@alienplatform/core 2.0.2 → 2.1.1

package/dist/index.js

@@ -1219,6 +1219,49 @@ const AwsDynamoDbKvHeartbeatDataSchema = z$2.object({
 	"ttlStatus": z$2.string().nullish()
 });
 //#endregion
+//#region src/generated/zod/aws-email-dkim-token-import-data-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description A single Easy-DKIM CNAME record.
+*/
+const AwsEmailDkimTokenImportDataSchema = z$2.object({
+	"name": z$2.string().describe("CNAME record host name."),
+	"value": z$2.string().describe("CNAME record value.")
+}).describe("A single Easy-DKIM CNAME record.");
+//#endregion
+//#region src/generated/zod/aws-email-domain-import-data-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Per-domain import payload for an AWS Email resource.
+*/
+const AwsEmailDomainImportDataSchema = z$2.object({ get "dkimTokens"() {
+	return z$2.array(AwsEmailDkimTokenImportDataSchema.describe("A single Easy-DKIM CNAME record.")).describe("Easy-DKIM CNAME tokens (three per domain). The domain is verified by\nSES once these records exist in its DNS configuration.");
+} }).describe("Per-domain import payload for an AWS Email resource.");
+z$2.object({
+	"configurationSet": z$2.string().describe("SES configuration set name (used when sending)."),
+	"domains": z$2.object({}).catchall(z$2.lazy(() => AwsEmailDomainImportDataSchema).describe("Per-domain import payload for an AWS Email resource.")).describe("Per-seed-domain DNS data, keyed by mail domain."),
+	"ruleSetName": z$2.string().describe("SES receipt rule set name, present only when inbound mail is\nconfigured. Activating the rule set is a manual post-deploy step.").nullish()
+}).describe("AWS Email ImportData.\n\nMirrors the `emit_import_ref` payload of the AWS SES email emitter: the\nshared configuration set name, one entry per seed domain carrying its\nEasy-DKIM CNAME records, and — when inbound mail is configured — the\nreceipt rule set name. Identities created at runtime through the\n`email/manage-identities` grant are application data and never appear\nhere.");
+//#endregion
+//#region src/generated/zod/aws-failure-domain-subnets-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description AWS subnets grouped by their real availability zone.
+*/
+const AwsFailureDomainSubnetsSchema = z$2.object({
+	"privateSubnetIds": z$2.optional(z$2.array(z$2.string()).describe("Private subnet IDs in this availability zone.")),
+	"publicSubnetIds": z$2.optional(z$2.array(z$2.string()).describe("Public subnet IDs in this availability zone."))
+}).describe("AWS subnets grouped by their real availability zone.");
+//#endregion
 //#region src/generated/zod/service-account-heartbeat-status-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -1342,9 +1385,45 @@ const AwsNetworkImportDataSchema = z$2.object({
 	"publicRouteTableId": z$2.string().describe("Public route table ID.").nullish(),
 	"publicSubnetIds": z$2.array(z$2.string()).describe("Public subnet IDs."),
 	"securityGroupId": z$2.string().describe("Security group ID for private workloads.").nullish(),
+	"subnetsByFailureDomain": z$2.optional(z$2.object({}).catchall(z$2.lazy(() => AwsFailureDomainSubnetsSchema).describe("AWS subnets grouped by their real availability zone.")).describe("Exact subnet membership keyed by real availability zone.")),
 	"vpcId": z$2.string().describe("VPC ID. Absent when default-VPC mode defers lookup to AWS at runtime.").nullish()
 }).describe("AWS Network ImportData.");
 //#endregion
+//#region src/generated/zod/aws-open-search-collection-type-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Workload type for an OpenSearch Serverless collection.\n\n`TIMESERIES` is intentionally not exposed: next-generation serverless\nscale-to-zero targets search and vector workloads.
+*/
+const AwsOpenSearchCollectionTypeSchema = z$2.enum(["search", "vectorSearch"]).describe("Workload type for an OpenSearch Serverless collection.\n\n`TIMESERIES` is intentionally not exposed: next-generation serverless\nscale-to-zero targets search and vector workloads.");
+z$2.object({
+	"collectionArn": z$2.string().describe("ARN of the collection."),
+	"collectionId": z$2.string().describe("Server-assigned collection id."),
+	"collectionName": z$2.string().describe("Physical collection name (`{id}-{stack-suffix}`)."),
+	"endpoint": z$2.string().describe("Collection endpoint (`https://<collectionId>.aoss.<region>.on.aws`).\nRequests must be SigV4-signed with service name `aoss`.")
+}).describe("AWS OpenSearch (`experimental/aws-opensearch`) ImportData.\n\nMirrors the `emit_import_ref` payload of the AWS OpenSearch Serverless\nemitter. Next-generation collections expose no Dashboards endpoint, so\nonly the data-plane endpoint and identifiers are carried.");
+z$2.object({
+	"collectionArn": z$2.string().describe("ARN of the collection."),
+	"endpoint": z$2.string().describe("Collection endpoint (`https://<collectionId>.aoss.<region>.on.aws`).\nRequests must be SigV4-signed with service name `aoss`.")
+}).describe("Outputs generated by a successfully provisioned AwsOpenSearch collection.\n\nNext-generation collections expose no OpenSearch Dashboards endpoint\n(the `DashboardEndpoint` attribute exists only for classic collections),\nso only the data-plane endpoint and ARN are surfaced.");
+//#endregion
+//#region src/generated/zod/aws-open-search-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description An Amazon OpenSearch Serverless collection (next generation).\n\n# Experimental namespace\n\nThis is the first resource under the `experimental/` resource-type\nnamespace. Experimental resources are provider-specific (they do not\nabstract over clouds), may change or be promoted to a portable resource\nin a breaking way, and are only registered for the platforms they\nsupport. `AwsOpenSearch` registers an AWS CloudFormation emitter only;\ndeploying it to any other platform fails with a typed\n`ImportRegistrationMissing` error at generation time.\n\n# What gets provisioned\n\nThe AWS emitter provisions next-generation OpenSearch Serverless:\na collection group (`Generation: NEXTGEN`, compute/storage decoupled,\nscale-to-zero) plus a collection inside it, an AWS-owned-key encryption\nconfiguration, a public network policy, and a data-access policy for\nservice-account roles granted `experimental/aws-opensearch/data-access`.\nThe collection endpoint is public but every request must be SigV4-signed\nand pass both IAM (`aoss:APIAccessAll`) and the data-access policy.\n\n# Naming\n\nThe physical collection (and collection group) name is\n`{id}-{stack-suffix}` and must satisfy the AOSS name grammar, so `id`\nmust match `[a-z][a-z0-9-]*` and be at most 23 characters. The emitter\nrejects ids that don\'t fit.\n\n# Runtime access\n\nWorkers reach the collection over HTTPS with SigV4. The SigV4 signing\nservice name for OpenSearch Serverless is `aoss` (not `es`); the runtime\nbinding payload carries `\"service\": \"aoss\"` so clients sign correctly.\nRequests with a body must also send an `x-amz-content-sha256` header\n(the AOSS gateway rejects body-carrying requests without it with an\nempty 403); official OpenSearch clients with an `aoss` signer handle\nthis automatically.
+*/
+const AwsOpenSearchSchema = z$2.object({
+	get "collectionType"() {
+		return AwsOpenSearchCollectionTypeSchema.describe("Workload type for an OpenSearch Serverless collection.\n\n`TIMESERIES` is intentionally not exposed: next-generation serverless\nscale-to-zero targets search and vector workloads.").optional();
+	},
+	"id": z$2.string().describe("Identifier for the collection. Becomes part of the physical collection\nname, so it must match `[a-z][a-z0-9-]*` and be at most 23 characters.")
+}).describe("An Amazon OpenSearch Serverless collection (next generation).\n\n# Experimental namespace\n\nThis is the first resource under the `experimental/` resource-type\nnamespace. Experimental resources are provider-specific (they do not\nabstract over clouds), may change or be promoted to a portable resource\nin a breaking way, and are only registered for the platforms they\nsupport. `AwsOpenSearch` registers an AWS CloudFormation emitter only;\ndeploying it to any other platform fails with a typed\n`ImportRegistrationMissing` error at generation time.\n\n# What gets provisioned\n\nThe AWS emitter provisions next-generation OpenSearch Serverless:\na collection group (`Generation: NEXTGEN`, compute/storage decoupled,\nscale-to-zero) plus a collection inside it, an AWS-owned-key encryption\nconfiguration, a public network policy, and a data-access policy for\nservice-account roles granted `experimental/aws-opensearch/data-access`.\nThe collection endpoint is public but every request must be SigV4-signed\nand pass both IAM (`aoss:APIAccessAll`) and the data-access policy.\n\n# Naming\n\nThe physical collection (and collection group) name is\n`{id}-{stack-suffix}` and must satisfy the AOSS name grammar, so `id`\nmust match `[a-z][a-z0-9-]*` and be at most 23 characters. The emitter\nrejects ids that don't fit.\n\n# Runtime access\n\nWorkers reach the collection over HTTPS with SigV4. The SigV4 signing\nservice name for OpenSearch Serverless is `aoss` (not `es`); the runtime\nbinding payload carries `\"service\": \"aoss\"` so clients sign correctly.\nRequests with a body must also send an `x-amz-content-sha256` header\n(the AOSS gateway rejects body-carrying requests without it with an\nempty 403); official OpenSearch clients with an `aoss` signer handle\nthis automatically.");
+//#endregion
 //#region src/generated/zod/vault-heartbeat-status-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -1843,6 +1922,7 @@ const AzureComputeClusterHeartbeatDataSchema = z$2.object({
 const AzureComputeClusterImportDataSchema = z$2.object({
 	"clusterId": z$2.string().describe("Cluster identifier used by the controller."),
 	"clusterIdentityPrincipalId": z$2.string().describe("AKS cluster identity principal id (system-assigned identity)."),
+	"identityId": z$2.string().describe("Resource ID of the user-assigned identity attached to cluster VMs."),
 	"kubeletIdentityClientId": z$2.string().describe("kubelet UAMI client id used by node pools.")
 }).describe("Azure ComputeCluster ImportData — AKS node pool identity / network.");
 //#endregion
@@ -3228,9 +3308,24 @@ const ComputeClusterSchema = z$2.object({
 		return z$2.array(CapacityGroupSchema.describe("Capacity group definition.\n\nA capacity group represents machines with identical hardware profiles.\nEach group becomes a separate Auto Scaling Group (AWS), Managed Instance Group (GCP),\nor VM Scale Set (Azure).")).describe("Capacity groups defining the machine pools for this cluster.\nEach group becomes a separate ASG/MIG/VMSS.");
 	},
 	"containerCidr": z$2.string().describe("Container CIDR block for internal container networking.\nAuto-generated as \"10.244.0.0/16\" if not specified.\nEach machine gets a /24 subnet from this range.").nullish(),
-	"id": z$2.string().describe("Unique identifier for the container cluster.\nMust contain only alphanumeric characters, hyphens, and underscores.")
+	"failureDomainSpread": z$2.optional(z$2.object({}).catchall(z$2.int().min(0)).describe("Requested failure-domain spread keyed by capacity group.\nEmpty preserves the existing aggregate layout.")),
+	"id": z$2.string().describe("Unique identifier for the container cluster.\nMust contain only alphanumeric characters, hyphens, and underscores."),
+	"selectedFailureDomains": z$2.optional(z$2.object({}).catchall(z$2.array(z$2.string())).describe("Concrete provider failure domains selected during setup, keyed by capacity group.\nEmpty preserves the existing aggregate layout when no spread policy is configured."))
 }).describe("ComputeCluster resource for running long-running container workloads.\n\nA ComputeCluster provides the setup-owned machine boundary for containers.\nAlien may manage the worker fleet inside that boundary when setup grants\n`compute-cluster/management`.\n\n## Architecture\n\n- **Setup** creates cloud resources: ASGs/MIGs/VMSSs, IAM roles, security groups\n- **Alien** manages allowed fleet operations: machine count and runtime\n  machine image rollout\n- A node agent runs on each machine from the selected runtime image channel\n\n## Example\n\n```rust\nuse alien_core::{CapacityGroup, ComputeCluster, MachineProfile};\n\nlet cluster = ComputeCluster::new(\"compute\".to_string())\n    .capacity_group(CapacityGroup {\n        group_id: \"general\".to_string(),\n        instance_type: None,\n        profile: Some(MachineProfile {\n            cpu: \"4.0\".to_string(),\n            memory_bytes: 16 * 1024 * 1024 * 1024,\n            ephemeral_storage_bytes: 20 * 1024 * 1024 * 1024,\n            architecture: None,\n            gpu: None,\n        }),\n        min_size: 1,\n        max_size: 5,\n        scale_policy: None,\n        nested_virtualization: None,\n    })\n    .build();\n```");
 //#endregion
+//#region src/generated/zod/failure-domain-selection-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Failure-domain policy selected for a compute pool.
+*/
+const FailureDomainSelectionSchema = z$2.object({
+	"selectedFailureDomains": z$2.optional(z$2.array(z$2.string()).describe("Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation.")),
+	"spread": z$2.int().min(0).describe("Number of distinct failure domains across which new stateful replicas may be spread.")
+}).describe("Failure-domain policy selected for a compute pool.");
+//#endregion
 //#region src/generated/zod/compute-pool-selection-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -3240,10 +3335,16 @@ const ComputeClusterSchema = z$2.object({
 * @description User-selected deployment settings for one compute pool.
 */
 const ComputePoolSelectionSchema = z$2.union([z$2.object({
+	get "failure_domains"() {
+		return z$2.union([FailureDomainSelectionSchema, z$2.null()]).optional();
+	},
 	"machine": z$2.string().describe("Provider machine type selected for this deployment.").nullish(),
 	"machines": z$2.int().min(0).describe("Number of machines to run."),
 	"mode": z$2.enum(["fixed"])
 }), z$2.object({
+	get "failure_domains"() {
+		return z$2.union([FailureDomainSelectionSchema, z$2.null()]).optional();
+	},
 	"machine": z$2.string().describe("Provider machine type selected for this deployment.").nullish(),
 	"max": z$2.int().min(0).describe("Maximum machine count."),
 	"min": z$2.int().min(0).describe("Minimum machine count."),
@@ -3634,6 +3735,16 @@ const ContainerStatusSchema = z$2.enum([
 	"failing"
 ]).describe("Container status in the managed container backend.");
 //#endregion
+//#region src/generated/zod/expose-protocol-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Protocol for public workload endpoints.
+*/
+const ExposeProtocolSchema = z$2.enum(["http", "tcp"]).describe("Protocol for public workload endpoints.");
+//#endregion
 //#region src/generated/zod/load-balancer-endpoint-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -3660,6 +3771,10 @@ const PublicEndpointOutputSchema = z$2.object({
 	get "loadBalancerEndpoint"() {
 		return z$2.union([LoadBalancerEndpointSchema, z$2.null()]).optional();
 	},
+	"port": z$2.int().min(1).max(65535).describe("Public connection port."),
+	get "protocol"() {
+		return ExposeProtocolSchema.describe("Protocol for public workload endpoints.");
+	},
 	"url": z$2.string().describe("Base URL for this endpoint."),
 	"wildcardHost": z$2.string().describe("Wildcard hostname routed to this endpoint, when configured.").nullish()
 }).describe("Runtime-resolved public endpoint metadata.");
@@ -3741,16 +3856,6 @@ const PersistentStorageSchema = z$2.object({
 	"size": z$2.string().describe("Storage size (e.g., \"100Gi\", \"500Gi\")")
 }).describe("Persistent storage configuration for stateful containers.");
 //#endregion
-//#region src/generated/zod/expose-protocol-schema.ts
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
-/**
-* @description Protocol for public workload endpoints.
-*/
-const ExposeProtocolSchema = z$2.enum(["http", "tcp"]).describe("Protocol for public workload endpoints.");
-//#endregion
 //#region src/generated/zod/public-endpoint-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -4254,6 +4359,79 @@ const DomainSettingsSchema = z$2.object({
 	}
 }).describe("Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains.");
 //#endregion
+//#region src/generated/zod/email-dkim-token-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description A single DKIM CNAME record the operator must create in DNS.
+*/
+const EmailDkimTokenSchema = z$2.object({
+	"name": z$2.string().describe("CNAME record host name."),
+	"value": z$2.string().describe("CNAME record value.")
+}).describe("A single DKIM CNAME record the operator must create in DNS.");
+//#endregion
+//#region src/generated/zod/email-domain-outputs-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Per-domain DNS records the operator must create.
+*/
+const EmailDomainOutputsSchema = z$2.object({ get "dkimTokens"() {
+	return z$2.array(EmailDkimTokenSchema.describe("A single DKIM CNAME record the operator must create in DNS.")).describe("Easy-DKIM CNAME tokens (three per domain). The domain is verified once\nthese records exist in its DNS configuration.");
+} }).describe("Per-domain DNS records the operator must create.");
+//#endregion
+//#region src/generated/zod/email-events-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Sending-event configuration for an [`Email`] resource.
+*/
+const EmailEventsSchema = z$2.object({ get "queue"() {
+	return ResourceRefSchema.describe("Reference to a resource by its stable id and resource type.");
+} }).describe("Sending-event configuration for an [`Email`] resource.");
+//#endregion
+//#region src/generated/zod/email-inbound-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Inbound-mail configuration for an [`Email`] resource.
+*/
+const EmailInboundSchema = z$2.object({ get "storage"() {
+	return ResourceRefSchema.describe("Reference to a resource by its stable id and resource type.");
+} }).describe("Inbound-mail configuration for an [`Email`] resource.");
+z$2.object({
+	"configurationSet": z$2.string().describe("The provisioned configuration set name (used when sending)."),
+	"domains": z$2.object({}).catchall(z$2.lazy(() => EmailDomainOutputsSchema).describe("Per-domain DNS records the operator must create.")).describe("DNS records per mail domain."),
+	"ruleSetName": z$2.string().describe("The inbound receipt rule set name, when `inbound` is configured.\nActivating it is a manual post-deploy step — CloudFormation cannot\nactivate a receipt rule set, and only one can be active per account.").nullish()
+}).describe("Outputs generated by a successfully provisioned Email resource.\n\nDomain verification status cannot be known at provisioning time — SES\nverifies a domain asynchronously once its DKIM records exist in DNS — so\nthe outputs carry the records the operator must create rather than a\nverification result.");
+//#endregion
+//#region src/generated/zod/email-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change. Two caveats apply:\n\n* SES allows only **one active receipt rule set per AWS account**, and\n  CloudFormation has no resource that activates a rule set. Activating the\n  provisioned rule set is a documented post-deploy step:\n  `aws ses set-active-receipt-rule-set --rule-set-name <ruleSetName>`.\n* SES email receiving is only available in a subset of AWS regions (see the\n  SES endpoints documentation). Deploying `inbound` to an unsupported\n  region fails at the CloudFormation layer.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.
+*/
+const EmailSchema = z$2.object({
+	"domains": z$2.optional(z$2.array(z$2.string()).describe("Seed mail domains provisioned at deploy time (one SES identity each).\nUseful for day-0 bootstrap and products with a static domain set.\nMay be empty (the default): products that create and verify domains\ndynamically should manage identities at runtime through the\n`email/manage-identities` grant instead of listing them here.")),
+	get "events"() {
+		return z$2.union([EmailEventsSchema, z$2.null()]).optional();
+	},
+	"id": z$2.string().describe("Identifier for the email resource. Must contain only alphanumeric\ncharacters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."),
+	get "inbound"() {
+		return z$2.union([EmailInboundSchema, z$2.null()]).optional();
+	}
+}).describe("Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change. Two caveats apply:\n\n* SES allows only **one active receipt rule set per AWS account**, and\n  CloudFormation has no resource that activates a rule set. Activating the\n  provisioned rule set is a documented post-deploy step:\n  `aws ses set-active-receipt-rule-set --rule-set-name <ruleSetName>`.\n* SES email receiving is only available in a subset of AWS regions (see the\n  SES endpoints documentation). Deploying `inbound` to an unsupported\n  region fails at the CloudFormation layer.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.");
+//#endregion
 //#region src/generated/zod/response-handling-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -7967,6 +8145,99 @@ var Queue = class {
 	}
 };
 //#endregion
+//#region src/email.ts
+/**
+* Email infrastructure for sending and receiving mail on customer-owned
+* domains (AWS SES). Provisions a shared configuration set, optional inbound
+* and event wiring, and one email identity (Easy DKIM) per seed domain.
+*
+* The resource owns the email infrastructure, not the domain lifecycle. Seed
+* domains are optional: products that create and verify domains dynamically
+* should manage identities at runtime through the `email/manage-identities`
+* grant instead of listing them here. Runtime-created identities are
+* application data — they are not tracked by the deployment and survive stack
+* deletion.
+*
+* After deployment, create the per-domain DKIM CNAME records from the
+* resource outputs — SES verifies each domain once the records exist in DNS.
+*
+* When inbound mail is configured, the receipt rule is a catch-all (no
+* recipient filter), so mail for runtime-verified identities lands in the
+* bucket without redeployment. The provisioned SES receipt rule set must be
+* activated manually after deployment (only one receipt rule set can be
+* active per AWS account, and CloudFormation cannot activate one):
+* `aws ses set-active-receipt-rule-set --rule-set-name <ruleSetName>`.
+*/
+var Email = class {
+	_config = { domains: [] };
+	/**
+	* Creates a new Email builder.
+	* @param id Identifier for the email resource. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+	*/
+	constructor(id) {
+		this._config.id = id;
+	}
+	/**
+	* Returns a ResourceType representing any email resource.
+	* Used for creating permission targets that apply to all email resources.
+	* @returns The "email" resource type.
+	*/
+	static any() {
+		return "email";
+	}
+	/**
+	* Sets the seed mail domains provisioned at deploy time (one SES identity
+	* each). Optional — omit for products that manage domains at runtime.
+	* @param domains The mail domains (e.g. `["mail.example.com"]`).
+	* @returns The Email builder instance.
+	*/
+	domains(domains) {
+		this._config.domains = domains;
+		return this;
+	}
+	/**
+	* Adds a single seed mail domain.
+	* @param domain The mail domain (e.g. `"mail.example.com"`).
+	* @returns The Email builder instance.
+	*/
+	domain(domain) {
+		this._config.domains = [...this._config.domains ?? [], domain];
+		return this;
+	}
+	/**
+	* Configures inbound mail: raw incoming mail for the configured domains is
+	* written to the linked Storage bucket. Note the post-deploy activation
+	* step described in the class documentation.
+	* @param storage The Storage resource that receives raw incoming mail.
+	* @returns The Email builder instance.
+	*/
+	inbound(storage) {
+		this._config.inbound = { storage: storage.ref() };
+		return this;
+	}
+	/**
+	* Configures sending events: send / delivery / bounce / complaint /
+	* delivery-delay / reject events are delivered to the linked Queue.
+	* @param queue The Queue resource that receives sending events.
+	* @returns The Email builder instance.
+	*/
+	events(queue) {
+		this._config.events = { queue: queue.ref() };
+		return this;
+	}
+	/**
+	* Builds and validates the email configuration.
+	* @returns An immutable Resource representing the configured email infrastructure.
+	* @throws Error if the email configuration is invalid.
+	*/
+	build() {
+		return new Resource({
+			type: "email",
+			...EmailSchema.parse(this._config)
+		});
+	}
+};
+//#endregion
 //#region src/service-account.ts
 /**
 * Represents a non-human identity that can be assumed by compute services.
@@ -8936,6 +9207,69 @@ function getResourceOutputs(params) {
 	return outputs.data;
 }
 //#endregion
-export { AgentStatusSchema, AlienError, AlienErrorSchema as AlienErrorOptionsSchema, AlienEventSchema, ArtifactRegistry, ArtifactRegistrySchema as ArtifactRegistryConfigSchema, ArtifactRegistryHeartbeatDataSchema, ArtifactRegistryHeartbeatStatusSchema, AwsArtifactRegistryImportDataSchema, AwsBuildImportDataSchema, AwsCodeBuildHeartbeatDataSchema, AwsComputeClusterHeartbeatDataSchema, AwsComputeClusterImportDataSchema, AwsDynamoDbKeySchemaElementSchema, AwsDynamoDbKvHeartbeatDataSchema, AwsEcrArtifactRegistryHeartbeatDataSchema, AwsEcrRepositoryHeartbeatDataSchema, AwsIamRoleServiceAccountHeartbeatDataSchema, AwsKvImportDataSchema, AwsLambdaWorkerHeartbeatDataSchema, AwsNetworkImportDataSchema, AwsParameterStoreVaultHeartbeatDataSchema, AwsQueueImportDataSchema, AwsRemoteStackManagementHeartbeatDataSchema, AwsRemoteStackManagementImportDataSchema, AwsS3StorageHeartbeatDataSchema, AwsServiceAccountImportDataSchema, AwsSqsQueueHeartbeatDataSchema, AwsStorageImportDataSchema, AwsVaultImportDataSchema, AwsVpcNetworkHeartbeatDataSchema, AwsWorkerImportDataSchema, AzureArtifactRegistryImportDataSchema, AzureBlobStorageHeartbeatDataSchema, AzureBuildImportDataSchema, AzureComputeClusterHeartbeatDataSchema, AzureComputeClusterImportDataSchema, AzureContainerAppsBuildHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatStatusSchema, AzureContainerAppsEnvironmentImportDataSchema, AzureContainerAppsEnvironmentWorkloadProfileSchema, AzureContainerAppsWorkerHeartbeatDataSchema, AzureContainerRegistryHeartbeatDataSchema, AzureKeyVaultHeartbeatDataSchema, AzureKvImportDataSchema, AzureManagedIdentityServiceAccountHeartbeatDataSchema, AzureNetworkImportDataSchema, AzureQueueImportDataSchema, AzureRemoteStackManagementHeartbeatDataSchema, AzureRemoteStackManagementImportDataSchema, AzureResourceGroupHeartbeatDataSchema, AzureResourceGroupHeartbeatStatusSchema, AzureResourceGroupImportDataSchema, AzureResourceProviderActivationHeartbeatDataSchema, AzureServiceAccountImportDataSchema, AzureServiceActivationImportDataSchema, AzureServiceBusNamespaceHeartbeatDataSchema, AzureServiceBusNamespaceImportDataSchema, AzureServiceBusQueueHeartbeatDataSchema, AzureStorageAccountEndpointsSchema, AzureStorageAccountHeartbeatDataSchema, AzureStorageAccountImportDataSchema, AzureStorageImportDataSchema, AzureTableKvHeartbeatDataSchema, AzureVaultImportDataSchema, AzureVnetNetworkHeartbeatDataSchema, AzureWorkerImportDataSchema, BodySpecSchema, Build, BuildConfigSchema, BuildHeartbeatDataSchema, BuildHeartbeatStatusSchema, BuildOutputsSchema, BuildStatusSchema, CapacityGroupScalePolicySchema, CapacityGroupSchema, CommandDeliveryModeSchema, CommandResponseSchema, CommandStateSchema, CommandStatusResponseSchema, CommandTargetSchema, CommandTargetTypeSchema, ComputeCapacityGroupStatusSchema, ComputeCapacityRecommendationSchema, ComputeChoiceRangeSchema, ComputeCluster, ComputeClusterSchema as ComputeClusterConfigSchema, ComputeClusterHeartbeatDataSchema, ComputeClusterHeartbeatStatusSchema, ComputeTypeSchema, Container, ContainerAutoscalingSchema, ContainerCodeSchema, ContainerSchema as ContainerConfigSchema, ContainerHeartbeatDataSchema, ContainerPortSchema, CreateCommandRequestSchema, CreateCommandResponseSchema, Daemon, DaemonCodeSchema, DaemonSchema as DaemonConfigSchema, DaemonHeartbeatDataSchema, DaemonOutputsSchema, DeploymentModelSchema, DevResourceInfoSchema, DevStatusSchema, DevStatusStateSchema, EnvelopeSchema, EventChangeSchema, EventStateSchema, ExposeProtocolSchema, GcpArtifactRegistryHeartbeatDataSchema, GcpArtifactRegistryImportDataSchema, GcpBuildImportDataSchema, GcpCloudBuildHeartbeatDataSchema, GcpCloudRunWorkerHeartbeatDataSchema, GcpCloudStorageHeartbeatDataSchema, GcpComputeClusterHeartbeatDataSchema, GcpComputeClusterImportDataSchema, GcpFirestoreKvHeartbeatDataSchema, GcpKvImportDataSchema, GcpNetworkImportDataSchema, GcpPubSubQueueHeartbeatDataSchema, GcpQueueImportDataSchema, GcpRemoteStackManagementHeartbeatDataSchema, GcpRemoteStackManagementImportDataSchema, GcpSecretManagerVaultHeartbeatDataSchema, GcpServiceAccountHeartbeatDataSchema, GcpServiceAccountImportDataSchema, GcpServiceActivationImportDataSchema, GcpServiceUsageActivationHeartbeatDataSchema, GcpStorageImportDataSchema, GcpVaultImportDataSchema, GcpVpcNetworkHeartbeatDataSchema, GcpWorkerImportDataSchema, HeartbeatBackendSchema, HeartbeatIssueSeveritySchema, HeartbeatsModeSchema, HorizonContainerHeartbeatDataSchema, HttpMethodSchema, KubernetesBuildHeartbeatDataSchema, KubernetesClusterNodeStatusSchema, KubernetesContainerHeartbeatDataSchema, KubernetesDaemonHeartbeatDataSchema, KubernetesEventInvolvedObjectSchema, KubernetesEventSnapshotSchema, KubernetesEventSourceSchema, KubernetesNodeConditionStatusSchema, KubernetesNodeResourcesSchema, KubernetesNodeUsageSchema, KubernetesPodRuntimeUnitStatusSchema, KubernetesSecretVaultHeartbeatDataSchema, KubernetesWorkerHeartbeatDataSchema, Kv, KvSchema as KvConfigSchema, KvHeartbeatDataSchema, KvHeartbeatStatusSchema, LeaseInfoSchema, LeaseRequestSchema, LeaseResponseSchema, LocalArtifactRegistryHeartbeatDataSchema, LocalComputeClusterHeartbeatDataSchema, LocalContainerHeartbeatDataSchema, LocalDaemonHeartbeatDataSchema, LocalKvHeartbeatDataSchema, LocalQueueHeartbeatDataSchema, LocalRuntimeEventSnapshotSchema, LocalRuntimeEventSubjectSchema, LocalRuntimeUnitKindSchema, LocalRuntimeUnitStatusSchema, LocalServiceAccountHeartbeatDataSchema, LocalStorageHeartbeatDataSchema, LocalVaultHeartbeatDataSchema, LocalWorkerHeartbeatDataSchema, MachineProfileSchema, ManagedRuntimeEventInvolvedObjectSchema, ManagedRuntimeEventSnapshotSchema, ManagedRuntimeEventSourceSchema, ManagedRuntimeUnitStatusSchema, MessagePayloadSchema, MetricSampleSchema, NetworkHeartbeatDataSchema, NetworkHeartbeatStatusSchema, ObservedCountsSchema, ObservedHealthSchema, ObservedInventoryBatchSchema, ObservedResourceSampleSchema, PermissionSetSchema, PlatformSchema, Postgres, PostgresSchema as PostgresConfigSchema, PresignedRequestBackendSchema, PresignedRequestSchema, ProviderFleetStatusSchema, ProviderLifecycleStateSchema, PublicEndpointSchema, Queue, QueueSchema as QueueConfigSchema, QueueHeartbeatDataSchema, QueueHeartbeatStatusSchema, QueueMessageSchema, ReadinessProbeSchema, ReleaseRequestSchema, RemoteStackManagementHeartbeatDataSchema, RemoteStackManagementHeartbeatStatusSchema, Resource, ResourceHeartbeatDataSchema, ResourceHeartbeatSchema, ResourceLifecycleSchema, ResourceNotFoundError, ResourceOutputsParseError, ResourceRefSchema, ResourceSchemaMapping, ResourceStatusSchema, ResourceTypeSchema, ResponseHandlingSchema, ScheduledEventSchema, ServiceAccount, ServiceAccountSchema as ServiceAccountConfigSchema, ServiceAccountHeartbeatDataSchema, ServiceAccountHeartbeatStatusSchema, ServiceAccountOutputsSchema, ServiceActivationHeartbeatDataSchema, ServiceActivationHeartbeatStatusSchema, Stack, StackInputDefaultValueSchema, StackInputDefinitionSchema, StackInputEnvironmentMappingSchema, StackInputEnvironmentVariableTypeSchema, StackInputKindSchema, StackInputProviderSchema, StackInputValidationSchema, StackResourceStateSchema, StackSchema, StackSettingsSchema, StackStateSchema, StackStatusSchema, Storage, StorageSchema as StorageConfigSchema, StorageEventSchema, StorageEventTypeSchema, StorageEventsSchema, StorageHeartbeatDataSchema, StorageHeartbeatStatusSchema, StorageUploadSchema, SubmitResponseRequestSchema, TelemetryModeSchema, TraceContextSchema, UnexpectedResourceTypeError, UpdatesModeSchema, UploadCompleteRequestSchema, UploadCompleteResponseSchema, Vault, VaultSchema as VaultConfigSchema, VaultHeartbeatDataSchema, VaultHeartbeatStatusSchema, Worker, WorkerSchema as WorkerConfigSchema, WorkerHeartbeatDataSchema, WorkerOutputsSchema, WorkerPublicEndpointSchema, WorkerTriggerSchema, WorkloadHeartbeatStatusSchema, WorkloadReplicaStatusSchema, defineBooleanInput as boolean, defineError, defineEnumInput as enum, getResourceOutputs, getStackInputDefinitions, inputs, defineIntegerInput as integer, defineNumberInput as number, defineSecretInput as secret, defineStringInput as string, defineStringListInput as stringList };
+//#region src/experimental/aws-opensearch.ts
+/**
+* An Amazon OpenSearch Serverless collection (next generation): compute and
+* storage are decoupled, the collection scales to zero, and it lives inside a
+* dedicated collection group.
+*
+* Experimental and AWS-only: deploying a stack containing this resource to any
+* other platform fails at template generation with a clear error.
+*
+* The collection endpoint is public but every request must be SigV4-signed
+* (signing service name `aoss`, not `es`, and body-carrying requests need an
+* `x-amz-content-sha256` header — official OpenSearch clients with an `aoss`
+* signer handle both) and pass both IAM and the collection's data-access
+* policy. Grant workers access with the
+* `experimental/aws-opensearch/data-access` permission set.
+*
+* The id becomes part of the physical collection name: it must start with a
+* lowercase letter, contain only lowercase letters, digits, and hyphens, and
+* be at most 23 characters.
+*/
+var AwsOpenSearch = class {
+	_config = { collectionType: "search" };
+	/**
+	* Creates a new AwsOpenSearch builder.
+	* @param id Identifier for the collection (lowercase letters, digits, and hyphens; max 23 characters).
+	*/
+	constructor(id) {
+		this._config.id = id;
+	}
+	/**
+	* Returns a ResourceType representing any AwsOpenSearch resource.
+	* Used for creating permission targets that apply to all AwsOpenSearch resources.
+	* @returns The "experimental/aws-opensearch" resource type.
+	*/
+	static any() {
+		return "experimental/aws-opensearch";
+	}
+	/**
+	* Sets the workload type of the collection ("search" | "vectorSearch").
+	* Immutable once the resource exists. Default `"search"`.
+	* @param value The collection type.
+	* @returns The AwsOpenSearch builder instance.
+	*/
+	collectionType(value) {
+		this._config.collectionType = value;
+		return this;
+	}
+	/**
+	* Builds and validates the collection configuration.
+	* @returns An immutable Resource representing the configured collection.
+	* @throws Error if the configuration is invalid.
+	*/
+	build() {
+		return new Resource({
+			type: "experimental/aws-opensearch",
+			...AwsOpenSearchSchema.parse(this._config)
+		});
+	}
+};
+//#endregion
+//#region src/index.ts
+const experimental = { AwsOpenSearch };
+//#endregion
+export { AgentStatusSchema, AlienError, AlienErrorSchema as AlienErrorOptionsSchema, AlienEventSchema, ArtifactRegistry, ArtifactRegistrySchema as ArtifactRegistryConfigSchema, ArtifactRegistryHeartbeatDataSchema, ArtifactRegistryHeartbeatStatusSchema, AwsArtifactRegistryImportDataSchema, AwsBuildImportDataSchema, AwsCodeBuildHeartbeatDataSchema, AwsComputeClusterHeartbeatDataSchema, AwsComputeClusterImportDataSchema, AwsDynamoDbKeySchemaElementSchema, AwsDynamoDbKvHeartbeatDataSchema, AwsEcrArtifactRegistryHeartbeatDataSchema, AwsEcrRepositoryHeartbeatDataSchema, AwsIamRoleServiceAccountHeartbeatDataSchema, AwsKvImportDataSchema, AwsLambdaWorkerHeartbeatDataSchema, AwsNetworkImportDataSchema, AwsParameterStoreVaultHeartbeatDataSchema, AwsQueueImportDataSchema, AwsRemoteStackManagementHeartbeatDataSchema, AwsRemoteStackManagementImportDataSchema, AwsS3StorageHeartbeatDataSchema, AwsServiceAccountImportDataSchema, AwsSqsQueueHeartbeatDataSchema, AwsStorageImportDataSchema, AwsVaultImportDataSchema, AwsVpcNetworkHeartbeatDataSchema, AwsWorkerImportDataSchema, AzureArtifactRegistryImportDataSchema, AzureBlobStorageHeartbeatDataSchema, AzureBuildImportDataSchema, AzureComputeClusterHeartbeatDataSchema, AzureComputeClusterImportDataSchema, AzureContainerAppsBuildHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatStatusSchema, AzureContainerAppsEnvironmentImportDataSchema, AzureContainerAppsEnvironmentWorkloadProfileSchema, AzureContainerAppsWorkerHeartbeatDataSchema, AzureContainerRegistryHeartbeatDataSchema, AzureKeyVaultHeartbeatDataSchema, AzureKvImportDataSchema, AzureManagedIdentityServiceAccountHeartbeatDataSchema, AzureNetworkImportDataSchema, AzureQueueImportDataSchema, AzureRemoteStackManagementHeartbeatDataSchema, AzureRemoteStackManagementImportDataSchema, AzureResourceGroupHeartbeatDataSchema, AzureResourceGroupHeartbeatStatusSchema, AzureResourceGroupImportDataSchema, AzureResourceProviderActivationHeartbeatDataSchema, AzureServiceAccountImportDataSchema, AzureServiceActivationImportDataSchema, AzureServiceBusNamespaceHeartbeatDataSchema, AzureServiceBusNamespaceImportDataSchema, AzureServiceBusQueueHeartbeatDataSchema, AzureStorageAccountEndpointsSchema, AzureStorageAccountHeartbeatDataSchema, AzureStorageAccountImportDataSchema, AzureStorageImportDataSchema, AzureTableKvHeartbeatDataSchema, AzureVaultImportDataSchema, AzureVnetNetworkHeartbeatDataSchema, AzureWorkerImportDataSchema, BodySpecSchema, Build, BuildConfigSchema, BuildHeartbeatDataSchema, BuildHeartbeatStatusSchema, BuildOutputsSchema, BuildStatusSchema, CapacityGroupScalePolicySchema, CapacityGroupSchema, CommandDeliveryModeSchema, CommandResponseSchema, CommandStateSchema, CommandStatusResponseSchema, CommandTargetSchema, CommandTargetTypeSchema, ComputeCapacityGroupStatusSchema, ComputeCapacityRecommendationSchema, ComputeChoiceRangeSchema, ComputeCluster, ComputeClusterSchema as ComputeClusterConfigSchema, ComputeClusterHeartbeatDataSchema, ComputeClusterHeartbeatStatusSchema, ComputeTypeSchema, Container, ContainerAutoscalingSchema, ContainerCodeSchema, ContainerSchema as ContainerConfigSchema, ContainerHeartbeatDataSchema, ContainerPortSchema, CreateCommandRequestSchema, CreateCommandResponseSchema, Daemon, DaemonCodeSchema, DaemonSchema as DaemonConfigSchema, DaemonHeartbeatDataSchema, DaemonOutputsSchema, DeploymentModelSchema, DevResourceInfoSchema, DevStatusSchema, DevStatusStateSchema, Email, EmailSchema as EmailConfigSchema, EnvelopeSchema, EventChangeSchema, EventStateSchema, ExposeProtocolSchema, GcpArtifactRegistryHeartbeatDataSchema, GcpArtifactRegistryImportDataSchema, GcpBuildImportDataSchema, GcpCloudBuildHeartbeatDataSchema, GcpCloudRunWorkerHeartbeatDataSchema, GcpCloudStorageHeartbeatDataSchema, GcpComputeClusterHeartbeatDataSchema, GcpComputeClusterImportDataSchema, GcpFirestoreKvHeartbeatDataSchema, GcpKvImportDataSchema, GcpNetworkImportDataSchema, GcpPubSubQueueHeartbeatDataSchema, GcpQueueImportDataSchema, GcpRemoteStackManagementHeartbeatDataSchema, GcpRemoteStackManagementImportDataSchema, GcpSecretManagerVaultHeartbeatDataSchema, GcpServiceAccountHeartbeatDataSchema, GcpServiceAccountImportDataSchema, GcpServiceActivationImportDataSchema, GcpServiceUsageActivationHeartbeatDataSchema, GcpStorageImportDataSchema, GcpVaultImportDataSchema, GcpVpcNetworkHeartbeatDataSchema, GcpWorkerImportDataSchema, HeartbeatBackendSchema, HeartbeatIssueSeveritySchema, HeartbeatsModeSchema, HorizonContainerHeartbeatDataSchema, HttpMethodSchema, KubernetesBuildHeartbeatDataSchema, KubernetesClusterNodeStatusSchema, KubernetesContainerHeartbeatDataSchema, KubernetesDaemonHeartbeatDataSchema, KubernetesEventInvolvedObjectSchema, KubernetesEventSnapshotSchema, KubernetesEventSourceSchema, KubernetesNodeConditionStatusSchema, KubernetesNodeResourcesSchema, KubernetesNodeUsageSchema, KubernetesPodRuntimeUnitStatusSchema, KubernetesSecretVaultHeartbeatDataSchema, KubernetesWorkerHeartbeatDataSchema, Kv, KvSchema as KvConfigSchema, KvHeartbeatDataSchema, KvHeartbeatStatusSchema, LeaseInfoSchema, LeaseRequestSchema, LeaseResponseSchema, LocalArtifactRegistryHeartbeatDataSchema, LocalComputeClusterHeartbeatDataSchema, LocalContainerHeartbeatDataSchema, LocalDaemonHeartbeatDataSchema, LocalKvHeartbeatDataSchema, LocalQueueHeartbeatDataSchema, LocalRuntimeEventSnapshotSchema, LocalRuntimeEventSubjectSchema, LocalRuntimeUnitKindSchema, LocalRuntimeUnitStatusSchema, LocalServiceAccountHeartbeatDataSchema, LocalStorageHeartbeatDataSchema, LocalVaultHeartbeatDataSchema, LocalWorkerHeartbeatDataSchema, MachineProfileSchema, ManagedRuntimeEventInvolvedObjectSchema, ManagedRuntimeEventSnapshotSchema, ManagedRuntimeEventSourceSchema, ManagedRuntimeUnitStatusSchema, MessagePayloadSchema, MetricSampleSchema, NetworkHeartbeatDataSchema, NetworkHeartbeatStatusSchema, ObservedCountsSchema, ObservedHealthSchema, ObservedInventoryBatchSchema, ObservedResourceSampleSchema, PermissionSetSchema, PlatformSchema, Postgres, PostgresSchema as PostgresConfigSchema, PresignedRequestBackendSchema, PresignedRequestSchema, ProviderFleetStatusSchema, ProviderLifecycleStateSchema, PublicEndpointSchema, Queue, QueueSchema as QueueConfigSchema, QueueHeartbeatDataSchema, QueueHeartbeatStatusSchema, QueueMessageSchema, ReadinessProbeSchema, ReleaseRequestSchema, RemoteStackManagementHeartbeatDataSchema, RemoteStackManagementHeartbeatStatusSchema, Resource, ResourceHeartbeatDataSchema, ResourceHeartbeatSchema, ResourceLifecycleSchema, ResourceNotFoundError, ResourceOutputsParseError, ResourceRefSchema, ResourceSchemaMapping, ResourceStatusSchema, ResourceTypeSchema, ResponseHandlingSchema, ScheduledEventSchema, ServiceAccount, ServiceAccountSchema as ServiceAccountConfigSchema, ServiceAccountHeartbeatDataSchema, ServiceAccountHeartbeatStatusSchema, ServiceAccountOutputsSchema, ServiceActivationHeartbeatDataSchema, ServiceActivationHeartbeatStatusSchema, Stack, StackInputDefaultValueSchema, StackInputDefinitionSchema, StackInputEnvironmentMappingSchema, StackInputEnvironmentVariableTypeSchema, StackInputKindSchema, StackInputProviderSchema, StackInputValidationSchema, StackResourceStateSchema, StackSchema, StackSettingsSchema, StackStateSchema, StackStatusSchema, Storage, StorageSchema as StorageConfigSchema, StorageEventSchema, StorageEventTypeSchema, StorageEventsSchema, StorageHeartbeatDataSchema, StorageHeartbeatStatusSchema, StorageUploadSchema, SubmitResponseRequestSchema, TelemetryModeSchema, TraceContextSchema, UnexpectedResourceTypeError, UpdatesModeSchema, UploadCompleteRequestSchema, UploadCompleteResponseSchema, Vault, VaultSchema as VaultConfigSchema, VaultHeartbeatDataSchema, VaultHeartbeatStatusSchema, Worker, WorkerSchema as WorkerConfigSchema, WorkerHeartbeatDataSchema, WorkerOutputsSchema, WorkerPublicEndpointSchema, WorkerTriggerSchema, WorkloadHeartbeatStatusSchema, WorkloadReplicaStatusSchema, defineBooleanInput as boolean, defineError, defineEnumInput as enum, experimental, getResourceOutputs, getStackInputDefinitions, inputs, defineIntegerInput as integer, defineNumberInput as number, defineSecretInput as secret, defineStringInput as string, defineStringListInput as stringList };
 
 //# sourceMappingURL=index.js.map