@alienplatform/core 2.1.6 → 3.0.0

package/dist/index.js

@@ -1246,7 +1246,7 @@ const AwsEmailDomainImportDataSchema = z$2.object({ get "dkimTokens"() {
 z$2.object({
 	"configurationSet": z$2.string().describe("SES configuration set name (used when sending)."),
 	"domains": z$2.object({}).catchall(z$2.lazy(() => AwsEmailDomainImportDataSchema).describe("Per-domain import payload for an AWS Email resource.")).describe("Per-seed-domain DNS data, keyed by mail domain."),
-	"ruleSetName": z$2.string().describe("SES receipt rule set name, present only when inbound mail is\nconfigured. Activating the rule set is a manual post-deploy step.").nullish()
+	"ruleSetName": z$2.string().describe("SES receipt rule set name, present only when inbound mail is configured.").nullish()
 }).describe("AWS Email ImportData.\n\nMirrors the `emit_import_ref` payload of the AWS SES email emitter: the\nshared configuration set name, one entry per seed domain carrying its\nEasy-DKIM CNAME records, and — when inbound mail is configured — the\nreceipt rule set name. Identities created at runtime through the\n`email/manage-identities` grant are application data and never appear\nhere.");
 //#endregion
 //#region src/generated/zod/aws-failure-domain-subnets-schema.ts
@@ -1389,6 +1389,36 @@ const AwsNetworkImportDataSchema = z$2.object({
 	"vpcId": z$2.string().describe("VPC ID. Absent when default-VPC mode defers lookup to AWS at runtime.").nullish()
 }).describe("AWS Network ImportData.");
 //#endregion
+//#region src/generated/zod/aws-open-search-capacity-range-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Minimum and maximum OCU bounds for one OpenSearch compute component.
+*/
+const AwsOpenSearchCapacityRangeSchema = z$2.object({
+	"maxOcu": z$2.int().min(2).max(1696).describe("Maximum OCUs the component may scale to.").nullish(),
+	"minOcu": z$2.int().min(0).max(1696).describe("Minimum OCUs kept available. Zero enables scale-to-zero.").nullish()
+}).describe("Minimum and maximum OCU bounds for one OpenSearch compute component.");
+//#endregion
+//#region src/generated/zod/aws-open-search-capacity-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Indexing and search capacity limits for an OpenSearch collection group.
+*/
+const AwsOpenSearchCapacitySchema = z$2.object({
+	get "indexing"() {
+		return z$2.union([AwsOpenSearchCapacityRangeSchema, z$2.null()]).optional();
+	},
+	get "search"() {
+		return z$2.union([AwsOpenSearchCapacityRangeSchema, z$2.null()]).optional();
+	}
+}).describe("Indexing and search capacity limits for an OpenSearch collection group.");
+//#endregion
 //#region src/generated/zod/aws-open-search-collection-type-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -1415,14 +1445,17 @@ z$2.object({
 * Do not edit manually.
 */
 /**
-* @description An Amazon OpenSearch Serverless collection (next generation).\n\n# Experimental namespace\n\nThis is the first resource under the `experimental/` resource-type\nnamespace. Experimental resources are provider-specific (they do not\nabstract over clouds), may change or be promoted to a portable resource\nin a breaking way, and are only registered for the platforms they\nsupport. `AwsOpenSearch` registers an AWS CloudFormation emitter only;\ndeploying it to any other platform fails with a typed\n`ImportRegistrationMissing` error at generation time.\n\n# What gets provisioned\n\nThe AWS emitter provisions next-generation OpenSearch Serverless:\na collection group (`Generation: NEXTGEN`, compute/storage decoupled,\nscale-to-zero) plus a collection inside it, an AWS-owned-key encryption\nconfiguration, a public network policy, and a data-access policy for\nservice-account roles granted `experimental/aws-opensearch/data-access`.\nThe collection endpoint is public but every request must be SigV4-signed\nand pass both IAM (`aoss:APIAccessAll`) and the data-access policy.\n\n# Naming\n\nThe physical collection (and collection group) name is\n`{id}-{stack-suffix}` and must satisfy the AOSS name grammar, so `id`\nmust match `[a-z][a-z0-9-]*` and be at most 23 characters. The emitter\nrejects ids that don\'t fit.\n\n# Runtime access\n\nWorkers reach the collection over HTTPS with SigV4. The SigV4 signing\nservice name for OpenSearch Serverless is `aoss` (not `es`); the runtime\nbinding payload carries `\"service\": \"aoss\"` so clients sign correctly.\nRequests with a body must also send an `x-amz-content-sha256` header\n(the AOSS gateway rejects body-carrying requests without it with an\nempty 403); official OpenSearch clients with an `aoss` signer handle\nthis automatically.
+* @description An Amazon OpenSearch Serverless collection (next generation).\n\n# Experimental namespace\n\nThis is the first resource under the `experimental/` resource-type\nnamespace. Experimental resources are provider-specific (they do not\nabstract over clouds), may change or be promoted to a portable resource\nin a breaking way, and are only registered for the platforms they\nsupport. `AwsOpenSearch` registers an AWS CloudFormation emitter only;\ndeploying it to any other platform fails with a typed\n`ImportRegistrationMissing` error at generation time.\n\n# What gets provisioned\n\nThe AWS emitter provisions next-generation OpenSearch Serverless:\na collection group (`Generation: NEXTGEN`, compute/storage decoupled)\nplus a collection inside it, an AWS-owned-key encryption configuration,\na public network policy, and a data-access policy for service-account\nroles granted `experimental/aws-opensearch/data-access`. Collection groups\nscale to zero by default; configure a non-zero minimum capacity when the\nworkload requires predictable interactive latency.\nThe collection endpoint is public but every request must be SigV4-signed\nand pass both IAM (`aoss:APIAccessAll`) and the data-access policy.\n\n# Naming\n\nThe physical collection (and collection group) name is\n`{id}-{stack-suffix}` and must satisfy the AOSS name grammar, so `id`\nmust match `[a-z][a-z0-9-]*` and be at most 23 characters. The emitter\nrejects ids that don\'t fit.\n\n# Runtime access\n\nWorkers reach the collection over HTTPS with SigV4. The SigV4 signing\nservice name for OpenSearch Serverless is `aoss` (not `es`); the runtime\nbinding payload carries `\"service\": \"aoss\"` so clients sign correctly.\nRequests with a body must also send an `x-amz-content-sha256` header\n(the AOSS gateway rejects body-carrying requests without it with an\nempty 403); official OpenSearch clients with an `aoss` signer handle\nthis automatically.
 */
 const AwsOpenSearchSchema = z$2.object({
+	get "capacity"() {
+		return z$2.union([AwsOpenSearchCapacitySchema, z$2.null()]).optional();
+	},
 	get "collectionType"() {
 		return AwsOpenSearchCollectionTypeSchema.describe("Workload type for an OpenSearch Serverless collection.\n\n`TIMESERIES` is intentionally not exposed: next-generation serverless\nscale-to-zero targets search and vector workloads.").optional();
 	},
 	"id": z$2.string().describe("Identifier for the collection. Becomes part of the physical collection\nname, so it must match `[a-z][a-z0-9-]*` and be at most 23 characters.")
-}).describe("An Amazon OpenSearch Serverless collection (next generation).\n\n# Experimental namespace\n\nThis is the first resource under the `experimental/` resource-type\nnamespace. Experimental resources are provider-specific (they do not\nabstract over clouds), may change or be promoted to a portable resource\nin a breaking way, and are only registered for the platforms they\nsupport. `AwsOpenSearch` registers an AWS CloudFormation emitter only;\ndeploying it to any other platform fails with a typed\n`ImportRegistrationMissing` error at generation time.\n\n# What gets provisioned\n\nThe AWS emitter provisions next-generation OpenSearch Serverless:\na collection group (`Generation: NEXTGEN`, compute/storage decoupled,\nscale-to-zero) plus a collection inside it, an AWS-owned-key encryption\nconfiguration, a public network policy, and a data-access policy for\nservice-account roles granted `experimental/aws-opensearch/data-access`.\nThe collection endpoint is public but every request must be SigV4-signed\nand pass both IAM (`aoss:APIAccessAll`) and the data-access policy.\n\n# Naming\n\nThe physical collection (and collection group) name is\n`{id}-{stack-suffix}` and must satisfy the AOSS name grammar, so `id`\nmust match `[a-z][a-z0-9-]*` and be at most 23 characters. The emitter\nrejects ids that don't fit.\n\n# Runtime access\n\nWorkers reach the collection over HTTPS with SigV4. The SigV4 signing\nservice name for OpenSearch Serverless is `aoss` (not `es`); the runtime\nbinding payload carries `\"service\": \"aoss\"` so clients sign correctly.\nRequests with a body must also send an `x-amz-content-sha256` header\n(the AOSS gateway rejects body-carrying requests without it with an\nempty 403); official OpenSearch clients with an `aoss` signer handle\nthis automatically.");
+}).describe("An Amazon OpenSearch Serverless collection (next generation).\n\n# Experimental namespace\n\nThis is the first resource under the `experimental/` resource-type\nnamespace. Experimental resources are provider-specific (they do not\nabstract over clouds), may change or be promoted to a portable resource\nin a breaking way, and are only registered for the platforms they\nsupport. `AwsOpenSearch` registers an AWS CloudFormation emitter only;\ndeploying it to any other platform fails with a typed\n`ImportRegistrationMissing` error at generation time.\n\n# What gets provisioned\n\nThe AWS emitter provisions next-generation OpenSearch Serverless:\na collection group (`Generation: NEXTGEN`, compute/storage decoupled)\nplus a collection inside it, an AWS-owned-key encryption configuration,\na public network policy, and a data-access policy for service-account\nroles granted `experimental/aws-opensearch/data-access`. Collection groups\nscale to zero by default; configure a non-zero minimum capacity when the\nworkload requires predictable interactive latency.\nThe collection endpoint is public but every request must be SigV4-signed\nand pass both IAM (`aoss:APIAccessAll`) and the data-access policy.\n\n# Naming\n\nThe physical collection (and collection group) name is\n`{id}-{stack-suffix}` and must satisfy the AOSS name grammar, so `id`\nmust match `[a-z][a-z0-9-]*` and be at most 23 characters. The emitter\nrejects ids that don't fit.\n\n# Runtime access\n\nWorkers reach the collection over HTTPS with SigV4. The SigV4 signing\nservice name for OpenSearch Serverless is `aoss` (not `es`); the runtime\nbinding payload carries `\"service\": \"aoss\"` so clients sign correctly.\nRequests with a body must also send an `x-amz-content-sha256` header\n(the AOSS gateway rejects body-carrying requests without it with an\nempty 403); official OpenSearch clients with an `aoss` signer handle\nthis automatically.");
 //#endregion
 //#region src/generated/zod/vault-heartbeat-status-schema.ts
 /**
@@ -4410,7 +4443,7 @@ const EmailInboundSchema = z$2.object({ get "storage"() {
 z$2.object({
 	"configurationSet": z$2.string().describe("The provisioned configuration set name (used when sending)."),
 	"domains": z$2.object({}).catchall(z$2.lazy(() => EmailDomainOutputsSchema).describe("Per-domain DNS records the operator must create.")).describe("DNS records per mail domain."),
-	"ruleSetName": z$2.string().describe("The inbound receipt rule set name, when `inbound` is configured.\nActivating it is a manual post-deploy step — CloudFormation cannot\nactivate a receipt rule set, and only one can be active per account.").nullish()
+	"ruleSetName": z$2.string().describe("The inbound receipt rule set name, when `inbound` is configured.").nullish()
 }).describe("Outputs generated by a successfully provisioned Email resource.\n\nDomain verification status cannot be known at provisioning time — SES\nverifies a domain asynchronously once its DKIM records exist in DNS — so\nthe outputs carry the records the operator must create rather than a\nverification result.");
 //#endregion
 //#region src/generated/zod/email-schema.ts
@@ -4419,7 +4452,7 @@ z$2.object({
 * Do not edit manually.
 */
 /**
-* @description Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change. Two caveats apply:\n\n* SES allows only **one active receipt rule set per AWS account**, and\n  CloudFormation has no resource that activates a rule set. Activating the\n  provisioned rule set is a documented post-deploy step:\n  `aws ses set-active-receipt-rule-set --rule-set-name <ruleSetName>`.\n* SES email receiving is only available in a subset of AWS regions (see the\n  SES endpoints documentation). Deploying `inbound` to an unsupported\n  region fails at the CloudFormation layer.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.
+* @description Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change.\n\nAlien activates the provisioned receipt rule set as part of setup. Because\nSES permits only one active receipt rule set per AWS account and region, an\nAWS stack may contain only one email resource with inbound delivery, and\ninstalling it makes its rule set the account\'s active rule set. SES email\nreceiving is available only in a subset of AWS regions; deploying `inbound`\nto an unsupported region fails during setup.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.
 */
 const EmailSchema = z$2.object({
 	"domains": z$2.optional(z$2.array(z$2.string()).describe("Seed mail domains provisioned at deploy time (one SES identity each).\nUseful for day-0 bootstrap and products with a static domain set.\nMay be empty (the default): products that create and verify domains\ndynamically should manage identities at runtime through the\n`email/manage-identities` grant instead of listing them here.")),
@@ -4430,7 +4463,7 @@ const EmailSchema = z$2.object({
 	get "inbound"() {
 		return z$2.union([EmailInboundSchema, z$2.null()]).optional();
 	}
-}).describe("Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change. Two caveats apply:\n\n* SES allows only **one active receipt rule set per AWS account**, and\n  CloudFormation has no resource that activates a rule set. Activating the\n  provisioned rule set is a documented post-deploy step:\n  `aws ses set-active-receipt-rule-set --rule-set-name <ruleSetName>`.\n* SES email receiving is only available in a subset of AWS regions (see the\n  SES endpoints documentation). Deploying `inbound` to an unsupported\n  region fails at the CloudFormation layer.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.");
+}).describe("Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change.\n\nAlien activates the provisioned receipt rule set as part of setup. Because\nSES permits only one active receipt rule set per AWS account and region, an\nAWS stack may contain only one email resource with inbound delivery, and\ninstalling it makes its rule set the account's active rule set. SES email\nreceiving is available only in a subset of AWS regions; deploying `inbound`\nto an unsupported region fails during setup.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.");
 //#endregion
 //#region src/generated/zod/response-handling-schema.ts
 /**
@@ -6072,6 +6105,7 @@ const ResourceEntrySchema = z$2.object({
 	get "dependencies"() {
 		return z$2.array(ResourceRefSchema.describe("Reference to a resource by its stable id and resource type.")).describe("Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list");
 	},
+	"enabledWhen": z$2.string().describe("Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it.").nullish(),
 	get "lifecycle"() {
 		return ResourceLifecycleSchema.describe("Describes the lifecycle of a resource within a stack, determining how it's managed and deployed.");
 	},
@@ -6675,6 +6709,7 @@ const StorageOutputsSchema = z$2.object({ "bucketName": z$2.string().describe("T
 * @description Represents an object storage bucket.
 */
 const StorageSchema = z$2.object({
+	"corsAllowedOrigins": z$2.optional(z$2.array(z$2.string()).describe("Browser origins allowed to read objects through signed URLs.\n\nWhen non-empty, providers configure CORS for `GET` and `HEAD` requests.\nAn origin of `*` is appropriate for private buckets whose signed URLs\nare bearer credentials and do not use browser cookies.\nDefault: `[]` (CORS disabled).")),
 	"id": z$2.string().describe("Name of the the storage bucket.\nFor names with dots, each dot-separated label must be ≤ 63 characters."),
 	get "lifecycleRules"() {
 		return z$2.array(LifecycleRuleSchema.describe("Defines a rule for managing the lifecycle of objects within a storage bucket.")).describe("List of rules for automatic object management (e.g., expiration).\nDefault: `[]` (empty list)").optional();
@@ -6833,7 +6868,7 @@ const WorkerSchema = z$2.object({
 	get "links"() {
 		return z$2.array(ResourceRefSchema.describe("Reference to a resource by its stable id and resource type.")).describe("List of resource references this worker depends on.");
 	},
-	"memoryMb": z$2.optional(z$2.int().min(0).default(256).describe("Memory allocated to the worker in megabytes (MB).\nDefault: 256\n\nPlatform-specific constraints:\n- **AWS Lambda**: 128–10240 MB in 1 MB increments\n- **GCP Cloud Run**: 128–32768 MB\n- **Azure Container Apps**: fixed CPU/memory pairs — 512, 1024, 1536, 2048, 2560,\n  3072, 3584, 4096 MB. Values below 512 are automatically rounded up at deploy time.")),
+	"memoryMb": z$2.optional(z$2.int().min(0).default(512).describe("Memory allocated to the worker in megabytes (MB).\nDefault: 512\n\nPlatform-specific constraints:\n- **AWS Lambda**: 128–10240 MB in 1 MB increments\n- **GCP Cloud Run**: 128–32768 MB\n- **Azure Container Apps**: fixed CPU/memory pairs — 512, 1024, 1536, 2048, 2560,\n  3072, 3584, 4096 MB. Values below 512 are automatically rounded up at deploy time.")),
 	"permissions": z$2.string().describe("Permission profile name that defines the permissions granted to this worker.\nThis references a profile defined in the stack's permission definitions."),
 	get "publicEndpoints"() {
 		return z$2.array(WorkerPublicEndpointSchema.describe("Public endpoint configuration for Worker resources.")).describe("Public endpoints exposed by this worker.").optional();
@@ -6857,9 +6892,11 @@ var Resource = class {
 	/**
 	* Creates a new Resource instance.
 	* @param config The configuration object for this specific resource type.
+	* @param enabledWhen Id of the boolean stack input gating this resource's creation.
 	*/
-	constructor(config) {
+	constructor(config, enabledWhen) {
 		this.config = config;
+		if (enabledWhen !== void 0) this.enabledWhen = enabledWhen;
 	}
 	/**
 	* Returns a reference to this resource.
@@ -6873,22 +6910,52 @@ var Resource = class {
 		};
 	}
 };
+/**
+* Base class for the per-resource builders, giving every resource type the same
+* `.enabled()` gate without each builder reimplementing it.
+*/
+var ResourceBuilder = class {
+	_enabledWhen;
+	/**
+	* Creates this resource only when the given boolean stack input is true.
+	* A deployer who answers no never gets the resource, its outputs, or anything derived from it.
+	* A frozen resource's answer is fixed when the deployment is created; a live
+	* resource follows later edits to the input, and turning it off deletes the
+	* resource together with its data.
+	* @param input A boolean stack input declared with alien.inputs({...}).
+	* @returns The builder instance.
+	*/
+	enabled(input) {
+		this._enabledWhen = input.id;
+		return this;
+	}
+	/**
+	* Carries the `.enabled()` gate into the Resource.
+	* @param config The validated configuration for this resource type.
+	* @returns An immutable Resource.
+	*/
+	resource(config) {
+		return new Resource(config, this._enabledWhen);
+	}
+};
 //#endregion
 //#region src/storage.ts
 /**
 * Represents an object storage bucket.
 */
-var Storage = class {
+var Storage = class extends ResourceBuilder {
 	_config = {
 		publicRead: false,
 		versioning: false,
-		lifecycleRules: []
+		lifecycleRules: [],
+		corsAllowedOrigins: []
 	};
 	/**
 	* Creates a new Storage builder.
 	* @param id ID of the storage bucket. For names with dots, each dot-separated label must be ≤ 63 characters.
 	*/
 	constructor(id) {
+		super();
 		this._config.id = id;
 	}
 	/**
@@ -6929,14 +6996,26 @@ var Storage = class {
 		return this;
 	}
 	/**
+	* Allows browser reads from the listed origins through signed URLs.
+	* Providers enable `GET` and `HEAD`; use `*` only when the signed URL itself
+	* is the credential and browser cookies are not involved.
+	* @param origins Allowed browser origins.
+	* @returns The Storage builder instance.
+	*/
+	corsAllowedOrigins(origins) {
+		this._config.corsAllowedOrigins = origins;
+		return this;
+	}
+	/**
 	* Builds and validates the storage configuration.
 	* @returns An immutable Resource representing the configured storage bucket.
 	* @throws Error if the storage configuration is invalid.
 	*/
 	build() {
-		return new Resource({
+		const config = StorageSchema.parse(this._config);
+		return this.resource({
 			type: "storage",
-			...StorageSchema.parse(this._config)
+			...config
 		});
 	}
 };
@@ -6980,7 +7059,7 @@ var Worker = class {
 	/**
 	* Sets the memory allocated to the worker in megabytes (MB).
 	* Constraints: 128‑32768 MB (platform-specific limits may apply).
-	* Default: 256 MB.
+	* Default: 512 MB.
 	* @param mb The memory in MB.
 	* @returns The Worker builder instance.
 	*/
@@ -7928,13 +8007,14 @@ var ArtifactRegistry = class {
 *
 * The vault acts as a namespace for secrets and controls access permissions for workers and services.
 */
-var Vault = class {
+var Vault = class extends ResourceBuilder {
 	_config = {};
 	/**
 	* Creates a new Vault builder.
 	* @param id Identifier for the vault. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
 	*/
 	constructor(id) {
+		super();
 		this._config.id = id;
 	}
 	/**
@@ -7951,9 +8031,10 @@ var Vault = class {
 	* @throws Error if the vault configuration is invalid.
 	*/
 	build() {
-		return new Resource({
+		const config = VaultSchema.parse(this._config);
+		return this.resource({
 			type: "vault",
-			...VaultSchema.parse(this._config)
+			...config
 		});
 	}
 };
@@ -7991,13 +8072,14 @@ var Vault = class {
 * - Clients must de-duplicate keys across pages
 * - No completeness guarantee under concurrent writes
 */
-var Kv = class {
+var Kv = class extends ResourceBuilder {
 	_config = {};
 	/**
 	* Creates a new KV builder.
 	* @param id Identifier for the KV store. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
 	*/
 	constructor(id) {
+		super();
 		this._config.id = id;
 	}
 	/**
@@ -8014,9 +8096,10 @@ var Kv = class {
 	* @throws Error if the KV configuration is invalid.
 	*/
 	build() {
-		return new Resource({
+		const config = KvSchema.parse(this._config);
+		return this.resource({
 			type: "kv",
-			...KvSchema.parse(this._config)
+			...config
 		});
 	}
 };
@@ -8026,7 +8109,7 @@ var Kv = class {
 * Represents a managed PostgreSQL database. The target platform decides the backend;
 * the database is private and reachable only by same-stack workloads.
 */
-var Postgres = class {
+var Postgres = class extends ResourceBuilder {
 	_config = {
 		version: "17",
 		storage: "20Gi",
@@ -8037,6 +8120,7 @@ var Postgres = class {
 	* @param id ID of the database. A database of this name is created on the server.
 	*/
 	constructor(id) {
+		super();
 		this._config.id = id;
 	}
 	/**
@@ -8103,9 +8187,10 @@ var Postgres = class {
 	* @throws Error if the configuration is invalid.
 	*/
 	build() {
-		return new Resource({
+		const config = PostgresSchema.parse(this._config);
+		return this.resource({
 			type: "postgres",
-			...PostgresSchema.parse(this._config)
+			...config
 		});
 	}
 };
@@ -8115,13 +8200,14 @@ var Postgres = class {
 * Represents a message queue resource with minimal, portable semantics.
 * Queue integrates with platform-native services (AWS SQS, GCP Pub/Sub, Azure Service Bus).
 */
-var Queue = class {
+var Queue = class extends ResourceBuilder {
 	_config = {};
 	/**
 	* Creates a new Queue builder.
 	* @param id Identifier for the queue. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
 	*/
 	constructor(id) {
+		super();
 		this._config.id = id;
 	}
 	/**
@@ -8138,9 +8224,10 @@ var Queue = class {
 	* @throws Error if the queue configuration is invalid.
 	*/
 	build() {
-		return new Resource({
+		const config = QueueSchema.parse(this._config);
+		return this.resource({
 			type: "queue",
-			...QueueSchema.parse(this._config)
+			...config
 		});
 	}
 };
@@ -8163,10 +8250,10 @@ var Queue = class {
 *
 * When inbound mail is configured, the receipt rule is a catch-all (no
 * recipient filter), so mail for runtime-verified identities lands in the
-* bucket without redeployment. The provisioned SES receipt rule set must be
-* activated manually after deployment (only one receipt rule set can be
-* active per AWS account, and CloudFormation cannot activate one):
-* `aws ses set-active-receipt-rule-set --rule-set-name <ruleSetName>`.
+* bucket without redeployment. Setup activates the provisioned receipt rule
+* set automatically. SES permits one active receipt rule set per account and
+* region, so an AWS stack may contain only one Email with inbound delivery,
+* and installing it makes its rule set the account's active rule set.
 */
 var Email = class {
 	_config = { domains: [] };
@@ -8529,6 +8616,7 @@ var Stack = class {
 			dependencies: []
 		};
 		if (options?.remoteAccess) entry.remoteAccess = true;
+		if (resource.enabledWhen !== void 0) entry.enabledWhen = resource.enabledWhen;
 		this._config.resources[resource.config.id] = entry;
 		return this;
 	}
@@ -9210,8 +9298,8 @@ function getResourceOutputs(params) {
 //#region src/experimental/aws-opensearch.ts
 /**
 * An Amazon OpenSearch Serverless collection (next generation): compute and
-* storage are decoupled, the collection scales to zero, and it lives inside a
-* dedicated collection group.
+* storage are decoupled, and the collection lives inside a dedicated
+* collection group. By default, its compute can scale to zero.
 *
 * Experimental and AWS-only: deploying a stack containing this resource to any
 * other platform fails at template generation with a clear error.
@@ -9255,6 +9343,21 @@ var AwsOpenSearch = class {
 		return this;
 	}
 	/**
+	* Sets the collection group's indexing and search capacity limits.
+	*
+	* Omit this setting to retain the provider defaults, including scale-to-zero.
+	* Set a minimum of 1 OCU for latency-sensitive workloads that should remain
+	* warm.
+	*
+	* @param value Indexing and search capacity limits.
+	* @returns The AwsOpenSearch builder instance.
+	*/
+	capacity(value) {
+		validateCapacity(value);
+		this._config.capacity = value;
+		return this;
+	}
+	/**
 	* Builds and validates the collection configuration.
 	* @returns An immutable Resource representing the configured collection.
 	* @throws Error if the configuration is invalid.
@@ -9266,6 +9369,20 @@ var AwsOpenSearch = class {
 		});
 	}
 };
+function validateCapacity(capacity) {
+	const components = [["indexing", capacity.indexing], ["search", capacity.search]];
+	if (components.every(([, range]) => range == null)) throw new Error("OpenSearch capacity must configure indexing, search, or both");
+	for (const [component, range] of components) {
+		if (range == null) continue;
+		if (range.minOcu == null && range.maxOcu == null) throw new Error(`OpenSearch ${component} capacity must configure minOcu, maxOcu, or both`);
+		if (range.minOcu != null) validateOcu(`${component}.minOcu`, range.minOcu, true);
+		if (range.maxOcu != null) validateOcu(`${component}.maxOcu`, range.maxOcu, false);
+		if (range.minOcu != null && range.maxOcu != null && range.minOcu > range.maxOcu) throw new Error(`OpenSearch ${component} minOcu must not exceed maxOcu`);
+	}
+}
+function validateOcu(field, value, allowZero) {
+	if (!(Number.isInteger(value) && value <= 1696 && (allowZero && value === 0 || value === 1 || value === 2 || value === 4 || value === 8 || value === 16 || value > 16 && value % 16 === 0))) throw new Error(`OpenSearch ${field} must be ${allowZero ? "0, " : ""}1, 2, 4, 8, 16, or a multiple of 16 up to 1696`);
+}
 //#endregion
 //#region src/index.ts
 const experimental = { AwsOpenSearch };