoot` | `composeService` | `composeBuild` | `composeFiles` | `composeProfiles` |
+     * `envFiles` | `externalNetworks` | `sharedStackRefs` | `setupSteps` | `healthGate` |
+     * `seedDump` | `repoCli`.
+     */
     readonly field: v.StringSchema<undefined>;
     readonly confidence: v.PicklistSchema<["high", "low"], undefined>;
     /** Rationale for the SPA to surface next to the field (e.g. "kustomization.yaml present ⇒ kustomize"). */
@@ -5905,19 +6928,83 @@ export declare const provisioningManifestRootCandidateSchema: v.ObjectSchema<{
     readonly recommended: v.BooleanSchema<undefined>;
 }, undefined>;
 export type ProvisioningManifestRootCandidate = v.InferOutput<typeof provisioningManifestRootCandidateSchema>;
+/**
+ * A candidate Docker Compose file for `-f` layering (slice 2 detection). The base file(s) are
+ * pre-selected into `provisioning.recipe.composeFiles`; OS-specific overrides
+ * (`dev.wsl.override.yml`, `dev.mac.override.yml`) are surfaced here — annotated with `os` and
+ * NOT auto-layered — so the wizard binds the one matching the operator's machine.
+ */
+export declare const provisioningComposeFileCandidateSchema: v.ObjectSchema<{
+    /** Repo-relative compose file path (a value `recipe.composeFiles` would take). */
+    readonly path: v.StringSchema<undefined>;
+    /** The file's base name (e.g. `dev.wsl.override.yml`). */
+    readonly name: v.StringSchema<undefined>;
+    /** For an OS-specific override, which OS it targets; absent ⇒ OS-neutral (a base layer). */
+    readonly os: v.OptionalSchema<v.PicklistSchema<["wsl", "mac", "linux", "windows"], undefined>, undefined>;
+    /** True for a base layer pre-selected into `composeFiles`; an OS override is opt-in. */
+    readonly recommended: v.BooleanSchema<undefined>;
+}, undefined>;
+export type ProvisioningComposeFileCandidate = v.InferOutput<typeof provisioningComposeFileCandidateSchema>;
+/**
+ * A `COMPOSE_PROFILES` label the compose files declare (slice 2 detection). Surfaced
+ * default-OFF — an optional service group the user opts into; `recommended` is set only for a
+ * profile the detector deems part of the base bring-up (rare — most profiles are optional).
+ */
+export declare const provisioningProfileCandidateSchema: v.ObjectSchema<{
+    /** The `profiles:` label (e.g. `peer`, `backends`). */
+    readonly profile: v.StringSchema<undefined>;
+    /** Whether to pre-enable it (default false — profiles are opt-in). */
+    readonly recommended: v.BooleanSchema<undefined>;
+}, undefined>;
+export type ProvisioningProfileCandidate = v.InferOutput<typeof provisioningProfileCandidateSchema>;
+/**
+ * A `.sql` dump found under a seed-ish directory (`deployment/`, `seed/`, `db/`,
+ * `docker-entrypoint-initdb.d/`) — a LOW-confidence candidate the wizard confirms, turning it
+ * into a `compose-exec` seed-import step (piping the dump via `stdinFile`). Never auto-applied.
+ */
+export declare const provisioningSeedDumpCandidateSchema: v.ObjectSchema<{
+    /** Repo-relative path of the SQL dump. */
+    readonly path: v.StringSchema<undefined>;
+    /** The dump file's base name. */
+    readonly name: v.StringSchema<undefined>;
+    /** The heuristic top pick among several dumps. */
+    readonly recommended: v.BooleanSchema<undefined>;
+}, undefined>;
+export type ProvisioningSeedDumpCandidate = v.InferOutput<typeof provisioningSeedDumpCandidateSchema>;
+/**
+ * A REPORT-ONLY hint that the repo carries its OWN imperative bring-up — a Makefile, a
+ * `bin/*console*` repo CLI, a justfile/Taskfile with setup-looking targets. Detection never
+ * parses shell; it only flags the file so the wizard can suggest running the environment
+ * ANALYST (slice 8) to translate that bring-up into recipe steps. Its presence sets the
+ * "consider deep analysis" nudge.
+ */
+export declare const provisioningRepoCliHintSchema: v.ObjectSchema<{
+    /** Repo-relative path of the CLI / build file that triggered the hint. */
+    readonly path: v.StringSchema<undefined>;
+    /** What kind of imperative entry point it is. */
+    readonly kind: v.PicklistSchema<["makefile", "repo-cli", "justfile", "taskfile"], undefined>;
+}, undefined>;
+export type ProvisioningRepoCliHint = v.InferOutput<typeof provisioningRepoCliHintSchema>;
 /**
  * A non-binding provisioning recommendation detected from a service's repo. `provisioning`
- * carries the service-owned config to prefill (the "what + where"); `urlSource`/`namespace`
- * are engine-level suggestions the workspace handler owns (the detector can READ them from
- * the manifests but they aren't stored on the service); the candidate arrays + `notes` drive
- * the confirm UI. `detected: false` ⇒ nothing inferable (`provisioning.type` is `infraless`).
+ * carries the service-owned config to prefill (the "what + where", now including a
+ * `docker-compose` service's {@link stackRecipeSchema | recipe} — layered compose files,
+ * profiles, env-file pairs, external networks); `urlSource`/`namespace` are engine-level
+ * suggestions the workspace handler owns (the detector can READ them from the manifests but
+ * they aren't stored on the service); the candidate arrays + `notes` drive the confirm UI.
+ * `detected: false` ⇒ nothing inferable (`provisioning.type` is `infraless`).
  *
  * The candidate arrays let the user CHOOSE instead of accepting a silent auto-pick:
  * `overlayCandidates` (which overlay within a kustomize root), `manifestRootCandidates` (which
- * k8s root when several resolve), `serviceDirCandidates` (which root-shared monorepo slice), and
- * `composeServiceCandidates` (which compose service). Each note's `field` is one of
- * `provisionType` | `renderer` | `url` | `namespace` | `secretInjections` | `images` | `overlay` |
- * `helmReleases` | `compose` | `serviceDir` | `manifestRoot` | `composeService` | `composeBuild`.
+ * k8s root when several resolve), `serviceDirCandidates` (which root-shared monorepo slice),
+ * `composeServiceCandidates` (which compose service), `composeFileCandidates` (which OS override
+ * to layer), `profileCandidates` (which optional profiles to enable), and `seedDumpCandidates`
+ * (which SQL dump to seed from). `repoCliHint` flags a repo with its own imperative bring-up
+ * (a nudge toward the analyst). Each note's `field` is one of `provisionType` | `renderer` |
+ * `url` | `namespace` | `secretInjections` | `images` | `overlay` | `helmReleases` | `compose` |
+ * `serviceDir` | `manifestRoot` | `composeService` | `composeBuild` | `composeFiles` |
+ * `composeProfiles` | `envFiles` | `externalNetworks` | `sharedStackRefs` | `setupSteps` |
+ * `healthGate` | `seedDump` | `repoCli`.
  */
 export declare const provisioningRecommendationSchema: v.ObjectSchema<{
     readonly detected: v.BooleanSchema<undefined>;
@@ -5951,6 +7038,113 @@ export declare const provisioningRecommendationSchema: v.ObjectSchema<{
          * contexts, in-checkout bind mounts, and relative `env_file`s resolve.
          */
         readonly composeBuild: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+        /**
+         * `docker-compose`: the declarative STACK RECIPE for a complex multi-step bring-up —
+         * multi-`-f` layering, profiles, env-file materialization, external networks / shared-stack
+         * refs, ordered setup/teardown steps + a terminal health gate. Absent ⇒ the simple
+         * single-file `composePath` + `up --wait` path (when set, `recipe.composeFiles` supersedes
+         * `composePath`). See {@link stackRecipeSchema}.
+         */
+        readonly recipe: v.OptionalSchema<v.ObjectSchema<{
+            readonly composeFiles: v.OptionalSchema<v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>, v.MinLengthAction<string[], 1, undefined>]>, undefined>;
+            readonly composeProfiles: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>, undefined>;
+            readonly envFiles: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                readonly template: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly target: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+            }, undefined>, undefined>, undefined>;
+            readonly externalNetworks: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>, undefined>;
+            readonly sharedStackRefs: v.OptionalSchema<v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>, undefined>;
+            readonly setupSteps: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"kind", [v.ObjectSchema<{
+                readonly kind: v.LiteralSchema<"compose-exec", undefined>;
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+                readonly service: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>;
+                readonly command: v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>, v.MinLengthAction<string[], 1, undefined>]>;
+                readonly stdinFile: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                readonly user: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+                readonly workdir: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly kind: v.LiteralSchema<"copy-file", undefined>;
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+                readonly from: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly to: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly kind: v.LiteralSchema<"wait-http", undefined>;
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+                readonly url: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly expectStatus: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 100, undefined>, v.MaxValueAction<number, 599, undefined>]>, undefined>;
+                readonly expectBodyContains: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                readonly intervalMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 250, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly kind: v.LiteralSchema<"wait-file", undefined>;
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+                readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly service: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+                readonly intervalMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 250, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly kind: v.LiteralSchema<"host-command", undefined>;
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+                readonly command: v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>, v.MinLengthAction<string[], 1, undefined>]>;
+                readonly workdir: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+            }, undefined>], undefined>, undefined>, undefined>;
+            readonly healthGate: v.OptionalSchema<v.VariantSchema<"kind", [v.ObjectSchema<{
+                readonly kind: v.LiteralSchema<"compose-healthy", undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly kind: v.LiteralSchema<"http", undefined>;
+                readonly url: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly expectStatus: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 100, undefined>, v.MaxValueAction<number, 599, undefined>]>, undefined>;
+                readonly expectBodyContains: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                readonly intervalMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 250, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly kind: v.LiteralSchema<"compose-exec", undefined>;
+                readonly service: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>;
+                readonly command: v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>, v.MinLengthAction<string[], 1, undefined>]>;
+                readonly intervalMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 250, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+            }, undefined>], undefined>, undefined>;
+            readonly teardownSteps: v.OptionalSchema<v.ArraySchema<v.VariantSchema<"kind", [v.ObjectSchema<{
+                readonly kind: v.LiteralSchema<"compose-exec", undefined>;
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+                readonly service: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>;
+                readonly command: v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>, v.MinLengthAction<string[], 1, undefined>]>;
+                readonly stdinFile: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                readonly user: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+                readonly workdir: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly kind: v.LiteralSchema<"copy-file", undefined>;
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+                readonly from: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly to: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly kind: v.LiteralSchema<"wait-http", undefined>;
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+                readonly url: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 2000, undefined>]>;
+                readonly expectStatus: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 100, undefined>, v.MaxValueAction<number, 599, undefined>]>, undefined>;
+                readonly expectBodyContains: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                readonly intervalMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 250, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly kind: v.LiteralSchema<"wait-file", undefined>;
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+                readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+                readonly service: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+                readonly intervalMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 250, undefined>, v.MaxValueAction<number, 60000, undefined>]>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+            }, undefined>, v.ObjectSchema<{
+                readonly kind: v.LiteralSchema<"host-command", undefined>;
+                readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+                readonly command: v.SchemaWithPipe<readonly [v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>, v.MinLengthAction<string[], 1, undefined>]>;
+                readonly workdir: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>, undefined>;
+                readonly timeoutMs: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1000, undefined>, v.MaxValueAction<number, 3600000, undefined>]>, undefined>;
+            }, undefined>], undefined>, undefined>, undefined>;
+        }, undefined>, undefined>;
         /** `custom`: the custom-manifest-type id this service produces (matched to a remote-custom handler). */
         readonly manifestId: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 64, undefined>]>, undefined>;
         /** `custom`: optional path to the custom manifest within the repo. */
@@ -6125,9 +7319,49 @@ export declare const provisioningRecommendationSchema: v.ObjectSchema<{
         /** The heuristic top pick (basename match, else the first declared service). */
         readonly recommended: v.BooleanSchema<undefined>;
     }, undefined>, undefined>, undefined>;
+    /** Candidate compose files for `-f` layering (base pre-selected; OS overrides opt-in). */
+    readonly composeFileCandidates: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+        /** Repo-relative compose file path (a value `recipe.composeFiles` would take). */
+        readonly path: v.StringSchema<undefined>;
+        /** The file's base name (e.g. `dev.wsl.override.yml`). */
+        readonly name: v.StringSchema<undefined>;
+        /** For an OS-specific override, which OS it targets; absent ⇒ OS-neutral (a base layer). */
+        readonly os: v.OptionalSchema<v.PicklistSchema<["wsl", "mac", "linux", "windows"], undefined>, undefined>;
+        /** True for a base layer pre-selected into `composeFiles`; an OS override is opt-in. */
+        readonly recommended: v.BooleanSchema<undefined>;
+    }, undefined>, undefined>, undefined>;
+    /** `COMPOSE_PROFILES` labels the compose files declare (surfaced default-off). */
+    readonly profileCandidates: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+        /** The `profiles:` label (e.g. `peer`, `backends`). */
+        readonly profile: v.StringSchema<undefined>;
+        /** Whether to pre-enable it (default false — profiles are opt-in). */
+        readonly recommended: v.BooleanSchema<undefined>;
+    }, undefined>, undefined>, undefined>;
+    /** Low-confidence SQL seed dumps to confirm as `compose-exec` seed steps. */
+    readonly seedDumpCandidates: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+        /** Repo-relative path of the SQL dump. */
+        readonly path: v.StringSchema<undefined>;
+        /** The dump file's base name. */
+        readonly name: v.StringSchema<undefined>;
+        /** The heuristic top pick among several dumps. */
+        readonly recommended: v.BooleanSchema<undefined>;
+    }, undefined>, undefined>, undefined>;
+    /** Report-only: the repo has its own imperative bring-up ⇒ suggest the environment analyst. */
+    readonly repoCliHint: v.OptionalSchema<v.ObjectSchema<{
+        /** Repo-relative path of the CLI / build file that triggered the hint. */
+        readonly path: v.StringSchema<undefined>;
+        /** What kind of imperative entry point it is. */
+        readonly kind: v.PicklistSchema<["makefile", "repo-cli", "justfile", "taskfile"], undefined>;
+    }, undefined>, undefined>;
     /** Per-field confidence + hints for the SPA. */
     readonly notes: v.ArraySchema<v.ObjectSchema<{
-        /** Which field this note explains: `provisionType` | `renderer` | `url` | `namespace` | `secretInjections` | `images` | `overlay` | `helmReleases` | `compose` | `serviceDir` | `manifestRoot` | `composeService` | `composeBuild`. */
+        /**
+         * Which field this note explains: `provisionType` | `renderer` | `url` | `namespace` |
+         * `secretInjections` | `images` | `overlay` | `helmReleases` | `compose` | `serviceDir` |
+         * `manifestRoot` | `composeService` | `composeBuild` | `composeFiles` | `composeProfiles` |
+         * `envFiles` | `externalNetworks` | `sharedStackRefs` | `setupSteps` | `healthGate` |
+         * `seedDump` | `repoCli`.
+         */
         readonly field: v.StringSchema<undefined>;
         readonly confidence: v.PicklistSchema<["high", "low"], undefined>;
         /** Rationale for the SPA to surface next to the field (e.g. "kustomization.yaml present ⇒ kustomize"). */