@rulebricks/cli 2.1.6 → 2.3.1

package/dist/types/index.d.ts

@@ -1,53 +1,37 @@
 import { z } from "zod";
 export type CloudProvider = "aws" | "gcp" | "azure";
 export type DatabaseType = "self-hosted" | "supabase-cloud";
-export type PerformanceTier = "small" | "medium" | "large";
+export type NodeArchitecture = "amd64" | "arm64" | "mixed" | "unknown";
 export type SSOProvider = "azure" | "google" | "okta" | "keycloak" | "ory" | "other";
+export type KafkaPreset = "aws-msk-iam" | "azure-event-hubs" | "gcp-managed" | "custom";
+export type KafkaSaslMechanism = "" | "aws-iam" | "oauthbearer" | "scram-sha-256" | "scram-sha-512" | "plain";
 export type DnsProvider = "route53" | "cloudflare" | "google" | "azure" | "other";
 export declare const SUPPORTED_DNS_PROVIDERS: DnsProvider[];
-export type LoggingSink = "console" | "pending" | "s3" | "azure-blob" | "gcs" | "datadog" | "splunk" | "elasticsearch" | "loki" | "newrelic" | "axiom";
-export type LoggingSinkCategory = "cloud-storage" | "logging-platform";
-export declare const LOGGING_SINK_CATEGORIES: Record<Exclude<LoggingSink, "console" | "pending">, LoggingSinkCategory>;
-export declare const CLOUD_REGIONS: Record<CloudProvider, string[]>;
-export declare const TIER_CONFIGS: Record<PerformanceTier, TierConfig>;
-export interface ResourceSpec {
-    requests: {
-        cpu: string;
-        memory: string;
-    };
-    limits: {
-        cpu: string;
-        memory: string;
-    };
+export type LoggingSink = "console" | "pending" | "datadog" | "splunk" | "elasticsearch" | "loki" | "newrelic" | "axiom";
+export type MonitoringDestination = "local-grafana" | "aws-amp" | "azure-monitor" | "grafana-cloud" | "generic";
+export type RemoteWriteDestination = "aws-amp" | "azure-monitor" | "grafana-cloud" | "generic";
+export type RemoteWriteAuthType = "none" | "managed-identity" | "workload-identity" | "oauth" | "basic" | "bearer";
+export interface SecretKeyRef {
+    name: string;
+    key: string;
 }
-export interface TierConfig {
-    description: string;
-    throughput: string;
-    nodes: {
-        min: number;
-        max: number;
-    };
-    resources: string;
-    hpsReplicas: number;
-    hpsWorkerReplicas: {
-        min: number;
-        max: number;
-    };
-    hpsResources: ResourceSpec;
-    hpsWorkerResources: ResourceSpec;
-    kafkaStorage: string;
-    kafkaReplication: number;
-    kafkaResources: ResourceSpec;
-    kafkaHeapOpts: string;
-    redisResources: ResourceSpec;
-    redisPersistenceSize: string;
-    vectorReplicas: number;
-    vectorResources: ResourceSpec;
-    dbResources: ResourceSpec;
-    dbPersistenceSize: string;
-    appReplicas: number;
-    appResources: ResourceSpec;
+export interface RemoteWriteConfig {
+    destination: RemoteWriteDestination;
+    url: string;
+    authType?: RemoteWriteAuthType;
+    awsRegion?: string;
+    awsRoleArn?: string;
+    azureCloud?: "AzurePublic" | "AzureChina" | "AzureGovernment";
+    clientId?: string;
+    tenantId?: string;
+    clientSecretRef?: SecretKeyRef;
+    usernameSecretRef?: SecretKeyRef;
+    passwordSecretRef?: SecretKeyRef;
+    bearerTokenSecretRef?: SecretKeyRef;
 }
+export type CloudLoggingAuthMode = "workload-identity" | "secret";
+export type ObjectStorageProvider = "s3" | "azure-blob" | "gcs";
+export declare const CLOUD_REGIONS: Record<CloudProvider, string[]>;
 export interface SMTPConfig {
     host: string;
     port: number;
@@ -111,35 +95,353 @@ export interface CustomEmailConfig {
 }
 export declare const DEFAULT_EMAIL_SUBJECTS: EmailSubjects;
 export declare const DNS_PROVIDER_NAMES: Record<DnsProvider, string>;
+export declare const CLOUD_PROVIDER_NAMES: Record<CloudProvider, string>;
 export declare const LOGGING_SINK_INFO: Record<LoggingSink, {
     name: string;
     description: string;
 }>;
-export declare const LOGGING_DESTINATION_LABELS: Record<LoggingSink, string>;
-export declare function getLoggingDestinationLabel(sink: LoggingSink): string;
+/**
+ * Validates a Prometheus remote_write config the same way buildHelmValues and
+ * the Helm chart do, returning human-readable errors. Centralized so the wizard
+ * gate, the Zod schema (load time), and Helm value generation all enforce the
+ * exact same per-destination/auth requirements. This is what prevents the CLI
+ * from ever persisting a monitoring config that throws at deploy time (e.g.
+ * "Azure Monitor remote_write managed identity requires client ID").
+ */
+export declare function validateRemoteWriteConfig(rw: RemoteWriteConfig): string[];
+export type TracingDestination = "elastic" | "otlp" | "azure-monitor";
+declare const TracingConfigSchema: z.ZodEffects<z.ZodObject<{
+    enabled: z.ZodBoolean;
+    destination: z.ZodOptional<z.ZodEnum<["elastic", "otlp", "azure-monitor"]>>;
+    samplingRatio: z.ZodOptional<z.ZodNumber>;
+    elastic: z.ZodOptional<z.ZodObject<{
+        endpoint: z.ZodOptional<z.ZodString>;
+        authMode: z.ZodOptional<z.ZodEnum<["secret-token", "api-key", "none"]>>;
+        secretToken: z.ZodOptional<z.ZodString>;
+        apiKey: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        endpoint?: string | undefined;
+        authMode?: "none" | "secret-token" | "api-key" | undefined;
+        secretToken?: string | undefined;
+        apiKey?: string | undefined;
+    }, {
+        endpoint?: string | undefined;
+        authMode?: "none" | "secret-token" | "api-key" | undefined;
+        secretToken?: string | undefined;
+        apiKey?: string | undefined;
+    }>>;
+    otlp: z.ZodOptional<z.ZodObject<{
+        endpoint: z.ZodOptional<z.ZodString>;
+        authMode: z.ZodOptional<z.ZodEnum<["none", "bearer", "api-key", "header"]>>;
+        headerName: z.ZodOptional<z.ZodString>;
+        token: z.ZodOptional<z.ZodString>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        headerValue: z.ZodOptional<z.ZodString>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        tlsInsecureSkipVerify: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        endpoint?: string | undefined;
+        authMode?: "none" | "bearer" | "api-key" | "header" | undefined;
+        apiKey?: string | undefined;
+        headerName?: string | undefined;
+        token?: string | undefined;
+        headerValue?: string | undefined;
+        headers?: Record<string, string> | undefined;
+        tlsInsecureSkipVerify?: boolean | undefined;
+    }, {
+        endpoint?: string | undefined;
+        authMode?: "none" | "bearer" | "api-key" | "header" | undefined;
+        apiKey?: string | undefined;
+        headerName?: string | undefined;
+        token?: string | undefined;
+        headerValue?: string | undefined;
+        headers?: Record<string, string> | undefined;
+        tlsInsecureSkipVerify?: boolean | undefined;
+    }>>;
+    azureMonitor: z.ZodOptional<z.ZodObject<{
+        connectionString: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        connectionString?: string | undefined;
+    }, {
+        connectionString?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    destination?: "azure-monitor" | "elastic" | "otlp" | undefined;
+    elastic?: {
+        endpoint?: string | undefined;
+        authMode?: "none" | "secret-token" | "api-key" | undefined;
+        secretToken?: string | undefined;
+        apiKey?: string | undefined;
+    } | undefined;
+    otlp?: {
+        endpoint?: string | undefined;
+        authMode?: "none" | "bearer" | "api-key" | "header" | undefined;
+        apiKey?: string | undefined;
+        headerName?: string | undefined;
+        token?: string | undefined;
+        headerValue?: string | undefined;
+        headers?: Record<string, string> | undefined;
+        tlsInsecureSkipVerify?: boolean | undefined;
+    } | undefined;
+    samplingRatio?: number | undefined;
+    azureMonitor?: {
+        connectionString?: string | undefined;
+    } | undefined;
+}, {
+    enabled: boolean;
+    destination?: "azure-monitor" | "elastic" | "otlp" | undefined;
+    elastic?: {
+        endpoint?: string | undefined;
+        authMode?: "none" | "secret-token" | "api-key" | undefined;
+        secretToken?: string | undefined;
+        apiKey?: string | undefined;
+    } | undefined;
+    otlp?: {
+        endpoint?: string | undefined;
+        authMode?: "none" | "bearer" | "api-key" | "header" | undefined;
+        apiKey?: string | undefined;
+        headerName?: string | undefined;
+        token?: string | undefined;
+        headerValue?: string | undefined;
+        headers?: Record<string, string> | undefined;
+        tlsInsecureSkipVerify?: boolean | undefined;
+    } | undefined;
+    samplingRatio?: number | undefined;
+    azureMonitor?: {
+        connectionString?: string | undefined;
+    } | undefined;
+}>, {
+    enabled: boolean;
+    destination?: "azure-monitor" | "elastic" | "otlp" | undefined;
+    elastic?: {
+        endpoint?: string | undefined;
+        authMode?: "none" | "secret-token" | "api-key" | undefined;
+        secretToken?: string | undefined;
+        apiKey?: string | undefined;
+    } | undefined;
+    otlp?: {
+        endpoint?: string | undefined;
+        authMode?: "none" | "bearer" | "api-key" | "header" | undefined;
+        apiKey?: string | undefined;
+        headerName?: string | undefined;
+        token?: string | undefined;
+        headerValue?: string | undefined;
+        headers?: Record<string, string> | undefined;
+        tlsInsecureSkipVerify?: boolean | undefined;
+    } | undefined;
+    samplingRatio?: number | undefined;
+    azureMonitor?: {
+        connectionString?: string | undefined;
+    } | undefined;
+}, {
+    enabled: boolean;
+    destination?: "azure-monitor" | "elastic" | "otlp" | undefined;
+    elastic?: {
+        endpoint?: string | undefined;
+        authMode?: "none" | "secret-token" | "api-key" | undefined;
+        secretToken?: string | undefined;
+        apiKey?: string | undefined;
+    } | undefined;
+    otlp?: {
+        endpoint?: string | undefined;
+        authMode?: "none" | "bearer" | "api-key" | "header" | undefined;
+        apiKey?: string | undefined;
+        headerName?: string | undefined;
+        token?: string | undefined;
+        headerValue?: string | undefined;
+        headers?: Record<string, string> | undefined;
+        tlsInsecureSkipVerify?: boolean | undefined;
+    } | undefined;
+    samplingRatio?: number | undefined;
+    azureMonitor?: {
+        connectionString?: string | undefined;
+    } | undefined;
+}>;
+export type TracingConfig = z.infer<typeof TracingConfigSchema>;
+declare const AppLogsConfigSchema: z.ZodEffects<z.ZodObject<{
+    enabled: z.ZodBoolean;
+    destination: z.ZodOptional<z.ZodEnum<["elasticsearch", "loki", "generic"]>>;
+    elasticsearch: z.ZodOptional<z.ZodObject<{
+        endpoint: z.ZodOptional<z.ZodString>;
+        index: z.ZodOptional<z.ZodString>;
+        authMode: z.ZodOptional<z.ZodEnum<["basic", "api-key", "none"]>>;
+        username: z.ZodOptional<z.ZodString>;
+        password: z.ZodOptional<z.ZodString>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        verifyCertificate: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        endpoint?: string | undefined;
+        authMode?: "none" | "basic" | "api-key" | undefined;
+        apiKey?: string | undefined;
+        index?: string | undefined;
+        username?: string | undefined;
+        password?: string | undefined;
+        verifyCertificate?: boolean | undefined;
+    }, {
+        endpoint?: string | undefined;
+        authMode?: "none" | "basic" | "api-key" | undefined;
+        apiKey?: string | undefined;
+        index?: string | undefined;
+        username?: string | undefined;
+        password?: string | undefined;
+        verifyCertificate?: boolean | undefined;
+    }>>;
+    loki: z.ZodOptional<z.ZodObject<{
+        endpoint: z.ZodOptional<z.ZodString>;
+        labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        endpoint?: string | undefined;
+        labels?: Record<string, string> | undefined;
+    }, {
+        endpoint?: string | undefined;
+        labels?: Record<string, string> | undefined;
+    }>>;
+    generic: z.ZodOptional<z.ZodObject<{
+        endpoint: z.ZodOptional<z.ZodString>;
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        endpoint?: string | undefined;
+        authHeader?: string | undefined;
+    }, {
+        endpoint?: string | undefined;
+        authHeader?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    elasticsearch?: {
+        endpoint?: string | undefined;
+        authMode?: "none" | "basic" | "api-key" | undefined;
+        apiKey?: string | undefined;
+        index?: string | undefined;
+        username?: string | undefined;
+        password?: string | undefined;
+        verifyCertificate?: boolean | undefined;
+    } | undefined;
+    loki?: {
+        endpoint?: string | undefined;
+        labels?: Record<string, string> | undefined;
+    } | undefined;
+    generic?: {
+        endpoint?: string | undefined;
+        authHeader?: string | undefined;
+    } | undefined;
+    destination?: "elasticsearch" | "loki" | "generic" | undefined;
+}, {
+    enabled: boolean;
+    elasticsearch?: {
+        endpoint?: string | undefined;
+        authMode?: "none" | "basic" | "api-key" | undefined;
+        apiKey?: string | undefined;
+        index?: string | undefined;
+        username?: string | undefined;
+        password?: string | undefined;
+        verifyCertificate?: boolean | undefined;
+    } | undefined;
+    loki?: {
+        endpoint?: string | undefined;
+        labels?: Record<string, string> | undefined;
+    } | undefined;
+    generic?: {
+        endpoint?: string | undefined;
+        authHeader?: string | undefined;
+    } | undefined;
+    destination?: "elasticsearch" | "loki" | "generic" | undefined;
+}>, {
+    enabled: boolean;
+    elasticsearch?: {
+        endpoint?: string | undefined;
+        authMode?: "none" | "basic" | "api-key" | undefined;
+        apiKey?: string | undefined;
+        index?: string | undefined;
+        username?: string | undefined;
+        password?: string | undefined;
+        verifyCertificate?: boolean | undefined;
+    } | undefined;
+    loki?: {
+        endpoint?: string | undefined;
+        labels?: Record<string, string> | undefined;
+    } | undefined;
+    generic?: {
+        endpoint?: string | undefined;
+        authHeader?: string | undefined;
+    } | undefined;
+    destination?: "elasticsearch" | "loki" | "generic" | undefined;
+}, {
+    enabled: boolean;
+    elasticsearch?: {
+        endpoint?: string | undefined;
+        authMode?: "none" | "basic" | "api-key" | undefined;
+        apiKey?: string | undefined;
+        index?: string | undefined;
+        username?: string | undefined;
+        password?: string | undefined;
+        verifyCertificate?: boolean | undefined;
+    } | undefined;
+    loki?: {
+        endpoint?: string | undefined;
+        labels?: Record<string, string> | undefined;
+    } | undefined;
+    generic?: {
+        endpoint?: string | undefined;
+        authHeader?: string | undefined;
+    } | undefined;
+    destination?: "elasticsearch" | "loki" | "generic" | undefined;
+}>;
+export type AppLogsConfig = z.infer<typeof AppLogsConfigSchema>;
 export declare const DeploymentConfigSchema: z.ZodObject<{
     name: z.ZodString;
     infrastructure: z.ZodObject<{
-        mode: z.ZodEnum<["existing", "provision"]>;
+        mode: z.ZodLiteral<"existing">;
         provider: z.ZodOptional<z.ZodEnum<["aws", "gcp", "azure"]>>;
         region: z.ZodOptional<z.ZodString>;
         clusterName: z.ZodOptional<z.ZodString>;
         gcpProjectId: z.ZodOptional<z.ZodString>;
         azureResourceGroup: z.ZodOptional<z.ZodString>;
+        nodeArchitecture: z.ZodOptional<z.ZodEnum<["amd64", "arm64", "mixed", "unknown"]>>;
+        arm64TolerationRequired: z.ZodOptional<z.ZodBoolean>;
+        storageClass: z.ZodOptional<z.ZodString>;
+        storageProvisioner: z.ZodOptional<z.ZodString>;
+        schedulableNodeCount: z.ZodOptional<z.ZodNumber>;
+        totalCpuCores: z.ZodOptional<z.ZodNumber>;
+        totalMemoryGi: z.ZodOptional<z.ZodNumber>;
+        eligibleCpuCores: z.ZodOptional<z.ZodNumber>;
+        eligibleMemoryGi: z.ZodOptional<z.ZodNumber>;
+        totalPersistentStorageGi: z.ZodOptional<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
-        mode: "existing" | "provision";
+        mode: "existing";
         provider?: "aws" | "gcp" | "azure" | undefined;
         region?: string | undefined;
         clusterName?: string | undefined;
         gcpProjectId?: string | undefined;
         azureResourceGroup?: string | undefined;
+        nodeArchitecture?: "amd64" | "arm64" | "mixed" | "unknown" | undefined;
+        arm64TolerationRequired?: boolean | undefined;
+        storageClass?: string | undefined;
+        storageProvisioner?: string | undefined;
+        schedulableNodeCount?: number | undefined;
+        totalCpuCores?: number | undefined;
+        totalMemoryGi?: number | undefined;
+        eligibleCpuCores?: number | undefined;
+        eligibleMemoryGi?: number | undefined;
+        totalPersistentStorageGi?: number | undefined;
     }, {
-        mode: "existing" | "provision";
+        mode: "existing";
         provider?: "aws" | "gcp" | "azure" | undefined;
         region?: string | undefined;
         clusterName?: string | undefined;
         gcpProjectId?: string | undefined;
         azureResourceGroup?: string | undefined;
+        nodeArchitecture?: "amd64" | "arm64" | "mixed" | "unknown" | undefined;
+        arm64TolerationRequired?: boolean | undefined;
+        storageClass?: string | undefined;
+        storageProvisioner?: string | undefined;
+        schedulableNodeCount?: number | undefined;
+        totalCpuCores?: number | undefined;
+        totalMemoryGi?: number | undefined;
+        eligibleCpuCores?: number | undefined;
+        eligibleMemoryGi?: number | undefined;
+        totalPersistentStorageGi?: number | undefined;
     }>;
     domain: z.ZodString;
     adminEmail: z.ZodString;
@@ -147,15 +449,12 @@ export declare const DeploymentConfigSchema: z.ZodObject<{
     dns: z.ZodObject<{
         provider: z.ZodEnum<["route53", "cloudflare", "google", "azure", "other"]>;
         autoManage: z.ZodBoolean;
-        existingExternalDns: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
         provider: "azure" | "google" | "other" | "route53" | "cloudflare";
         autoManage: boolean;
-        existingExternalDns?: boolean | undefined;
     }, {
         provider: "azure" | "google" | "other" | "route53" | "cloudflare";
         autoManage: boolean;
-        existingExternalDns?: boolean | undefined;
     }>;
     smtp: z.ZodObject<{
         host: z.ZodString;
@@ -213,7 +512,485 @@ export declare const DeploymentConfigSchema: z.ZodObject<{
         supabaseDashboardUser?: string | undefined;
         supabaseDashboardPass?: string | undefined;
     }>;
-    tier: z.ZodEnum<["small", "medium", "large"]>;
+    storage: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodEnum<["s3", "azure-blob", "gcs"]>;
+        cloudAuthMode: z.ZodOptional<z.ZodEnum<["workload-identity", "secret"]>>;
+        bucket: z.ZodString;
+        region: z.ZodString;
+        awsIamRoleArn: z.ZodOptional<z.ZodString>;
+        azureBlobClientId: z.ZodOptional<z.ZodString>;
+        azureBlobTenantId: z.ZodOptional<z.ZodString>;
+        azureBlobConnectionStringSecretRef: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            key: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            key: string;
+        }, {
+            name: string;
+            key: string;
+        }>>;
+        azureBlobContainer: z.ZodOptional<z.ZodString>;
+        gcpServiceAccountEmail: z.ZodOptional<z.ZodString>;
+        paths: z.ZodOptional<z.ZodObject<{
+            decisionLogs: z.ZodOptional<z.ZodString>;
+            dbBackups: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            decisionLogs?: string | undefined;
+            dbBackups?: string | undefined;
+        }, {
+            decisionLogs?: string | undefined;
+            dbBackups?: string | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        provider: "s3" | "azure-blob" | "gcs";
+        region: string;
+        bucket: string;
+        cloudAuthMode?: "workload-identity" | "secret" | undefined;
+        awsIamRoleArn?: string | undefined;
+        azureBlobClientId?: string | undefined;
+        azureBlobTenantId?: string | undefined;
+        azureBlobConnectionStringSecretRef?: {
+            name: string;
+            key: string;
+        } | undefined;
+        azureBlobContainer?: string | undefined;
+        gcpServiceAccountEmail?: string | undefined;
+        paths?: {
+            decisionLogs?: string | undefined;
+            dbBackups?: string | undefined;
+        } | undefined;
+    }, {
+        provider: "s3" | "azure-blob" | "gcs";
+        region: string;
+        bucket: string;
+        cloudAuthMode?: "workload-identity" | "secret" | undefined;
+        awsIamRoleArn?: string | undefined;
+        azureBlobClientId?: string | undefined;
+        azureBlobTenantId?: string | undefined;
+        azureBlobConnectionStringSecretRef?: {
+            name: string;
+            key: string;
+        } | undefined;
+        azureBlobContainer?: string | undefined;
+        gcpServiceAccountEmail?: string | undefined;
+        paths?: {
+            decisionLogs?: string | undefined;
+            dbBackups?: string | undefined;
+        } | undefined;
+    }>>;
+    externalServices: z.ZodOptional<z.ZodObject<{
+        redis: z.ZodOptional<z.ZodObject<{
+            mode: z.ZodEnum<["embedded", "external"]>;
+            external: z.ZodOptional<z.ZodObject<{
+                host: z.ZodOptional<z.ZodString>;
+                port: z.ZodOptional<z.ZodNumber>;
+                password: z.ZodOptional<z.ZodString>;
+                existingSecret: z.ZodOptional<z.ZodString>;
+                existingSecretKey: z.ZodOptional<z.ZodString>;
+                tls: z.ZodOptional<z.ZodBoolean>;
+                httpApi: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodBoolean;
+                    url: z.ZodOptional<z.ZodString>;
+                    token: z.ZodOptional<z.ZodString>;
+                }, "strip", z.ZodTypeAny, {
+                    enabled: boolean;
+                    url?: string | undefined;
+                    token?: string | undefined;
+                }, {
+                    enabled: boolean;
+                    url?: string | undefined;
+                    token?: string | undefined;
+                }>>;
+            }, "strip", z.ZodTypeAny, {
+                password?: string | undefined;
+                host?: string | undefined;
+                port?: number | undefined;
+                existingSecret?: string | undefined;
+                existingSecretKey?: string | undefined;
+                tls?: boolean | undefined;
+                httpApi?: {
+                    enabled: boolean;
+                    url?: string | undefined;
+                    token?: string | undefined;
+                } | undefined;
+            }, {
+                password?: string | undefined;
+                host?: string | undefined;
+                port?: number | undefined;
+                existingSecret?: string | undefined;
+                existingSecretKey?: string | undefined;
+                tls?: boolean | undefined;
+                httpApi?: {
+                    enabled: boolean;
+                    url?: string | undefined;
+                    token?: string | undefined;
+                } | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            mode: "embedded" | "external";
+            external?: {
+                password?: string | undefined;
+                host?: string | undefined;
+                port?: number | undefined;
+                existingSecret?: string | undefined;
+                existingSecretKey?: string | undefined;
+                tls?: boolean | undefined;
+                httpApi?: {
+                    enabled: boolean;
+                    url?: string | undefined;
+                    token?: string | undefined;
+                } | undefined;
+            } | undefined;
+        }, {
+            mode: "embedded" | "external";
+            external?: {
+                password?: string | undefined;
+                host?: string | undefined;
+                port?: number | undefined;
+                existingSecret?: string | undefined;
+                existingSecretKey?: string | undefined;
+                tls?: boolean | undefined;
+                httpApi?: {
+                    enabled: boolean;
+                    url?: string | undefined;
+                    token?: string | undefined;
+                } | undefined;
+            } | undefined;
+        }>>;
+        kafka: z.ZodOptional<z.ZodObject<{
+            mode: z.ZodEnum<["embedded", "external"]>;
+            external: z.ZodOptional<z.ZodObject<{
+                preset: z.ZodOptional<z.ZodEnum<["aws-msk-iam", "azure-event-hubs", "gcp-managed", "custom"]>>;
+                brokers: z.ZodOptional<z.ZodString>;
+                topic: z.ZodOptional<z.ZodString>;
+                topicPrefix: z.ZodOptional<z.ZodString>;
+                provisionTopics: z.ZodOptional<z.ZodBoolean>;
+                ssl: z.ZodOptional<z.ZodBoolean>;
+                sasl: z.ZodOptional<z.ZodObject<{
+                    mechanism: z.ZodEnum<["", "aws-iam", "oauthbearer", "scram-sha-256", "scram-sha-512", "plain"]>;
+                    region: z.ZodOptional<z.ZodString>;
+                    username: z.ZodOptional<z.ZodString>;
+                    password: z.ZodOptional<z.ZodString>;
+                    existingSecret: z.ZodOptional<z.ZodString>;
+                }, "strip", z.ZodTypeAny, {
+                    mechanism: "" | "aws-iam" | "oauthbearer" | "scram-sha-256" | "scram-sha-512" | "plain";
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    region?: string | undefined;
+                    existingSecret?: string | undefined;
+                }, {
+                    mechanism: "" | "aws-iam" | "oauthbearer" | "scram-sha-256" | "scram-sha-512" | "plain";
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    region?: string | undefined;
+                    existingSecret?: string | undefined;
+                }>>;
+                identity: z.ZodOptional<z.ZodObject<{
+                    awsRoleArn: z.ZodOptional<z.ZodString>;
+                    gcpServiceAccountEmail: z.ZodOptional<z.ZodString>;
+                    azureClientId: z.ZodOptional<z.ZodString>;
+                }, "strip", z.ZodTypeAny, {
+                    awsRoleArn?: string | undefined;
+                    gcpServiceAccountEmail?: string | undefined;
+                    azureClientId?: string | undefined;
+                }, {
+                    awsRoleArn?: string | undefined;
+                    gcpServiceAccountEmail?: string | undefined;
+                    azureClientId?: string | undefined;
+                }>>;
+            }, "strip", z.ZodTypeAny, {
+                preset?: "aws-msk-iam" | "azure-event-hubs" | "gcp-managed" | "custom" | undefined;
+                brokers?: string | undefined;
+                topic?: string | undefined;
+                topicPrefix?: string | undefined;
+                provisionTopics?: boolean | undefined;
+                ssl?: boolean | undefined;
+                sasl?: {
+                    mechanism: "" | "aws-iam" | "oauthbearer" | "scram-sha-256" | "scram-sha-512" | "plain";
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    region?: string | undefined;
+                    existingSecret?: string | undefined;
+                } | undefined;
+                identity?: {
+                    awsRoleArn?: string | undefined;
+                    gcpServiceAccountEmail?: string | undefined;
+                    azureClientId?: string | undefined;
+                } | undefined;
+            }, {
+                preset?: "aws-msk-iam" | "azure-event-hubs" | "gcp-managed" | "custom" | undefined;
+                brokers?: string | undefined;
+                topic?: string | undefined;
+                topicPrefix?: string | undefined;
+                provisionTopics?: boolean | undefined;
+                ssl?: boolean | undefined;
+                sasl?: {
+                    mechanism: "" | "aws-iam" | "oauthbearer" | "scram-sha-256" | "scram-sha-512" | "plain";
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    region?: string | undefined;
+                    existingSecret?: string | undefined;
+                } | undefined;
+                identity?: {
+                    awsRoleArn?: string | undefined;
+                    gcpServiceAccountEmail?: string | undefined;
+                    azureClientId?: string | undefined;
+                } | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            mode: "embedded" | "external";
+            external?: {
+                preset?: "aws-msk-iam" | "azure-event-hubs" | "gcp-managed" | "custom" | undefined;
+                brokers?: string | undefined;
+                topic?: string | undefined;
+                topicPrefix?: string | undefined;
+                provisionTopics?: boolean | undefined;
+                ssl?: boolean | undefined;
+                sasl?: {
+                    mechanism: "" | "aws-iam" | "oauthbearer" | "scram-sha-256" | "scram-sha-512" | "plain";
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    region?: string | undefined;
+                    existingSecret?: string | undefined;
+                } | undefined;
+                identity?: {
+                    awsRoleArn?: string | undefined;
+                    gcpServiceAccountEmail?: string | undefined;
+                    azureClientId?: string | undefined;
+                } | undefined;
+            } | undefined;
+        }, {
+            mode: "embedded" | "external";
+            external?: {
+                preset?: "aws-msk-iam" | "azure-event-hubs" | "gcp-managed" | "custom" | undefined;
+                brokers?: string | undefined;
+                topic?: string | undefined;
+                topicPrefix?: string | undefined;
+                provisionTopics?: boolean | undefined;
+                ssl?: boolean | undefined;
+                sasl?: {
+                    mechanism: "" | "aws-iam" | "oauthbearer" | "scram-sha-256" | "scram-sha-512" | "plain";
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    region?: string | undefined;
+                    existingSecret?: string | undefined;
+                } | undefined;
+                identity?: {
+                    awsRoleArn?: string | undefined;
+                    gcpServiceAccountEmail?: string | undefined;
+                    azureClientId?: string | undefined;
+                } | undefined;
+            } | undefined;
+        }>>;
+        postgres: z.ZodOptional<z.ZodObject<{
+            mode: z.ZodEnum<["embedded", "external"]>;
+            external: z.ZodOptional<z.ZodObject<{
+                provider: z.ZodOptional<z.ZodEnum<["aws", "azure"]>>;
+                host: z.ZodOptional<z.ZodString>;
+                port: z.ZodOptional<z.ZodNumber>;
+                database: z.ZodOptional<z.ZodString>;
+                bootstrap: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodOptional<z.ZodBoolean>;
+                    masterUsername: z.ZodOptional<z.ZodString>;
+                    masterPassword: z.ZodOptional<z.ZodString>;
+                    secretRef: z.ZodOptional<z.ZodString>;
+                    appRole: z.ZodOptional<z.ZodString>;
+                }, "strip", z.ZodTypeAny, {
+                    enabled?: boolean | undefined;
+                    masterUsername?: string | undefined;
+                    masterPassword?: string | undefined;
+                    secretRef?: string | undefined;
+                    appRole?: string | undefined;
+                }, {
+                    enabled?: boolean | undefined;
+                    masterUsername?: string | undefined;
+                    masterPassword?: string | undefined;
+                    secretRef?: string | undefined;
+                    appRole?: string | undefined;
+                }>>;
+            }, "strip", z.ZodTypeAny, {
+                provider?: "aws" | "azure" | undefined;
+                host?: string | undefined;
+                port?: number | undefined;
+                database?: string | undefined;
+                bootstrap?: {
+                    enabled?: boolean | undefined;
+                    masterUsername?: string | undefined;
+                    masterPassword?: string | undefined;
+                    secretRef?: string | undefined;
+                    appRole?: string | undefined;
+                } | undefined;
+            }, {
+                provider?: "aws" | "azure" | undefined;
+                host?: string | undefined;
+                port?: number | undefined;
+                database?: string | undefined;
+                bootstrap?: {
+                    enabled?: boolean | undefined;
+                    masterUsername?: string | undefined;
+                    masterPassword?: string | undefined;
+                    secretRef?: string | undefined;
+                    appRole?: string | undefined;
+                } | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            mode: "embedded" | "external";
+            external?: {
+                provider?: "aws" | "azure" | undefined;
+                host?: string | undefined;
+                port?: number | undefined;
+                database?: string | undefined;
+                bootstrap?: {
+                    enabled?: boolean | undefined;
+                    masterUsername?: string | undefined;
+                    masterPassword?: string | undefined;
+                    secretRef?: string | undefined;
+                    appRole?: string | undefined;
+                } | undefined;
+            } | undefined;
+        }, {
+            mode: "embedded" | "external";
+            external?: {
+                provider?: "aws" | "azure" | undefined;
+                host?: string | undefined;
+                port?: number | undefined;
+                database?: string | undefined;
+                bootstrap?: {
+                    enabled?: boolean | undefined;
+                    masterUsername?: string | undefined;
+                    masterPassword?: string | undefined;
+                    secretRef?: string | undefined;
+                    appRole?: string | undefined;
+                } | undefined;
+            } | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        redis?: {
+            mode: "embedded" | "external";
+            external?: {
+                password?: string | undefined;
+                host?: string | undefined;
+                port?: number | undefined;
+                existingSecret?: string | undefined;
+                existingSecretKey?: string | undefined;
+                tls?: boolean | undefined;
+                httpApi?: {
+                    enabled: boolean;
+                    url?: string | undefined;
+                    token?: string | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+        kafka?: {
+            mode: "embedded" | "external";
+            external?: {
+                preset?: "aws-msk-iam" | "azure-event-hubs" | "gcp-managed" | "custom" | undefined;
+                brokers?: string | undefined;
+                topic?: string | undefined;
+                topicPrefix?: string | undefined;
+                provisionTopics?: boolean | undefined;
+                ssl?: boolean | undefined;
+                sasl?: {
+                    mechanism: "" | "aws-iam" | "oauthbearer" | "scram-sha-256" | "scram-sha-512" | "plain";
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    region?: string | undefined;
+                    existingSecret?: string | undefined;
+                } | undefined;
+                identity?: {
+                    awsRoleArn?: string | undefined;
+                    gcpServiceAccountEmail?: string | undefined;
+                    azureClientId?: string | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+        postgres?: {
+            mode: "embedded" | "external";
+            external?: {
+                provider?: "aws" | "azure" | undefined;
+                host?: string | undefined;
+                port?: number | undefined;
+                database?: string | undefined;
+                bootstrap?: {
+                    enabled?: boolean | undefined;
+                    masterUsername?: string | undefined;
+                    masterPassword?: string | undefined;
+                    secretRef?: string | undefined;
+                    appRole?: string | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    }, {
+        redis?: {
+            mode: "embedded" | "external";
+            external?: {
+                password?: string | undefined;
+                host?: string | undefined;
+                port?: number | undefined;
+                existingSecret?: string | undefined;
+                existingSecretKey?: string | undefined;
+                tls?: boolean | undefined;
+                httpApi?: {
+                    enabled: boolean;
+                    url?: string | undefined;
+                    token?: string | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+        kafka?: {
+            mode: "embedded" | "external";
+            external?: {
+                preset?: "aws-msk-iam" | "azure-event-hubs" | "gcp-managed" | "custom" | undefined;
+                brokers?: string | undefined;
+                topic?: string | undefined;
+                topicPrefix?: string | undefined;
+                provisionTopics?: boolean | undefined;
+                ssl?: boolean | undefined;
+                sasl?: {
+                    mechanism: "" | "aws-iam" | "oauthbearer" | "scram-sha-256" | "scram-sha-512" | "plain";
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    region?: string | undefined;
+                    existingSecret?: string | undefined;
+                } | undefined;
+                identity?: {
+                    awsRoleArn?: string | undefined;
+                    gcpServiceAccountEmail?: string | undefined;
+                    azureClientId?: string | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+        postgres?: {
+            mode: "embedded" | "external";
+            external?: {
+                provider?: "aws" | "azure" | undefined;
+                host?: string | undefined;
+                port?: number | undefined;
+                database?: string | undefined;
+                bootstrap?: {
+                    enabled?: boolean | undefined;
+                    masterUsername?: string | undefined;
+                    masterPassword?: string | undefined;
+                    secretRef?: string | undefined;
+                    appRole?: string | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    }>>;
+    backup: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+        schedule: z.ZodString;
+        retentionDays: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        schedule: string;
+        retentionDays: number;
+    }, {
+        enabled: boolean;
+        schedule: string;
+        retentionDays: number;
+    }>>;
     features: z.ZodObject<{
         ai: z.ZodObject<{
             enabled: z.ZodBoolean;
@@ -233,39 +1010,663 @@ export declare const DeploymentConfigSchema: z.ZodObject<{
             clientSecret: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
             enabled: boolean;
-            provider?: "azure" | "google" | "okta" | "keycloak" | "ory" | "other" | undefined;
             url?: string | undefined;
             clientId?: string | undefined;
+            provider?: "azure" | "google" | "okta" | "keycloak" | "ory" | "other" | undefined;
             clientSecret?: string | undefined;
         }, {
             enabled: boolean;
-            provider?: "azure" | "google" | "okta" | "keycloak" | "ory" | "other" | undefined;
             url?: string | undefined;
             clientId?: string | undefined;
+            provider?: "azure" | "google" | "okta" | "keycloak" | "ory" | "other" | undefined;
             clientSecret?: string | undefined;
         }>;
         monitoring: z.ZodObject<{
             enabled: z.ZodBoolean;
+            destination: z.ZodOptional<z.ZodEnum<["local-grafana", "aws-amp", "azure-monitor", "grafana-cloud", "generic"]>>;
             remoteWriteUrl: z.ZodOptional<z.ZodString>;
+            remoteWrite: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+                destination: z.ZodEnum<["aws-amp", "azure-monitor", "grafana-cloud", "generic"]>;
+                url: z.ZodString;
+                authType: z.ZodOptional<z.ZodEnum<["none", "managed-identity", "workload-identity", "oauth", "basic", "bearer"]>>;
+                awsRegion: z.ZodOptional<z.ZodString>;
+                awsRoleArn: z.ZodOptional<z.ZodString>;
+                azureCloud: z.ZodOptional<z.ZodEnum<["AzurePublic", "AzureChina", "AzureGovernment"]>>;
+                clientId: z.ZodOptional<z.ZodString>;
+                tenantId: z.ZodOptional<z.ZodString>;
+                clientSecretRef: z.ZodOptional<z.ZodObject<{
+                    name: z.ZodString;
+                    key: z.ZodString;
+                }, "strip", z.ZodTypeAny, {
+                    name: string;
+                    key: string;
+                }, {
+                    name: string;
+                    key: string;
+                }>>;
+                usernameSecretRef: z.ZodOptional<z.ZodObject<{
+                    name: z.ZodString;
+                    key: z.ZodString;
+                }, "strip", z.ZodTypeAny, {
+                    name: string;
+                    key: string;
+                }, {
+                    name: string;
+                    key: string;
+                }>>;
+                passwordSecretRef: z.ZodOptional<z.ZodObject<{
+                    name: z.ZodString;
+                    key: z.ZodString;
+                }, "strip", z.ZodTypeAny, {
+                    name: string;
+                    key: string;
+                }, {
+                    name: string;
+                    key: string;
+                }>>;
+                bearerTokenSecretRef: z.ZodOptional<z.ZodObject<{
+                    name: z.ZodString;
+                    key: z.ZodString;
+                }, "strip", z.ZodTypeAny, {
+                    name: string;
+                    key: string;
+                }, {
+                    name: string;
+                    key: string;
+                }>>;
+            }, "strip", z.ZodTypeAny, {
+                destination: "aws-amp" | "azure-monitor" | "grafana-cloud" | "generic";
+                url: string;
+                authType?: "none" | "managed-identity" | "workload-identity" | "oauth" | "basic" | "bearer" | undefined;
+                awsRegion?: string | undefined;
+                awsRoleArn?: string | undefined;
+                azureCloud?: "AzurePublic" | "AzureChina" | "AzureGovernment" | undefined;
+                clientId?: string | undefined;
+                tenantId?: string | undefined;
+                clientSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                usernameSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                passwordSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                bearerTokenSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+            }, {
+                destination: "aws-amp" | "azure-monitor" | "grafana-cloud" | "generic";
+                url: string;
+                authType?: "none" | "managed-identity" | "workload-identity" | "oauth" | "basic" | "bearer" | undefined;
+                awsRegion?: string | undefined;
+                awsRoleArn?: string | undefined;
+                azureCloud?: "AzurePublic" | "AzureChina" | "AzureGovernment" | undefined;
+                clientId?: string | undefined;
+                tenantId?: string | undefined;
+                clientSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                usernameSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                passwordSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                bearerTokenSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+            }>, {
+                destination: "aws-amp" | "azure-monitor" | "grafana-cloud" | "generic";
+                url: string;
+                authType?: "none" | "managed-identity" | "workload-identity" | "oauth" | "basic" | "bearer" | undefined;
+                awsRegion?: string | undefined;
+                awsRoleArn?: string | undefined;
+                azureCloud?: "AzurePublic" | "AzureChina" | "AzureGovernment" | undefined;
+                clientId?: string | undefined;
+                tenantId?: string | undefined;
+                clientSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                usernameSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                passwordSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                bearerTokenSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+            }, {
+                destination: "aws-amp" | "azure-monitor" | "grafana-cloud" | "generic";
+                url: string;
+                authType?: "none" | "managed-identity" | "workload-identity" | "oauth" | "basic" | "bearer" | undefined;
+                awsRegion?: string | undefined;
+                awsRoleArn?: string | undefined;
+                azureCloud?: "AzurePublic" | "AzureChina" | "AzureGovernment" | undefined;
+                clientId?: string | undefined;
+                tenantId?: string | undefined;
+                clientSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                usernameSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                passwordSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                bearerTokenSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+            }>>;
         }, "strip", z.ZodTypeAny, {
             enabled: boolean;
+            destination?: "local-grafana" | "aws-amp" | "azure-monitor" | "grafana-cloud" | "generic" | undefined;
             remoteWriteUrl?: string | undefined;
+            remoteWrite?: {
+                destination: "aws-amp" | "azure-monitor" | "grafana-cloud" | "generic";
+                url: string;
+                authType?: "none" | "managed-identity" | "workload-identity" | "oauth" | "basic" | "bearer" | undefined;
+                awsRegion?: string | undefined;
+                awsRoleArn?: string | undefined;
+                azureCloud?: "AzurePublic" | "AzureChina" | "AzureGovernment" | undefined;
+                clientId?: string | undefined;
+                tenantId?: string | undefined;
+                clientSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                usernameSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                passwordSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                bearerTokenSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+            } | undefined;
         }, {
             enabled: boolean;
+            destination?: "local-grafana" | "aws-amp" | "azure-monitor" | "grafana-cloud" | "generic" | undefined;
             remoteWriteUrl?: string | undefined;
+            remoteWrite?: {
+                destination: "aws-amp" | "azure-monitor" | "grafana-cloud" | "generic";
+                url: string;
+                authType?: "none" | "managed-identity" | "workload-identity" | "oauth" | "basic" | "bearer" | undefined;
+                awsRegion?: string | undefined;
+                awsRoleArn?: string | undefined;
+                azureCloud?: "AzurePublic" | "AzureChina" | "AzureGovernment" | undefined;
+                clientId?: string | undefined;
+                tenantId?: string | undefined;
+                clientSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                usernameSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                passwordSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                bearerTokenSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+            } | undefined;
         }>;
+        observability: z.ZodOptional<z.ZodObject<{
+            clickstack: z.ZodObject<{
+                enabled: z.ZodBoolean;
+                telemetryRetentionDays: z.ZodOptional<z.ZodNumber>;
+                decisionLogRetentionDays: z.ZodOptional<z.ZodNumber>;
+                clickHouseStorageSize: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                enabled: boolean;
+                telemetryRetentionDays?: number | undefined;
+                decisionLogRetentionDays?: number | undefined;
+                clickHouseStorageSize?: string | undefined;
+            }, {
+                enabled: boolean;
+                telemetryRetentionDays?: number | undefined;
+                decisionLogRetentionDays?: number | undefined;
+                clickHouseStorageSize?: string | undefined;
+            }>;
+        }, "strip", z.ZodTypeAny, {
+            clickstack: {
+                enabled: boolean;
+                telemetryRetentionDays?: number | undefined;
+                decisionLogRetentionDays?: number | undefined;
+                clickHouseStorageSize?: string | undefined;
+            };
+        }, {
+            clickstack: {
+                enabled: boolean;
+                telemetryRetentionDays?: number | undefined;
+                decisionLogRetentionDays?: number | undefined;
+                clickHouseStorageSize?: string | undefined;
+            };
+        }>>;
+        tracing: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            destination: z.ZodOptional<z.ZodEnum<["elastic", "otlp", "azure-monitor"]>>;
+            samplingRatio: z.ZodOptional<z.ZodNumber>;
+            elastic: z.ZodOptional<z.ZodObject<{
+                endpoint: z.ZodOptional<z.ZodString>;
+                authMode: z.ZodOptional<z.ZodEnum<["secret-token", "api-key", "none"]>>;
+                secretToken: z.ZodOptional<z.ZodString>;
+                apiKey: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                endpoint?: string | undefined;
+                authMode?: "none" | "secret-token" | "api-key" | undefined;
+                secretToken?: string | undefined;
+                apiKey?: string | undefined;
+            }, {
+                endpoint?: string | undefined;
+                authMode?: "none" | "secret-token" | "api-key" | undefined;
+                secretToken?: string | undefined;
+                apiKey?: string | undefined;
+            }>>;
+            otlp: z.ZodOptional<z.ZodObject<{
+                endpoint: z.ZodOptional<z.ZodString>;
+                authMode: z.ZodOptional<z.ZodEnum<["none", "bearer", "api-key", "header"]>>;
+                headerName: z.ZodOptional<z.ZodString>;
+                token: z.ZodOptional<z.ZodString>;
+                apiKey: z.ZodOptional<z.ZodString>;
+                headerValue: z.ZodOptional<z.ZodString>;
+                headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                tlsInsecureSkipVerify: z.ZodOptional<z.ZodBoolean>;
+            }, "strip", z.ZodTypeAny, {
+                endpoint?: string | undefined;
+                authMode?: "none" | "bearer" | "api-key" | "header" | undefined;
+                apiKey?: string | undefined;
+                headerName?: string | undefined;
+                token?: string | undefined;
+                headerValue?: string | undefined;
+                headers?: Record<string, string> | undefined;
+                tlsInsecureSkipVerify?: boolean | undefined;
+            }, {
+                endpoint?: string | undefined;
+                authMode?: "none" | "bearer" | "api-key" | "header" | undefined;
+                apiKey?: string | undefined;
+                headerName?: string | undefined;
+                token?: string | undefined;
+                headerValue?: string | undefined;
+                headers?: Record<string, string> | undefined;
+                tlsInsecureSkipVerify?: boolean | undefined;
+            }>>;
+            azureMonitor: z.ZodOptional<z.ZodObject<{
+                connectionString: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                connectionString?: string | undefined;
+            }, {
+                connectionString?: string | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            destination?: "azure-monitor" | "elastic" | "otlp" | undefined;
+            elastic?: {
+                endpoint?: string | undefined;
+                authMode?: "none" | "secret-token" | "api-key" | undefined;
+                secretToken?: string | undefined;
+                apiKey?: string | undefined;
+            } | undefined;
+            otlp?: {
+                endpoint?: string | undefined;
+                authMode?: "none" | "bearer" | "api-key" | "header" | undefined;
+                apiKey?: string | undefined;
+                headerName?: string | undefined;
+                token?: string | undefined;
+                headerValue?: string | undefined;
+                headers?: Record<string, string> | undefined;
+                tlsInsecureSkipVerify?: boolean | undefined;
+            } | undefined;
+            samplingRatio?: number | undefined;
+            azureMonitor?: {
+                connectionString?: string | undefined;
+            } | undefined;
+        }, {
+            enabled: boolean;
+            destination?: "azure-monitor" | "elastic" | "otlp" | undefined;
+            elastic?: {
+                endpoint?: string | undefined;
+                authMode?: "none" | "secret-token" | "api-key" | undefined;
+                secretToken?: string | undefined;
+                apiKey?: string | undefined;
+            } | undefined;
+            otlp?: {
+                endpoint?: string | undefined;
+                authMode?: "none" | "bearer" | "api-key" | "header" | undefined;
+                apiKey?: string | undefined;
+                headerName?: string | undefined;
+                token?: string | undefined;
+                headerValue?: string | undefined;
+                headers?: Record<string, string> | undefined;
+                tlsInsecureSkipVerify?: boolean | undefined;
+            } | undefined;
+            samplingRatio?: number | undefined;
+            azureMonitor?: {
+                connectionString?: string | undefined;
+            } | undefined;
+        }>, {
+            enabled: boolean;
+            destination?: "azure-monitor" | "elastic" | "otlp" | undefined;
+            elastic?: {
+                endpoint?: string | undefined;
+                authMode?: "none" | "secret-token" | "api-key" | undefined;
+                secretToken?: string | undefined;
+                apiKey?: string | undefined;
+            } | undefined;
+            otlp?: {
+                endpoint?: string | undefined;
+                authMode?: "none" | "bearer" | "api-key" | "header" | undefined;
+                apiKey?: string | undefined;
+                headerName?: string | undefined;
+                token?: string | undefined;
+                headerValue?: string | undefined;
+                headers?: Record<string, string> | undefined;
+                tlsInsecureSkipVerify?: boolean | undefined;
+            } | undefined;
+            samplingRatio?: number | undefined;
+            azureMonitor?: {
+                connectionString?: string | undefined;
+            } | undefined;
+        }, {
+            enabled: boolean;
+            destination?: "azure-monitor" | "elastic" | "otlp" | undefined;
+            elastic?: {
+                endpoint?: string | undefined;
+                authMode?: "none" | "secret-token" | "api-key" | undefined;
+                secretToken?: string | undefined;
+                apiKey?: string | undefined;
+            } | undefined;
+            otlp?: {
+                endpoint?: string | undefined;
+                authMode?: "none" | "bearer" | "api-key" | "header" | undefined;
+                apiKey?: string | undefined;
+                headerName?: string | undefined;
+                token?: string | undefined;
+                headerValue?: string | undefined;
+                headers?: Record<string, string> | undefined;
+                tlsInsecureSkipVerify?: boolean | undefined;
+            } | undefined;
+            samplingRatio?: number | undefined;
+            azureMonitor?: {
+                connectionString?: string | undefined;
+            } | undefined;
+        }>>;
+        cache: z.ZodOptional<z.ZodObject<{
+            valkeyAdmin: z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodBoolean;
+                exposure: z.ZodOptional<z.ZodEnum<["internal", "ingress"]>>;
+                hostname: z.ZodOptional<z.ZodString>;
+                basicAuthUsers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                basicAuthExistingSecret: z.ZodOptional<z.ZodString>;
+                allowedIPs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "strip", z.ZodTypeAny, {
+                enabled: boolean;
+                exposure?: "internal" | "ingress" | undefined;
+                hostname?: string | undefined;
+                basicAuthUsers?: string[] | undefined;
+                basicAuthExistingSecret?: string | undefined;
+                allowedIPs?: string[] | undefined;
+            }, {
+                enabled: boolean;
+                exposure?: "internal" | "ingress" | undefined;
+                hostname?: string | undefined;
+                basicAuthUsers?: string[] | undefined;
+                basicAuthExistingSecret?: string | undefined;
+                allowedIPs?: string[] | undefined;
+            }>>;
+            redisExporter: z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodBoolean;
+            }, "strip", z.ZodTypeAny, {
+                enabled: boolean;
+            }, {
+                enabled: boolean;
+            }>>;
+            kafkaExporter: z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodBoolean;
+            }, "strip", z.ZodTypeAny, {
+                enabled: boolean;
+            }, {
+                enabled: boolean;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            valkeyAdmin?: {
+                enabled: boolean;
+                exposure?: "internal" | "ingress" | undefined;
+                hostname?: string | undefined;
+                basicAuthUsers?: string[] | undefined;
+                basicAuthExistingSecret?: string | undefined;
+                allowedIPs?: string[] | undefined;
+            } | undefined;
+            redisExporter?: {
+                enabled: boolean;
+            } | undefined;
+            kafkaExporter?: {
+                enabled: boolean;
+            } | undefined;
+        }, {
+            valkeyAdmin?: {
+                enabled: boolean;
+                exposure?: "internal" | "ingress" | undefined;
+                hostname?: string | undefined;
+                basicAuthUsers?: string[] | undefined;
+                basicAuthExistingSecret?: string | undefined;
+                allowedIPs?: string[] | undefined;
+            } | undefined;
+            redisExporter?: {
+                enabled: boolean;
+            } | undefined;
+            kafkaExporter?: {
+                enabled: boolean;
+            } | undefined;
+        }>>;
         logging: z.ZodObject<{
-            sink: z.ZodEnum<["console", "pending", "s3", "azure-blob", "gcs", "datadog", "splunk", "elasticsearch", "loki", "newrelic", "axiom"]>;
+            sink: z.ZodEnum<["console", "pending", "datadog", "splunk", "elasticsearch", "loki", "newrelic", "axiom"]>;
             bucket: z.ZodOptional<z.ZodString>;
             region: z.ZodOptional<z.ZodString>;
+            appLogs: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+                enabled: z.ZodBoolean;
+                destination: z.ZodOptional<z.ZodEnum<["elasticsearch", "loki", "generic"]>>;
+                elasticsearch: z.ZodOptional<z.ZodObject<{
+                    endpoint: z.ZodOptional<z.ZodString>;
+                    index: z.ZodOptional<z.ZodString>;
+                    authMode: z.ZodOptional<z.ZodEnum<["basic", "api-key", "none"]>>;
+                    username: z.ZodOptional<z.ZodString>;
+                    password: z.ZodOptional<z.ZodString>;
+                    apiKey: z.ZodOptional<z.ZodString>;
+                    verifyCertificate: z.ZodOptional<z.ZodBoolean>;
+                }, "strip", z.ZodTypeAny, {
+                    endpoint?: string | undefined;
+                    authMode?: "none" | "basic" | "api-key" | undefined;
+                    apiKey?: string | undefined;
+                    index?: string | undefined;
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    verifyCertificate?: boolean | undefined;
+                }, {
+                    endpoint?: string | undefined;
+                    authMode?: "none" | "basic" | "api-key" | undefined;
+                    apiKey?: string | undefined;
+                    index?: string | undefined;
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    verifyCertificate?: boolean | undefined;
+                }>>;
+                loki: z.ZodOptional<z.ZodObject<{
+                    endpoint: z.ZodOptional<z.ZodString>;
+                    labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                }, "strip", z.ZodTypeAny, {
+                    endpoint?: string | undefined;
+                    labels?: Record<string, string> | undefined;
+                }, {
+                    endpoint?: string | undefined;
+                    labels?: Record<string, string> | undefined;
+                }>>;
+                generic: z.ZodOptional<z.ZodObject<{
+                    endpoint: z.ZodOptional<z.ZodString>;
+                    authHeader: z.ZodOptional<z.ZodString>;
+                }, "strip", z.ZodTypeAny, {
+                    endpoint?: string | undefined;
+                    authHeader?: string | undefined;
+                }, {
+                    endpoint?: string | undefined;
+                    authHeader?: string | undefined;
+                }>>;
+            }, "strip", z.ZodTypeAny, {
+                enabled: boolean;
+                elasticsearch?: {
+                    endpoint?: string | undefined;
+                    authMode?: "none" | "basic" | "api-key" | undefined;
+                    apiKey?: string | undefined;
+                    index?: string | undefined;
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    verifyCertificate?: boolean | undefined;
+                } | undefined;
+                loki?: {
+                    endpoint?: string | undefined;
+                    labels?: Record<string, string> | undefined;
+                } | undefined;
+                generic?: {
+                    endpoint?: string | undefined;
+                    authHeader?: string | undefined;
+                } | undefined;
+                destination?: "elasticsearch" | "loki" | "generic" | undefined;
+            }, {
+                enabled: boolean;
+                elasticsearch?: {
+                    endpoint?: string | undefined;
+                    authMode?: "none" | "basic" | "api-key" | undefined;
+                    apiKey?: string | undefined;
+                    index?: string | undefined;
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    verifyCertificate?: boolean | undefined;
+                } | undefined;
+                loki?: {
+                    endpoint?: string | undefined;
+                    labels?: Record<string, string> | undefined;
+                } | undefined;
+                generic?: {
+                    endpoint?: string | undefined;
+                    authHeader?: string | undefined;
+                } | undefined;
+                destination?: "elasticsearch" | "loki" | "generic" | undefined;
+            }>, {
+                enabled: boolean;
+                elasticsearch?: {
+                    endpoint?: string | undefined;
+                    authMode?: "none" | "basic" | "api-key" | undefined;
+                    apiKey?: string | undefined;
+                    index?: string | undefined;
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    verifyCertificate?: boolean | undefined;
+                } | undefined;
+                loki?: {
+                    endpoint?: string | undefined;
+                    labels?: Record<string, string> | undefined;
+                } | undefined;
+                generic?: {
+                    endpoint?: string | undefined;
+                    authHeader?: string | undefined;
+                } | undefined;
+                destination?: "elasticsearch" | "loki" | "generic" | undefined;
+            }, {
+                enabled: boolean;
+                elasticsearch?: {
+                    endpoint?: string | undefined;
+                    authMode?: "none" | "basic" | "api-key" | undefined;
+                    apiKey?: string | undefined;
+                    index?: string | undefined;
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    verifyCertificate?: boolean | undefined;
+                } | undefined;
+                loki?: {
+                    endpoint?: string | undefined;
+                    labels?: Record<string, string> | undefined;
+                } | undefined;
+                generic?: {
+                    endpoint?: string | undefined;
+                    authHeader?: string | undefined;
+                } | undefined;
+                destination?: "elasticsearch" | "loki" | "generic" | undefined;
+            }>>;
         }, "strip", z.ZodTypeAny, {
-            sink: "console" | "pending" | "s3" | "azure-blob" | "gcs" | "datadog" | "splunk" | "elasticsearch" | "loki" | "newrelic" | "axiom";
+            sink: "console" | "pending" | "datadog" | "splunk" | "elasticsearch" | "loki" | "newrelic" | "axiom";
             region?: string | undefined;
             bucket?: string | undefined;
+            appLogs?: {
+                enabled: boolean;
+                elasticsearch?: {
+                    endpoint?: string | undefined;
+                    authMode?: "none" | "basic" | "api-key" | undefined;
+                    apiKey?: string | undefined;
+                    index?: string | undefined;
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    verifyCertificate?: boolean | undefined;
+                } | undefined;
+                loki?: {
+                    endpoint?: string | undefined;
+                    labels?: Record<string, string> | undefined;
+                } | undefined;
+                generic?: {
+                    endpoint?: string | undefined;
+                    authHeader?: string | undefined;
+                } | undefined;
+                destination?: "elasticsearch" | "loki" | "generic" | undefined;
+            } | undefined;
         }, {
-            sink: "console" | "pending" | "s3" | "azure-blob" | "gcs" | "datadog" | "splunk" | "elasticsearch" | "loki" | "newrelic" | "axiom";
+            sink: "console" | "pending" | "datadog" | "splunk" | "elasticsearch" | "loki" | "newrelic" | "axiom";
             region?: string | undefined;
             bucket?: string | undefined;
+            appLogs?: {
+                enabled: boolean;
+                elasticsearch?: {
+                    endpoint?: string | undefined;
+                    authMode?: "none" | "basic" | "api-key" | undefined;
+                    apiKey?: string | undefined;
+                    index?: string | undefined;
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    verifyCertificate?: boolean | undefined;
+                } | undefined;
+                loki?: {
+                    endpoint?: string | undefined;
+                    labels?: Record<string, string> | undefined;
+                } | undefined;
+                generic?: {
+                    endpoint?: string | undefined;
+                    authHeader?: string | undefined;
+                } | undefined;
+                destination?: "elasticsearch" | "loki" | "generic" | undefined;
+            } | undefined;
         }>;
         customEmails: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodBoolean;
@@ -337,20 +1738,116 @@ export declare const DeploymentConfigSchema: z.ZodObject<{
         };
         sso: {
             enabled: boolean;
-            provider?: "azure" | "google" | "okta" | "keycloak" | "ory" | "other" | undefined;
             url?: string | undefined;
             clientId?: string | undefined;
+            provider?: "azure" | "google" | "okta" | "keycloak" | "ory" | "other" | undefined;
             clientSecret?: string | undefined;
         };
         monitoring: {
             enabled: boolean;
+            destination?: "local-grafana" | "aws-amp" | "azure-monitor" | "grafana-cloud" | "generic" | undefined;
             remoteWriteUrl?: string | undefined;
+            remoteWrite?: {
+                destination: "aws-amp" | "azure-monitor" | "grafana-cloud" | "generic";
+                url: string;
+                authType?: "none" | "managed-identity" | "workload-identity" | "oauth" | "basic" | "bearer" | undefined;
+                awsRegion?: string | undefined;
+                awsRoleArn?: string | undefined;
+                azureCloud?: "AzurePublic" | "AzureChina" | "AzureGovernment" | undefined;
+                clientId?: string | undefined;
+                tenantId?: string | undefined;
+                clientSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                usernameSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                passwordSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                bearerTokenSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+            } | undefined;
         };
         logging: {
-            sink: "console" | "pending" | "s3" | "azure-blob" | "gcs" | "datadog" | "splunk" | "elasticsearch" | "loki" | "newrelic" | "axiom";
+            sink: "console" | "pending" | "datadog" | "splunk" | "elasticsearch" | "loki" | "newrelic" | "axiom";
             region?: string | undefined;
             bucket?: string | undefined;
+            appLogs?: {
+                enabled: boolean;
+                elasticsearch?: {
+                    endpoint?: string | undefined;
+                    authMode?: "none" | "basic" | "api-key" | undefined;
+                    apiKey?: string | undefined;
+                    index?: string | undefined;
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    verifyCertificate?: boolean | undefined;
+                } | undefined;
+                loki?: {
+                    endpoint?: string | undefined;
+                    labels?: Record<string, string> | undefined;
+                } | undefined;
+                generic?: {
+                    endpoint?: string | undefined;
+                    authHeader?: string | undefined;
+                } | undefined;
+                destination?: "elasticsearch" | "loki" | "generic" | undefined;
+            } | undefined;
         };
+        observability?: {
+            clickstack: {
+                enabled: boolean;
+                telemetryRetentionDays?: number | undefined;
+                decisionLogRetentionDays?: number | undefined;
+                clickHouseStorageSize?: string | undefined;
+            };
+        } | undefined;
+        tracing?: {
+            enabled: boolean;
+            destination?: "azure-monitor" | "elastic" | "otlp" | undefined;
+            elastic?: {
+                endpoint?: string | undefined;
+                authMode?: "none" | "secret-token" | "api-key" | undefined;
+                secretToken?: string | undefined;
+                apiKey?: string | undefined;
+            } | undefined;
+            otlp?: {
+                endpoint?: string | undefined;
+                authMode?: "none" | "bearer" | "api-key" | "header" | undefined;
+                apiKey?: string | undefined;
+                headerName?: string | undefined;
+                token?: string | undefined;
+                headerValue?: string | undefined;
+                headers?: Record<string, string> | undefined;
+                tlsInsecureSkipVerify?: boolean | undefined;
+            } | undefined;
+            samplingRatio?: number | undefined;
+            azureMonitor?: {
+                connectionString?: string | undefined;
+            } | undefined;
+        } | undefined;
+        cache?: {
+            valkeyAdmin?: {
+                enabled: boolean;
+                exposure?: "internal" | "ingress" | undefined;
+                hostname?: string | undefined;
+                basicAuthUsers?: string[] | undefined;
+                basicAuthExistingSecret?: string | undefined;
+                allowedIPs?: string[] | undefined;
+            } | undefined;
+            redisExporter?: {
+                enabled: boolean;
+            } | undefined;
+            kafkaExporter?: {
+                enabled: boolean;
+            } | undefined;
+        } | undefined;
         customEmails?: {
             enabled: boolean;
             subjects?: {
@@ -373,20 +1870,116 @@ export declare const DeploymentConfigSchema: z.ZodObject<{
         };
         sso: {
             enabled: boolean;
-            provider?: "azure" | "google" | "okta" | "keycloak" | "ory" | "other" | undefined;
             url?: string | undefined;
             clientId?: string | undefined;
+            provider?: "azure" | "google" | "okta" | "keycloak" | "ory" | "other" | undefined;
             clientSecret?: string | undefined;
         };
         monitoring: {
             enabled: boolean;
+            destination?: "local-grafana" | "aws-amp" | "azure-monitor" | "grafana-cloud" | "generic" | undefined;
             remoteWriteUrl?: string | undefined;
+            remoteWrite?: {
+                destination: "aws-amp" | "azure-monitor" | "grafana-cloud" | "generic";
+                url: string;
+                authType?: "none" | "managed-identity" | "workload-identity" | "oauth" | "basic" | "bearer" | undefined;
+                awsRegion?: string | undefined;
+                awsRoleArn?: string | undefined;
+                azureCloud?: "AzurePublic" | "AzureChina" | "AzureGovernment" | undefined;
+                clientId?: string | undefined;
+                tenantId?: string | undefined;
+                clientSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                usernameSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                passwordSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                bearerTokenSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+            } | undefined;
         };
         logging: {
-            sink: "console" | "pending" | "s3" | "azure-blob" | "gcs" | "datadog" | "splunk" | "elasticsearch" | "loki" | "newrelic" | "axiom";
+            sink: "console" | "pending" | "datadog" | "splunk" | "elasticsearch" | "loki" | "newrelic" | "axiom";
             region?: string | undefined;
             bucket?: string | undefined;
+            appLogs?: {
+                enabled: boolean;
+                elasticsearch?: {
+                    endpoint?: string | undefined;
+                    authMode?: "none" | "basic" | "api-key" | undefined;
+                    apiKey?: string | undefined;
+                    index?: string | undefined;
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    verifyCertificate?: boolean | undefined;
+                } | undefined;
+                loki?: {
+                    endpoint?: string | undefined;
+                    labels?: Record<string, string> | undefined;
+                } | undefined;
+                generic?: {
+                    endpoint?: string | undefined;
+                    authHeader?: string | undefined;
+                } | undefined;
+                destination?: "elasticsearch" | "loki" | "generic" | undefined;
+            } | undefined;
         };
+        observability?: {
+            clickstack: {
+                enabled: boolean;
+                telemetryRetentionDays?: number | undefined;
+                decisionLogRetentionDays?: number | undefined;
+                clickHouseStorageSize?: string | undefined;
+            };
+        } | undefined;
+        tracing?: {
+            enabled: boolean;
+            destination?: "azure-monitor" | "elastic" | "otlp" | undefined;
+            elastic?: {
+                endpoint?: string | undefined;
+                authMode?: "none" | "secret-token" | "api-key" | undefined;
+                secretToken?: string | undefined;
+                apiKey?: string | undefined;
+            } | undefined;
+            otlp?: {
+                endpoint?: string | undefined;
+                authMode?: "none" | "bearer" | "api-key" | "header" | undefined;
+                apiKey?: string | undefined;
+                headerName?: string | undefined;
+                token?: string | undefined;
+                headerValue?: string | undefined;
+                headers?: Record<string, string> | undefined;
+                tlsInsecureSkipVerify?: boolean | undefined;
+            } | undefined;
+            samplingRatio?: number | undefined;
+            azureMonitor?: {
+                connectionString?: string | undefined;
+            } | undefined;
+        } | undefined;
+        cache?: {
+            valkeyAdmin?: {
+                enabled: boolean;
+                exposure?: "internal" | "ingress" | undefined;
+                hostname?: string | undefined;
+                basicAuthUsers?: string[] | undefined;
+                basicAuthExistingSecret?: string | undefined;
+                allowedIPs?: string[] | undefined;
+            } | undefined;
+            redisExporter?: {
+                enabled: boolean;
+            } | undefined;
+            kafkaExporter?: {
+                enabled: boolean;
+            } | undefined;
+        } | undefined;
         customEmails?: {
             enabled: boolean;
             subjects?: {
@@ -404,18 +1997,28 @@ export declare const DeploymentConfigSchema: z.ZodObject<{
         } | undefined;
     }>;
     licenseKey: z.ZodString;
-    appVersion: z.ZodOptional<z.ZodString>;
-    hpsVersion: z.ZodOptional<z.ZodString>;
+    version: z.ZodString;
+    imageRegistry: z.ZodOptional<z.ZodString>;
     chartVersion: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     name: string;
     infrastructure: {
-        mode: "existing" | "provision";
+        mode: "existing";
         provider?: "aws" | "gcp" | "azure" | undefined;
         region?: string | undefined;
         clusterName?: string | undefined;
         gcpProjectId?: string | undefined;
         azureResourceGroup?: string | undefined;
+        nodeArchitecture?: "amd64" | "arm64" | "mixed" | "unknown" | undefined;
+        arm64TolerationRequired?: boolean | undefined;
+        storageClass?: string | undefined;
+        storageProvisioner?: string | undefined;
+        schedulableNodeCount?: number | undefined;
+        totalCpuCores?: number | undefined;
+        totalMemoryGi?: number | undefined;
+        eligibleCpuCores?: number | undefined;
+        eligibleMemoryGi?: number | undefined;
+        totalPersistentStorageGi?: number | undefined;
     };
     domain: string;
     adminEmail: string;
@@ -423,7 +2026,6 @@ export declare const DeploymentConfigSchema: z.ZodObject<{
     dns: {
         provider: "azure" | "google" | "other" | "route53" | "cloudflare";
         autoManage: boolean;
-        existingExternalDns?: boolean | undefined;
     };
     smtp: {
         host: string;
@@ -445,7 +2047,6 @@ export declare const DeploymentConfigSchema: z.ZodObject<{
         supabaseDashboardUser?: string | undefined;
         supabaseDashboardPass?: string | undefined;
     };
-    tier: "small" | "medium" | "large";
     features: {
         ai: {
             enabled: boolean;
@@ -453,20 +2054,116 @@ export declare const DeploymentConfigSchema: z.ZodObject<{
         };
         sso: {
             enabled: boolean;
-            provider?: "azure" | "google" | "okta" | "keycloak" | "ory" | "other" | undefined;
             url?: string | undefined;
             clientId?: string | undefined;
+            provider?: "azure" | "google" | "okta" | "keycloak" | "ory" | "other" | undefined;
             clientSecret?: string | undefined;
         };
         monitoring: {
             enabled: boolean;
+            destination?: "local-grafana" | "aws-amp" | "azure-monitor" | "grafana-cloud" | "generic" | undefined;
             remoteWriteUrl?: string | undefined;
+            remoteWrite?: {
+                destination: "aws-amp" | "azure-monitor" | "grafana-cloud" | "generic";
+                url: string;
+                authType?: "none" | "managed-identity" | "workload-identity" | "oauth" | "basic" | "bearer" | undefined;
+                awsRegion?: string | undefined;
+                awsRoleArn?: string | undefined;
+                azureCloud?: "AzurePublic" | "AzureChina" | "AzureGovernment" | undefined;
+                clientId?: string | undefined;
+                tenantId?: string | undefined;
+                clientSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                usernameSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                passwordSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                bearerTokenSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+            } | undefined;
         };
         logging: {
-            sink: "console" | "pending" | "s3" | "azure-blob" | "gcs" | "datadog" | "splunk" | "elasticsearch" | "loki" | "newrelic" | "axiom";
+            sink: "console" | "pending" | "datadog" | "splunk" | "elasticsearch" | "loki" | "newrelic" | "axiom";
             region?: string | undefined;
             bucket?: string | undefined;
+            appLogs?: {
+                enabled: boolean;
+                elasticsearch?: {
+                    endpoint?: string | undefined;
+                    authMode?: "none" | "basic" | "api-key" | undefined;
+                    apiKey?: string | undefined;
+                    index?: string | undefined;
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    verifyCertificate?: boolean | undefined;
+                } | undefined;
+                loki?: {
+                    endpoint?: string | undefined;
+                    labels?: Record<string, string> | undefined;
+                } | undefined;
+                generic?: {
+                    endpoint?: string | undefined;
+                    authHeader?: string | undefined;
+                } | undefined;
+                destination?: "elasticsearch" | "loki" | "generic" | undefined;
+            } | undefined;
         };
+        observability?: {
+            clickstack: {
+                enabled: boolean;
+                telemetryRetentionDays?: number | undefined;
+                decisionLogRetentionDays?: number | undefined;
+                clickHouseStorageSize?: string | undefined;
+            };
+        } | undefined;
+        tracing?: {
+            enabled: boolean;
+            destination?: "azure-monitor" | "elastic" | "otlp" | undefined;
+            elastic?: {
+                endpoint?: string | undefined;
+                authMode?: "none" | "secret-token" | "api-key" | undefined;
+                secretToken?: string | undefined;
+                apiKey?: string | undefined;
+            } | undefined;
+            otlp?: {
+                endpoint?: string | undefined;
+                authMode?: "none" | "bearer" | "api-key" | "header" | undefined;
+                apiKey?: string | undefined;
+                headerName?: string | undefined;
+                token?: string | undefined;
+                headerValue?: string | undefined;
+                headers?: Record<string, string> | undefined;
+                tlsInsecureSkipVerify?: boolean | undefined;
+            } | undefined;
+            samplingRatio?: number | undefined;
+            azureMonitor?: {
+                connectionString?: string | undefined;
+            } | undefined;
+        } | undefined;
+        cache?: {
+            valkeyAdmin?: {
+                enabled: boolean;
+                exposure?: "internal" | "ingress" | undefined;
+                hostname?: string | undefined;
+                basicAuthUsers?: string[] | undefined;
+                basicAuthExistingSecret?: string | undefined;
+                allowedIPs?: string[] | undefined;
+            } | undefined;
+            redisExporter?: {
+                enabled: boolean;
+            } | undefined;
+            kafkaExporter?: {
+                enabled: boolean;
+            } | undefined;
+        } | undefined;
         customEmails?: {
             enabled: boolean;
             subjects?: {
@@ -484,18 +2181,109 @@ export declare const DeploymentConfigSchema: z.ZodObject<{
         } | undefined;
     };
     licenseKey: string;
-    appVersion?: string | undefined;
-    hpsVersion?: string | undefined;
+    version: string;
+    storage?: {
+        provider: "s3" | "azure-blob" | "gcs";
+        region: string;
+        bucket: string;
+        cloudAuthMode?: "workload-identity" | "secret" | undefined;
+        awsIamRoleArn?: string | undefined;
+        azureBlobClientId?: string | undefined;
+        azureBlobTenantId?: string | undefined;
+        azureBlobConnectionStringSecretRef?: {
+            name: string;
+            key: string;
+        } | undefined;
+        azureBlobContainer?: string | undefined;
+        gcpServiceAccountEmail?: string | undefined;
+        paths?: {
+            decisionLogs?: string | undefined;
+            dbBackups?: string | undefined;
+        } | undefined;
+    } | undefined;
+    externalServices?: {
+        redis?: {
+            mode: "embedded" | "external";
+            external?: {
+                password?: string | undefined;
+                host?: string | undefined;
+                port?: number | undefined;
+                existingSecret?: string | undefined;
+                existingSecretKey?: string | undefined;
+                tls?: boolean | undefined;
+                httpApi?: {
+                    enabled: boolean;
+                    url?: string | undefined;
+                    token?: string | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+        kafka?: {
+            mode: "embedded" | "external";
+            external?: {
+                preset?: "aws-msk-iam" | "azure-event-hubs" | "gcp-managed" | "custom" | undefined;
+                brokers?: string | undefined;
+                topic?: string | undefined;
+                topicPrefix?: string | undefined;
+                provisionTopics?: boolean | undefined;
+                ssl?: boolean | undefined;
+                sasl?: {
+                    mechanism: "" | "aws-iam" | "oauthbearer" | "scram-sha-256" | "scram-sha-512" | "plain";
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    region?: string | undefined;
+                    existingSecret?: string | undefined;
+                } | undefined;
+                identity?: {
+                    awsRoleArn?: string | undefined;
+                    gcpServiceAccountEmail?: string | undefined;
+                    azureClientId?: string | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+        postgres?: {
+            mode: "embedded" | "external";
+            external?: {
+                provider?: "aws" | "azure" | undefined;
+                host?: string | undefined;
+                port?: number | undefined;
+                database?: string | undefined;
+                bootstrap?: {
+                    enabled?: boolean | undefined;
+                    masterUsername?: string | undefined;
+                    masterPassword?: string | undefined;
+                    secretRef?: string | undefined;
+                    appRole?: string | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    } | undefined;
+    backup?: {
+        enabled: boolean;
+        schedule: string;
+        retentionDays: number;
+    } | undefined;
+    imageRegistry?: string | undefined;
     chartVersion?: string | undefined;
 }, {
     name: string;
     infrastructure: {
-        mode: "existing" | "provision";
+        mode: "existing";
         provider?: "aws" | "gcp" | "azure" | undefined;
         region?: string | undefined;
         clusterName?: string | undefined;
         gcpProjectId?: string | undefined;
         azureResourceGroup?: string | undefined;
+        nodeArchitecture?: "amd64" | "arm64" | "mixed" | "unknown" | undefined;
+        arm64TolerationRequired?: boolean | undefined;
+        storageClass?: string | undefined;
+        storageProvisioner?: string | undefined;
+        schedulableNodeCount?: number | undefined;
+        totalCpuCores?: number | undefined;
+        totalMemoryGi?: number | undefined;
+        eligibleCpuCores?: number | undefined;
+        eligibleMemoryGi?: number | undefined;
+        totalPersistentStorageGi?: number | undefined;
     };
     domain: string;
     adminEmail: string;
@@ -503,7 +2291,6 @@ export declare const DeploymentConfigSchema: z.ZodObject<{
     dns: {
         provider: "azure" | "google" | "other" | "route53" | "cloudflare";
         autoManage: boolean;
-        existingExternalDns?: boolean | undefined;
     };
     smtp: {
         host: string;
@@ -525,7 +2312,6 @@ export declare const DeploymentConfigSchema: z.ZodObject<{
         supabaseDashboardUser?: string | undefined;
         supabaseDashboardPass?: string | undefined;
     };
-    tier: "small" | "medium" | "large";
     features: {
         ai: {
             enabled: boolean;
@@ -533,20 +2319,116 @@ export declare const DeploymentConfigSchema: z.ZodObject<{
         };
         sso: {
             enabled: boolean;
-            provider?: "azure" | "google" | "okta" | "keycloak" | "ory" | "other" | undefined;
             url?: string | undefined;
             clientId?: string | undefined;
+            provider?: "azure" | "google" | "okta" | "keycloak" | "ory" | "other" | undefined;
             clientSecret?: string | undefined;
         };
         monitoring: {
             enabled: boolean;
+            destination?: "local-grafana" | "aws-amp" | "azure-monitor" | "grafana-cloud" | "generic" | undefined;
             remoteWriteUrl?: string | undefined;
+            remoteWrite?: {
+                destination: "aws-amp" | "azure-monitor" | "grafana-cloud" | "generic";
+                url: string;
+                authType?: "none" | "managed-identity" | "workload-identity" | "oauth" | "basic" | "bearer" | undefined;
+                awsRegion?: string | undefined;
+                awsRoleArn?: string | undefined;
+                azureCloud?: "AzurePublic" | "AzureChina" | "AzureGovernment" | undefined;
+                clientId?: string | undefined;
+                tenantId?: string | undefined;
+                clientSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                usernameSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                passwordSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+                bearerTokenSecretRef?: {
+                    name: string;
+                    key: string;
+                } | undefined;
+            } | undefined;
         };
         logging: {
-            sink: "console" | "pending" | "s3" | "azure-blob" | "gcs" | "datadog" | "splunk" | "elasticsearch" | "loki" | "newrelic" | "axiom";
+            sink: "console" | "pending" | "datadog" | "splunk" | "elasticsearch" | "loki" | "newrelic" | "axiom";
             region?: string | undefined;
             bucket?: string | undefined;
+            appLogs?: {
+                enabled: boolean;
+                elasticsearch?: {
+                    endpoint?: string | undefined;
+                    authMode?: "none" | "basic" | "api-key" | undefined;
+                    apiKey?: string | undefined;
+                    index?: string | undefined;
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    verifyCertificate?: boolean | undefined;
+                } | undefined;
+                loki?: {
+                    endpoint?: string | undefined;
+                    labels?: Record<string, string> | undefined;
+                } | undefined;
+                generic?: {
+                    endpoint?: string | undefined;
+                    authHeader?: string | undefined;
+                } | undefined;
+                destination?: "elasticsearch" | "loki" | "generic" | undefined;
+            } | undefined;
         };
+        observability?: {
+            clickstack: {
+                enabled: boolean;
+                telemetryRetentionDays?: number | undefined;
+                decisionLogRetentionDays?: number | undefined;
+                clickHouseStorageSize?: string | undefined;
+            };
+        } | undefined;
+        tracing?: {
+            enabled: boolean;
+            destination?: "azure-monitor" | "elastic" | "otlp" | undefined;
+            elastic?: {
+                endpoint?: string | undefined;
+                authMode?: "none" | "secret-token" | "api-key" | undefined;
+                secretToken?: string | undefined;
+                apiKey?: string | undefined;
+            } | undefined;
+            otlp?: {
+                endpoint?: string | undefined;
+                authMode?: "none" | "bearer" | "api-key" | "header" | undefined;
+                apiKey?: string | undefined;
+                headerName?: string | undefined;
+                token?: string | undefined;
+                headerValue?: string | undefined;
+                headers?: Record<string, string> | undefined;
+                tlsInsecureSkipVerify?: boolean | undefined;
+            } | undefined;
+            samplingRatio?: number | undefined;
+            azureMonitor?: {
+                connectionString?: string | undefined;
+            } | undefined;
+        } | undefined;
+        cache?: {
+            valkeyAdmin?: {
+                enabled: boolean;
+                exposure?: "internal" | "ingress" | undefined;
+                hostname?: string | undefined;
+                basicAuthUsers?: string[] | undefined;
+                basicAuthExistingSecret?: string | undefined;
+                allowedIPs?: string[] | undefined;
+            } | undefined;
+            redisExporter?: {
+                enabled: boolean;
+            } | undefined;
+            kafkaExporter?: {
+                enabled: boolean;
+            } | undefined;
+        } | undefined;
         customEmails?: {
             enabled: boolean;
             subjects?: {
@@ -564,8 +2446,89 @@ export declare const DeploymentConfigSchema: z.ZodObject<{
         } | undefined;
     };
     licenseKey: string;
-    appVersion?: string | undefined;
-    hpsVersion?: string | undefined;
+    version: string;
+    storage?: {
+        provider: "s3" | "azure-blob" | "gcs";
+        region: string;
+        bucket: string;
+        cloudAuthMode?: "workload-identity" | "secret" | undefined;
+        awsIamRoleArn?: string | undefined;
+        azureBlobClientId?: string | undefined;
+        azureBlobTenantId?: string | undefined;
+        azureBlobConnectionStringSecretRef?: {
+            name: string;
+            key: string;
+        } | undefined;
+        azureBlobContainer?: string | undefined;
+        gcpServiceAccountEmail?: string | undefined;
+        paths?: {
+            decisionLogs?: string | undefined;
+            dbBackups?: string | undefined;
+        } | undefined;
+    } | undefined;
+    externalServices?: {
+        redis?: {
+            mode: "embedded" | "external";
+            external?: {
+                password?: string | undefined;
+                host?: string | undefined;
+                port?: number | undefined;
+                existingSecret?: string | undefined;
+                existingSecretKey?: string | undefined;
+                tls?: boolean | undefined;
+                httpApi?: {
+                    enabled: boolean;
+                    url?: string | undefined;
+                    token?: string | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+        kafka?: {
+            mode: "embedded" | "external";
+            external?: {
+                preset?: "aws-msk-iam" | "azure-event-hubs" | "gcp-managed" | "custom" | undefined;
+                brokers?: string | undefined;
+                topic?: string | undefined;
+                topicPrefix?: string | undefined;
+                provisionTopics?: boolean | undefined;
+                ssl?: boolean | undefined;
+                sasl?: {
+                    mechanism: "" | "aws-iam" | "oauthbearer" | "scram-sha-256" | "scram-sha-512" | "plain";
+                    username?: string | undefined;
+                    password?: string | undefined;
+                    region?: string | undefined;
+                    existingSecret?: string | undefined;
+                } | undefined;
+                identity?: {
+                    awsRoleArn?: string | undefined;
+                    gcpServiceAccountEmail?: string | undefined;
+                    azureClientId?: string | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+        postgres?: {
+            mode: "embedded" | "external";
+            external?: {
+                provider?: "aws" | "azure" | undefined;
+                host?: string | undefined;
+                port?: number | undefined;
+                database?: string | undefined;
+                bootstrap?: {
+                    enabled?: boolean | undefined;
+                    masterUsername?: string | undefined;
+                    masterPassword?: string | undefined;
+                    secretRef?: string | undefined;
+                    appRole?: string | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    } | undefined;
+    backup?: {
+        enabled: boolean;
+        schedule: string;
+        retentionDays: number;
+    } | undefined;
+    imageRegistry?: string | undefined;
     chartVersion?: string | undefined;
 }>;
 export type DeploymentConfig = z.infer<typeof DeploymentConfigSchema>;
@@ -582,10 +2545,8 @@ export interface DeploymentState {
         clusterEndpoint?: string;
     };
     application?: {
-        /** App image version */
-        appVersion: string;
-        /** HPS image version */
-        hpsVersion: string;
+        /** Unified Rulebricks product version */
+        version: string;
         /** Legacy chart version (deprecated) */
         chartVersion?: string;
         namespace: string;
@@ -606,21 +2567,17 @@ export interface ChartVersion {
     digest: string;
 }
 export interface AppVersion {
-    /** App image version (e.g., "1.5.0") */
+    /** Product image version (e.g., "1.5.0") */
     version: string;
     /** Release date ISO string */
     releaseDate: string;
-    /** Matched HPS version (latest HPS released on or before app release) */
-    hpsVersion: string | null;
     /** Image digest */
     digest: string;
+    /** HPS server image digests for this version */
+    hpsDigests?: string[];
+    /** HPS worker image digests for this version */
+    hpsWorkerDigests?: string[];
 }
-export interface WizardStep {
-    id: string;
-    title: string;
-    description: string;
-}
-export declare const WIZARD_STEPS: WizardStep[];
 export interface DNSRecord {
     hostname: string;
     type: "A" | "CNAME";
@@ -645,9 +2602,74 @@ export declare const ProfileConfigSchema: z.ZodObject<{
     smtpFromName: z.ZodOptional<z.ZodString>;
     openaiApiKey: z.ZodOptional<z.ZodString>;
     licenseKey: z.ZodOptional<z.ZodString>;
-    tier: z.ZodOptional<z.ZodEnum<["small", "medium", "large"]>>;
     databaseType: z.ZodOptional<z.ZodEnum<["self-hosted", "supabase-cloud"]>>;
-    infrastructureMode: z.ZodOptional<z.ZodEnum<["existing", "provision"]>>;
+    storage: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodEnum<["s3", "azure-blob", "gcs"]>;
+        cloudAuthMode: z.ZodOptional<z.ZodEnum<["workload-identity", "secret"]>>;
+        bucket: z.ZodOptional<z.ZodString>;
+        region: z.ZodOptional<z.ZodString>;
+        awsIamRoleArn: z.ZodOptional<z.ZodString>;
+        azureBlobClientId: z.ZodOptional<z.ZodString>;
+        azureBlobTenantId: z.ZodOptional<z.ZodString>;
+        azureBlobConnectionStringSecretRef: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            key: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            key: string;
+        }, {
+            name: string;
+            key: string;
+        }>>;
+        azureBlobContainer: z.ZodOptional<z.ZodString>;
+        gcpServiceAccountEmail: z.ZodOptional<z.ZodString>;
+        paths: z.ZodOptional<z.ZodObject<{
+            decisionLogs: z.ZodOptional<z.ZodString>;
+            dbBackups: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            decisionLogs?: string | undefined;
+            dbBackups?: string | undefined;
+        }, {
+            decisionLogs?: string | undefined;
+            dbBackups?: string | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        provider: "s3" | "azure-blob" | "gcs";
+        region?: string | undefined;
+        cloudAuthMode?: "workload-identity" | "secret" | undefined;
+        bucket?: string | undefined;
+        awsIamRoleArn?: string | undefined;
+        azureBlobClientId?: string | undefined;
+        azureBlobTenantId?: string | undefined;
+        azureBlobConnectionStringSecretRef?: {
+            name: string;
+            key: string;
+        } | undefined;
+        azureBlobContainer?: string | undefined;
+        gcpServiceAccountEmail?: string | undefined;
+        paths?: {
+            decisionLogs?: string | undefined;
+            dbBackups?: string | undefined;
+        } | undefined;
+    }, {
+        provider: "s3" | "azure-blob" | "gcs";
+        region?: string | undefined;
+        cloudAuthMode?: "workload-identity" | "secret" | undefined;
+        bucket?: string | undefined;
+        awsIamRoleArn?: string | undefined;
+        azureBlobClientId?: string | undefined;
+        azureBlobTenantId?: string | undefined;
+        azureBlobConnectionStringSecretRef?: {
+            name: string;
+            key: string;
+        } | undefined;
+        azureBlobContainer?: string | undefined;
+        gcpServiceAccountEmail?: string | undefined;
+        paths?: {
+            decisionLogs?: string | undefined;
+            dbBackups?: string | undefined;
+        } | undefined;
+    }>>;
     ssoProvider: z.ZodOptional<z.ZodEnum<["azure", "google", "okta", "keycloak", "ory", "other"]>>;
     ssoUrl: z.ZodOptional<z.ZodString>;
     ssoClientId: z.ZodOptional<z.ZodString>;
@@ -658,7 +2680,25 @@ export declare const ProfileConfigSchema: z.ZodObject<{
     clusterName?: string | undefined;
     adminEmail?: string | undefined;
     tlsEmail?: string | undefined;
-    tier?: "small" | "medium" | "large" | undefined;
+    storage?: {
+        provider: "s3" | "azure-blob" | "gcs";
+        region?: string | undefined;
+        cloudAuthMode?: "workload-identity" | "secret" | undefined;
+        bucket?: string | undefined;
+        awsIamRoleArn?: string | undefined;
+        azureBlobClientId?: string | undefined;
+        azureBlobTenantId?: string | undefined;
+        azureBlobConnectionStringSecretRef?: {
+            name: string;
+            key: string;
+        } | undefined;
+        azureBlobContainer?: string | undefined;
+        gcpServiceAccountEmail?: string | undefined;
+        paths?: {
+            decisionLogs?: string | undefined;
+            dbBackups?: string | undefined;
+        } | undefined;
+    } | undefined;
     openaiApiKey?: string | undefined;
     licenseKey?: string | undefined;
     domainSuffix?: string | undefined;
@@ -670,7 +2710,6 @@ export declare const ProfileConfigSchema: z.ZodObject<{
     smtpFrom?: string | undefined;
     smtpFromName?: string | undefined;
     databaseType?: "self-hosted" | "supabase-cloud" | undefined;
-    infrastructureMode?: "existing" | "provision" | undefined;
     ssoProvider?: "azure" | "google" | "okta" | "keycloak" | "ory" | "other" | undefined;
     ssoUrl?: string | undefined;
     ssoClientId?: string | undefined;
@@ -681,7 +2720,25 @@ export declare const ProfileConfigSchema: z.ZodObject<{
     clusterName?: string | undefined;
     adminEmail?: string | undefined;
     tlsEmail?: string | undefined;
-    tier?: "small" | "medium" | "large" | undefined;
+    storage?: {
+        provider: "s3" | "azure-blob" | "gcs";
+        region?: string | undefined;
+        cloudAuthMode?: "workload-identity" | "secret" | undefined;
+        bucket?: string | undefined;
+        awsIamRoleArn?: string | undefined;
+        azureBlobClientId?: string | undefined;
+        azureBlobTenantId?: string | undefined;
+        azureBlobConnectionStringSecretRef?: {
+            name: string;
+            key: string;
+        } | undefined;
+        azureBlobContainer?: string | undefined;
+        gcpServiceAccountEmail?: string | undefined;
+        paths?: {
+            decisionLogs?: string | undefined;
+            dbBackups?: string | undefined;
+        } | undefined;
+    } | undefined;
     openaiApiKey?: string | undefined;
     licenseKey?: string | undefined;
     domainSuffix?: string | undefined;
@@ -693,7 +2750,6 @@ export declare const ProfileConfigSchema: z.ZodObject<{
     smtpFrom?: string | undefined;
     smtpFromName?: string | undefined;
     databaseType?: "self-hosted" | "supabase-cloud" | undefined;
-    infrastructureMode?: "existing" | "provision" | undefined;
     ssoProvider?: "azure" | "google" | "okta" | "keycloak" | "ory" | "other" | undefined;
     ssoUrl?: string | undefined;
     ssoClientId?: string | undefined;
@@ -806,3 +2862,4 @@ export declare const THROUGHPUT_PRESETS: Record<Exclude<BenchmarkPreset, "custom
 }>;
 /** Cloud URLs that should be blocked from benchmarking */
 export declare const BLOCKED_BENCHMARK_DOMAINS: string[];
+export {};