@highstate/library 0.26.0 → 0.27.0

package/dist/index.js

@@ -3908,13 +3908,15 @@ var envoyGateway = defineUnit28({
   source: source("envoy-gateway")
 });
 // src/k8s/apps/etcd.ts
-import { defineUnit as defineUnit29 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription30 } from "@highstate/contract";
+import { defineUnit as defineUnit29, z as z40 } from "@highstate/contract";
 import { pick as pick6 } from "remeda";
 var etcd = defineUnit29({
   type: "k8s.apps.etcd.v1",
   args: {
     ...appName("etcd"),
-    ...pick6(sharedArgs, ["external", "values", "patches", "service", "scheduling"])
+    ...pick6(sharedArgs, ["external", "values", "patches", "service", "scheduling"]),
+    replicas: $addArgumentDescription30(z40.number().int().positive().refine((replicas) => replicas % 2 === 1, "etcd replicas must be odd").default(1), `The odd number of etcd members to deploy.`)
   },
   secrets: {
     ...pick6(sharedSecrets, ["backupKey"])
@@ -3937,20 +3939,20 @@ var etcd = defineUnit29({
   source: source("etcd")
 });
 // src/k8s/apps/grafana.ts
-import { $addArgumentDescription as $addArgumentDescription30 } from "@highstate/contract";
-import { defineUnit as defineUnit30, z as z40 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription31 } from "@highstate/contract";
+import { defineUnit as defineUnit30, z as z41 } from "@highstate/contract";
 import { pick as pick7 } from "remeda";
 var grafana = defineUnit30({
   type: "k8s.apps.grafana.v1",
   args: {
     ...appName("grafana"),
     ...pick7(sharedArgs, ["fqdn", "values", "patches", "service", "scheduling"]),
-    plugins: $addArgumentDescription30(z40.string().array().default([]), `The list of plugins to install on Grafana.
+    plugins: $addArgumentDescription31(z41.string().array().default([]), `The list of plugins to install on Grafana.
 
  See https://grafana.com/grafana/plugins for available plugins and their names.`)
   },
   secrets: {
-    adminPassword: $addArgumentDescription30(z40.string().optional(), `The admin password used for Grafana.
+    adminPassword: $addArgumentDescription31(z41.string().optional(), `The admin password used for Grafana.
 
  If not provided, a random password will be generated.`)
   },
@@ -4047,29 +4049,29 @@ var mariadb = defineUnit33({
   source: source("mariadb")
 });
 // src/k8s/apps/matrix-stack.ts
-import { $addArgumentDescription as $addArgumentDescription31, $addInputDescription as $addInputDescription31 } from "@highstate/contract";
-import { defineUnit as defineUnit34, z as z41 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription32, $addInputDescription as $addInputDescription32 } from "@highstate/contract";
+import { defineUnit as defineUnit34, z as z42 } from "@highstate/contract";
 import { pick as pick11 } from "remeda";
 var matrixStack = defineUnit34({
   type: "k8s.apps.matrix-stack.v1",
   args: {
     ...appName("matrix-stack"),
     ...pick11(sharedArgs, ["values", "patches", "service"]),
-    fqdn: $addArgumentDescription31(z41.string(), `The base domain for the Matrix stack services.
+    fqdn: $addArgumentDescription32(z42.string(), `The base domain for the Matrix stack services.
 
  Subdomains for Matrix services are generated automatically.
  This value cannot be changed after the first deployment.`),
-    enableCinny: $addArgumentDescription31(z41.boolean().default(false), `Whether to enable cinny web client deployment.
+    enableCinny: $addArgumentDescription32(z42.boolean().default(false), `Whether to enable cinny web client deployment.
 
  The FQDN will be generated as \`cinny.\${fqdn}\`.`),
-    federationDomainWhitelist: $addArgumentDescription31(z41.array(z41.string()).default([]), `The list of remote Matrix domains that are allowed for federation.
+    federationDomainWhitelist: $addArgumentDescription32(z42.array(z42.string()).default([]), `The list of remote Matrix domains that are allowed for federation.
 
  Leave empty to allow federation with all domains.`)
   },
   inputs: {
     ...pick11(sharedInputs, ["k8sCluster", "accessPoint"]),
-    synapsePostgresql: $addInputDescription31(exports_postgresql.connectionEntity, `The PostgreSQL connection for the Synapse server.`),
-    masPostgresql: $addInputDescription31(exports_postgresql.connectionEntity, `The PostgreSQL connection for the Matrix Authentication Service.`)
+    synapsePostgresql: $addInputDescription32(exports_postgresql.connectionEntity, `The PostgreSQL connection for the Synapse server.`),
+    masPostgresql: $addInputDescription32(exports_postgresql.connectionEntity, `The PostgreSQL connection for the Matrix Authentication Service.`)
   },
   secrets: {},
   meta: {
@@ -4082,8 +4084,8 @@ var matrixStack = defineUnit34({
   source: source("matrix-stack")
 });
 // src/k8s/apps/minio.ts
-import { $addArgumentDescription as $addArgumentDescription32 } from "@highstate/contract";
-import { defineUnit as defineUnit35, z as z42 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription33 } from "@highstate/contract";
+import { defineUnit as defineUnit35, z as z43 } from "@highstate/contract";
 import { pick as pick12 } from "remeda";
 var minio = defineUnit35({
   type: "k8s.apps.minio.v1",
@@ -4091,13 +4093,13 @@ var minio = defineUnit35({
     ...appName("minio"),
     ...pick12(optionalSharedArgs, ["fqdn", "namespace"]),
     ...pick12(sharedArgs, ["external", "values", "patches", "service", "scheduling"]),
-    consoleFqdn: $addArgumentDescription32(z42.string().optional(), `The FQDN of the MinIO console.
+    consoleFqdn: $addArgumentDescription33(z43.string().optional(), `The FQDN of the MinIO console.
 
  If not provided, the console will not be exposed and only the S3 API will be available.`),
-    region: $addArgumentDescription32(z42.string().default("us-east-1"), `The name of the region to associate with the MinIO deployment.
+    region: $addArgumentDescription33(z43.string().default("us-east-1"), `The name of the region to associate with the MinIO deployment.
 
  Defaults to "us-east-1".`),
-    useConsoleFork: $addArgumentDescription32(z42.boolean().default(false), `Whether to use the [fork](https://github.com/huncrys/minio-console) of MinIO Console instead of the built-in console.
+    useConsoleFork: $addArgumentDescription33(z43.boolean().default(false), `Whether to use the [fork](https://github.com/huncrys/minio-console) of MinIO Console instead of the built-in console.
  The fork contains admin features that were removed from the original console.`)
   },
   secrets: {
@@ -4199,20 +4201,20 @@ var postgresql = defineUnit38({
   source: source("postgresql")
 });
 // src/k8s/apps/refluxdb.ts
-import { $addArgumentDescription as $addArgumentDescription33 } from "@highstate/contract";
-import { defineUnit as defineUnit39, z as z43 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription34 } from "@highstate/contract";
+import { defineUnit as defineUnit39, z as z44 } from "@highstate/contract";
 import { pick as pick16 } from "remeda";
 var refluxdb = defineUnit39({
   type: "k8s.apps.refluxdb.v1",
   args: {
     ...appName("refluxdb"),
     ...pick16(sharedArgs, ["external"]),
-    nodeId: $addArgumentDescription33(z43.string().default("local1"), `The ID of the node.
+    nodeId: $addArgumentDescription34(z44.string().default("local1"), `The ID of the node.
 
  Defaults to "local1".`)
   },
   secrets: {
-    operatorToken: $addArgumentDescription33(z43.string().optional(), `The operator token of the RefluxDB instance.`)
+    operatorToken: $addArgumentDescription34(z44.string().optional(), `The operator token of the RefluxDB instance.`)
   },
   inputs: {
     ...pick16(sharedInputs, ["k8sCluster"]),
@@ -4235,13 +4237,13 @@ import { camelCaseToHumanReadable as __camelCaseToHumanReadable24 } from "@highs
 import {
   defineEntity as defineEntity29,
   defineUnit as defineUnit40,
-  z as z44
+  z as z45
 } from "@highstate/contract";
 import { pick as pick17 } from "remeda";
 var remnawaveEntity = defineEntity29({
   type: "k8s.apps.remnawave.v1",
-  schema: z44.object({
-    instanceId: z44.string().meta({ title: __camelCaseToHumanReadable24("instanceId"), description: `The ID of the Remnawave instance.` })
+  schema: z45.object({
+    instanceId: z45.string().meta({ title: __camelCaseToHumanReadable24("instanceId"), description: `The ID of the Remnawave instance.` })
   }),
   meta: {
     color: "#0066cc",
@@ -4253,8 +4255,8 @@ var remnawaveEntity = defineEntity29({
 var remnawave = defineUnit40({
   type: "k8s.apps.remnawave.backend.v1",
   secrets: {
-    jwtAuthSecret: z44.string(),
-    jwtApiTokensSecret: z44.string()
+    jwtAuthSecret: z45.string(),
+    jwtApiTokensSecret: z45.string()
   },
   inputs: {
     ...pick17(sharedInputs, ["k8sCluster", "accessPoint", "postgresql", "redis"]),
@@ -4289,8 +4291,8 @@ var node = defineUnit40({
   source: source("remnawave/node")
 });
 // src/k8s/apps/rustfs.ts
-import { $addArgumentDescription as $addArgumentDescription34 } from "@highstate/contract";
-import { defineUnit as defineUnit41, z as z45 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription35 } from "@highstate/contract";
+import { defineUnit as defineUnit41, z as z46 } from "@highstate/contract";
 import { pick as pick18 } from "remeda";
 var rustfs = defineUnit41({
   type: "k8s.apps.rustfs.v1",
@@ -4298,25 +4300,25 @@ var rustfs = defineUnit41({
     ...appName("rustfs"),
     ...pick18(optionalSharedArgs, ["fqdn", "namespace"]),
     ...pick18(sharedArgs, ["external", "values", "patches", "service", "scheduling"]),
-    mode: $addArgumentDescription34(z45.enum(["standalone", "distributed"]).default("distributed"), `The deployment topology to use.
+    mode: $addArgumentDescription35(z46.enum(["standalone", "distributed"]).default("distributed"), `The deployment topology to use.
 
  Standalone mode deploys one pod with one data volume.
  Distributed mode deploys an erasure-coded StatefulSet across multiple pods and volumes.`),
-    consoleFqdn: $addArgumentDescription34(z45.string().optional(), `The FQDN of the RustFS console.
+    consoleFqdn: $addArgumentDescription35(z46.string().optional(), `The FQDN of the RustFS console.
 
  If not provided, the console will only be available inside the cluster.`),
-    replicas: $addArgumentDescription34(z45.number().int().min(2).default(4), `The number of nodes in a distributed deployment.
+    replicas: $addArgumentDescription35(z46.number().int().min(2).default(4), `The number of nodes in a distributed deployment.
 
  Ignored in standalone mode.`),
-    drivesPerNode: $addArgumentDescription34(z45.number().int().min(1).default(4), `The number of data volumes attached to each distributed node.
+    drivesPerNode: $addArgumentDescription35(z46.number().int().min(1).default(4), `The number of data volumes attached to each distributed node.
 
  Ignored in standalone mode.`),
-    unsafeBypassDiskCheck: $addArgumentDescription34(z45.boolean().default(false), `Whether to bypass RustFS validation that each data volume uses a distinct physical disk.
+    unsafeBypassDiskCheck: $addArgumentDescription35(z46.boolean().default(false), `Whether to bypass RustFS validation that each data volume uses a distinct physical disk.
 
  This sets \`RUSTFS_UNSAFE_BYPASS_DISK_CHECK=true\` and must only be used for local testing or CI.
  Enabling it in production can cause correlated data loss because multiple erasure-coded drives
  may actually share one physical device.`),
-    allowLessNodes: $addArgumentDescription34(z45.boolean().default(false), `Whether distributed RustFS pods may share Kubernetes nodes.
+    allowLessNodes: $addArgumentDescription35(z46.boolean().default(false), `Whether distributed RustFS pods may share Kubernetes nodes.
 
  By default, RustFS requires each replica to run on a different node for failure isolation.
  Enable this when the Kubernetes cluster has fewer eligible nodes than RustFS replicas.
@@ -4324,10 +4326,10 @@ var rustfs = defineUnit41({
  This reduces fault tolerance because one node failure can make multiple RustFS replicas unavailable.
 
  Ignored in standalone mode.`),
-    storageClass: $addArgumentDescription34(z45.string().default("local-path"), `The Kubernetes StorageClass used for RustFS volumes.`),
-    dataStorageSize: $addArgumentDescription34(z45.string().default("100Gi"), `The requested capacity of each data volume.`),
-    logStorageSize: $addArgumentDescription34(z45.string().default("1Gi"), `The requested capacity of each log volume.`),
-    region: $addArgumentDescription34(z45.string().default("us-east-1"), `The S3 region reported by RustFS.`)
+    storageClass: $addArgumentDescription35(z46.string().default("local-path"), `The Kubernetes StorageClass used for RustFS volumes.`),
+    dataStorageSize: $addArgumentDescription35(z46.string().default("100Gi"), `The requested capacity of each data volume.`),
+    logStorageSize: $addArgumentDescription35(z46.string().default("1Gi"), `The requested capacity of each log volume.`),
+    region: $addArgumentDescription35(z46.string().default("us-east-1"), `The S3 region reported by RustFS.`)
   },
   secrets: {
     ...pick18(sharedSecrets, ["adminPassword", "backupKey"])
@@ -4373,20 +4375,20 @@ var signoz = defineUnit42({
   source: source("signoz")
 });
 // src/k8s/apps/syncthing.ts
-import { $addArgumentDescription as $addArgumentDescription35 } from "@highstate/contract";
-import { defineUnit as defineUnit43, z as z46 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription36 } from "@highstate/contract";
+import { defineUnit as defineUnit43, z as z47 } from "@highstate/contract";
 import { pick as pick20 } from "remeda";
-var backupModeSchema = z46.enum(["state", "full"]);
+var backupModeSchema = z47.enum(["state", "full"]);
 var syncthing = defineUnit43({
   type: "k8s.apps.syncthing.v1",
   args: {
     ...appName("syncthing"),
     ...pick20(sharedArgs, ["fqdn", "external"]),
-    deviceFqdn: $addArgumentDescription35(z46.string().optional(), `The FQDN of the Syncthing instance used to sync with other devices.
+    deviceFqdn: $addArgumentDescription36(z47.string().optional(), `The FQDN of the Syncthing instance used to sync with other devices.
 
  The \`fqdn\` argument unlike this one points to the gateway and used to
  access the Syncthing Web UI.`),
-    backupMode: $addArgumentDescription35(backupModeSchema.default("state"), `The backup mode to use for the Syncthing instance.
+    backupMode: $addArgumentDescription36(backupModeSchema.default("state"), `The backup mode to use for the Syncthing instance.
 
  - \`state\`: Only the state is backed up. When the instance is restored, it will
  sync files from the other devices automatically.
@@ -4418,21 +4420,21 @@ var syncthing = defineUnit43({
   source: source("syncthing")
 });
 // src/k8s/apps/traefik.ts
-import { $addArgumentDescription as $addArgumentDescription36 } from "@highstate/contract";
-import { defineUnit as defineUnit44, z as z47 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription37 } from "@highstate/contract";
+import { defineUnit as defineUnit44, z as z48 } from "@highstate/contract";
 import { pick as pick21 } from "remeda";
 var traefik = defineUnit44({
   type: "k8s.apps.traefik.v1",
   args: {
     ...appName("traefik"),
     ...pick21(sharedArgs, ["external", "replicas", "values", "patches", "service", "scheduling"]),
-    className: $addArgumentDescription36(z47.string().default("traefik"), `The name of the class to configure for ingress and gateway resources.
+    className: $addArgumentDescription37(z48.string().default("traefik"), `The name of the class to configure for ingress and gateway resources.
 
  Defaults to "traefik".`),
-    enableTraefikCrds: $addArgumentDescription36(z47.boolean().default(true), `Whether to create and enable reconciliation for Traefik CRDs.`),
-    installCrds: $addArgumentDescription36(z47.boolean().default(true), `Whether to install CRDs bundled with the Traefik Helm chart.`),
-    enableIngressApi: $addArgumentDescription36(z47.boolean().default(true), `Whether to enable reconciliation for Ingress resources and create ingress class.`),
-    enableGatewayApi: $addArgumentDescription36(z47.boolean().default(false), `Whether to enable reconciliation for Gateway API resources and create gateway class.`)
+    enableTraefikCrds: $addArgumentDescription37(z48.boolean().default(true), `Whether to create and enable reconciliation for Traefik CRDs.`),
+    installCrds: $addArgumentDescription37(z48.boolean().default(true), `Whether to install CRDs bundled with the Traefik Helm chart.`),
+    enableIngressApi: $addArgumentDescription37(z48.boolean().default(true), `Whether to enable reconciliation for Ingress resources and create ingress class.`),
+    enableGatewayApi: $addArgumentDescription37(z48.boolean().default(false), `Whether to enable reconciliation for Gateway API resources and create gateway class.`)
   },
   inputs: {
     ...pick21(sharedInputs, ["k8sCluster"])
@@ -4483,9 +4485,9 @@ var valkey = defineUnit45({
   source: source("valkey")
 });
 // src/k8s/apps/vault.ts
-import { $addArgumentDescription as $addArgumentDescription37, $addInputDescription as $addInputDescription37 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription38, $addInputDescription as $addInputDescription38 } from "@highstate/contract";
 import { camelCaseToHumanReadable as __camelCaseToHumanReadable25 } from "@highstate/contract";
-import { defineUnit as defineUnit46, z as z48 } from "@highstate/contract";
+import { defineUnit as defineUnit46, z as z49 } from "@highstate/contract";
 import { pick as pick23 } from "remeda";
 var vault = defineUnit46({
   type: "k8s.apps.vault.v1",
@@ -4500,15 +4502,15 @@ var vault = defineUnit46({
       "service",
       "scheduling"
     ]),
-    backend: $addArgumentDescription37(z48.enum(["file", "s3"]).default("file"), `The storage backend to use for Vault.
+    backend: $addArgumentDescription38(z49.enum(["file", "s3"]).default("file"), `The storage backend to use for Vault.
 
  The options are:
  - \`file\`: uses a persistent volume claim and supports restic backups (default);
  - \`s3\`: uses an external S3-compatible bucket; expects \`s3Bucket\` input.`),
-    autoInit: $addArgumentDescription37(z48.object({
-      enabled: z48.boolean().default(true).meta({ title: __camelCaseToHumanReadable25("enabled"), description: `Whether to initialize Vault automatically using the Vault CLI.` }),
-      shares: z48.number().int().positive().default(1).meta({ title: __camelCaseToHumanReadable25("shares"), description: `The number of unseal key shares to create.` }),
-      threshold: z48.number().int().positive().default(1).meta({ title: __camelCaseToHumanReadable25("threshold"), description: `The number of unseal key shares required to unseal Vault.` })
+    autoInit: $addArgumentDescription38(z49.object({
+      enabled: z49.boolean().default(true).meta({ title: __camelCaseToHumanReadable25("enabled"), description: `Whether to initialize Vault automatically using the Vault CLI.` }),
+      shares: z49.number().int().positive().default(1).meta({ title: __camelCaseToHumanReadable25("shares"), description: `The number of unseal key shares to create.` }),
+      threshold: z49.number().int().positive().default(1).meta({ title: __camelCaseToHumanReadable25("threshold"), description: `The number of unseal key shares required to unseal Vault.` })
     }).refine((autoInit) => autoInit.threshold <= autoInit.shares, {
       message: "threshold must be less than or equal to shares",
       path: ["threshold"]
@@ -4520,12 +4522,12 @@ var vault = defineUnit46({
   },
   secrets: {
     ...pick23(sharedSecrets, ["backupKey"]),
-    rootToken: $addArgumentDescription37(z48.string().optional(), `The root token returned by \`vault operator init\`.`),
-    unsealKeys: $addArgumentDescription37(z48.string().array().meta({ complex: true }).optional(), `The unseal key shares returned by \`vault operator init\`.`)
+    rootToken: $addArgumentDescription38(z49.string().optional(), `The root token returned by \`vault operator init\`.`),
+    unsealKeys: $addArgumentDescription38(z49.string().array().meta({ complex: true }).optional(), `The unseal key shares returned by \`vault operator init\`.`)
   },
   inputs: {
     ...pick23(sharedInputs, ["k8sCluster", "accessPoint"]),
-    s3Bucket: $addInputDescription37({
+    s3Bucket: $addInputDescription38({
       entity: exports_s3.bucketEntity,
       required: false
     }, `When \`backend\` is \`s3\`, supply an existing S3 bucket connection (see \`s3.bucketEntity\`).`),
@@ -4544,19 +4546,19 @@ var vault = defineUnit46({
   source: source("vault")
 });
 // src/k8s/apps/vaultwarden.ts
-import { $addArgumentDescription as $addArgumentDescription38 } from "@highstate/contract";
-import { defineUnit as defineUnit47, z as z49 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription39 } from "@highstate/contract";
+import { defineUnit as defineUnit47, z as z50 } from "@highstate/contract";
 import { pick as pick24 } from "remeda";
 var vaultwarden = defineUnit47({
   type: "k8s.apps.vaultwarden.v1",
   args: {
     ...appName("vaultwarden"),
     ...pick24(sharedArgs, ["fqdn"]),
-    allowSignup: $addArgumentDescription38(z49.boolean().default(false), `Whether signup is allowed for the Vaultwarden instance. Defaults to \`false\` for security reasons.`),
-    enableAdminPanel: $addArgumentDescription38(z49.boolean().default(true), `Whether admin panel is enabled. Defaults to \`true\`.`)
+    allowSignup: $addArgumentDescription39(z50.boolean().default(false), `Whether signup is allowed for the Vaultwarden instance. Defaults to \`false\` for security reasons.`),
+    enableAdminPanel: $addArgumentDescription39(z50.boolean().default(true), `Whether admin panel is enabled. Defaults to \`true\`.`)
   },
   secrets: {
-    adminToken: $addArgumentDescription38(z49.string().optional(), `The admin token for the Vaulwarden instance.
+    adminToken: $addArgumentDescription39(z50.string().optional(), `The admin token for the Vaulwarden instance.
 
  Will be automatically generated if \`enableAdminPanel\` is \`true\`.`),
     ...pick24(sharedSecrets, ["backupKey"])
@@ -4574,16 +4576,26 @@ var vaultwarden = defineUnit47({
   source: source("vaultwarden")
 });
 // src/k8s/apps/wg-feed-server.ts
-import { defineUnit as defineUnit48 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription40, $addInputDescription as $addInputDescription40 } from "@highstate/contract";
+import { defineUnit as defineUnit48, z as z51 } from "@highstate/contract";
 import { pick as pick25 } from "remeda";
 var wgFeedServer = defineUnit48({
   type: "k8s.apps.wg-feed-server.v1",
   args: {
     ...appName("wg-feed-server"),
-    ...pick25(sharedArgs, ["fqdn"])
+    ...pick25(sharedArgs, ["fqdn", "replicas", "scheduling"]),
+    pathPattern: $addArgumentDescription40(z51.string().optional(), `The regular expression matching paths served by the WG feed server.
+
+ Must be provided together with \`fallbackSite\`.`)
   },
   inputs: {
-    ...pick25(sharedInputs, ["k8sCluster", "accessPoint", "etcd"])
+    ...pick25(sharedInputs, ["k8sCluster", "accessPoint", "etcd"]),
+    fallbackSite: $addInputDescription40({
+      entity: folderEntity,
+      required: false
+    }, `The static site served for paths that do not match \`pathPattern\`.
+
+ Must be provided together with \`pathPattern\`.`)
   },
   outputs: {
     endpoint: l4EndpointEntity
@@ -4599,10 +4611,10 @@ var wgFeedServer = defineUnit48({
   source: source("wg-feed-server")
 });
 // src/k8s/apps/workload.ts
-import { $addArgumentDescription as $addArgumentDescription39 } from "@highstate/contract";
-import { defineUnit as defineUnit49, z as z50 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription41 } from "@highstate/contract";
+import { defineUnit as defineUnit49, z as z52 } from "@highstate/contract";
 import { pick as pick26 } from "remeda";
-var databaseConfigKeySchema = z50.enum([
+var databaseConfigKeySchema = z52.enum([
   "url",
   "host",
   "port",
@@ -4610,86 +4622,86 @@ var databaseConfigKeySchema = z50.enum([
   "password",
   "database"
 ]);
-var environmentVariableSchema = z50.union([
-  z50.string(),
-  z50.object({
-    dependencyKey: z50.templateLiteral([
-      z50.enum(["mariadb", "postgresql", "mongodb"]),
-      z50.literal("."),
+var environmentVariableSchema = z52.union([
+  z52.string(),
+  z52.object({
+    dependencyKey: z52.templateLiteral([
+      z52.enum(["mariadb", "postgresql", "mongodb"]),
+      z52.literal("."),
       databaseConfigKeySchema
     ])
   }),
-  z50.object({
-    configKey: z50.string()
+  z52.object({
+    configKey: z52.string()
   }),
-  z50.object({
-    secretKey: z50.string()
+  z52.object({
+    secretKey: z52.string()
   })
 ]);
 var workload = defineUnit49({
   type: "k8s.apps.workload.v0",
   args: {
-    appName: $addArgumentDescription39(z50.string().optional(), `The name of the application.
+    appName: $addArgumentDescription41(z52.string().optional(), `The name of the application.
 
  If not provided, the name of the unit will be used.`),
-    namespace: $addArgumentDescription39(z50.string().optional(), `The name of the new namespace to create for the workload.
+    namespace: $addArgumentDescription41(z52.string().optional(), `The name of the new namespace to create for the workload.
 
  If not provided, the \`appName\` will be used as the namespace name.`),
-    existingNamespace: $addArgumentDescription39(z50.string().optional(), `The name of the existing namespace to use for the workload.`),
+    existingNamespace: $addArgumentDescription41(z52.string().optional(), `The name of the existing namespace to use for the workload.`),
     ...pick26(sharedArgs, ["external"]),
     ...serviceArg,
     ...schedulingArg,
-    type: $addArgumentDescription39(z50.enum(["Deployment", "StatefulSet", "DaemonSet", "Job", "CronJob"]).default("Deployment"), `The type of the workload to create.`),
-    image: $addArgumentDescription39(z50.string(), `The image to use for the workload.`),
-    command: $addArgumentDescription39(z50.array(z50.string()).default([]), `The command to run in the container.`),
-    port: $addArgumentDescription39(portSchema.optional(), `The port to expose for the workload.
+    type: $addArgumentDescription41(z52.enum(["Deployment", "StatefulSet", "DaemonSet", "Job", "CronJob"]).default("Deployment"), `The type of the workload to create.`),
+    image: $addArgumentDescription41(z52.string(), `The image to use for the workload.`),
+    command: $addArgumentDescription41(z52.array(z52.string()).default([]), `The command to run in the container.`),
+    port: $addArgumentDescription41(portSchema.optional(), `The port to expose for the workload.
 
  If specified, a service will be created for the workload.`),
-    fqdn: $addArgumentDescription39(z50.string().optional(), `The FQDN of the workload.
+    fqdn: $addArgumentDescription41(z52.string().optional(), `The FQDN of the workload.
 
  If specified, a service and an HTTP route will be created for the workload.`),
-    replicas: $addArgumentDescription39(z50.number().default(1), `The number of replicas for the workload.
+    replicas: $addArgumentDescription41(z52.number().default(1), `The number of replicas for the workload.
 
  By default, it is set to 1.`),
-    dataPath: $addArgumentDescription39(z50.string().optional(), `The path where the workload data will be stored.
+    dataPath: $addArgumentDescription41(z52.string().optional(), `The path where the workload data will be stored.
 
  If specified, a persistent volume claim will be created for the workload.
 
  If \`resticRepo\` input is provided, the automatic backup will be enabled for this path.`),
-    env: $addArgumentDescription39(z50.record(z50.string(), environmentVariableSchema).default({}), `The environment variables to set for the workload.
+    env: $addArgumentDescription41(z52.record(z52.string(), environmentVariableSchema).default({}), `The environment variables to set for the workload.
 
  The values can be:
  1. a static string value;
  2. a dependency key to service configuration (e.g., \`mariadb.username\`);
  3. a config key to reference a configuration value provided via \`config\` argument;
  4. a secret key to reference a secret value provided via \`secretData\` secret.`),
-    files: $addArgumentDescription39(z50.record(z50.string(), z50.string()).default({}), `The files to mount in the workload from a config map.`),
-    config: $addArgumentDescription39(z50.record(z50.string(), z50.unknown()).default({}), `The configuration for the workload.
+    files: $addArgumentDescription41(z52.record(z52.string(), z52.string()).default({}), `The files to mount in the workload from a config map.`),
+    config: $addArgumentDescription41(z52.record(z52.string(), z52.unknown()).default({}), `The configuration for the workload.
 
  If provided, the config map will be created.
 
  You can reference the configuration values in the environment variables using \`configKey\`.`),
-    manifest: $addArgumentDescription39(z50.record(z50.string(), z50.unknown()).default({}), `The Kubernetes manifest patch for the deployment.
+    manifest: $addArgumentDescription41(z52.record(z52.string(), z52.unknown()).default({}), `The Kubernetes manifest patch for the deployment.
 
  Will be applied to the deployment manifest before it is created.`),
-    httpRouteManifest: $addArgumentDescription39(z50.record(z50.string(), z50.unknown()).default({}), `The Kubernetes HTTP route manifest for the deployment.
+    httpRouteManifest: $addArgumentDescription41(z52.record(z52.string(), z52.unknown()).default({}), `The Kubernetes HTTP route manifest for the deployment.
 
  Will be applied to the HTTP route manifest before it is created.`)
   },
   secrets: {
-    mariadbPassword: $addArgumentDescription39(z50.string().optional(), `The password for the MariaDB database.
+    mariadbPassword: $addArgumentDescription41(z52.string().optional(), `The password for the MariaDB database.
 
  If not provided and requested, a random password will be generated.`),
-    postgresqlPassword: $addArgumentDescription39(z50.string().optional(), `The password for the PostgreSQL database.
+    postgresqlPassword: $addArgumentDescription41(z52.string().optional(), `The password for the PostgreSQL database.
 
  If not provided and requested, a random password will be generated.`),
-    mongodbPassword: $addArgumentDescription39(z50.string().optional(), `The password for the MongoDB database.
+    mongodbPassword: $addArgumentDescription41(z52.string().optional(), `The password for the MongoDB database.
 
  If not provided and requested, a random password will be generated.`),
-    backupKey: $addArgumentDescription39(z50.string().optional(), `The key for the backup.
+    backupKey: $addArgumentDescription41(z52.string().optional(), `The key for the backup.
 
  If not provided and requested, a random key will be generated.`),
-    secretData: $addArgumentDescription39(z50.record(z50.string(), z50.string()).default({}), `The secret configuration for the workload.
+    secretData: $addArgumentDescription41(z52.record(z52.string(), z52.string()).default({}), `The secret configuration for the workload.
 
  If provided, the secret will be created with the specified content.
 
@@ -4719,19 +4731,19 @@ var workload = defineUnit49({
   source: source("workload")
 });
 // src/k8s/cert-manager.ts
-import { $addArgumentDescription as $addArgumentDescription40, $addInputDescription as $addInputDescription40 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription42, $addInputDescription as $addInputDescription42 } from "@highstate/contract";
 import { camelCaseToHumanReadable as __camelCaseToHumanReadable26 } from "@highstate/contract";
-import { defineUnit as defineUnit50, z as z51 } from "@highstate/contract";
-var tlsIssuerDataSchema = z51.object({
+import { defineUnit as defineUnit50, z as z53 } from "@highstate/contract";
+var tlsIssuerDataSchema = z53.object({
   cluster: clusterEntity.schema.meta({ title: __camelCaseToHumanReadable26("cluster"), description: `The Kubernetes cluster to use for creating gateway routes.` }),
-  clusterIssuerName: z51.string().meta({ title: __camelCaseToHumanReadable26("clusterIssuerName"), description: `The name of the cluster issuer which should be used to issue TLS certificates.` })
+  clusterIssuerName: z53.string().meta({ title: __camelCaseToHumanReadable26("clusterIssuerName"), description: `The name of the cluster issuer which should be used to issue TLS certificates.` })
 });
 var certManager = defineUnit50({
   type: "k8s.cert-manager.v1",
   args: {
     ...helmExtensionArgs,
     ...schedulingArg,
-    enableGatewayApi: $addArgumentDescription40(z51.boolean().default(false), `Whether to enable the native support for Gateway API in cert-manager.
+    enableGatewayApi: $addArgumentDescription42(z53.boolean().default(false), `Whether to enable the native support for Gateway API in cert-manager.
 
  Note that this can conflict with "Gateway API" unit since it is bringing its own CRDs.`)
   },
@@ -4755,19 +4767,19 @@ var certManager = defineUnit50({
 var dns01TlsIssuer = defineUnit50({
   type: "k8s.dns01-issuer.v1",
   args: {
-    acmeServer: $addArgumentDescription40(z51.union([
-      z51.object({
-        type: z51.enum(["letsencrypt", "zerossl"])
+    acmeServer: $addArgumentDescription42(z53.union([
+      z53.object({
+        type: z53.enum(["letsencrypt", "zerossl"])
       }),
-      z51.object({
-        type: z51.literal("custom"),
-        url: z51.string()
+      z53.object({
+        type: z53.literal("custom"),
+        url: z53.string()
       })
     ]).default({ type: "letsencrypt" }), `The ACME server to use for issuing certificates.`)
   },
   secrets: {
-    eabKeyId: z51.string().optional(),
-    eabKeySecret: z51.string().optional()
+    eabKeyId: z53.string().optional(),
+    eabKeySecret: z53.string().optional()
   },
   inputs: {
     k8sCluster: clusterEntity,
@@ -4792,8 +4804,8 @@ var dns01TlsIssuer = defineUnit50({
 var vaultTlsIssuer = defineUnit50({
   type: "k8s.vault-issuer.v1",
   inputs: {
-    k8sCluster: $addInputDescription40(clusterEntity, `The Kubernetes cluster where the Vault issuer should be configured.`),
-    vaultPkiIssuer: $addInputDescription40(pkiIssuerEntity, `The Vault PKI issuer to use for issuing certificates.`)
+    k8sCluster: $addInputDescription42(clusterEntity, `The Kubernetes cluster where the Vault issuer should be configured.`),
+    vaultPkiIssuer: $addInputDescription42(pkiIssuerEntity, `The Vault PKI issuer to use for issuing certificates.`)
   },
   outputs: {
     tlsIssuer: tlsIssuerEntity
@@ -4812,18 +4824,18 @@ var vaultTlsIssuer = defineUnit50({
   }
 });
 // src/k8s/cilium.ts
-import { $addArgumentDescription as $addArgumentDescription41 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription43 } from "@highstate/contract";
 import { camelCaseToHumanReadable as __camelCaseToHumanReadable27 } from "@highstate/contract";
-import { defineUnit as defineUnit51, z as z52 } from "@highstate/contract";
+import { defineUnit as defineUnit51, z as z54 } from "@highstate/contract";
 var cilium = defineUnit51({
   type: "k8s.cilium.v1",
   args: {
-    allowForbiddenFqdnResolution: $addArgumentDescription41(z52.boolean().default(false), `If set to \`true\`, the generated network policy will allow
+    allowForbiddenFqdnResolution: $addArgumentDescription43(z54.boolean().default(false), `If set to \`true\`, the generated network policy will allow
  all DNS queries to be resolved, even if they are
  for forbidden (non-allowed) FQDNs.
 
  By default, is \`false\`.`),
-    enableHubble: $addArgumentDescription41(z52.boolean().default(true), `Whether to enable Hubble Relay and UI for observability.
+    enableHubble: $addArgumentDescription43(z54.boolean().default(true), `Whether to enable Hubble Relay and UI for observability.
 
  By default, this is \`true\`.
 
@@ -4849,9 +4861,9 @@ var cilium = defineUnit51({
     path: "unit"
   }
 });
-var ciliumClusterMetadata = z52.object({
-  "cilium.cni": z52.object({
-    allowForbiddenFqdnResolution: z52.boolean().default(false).meta({ title: __camelCaseToHumanReadable27("allowForbiddenFqdnResolution"), description: `If set to \`true\`, the generated network policy will allow
+var ciliumClusterMetadata = z54.object({
+  "cilium.cni": z54.object({
+    allowForbiddenFqdnResolution: z54.boolean().default(false).meta({ title: __camelCaseToHumanReadable27("allowForbiddenFqdnResolution"), description: `If set to \`true\`, the generated network policy will allow
  all DNS queries to be resolved, even if they are
  for forbidden (non-allowed) FQDNs.
 
@@ -4859,24 +4871,24 @@ var ciliumClusterMetadata = z52.object({
   })
 });
 // src/k8s/coredns.ts
-import { $addArgumentDescription as $addArgumentDescription42 } from "@highstate/contract";
-import { defineUnit as defineUnit52, z as z53 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription44 } from "@highstate/contract";
+import { defineUnit as defineUnit52, z as z55 } from "@highstate/contract";
 var coreDns = defineUnit52({
   type: "k8s.coredns.v1",
   args: {
     ...schedulingArg,
-    mode: $addArgumentDescription42(z53.enum(["cluster", "node"]).default("cluster"), `The mode to use for CoreDNS deployment.
+    mode: $addArgumentDescription44(z55.enum(["cluster", "node"]).default("cluster"), `The mode to use for CoreDNS deployment.
 
  \`cluster\` creates a regular Deployment with a small replica count.
  It is the default Kubernetes model and fits clusters with reliable pod/service networking between nodes.
 
  \`node\` creates a DaemonSet and configures the DNS Service to route only to node-local endpoints.
  It fits edge, NATed, or partitioned clusters where each node should answer DNS locally and avoid cross-node DNS traffic.`),
-    clusterDomain: $addArgumentDescription42(z53.string().default("cluster.local"), `The Kubernetes cluster DNS domain served by CoreDNS.`),
-    clusterIP: $addArgumentDescription42(z53.string().default("10.43.0.10"), `The stable Service IP to reserve for cluster DNS.
+    clusterDomain: $addArgumentDescription44(z55.string().default("cluster.local"), `The Kubernetes cluster DNS domain served by CoreDNS.`),
+    clusterIP: $addArgumentDescription44(z55.string().default("10.43.0.10"), `The stable Service IP to reserve for cluster DNS.
 
  The default matches the common K3s service CIDR.`),
-    useExternalKubeApi: $addArgumentDescription42(z53.boolean().default(false), `Whether CoreDNS should connect through the best external Kubernetes API endpoint.
+    useExternalKubeApi: $addArgumentDescription44(z55.boolean().default(false), `Whether CoreDNS should connect through the best external Kubernetes API endpoint.
 
  By default, CoreDNS uses the in-cluster Kubernetes service endpoint.`)
   },
@@ -4905,14 +4917,14 @@ __export(exports_game_servers, {
 });
 
 // src/k8s/game-servers/openttd.ts
-import { defineUnit as defineUnit53, z as z54 } from "@highstate/contract";
+import { defineUnit as defineUnit53, z as z56 } from "@highstate/contract";
 import { pick as pick27 } from "remeda";
 var openttd = defineUnit53({
   type: "k8s.game-servers.openttd.v1",
   args: {
     ...appName("openttd-server"),
     ...pick27(sharedArgs, ["fqdn"]),
-    port: z54.number().default(3979).describe("The port the game server will be exposed on.")
+    port: z56.number().default(3979).describe("The port the game server will be exposed on.")
   },
   inputs: {
     ...pick27(sharedInputs, ["k8sCluster", "dnsProviders"]),
@@ -4932,14 +4944,14 @@ var openttd = defineUnit53({
   }
 });
 // src/k8s/game-servers/satisfactory.ts
-import { defineUnit as defineUnit54, z as z55 } from "@highstate/contract";
+import { defineUnit as defineUnit54, z as z57 } from "@highstate/contract";
 import { pick as pick28 } from "remeda";
 var satisfactory = defineUnit54({
   type: "k8s.game-servers.satisfactory.v1",
   args: {
     ...appName("satisfactory-server"),
     ...pick28(sharedArgs, ["fqdn"]),
-    port: z55.number().default(7777).describe("The port the game server will be exposed on.")
+    port: z57.number().default(7777).describe("The port the game server will be exposed on.")
   },
   inputs: {
     ...pick28(sharedInputs, ["k8sCluster", "accessPoint"]),
@@ -4959,31 +4971,31 @@ var satisfactory = defineUnit54({
   }
 });
 // src/k8s/gateway.ts
-import { $addArgumentDescription as $addArgumentDescription43 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription45 } from "@highstate/contract";
 import { camelCaseToHumanReadable as __camelCaseToHumanReadable28 } from "@highstate/contract";
-import { defineUnit as defineUnit55, z as z56 } from "@highstate/contract";
-var semverVersionSchema = z56.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/);
-var gatewayDataSchema = z56.object({
+import { defineUnit as defineUnit55, z as z58 } from "@highstate/contract";
+var semverVersionSchema = z58.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/);
+var gatewayDataSchema = z58.object({
   cluster: clusterEntity.schema.meta({ title: __camelCaseToHumanReadable28("cluster"), description: `The Kubernetes cluster to use for creating gateway routes.` }),
   namespace: namespaceEntity2.schema.meta({ title: __camelCaseToHumanReadable28("namespace"), description: `The namespace where the gateway controller of the class is running.` }),
-  className: z56.string().meta({ title: __camelCaseToHumanReadable28("className"), description: `The name of the gateway class to use.` }),
-  httpPort: z56.number().default(80).meta({ title: __camelCaseToHumanReadable28("httpPort"), description: `The port to use for HTTP in listener.
+  className: z58.string().meta({ title: __camelCaseToHumanReadable28("className"), description: `The name of the gateway class to use.` }),
+  httpPort: z58.number().default(80).meta({ title: __camelCaseToHumanReadable28("httpPort"), description: `The port to use for HTTP in listener.
 
  If not provided, defaults to 80.` }),
-  httpsPort: z56.number().default(443).meta({ title: __camelCaseToHumanReadable28("httpsPort"), description: `The port to use for HTTPS in listener.
+  httpsPort: z58.number().default(443).meta({ title: __camelCaseToHumanReadable28("httpsPort"), description: `The port to use for HTTPS in listener.
 
  If not provided, defaults to 443.` }),
   controllerImplRef: implementationReferenceSchema.optional().meta({ title: __camelCaseToHumanReadable28("controllerImplRef"), description: `The nested implementation reference for the Gateway API controller.` })
 });
-var gatewayImplRefSchema = z56.object({
-  package: z56.literal("@highstate/k8s"),
+var gatewayImplRefSchema = z58.object({
+  package: z58.literal("@highstate/k8s"),
   data: gatewayDataSchema
 });
 var gatewayApi = defineUnit55({
   type: "k8s.gateway-api.v1",
   args: {
-    channel: $addArgumentDescription43(z56.enum(["stable", "experimental"]).default("stable"), `The Gateway API release channel to install.`),
-    version: $addArgumentDescription43(semverVersionSchema.optional(), `The Gateway API version to install.
+    channel: $addArgumentDescription45(z58.enum(["stable", "experimental"]).default("stable"), `The Gateway API release channel to install.`),
+    version: $addArgumentDescription45(semverVersionSchema.optional(), `The Gateway API version to install.
 
  Defaults to the latest stable version when using the stable channel.
  Must be specified when using the experimental channel.`)
@@ -5024,23 +5036,23 @@ __export(exports_phantun, {
 import { defineUnit as defineUnit56 } from "@highstate/contract";
 
 // src/k8s/obfuscators/shared.ts
-import { $addArgumentDescription as $addArgumentDescription44, $addInputDescription as $addInputDescription44 } from "@highstate/contract";
-import { $args as $args7, $inputs as $inputs3, $outputs as $outputs2, z as z57 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription46, $addInputDescription as $addInputDescription46 } from "@highstate/contract";
+import { $args as $args7, $inputs as $inputs3, $outputs as $outputs2, z as z59 } from "@highstate/contract";
 var deobfuscatorSpec = {
   args: $args7({
-    appName: $addArgumentDescription44(z57.string().optional(), `The name of the namespace and deployment to deploy the deobfuscator on.
+    appName: $addArgumentDescription46(z59.string().optional(), `The name of the namespace and deployment to deploy the deobfuscator on.
 
  By default, calculated as \`deobfs-{type}-{name}\`.`),
-    targetEndpoints: $addArgumentDescription44(z57.string().array().default([]), `The L4 endpoint to forward deobfuscated traffic to.
+    targetEndpoints: $addArgumentDescription46(z59.string().array().default([]), `The L4 endpoint to forward deobfuscated traffic to.
 
  Will take precedence over the \`targetEndpoint\` input.`),
-    external: $addArgumentDescription44(z57.boolean().default(false), `Whether to expose the deobfuscator service by "NodePort" or "LoadBalancer".
+    external: $addArgumentDescription46(z59.boolean().default(false), `Whether to expose the deobfuscator service by "NodePort" or "LoadBalancer".
 
  By default, the service is not exposed and only accessible from within the cluster.`)
   }),
   inputs: $inputs3({
-    k8sCluster: $addInputDescription44(clusterEntity, `The Kubernetes cluster to deploy the deobfuscator on.`),
-    targetEndpoints: $addInputDescription44({
+    k8sCluster: $addInputDescription46(clusterEntity, `The Kubernetes cluster to deploy the deobfuscator on.`),
+    targetEndpoints: $addInputDescription46({
       entity: l4EndpointEntity,
       required: false,
       multiple: true
@@ -5049,7 +5061,7 @@ var deobfuscatorSpec = {
  Will select the most appropriate endpoint based on the environment.`)
   }),
   outputs: $outputs2({
-    endpoints: $addInputDescription44({
+    endpoints: $addInputDescription46({
       entity: l4EndpointEntity,
       required: false,
       multiple: true
@@ -5058,19 +5070,19 @@ var deobfuscatorSpec = {
 };
 var obfuscatorSpec = {
   args: $args7({
-    appName: $addArgumentDescription44(z57.string().optional(), `The name of the namespace and deployment to deploy the obfuscator on.
+    appName: $addArgumentDescription46(z59.string().optional(), `The name of the namespace and deployment to deploy the obfuscator on.
 
  By default, calculated as \`obfs-{type}-{name}\`.`),
-    endpoints: $addArgumentDescription44(z57.string().array().default([]), `The endpoint of the deobfuscator to pass obfuscated traffic to.
+    endpoints: $addArgumentDescription46(z59.string().array().default([]), `The endpoint of the deobfuscator to pass obfuscated traffic to.
 
  Will take precedence over the \`endpoint\` input.`),
-    external: $addArgumentDescription44(z57.boolean().default(false), `Whether to expose the obfuscator service by "NodePort" or "LoadBalancer".
+    external: $addArgumentDescription46(z59.boolean().default(false), `Whether to expose the obfuscator service by "NodePort" or "LoadBalancer".
 
  By default, the service is not exposed and only accessible from within the cluster.`)
   }),
   inputs: $inputs3({
-    k8sCluster: $addInputDescription44(clusterEntity, `The Kubernetes cluster to deploy the obfuscator on.`),
-    endpoints: $addInputDescription44({
+    k8sCluster: $addInputDescription46(clusterEntity, `The Kubernetes cluster to deploy the obfuscator on.`),
+    endpoints: $addInputDescription46({
       entity: l4EndpointEntity,
       required: false,
       multiple: true
@@ -5079,7 +5091,7 @@ var obfuscatorSpec = {
  Will select the most appropriate endpoint based on the environment.`)
   }),
   outputs: $outputs2({
-    entryEndpoints: $addInputDescription44({
+    entryEndpoints: $addInputDescription46({
       entity: l4EndpointEntity,
       multiple: true
     }, `The L4 endpoints accepting unobfuscated traffic.`)
@@ -5118,9 +5130,9 @@ var obfuscator = defineUnit56({
   }
 });
 // src/k8s/reduced-access.ts
-import { $addArgumentDescription as $addArgumentDescription45, $addInputDescription as $addInputDescription45 } from "@highstate/contract";
-import { defineUnit as defineUnit57, z as z58 } from "@highstate/contract";
-var accessVerbSchema = z58.enum([
+import { $addArgumentDescription as $addArgumentDescription47, $addInputDescription as $addInputDescription47 } from "@highstate/contract";
+import { defineUnit as defineUnit57, z as z60 } from "@highstate/contract";
+var accessVerbSchema = z60.enum([
   "get",
   "list",
   "watch",
@@ -5130,32 +5142,32 @@ var accessVerbSchema = z58.enum([
   "delete",
   "deletecollection"
 ]);
-var acessRuleSchema = z58.object({
-  apiGroups: z58.string().array(),
-  resources: z58.string().array(),
+var acessRuleSchema = z60.object({
+  apiGroups: z60.string().array(),
+  resources: z60.string().array(),
   verbs: accessVerbSchema.array(),
-  resourceNames: z58.string().array().default([])
+  resourceNames: z60.string().array().default([])
 });
 var reducedAccessCluster = defineUnit57({
   type: "k8s.reduced-access-cluster.v1",
   args: {
-    serviceAccountName: $addArgumentDescription45(z58.string().optional(), `The name of the ServiceAccount to create.
+    serviceAccountName: $addArgumentDescription47(z60.string().optional(), `The name of the ServiceAccount to create.
 
  If not provided, will be the same as the unit name.`),
-    rules: $addArgumentDescription45(acessRuleSchema.array().default([]), `The rules defining the access permissions for the ServiceAccount.
+    rules: $addArgumentDescription47(acessRuleSchema.array().default([]), `The rules defining the access permissions for the ServiceAccount.
 
  If rule's \`apiGroups\` and \`resources\` exactly match resources from the \`resources\` input,
  their names will be added to the rule's \`resourceNames\` list.`)
   },
   inputs: {
     k8sCluster: clusterEntity,
-    namespace: $addInputDescription45(namespaceEntity2, `The namespace where the ServiceAccount will be created.`),
-    extraNamespaces: $addInputDescription45({
+    namespace: $addInputDescription47(namespaceEntity2, `The namespace where the ServiceAccount will be created.`),
+    extraNamespaces: $addInputDescription47({
       entity: namespaceEntity2,
       multiple: true,
       required: false
     }, `The extra namespaces to bind to the ClusterRole and allow ServiceAccount to access them with specified rules.`),
-    resources: $addInputDescription45({
+    resources: $addInputDescription47({
       entity: resourceEntity,
       multiple: true,
       required: false
@@ -5190,24 +5202,24 @@ __export(exports_netaminity, {
   gatewayDataSchema: () => gatewayDataSchema2,
   gateway: () => gateway2
 });
-import { $addArgumentDescription as $addArgumentDescription46, $addInputDescription as $addInputDescription46 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription48, $addInputDescription as $addInputDescription48 } from "@highstate/contract";
 import { camelCaseToHumanReadable as __camelCaseToHumanReadable29 } from "@highstate/contract";
 import {
   defineEntity as defineEntity30,
   defineUnit as defineUnit58,
   secretSchema as secretSchema14,
-  z as z59
+  z as z61
 } from "@highstate/contract";
 var source2 = (path) => ({
   package: "@highstate/netaminity",
   path
 });
-var portSchema2 = z59.number().int().min(1).max(65535);
-var serviceTypeSchema2 = z59.enum(["ClusterIP", "NodePort", "LoadBalancer"]);
-var podTemplateSchema = z59.record(z59.string(), z59.unknown()).default({});
-var replicasSchema = z59.number().int().min(1).default(1);
-var oddReplicasSchema = z59.number().int().min(1).refine((replicas) => replicas % 2 === 1, "Netaminity replicas must be odd").default(1);
-var gatewayDataSchema2 = z59.object({
+var portSchema2 = z61.number().int().min(1).max(65535);
+var serviceTypeSchema2 = z61.enum(["ClusterIP", "NodePort", "LoadBalancer"]);
+var podTemplateSchema = z61.record(z61.string(), z61.unknown()).default({});
+var replicasSchema = z61.number().int().min(1).default(1);
+var oddReplicasSchema = z61.number().int().min(1).refine((replicas) => replicas % 2 === 1, "Netaminity replicas must be odd").default(1);
+var gatewayDataSchema2 = z61.object({
   proxyGateway: gatewayEntity.schema.meta({ title: __camelCaseToHumanReadable29("proxyGateway"), description: `The proxy-side gateway that accepts public TLS traffic.` }),
   targetGateway: gatewayEntity.schema.meta({ title: __camelCaseToHumanReadable29("targetGateway"), description: `The target-side gateway that terminates TLS and routes requests.` }),
   proxyImplRef: implementationReferenceSchema.meta({ title: __camelCaseToHumanReadable29("proxyImplRef"), description: `The implementation reference used to create proxy-side TLS routes.` }),
@@ -5229,9 +5241,9 @@ var proxyEntity = defineEntity30({
       required: false
     }
   },
-  schema: z59.object({
-    proxyEndpoint: z59.string().meta({ title: __camelCaseToHumanReadable29("proxyEndpoint"), description: `The control endpoint where Netaminity targets connect to the proxy.` }),
-    sharedSecret: secretSchema14(z59.string()).meta({ title: __camelCaseToHumanReadable29("sharedSecret"), description: `The shared authentication secret used by the proxy and its targets.` })
+  schema: z61.object({
+    proxyEndpoint: z61.string().meta({ title: __camelCaseToHumanReadable29("proxyEndpoint"), description: `The control endpoint where Netaminity targets connect to the proxy.` }),
+    sharedSecret: secretSchema14(z61.string()).meta({ title: __camelCaseToHumanReadable29("sharedSecret"), description: `The shared authentication secret used by the proxy and its targets.` })
   }),
   meta: {
     color: "#477D75",
@@ -5244,7 +5256,7 @@ var proxyEntity = defineEntity30({
 var targetEntity = defineEntity30({
   type: "netaminity.target.v1",
   extends: { namespacedResourceEntity },
-  schema: z59.unknown(),
+  schema: z61.unknown(),
   meta: {
     color: "#8064A2",
     title: "Netaminity Target",
@@ -5264,7 +5276,7 @@ var tunnelEntity = defineEntity30({
       required: false
     }
   },
-  schema: z59.unknown(),
+  schema: z61.unknown(),
   meta: {
     color: "#2878A0",
     title: "Netaminity Tunnel",
@@ -5278,17 +5290,17 @@ var operator = defineUnit58({
   args: {
     ...helmExtensionArgs,
     ...schedulingArg,
-    replicas: $addArgumentDescription46(oddReplicasSchema, `The number of Netaminity operator replicas.
+    replicas: $addArgumentDescription48(oddReplicasSchema, `The number of Netaminity operator replicas.
 
  Leader election ensures that only one replica actively reconciles resources.
  The replica count must be odd.`),
-    proxyHost: $addArgumentDescription46(z59.string().optional(), `The hostname or IP address used to advertise NodePort proxy control Services.
+    proxyHost: $addArgumentDescription48(z61.string().optional(), `The hostname or IP address used to advertise NodePort proxy control Services.
 
  When omitted, the proxy host input or the first cluster endpoint is used.`)
   },
   inputs: {
-    k8sCluster: $addInputDescription46(clusterEntity, `The Kubernetes cluster where the Netaminity operator should be installed.`),
-    proxyHost: $addInputDescription46({
+    k8sCluster: $addInputDescription48(clusterEntity, `The Kubernetes cluster where the Netaminity operator should be installed.`),
+    proxyHost: $addInputDescription48({
       entity: l3EndpointEntity,
       required: false
     }, `The hostname or IP address used to advertise NodePort proxy control Services.
@@ -5296,7 +5308,7 @@ var operator = defineUnit58({
  The first cluster endpoint is used when this input and the proxyHost argument are omitted.`)
   },
   outputs: {
-    k8sCluster: $addInputDescription46(clusterEntity, `The Kubernetes cluster after the Netaminity operator has been installed.`)
+    k8sCluster: $addInputDescription48(clusterEntity, `The Kubernetes cluster after the Netaminity operator has been installed.`)
   },
   meta: {
     description: `Installs the Netaminity operator on a Kubernetes cluster.`,
@@ -5310,58 +5322,58 @@ var operator = defineUnit58({
 var proxy = defineUnit58({
   type: "netaminity.proxy.v1",
   args: {
-    resourceName: $addArgumentDescription46(z59.string().optional(), `The name of the Proxy custom resource.
+    resourceName: $addArgumentDescription48(z61.string().optional(), `The name of the Proxy custom resource.
 
  If omitted, the unit name is used.`),
-    namespace: $addArgumentDescription46(z59.string().optional(), `The name of the Kubernetes namespace to create for the proxy.
+    namespace: $addArgumentDescription48(z61.string().optional(), `The name of the Kubernetes namespace to create for the proxy.
 
  Ignored when the namespace input is provided.`),
-    serviceEnabled: $addArgumentDescription46(z59.boolean().default(true), `Whether to create a Service for consumers of the proxied target.`),
-    serviceName: $addArgumentDescription46(z59.string().optional(), `The name of the consumer Service.
+    serviceEnabled: $addArgumentDescription48(z61.boolean().default(true), `Whether to create a Service for consumers of the proxied target.`),
+    serviceName: $addArgumentDescription48(z61.string().optional(), `The name of the consumer Service.
 
  If omitted, the Proxy resource name is used.`),
-    servicePort: $addArgumentDescription46(portSchema2.optional(), `The TCP port exposed by the consumer Service.
+    servicePort: $addArgumentDescription48(portSchema2.optional(), `The TCP port exposed by the consumer Service.
 
  When omitted, the port of the first endpoint input is used.`),
-    external: $addArgumentDescription46(z59.boolean().default(false), `Whether to expose the consumer Service outside the cluster.
+    external: $addArgumentDescription48(z61.boolean().default(false), `Whether to expose the consumer Service outside the cluster.
 
  The Service type is selected automatically from the cluster configuration.`),
-    proxyServiceName: $addArgumentDescription46(z59.string().optional(), `The name of the control Service used by targets.`),
-    proxyServiceType: $addArgumentDescription46(serviceTypeSchema2.default("NodePort"), `The Kubernetes type of the control Service used by targets.`),
-    proxyNodePort: $addArgumentDescription46(portSchema2.optional(), `The fixed NodePort for the control Service.
+    proxyServiceName: $addArgumentDescription48(z61.string().optional(), `The name of the control Service used by targets.`),
+    proxyServiceType: $addArgumentDescription48(serviceTypeSchema2.default("NodePort"), `The Kubernetes type of the control Service used by targets.`),
+    proxyNodePort: $addArgumentDescription48(portSchema2.optional(), `The fixed NodePort for the control Service.
 
  Kubernetes assigns one when omitted.`),
-    replicas: $addArgumentDescription46(replicasSchema, `The number of interchangeable proxy pods behind the Proxy Services.`),
-    hostNetwork: $addArgumentDescription46(z59.boolean().default(false), `Whether generated proxy pods use the node network namespace.`),
-    distributeByNodes: $addArgumentDescription46(z59.boolean().default(true), `Whether generated proxy pods prefer distribution across Kubernetes nodes.`),
-    podTemplate: $addArgumentDescription46(podTemplateSchema, `The raw Netaminity pod template applied to the generated proxy pod.`)
+    replicas: $addArgumentDescription48(replicasSchema, `The number of interchangeable proxy pods behind the Proxy Services.`),
+    hostNetwork: $addArgumentDescription48(z61.boolean().default(false), `Whether generated proxy pods use the node network namespace.`),
+    distributeByNodes: $addArgumentDescription48(z61.boolean().default(true), `Whether generated proxy pods prefer distribution across Kubernetes nodes.`),
+    podTemplate: $addArgumentDescription48(podTemplateSchema, `The raw Netaminity pod template applied to the generated proxy pod.`)
   },
   secrets: {
-    sharedSecret: $addArgumentDescription46(z59.string().optional(), `The shared authentication secret used by the proxy and its targets.
+    sharedSecret: $addArgumentDescription48(z61.string().optional(), `The shared authentication secret used by the proxy and its targets.
 
  A random key is generated when omitted.`)
   },
   inputs: {
-    k8sCluster: $addInputDescription46(clusterEntity, `The Kubernetes cluster with the Netaminity operator installed.`),
-    endpoints: $addInputDescription46({
+    k8sCluster: $addInputDescription48(clusterEntity, `The Kubernetes cluster with the Netaminity operator installed.`),
+    endpoints: $addInputDescription48({
       entity: l4EndpointEntity,
       multiple: true,
       required: false
     }, `The target TCP endpoints whose port should be exposed by the consumer Service.
 
  The first endpoint's port is used when the servicePort argument is omitted.`),
-    namespace: $addInputDescription46({
+    namespace: $addInputDescription48({
       entity: namespaceEntity2,
       required: false
     }, `The existing Kubernetes namespace where the proxy should be created.`)
   },
   outputs: {
-    proxy: $addInputDescription46(proxyEntity, `The Netaminity proxy, including its control endpoint and shared secret.`),
-    service: $addInputDescription46({
+    proxy: $addInputDescription48(proxyEntity, `The Netaminity proxy, including its control endpoint and shared secret.`),
+    service: $addInputDescription48({
       entity: serviceEntity,
       required: false
     }, `The consumer Service created for the proxy.`),
-    endpoints: $addInputDescription46({
+    endpoints: $addInputDescription48({
       entity: l4EndpointEntity,
       multiple: true
     }, `The endpoints where consumers can access the proxied service.`)
@@ -5379,36 +5391,36 @@ var proxy = defineUnit58({
 var target = defineUnit58({
   type: "netaminity.target.v1",
   args: {
-    resourceName: $addArgumentDescription46(z59.string().optional(), `The name of the Target custom resource.
+    resourceName: $addArgumentDescription48(z61.string().optional(), `The name of the Target custom resource.
 
  If omitted, the unit name is used.`),
-    namespace: $addArgumentDescription46(z59.string().optional(), `The name of the Kubernetes namespace to create for the target.
+    namespace: $addArgumentDescription48(z61.string().optional(), `The name of the Kubernetes namespace to create for the target.
 
  Ignored when the namespace input is provided.`),
-    endpoint: $addArgumentDescription46(z59.string().min(3).optional(), `The target TCP endpoint reachable from the generated target pod.
+    endpoint: $addArgumentDescription48(z61.string().min(3).optional(), `The target TCP endpoint reachable from the generated target pod.
 
  When omitted, the first endpoint input is used.`),
-    hostNetwork: $addArgumentDescription46(z59.boolean().default(false), `Whether the generated target pod uses the node network namespace.`),
-    distributeByNodes: $addArgumentDescription46(z59.boolean().default(true), `Whether the generated target pod prefers distribution across Kubernetes nodes.`),
-    podTemplate: $addArgumentDescription46(podTemplateSchema, `The raw Netaminity pod template applied to the generated target pod.`)
+    hostNetwork: $addArgumentDescription48(z61.boolean().default(false), `Whether the generated target pod uses the node network namespace.`),
+    distributeByNodes: $addArgumentDescription48(z61.boolean().default(true), `Whether the generated target pod prefers distribution across Kubernetes nodes.`),
+    podTemplate: $addArgumentDescription48(podTemplateSchema, `The raw Netaminity pod template applied to the generated target pod.`)
   },
   inputs: {
-    k8sCluster: $addInputDescription46(clusterEntity, `The Kubernetes cluster with the Netaminity operator installed.`),
-    proxy: $addInputDescription46(proxyEntity, `The standalone Netaminity proxy to connect the target to.`),
-    endpoints: $addInputDescription46({
+    k8sCluster: $addInputDescription48(clusterEntity, `The Kubernetes cluster with the Netaminity operator installed.`),
+    proxy: $addInputDescription48(proxyEntity, `The standalone Netaminity proxy to connect the target to.`),
+    endpoints: $addInputDescription48({
       entity: l4EndpointEntity,
       multiple: true,
       required: false
     }, `The target TCP endpoints reachable from the generated target pod.
 
  The first endpoint is used when the endpoint argument is omitted.`),
-    namespace: $addInputDescription46({
+    namespace: $addInputDescription48({
       entity: namespaceEntity2,
       required: false
     }, `The existing Kubernetes namespace where the target should be created.`)
   },
   outputs: {
-    target: $addInputDescription46(targetEntity, `The created Netaminity target resource.`)
+    target: $addInputDescription48(targetEntity, `The created Netaminity target resource.`)
   },
   meta: {
     description: `Creates a Netaminity target connected to a standalone proxy.`,
@@ -5423,54 +5435,54 @@ var target = defineUnit58({
 var tunnel = defineUnit58({
   type: "netaminity.tunnel.v1",
   args: {
-    resourceName: $addArgumentDescription46(z59.string().optional(), `The name of the Tunnel custom resource.
+    resourceName: $addArgumentDescription48(z61.string().optional(), `The name of the Tunnel custom resource.
 
  If omitted, the unit name is used.`),
-    namespace: $addArgumentDescription46(z59.string().optional(), `The name of the Kubernetes namespace to create for the tunnel.
+    namespace: $addArgumentDescription48(z61.string().optional(), `The name of the Kubernetes namespace to create for the tunnel.
 
  Ignored when the namespace input is provided.`),
-    replicas: $addArgumentDescription46(replicasSchema, `The number of proxy and target pairs created for the tunnel.`),
-    proxyReplicas: $addArgumentDescription46(replicasSchema, `The number of interchangeable proxy pods created for each Proxy resource.`),
-    hostNetwork: $addArgumentDescription46(z59.boolean().default(false), `Whether generated proxy and target pods use their node network namespace.`),
-    distributeByNodes: $addArgumentDescription46(z59.boolean().default(true), `Whether generated proxy and target pods prefer distribution across Kubernetes nodes.`),
-    endpoint: $addArgumentDescription46(z59.string().min(3).optional(), `The target TCP endpoint reachable from generated target pods.
+    replicas: $addArgumentDescription48(replicasSchema, `The number of proxy and target pairs created for the tunnel.`),
+    proxyReplicas: $addArgumentDescription48(replicasSchema, `The number of interchangeable proxy pods created for each Proxy resource.`),
+    hostNetwork: $addArgumentDescription48(z61.boolean().default(false), `Whether generated proxy and target pods use their node network namespace.`),
+    distributeByNodes: $addArgumentDescription48(z61.boolean().default(true), `Whether generated proxy and target pods prefer distribution across Kubernetes nodes.`),
+    endpoint: $addArgumentDescription48(z61.string().min(3).optional(), `The target TCP endpoint reachable from generated target pods.
 
  When omitted, the first endpoint input is used.`),
-    serviceName: $addArgumentDescription46(z59.string().optional(), `The name of the consumer Service.
+    serviceName: $addArgumentDescription48(z61.string().optional(), `The name of the consumer Service.
 
  If omitted, the Tunnel resource name is used.`),
-    servicePort: $addArgumentDescription46(portSchema2.optional(), `The TCP port exposed by the consumer Service.
+    servicePort: $addArgumentDescription48(portSchema2.optional(), `The TCP port exposed by the consumer Service.
 
  When omitted, the destination endpoint port is used.`),
-    external: $addArgumentDescription46(z59.boolean().default(false), `Whether to expose the consumer Service outside the cluster.
+    external: $addArgumentDescription48(z61.boolean().default(false), `Whether to expose the consumer Service outside the cluster.
 
  The Service type is selected automatically from the cluster configuration.`),
-    proxyServiceType: $addArgumentDescription46(serviceTypeSchema2.default("NodePort"), `The Kubernetes type of the control Services used by generated targets.`),
-    proxyNodePort: $addArgumentDescription46(portSchema2.optional(), `The first fixed NodePort assigned to generated proxy control Services.
+    proxyServiceType: $addArgumentDescription48(serviceTypeSchema2.default("NodePort"), `The Kubernetes type of the control Services used by generated targets.`),
+    proxyNodePort: $addArgumentDescription48(portSchema2.optional(), `The first fixed NodePort assigned to generated proxy control Services.
 
  Replica indexes are added to this value.`),
-    podTemplate: $addArgumentDescription46(podTemplateSchema, `The raw base pod template inherited by generated proxy and target pods.`),
-    proxyPodTemplate: $addArgumentDescription46(podTemplateSchema, `The raw pod template merged into generated proxy pods.`),
-    targetPodTemplate: $addArgumentDescription46(podTemplateSchema, `The raw pod template merged into generated target pods.`)
+    podTemplate: $addArgumentDescription48(podTemplateSchema, `The raw base pod template inherited by generated proxy and target pods.`),
+    proxyPodTemplate: $addArgumentDescription48(podTemplateSchema, `The raw pod template merged into generated proxy pods.`),
+    targetPodTemplate: $addArgumentDescription48(podTemplateSchema, `The raw pod template merged into generated target pods.`)
   },
   inputs: {
-    k8sCluster: $addInputDescription46(clusterEntity, `The Kubernetes cluster with the Netaminity operator installed.`),
-    endpoints: $addInputDescription46({
+    k8sCluster: $addInputDescription48(clusterEntity, `The Kubernetes cluster with the Netaminity operator installed.`),
+    endpoints: $addInputDescription48({
       entity: l4EndpointEntity,
       multiple: true,
       required: false
     }, `The target TCP endpoints reachable from generated target pods.
 
  The first endpoint is used when the endpoint argument is omitted.`),
-    namespace: $addInputDescription46({
+    namespace: $addInputDescription48({
       entity: namespaceEntity2,
       required: false
     }, `The existing Kubernetes namespace where the tunnel should be created.`)
   },
   outputs: {
-    tunnel: $addInputDescription46(tunnelEntity, `The created Netaminity tunnel resource.`),
-    service: $addInputDescription46(serviceEntity, `The consumer Service created for the tunnel.`),
-    endpoints: $addInputDescription46({
+    tunnel: $addInputDescription48(tunnelEntity, `The created Netaminity tunnel resource.`),
+    service: $addInputDescription48(serviceEntity, `The consumer Service created for the tunnel.`),
+    endpoints: $addInputDescription48({
       entity: l4EndpointEntity,
       multiple: true
     }, `The endpoints where consumers can access the tunnel.`)
@@ -5488,66 +5500,66 @@ var tunnel = defineUnit58({
 var tunnelMc = defineUnit58({
   type: "netaminity.tunnel.mc.v1",
   args: {
-    resourceName: $addArgumentDescription46(z59.string().optional(), `The base name of the generated Proxy and Target custom resources.
+    resourceName: $addArgumentDescription48(z61.string().optional(), `The base name of the generated Proxy and Target custom resources.
 
  If omitted, the unit name is used.`),
-    proxyNamespace: $addArgumentDescription46(z59.string().optional(), `The name of the Kubernetes namespace to create in the proxy cluster.
+    proxyNamespace: $addArgumentDescription48(z61.string().optional(), `The name of the Kubernetes namespace to create in the proxy cluster.
 
  Ignored when the proxyNamespace input is provided.`),
-    targetNamespace: $addArgumentDescription46(z59.string().optional(), `The name of the Kubernetes namespace to create in the target cluster.
+    targetNamespace: $addArgumentDescription48(z61.string().optional(), `The name of the Kubernetes namespace to create in the target cluster.
 
  Ignored when the targetNamespace input is provided.`),
-    replicas: $addArgumentDescription46(replicasSchema, `The number of Proxy and Target pairs created for the tunnel.`),
-    proxyReplicas: $addArgumentDescription46(replicasSchema, `The number of interchangeable proxy pods created for each Proxy resource.`),
-    hostNetwork: $addArgumentDescription46(z59.boolean().default(false), `Whether generated Proxy and Target pods use their node network namespace.`),
-    distributeByNodes: $addArgumentDescription46(z59.boolean().default(true), `Whether generated Proxy and Target pods prefer distribution across Kubernetes nodes.`),
-    endpoint: $addArgumentDescription46(z59.string().min(3).optional(), `The target TCP endpoint reachable from generated Target pods.
+    replicas: $addArgumentDescription48(replicasSchema, `The number of Proxy and Target pairs created for the tunnel.`),
+    proxyReplicas: $addArgumentDescription48(replicasSchema, `The number of interchangeable proxy pods created for each Proxy resource.`),
+    hostNetwork: $addArgumentDescription48(z61.boolean().default(false), `Whether generated Proxy and Target pods use their node network namespace.`),
+    distributeByNodes: $addArgumentDescription48(z61.boolean().default(true), `Whether generated Proxy and Target pods prefer distribution across Kubernetes nodes.`),
+    endpoint: $addArgumentDescription48(z61.string().min(3).optional(), `The target TCP endpoint reachable from generated Target pods.
 
  When omitted, the first endpoint input is used.`),
-    serviceName: $addArgumentDescription46(z59.string().optional(), `The name of the shared consumer Service in the proxy cluster.
+    serviceName: $addArgumentDescription48(z61.string().optional(), `The name of the shared consumer Service in the proxy cluster.
 
  If omitted, the base resource name is used.`),
-    servicePort: $addArgumentDescription46(portSchema2.optional(), `The TCP port exposed by the shared consumer Service.
+    servicePort: $addArgumentDescription48(portSchema2.optional(), `The TCP port exposed by the shared consumer Service.
 
  When omitted, the destination endpoint port is used.`),
-    external: $addArgumentDescription46(z59.boolean().default(false), `Whether to expose the shared consumer Service outside the proxy cluster.
+    external: $addArgumentDescription48(z61.boolean().default(false), `Whether to expose the shared consumer Service outside the proxy cluster.
 
  The Service type is selected automatically from the proxy cluster configuration.`),
-    proxyServiceType: $addArgumentDescription46(serviceTypeSchema2.default("NodePort"), `The Kubernetes type of the control Services used by generated Targets.`),
-    proxyNodePort: $addArgumentDescription46(portSchema2.optional(), `The first fixed NodePort assigned to generated Proxy control Services.
+    proxyServiceType: $addArgumentDescription48(serviceTypeSchema2.default("NodePort"), `The Kubernetes type of the control Services used by generated Targets.`),
+    proxyNodePort: $addArgumentDescription48(portSchema2.optional(), `The first fixed NodePort assigned to generated Proxy control Services.
 
  Replica indexes are added to this value.`),
-    podTemplate: $addArgumentDescription46(podTemplateSchema, `The raw base pod template inherited by generated Proxy and Target pods.`),
-    proxyPodTemplate: $addArgumentDescription46(podTemplateSchema, `The raw pod template merged into generated Proxy pods.`),
-    targetPodTemplate: $addArgumentDescription46(podTemplateSchema, `The raw pod template merged into generated Target pods.`)
+    podTemplate: $addArgumentDescription48(podTemplateSchema, `The raw base pod template inherited by generated Proxy and Target pods.`),
+    proxyPodTemplate: $addArgumentDescription48(podTemplateSchema, `The raw pod template merged into generated Proxy pods.`),
+    targetPodTemplate: $addArgumentDescription48(podTemplateSchema, `The raw pod template merged into generated Target pods.`)
   },
   secrets: {
-    sharedSecret: $addArgumentDescription46(z59.string().optional(), `The shared authentication secret used by every generated Proxy and Target.
+    sharedSecret: $addArgumentDescription48(z61.string().optional(), `The shared authentication secret used by every generated Proxy and Target.
 
  A random key is generated when omitted.`)
   },
   inputs: {
-    proxyK8sCluster: $addInputDescription46(clusterEntity, `The Kubernetes cluster where generated Proxies and the consumer Service are created.`),
-    targetK8sCluster: $addInputDescription46(clusterEntity, `The Kubernetes cluster where generated Targets are created.`),
-    endpoints: $addInputDescription46({
+    proxyK8sCluster: $addInputDescription48(clusterEntity, `The Kubernetes cluster where generated Proxies and the consumer Service are created.`),
+    targetK8sCluster: $addInputDescription48(clusterEntity, `The Kubernetes cluster where generated Targets are created.`),
+    endpoints: $addInputDescription48({
       entity: l4EndpointEntity,
       multiple: true,
       required: false
     }, `The target TCP endpoints reachable from generated Target pods.
 
  The first endpoint is used when the endpoint argument is omitted.`),
-    proxyNamespace: $addInputDescription46({
+    proxyNamespace: $addInputDescription48({
       entity: namespaceEntity2,
       required: false
     }, `The existing Kubernetes namespace where Proxies and the consumer Service are created.`),
-    targetNamespace: $addInputDescription46({
+    targetNamespace: $addInputDescription48({
       entity: namespaceEntity2,
       required: false
     }, `The existing Kubernetes namespace where Targets are created.`)
   },
   outputs: {
-    service: $addInputDescription46(serviceEntity, `The shared consumer Service created in the proxy cluster.`),
-    endpoints: $addInputDescription46({
+    service: $addInputDescription48(serviceEntity, `The shared consumer Service created in the proxy cluster.`),
+    endpoints: $addInputDescription48({
       entity: l4EndpointEntity,
       multiple: true
     }, `The endpoints where consumers can access the multi-cluster tunnel.`)
@@ -5565,49 +5577,49 @@ var tunnelMc = defineUnit58({
 var gateway2 = defineUnit58({
   type: "netaminity.gateway.v1",
   args: {
-    resourceName: $addArgumentDescription46(z59.string().optional(), `The name of the generated Netaminity resources.
+    resourceName: $addArgumentDescription48(z61.string().optional(), `The name of the generated Netaminity resources.
 
  If omitted, the unit name is used.`),
-    proxyNamespace: $addArgumentDescription46(z59.string().optional(), `The name of the Kubernetes namespace to create in the proxy cluster.
+    proxyNamespace: $addArgumentDescription48(z61.string().optional(), `The name of the Kubernetes namespace to create in the proxy cluster.
 
  Ignored when the proxyNamespace input is provided.`),
-    targetNamespace: $addArgumentDescription46(z59.string().optional(), `The name of the Kubernetes namespace to create in the target cluster.
+    targetNamespace: $addArgumentDescription48(z61.string().optional(), `The name of the Kubernetes namespace to create in the target cluster.
 
  Ignored when the targetNamespace input is provided.`),
-    replicas: $addArgumentDescription46(replicasSchema, `The number of Proxy and Target pairs created for the shared tunnel.`),
-    proxyReplicas: $addArgumentDescription46(replicasSchema, `The number of interchangeable proxy pods created for each Proxy resource.`),
-    hostNetwork: $addArgumentDescription46(z59.boolean().default(false), `Whether generated Proxy and Target pods use their node network namespace.`),
-    distributeByNodes: $addArgumentDescription46(z59.boolean().default(true), `Whether generated Proxy and Target pods prefer distribution across Kubernetes nodes.`),
-    targetGatewayPort: $addArgumentDescription46(portSchema2.default(443), `The TLS port exposed by the target-side gateway.`),
-    proxyServiceType: $addArgumentDescription46(serviceTypeSchema2.default("NodePort"), `The Kubernetes type of the control Services used by generated Targets.`),
-    proxyNodePort: $addArgumentDescription46(portSchema2.optional(), `The first fixed NodePort assigned to generated Proxy control Services.
+    replicas: $addArgumentDescription48(replicasSchema, `The number of Proxy and Target pairs created for the shared tunnel.`),
+    proxyReplicas: $addArgumentDescription48(replicasSchema, `The number of interchangeable proxy pods created for each Proxy resource.`),
+    hostNetwork: $addArgumentDescription48(z61.boolean().default(false), `Whether generated Proxy and Target pods use their node network namespace.`),
+    distributeByNodes: $addArgumentDescription48(z61.boolean().default(true), `Whether generated Proxy and Target pods prefer distribution across Kubernetes nodes.`),
+    targetGatewayPort: $addArgumentDescription48(portSchema2.default(443), `The TLS port exposed by the target-side gateway.`),
+    proxyServiceType: $addArgumentDescription48(serviceTypeSchema2.default("NodePort"), `The Kubernetes type of the control Services used by generated Targets.`),
+    proxyNodePort: $addArgumentDescription48(portSchema2.optional(), `The first fixed NodePort assigned to generated Proxy control Services.
 
  Replica indexes are added to this value.`),
-    podTemplate: $addArgumentDescription46(podTemplateSchema, `The raw base pod template inherited by generated Proxy and Target pods.`),
-    proxyPodTemplate: $addArgumentDescription46(podTemplateSchema, `The raw pod template merged into generated Proxy pods.`),
-    targetPodTemplate: $addArgumentDescription46(podTemplateSchema, `The raw pod template merged into generated Target pods.`)
+    podTemplate: $addArgumentDescription48(podTemplateSchema, `The raw base pod template inherited by generated Proxy and Target pods.`),
+    proxyPodTemplate: $addArgumentDescription48(podTemplateSchema, `The raw pod template merged into generated Proxy pods.`),
+    targetPodTemplate: $addArgumentDescription48(podTemplateSchema, `The raw pod template merged into generated Target pods.`)
   },
   secrets: {
-    sharedSecret: $addArgumentDescription46(z59.string().optional(), `The shared authentication secret used by every generated Proxy and Target.
+    sharedSecret: $addArgumentDescription48(z61.string().optional(), `The shared authentication secret used by every generated Proxy and Target.
 
  A random key is generated when omitted.`)
   },
   inputs: {
-    proxyGateway: $addInputDescription46(gatewayEntity, `The public gateway in the proxy cluster.`),
-    targetGateway: $addInputDescription46(gatewayEntity, `The local gateway in the target cluster.`),
-    proxyK8sCluster: $addInputDescription46(clusterEntity, `The operator-ready Kubernetes cluster where Proxy resources are created.`),
-    targetK8sCluster: $addInputDescription46(clusterEntity, `The operator-ready Kubernetes cluster where Target resources are created.`),
-    proxyNamespace: $addInputDescription46({
+    proxyGateway: $addInputDescription48(gatewayEntity, `The public gateway in the proxy cluster.`),
+    targetGateway: $addInputDescription48(gatewayEntity, `The local gateway in the target cluster.`),
+    proxyK8sCluster: $addInputDescription48(clusterEntity, `The operator-ready Kubernetes cluster where Proxy resources are created.`),
+    targetK8sCluster: $addInputDescription48(clusterEntity, `The operator-ready Kubernetes cluster where Target resources are created.`),
+    proxyNamespace: $addInputDescription48({
       entity: namespaceEntity2,
       required: false
     }, `The existing Kubernetes namespace where Proxy resources are created.`),
-    targetNamespace: $addInputDescription46({
+    targetNamespace: $addInputDescription48({
       entity: namespaceEntity2,
       required: false
     }, `The existing Kubernetes namespace where Target resources are created.`)
   },
   outputs: {
-    gateway: $addInputDescription46(gatewayEntity, `The gateway that delegates termination to the target cluster through Netaminity.`)
+    gateway: $addInputDescription48(gatewayEntity, `The gateway that delegates termination to the target cluster through Netaminity.`)
   },
   meta: {
     description: `Wraps proxy-side and target-side gateways with one shared Netaminity tunnel.`,
@@ -5626,15 +5638,15 @@ __export(exports_nixos, {
   inlineModule: () => inlineModule,
   inlineFlake: () => inlineFlake
 });
-import { $addArgumentDescription as $addArgumentDescription47 } from "@highstate/contract";
-import { defineUnit as defineUnit59, z as z60 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription49 } from "@highstate/contract";
+import { defineUnit as defineUnit59, z as z62 } from "@highstate/contract";
 var inlineModule = defineUnit59({
   type: "nixos.inline-module.v1",
   args: {
-    moduleName: $addArgumentDescription47(z60.string().optional(), `The name of the module file.
+    moduleName: $addArgumentDescription49(z62.string().optional(), `The name of the module file.
 
  If not provided, the name will be the name of the unit.`),
-    code: $addArgumentDescription47(z60.string().meta({ language: "nix" }), `The code of the NixOS module.
+    code: $addArgumentDescription49(z62.string().meta({ language: "nix" }), `The code of the NixOS module.
 
  In this code you can reference other modules and files by their names.`)
   },
@@ -5669,10 +5681,10 @@ var inlineModule = defineUnit59({
 var inlineFlake = defineUnit59({
   type: "nixos.inline-flake.v1",
   args: {
-    flakeName: $addArgumentDescription47(z60.string().optional(), `The name of the flake folder.
+    flakeName: $addArgumentDescription49(z62.string().optional(), `The name of the flake folder.
 
  If not provided, the name will be the name of the unit.`),
-    code: $addArgumentDescription47(z60.string().meta({ language: "nix" }), `The code of the \`flake.nix\` file.
+    code: $addArgumentDescription49(z62.string().meta({ language: "nix" }), `The code of the \`flake.nix\` file.
 
  In this code you can reference other flakes, modules, files, and folders by their names.
  The inputs for them will be automatically added to the \`inputs\` attribute of the flake.
@@ -5713,7 +5725,7 @@ var inlineFlake = defineUnit59({
 var system = defineUnit59({
   type: "nixos.system.v1",
   args: {
-    system: z60.string().optional()
+    system: z62.string().optional()
   },
   inputs: {
     server: serverEntity,
@@ -5751,13 +5763,13 @@ __export(exports_proxmox, {
   connection: () => connection8,
   clusterEntity: () => clusterEntity3
 });
-import { $addArgumentDescription as $addArgumentDescription48, $addInputDescription as $addInputDescription48 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription50, $addInputDescription as $addInputDescription50 } from "@highstate/contract";
 import { camelCaseToHumanReadable as __camelCaseToHumanReadable30 } from "@highstate/contract";
 import {
   defineEntity as defineEntity31,
   defineUnit as defineUnit60,
   secretSchema as secretSchema15,
-  z as z61
+  z as z63
 } from "@highstate/contract";
 var clusterEntity3 = defineEntity31({
   type: "proxmox.cluster.v1",
@@ -5767,14 +5779,14 @@ var clusterEntity3 = defineEntity31({
       required: false
     }
   },
-  schema: z61.object({
+  schema: z63.object({
     endpoint: l7EndpointEntity.schema,
-    insecure: z61.boolean().optional(),
-    username: z61.string().optional(),
-    defaultNodeName: z61.string(),
-    defaultDatastoreId: z61.string(),
-    password: secretSchema15(z61.string()).optional(),
-    apiToken: secretSchema15(z61.string()).optional()
+    insecure: z63.boolean().optional(),
+    username: z63.string().optional(),
+    defaultNodeName: z63.string(),
+    defaultDatastoreId: z63.string(),
+    password: secretSchema15(z63.string()).optional(),
+    apiToken: secretSchema15(z63.string()).optional()
   }),
   meta: {
     color: "#e56901"
@@ -5782,8 +5794,8 @@ var clusterEntity3 = defineEntity31({
 });
 var imageEntity = defineEntity31({
   type: "proxmox.image.v1",
-  schema: z61.object({
-    id: z61.string()
+  schema: z63.object({
+    id: z63.string()
   }),
   meta: {
     color: "#e56901"
@@ -5792,30 +5804,30 @@ var imageEntity = defineEntity31({
 var connection8 = defineUnit60({
   type: "proxmox.connection.v1",
   args: {
-    endpoint: $addArgumentDescription48(z61.string(), `The endpoint of the Proxmox API.`),
-    insecure: $addArgumentDescription48(z61.boolean().optional(), `Whether to allow insecure connections to the Proxmox API.`),
-    username: $addArgumentDescription48(z61.string().optional(), `The username to use for the Proxmox API.
+    endpoint: $addArgumentDescription50(z63.string(), `The endpoint of the Proxmox API.`),
+    insecure: $addArgumentDescription50(z63.boolean().optional(), `Whether to allow insecure connections to the Proxmox API.`),
+    username: $addArgumentDescription50(z63.string().optional(), `The username to use for the Proxmox API.
 
  Only required for password token authentication.`),
-    defaultNodeName: $addArgumentDescription48(z61.string().optional(), `The name of the default Proxmox node to use for operations.
+    defaultNodeName: $addArgumentDescription50(z63.string().optional(), `The name of the default Proxmox node to use for operations.
 
  If not specified, the first node in the cluster will be used.`),
-    defaultDatastoreId: $addArgumentDescription48(z61.string().optional(), `The ID of the default Proxmox datastore to use for operations.
+    defaultDatastoreId: $addArgumentDescription50(z63.string().optional(), `The ID of the default Proxmox datastore to use for operations.
 
  If not specified, the first datastore in the cluster will be used.`),
-    ssh: $addArgumentDescription48(argsSchema.prefault({}), `The SSH configuration to use for connecting to the Proxmox nodes.`)
+    ssh: $addArgumentDescription50(argsSchema.prefault({}), `The SSH configuration to use for connecting to the Proxmox nodes.`)
   },
   secrets: {
-    password: $addArgumentDescription48({
-      schema: z61.string().optional(),
+    password: $addArgumentDescription50({
+      schema: z63.string().optional(),
       meta: {
         title: "Proxmox Password"
       }
     }, `The password to use for the Proxmox API.
 
  Requires \`username\` to be set.`),
-    apiToken: $addArgumentDescription48({
-      schema: z61.string().optional(),
+    apiToken: $addArgumentDescription50({
+      schema: z63.string().optional(),
       meta: {
         title: "Proxmox API Token"
       }
@@ -5826,8 +5838,8 @@ var connection8 = defineUnit60({
     ...inputs
   },
   outputs: {
-    proxmoxCluster: $addInputDescription48(clusterEntity3, `The Proxmox cluster.`),
-    server: $addInputDescription48({
+    proxmoxCluster: $addInputDescription50(clusterEntity3, `The Proxmox cluster.`),
+    server: $addInputDescription50({
       entity: serverEntity,
       required: false
     }, `The server representing the Proxmox API endpoint.`)
@@ -5847,22 +5859,22 @@ var connection8 = defineUnit60({
 var image = defineUnit60({
   type: "proxmox.image.v1",
   args: {
-    fileName: $addArgumentDescription48(z61.string().optional(), `The name of the image to upload.
+    fileName: $addArgumentDescription50(z63.string().optional(), `The name of the image to upload.
 
  If not specified, the default name is \`<unitName>-<sha256>.<extension>\`
  or \`<unitName>.<extension>\` if \`sha256\` is not provided.`),
-    url: $addArgumentDescription48(z61.string().optional(), `The URL of the image to upload.`),
-    checksum: $addArgumentDescription48(checksumSchema.optional(), `The checksum of the image file to verify.`),
-    nodeName: $addArgumentDescription48(z61.string().optional(), `The name of the Proxmox node to upload the image to.
+    url: $addArgumentDescription50(z63.string().optional(), `The URL of the image to upload.`),
+    checksum: $addArgumentDescription50(checksumSchema.optional(), `The checksum of the image file to verify.`),
+    nodeName: $addArgumentDescription50(z63.string().optional(), `The name of the Proxmox node to upload the image to.
 
  If not specified, the default node name from the cluster will be used.`),
-    datastoreId: $addArgumentDescription48(z61.string().optional(), `The ID of the Proxmox datastore to upload the image to.
+    datastoreId: $addArgumentDescription50(z63.string().optional(), `The ID of the Proxmox datastore to upload the image to.
 
  If not specified, the default datastore ID from the cluster will be used.`)
   },
   inputs: {
-    proxmoxCluster: $addInputDescription48(clusterEntity3, `The Proxmox cluster to upload the image to.`),
-    file: $addInputDescription48({
+    proxmoxCluster: $addInputDescription50(clusterEntity3, `The Proxmox cluster to upload the image to.`),
+    file: $addInputDescription50({
       entity: fileEntity,
       required: false
     }, `The file to upload as an image.
@@ -5888,7 +5900,7 @@ var image = defineUnit60({
 var existingImage = defineUnit60({
   type: "proxmox.existing-image.v1",
   args: {
-    id: z61.string()
+    id: z63.string()
   },
   inputs: {
     proxmoxCluster: clusterEntity3
@@ -5912,56 +5924,56 @@ var existingImage = defineUnit60({
 var virtualMachine = defineUnit60({
   type: "proxmox.virtual-machine.v1",
   args: {
-    vmName: $addArgumentDescription48(z61.string().optional(), `The name of the virtual machine.
+    vmName: $addArgumentDescription50(z63.string().optional(), `The name of the virtual machine.
 
  If not specified, the unit name will be used.`),
-    nodeName: $addArgumentDescription48(z61.string().optional(), `The name of the node to create the virtual machine on.
+    nodeName: $addArgumentDescription50(z63.string().optional(), `The name of the node to create the virtual machine on.
 
  If not specified, the default node name from the cluster will be used.`),
-    datastoreId: $addArgumentDescription48(z61.string().optional(), `The ID of the Proxmox datastore to create the virtual machine on.
+    datastoreId: $addArgumentDescription50(z63.string().optional(), `The ID of the Proxmox datastore to create the virtual machine on.
 
  If not specified, the default datastore ID from the cluster will be used.`),
-    cpuType: $addArgumentDescription48(z61.string().default("host"), `The type of CPU to use for the virtual machine.
+    cpuType: $addArgumentDescription50(z63.string().default("host"), `The type of CPU to use for the virtual machine.
 
  By default, this is set to "host" which offers the best performance.`),
-    resources: $addArgumentDescription48(z61.object({
-      cores: z61.number().default(1).meta({ title: __camelCaseToHumanReadable30("cores"), description: `The number of CPU cores to allocate to the virtual machine.
+    resources: $addArgumentDescription50(z63.object({
+      cores: z63.number().default(1).meta({ title: __camelCaseToHumanReadable30("cores"), description: `The number of CPU cores to allocate to the virtual machine.
 
  By default, this is set to 1.` }),
-      sockets: z61.number().default(1).meta({ title: __camelCaseToHumanReadable30("sockets"), description: `The number of CPU sockets to allocate to the virtual machine.
+      sockets: z63.number().default(1).meta({ title: __camelCaseToHumanReadable30("sockets"), description: `The number of CPU sockets to allocate to the virtual machine.
 
  By default, this is set to 1.` }),
-      memory: z61.number().default(512).meta({ title: __camelCaseToHumanReadable30("memory"), description: `The amount of dedicated memory to allocate to the virtual machine, in MB.
+      memory: z63.number().default(512).meta({ title: __camelCaseToHumanReadable30("memory"), description: `The amount of dedicated memory to allocate to the virtual machine, in MB.
 
  By default, this is set to 512 MB.` }),
-      diskSize: z61.number().default(8).meta({ title: __camelCaseToHumanReadable30("diskSize"), description: `The size of the disk to create for the virtual machine, in GB.
+      diskSize: z63.number().default(8).meta({ title: __camelCaseToHumanReadable30("diskSize"), description: `The size of the disk to create for the virtual machine, in GB.
 
  By default, this is set to 8 GB.` })
     }).prefault({}), `The resources to allocate to the virtual machine.`),
-    ipv4: $addArgumentDescription48(z61.discriminatedUnion("type", [
-      z61.object({
-        type: z61.literal("dhcp")
+    ipv4: $addArgumentDescription50(z63.discriminatedUnion("type", [
+      z63.object({
+        type: z63.literal("dhcp")
       }),
-      z61.object({
-        type: z61.literal("static"),
-        address: z61.ipv4().meta({ title: __camelCaseToHumanReadable30("address"), description: `The IPv4 address to assign to the virtual machine.` }),
+      z63.object({
+        type: z63.literal("static"),
+        address: z63.ipv4().meta({ title: __camelCaseToHumanReadable30("address"), description: `The IPv4 address to assign to the virtual machine.` }),
         prefix: ipv4PrefixSchema.default(24).meta({ title: __camelCaseToHumanReadable30("prefix"), description: `The CIDR prefix for the IPv4 address.
 
  By default, this is set to 24.` }),
-        gateway: z61.ipv4().optional().meta({ title: __camelCaseToHumanReadable30("gateway"), description: `The IPv4 gateway for the virtual machine.
+        gateway: z63.ipv4().optional().meta({ title: __camelCaseToHumanReadable30("gateway"), description: `The IPv4 gateway for the virtual machine.
 
  If not specified, will be set to the first address in the subnet.` })
       })
     ]).default({ type: "dhcp" }), `The IPv4 address configuration for the virtual machine.`),
-    network: $addArgumentDescription48(z61.object({
+    network: $addArgumentDescription50(z63.object({
       dns: ipv46Schema.array().default([]).meta({ title: __camelCaseToHumanReadable30("dns"), description: `The list of DNS servers to use for the virtual machine.` }),
-      bridge: z61.string().default("vmbr0").meta({ title: __camelCaseToHumanReadable30("bridge"), description: `The name of the network bridge to connect the virtual machine to.
+      bridge: z63.string().default("vmbr0").meta({ title: __camelCaseToHumanReadable30("bridge"), description: `The name of the network bridge to connect the virtual machine to.
 
  By default, this is set to "vmbr0".` })
     }).prefault({}), `The network configuration for the virtual machine.`),
-    ssh: $addArgumentDescription48(vmSshArgs, `The SSH configuration for the virtual machine.`),
-    waitForAgent: $addArgumentDescription48(z61.boolean().default(true), `Whether to wait for the Proxmox agent to be ready before returning.`),
-    vendorData: $addArgumentDescription48(z61.string().optional().meta({ multiline: true }), `The cloud-init vendor data to use for the virtual machine.
+    ssh: $addArgumentDescription50(vmSshArgs, `The SSH configuration for the virtual machine.`),
+    waitForAgent: $addArgumentDescription50(z63.boolean().default(true), `Whether to wait for the Proxmox agent to be ready before returning.`),
+    vendorData: $addArgumentDescription50(z63.string().optional().meta({ multiline: true }), `The cloud-init vendor data to use for the virtual machine.
 
  Will take precedence over the \`vendorData\` input.`)
   },
@@ -5971,7 +5983,7 @@ var virtualMachine = defineUnit60({
   inputs: {
     proxmoxCluster: clusterEntity3,
     image: imageEntity,
-    vendorData: $addInputDescription48({
+    vendorData: $addInputDescription50({
       entity: fileEntity,
       required: false
     }, `The cloud-init vendor data to use for the virtual machine.
@@ -5998,12 +6010,12 @@ var exports_sops = {};
 __export(exports_sops, {
   secrets: () => secrets2
 });
-import { $addArgumentDescription as $addArgumentDescription49 } from "@highstate/contract";
-import { defineUnit as defineUnit61, z as z62 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription51 } from "@highstate/contract";
+import { defineUnit as defineUnit61, z as z64 } from "@highstate/contract";
 var secrets2 = defineUnit61({
   type: "sops.secrets.v1",
   secrets: {
-    data: $addArgumentDescription49(z62.record(z62.string(), z62.unknown()), `The content of the SOPS secrets file.
+    data: $addArgumentDescription51(z64.record(z64.string(), z64.unknown()), `The content of the SOPS secrets file.
 
  Will take precedence over the \`data\` input.`)
   },
@@ -6040,32 +6052,32 @@ __export(exports_talos, {
   clusterEntity: () => clusterEntity4,
   cluster: () => cluster2
 });
-import { $addArgumentDescription as $addArgumentDescription50 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription52 } from "@highstate/contract";
 import {
   defineEntity as defineEntity32,
   defineUnit as defineUnit62,
-  z as z63
+  z as z65
 } from "@highstate/contract";
 var clusterEntity4 = defineEntity32({
   type: "talos.cluster.v1",
-  schema: z63.object({
-    clientConfiguration: z63.string(),
-    machineSecrets: z63.string()
+  schema: z65.object({
+    clientConfiguration: z65.string(),
+    machineSecrets: z65.string()
   }),
   meta: {
     color: "#2d2d2d"
   }
 });
-var cniSchema2 = z63.enum(["none", "cilium", "flannel"]);
-var csiSchema = z63.enum(["none", "local-path-provisioner"]);
+var cniSchema2 = z65.enum(["none", "cilium", "flannel"]);
+var csiSchema = z65.enum(["none", "local-path-provisioner"]);
 var cluster2 = defineUnit62({
   type: "talos.cluster.v1",
   args: {
     ...scheduleOnMastersPolicyArgs,
-    clusterName: $addArgumentDescription50(z63.string().optional(), `The name of the cluster.
+    clusterName: $addArgumentDescription52(z65.string().optional(), `The name of the cluster.
 
  By default, the name of the instance is used.`),
-    cni: $addArgumentDescription50(cniSchema2.default("cilium"), `The CNI plugin to use.
+    cni: $addArgumentDescription52(cniSchema2.default("cilium"), `The CNI plugin to use.
 
  The following options are available:
  - "cilium" (default)
@@ -6073,18 +6085,18 @@ var cluster2 = defineUnit62({
  - "none" (disable CNI, must be installed manually)
 
  The "cilium" CNI plugin is recommended to cover advanced network policies like FQDNs.`),
-    csi: $addArgumentDescription50(csiSchema.default("local-path-provisioner"), `The CSI plugin to use.
+    csi: $addArgumentDescription52(csiSchema.default("local-path-provisioner"), `The CSI plugin to use.
 
  The following options are available:
  - "local-path-provisioner" (default)
  - "none" (disable CSI, must be installed manually if needed)`),
-    sharedConfigPatch: $addArgumentDescription50(z63.record(z63.string(), z63.any()).optional(), `The shared configuration patch.
+    sharedConfigPatch: $addArgumentDescription52(z65.record(z65.string(), z65.any()).optional(), `The shared configuration patch.
  It will be applied to all nodes.`),
-    masterConfigPatch: $addArgumentDescription50(z63.record(z63.string(), z63.any()).optional(), `The master configuration patch.
+    masterConfigPatch: $addArgumentDescription52(z65.record(z65.string(), z65.any()).optional(), `The master configuration patch.
  It will be applied to all master nodes.`),
-    workerConfigPatch: $addArgumentDescription50(z63.record(z63.string(), z63.any()).optional(), `The worker configuration patch.
+    workerConfigPatch: $addArgumentDescription52(z65.record(z65.string(), z65.any()).optional(), `The worker configuration patch.
  It will be applied to all worker nodes.`),
-    enableTunDevicePlugin: $addArgumentDescription50(z63.boolean().default(true), `Whether to enable the Tun device plugin.
+    enableTunDevicePlugin: $addArgumentDescription52(z65.boolean().default(true), `Whether to enable the Tun device plugin.
 
  There is the only option for Talos to get tun device in containers.
 
@@ -6114,12 +6126,12 @@ __export(exports_cloudflare, {
   providerDataSchema: () => providerDataSchema,
   connection: () => connection9
 });
-import { $addArgumentDescription as $addArgumentDescription51 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription53 } from "@highstate/contract";
 import { camelCaseToHumanReadable as __camelCaseToHumanReadable31 } from "@highstate/contract";
-import { defineUnit as defineUnit63, secretSchema as secretSchema16, z as z64 } from "@highstate/contract";
-var providerDataSchema = z64.object({
-  zoneIds: z64.record(z64.string(), z64.string()).meta({ title: __camelCaseToHumanReadable31("zoneIds"), description: `The mapping of zone names to their corresponding Cloudflare zone IDs.` }),
-  apiToken: secretSchema16(z64.string()).meta({ title: __camelCaseToHumanReadable31("apiToken"), description: `The API token for the Cloudflare account.
+import { defineUnit as defineUnit63, secretSchema as secretSchema16, z as z66 } from "@highstate/contract";
+var providerDataSchema = z66.object({
+  zoneIds: z66.record(z66.string(), z66.string()).meta({ title: __camelCaseToHumanReadable31("zoneIds"), description: `The mapping of zone names to their corresponding Cloudflare zone IDs.` }),
+  apiToken: secretSchema16(z66.string()).meta({ title: __camelCaseToHumanReadable31("apiToken"), description: `The API token for the Cloudflare account.
 
  The API key must have permissions to manage DNS records for exactly one zone.
  If multiple zones are specified, the unit will fail.
@@ -6131,7 +6143,7 @@ var providerDataSchema = z64.object({
 var connection9 = defineUnit63({
   type: "cloudflare.connection.v1",
   secrets: {
-    apiToken: $addArgumentDescription51(z64.string(), `The API token for the Cloudflare account.
+    apiToken: $addArgumentDescription53(z66.string(), `The API token for the Cloudflare account.
 
  The API key must have permissions to manage DNS records for exactly one zone.
  If multiple zones are specified, the unit will fail.
@@ -6168,22 +6180,22 @@ __export(exports_gcp, {
   connectionEntity: () => connectionEntity11,
   connection: () => connection10
 });
-import { $addArgumentDescription as $addArgumentDescription52, $addInputDescription as $addInputDescription52 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription54, $addInputDescription as $addInputDescription54 } from "@highstate/contract";
 import { camelCaseToHumanReadable as __camelCaseToHumanReadable32 } from "@highstate/contract";
 import {
   $args as $args8,
   defineEntity as defineEntity33,
   defineUnit as defineUnit64,
   secretSchema as secretSchema17,
-  z as z65
+  z as z67
 } from "@highstate/contract";
 var connectionEntity11 = defineEntity33({
   type: "gcp.connection.v1",
-  schema: z65.object({
-    serviceAccountKeyJson: secretSchema17(z65.string()).meta({ title: __camelCaseToHumanReadable32("serviceAccountKeyJson"), description: `The service account JSON key used for authentication.` }),
-    projectId: z65.string().meta({ title: __camelCaseToHumanReadable32("projectId"), description: `The ID of the Google Cloud project.` }),
-    defaultRegion: z65.string().meta({ title: __camelCaseToHumanReadable32("defaultRegion"), description: `The default region.` }),
-    defaultZone: z65.string().optional().meta({ title: __camelCaseToHumanReadable32("defaultZone"), description: `The default availability zone.` })
+  schema: z67.object({
+    serviceAccountKeyJson: secretSchema17(z67.string()).meta({ title: __camelCaseToHumanReadable32("serviceAccountKeyJson"), description: `The service account JSON key used for authentication.` }),
+    projectId: z67.string().meta({ title: __camelCaseToHumanReadable32("projectId"), description: `The ID of the Google Cloud project.` }),
+    defaultRegion: z67.string().meta({ title: __camelCaseToHumanReadable32("defaultRegion"), description: `The default region.` }),
+    defaultZone: z67.string().optional().meta({ title: __camelCaseToHumanReadable32("defaultZone"), description: `The default availability zone.` })
   }),
   meta: {
     color: "#4285F4",
@@ -6195,16 +6207,16 @@ var connectionEntity11 = defineEntity33({
 var connection10 = defineUnit64({
   type: "gcp.connection.v1",
   args: {
-    region: $addArgumentDescription52(z65.object({
-      id: z65.string().default("us-central1").meta({ title: __camelCaseToHumanReadable32("id"), description: `The ID of the region.` }),
-      defaultZone: z65.string().optional().meta({ title: __camelCaseToHumanReadable32("defaultZone"), description: `The default availability zone in the selected region.
+    region: $addArgumentDescription54(z67.object({
+      id: z67.string().default("us-central1").meta({ title: __camelCaseToHumanReadable32("id"), description: `The ID of the region.` }),
+      defaultZone: z67.string().optional().meta({ title: __camelCaseToHumanReadable32("defaultZone"), description: `The default availability zone in the selected region.
 
  If not specified, an available zone in the region will be selected automatically.` })
     }).prefault({}), `The region to create connection for.`)
   },
   secrets: {
-    serviceAccountKeyJson: $addArgumentDescription52({
-      schema: z65.string().meta({ language: "json" }),
+    serviceAccountKeyJson: $addArgumentDescription54({
+      schema: z67.string().meta({ language: "json" }),
       meta: {
         title: "Service Account Key JSON"
       }
@@ -6214,7 +6226,7 @@ var connection10 = defineUnit64({
     ...inputs
   },
   outputs: {
-    connection: $addInputDescription52(connectionEntity11, `The Google Cloud connection.`)
+    connection: $addInputDescription54(connectionEntity11, `The Google Cloud connection.`)
   },
   meta: {
     description: `The connection to a Google Cloud account.`,
@@ -6228,15 +6240,15 @@ var connection10 = defineUnit64({
     path: "connection"
   }
 });
-var diskSchema = z65.object({
-  type: z65.enum(["pd-standard", "pd-balanced", "pd-ssd", "pd-extreme"]).default("pd-balanced").meta({ title: __camelCaseToHumanReadable32("type"), description: `The disk type.` }),
-  size: z65.number().default(20).meta({ title: __camelCaseToHumanReadable32("size"), description: `The disk size in GB.` }),
-  encrypted: z65.boolean().default(false).meta({ title: __camelCaseToHumanReadable32("encrypted"), description: `Whether the disk should be encrypted with a separate KMS key.` })
+var diskSchema = z67.object({
+  type: z67.enum(["pd-standard", "pd-balanced", "pd-ssd", "pd-extreme"]).default("pd-balanced").meta({ title: __camelCaseToHumanReadable32("type"), description: `The disk type.` }),
+  size: z67.number().default(20).meta({ title: __camelCaseToHumanReadable32("size"), description: `The disk size in GB.` }),
+  encrypted: z67.boolean().default(false).meta({ title: __camelCaseToHumanReadable32("encrypted"), description: `Whether the disk should be encrypted with a separate KMS key.` })
 });
 var diskEntity = defineEntity33({
   type: "gcp.disk.v1",
-  schema: z65.object({
-    id: z65.string().meta({ title: __camelCaseToHumanReadable32("id"), description: `The global ID of the disk.` })
+  schema: z67.object({
+    id: z67.string().meta({ title: __camelCaseToHumanReadable32("id"), description: `The global ID of the disk.` })
   }),
   meta: {
     title: "GCP Disk",
@@ -6248,7 +6260,7 @@ var diskEntity = defineEntity33({
 var disk = defineUnit64({
   type: "gcp.disk.v1",
   args: {
-    diskName: $addArgumentDescription52(z65.string().optional(), `The name of the disk in the project.
+    diskName: $addArgumentDescription54(z67.string().optional(), `The name of the disk in the project.
  If not specified, the name of the unit will be used.`),
     ...diskSchema.shape
   },
@@ -6256,7 +6268,7 @@ var disk = defineUnit64({
     connection: connectionEntity11
   },
   outputs: {
-    disk: $addInputDescription52(diskEntity, `The disk entity.`)
+    disk: $addInputDescription54(diskEntity, `The disk entity.`)
   },
   meta: {
     description: `The disk on Google Cloud.`,
@@ -6273,8 +6285,8 @@ var disk = defineUnit64({
 });
 var imageEntity2 = defineEntity33({
   type: "gcp.image.v1",
-  schema: z65.object({
-    id: z65.string().meta({ title: __camelCaseToHumanReadable32("id"), description: `The global ID of the image.` })
+  schema: z67.object({
+    id: z67.string().meta({ title: __camelCaseToHumanReadable32("id"), description: `The global ID of the image.` })
   }),
   meta: {
     title: "GCP Image",
@@ -6286,7 +6298,7 @@ var imageEntity2 = defineEntity33({
 var existingImage2 = defineUnit64({
   type: "gcp.existing-image.v1",
   args: {
-    id: $addArgumentDescription52(z65.string(), `The ID or self-link of the image.
+    id: $addArgumentDescription54(z67.string(), `The ID or self-link of the image.
 
  See [Compute Engine public images](https://cloud.google.com/compute/docs/images/os-details)
  and [Google Cloud Marketplace](https://console.cloud.google.com/marketplace)
@@ -6296,7 +6308,7 @@ var existingImage2 = defineUnit64({
     connection: connectionEntity11
   },
   outputs: {
-    image: $addInputDescription52(imageEntity2, `The image entity.`)
+    image: $addInputDescription54(imageEntity2, `The image entity.`)
   },
   meta: {
     description: `The existing image from Google Cloud public images or custom images.`,
@@ -6312,27 +6324,27 @@ var existingImage2 = defineUnit64({
   }
 });
 var vmArgs = $args8({
-  machineType: $addArgumentDescription52(z65.string().default("e2-standard-2"), `The machine type for the instance.`),
-  bootDisk: $addArgumentDescription52(diskSchema.prefault({}), `The boot disk configuration.`),
-  network: $addArgumentDescription52(z65.object({
-    subnetworkId: z65.string().optional().meta({ title: __camelCaseToHumanReadable32("subnetworkId"), description: `The subnetwork self-link to connect to.
+  machineType: $addArgumentDescription54(z67.string().default("e2-standard-2"), `The machine type for the instance.`),
+  bootDisk: $addArgumentDescription54(diskSchema.prefault({}), `The boot disk configuration.`),
+  network: $addArgumentDescription54(z67.object({
+    subnetworkId: z67.string().optional().meta({ title: __camelCaseToHumanReadable32("subnetworkId"), description: `The subnetwork self-link to connect to.
  If not specified, will auto-discover the default subnet for the zone.` }),
-    assignPublicIp: z65.boolean().default(true).meta({ title: __camelCaseToHumanReadable32("assignPublicIp"), description: `Whether to assign a public IP.` }),
-    reservePublicIp: z65.boolean().default(true).meta({ title: __camelCaseToHumanReadable32("reservePublicIp"), description: `Whether to reserve the public IP permanently.` })
+    assignPublicIp: z67.boolean().default(true).meta({ title: __camelCaseToHumanReadable32("assignPublicIp"), description: `Whether to assign a public IP.` }),
+    reservePublicIp: z67.boolean().default(true).meta({ title: __camelCaseToHumanReadable32("reservePublicIp"), description: `Whether to reserve the public IP permanently.` })
   }).prefault({}), `The network configuration.`),
-  ssh: $addArgumentDescription52(vmSshArgs, `The SSH configuration.`),
-  preemptible: $addArgumentDescription52(z65.boolean().default(false), `Whether the virtual machine is preemptible.`)
+  ssh: $addArgumentDescription54(vmSshArgs, `The SSH configuration.`),
+  preemptible: $addArgumentDescription54(z67.boolean().default(false), `Whether the virtual machine is preemptible.`)
 });
 var virtualMachine2 = defineUnit64({
   type: "gcp.virtual-machine.v1",
   args: {
-    vmName: $addArgumentDescription52(z65.string().optional(), `The name of the virtual machine.
+    vmName: $addArgumentDescription54(z67.string().optional(), `The name of the virtual machine.
  If not specified, the name of the unit will be used.`),
-    projectId: $addArgumentDescription52(z65.string().optional(), `The ID of the project to create the VM in.
+    projectId: $addArgumentDescription54(z67.string().optional(), `The ID of the project to create the VM in.
  If not specified, will use the project from the connection.`),
-    region: $addArgumentDescription52(z65.string().optional(), `The region to create the VM in.
+    region: $addArgumentDescription54(z67.string().optional(), `The region to create the VM in.
  If not specified, will use the region from the connection.`),
-    zone: $addArgumentDescription52(z65.string().optional(), `The zone to create the VM in.
+    zone: $addArgumentDescription54(z67.string().optional(), `The zone to create the VM in.
  If not specified, will use the default zone from the connection.`),
     ...vmArgs
   },
@@ -6361,15 +6373,15 @@ var virtualMachine2 = defineUnit64({
 var instanceGroup = defineUnit64({
   type: "gcp.instance-group.v1",
   args: {
-    groupName: $addArgumentDescription52(z65.string().optional(), `The name of the instance group.
+    groupName: $addArgumentDescription54(z67.string().optional(), `The name of the instance group.
  If not specified, the name of the unit will be used.`),
-    projectId: $addArgumentDescription52(z65.string().optional(), `The ID of the project to create the instance group in.
+    projectId: $addArgumentDescription54(z67.string().optional(), `The ID of the project to create the instance group in.
  If not specified, will use the project from the connection.`),
-    region: $addArgumentDescription52(z65.string().optional(), `The region to create the instance group in.
+    region: $addArgumentDescription54(z67.string().optional(), `The region to create the instance group in.
  If not specified, will use the region from the connection.`),
-    zone: $addArgumentDescription52(z65.string().optional(), `The zone to create the instance group in.
+    zone: $addArgumentDescription54(z67.string().optional(), `The zone to create the instance group in.
  If not specified, will use the default zone from the connection.`),
-    size: $addArgumentDescription52(z65.number().default(1), `The number of instances to create in the group.`),
+    size: $addArgumentDescription54(z67.number().default(1), `The number of instances to create in the group.`),
     ...vmArgs
   },
   secrets: {
@@ -6404,8 +6416,8 @@ var exports_mullvad = {};
 __export(exports_mullvad, {
   peer: () => peer2
 });
-import { $addArgumentDescription as $addArgumentDescription54, $addInputDescription as $addInputDescription54 } from "@highstate/contract";
-import { defineUnit as defineUnit66, z as z67 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription56, $addInputDescription as $addInputDescription56 } from "@highstate/contract";
+import { defineUnit as defineUnit66, z as z69 } from "@highstate/contract";
 
 // src/wireguard.ts
 var exports_wireguard = {};
@@ -6435,7 +6447,7 @@ __export(exports_wireguard, {
   backendSchema: () => backendSchema,
   amneziaParametersSchema: () => amneziaParametersSchema
 });
-import { $addArgumentDescription as $addArgumentDescription53, $addInputDescription as $addInputDescription53 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription55, $addInputDescription as $addInputDescription55 } from "@highstate/contract";
 import { camelCaseToHumanReadable as __camelCaseToHumanReadable33 } from "@highstate/contract";
 import {
   $args as $args9,
@@ -6445,47 +6457,47 @@ import {
   defineUnit as defineUnit65,
   genericNameSchema as genericNameSchema2,
   secretSchema as secretSchema18,
-  z as z66
+  z as z68
 } from "@highstate/contract";
 import { pick as pick29 } from "remeda";
-var backendSchema = z66.enum(["wireguard", "amneziawg"]);
-var amneziaParametersSchema = z66.object({
-  i1: z66.string().optional(),
-  i2: z66.string().optional(),
-  i3: z66.string().optional(),
-  i4: z66.string().optional(),
-  i5: z66.string().optional(),
-  s1: z66.number().optional(),
-  s2: z66.number().optional(),
-  s3: z66.number().optional(),
-  s4: z66.number().optional(),
-  jc: z66.number().optional(),
-  jmin: z66.number().optional(),
-  jmax: z66.number().optional(),
-  h1: z66.string().optional(),
-  h2: z66.string().optional(),
-  h3: z66.string().optional(),
-  h4: z66.string().optional()
+var backendSchema = z68.enum(["wireguard", "amneziawg"]);
+var amneziaParametersSchema = z68.object({
+  i1: z68.string().optional(),
+  i2: z68.string().optional(),
+  i3: z68.string().optional(),
+  i4: z68.string().optional(),
+  i5: z68.string().optional(),
+  s1: z68.number().optional(),
+  s2: z68.number().optional(),
+  s3: z68.number().optional(),
+  s4: z68.number().optional(),
+  jc: z68.number().optional(),
+  jmin: z68.number().optional(),
+  jmax: z68.number().optional(),
+  h1: z68.string().optional(),
+  h2: z68.string().optional(),
+  h3: z68.string().optional(),
+  h4: z68.string().optional()
 });
 var networkArgs2 = {
   backend: backendSchema.default("wireguard"),
-  ipv4: z66.boolean().default(true),
-  ipv6: z66.boolean().default(false),
+  ipv4: z68.boolean().default(true),
+  ipv6: z68.boolean().default(false),
   amnezia: amneziaParametersSchema.default({})
 };
 var configSharedArgs = $args9({
-  peerEndpointFilter: $addArgumentDescription53(z66.string().optional().meta({ language: "javascript" }), `The filter to use when selecting endpoints for each peer.
+  peerEndpointFilter: $addArgumentDescription55(z68.string().optional().meta({ language: "javascript" }), `The filter to use when selecting endpoints for each peer.
 
  The first matching endpoint will be used.
 
  If not provided, all endpoints will be considered.`),
-  listen: $addArgumentDescription53(z66.boolean().default(false), `Whether to include the \`ListenPort\` in the generated config.
+  listen: $addArgumentDescription55(z68.boolean().default(false), `Whether to include the \`ListenPort\` in the generated config.
 
  By default, is \`false\` because in most cases the config is used for peers which don't listen for incoming connections.`)
 });
 var networkEntity2 = defineEntity34({
   type: "wireguard.network.v1",
-  schema: z66.object(networkArgs2),
+  schema: z68.object(networkArgs2),
   meta: {
     description: `The entity representing the WireGuard network configuration.
 
@@ -6497,30 +6509,30 @@ var networkEntity2 = defineEntity34({
     secondaryIcon: "mdi:local-area-network-connect"
   }
 });
-var nodeExposePolicySchema = z66.enum(["always", "when-has-endpoint", "never"]);
-var feedDaemonSyncModeSchema = z66.enum(["sse", "polling"]);
-var feedDaemonBackendTypeSchema = z66.enum([
+var nodeExposePolicySchema = z68.enum(["always", "when-has-endpoint", "never"]);
+var feedDaemonSyncModeSchema = z68.enum(["sse", "polling"]);
+var feedDaemonBackendTypeSchema = z68.enum([
   "wg-quick",
   "networkmanager",
   "netns",
   "windows",
   "windows-manager"
 ]);
-var feedDisplayInfoSchema = z66.object({
-  title: z66.string().meta({ title: __camelCaseToHumanReadable33("title"), description: `The display title of the tunnel.` }),
-  description: z66.string().optional().meta({ title: __camelCaseToHumanReadable33("description"), description: `The display description of the tunnel.` }),
-  iconUrl: z66.url().optional().meta({ title: __camelCaseToHumanReadable33("iconUrl"), description: `The display icon URL of the tunnel.
+var feedDisplayInfoSchema = z68.object({
+  title: z68.string().meta({ title: __camelCaseToHumanReadable33("title"), description: `The display title of the tunnel.` }),
+  description: z68.string().optional().meta({ title: __camelCaseToHumanReadable33("description"), description: `The display description of the tunnel.` }),
+  iconUrl: z68.url().optional().meta({ title: __camelCaseToHumanReadable33("iconUrl"), description: `The display icon URL of the tunnel.
 
  Must only be \`data:\` URL with SVG image.` })
 });
-var feedMetadataSchema = z66.object({
-  id: z66.string().meta({ title: __camelCaseToHumanReadable33("id"), description: `The ID of the tunnel in the feed.` }),
+var feedMetadataSchema = z68.object({
+  id: z68.string().meta({ title: __camelCaseToHumanReadable33("id"), description: `The ID of the tunnel in the feed.` }),
   name: genericNameSchema2.meta({ title: __camelCaseToHumanReadable33("name"), description: `The suggested name of the interface for the tunnel.` }),
-  enabled: z66.boolean().default(false).meta({ title: __camelCaseToHumanReadable33("enabled"), description: `Whether the tunnel should be enabled by the client.` }),
-  forced: z66.boolean().default(false).meta({ title: __camelCaseToHumanReadable33("forced"), description: `Whether the tunnel state must be forced by the client.` }),
-  exclusive: z66.boolean().default(false).meta({ title: __camelCaseToHumanReadable33("exclusive"), description: `Whether the tunnel is exclusive and should not be enabled with other tunnels.` }),
+  enabled: z68.boolean().default(false).meta({ title: __camelCaseToHumanReadable33("enabled"), description: `Whether the tunnel should be enabled by the client.` }),
+  forced: z68.boolean().default(false).meta({ title: __camelCaseToHumanReadable33("forced"), description: `Whether the tunnel state must be forced by the client.` }),
+  exclusive: z68.boolean().default(false).meta({ title: __camelCaseToHumanReadable33("exclusive"), description: `Whether the tunnel is exclusive and should not be enabled with other tunnels.` }),
   displayInfo: feedDisplayInfoSchema.meta({ title: __camelCaseToHumanReadable33("displayInfo"), description: `The display information of the tunnel.` }),
-  warningMessage: z66.string().optional().meta({ title: __camelCaseToHumanReadable33("warningMessage"), description: `The warning message to display for the tunnel.` })
+  warningMessage: z68.string().optional().meta({ title: __camelCaseToHumanReadable33("warningMessage"), description: `The warning message to display for the tunnel.` })
 });
 var peerEntity = defineEntity34({
   type: "wireguard.peer.v1",
@@ -6555,23 +6567,23 @@ var peerEntity = defineEntity34({
       required: false
     }
   },
-  schema: z66.object({
+  schema: z68.object({
     name: genericNameSchema2.meta({ title: __camelCaseToHumanReadable33("name"), description: `The name of the WireGuard peer.` }),
-    publicKey: z66.string().meta({ title: __camelCaseToHumanReadable33("publicKey"), description: `The public key of the WireGuard peer.` }),
-    presharedKey: secretSchema18(z66.string()).optional().meta({ title: __camelCaseToHumanReadable33("presharedKey"), description: `The pre-shared key of the WireGuard peer.
+    publicKey: z68.string().meta({ title: __camelCaseToHumanReadable33("publicKey"), description: `The public key of the WireGuard peer.` }),
+    presharedKey: secretSchema18(z68.string()).optional().meta({ title: __camelCaseToHumanReadable33("presharedKey"), description: `The pre-shared key of the WireGuard peer.
 
  If one of two peers has \`presharedKey\` set, the other peer must have \`presharedKey\` set too and they must be equal.
 
  Will be ignored if both peers have \`presharedKeyPart\` set.` }),
-    presharedKeyPart: secretSchema18(z66.string()).optional().meta({ title: __camelCaseToHumanReadable33("presharedKeyPart"), description: `The pre-shared key part of the WireGuard peer.
+    presharedKeyPart: secretSchema18(z68.string()).optional().meta({ title: __camelCaseToHumanReadable33("presharedKeyPart"), description: `The pre-shared key part of the WireGuard peer.
 
  If both peers have \`presharedKeyPart\` set, their \`presharedKey\` will be calculated as sha256 of the two parts.` }),
-    listenPort: z66.number().default(51820).meta({ title: __camelCaseToHumanReadable33("listenPort"), description: `The port where the WireGuard peer is listening.
+    listenPort: z68.number().default(51820).meta({ title: __camelCaseToHumanReadable33("listenPort"), description: `The port where the WireGuard peer is listening.
 
  Will be used:
  1. For implementations if the listen port is not set elsewhere.
  2. To map L3 endpoints to L4 endpoints with this port.` }),
-    persistentKeepalive: z66.number().int().nonnegative().default(0).meta({ title: __camelCaseToHumanReadable33("persistentKeepalive"), description: `The keepalive interval in seconds that will be used by all nodes connecting to this peer.
+    persistentKeepalive: z68.number().int().nonnegative().default(0).meta({ title: __camelCaseToHumanReadable33("persistentKeepalive"), description: `The keepalive interval in seconds that will be used by all nodes connecting to this peer.
 
  If set to 0, keepalive is disabled.` }),
     feedMetadata: feedMetadataSchema.optional().meta({ title: __camelCaseToHumanReadable33("feedMetadata"), description: `The wg-feed metadata of the WireGuard peer.
@@ -6590,8 +6602,8 @@ var identityEntity = defineEntity34({
   includes: {
     peer: peerEntity
   },
-  schema: z66.object({
-    privateKey: secretSchema18(z66.string()).meta({ title: __camelCaseToHumanReadable33("privateKey"), description: `The private key of the WireGuard identity.` })
+  schema: z68.object({
+    privateKey: secretSchema18(z68.string()).meta({ title: __camelCaseToHumanReadable33("privateKey"), description: `The private key of the WireGuard identity.` })
   }),
   meta: {
     color: "#F44336",
@@ -6610,7 +6622,7 @@ var configEntity = defineEntity34({
       multiple: true
     }
   },
-  schema: z66.object({
+  schema: z68.object({
     feedMetadata: feedMetadataSchema.optional().meta({ title: __camelCaseToHumanReadable33("feedMetadata"), description: `The metadata to include in the wg-feed for this config.
 
  Must be provided for the configs uploaded to wg-feed.` })
@@ -6624,14 +6636,14 @@ var configEntity = defineEntity34({
   }
 });
 var feedDaemonArgs = $args9({
-  feedName: $addArgumentDescription53(genericNameSchema2.default("main"), `The label of the feed in the wg-feed daemon config.`),
-  backendName: $addArgumentDescription53(genericNameSchema2.default("default"), `The label of the backend in the wg-feed daemon config.`),
-  backendType: $addArgumentDescription53(feedDaemonBackendTypeSchema.default("wg-quick"), `The backend type used by the wg-feed daemon.`),
-  syncMode: $addArgumentDescription53(feedDaemonSyncModeSchema.default("sse"), `The sync mode used by the wg-feed daemon.`),
-  pollingInterval: $addArgumentDescription53(z66.number().int().nonnegative().default(0), `The polling interval in seconds.
+  feedName: $addArgumentDescription55(genericNameSchema2.default("main"), `The label of the feed in the wg-feed daemon config.`),
+  backendName: $addArgumentDescription55(genericNameSchema2.default("default"), `The label of the backend in the wg-feed daemon config.`),
+  backendType: $addArgumentDescription55(feedDaemonBackendTypeSchema.default("wg-quick"), `The backend type used by the wg-feed daemon.`),
+  syncMode: $addArgumentDescription55(feedDaemonSyncModeSchema.default("sse"), `The sync mode used by the wg-feed daemon.`),
+  pollingInterval: $addArgumentDescription55(z68.number().int().nonnegative().default(0), `The polling interval in seconds.
 
  If set to 0, wg-feed daemon uses the server-provided TTL.`),
-  statePath: $addArgumentDescription53(z66.string().default("/var/lib/wg-feed/state.json"), `The state file path used by the wg-feed daemon.`)
+  statePath: $addArgumentDescription55(z68.string().default("/var/lib/wg-feed/state.json"), `The state file path used by the wg-feed daemon.`)
 });
 var network3 = defineUnit65({
   type: "wireguard.network.v1",
@@ -6652,9 +6664,9 @@ var network3 = defineUnit65({
   }
 });
 var sharedFeedArgs = $args9({
-  feedMetadata: $addArgumentDescription53(z66.discriminatedUnion("provided", [
-    z66.object({
-      provided: z66.literal("yes").meta({ title: __camelCaseToHumanReadable33("provided"), description: `Whether this config is enabled for upload to wg-feed.
+  feedMetadata: $addArgumentDescription55(z68.discriminatedUnion("provided", [
+    z68.object({
+      provided: z68.literal("yes").meta({ title: __camelCaseToHumanReadable33("provided"), description: `Whether this config is enabled for upload to wg-feed.
 
  You must fill the metadata fields.` }),
       ...pick29(feedMetadataSchema.shape, [
@@ -6667,24 +6679,24 @@ var sharedFeedArgs = $args9({
       ]),
       ...feedDisplayInfoSchema.shape
     }),
-    z66.object({
-      provided: z66.literal("no").meta({ title: __camelCaseToHumanReadable33("provided"), description: `Whether this config is enabled for upload to wg-feed.` })
+    z68.object({
+      provided: z68.literal("no").meta({ title: __camelCaseToHumanReadable33("provided"), description: `Whether this config is enabled for upload to wg-feed.` })
     })
   ]).prefault({ provided: "no" }), `The metadata to include in the wg-feed for this config.`)
 });
 var sharedPeerArgs = $args9({
-  peerName: $addArgumentDescription53(z66.string().optional(), `The name of the WireGuard peer.
+  peerName: $addArgumentDescription55(z68.string().optional(), `The name of the WireGuard peer.
 
  If not provided, the peer will be named after the unit.`),
-  addresses: $addArgumentDescription53(z66.string().array().default([]), `The addresses of the WireGuard interface.
+  addresses: $addArgumentDescription55(z68.string().array().default([]), `The addresses of the WireGuard interface.
 
  The address may be any IPv4 or IPv6 address. CIDR notation is also supported.`),
-  exitNode: $addArgumentDescription53(z66.boolean().default(false), `The convenience option to set \`allowedIps\` to \`0.0.0.0/0, ::/0\`.
+  exitNode: $addArgumentDescription55(z68.boolean().default(false), `The convenience option to set \`allowedIps\` to \`0.0.0.0/0, ::/0\`.
 
  Will be merged with the \`allowedIps\` if provided.`),
-  allowedSubnets: $addArgumentDescription53(z66.string().array().default([]), `The list of IP ranges to include in the allowed IPs of the peer.`),
-  excludedSubnets: $addArgumentDescription53(z66.string().array().default([]), `The list of IP ranges to exclude from the tunnel.`),
-  excludePrivateSubnets: $addArgumentDescription53(z66.boolean().default(false), `The convenience option to exclude private IPs from the tunnel.
+  allowedSubnets: $addArgumentDescription55(z68.string().array().default([]), `The list of IP ranges to include in the allowed IPs of the peer.`),
+  excludedSubnets: $addArgumentDescription55(z68.string().array().default([]), `The list of IP ranges to exclude from the tunnel.`),
+  excludePrivateSubnets: $addArgumentDescription55(z68.boolean().default(false), `The convenience option to exclude private IPs from the tunnel.
 
  For IPv4, the private IPs are:
 
@@ -6698,47 +6710,47 @@ var sharedPeerArgs = $args9({
  - \`fe80::/10\`
 
  Will be merged with \`excludedIps\` if provided.`),
-  endpoints: $addArgumentDescription53(z66.string().array().default([]), `The endpoints of the WireGuard peer.`),
-  dns: $addArgumentDescription53(z66.string().array().default([]), `The DNS servers that should be used by the interface connected to the WireGuard peer.
+  endpoints: $addArgumentDescription55(z68.string().array().default([]), `The endpoints of the WireGuard peer.`),
+  dns: $addArgumentDescription55(z68.string().array().default([]), `The DNS servers that should be used by the interface connected to the WireGuard peer.
 
  If multiple peers define DNS servers, the node will merge them into a single list (but this is discouraged).`),
-  includeAddresses: $addArgumentDescription53(z66.boolean().default(true), `The convenience option to include the addresses to the allowed IPs.
+  includeAddresses: $addArgumentDescription55(z68.boolean().default(true), `The convenience option to include the addresses to the allowed IPs.
 
  By default, is \`true\`.`),
-  includeDns: $addArgumentDescription53(z66.boolean().default(true), `The convenience option to include the DNS servers to the allowed IPs.
+  includeDns: $addArgumentDescription55(z68.boolean().default(true), `The convenience option to include the DNS servers to the allowed IPs.
 
  By default, is \`true\`.`),
-  listenPort: $addArgumentDescription53(z66.number().default(51820), `The port to listen on.`),
-  persistentKeepalive: $addArgumentDescription53(z66.number().int().nonnegative().default(0), `The keepalive interval in seconds that will be used by all nodes connecting to this peer.
+  listenPort: $addArgumentDescription55(z68.number().default(51820), `The port to listen on.`),
+  persistentKeepalive: $addArgumentDescription55(z68.number().int().nonnegative().default(0), `The keepalive interval in seconds that will be used by all nodes connecting to this peer.
 
  If set to 0, keepalive is disabled.`),
   ...sharedFeedArgs
 });
 var sharedPeerInputs = $inputs4({
-  network: $addInputDescription53({
+  network: $addInputDescription55({
     entity: networkEntity2,
     required: false
   }, `The network to use for the WireGuard identity.
 
  If not provided, the identity will use default network configuration.`),
-  endpoints: $addInputDescription53({
+  endpoints: $addInputDescription55({
     entity: l3EndpointEntity,
     multiple: true,
     required: false
   }, `The L3/L4 endpoints of the identity.
 
  All L3 endpoints will be adjusted to L4 endpoints with listen port of the identity.`),
-  allowedEndpoints: $addInputDescription53({
+  allowedEndpoints: $addInputDescription55({
     entity: l3EndpointEntity,
     multiple: true,
     required: false
   }, `the endpoints to add to the allowed IPs of the identity.`),
-  allowedSubnets: $addInputDescription53({
+  allowedSubnets: $addInputDescription55({
     entity: subnetEntity,
     multiple: true,
     required: false
   }, `The subnets to add to the allowed IPs of the identity.`),
-  relayedPeers: $addInputDescription53({
+  relayedPeers: $addInputDescription55({
     entity: peerEntity,
     multiple: true,
     required: false
@@ -6751,10 +6763,10 @@ var peer = defineUnit65({
   type: "wireguard.peer.v1",
   args: {
     ...sharedPeerArgs,
-    publicKey: $addArgumentDescription53(z66.string(), `The public key of the WireGuard peer.`)
+    publicKey: $addArgumentDescription55(z68.string(), `The public key of the WireGuard peer.`)
   },
   secrets: {
-    presharedKey: $addArgumentDescription53(z66.string().optional(), `The pre-shared key which should be used for the peer.`)
+    presharedKey: $addArgumentDescription55(z68.string().optional(), `The pre-shared key which should be used for the peer.`)
   },
   inputs: sharedPeerInputs,
   outputs: sharedPeerOutputs,
@@ -6795,10 +6807,10 @@ var identity = defineUnit65({
   type: "wireguard.identity.v1",
   args: sharedPeerArgs,
   secrets: {
-    privateKey: $addArgumentDescription53(z66.string().optional(), `The private key of the WireGuard identity.
+    privateKey: $addArgumentDescription55(z68.string().optional(), `The private key of the WireGuard identity.
 
  If not provided, the key will be generated automatically.`),
-    presharedKeyPart: $addArgumentDescription53(z66.string().optional(), `The part of the pre-shared of the WireGuard identity.
+    presharedKeyPart: $addArgumentDescription55(z68.string().optional(), `The part of the pre-shared of the WireGuard identity.
 
  Will be generated automatically if not provided.`)
   },
@@ -6821,30 +6833,32 @@ var identity = defineUnit65({
 var nodeK8s = defineUnit65({
   type: "wireguard.node.k8s.v1",
   args: {
-    appName: $addArgumentDescription53(z66.string().optional(), `The name of the namespace/deployment/statefulset where the WireGuard node will be deployed.
+    appName: $addArgumentDescription55(z68.string().optional(), `The name of the namespace/deployment/statefulset where the WireGuard node will be deployed.
 
  By default, the name is \`wg-\${identity.name}\`.`),
-    external: $addArgumentDescription53(z66.boolean().default(false), `Whether to expose the WireGuard node to the outside world.`),
-    exposePolicy: $addArgumentDescription53(nodeExposePolicySchema.default("when-has-endpoint"), `The policy to use for exposing the WireGuard node.
+    external: $addArgumentDescription55(z68.boolean().default(false), `Whether to expose the WireGuard node to the outside world.`),
+    nodePort: $addArgumentDescription55(z68.number().int().min(30000).max(32767).optional(), `The NodePort to assign when the node is exposed.`),
+    exposePolicy: $addArgumentDescription55(nodeExposePolicySchema.default("when-has-endpoint"), `The policy to use for exposing the WireGuard node.
 
  - \`always\` - The node will be exposed and the service will be created.
  - \`when-has-endpoint\` - The node will be exposed only if the provided idenity has at least one endpoint.
  - \`never\` - The node will not be exposed and the service will not be created.
 
  * By default, the \`when-has-endpoint\` policy is used.`),
-    containerSpec: $addArgumentDescription53(z66.record(z66.string(), z66.unknown()).optional(), `The extra specification of the container which runs the WireGuard node.
+    listen: $addArgumentDescription55(z68.boolean().default(true), `Whether to include a listen port in the generated WireGuard configuration.`),
+    containerSpec: $addArgumentDescription55(z68.record(z68.string(), z68.unknown()).optional(), `The extra specification of the container which runs the WireGuard node.
 
  Will override any overlapping fields.`),
-    forwardRestrictedSubnets: $addArgumentDescription53(z66.string().array().default([]), `List of CIDR blocks that should be blocked from forwarding through this WireGuard node.
+    forwardRestrictedSubnets: $addArgumentDescription55(z68.string().array().default([]), `List of CIDR blocks that should be blocked from forwarding through this WireGuard node.
 
  This prevents other peers from reaching these destination CIDRs while still allowing
  the peers in those CIDRs to access the internet and other allowed endpoints.
 
  Useful for peer isolation where you want to prevent cross-peer communication.`),
-    allowClusterPods: $addArgumentDescription53(z66.boolean().default(false), `Whether to allow traffic to all pods inside the cluster from the WireGuard node.
+    allowClusterPods: $addArgumentDescription55(z68.boolean().default(false), `Whether to allow traffic to all pods inside the cluster from the WireGuard node.
 
  By default, is false.`),
-    lockdownUpstream: $addArgumentDescription53(z66.boolean().default(false), `Whether to drop all traffic from the interface using ip rule with priority 100.
+    lockdownUpstream: $addArgumentDescription55(z68.boolean().default(false), `Whether to drop all traffic from the interface using ip rule with priority 100.
 
  This is useful for preventing the traffic leaks before upstream node is attached via \`downstreamInterface\` input.
  They will add their own ip rule with <100 priority which allows traffic from the interface.`)
@@ -6904,32 +6918,32 @@ var nodeK8s = defineUnit65({
 var nodeFeedK8s = defineUnit65({
   type: "wireguard.node.feed.k8s.v1",
   args: {
-    appName: $addArgumentDescription53(z66.string().optional(), `The name of the namespace/deployment/statefulset where the daemon will be deployed.
+    appName: $addArgumentDescription55(z68.string().optional(), `The name of the namespace/deployment/statefulset where the daemon will be deployed.
 
  By default, the name is \`wg-\${identity.name}\`.`),
-    external: $addArgumentDescription53(z66.boolean().default(false), `Whether to expose the WireGuard node to the outside world.`),
-    expose: $addArgumentDescription53(z66.boolean().default(false), `Whether to create a Service and allow ingress.`),
-    listenPort: $addArgumentDescription53(z66.number().default(51820), `The UDP port that will be exposed by the Service.
+    external: $addArgumentDescription55(z68.boolean().default(false), `Whether to expose the WireGuard node to the outside world.`),
+    expose: $addArgumentDescription55(z68.boolean().default(false), `Whether to create a Service and allow ingress.`),
+    listenPort: $addArgumentDescription55(z68.number().default(51820), `The UDP port that will be exposed by the Service.
 
  This is required for consumers that need to know the port ahead of time.`),
-    nodePort: $addArgumentDescription53(z66.number().int().min(30000).max(32767).optional(), `The NodePort to assign when the node is exposed.`),
-    interfaceName: $addArgumentDescription53(z66.string().default("wg0"), `The name of the WireGuard interface to export as \`interface\` output.
+    nodePort: $addArgumentDescription55(z68.number().int().min(30000).max(32767).optional(), `The NodePort to assign when the node is exposed.`),
+    interfaceName: $addArgumentDescription55(z68.string().default("wg0"), `The name of the WireGuard interface to export as \`interface\` output.
 
  Note: wg-feed may manage multiple tunnels.
  This output is a convenience handle for downstream units.`),
     ...feedDaemonArgs,
-    enabledTunnels: $addArgumentDescription53(z66.string().array().default([]), `The wg-feed tunnel IDs to force-enable in the daemon config.`),
-    forwardRestrictedSubnets: $addArgumentDescription53(z66.string().array().default([]), `List of CIDR blocks that should be blocked from forwarding through this WireGuard node.
+    enabledTunnels: $addArgumentDescription55(z68.string().array().default([]), `The wg-feed tunnel IDs to force-enable in the daemon config.`),
+    forwardRestrictedSubnets: $addArgumentDescription55(z68.string().array().default([]), `List of CIDR blocks that should be blocked from forwarding through this WireGuard node.
 
  This prevents other peers from reaching these destination CIDRs while still allowing
  the peers in those CIDRs to access the internet and other allowed endpoints.
 
  Useful for peer isolation where you want to prevent cross-peer communication.`),
-    lockdownUpstream: $addArgumentDescription53(z66.boolean().default(false), `Whether to drop all traffic from the interface using ip rule with priority 100.
+    lockdownUpstream: $addArgumentDescription55(z68.boolean().default(false), `Whether to drop all traffic from the interface using ip rule with priority 100.
 
  This is useful for preventing the traffic leaks before upstream node is attached via \`downstreamInterface\` input.
  They will add their own ip rule with <100 priority which allows traffic from the interface.`),
-    containerSpec: $addArgumentDescription53(z66.record(z66.string(), z66.unknown()).optional(), `The extra specification of the container which runs the wg-feed daemon.
+    containerSpec: $addArgumentDescription55(z68.record(z68.string(), z68.unknown()).optional(), `The extra specification of the container which runs the wg-feed daemon.
 
  Will override any overlapping fields.`)
   },
@@ -6981,27 +6995,27 @@ var nodeFeedK8s = defineUnit65({
 var nodeFeed = defineUnit65({
   type: "wireguard.node.feed.v1",
   args: {
-    serviceName: $addArgumentDescription53(z66.string().optional(), `The name of the wg-feed daemon systemd service.
+    serviceName: $addArgumentDescription55(z68.string().optional(), `The name of the wg-feed daemon systemd service.
 
  By default, the name is \`wg-feed-\${unitName}\`.`),
-    listenPort: $addArgumentDescription53(z66.number().default(51820), `The UDP port that will be exposed by the output peer.`),
-    interfaceName: $addArgumentDescription53(z66.string().default("wg0"), `The name of the WireGuard interface to use for lockdown rules.
+    listenPort: $addArgumentDescription55(z68.number().default(51820), `The UDP port that will be exposed by the output peer.`),
+    interfaceName: $addArgumentDescription55(z68.string().default("wg0"), `The name of the WireGuard interface to use for lockdown rules.
 
  Note: wg-feed may manage multiple tunnels.`),
-    daemonPath: $addArgumentDescription53(z66.string().default("/usr/local/bin/wg-feed-daemon"), `The path where the wg-feed daemon binary should be installed.`),
-    configPath: $addArgumentDescription53(z66.string().default("/etc/wg-feed/config.yaml"), `The path where the wg-feed daemon config should be written.`),
+    daemonPath: $addArgumentDescription55(z68.string().default("/usr/local/bin/wg-feed-daemon"), `The path where the wg-feed daemon binary should be installed.`),
+    configPath: $addArgumentDescription55(z68.string().default("/etc/wg-feed/config.yaml"), `The path where the wg-feed daemon config should be written.`),
     ...feedDaemonArgs,
-    enabledTunnels: $addArgumentDescription53(z66.string().array().default([]), `The wg-feed tunnel IDs to force-enable in the daemon config.`),
-    forwardRestrictedSubnets: $addArgumentDescription53(z66.string().array().default([]), `List of CIDR blocks that should be blocked from forwarding through this WireGuard node.
+    enabledTunnels: $addArgumentDescription55(z68.string().array().default([]), `The wg-feed tunnel IDs to force-enable in the daemon config.`),
+    forwardRestrictedSubnets: $addArgumentDescription55(z68.string().array().default([]), `List of CIDR blocks that should be blocked from forwarding through this WireGuard node.
 
  This prevents other peers from reaching these destination CIDRs while still allowing
  the peers in those CIDRs to access the internet and other allowed endpoints.`),
-    lockdownUpstream: $addArgumentDescription53(z66.boolean().default(false), `Whether to drop all traffic from the interface using ip rule with priority 100.
+    lockdownUpstream: $addArgumentDescription55(z68.boolean().default(false), `Whether to drop all traffic from the interface using ip rule with priority 100.
 
  This is useful for preventing traffic leaks before another routing rule is installed.`)
   },
   secrets: {
-    endpoints: $addArgumentDescription53(z66.string().array().default([]), `The wg-feed setup URLs to configure on the daemon.
+    endpoints: $addArgumentDescription55(z68.string().array().default([]), `The wg-feed setup URLs to configure on the daemon.
 
  This is useful for URLs that include secret fragments such as age keys.`)
   },
@@ -7042,23 +7056,23 @@ var nodeFeed = defineUnit65({
 var node2 = defineUnit65({
   type: "wireguard.node.v1",
   args: {
-    interfaceName: $addArgumentDescription53(z66.string().optional(), `The name of the WireGuard interface.
+    interfaceName: $addArgumentDescription55(z68.string().optional(), `The name of the WireGuard interface.
 
  By default, the name is \`wg-\${identity.name}\` (truncated to 15 characters).`),
-    forwardRestrictedIps: $addArgumentDescription53(z66.string().array().default([]), `List of CIDR blocks that should be blocked from forwarding through this WireGuard node.
+    forwardRestrictedIps: $addArgumentDescription55(z68.string().array().default([]), `List of CIDR blocks that should be blocked from forwarding through this WireGuard node.
 
  This prevents other peers from reaching these destination CIDRs while still allowing
  the peers in those CIDRs to access the internet and other allowed endpoints.
 
  Useful for peer isolation where you want to prevent cross-peer communication.`),
-    enableMasquerade: $addArgumentDescription53(z66.boolean().default(true), `Whether to enable IP masquerading (NAT) for outgoing traffic.
+    enableMasquerade: $addArgumentDescription55(z68.boolean().default(true), `Whether to enable IP masquerading (NAT) for outgoing traffic.
 
  By default, IP masquerading is enabled.`),
     ...configSharedArgs,
-    preUpScript: $addArgumentDescription53(z66.string().optional().meta({ language: "shell" }), `Script to run before bringing up the interface.`),
-    postUpScript: $addArgumentDescription53(z66.string().optional().meta({ language: "shell" }), `Script to run after bringing up the interface.`),
-    preDownScript: $addArgumentDescription53(z66.string().optional().meta({ language: "shell" }), `Script to run before bringing down the interface.`),
-    postDownScript: $addArgumentDescription53(z66.string().optional().meta({ language: "shell" }), `Script to run after bringing down the interface.`)
+    preUpScript: $addArgumentDescription55(z68.string().optional().meta({ language: "shell" }), `Script to run before bringing up the interface.`),
+    postUpScript: $addArgumentDescription55(z68.string().optional().meta({ language: "shell" }), `Script to run after bringing up the interface.`),
+    preDownScript: $addArgumentDescription55(z68.string().optional().meta({ language: "shell" }), `Script to run before bringing down the interface.`),
+    postDownScript: $addArgumentDescription55(z68.string().optional().meta({ language: "shell" }), `Script to run after bringing down the interface.`)
   },
   inputs: {
     identity: {
@@ -7135,7 +7149,7 @@ var config = defineUnit65({
 var existingConfig = defineUnit65({
   type: "wireguard.existing-config.v1",
   args: {
-    config: $addArgumentDescription53(z66.string().meta({ language: "ini" }), `The existing wg-quick or awg-quick configuration content.`)
+    config: $addArgumentDescription55(z68.string().meta({ language: "ini" }), `The existing wg-quick or awg-quick configuration content.`)
   },
   outputs: {
     config: configEntity,
@@ -7202,29 +7216,29 @@ var configBundle = defineUnit65({
 var feed = defineUnit65({
   type: "wireguard.feed.v1",
   args: {
-    ttlSeconds: $addArgumentDescription53(z66.number().int().positive().default(900), `The TTL seconds to suggest to wg-feed clients.
+    ttlSeconds: $addArgumentDescription55(z68.number().int().positive().default(900), `The TTL seconds to suggest to wg-feed clients.
 
  By default, is 900 seconds (15 minutes).`),
-    serverEndpoints: $addArgumentDescription53(z66.string().array().default([]), `The endpoints of the wg-feed servers to use for generating the subscription URLs.
+    serverEndpoints: $addArgumentDescription55(z68.string().array().default([]), `The endpoints of the wg-feed servers to use for generating the subscription URLs.
 
  At least one endpoint must be provided either here or via \`serverEndpoints\` input.
 
  The resulting subscription URL will be inferred as: \`https://{firstEndpoint}/{feedId}#{privateKey}\`.`),
-    publicKey: $addArgumentDescription53(z66.string().optional(), `The AGE public key (x25519 recipient) to encrypt the configs with.
+    publicKey: $addArgumentDescription55(z68.string().optional(), `The AGE public key (x25519 recipient) to encrypt the configs with.
 
  Note: If you provide this, you must provide the corresponding private key to the clients.
  Resulting subscription URL will not contain the private key.`),
-    displayInfo: $addArgumentDescription53(feedDisplayInfoSchema, `The display information of the feed.`),
-    warningMessage: $addArgumentDescription53(z66.string().optional(), `The warning message to display for the feed.`)
+    displayInfo: $addArgumentDescription55(feedDisplayInfoSchema, `The display information of the feed.`),
+    warningMessage: $addArgumentDescription55(z68.string().optional(), `The warning message to display for the feed.`)
   },
   secrets: {
-    feedId: $addArgumentDescription53(z66.string().optional(), `The cuidv2 of the feed.
+    feedId: $addArgumentDescription55(z68.string().optional(), `The cuidv2 of the feed.
  Will be used as path of the feed in etcd/subscription URL.
 
  In most cases, you don't want to provide this and let it be generated automatically.
 
  The \`id\` field of the feed document will be inferred from this value as \`uuidv5(feedId, "2b5e358c-3510-48fb-b1cf-a8aee788925a")\`.`),
-    privateKey: $addArgumentDescription53(z66.string().optional(), `The AGE private key (x25519 identity) to embed in the subscription URL.
+    privateKey: $addArgumentDescription55(z68.string().optional(), `The AGE private key (x25519 identity) to embed in the subscription URL.
 
  If not provided and \`publicKey\` is not provided, a new key pair will be generated.`)
   },
@@ -7261,11 +7275,11 @@ var feed = defineUnit65({
 var peer2 = defineUnit66({
   type: "mullvad.peer.v1",
   args: {
-    hostname: z67.string().optional(),
-    includeDns: $addArgumentDescription54(z67.boolean().default(true), `Whether to include Mullvad DNS servers in the peer configuration.`)
+    hostname: z69.string().optional(),
+    includeDns: $addArgumentDescription56(z69.boolean().default(true), `Whether to include Mullvad DNS servers in the peer configuration.`)
   },
   inputs: {
-    network: $addInputDescription54({
+    network: $addInputDescription56({
       entity: networkEntity2,
       required: false
     }, `The network to use for the WireGuard peer.
@@ -7299,18 +7313,18 @@ __export(exports_timeweb, {
   connectionEntity: () => connectionEntity12,
   connection: () => connection11
 });
-import { $addArgumentDescription as $addArgumentDescription55 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription57 } from "@highstate/contract";
 import {
   defineEntity as defineEntity35,
   defineUnit as defineUnit67,
   secretSchema as secretSchema19,
-  z as z68
+  z as z70
 } from "@highstate/contract";
 var connectionEntity12 = defineEntity35({
   type: "timeweb.connection.v1",
-  schema: z68.object({
-    name: z68.string(),
-    apiToken: secretSchema19(z68.string())
+  schema: z70.object({
+    name: z70.string(),
+    apiToken: secretSchema19(z70.string())
   }),
   meta: {
     color: "#0078FF",
@@ -7322,7 +7336,7 @@ var connectionEntity12 = defineEntity35({
 var connection11 = defineUnit67({
   type: "timeweb.connection.v1",
   secrets: {
-    apiToken: $addArgumentDescription55(z68.string(), `The API token for the Timeweb account.
+    apiToken: $addArgumentDescription57(z70.string(), `The API token for the Timeweb account.
 
  Can be obtained from the Timeweb control panel.`)
   },
@@ -7343,19 +7357,19 @@ var connection11 = defineUnit67({
 var virtualMachine3 = defineUnit67({
   type: "timeweb.virtual-machine.v1",
   args: {
-    vmName: $addArgumentDescription55(z68.string().optional(), `The name of the virtual machine.
+    vmName: $addArgumentDescription57(z70.string().optional(), `The name of the virtual machine.
 
  If not provided, the name of the unit will be used.`),
-    presetId: $addArgumentDescription55(z68.number().optional(), `The ID of the preset to use for the virtual machine.
+    presetId: $addArgumentDescription57(z70.number().optional(), `The ID of the preset to use for the virtual machine.
 
  Can be obtained from the Timeweb control panel when creating a new virtual machine.`),
-    osId: $addArgumentDescription55(z68.number().optional(), `The ID of the operating system to use for the virtual machine.
+    osId: $addArgumentDescription57(z70.number().optional(), `The ID of the operating system to use for the virtual machine.
 
  Can be obtained from the Timeweb control panel when creating a new virtual machine.`),
-    availabilityZone: $addArgumentDescription55(z68.string(), `The ID of the connection to use for the virtual machine.
+    availabilityZone: $addArgumentDescription57(z70.string(), `The ID of the connection to use for the virtual machine.
 
  Can be obtained from the Timeweb control panel when creating a new virtual machine.`),
-    ssh: $addArgumentDescription55(vmSshArgs, `The SSH arguments to use for the virtual machine.`)
+    ssh: $addArgumentDescription57(vmSshArgs, `The SSH arguments to use for the virtual machine.`)
   },
   inputs: {
     connection: connectionEntity12,
@@ -7393,24 +7407,24 @@ __export(exports_yandex, {
   connectionEntity: () => connectionEntity13,
   connection: () => connection12
 });
-import { $addArgumentDescription as $addArgumentDescription56, $addInputDescription as $addInputDescription56 } from "@highstate/contract";
+import { $addArgumentDescription as $addArgumentDescription58, $addInputDescription as $addInputDescription58 } from "@highstate/contract";
 import { camelCaseToHumanReadable as __camelCaseToHumanReadable34 } from "@highstate/contract";
 import {
   $args as $args10,
   defineEntity as defineEntity36,
   defineUnit as defineUnit68,
   secretSchema as secretSchema20,
-  z as z69
+  z as z71
 } from "@highstate/contract";
 var connectionEntity13 = defineEntity36({
   type: "yandex.connection.v1",
-  schema: z69.object({
-    authorizedKeyJson: secretSchema20(z69.string()).meta({ title: __camelCaseToHumanReadable34("authorizedKeyJson"), description: `The JSON of the authorized key for the service account.` }),
-    cloudId: z69.string().meta({ title: __camelCaseToHumanReadable34("cloudId"), description: `The ID of the cloud.` }),
-    defaultFolderId: z69.string().meta({ title: __camelCaseToHumanReadable34("defaultFolderId"), description: `The default folder ID.` }),
-    defaultZone: z69.string().meta({ title: __camelCaseToHumanReadable34("defaultZone"), description: `The default availability zone.` }),
-    regionId: z69.string().optional().meta({ title: __camelCaseToHumanReadable34("regionId"), description: `The region ID.` }),
-    serviceAccountId: z69.string().meta({ title: __camelCaseToHumanReadable34("serviceAccountId"), description: `The ID of the service account used for authentication.` })
+  schema: z71.object({
+    authorizedKeyJson: secretSchema20(z71.string()).meta({ title: __camelCaseToHumanReadable34("authorizedKeyJson"), description: `The JSON of the authorized key for the service account.` }),
+    cloudId: z71.string().meta({ title: __camelCaseToHumanReadable34("cloudId"), description: `The ID of the cloud.` }),
+    defaultFolderId: z71.string().meta({ title: __camelCaseToHumanReadable34("defaultFolderId"), description: `The default folder ID.` }),
+    defaultZone: z71.string().meta({ title: __camelCaseToHumanReadable34("defaultZone"), description: `The default availability zone.` }),
+    regionId: z71.string().optional().meta({ title: __camelCaseToHumanReadable34("regionId"), description: `The region ID.` }),
+    serviceAccountId: z71.string().meta({ title: __camelCaseToHumanReadable34("serviceAccountId"), description: `The ID of the service account used for authentication.` })
   }),
   meta: {
     color: "#0080ff",
@@ -7422,22 +7436,22 @@ var connectionEntity13 = defineEntity36({
 var connection12 = defineUnit68({
   type: "yandex.connection.v1",
   args: {
-    region: $addArgumentDescription56(z69.discriminatedUnion("id", [
-      z69.object({
-        id: z69.literal("ru-central1").meta({ title: __camelCaseToHumanReadable34("id"), description: `The ID of the region.` }),
-        defaultZone: z69.enum(["ru-central1-a", "ru-central1-b", "ru-central1-d", "ru-central1-e"]).default("ru-central1-d").meta({ title: __camelCaseToHumanReadable34("defaultZone"), description: `The default availability zone in ru-central1 to place resources in.` })
+    region: $addArgumentDescription58(z71.discriminatedUnion("id", [
+      z71.object({
+        id: z71.literal("ru-central1").meta({ title: __camelCaseToHumanReadable34("id"), description: `The ID of the region.` }),
+        defaultZone: z71.enum(["ru-central1-a", "ru-central1-b", "ru-central1-d", "ru-central1-e"]).default("ru-central1-d").meta({ title: __camelCaseToHumanReadable34("defaultZone"), description: `The default availability zone in ru-central1 to place resources in.` })
       }),
-      z69.object({
-        id: z69.literal("kz1").meta({ title: __camelCaseToHumanReadable34("id"), description: `The ID of the region.` }),
-        defaultZone: z69.enum(["kz1-a"]).default("kz1-a").meta({ title: __camelCaseToHumanReadable34("defaultZone"), description: `The default availability zone in kz1 to place resources in.` })
+      z71.object({
+        id: z71.literal("kz1").meta({ title: __camelCaseToHumanReadable34("id"), description: `The ID of the region.` }),
+        defaultZone: z71.enum(["kz1-a"]).default("kz1-a").meta({ title: __camelCaseToHumanReadable34("defaultZone"), description: `The default availability zone in kz1 to place resources in.` })
       })
     ]).prefault({ id: "ru-central1" }), `The region to create connection for.
 
  See [Regions](https://yandex.cloud/en/docs/overview/concepts/region) for details.`)
   },
   secrets: {
-    authorizedKeyJson: $addArgumentDescription56({
-      schema: z69.string().meta({ language: "json" }),
+    authorizedKeyJson: $addArgumentDescription58({
+      schema: z71.string().meta({ language: "json" }),
       meta: {
         title: "Authorized Key JSON"
       }
@@ -7451,7 +7465,7 @@ var connection12 = defineUnit68({
     ...inputs
   },
   outputs: {
-    connection: $addInputDescription56(connectionEntity13, `The Yandex Cloud connection.`)
+    connection: $addInputDescription58(connectionEntity13, `The Yandex Cloud connection.`)
   },
   meta: {
     description: `The connection to a Yandex Cloud account.`,
@@ -7465,24 +7479,24 @@ var connection12 = defineUnit68({
     path: "connection"
   }
 });
-var diskSchema2 = z69.object({
-  type: z69.enum(["network-ssd", "network-hdd", "network-ssd-nonreplicated", "network-ssd-io-m3"]).default("network-ssd").meta({ title: __camelCaseToHumanReadable34("type"), description: `The disk type.
+var diskSchema2 = z71.object({
+  type: z71.enum(["network-ssd", "network-hdd", "network-ssd-nonreplicated", "network-ssd-io-m3"]).default("network-ssd").meta({ title: __camelCaseToHumanReadable34("type"), description: `The disk type.
 
  - Network SSD (network-ssd): Fast network drive; SSD network block storage.
  - Network HDD (network-hdd): Standard network drive; HDD network block storage.
  - Non-replicated SSD (network-ssd-nonreplicated): Enhanced performance network drive without redundancy.
  - Ultra high-speed network storage with three replicas (SSD) (network-ssd-io-m3): High-performance SSD offering the same speed as network-ssd-nonreplicated, plus redundancy.` }),
-  size: z69.number().default(20).meta({ title: __camelCaseToHumanReadable34("size"), description: `The disk size in GB.
+  size: z71.number().default(20).meta({ title: __camelCaseToHumanReadable34("size"), description: `The disk size in GB.
 
  For \`network-ssd-nonreplicated\` and \`network-ssd-io-m3\` must be multiple of 93.` }),
-  encrypted: z69.boolean().default(true).meta({ title: __camelCaseToHumanReadable34("encrypted"), description: `Whether the disk should be encrypted by separate key in KMS.
+  encrypted: z71.boolean().default(true).meta({ title: __camelCaseToHumanReadable34("encrypted"), description: `Whether the disk should be encrypted by separate key in KMS.
 
  If \`true\`, a new key will be created for the disk.` })
 });
 var diskEntity2 = defineEntity36({
   type: "yandex.disk.v1",
-  schema: z69.object({
-    id: z69.string().meta({ title: __camelCaseToHumanReadable34("id"), description: `The global ID of the disk.` })
+  schema: z71.object({
+    id: z71.string().meta({ title: __camelCaseToHumanReadable34("id"), description: `The global ID of the disk.` })
   }),
   meta: {
     title: "YC Disk",
@@ -7494,7 +7508,7 @@ var diskEntity2 = defineEntity36({
 var disk2 = defineUnit68({
   type: "yandex.disk.v1",
   args: {
-    diskName: $addArgumentDescription56(z69.string().optional(), `The name of the disk in the folder.
+    diskName: $addArgumentDescription58(z71.string().optional(), `The name of the disk in the folder.
  If not specified, the name of the unit will be used.`),
     ...diskSchema2.shape
   },
@@ -7502,7 +7516,7 @@ var disk2 = defineUnit68({
     connection: connectionEntity13
   },
   outputs: {
-    disk: $addInputDescription56(diskEntity2, `The disk entity.`)
+    disk: $addInputDescription58(diskEntity2, `The disk entity.`)
   },
   meta: {
     description: `The disk on Yandex Cloud.`,
@@ -7519,10 +7533,10 @@ var disk2 = defineUnit68({
 });
 var publicAddressEntity = defineEntity36({
   type: "yandex.public-address.v1",
-  schema: z69.object({
-    id: z69.string().meta({ title: __camelCaseToHumanReadable34("id"), description: `The global ID of the public address.` }),
-    name: z69.string().meta({ title: __camelCaseToHumanReadable34("name"), description: `The name of the public address.` }),
-    address: z69.string().meta({ title: __camelCaseToHumanReadable34("address"), description: `The IPv4 address value.` })
+  schema: z71.object({
+    id: z71.string().meta({ title: __camelCaseToHumanReadable34("id"), description: `The global ID of the public address.` }),
+    name: z71.string().meta({ title: __camelCaseToHumanReadable34("name"), description: `The name of the public address.` }),
+    address: z71.string().meta({ title: __camelCaseToHumanReadable34("address"), description: `The IPv4 address value.` })
   }),
   meta: {
     title: "YC Public Address",
@@ -7534,20 +7548,20 @@ var publicAddressEntity = defineEntity36({
 var publicAddress = defineUnit68({
   type: "yandex.public-address.v1",
   args: {
-    addressName: $addArgumentDescription56(z69.string().optional(), `The name of the public address in the folder.
+    addressName: $addArgumentDescription58(z71.string().optional(), `The name of the public address in the folder.
  If not specified, the name of the unit will be used.`),
-    cloudId: $addArgumentDescription56(z69.string().optional(), `The ID of the cloud to create the public address in.
+    cloudId: $addArgumentDescription58(z71.string().optional(), `The ID of the cloud to create the public address in.
  If not specified, will use the cloud from the connection.`),
-    folderId: $addArgumentDescription56(z69.string().optional(), `The ID of the folder to create the public address in.
+    folderId: $addArgumentDescription58(z71.string().optional(), `The ID of the folder to create the public address in.
  If not specified, will use the default folder from the connection.`),
-    zone: $addArgumentDescription56(z69.string().optional(), `The availability zone to reserve the address in.
+    zone: $addArgumentDescription58(z71.string().optional(), `The availability zone to reserve the address in.
  If not specified, will use the default zone from the connection.`)
   },
   inputs: {
     connection: connectionEntity13
   },
   outputs: {
-    publicAddress: $addInputDescription56(publicAddressEntity, `The public address entity.`)
+    publicAddress: $addInputDescription58(publicAddressEntity, `The public address entity.`)
   },
   meta: {
     description: `The reserved public IPv4 address on Yandex Cloud.`,
@@ -7564,8 +7578,8 @@ var publicAddress = defineUnit68({
 });
 var imageEntity3 = defineEntity36({
   type: "yandex.image.v1",
-  schema: z69.object({
-    id: z69.string().meta({ title: __camelCaseToHumanReadable34("id"), description: `The global ID of the image.` })
+  schema: z71.object({
+    id: z71.string().meta({ title: __camelCaseToHumanReadable34("id"), description: `The global ID of the image.` })
   }),
   meta: {
     title: "YC Image",
@@ -7577,7 +7591,7 @@ var imageEntity3 = defineEntity36({
 var existingImage3 = defineUnit68({
   type: "yandex.existing-image.v1",
   args: {
-    id: $addArgumentDescription56(z69.string(), `The ID of the image.
+    id: $addArgumentDescription58(z71.string(), `The ID of the image.
 
  See [Yandex Cloud Marketplace Images](https://yandex.cloud/en/marketplace) to find available images and their IDs.
  You can also use user images by specifying their IDs.`)
@@ -7586,7 +7600,7 @@ var existingImage3 = defineUnit68({
     connection: connectionEntity13
   },
   outputs: {
-    image: $addInputDescription56(imageEntity3, `The image entity.`)
+    image: $addInputDescription58(imageEntity3, `The image entity.`)
   },
   meta: {
     description: `The existing image from Yandex Cloud Marketplace or user images.`,
@@ -7601,7 +7615,7 @@ var existingImage3 = defineUnit68({
     path: "existing-image"
   }
 });
-var platformIdSchema = z69.enum([
+var platformIdSchema = z71.enum([
   "standard-v1",
   "standard-v2",
   "standard-v3",
@@ -7618,57 +7632,57 @@ var platformIdSchema = z69.enum([
   "gpu-platform-v4"
 ]);
 var vmArgs2 = $args10({
-  platformId: $addArgumentDescription56(platformIdSchema.default("standard-v3"), `The platform ID for the instance.
+  platformId: $addArgumentDescription58(platformIdSchema.default("standard-v3"), `The platform ID for the instance.
 
  See [Platforms](https://yandex.cloud/en/docs/compute/concepts/vm-platforms) for details.`),
-  resources: $addArgumentDescription56(z69.object({
-    cores: z69.number().default(2).meta({ title: __camelCaseToHumanReadable34("cores"), description: `The number of CPU cores.` }),
-    memory: z69.number().default(4).meta({ title: __camelCaseToHumanReadable34("memory"), description: `The amount of memory in GB.` }),
-    coreFraction: z69.number().min(10).max(100).default(100).meta({ title: __camelCaseToHumanReadable34("coreFraction"), description: `The guaranteed CPU core performance (10-100).` })
+  resources: $addArgumentDescription58(z71.object({
+    cores: z71.number().default(2).meta({ title: __camelCaseToHumanReadable34("cores"), description: `The number of CPU cores.` }),
+    memory: z71.number().default(4).meta({ title: __camelCaseToHumanReadable34("memory"), description: `The amount of memory in GB.` }),
+    coreFraction: z71.number().min(10).max(100).default(100).meta({ title: __camelCaseToHumanReadable34("coreFraction"), description: `The guaranteed CPU core performance (10-100).` })
   }).prefault({}), `The resources to allocate to the virtual machine.`),
-  bootDisk: $addArgumentDescription56(diskSchema2.prefault({}), `The boot disk configuration.`),
-  network: $addArgumentDescription56(z69.object({
-    subnetId: z69.string().optional().meta({ title: __camelCaseToHumanReadable34("subnetId"), description: `The subnet ID to connect to.
+  bootDisk: $addArgumentDescription58(diskSchema2.prefault({}), `The boot disk configuration.`),
+  network: $addArgumentDescription58(z71.object({
+    subnetId: z71.string().optional().meta({ title: __camelCaseToHumanReadable34("subnetId"), description: `The subnet ID to connect to.
  If not specified, will auto-discover the default subnet for the zone.` }),
-    assignPublicIp: z69.boolean().default(true).meta({ title: __camelCaseToHumanReadable34("assignPublicIp"), description: `Whether to assign a public IP.` }),
-    reservePublicIp: z69.boolean().default(true).meta({ title: __camelCaseToHumanReadable34("reservePublicIp"), description: `Whether to reserve the public IP permanently.
+    assignPublicIp: z71.boolean().default(true).meta({ title: __camelCaseToHumanReadable34("assignPublicIp"), description: `Whether to assign a public IP.` }),
+    reservePublicIp: z71.boolean().default(true).meta({ title: __camelCaseToHumanReadable34("reservePublicIp"), description: `Whether to reserve the public IP permanently.
 
  If not set, the public IP can be changed when the VM is stopped and started again.
 
  Makes no sense if \`assignPublicIp\` is false.` })
   }).prefault({}), `The network configuration.`),
-  ssh: $addArgumentDescription56(vmSshArgs, `The SSH configuration.`),
-  preemptible: $addArgumentDescription56(z69.boolean().default(false), `Whether the virtual machine is preemptible.
+  ssh: $addArgumentDescription58(vmSshArgs, `The SSH configuration.`),
+  preemptible: $addArgumentDescription58(z71.boolean().default(false), `Whether the virtual machine is preemptible.
 
  See [Preemptible VMs](https://yandex.cloud/en/docs/compute/concepts/preemptible-vms) for details.`)
 });
-var nlbArgs = z69.object({
-  enabled: z69.boolean().default(false).meta({ title: __camelCaseToHumanReadable34("enabled"), description: `Whether to create a network load balancer for the instance group.` }),
-  name: z69.string().optional().meta({ title: __camelCaseToHumanReadable34("name"), description: `The name of the network load balancer.
+var nlbArgs = z71.object({
+  enabled: z71.boolean().default(false).meta({ title: __camelCaseToHumanReadable34("enabled"), description: `Whether to create a network load balancer for the instance group.` }),
+  name: z71.string().optional().meta({ title: __camelCaseToHumanReadable34("name"), description: `The name of the network load balancer.
  If not specified, the instance group name will be used.` }),
-  listeners: z69.string().array().default([]).meta({ title: __camelCaseToHumanReadable34("listeners"), description: `The load-balanced ports to expose through the shared public address.
+  listeners: z71.string().array().default([]).meta({ title: __camelCaseToHumanReadable34("listeners"), description: `The load-balanced ports to expose through the shared public address.
 
  Each listener must use \`protocol:source=>target\` format, for example \`tcp:80=>8080\`.
 
  If the source and target ports are the same, use \`protocol:port\` shorthand, for example \`tcp:80\`.
 
  When SSH is enabled, the \`tcp:<ssh-port>\` listener is included automatically.` }),
-  healthCheckProtocol: z69.enum(["tcp", "http"]).default("tcp").meta({ title: __camelCaseToHumanReadable34("healthCheckProtocol"), description: `The health check protocol.` }),
+  healthCheckProtocol: z71.enum(["tcp", "http"]).default("tcp").meta({ title: __camelCaseToHumanReadable34("healthCheckProtocol"), description: `The health check protocol.` }),
   healthCheckPort: portSchema.default(22).meta({ title: __camelCaseToHumanReadable34("healthCheckPort"), description: `The port to use for health checks.` }),
-  healthCheckPath: z69.string().default("/").meta({ title: __camelCaseToHumanReadable34("healthCheckPath"), description: `The HTTP path to use for health checks.` }),
-  healthCheckInterval: z69.number().int().min(1).max(60).default(2).meta({ title: __camelCaseToHumanReadable34("healthCheckInterval"), description: `The interval between health checks in seconds.` }),
-  healthCheckTimeout: z69.number().int().min(1).max(60).default(1).meta({ title: __camelCaseToHumanReadable34("healthCheckTimeout"), description: `The timeout for health check responses in seconds.` }),
-  healthCheckHealthyThreshold: z69.number().int().default(2).meta({ title: __camelCaseToHumanReadable34("healthCheckHealthyThreshold"), description: `The number of successful checks required to mark a target healthy.` }),
-  healthCheckUnhealthyThreshold: z69.number().int().default(2).meta({ title: __camelCaseToHumanReadable34("healthCheckUnhealthyThreshold"), description: `The number of failed checks required to mark a target unhealthy.` })
+  healthCheckPath: z71.string().default("/").meta({ title: __camelCaseToHumanReadable34("healthCheckPath"), description: `The HTTP path to use for health checks.` }),
+  healthCheckInterval: z71.number().int().min(1).max(60).default(2).meta({ title: __camelCaseToHumanReadable34("healthCheckInterval"), description: `The interval between health checks in seconds.` }),
+  healthCheckTimeout: z71.number().int().min(1).max(60).default(1).meta({ title: __camelCaseToHumanReadable34("healthCheckTimeout"), description: `The timeout for health check responses in seconds.` }),
+  healthCheckHealthyThreshold: z71.number().int().default(2).meta({ title: __camelCaseToHumanReadable34("healthCheckHealthyThreshold"), description: `The number of successful checks required to mark a target healthy.` }),
+  healthCheckUnhealthyThreshold: z71.number().int().default(2).meta({ title: __camelCaseToHumanReadable34("healthCheckUnhealthyThreshold"), description: `The number of failed checks required to mark a target unhealthy.` })
 });
 var virtualMachine4 = defineUnit68({
   type: "yandex.virtual-machine.v1",
   args: {
-    vmName: $addArgumentDescription56(z69.string().optional(), `The name of the virtual machine.
+    vmName: $addArgumentDescription58(z71.string().optional(), `The name of the virtual machine.
  If not specified, the name of the unit will be used.`),
-    cloudId: $addArgumentDescription56(z69.string().optional(), `The ID of the cloud to create the VM in.
+    cloudId: $addArgumentDescription58(z71.string().optional(), `The ID of the cloud to create the VM in.
  If not specified, will use the cloud from the connection.`),
-    folderId: $addArgumentDescription56(z69.string().optional(), `The ID of the folder to create the VM in.
+    folderId: $addArgumentDescription58(z71.string().optional(), `The ID of the folder to create the VM in.
  If not specified, will use the default folder from the connection.`),
     ...vmArgs2
   },
@@ -7678,11 +7692,11 @@ var virtualMachine4 = defineUnit68({
   inputs: {
     connection: connectionEntity13,
     image: imageEntity3,
-    publicAddress: $addInputDescription56({
+    publicAddress: $addInputDescription58({
       entity: publicAddressEntity,
       required: false
     }, `The reserved public address to attach to the virtual machine.`),
-    sshProxyEndpoint: $addInputDescription56({
+    sshProxyEndpoint: $addInputDescription58({
       entity: l4EndpointEntity,
       required: false
     }, `The endpoint of the SSH jump host used to connect to the virtual machine.`),
@@ -7705,16 +7719,16 @@ var virtualMachine4 = defineUnit68({
 var instanceGroup2 = defineUnit68({
   type: "yandex.instance-group.v1",
   args: {
-    groupName: $addArgumentDescription56(z69.string().optional(), `The name of the instance group.
+    groupName: $addArgumentDescription58(z71.string().optional(), `The name of the instance group.
  If not specified, the name of the unit will be used.`),
-    cloudId: $addArgumentDescription56(z69.string().optional(), `The ID of the cloud to create the instance group in.
+    cloudId: $addArgumentDescription58(z71.string().optional(), `The ID of the cloud to create the instance group in.
  If not specified, will use the cloud from the connection.`),
-    folderId: $addArgumentDescription56(z69.string().optional(), `The ID of the folder to create the instance group in.
+    folderId: $addArgumentDescription58(z71.string().optional(), `The ID of the folder to create the instance group in.
  If not specified, will use the default folder from the connection.`),
-    size: $addArgumentDescription56(z69.number().default(1), `The number of instances to create in the group.`),
-    zones: $addArgumentDescription56(z69.string().array().optional(), `The zones to spread instances across.
+    size: $addArgumentDescription58(z71.number().default(1), `The number of instances to create in the group.`),
+    zones: $addArgumentDescription58(z71.string().array().optional(), `The zones to spread instances across.
  If not specified, will use the default zone from the connection.`),
-    nlb: $addArgumentDescription56(nlbArgs.prefault({}), `The network load balancer configuration.`),
+    nlb: $addArgumentDescription58(nlbArgs.prefault({}), `The network load balancer configuration.`),
     ...vmArgs2
   },
   secrets: {
@@ -7723,17 +7737,17 @@ var instanceGroup2 = defineUnit68({
   inputs: {
     connection: connectionEntity13,
     image: imageEntity3,
-    publicAddresses: $addInputDescription56({
+    publicAddresses: $addInputDescription58({
       entity: publicAddressEntity,
       required: false,
       multiple: true
     }, `The public addresses to attach to instances.
  Addresses are sorted by name and assigned to instances in that order.`),
-    nlbPublicAddress: $addInputDescription56({
+    nlbPublicAddress: $addInputDescription58({
       entity: publicAddressEntity,
       required: false
     }, `The reserved public address to use for the network load balancer.`),
-    sshProxyEndpoint: $addInputDescription56({
+    sshProxyEndpoint: $addInputDescription58({
       entity: l4EndpointEntity,
       required: false
     }, `The endpoint of the SSH jump host used to connect to the instances.`),