@alienplatform/core 2.1.6 → 3.0.1

package/dist/index.d.ts

@@ -1179,6 +1179,22 @@ declare const AwsNetworkImportDataSchema: z$2.ZodObject<{
 }, z$2.core.$strip>;
 type AwsNetworkImportData = z$2.infer<typeof AwsNetworkImportDataSchema>;
 //#endregion
+//#region src/generated/zod/aws-open-search-capacity-schema.d.ts
+/**
+ * @description Indexing and search capacity limits for an OpenSearch collection group.
+ */
+declare const AwsOpenSearchCapacitySchema: z$2.ZodObject<{
+  indexing: z$2.ZodOptional<z$2.ZodUnion<readonly [z$2.ZodObject<{
+    maxOcu: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodInt>>;
+    minOcu: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodInt>>;
+  }, z$2.core.$strip>, z$2.ZodNull]>>;
+  search: z$2.ZodOptional<z$2.ZodUnion<readonly [z$2.ZodObject<{
+    maxOcu: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodInt>>;
+    minOcu: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodInt>>;
+  }, z$2.core.$strip>, z$2.ZodNull]>>;
+}, z$2.core.$strip>;
+type AwsOpenSearchCapacity = z$2.infer<typeof AwsOpenSearchCapacitySchema>;
+//#endregion
 //#region src/generated/zod/aws-open-search-collection-type-schema.d.ts
 /**
  * @description Workload type for an OpenSearch Serverless collection.\n\n`TIMESERIES` is intentionally not exposed: next-generation serverless\nscale-to-zero targets search and vector workloads.
@@ -1201,9 +1217,19 @@ type AwsOpenSearchOutputs = z$2.infer<typeof AwsOpenSearchOutputsSchema>;
 //#endregion
 //#region src/generated/zod/aws-open-search-schema.d.ts
 /**
- * @description An Amazon OpenSearch Serverless collection (next generation).\n\n# Experimental namespace\n\nThis is the first resource under the `experimental/` resource-type\nnamespace. Experimental resources are provider-specific (they do not\nabstract over clouds), may change or be promoted to a portable resource\nin a breaking way, and are only registered for the platforms they\nsupport. `AwsOpenSearch` registers an AWS CloudFormation emitter only;\ndeploying it to any other platform fails with a typed\n`ImportRegistrationMissing` error at generation time.\n\n# What gets provisioned\n\nThe AWS emitter provisions next-generation OpenSearch Serverless:\na collection group (`Generation: NEXTGEN`, compute/storage decoupled,\nscale-to-zero) plus a collection inside it, an AWS-owned-key encryption\nconfiguration, a public network policy, and a data-access policy for\nservice-account roles granted `experimental/aws-opensearch/data-access`.\nThe collection endpoint is public but every request must be SigV4-signed\nand pass both IAM (`aoss:APIAccessAll`) and the data-access policy.\n\n# Naming\n\nThe physical collection (and collection group) name is\n`{id}-{stack-suffix}` and must satisfy the AOSS name grammar, so `id`\nmust match `[a-z][a-z0-9-]*` and be at most 23 characters. The emitter\nrejects ids that don\'t fit.\n\n# Runtime access\n\nWorkers reach the collection over HTTPS with SigV4. The SigV4 signing\nservice name for OpenSearch Serverless is `aoss` (not `es`); the runtime\nbinding payload carries `\"service\": \"aoss\"` so clients sign correctly.\nRequests with a body must also send an `x-amz-content-sha256` header\n(the AOSS gateway rejects body-carrying requests without it with an\nempty 403); official OpenSearch clients with an `aoss` signer handle\nthis automatically.
+ * @description An Amazon OpenSearch Serverless collection (next generation).\n\n# Experimental namespace\n\nThis is the first resource under the `experimental/` resource-type\nnamespace. Experimental resources are provider-specific (they do not\nabstract over clouds), may change or be promoted to a portable resource\nin a breaking way, and are only registered for the platforms they\nsupport. `AwsOpenSearch` registers an AWS CloudFormation emitter only;\ndeploying it to any other platform fails with a typed\n`ImportRegistrationMissing` error at generation time.\n\n# What gets provisioned\n\nThe AWS emitter provisions next-generation OpenSearch Serverless:\na collection group (`Generation: NEXTGEN`, compute/storage decoupled)\nplus a collection inside it, an AWS-owned-key encryption configuration,\na public network policy, and a data-access policy for service-account\nroles granted `experimental/aws-opensearch/data-access`. Collection groups\nscale to zero by default; configure a non-zero minimum capacity when the\nworkload requires predictable interactive latency.\nThe collection endpoint is public but every request must be SigV4-signed\nand pass both IAM (`aoss:APIAccessAll`) and the data-access policy.\n\n# Naming\n\nThe physical collection (and collection group) name is\n`{id}-{stack-suffix}` and must satisfy the AOSS name grammar, so `id`\nmust match `[a-z][a-z0-9-]*` and be at most 23 characters. The emitter\nrejects ids that don\'t fit.\n\n# Runtime access\n\nWorkers reach the collection over HTTPS with SigV4. The SigV4 signing\nservice name for OpenSearch Serverless is `aoss` (not `es`); the runtime\nbinding payload carries `\"service\": \"aoss\"` so clients sign correctly.\nRequests with a body must also send an `x-amz-content-sha256` header\n(the AOSS gateway rejects body-carrying requests without it with an\nempty 403); official OpenSearch clients with an `aoss` signer handle\nthis automatically.
  */
 declare const AwsOpenSearchSchema: z$2.ZodObject<{
+  capacity: z$2.ZodOptional<z$2.ZodUnion<readonly [z$2.ZodObject<{
+    indexing: z$2.ZodOptional<z$2.ZodUnion<readonly [z$2.ZodObject<{
+      maxOcu: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodInt>>;
+      minOcu: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodInt>>;
+    }, z$2.core.$strip>, z$2.ZodNull]>>;
+    search: z$2.ZodOptional<z$2.ZodUnion<readonly [z$2.ZodObject<{
+      maxOcu: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodInt>>;
+      minOcu: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodInt>>;
+    }, z$2.core.$strip>, z$2.ZodNull]>>;
+  }, z$2.core.$strip>, z$2.ZodNull]>>;
   collectionType: z$2.ZodOptional<z$2.ZodEnum<{
     search: "search";
     vectorSearch: "vectorSearch";
@@ -3310,10 +3336,10 @@ type BuildOutputs = z$2.infer<typeof BuildOutputsSchema>;
  * @description Status of a build execution.
  */
 declare const BuildStatusSchema: z$2.ZodEnum<{
-  SUCCEEDED: "SUCCEEDED";
-  FAILED: "FAILED";
   QUEUED: "QUEUED";
   RUNNING: "RUNNING";
+  SUCCEEDED: "SUCCEEDED";
+  FAILED: "FAILED";
   CANCELLED: "CANCELLED";
   TIMED_OUT: "TIMED_OUT";
 }>;
@@ -3471,11 +3497,11 @@ type CommandResponse = z$2.infer<typeof CommandResponseSchema>;
  * @description Command states in the Commands protocol lifecycle
  */
 declare const CommandStateSchema: z$2.ZodEnum<{
+  SUCCEEDED: "SUCCEEDED";
+  FAILED: "FAILED";
   PENDING_UPLOAD: "PENDING_UPLOAD";
   PENDING: "PENDING";
   DISPATCHED: "DISPATCHED";
-  SUCCEEDED: "SUCCEEDED";
-  FAILED: "FAILED";
   EXPIRED: "EXPIRED";
 }>;
 type CommandState = z$2.infer<typeof CommandStateSchema>;
@@ -3539,11 +3565,11 @@ declare const CommandStatusResponseSchema: z$2.ZodObject<{
     }>;
   }, z$2.core.$strip>]>, z$2.ZodNull]>>;
   state: z$2.ZodEnum<{
+    SUCCEEDED: "SUCCEEDED";
+    FAILED: "FAILED";
     PENDING_UPLOAD: "PENDING_UPLOAD";
     PENDING: "PENDING";
     DISPATCHED: "DISPATCHED";
-    SUCCEEDED: "SUCCEEDED";
-    FAILED: "FAILED";
     EXPIRED: "EXPIRED";
   }>;
   target: z$2.ZodObject<{
@@ -5132,11 +5158,11 @@ declare const CreateCommandResponseSchema: z$2.ZodObject<{
   inlineAllowedUpTo: z$2.ZodInt;
   next: z$2.ZodString;
   state: z$2.ZodEnum<{
+    SUCCEEDED: "SUCCEEDED";
+    FAILED: "FAILED";
     PENDING_UPLOAD: "PENDING_UPLOAD";
     PENDING: "PENDING";
     DISPATCHED: "DISPATCHED";
-    SUCCEEDED: "SUCCEEDED";
-    FAILED: "FAILED";
     EXPIRED: "EXPIRED";
   }>;
   storageUpload: z$2.ZodOptional<z$2.ZodUnion<readonly [z$2.ZodObject<{
@@ -6235,7 +6261,7 @@ type EmailOutputs = z$2.infer<typeof EmailOutputsSchema>;
 //#endregion
 //#region src/generated/zod/email-schema.d.ts
 /**
- * @description Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change. Two caveats apply:\n\n* SES allows only **one active receipt rule set per AWS account**, and\n  CloudFormation has no resource that activates a rule set. Activating the\n  provisioned rule set is a documented post-deploy step:\n  `aws ses set-active-receipt-rule-set --rule-set-name <ruleSetName>`.\n* SES email receiving is only available in a subset of AWS regions (see the\n  SES endpoints documentation). Deploying `inbound` to an unsupported\n  region fails at the CloudFormation layer.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.
+ * @description Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change.\n\nAlien activates the provisioned receipt rule set as part of setup. Because\nSES permits only one active receipt rule set per AWS account and region, an\nAWS stack may contain only one email resource with inbound delivery, and\ninstalling it makes its rule set the account\'s active rule set. SES email\nreceiving is available only in a subset of AWS regions; deploying `inbound`\nto an unsupported region fails during setup.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.
  */
 declare const EmailSchema: z$2.ZodObject<{
   domains: z$2.ZodOptional<z$2.ZodArray<z$2.ZodString>>;
@@ -23412,6 +23438,7 @@ declare const StackSchema: z$2.ZodObject<{
       id: z$2.ZodString;
       type: z$2.ZodString;
     }, z$2.core.$strip>>;
+    enabledWhen: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
     lifecycle: z$2.ZodEnum<{
       frozen: "frozen";
       live: "live";
@@ -24226,6 +24253,7 @@ type StorageOutputs = z$2.infer<typeof StorageOutputsSchema>;
  * @description Represents an object storage bucket.
  */
 declare const StorageSchema: z$2.ZodObject<{
+  corsAllowedOrigins: z$2.ZodOptional<z$2.ZodArray<z$2.ZodString>>;
   id: z$2.ZodString;
   lifecycleRules: z$2.ZodOptional<z$2.ZodArray<z$2.ZodObject<{
     days: z$2.ZodInt;
@@ -24376,11 +24404,11 @@ type UploadCompleteRequest = z$2.infer<typeof UploadCompleteRequestSchema>;
 declare const UploadCompleteResponseSchema: z$2.ZodObject<{
   commandId: z$2.ZodString;
   state: z$2.ZodEnum<{
+    SUCCEEDED: "SUCCEEDED";
+    FAILED: "FAILED";
     PENDING_UPLOAD: "PENDING_UPLOAD";
     PENDING: "PENDING";
     DISPATCHED: "DISPATCHED";
-    SUCCEEDED: "SUCCEEDED";
-    FAILED: "FAILED";
     EXPIRED: "EXPIRED";
   }>;
 }, z$2.core.$strip>;
@@ -25416,6 +25444,79 @@ declare const WorkloadReplicaStatusSchema: z$2.ZodObject<{
 }, z$2.core.$strip>;
 type WorkloadReplicaStatus = z$2.infer<typeof WorkloadReplicaStatusSchema>;
 //#endregion
+//#region src/input.d.ts
+declare const stackInputDraftSymbol: unique symbol;
+declare const stackInputDefinitionsSymbol: unique symbol;
+type StackInputValue = string | number | boolean | string[];
+type OneOrMany<T> = T | readonly T[];
+type StackInputEnvMapping = string | {
+  name: string;
+  targetResources?: readonly string[];
+  type?: StackInputEnvironmentVariableType;
+};
+interface CommonInputOptions<TDefault extends StackInputValue> {
+  providedBy: OneOrMany<StackInputProvider>;
+  required: boolean;
+  label: string;
+  description: string;
+  placeholder?: string;
+  default?: TDefault;
+  platforms?: readonly Platform[];
+  env?: OneOrMany<StackInputEnvMapping>;
+}
+interface StringInputOptions extends CommonInputOptions<string> {
+  minLength?: number;
+  maxLength?: number;
+  pattern?: string;
+  format?: string;
+}
+interface SecretInputOptions extends Omit<CommonInputOptions<string>, "default"> {
+  minLength?: number;
+  maxLength?: number;
+  pattern?: string;
+  format?: string;
+}
+interface NumberInputOptions extends CommonInputOptions<number> {
+  min?: number;
+  max?: number;
+}
+interface IntegerInputOptions extends CommonInputOptions<number> {
+  min?: number;
+  max?: number;
+}
+interface BooleanInputOptions extends CommonInputOptions<boolean> {}
+interface EnumInputOptions extends CommonInputOptions<string> {
+  placeholder?: string;
+}
+interface StringListInputOptions extends CommonInputOptions<string[]> {
+  minItems?: number;
+  maxItems?: number;
+}
+interface StackInputRef<TValue extends StackInputValue = StackInputValue> {
+  readonly id: string;
+  readonly kind: StackInputKind;
+  readonly __value?: TValue;
+}
+type StackInputCollection = {
+  readonly [stackInputDefinitionsSymbol]: readonly StackInputDefinition[];
+};
+interface StackInputDraft<TValue extends StackInputValue = StackInputValue> {
+  readonly [stackInputDraftSymbol]: true;
+  readonly kind: StackInputKind;
+  readonly options: CommonInputOptions<TValue>;
+  readonly validation: StackInputValidation;
+}
+type StackInputSet<T extends Record<string, StackInputDraft>> = { readonly [K in keyof T]: T[K] extends StackInputDraft<infer TValue> ? StackInputRef<TValue> : never } & StackInputCollection;
+declare function inputs<const T extends Record<string, StackInputDraft>>(drafts: T): StackInputSet<T>;
+declare function getStackInputDefinitions(value: StackInputCollection | readonly StackInputDefinition[]): StackInputDefinition[];
+declare function defineStringInput(options: StringInputOptions): StackInputDraft<string>;
+declare function defineSecretInput(options: SecretInputOptions): StackInputDraft<string>;
+declare function defineNumberInput(options: NumberInputOptions): StackInputDraft<number>;
+declare function defineIntegerInput(options: IntegerInputOptions): StackInputDraft<number>;
+declare function defineBooleanInput(options: BooleanInputOptions): StackInputDraft<boolean>;
+declare function defineEnumInput<const TValues extends readonly [string, ...string[]]>(values: TValues, options: EnumInputOptions): StackInputDraft<TValues[number]>;
+declare function defineStringListInput(options: StringListInputOptions): StackInputDraft<string[]>;
+//#endregion
 //#region src/resource.d.ts
 /**
  * Represents a generic cloud resource within the Alien framework.
@@ -25423,11 +25524,21 @@ type WorkloadReplicaStatus = z$2.infer<typeof WorkloadReplicaStatusSchema>;
  */
 declare class Resource {
   config: BaseResource;
+  /**
+   * Id of the boolean stack input that decides whether this resource is created at all.
+   * Undefined means always create it.
+   *
+   * Declared rather than defined because class fields materialise on construction: a
+   * plain declaration would put `enabledWhen: undefined` on every resource, including
+   * ungated ones, which shows up in the stack snapshots.
+   */
+  readonly enabledWhen?: string;
   /**
    * Creates a new Resource instance.
    * @param config The configuration object for this specific resource type.
+   * @param enabledWhen Id of the boolean stack input gating this resource's creation.
    */
-  constructor(config: BaseResource);
+  constructor(config: BaseResource, enabledWhen?: string);
   /**
    * Returns a reference to this resource.
    * A resource reference is used to link resources together (e.g., granting a Worker access to a Storage bucket).
@@ -25435,12 +25546,35 @@ declare class Resource {
    */
   ref(): ResourceRef;
 }
+/**
+ * Base class for the per-resource builders, giving every resource type the same
+ * `.enabled()` gate without each builder reimplementing it.
+ */
+declare abstract class ResourceBuilder {
+  private _enabledWhen?;
+  /**
+   * Creates this resource only when the given boolean stack input is true.
+   * A deployer who answers no never gets the resource, its outputs, or anything derived from it.
+   * A frozen resource's answer is fixed when the deployment is created; a live
+   * resource follows later edits to the input, and turning it off deletes the
+   * resource together with its data.
+   * @param input A boolean stack input declared with alien.inputs({...}).
+   * @returns The builder instance.
+   */
+  enabled(input: StackInputRef<boolean>): this;
+  /**
+   * Carries the `.enabled()` gate into the Resource.
+   * @param config The validated configuration for this resource type.
+   * @returns An immutable Resource.
+   */
+  protected resource(config: BaseResource): Resource;
+}
 //#endregion
 //#region src/storage.d.ts
 /**
  * Represents an object storage bucket.
  */
-declare class Storage {
+declare class Storage extends ResourceBuilder {
   private _config;
   /**
    * Creates a new Storage builder.
@@ -25473,6 +25607,14 @@ declare class Storage {
    * @returns The Storage builder instance.
    */
   lifecycleRules(rules: LifecycleRule[]): this;
+  /**
+   * Allows browser reads from the listed origins through signed URLs.
+   * Providers enable `GET` and `HEAD`; use `*` only when the signed URL itself
+   * is the credential and browser cookies are not involved.
+   * @param origins Allowed browser origins.
+   * @returns The Storage builder instance.
+   */
+  corsAllowedOrigins(origins: string[]): this;
   /**
    * Builds and validates the storage configuration.
    * @returns An immutable Resource representing the configured storage bucket.
@@ -25512,7 +25654,7 @@ declare class Worker {
   /**
    * Sets the memory allocated to the worker in megabytes (MB).
    * Constraints: 128‑32768 MB (platform-specific limits may apply).
-   * Default: 256 MB.
+   * Default: 512 MB.
    * @param mb The memory in MB.
    * @returns The Worker builder instance.
    */
@@ -26128,7 +26270,7 @@ declare class ArtifactRegistry {
  *
  * The vault acts as a namespace for secrets and controls access permissions for workers and services.
  */
-declare class Vault {
+declare class Vault extends ResourceBuilder {
   private _config;
   /**
    * Creates a new Vault builder.
@@ -26182,7 +26324,7 @@ declare class Vault {
  * - Clients must de-duplicate keys across pages
  * - No completeness guarantee under concurrent writes
  */
-declare class Kv {
+declare class Kv extends ResourceBuilder {
   private _config;
   /**
    * Creates a new KV builder.
@@ -26208,7 +26350,7 @@ declare class Kv {
  * Represents a managed PostgreSQL database. The target platform decides the backend;
  * the database is private and reachable only by same-stack workloads.
  */
-declare class Postgres {
+declare class Postgres extends ResourceBuilder {
   private _config;
   /**
    * Creates a new Postgres builder.
@@ -26269,7 +26411,7 @@ declare class Postgres {
  * Represents a message queue resource with minimal, portable semantics.
  * Queue integrates with platform-native services (AWS SQS, GCP Pub/Sub, Azure Service Bus).
  */
-declare class Queue {
+declare class Queue extends ResourceBuilder {
   private _config;
   /**
    * Creates a new Queue builder.
@@ -26308,10 +26450,10 @@ declare class Queue {
  *
  * When inbound mail is configured, the receipt rule is a catch-all (no
  * recipient filter), so mail for runtime-verified identities lands in the
- * bucket without redeployment. The provisioned SES receipt rule set must be
- * activated manually after deployment (only one receipt rule set can be
- * active per AWS account, and CloudFormation cannot activate one):
- * `aws ses set-active-receipt-rule-set --rule-set-name <ruleSetName>`.
+ * bucket without redeployment. Setup activates the provisioned receipt rule
+ * set automatically. SES permits one active receipt rule set per account and
+ * region, so an AWS stack may contain only one Email with inbound delivery,
+ * and installing it makes its rule set the account's active rule set.
  */
 declare class Email {
   private _config;
@@ -26439,79 +26581,6 @@ declare class ServiceAccount {
   build(): Resource;
 }
 //#endregion
-//#region src/input.d.ts
-declare const stackInputDraftSymbol: unique symbol;
-declare const stackInputDefinitionsSymbol: unique symbol;
-type StackInputValue = string | number | boolean | string[];
-type OneOrMany<T> = T | readonly T[];
-type StackInputEnvMapping = string | {
-  name: string;
-  targetResources?: readonly string[];
-  type?: StackInputEnvironmentVariableType;
-};
-interface CommonInputOptions<TDefault extends StackInputValue> {
-  providedBy: OneOrMany<StackInputProvider>;
-  required: boolean;
-  label: string;
-  description: string;
-  placeholder?: string;
-  default?: TDefault;
-  platforms?: readonly Platform[];
-  env?: OneOrMany<StackInputEnvMapping>;
-}
-interface StringInputOptions extends CommonInputOptions<string> {
-  minLength?: number;
-  maxLength?: number;
-  pattern?: string;
-  format?: string;
-}
-interface SecretInputOptions extends Omit<CommonInputOptions<string>, "default"> {
-  minLength?: number;
-  maxLength?: number;
-  pattern?: string;
-  format?: string;
-}
-interface NumberInputOptions extends CommonInputOptions<number> {
-  min?: number;
-  max?: number;
-}
-interface IntegerInputOptions extends CommonInputOptions<number> {
-  min?: number;
-  max?: number;
-}
-interface BooleanInputOptions extends CommonInputOptions<boolean> {}
-interface EnumInputOptions extends CommonInputOptions<string> {
-  placeholder?: string;
-}
-interface StringListInputOptions extends CommonInputOptions<string[]> {
-  minItems?: number;
-  maxItems?: number;
-}
-interface StackInputRef<TValue extends StackInputValue = StackInputValue> {
-  readonly id: string;
-  readonly kind: StackInputKind;
-  readonly __value?: TValue;
-}
-type StackInputCollection = {
-  readonly [stackInputDefinitionsSymbol]: readonly StackInputDefinition[];
-};
-interface StackInputDraft<TValue extends StackInputValue = StackInputValue> {
-  readonly [stackInputDraftSymbol]: true;
-  readonly kind: StackInputKind;
-  readonly options: CommonInputOptions<TValue>;
-  readonly validation: StackInputValidation;
-}
-type StackInputSet<T extends Record<string, StackInputDraft>> = { readonly [K in keyof T]: T[K] extends StackInputDraft<infer TValue> ? StackInputRef<TValue> : never } & StackInputCollection;
-declare function inputs<const T extends Record<string, StackInputDraft>>(drafts: T): StackInputSet<T>;
-declare function getStackInputDefinitions(value: StackInputCollection | readonly StackInputDefinition[]): StackInputDefinition[];
-declare function defineStringInput(options: StringInputOptions): StackInputDraft<string>;
-declare function defineSecretInput(options: SecretInputOptions): StackInputDraft<string>;
-declare function defineNumberInput(options: NumberInputOptions): StackInputDraft<number>;
-declare function defineIntegerInput(options: IntegerInputOptions): StackInputDraft<number>;
-declare function defineBooleanInput(options: BooleanInputOptions): StackInputDraft<boolean>;
-declare function defineEnumInput<const TValues extends readonly [string, ...string[]]>(values: TValues, options: EnumInputOptions): StackInputDraft<TValues[number]>;
-declare function defineStringListInput(options: StringListInputOptions): StackInputDraft<string[]>;
-//#endregion
 //#region src/stack.d.ts
 /**
  * Options for adding a resource to a stack.
@@ -26806,6 +26875,7 @@ declare const ResourceSchemaMapping: {
   };
   storage: {
     input: z$1.ZodObject<{
+      corsAllowedOrigins: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
       id: z$1.ZodString;
       lifecycleRules: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
         days: z$1.ZodInt;
@@ -27398,8 +27468,8 @@ declare const UnexpectedResourceTypeError: {
 //#region src/experimental/aws-opensearch.d.ts
 /**
  * An Amazon OpenSearch Serverless collection (next generation): compute and
- * storage are decoupled, the collection scales to zero, and it lives inside a
- * dedicated collection group.
+ * storage are decoupled, and the collection lives inside a dedicated
+ * collection group. By default, its compute can scale to zero.
  *
  * Experimental and AWS-only: deploying a stack containing this resource to any
  * other platform fails at template generation with a clear error.
@@ -27435,6 +27505,17 @@ declare class AwsOpenSearch$1 {
    * @returns The AwsOpenSearch builder instance.
    */
   collectionType(value: AwsOpenSearchCollectionType): this;
+  /**
+   * Sets the collection group's indexing and search capacity limits.
+   *
+   * Omit this setting to retain the provider defaults, including scale-to-zero.
+   * Set a minimum of 1 OCU for latency-sensitive workloads that should remain
+   * warm.
+   *
+   * @param value Indexing and search capacity limits.
+   * @returns The AwsOpenSearch builder instance.
+   */
+  capacity(value: AwsOpenSearchCapacity): this;
   /**
    * Builds and validates the collection configuration.
    * @returns An immutable Resource representing the configured collection.