@alienplatform/core 3.3.10 → 3.3.12

package/dist/index.d.ts

@@ -6283,7 +6283,7 @@ type EmailOutputs = z$2.infer<typeof EmailOutputsSchema>;
 //#endregion
 //#region src/generated/zod/email-schema.d.ts
 /**
- * @description Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change.\n\nAlien activates the provisioned receipt rule set as part of setup. Because\nSES permits only one active receipt rule set per AWS account and region, an\nAWS stack may contain only one email resource with inbound delivery, and\ninstalling it makes its rule set the account\'s active rule set. SES email\nreceiving is available only in a subset of AWS regions; deploying `inbound`\nto an unsupported region fails during setup.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.
+ * @description Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change.\n\nAlien activates the provisioned receipt rule set as part of setup. Because\nSES permits only one active receipt rule set per AWS account and region, an\nAWS stack may contain only one email resource with inbound delivery. The\nresource requires exclusive ownership of SES receiving in its account and\nregion: setup refuses to replace an active rule set it does not own. Choose\nan unused region when the account already receives email through SES. SES email\nreceiving is available only in a subset of AWS regions; deploying `inbound`\nto an unsupported region fails during setup.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.
  */
 declare const EmailSchema: z$2.ZodObject<{
   domains: z$2.ZodOptional<z$2.ZodArray<z$2.ZodString>>;
@@ -7930,10 +7930,10 @@ type HealthCheck = z$2.infer<typeof HealthCheckSchema>;
 //#endregion
 //#region src/generated/zod/heartbeat-backend-schema.d.ts
 declare const HeartbeatBackendSchema: z$2.ZodEnum<{
+  external: "external";
   aws: "aws";
   azure: "azure";
   gcp: "gcp";
-  external: "external";
   kubernetes: "kubernetes";
   local: "local";
   test: "test";
@@ -10806,10 +10806,10 @@ type ObservedHealth = z$2.infer<typeof ObservedHealthSchema>;
 //#region src/generated/zod/observed-inventory-batch-schema.d.ts
 declare const ObservedInventoryBatchSchema: z$2.ZodObject<{
   backend: z$2.ZodEnum<{
+    external: "external";
     aws: "aws";
     azure: "azure";
     gcp: "gcp";
-    external: "external";
     kubernetes: "kubernetes";
     local: "local";
     test: "test";
@@ -17336,10 +17336,10 @@ type ResourceHeartbeatData = z$2.infer<typeof ResourceHeartbeatDataSchema>;
 //#region src/generated/zod/resource-heartbeat-schema.d.ts
 declare const ResourceHeartbeatSchema: z$2.ZodObject<{
   backend: z$2.ZodEnum<{
+    external: "external";
     aws: "aws";
     azure: "azure";
     gcp: "gcp";
-    external: "external";
     kubernetes: "kubernetes";
     local: "local";
     test: "test";
@@ -23352,8 +23352,8 @@ declare const StackInputDefinitionSchema: z$2.ZodObject<{
     number: "number";
     boolean: "boolean";
     enum: "enum";
-    stringList: "stringList";
     secret: "secret";
+    stringList: "stringList";
     integer: "integer";
   }>;
   label: z$2.ZodString;
@@ -23419,8 +23419,8 @@ declare const StackInputKindSchema: z$2.ZodEnum<{
   number: "number";
   boolean: "boolean";
   enum: "enum";
-  stringList: "stringList";
   secret: "secret";
+  stringList: "stringList";
   integer: "integer";
 }>;
 type StackInputKind = z$2.infer<typeof StackInputKindSchema>;
@@ -23559,8 +23559,8 @@ declare const StackSchema: z$2.ZodObject<{
       number: "number";
       boolean: "boolean";
       enum: "enum";
-      stringList: "stringList";
       secret: "secret";
+      stringList: "stringList";
       integer: "integer";
     }>;
     label: z$2.ZodString;
@@ -25970,464 +25970,616 @@ declare abstract class ResourceBuilder {
   protected resource(config: BaseResource): Resource;
 }
 //#endregion
-//#region src/storage.d.ts
+//#region src/ai.d.ts
 /**
- * Represents an object storage bucket.
+ * Represents an AI Gateway resource that provides a unified interface to
+ * managed AI inference services across cloud providers.
  */
-declare class Storage extends ResourceBuilder {
+declare class AI extends ResourceBuilder {
   private _config;
   /**
-   * Creates a new Storage builder.
-   * @param id ID of the storage bucket. For names with dots, each dot-separated label must be ≤ 63 characters.
+   * Creates a new AI builder.
+   * @param id Identifier for the AI resource. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
    */
   constructor(id: string);
   /**
-   * Returns a ResourceType representing any storage resource.
-   * Used for creating permission targets that apply to all storage resources.
-   * @returns The "storage" resource type.
+   * Returns a ResourceType representing any AI resource.
+   * Used for creating permission targets that apply to all AI resources.
+   * @returns The "ai" resource type.
    */
   static any(): ResourceType;
   /**
-   * Allows public read access to objects without authentication.
-   * Default: `false`.
-   * @param value Whether to allow public read access.
-   * @returns The Storage builder instance.
-   */
-  publicRead(value: boolean): this;
-  /**
-   * Enables object versioning.
-   * Default: `false`.
-   * @param value Whether to enable versioning.
-   * @returns The Storage builder instance.
-   */
-  versioning(value: boolean): this;
-  /**
-   * Defines lifecycle rules for automatic object management (e.g., expiration).
-   * @param rules An array of lifecycle rules.
-   * @returns The Storage builder instance.
-   */
-  lifecycleRules(rules: LifecycleRule[]): this;
-  /**
-   * Allows browser reads from the listed origins through signed URLs.
-   * Providers enable `GET` and `HEAD`; use `*` only when the signed URL itself
-   * is the credential and browser cookies are not involved.
-   * @param origins Allowed browser origins.
-   * @returns The Storage builder instance.
-   */
-  corsAllowedOrigins(origins: string[]): this;
-  /**
-   * Builds and validates the storage configuration.
-   * @returns An immutable Resource representing the configured storage bucket.
-   * @throws Error if the storage configuration is invalid.
+   * Builds and validates the AI configuration.
+   * @returns An immutable Resource representing the configured AI Gateway.
+   * @throws Error if the AI configuration is invalid.
    */
   build(): Resource;
 }
 //#endregion
-//#region src/worker.d.ts
-interface WorkerPublicEndpointOptions {
-  hostLabel?: string;
-  wildcardSubdomains?: boolean;
-}
+//#region src/artifact-registry.d.ts
 /**
- * Represents a serverless worker that executes code in response to triggers or direct invocations.
- * Workers are the primary compute resource in serverless applications, designed to be stateless and ephemeral.
+ * Represents an artifact registry for storing container images and other build artifacts.
+ * This is a high-level wrapper resource that provides a cloud-agnostic interface over
+ * AWS ECR, GCP Artifact Registry, and Azure Container Registry.
  */
-declare class Worker extends ResourceBuilder {
+declare class ArtifactRegistry {
   private _config;
   /**
-   * Creates a new Worker builder.
-   * @param id Identifier for the worker. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+   * Creates a new ArtifactRegistry builder.
+   * @param id Identifier for the artifact registry. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
    */
   constructor(id: string);
   /**
-   * Returns a ResourceType representing any worker resource.
-   * Used for creating permission targets that apply to all worker resources.
-   * @returns The "worker" resource type.
+   * Returns a ResourceType representing any artifact registry resource.
+   * Used for creating permission targets that apply to all artifact registry resources.
+   * @returns The "artifact-registry" resource type.
    */
   static any(): ResourceType;
   /**
-   * Sets the code for the worker, either a pre-built image or source code to be built.
-   * @param code The worker code configuration.
-   * @returns The Worker builder instance.
+   * AWS-only: Configure ECR private image replication to additional regions.
+   * Ensures images pushed in the registry's home region are automatically
+   * available in these destination regions (required when Lambda or other
+   * compute runs in a different region).
+   * @param regions - AWS region codes to replicate to (e.g., ["us-east-2", "eu-west-1"])
    */
-  code(code: WorkerCode): this;
+  replicationRegions(regions: string[]): this;
   /**
-   * Sets the memory allocated to the worker in megabytes (MB).
-   * Constraints: 128‑32768 MB (platform-specific limits may apply).
-   * Default: 512 MB.
-   * @param mb The memory in MB.
-   * @returns The Worker builder instance.
+   * Builds and validates the artifact registry configuration.
+   * @returns An immutable Resource representing the configured artifact registry.
+   * @throws Error if the artifact registry configuration is invalid.
    */
-  memoryMb(mb: number): this;
+  build(): Resource;
+}
+//#endregion
+//#region src/build.d.ts
+/**
+ * Represents a build resource that executes bash scripts to build code.
+ * Builds are designed to be stateless and can be triggered on-demand to compile,
+ * test, or package application code.
+ */
+declare class Build {
+  private _config;
   /**
-   * Sets the maximum execution time for the worker in seconds.
-   * Constraints: 1‑3600 seconds (platform-specific limits may apply).
-   * Default: 30 seconds.
-   * @param sec The timeout in seconds.
-   * @returns The Worker builder instance.
+   * Creates a new Build builder.
+   * @param id Identifier for the build resource. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
    */
-  timeoutSeconds(sec: number): this;
+  constructor(id: string);
   /**
-   * Sets the maximum number of concurrent executions allowed for the worker.
-   * `null` means platform default applies.
-   * @param limit The concurrency limit, or `null` for platform default.
-   * @returns The Worker builder instance.
+   * Returns a ResourceType representing any build resource.
+   * Used for creating permission targets that apply to all build resources.
+   * @returns The "build" resource type.
    */
-  concurrencyLimit(limit: number | undefined): this;
+  static any(): ResourceType;
   /**
-   * Exposes a named public HTTP endpoint for the worker.
-   *
-   * If no public endpoint is declared, the worker is private and only reachable
-   * through triggers, commands, or provider invocation APIs.
+   * Sets the compute type for the build.
+   * @param type The compute type (small, medium, large, x-large).
+   * @returns The Build builder instance.
    */
-  publicEndpoint(name: string, options?: WorkerPublicEndpointOptions): this;
+  computeType(type: ComputeType): this;
   /**
-   * Sets key-value pairs as environment variables for the worker.
+   * Sets key-value pairs as environment variables for the build.
    * @param env A map of environment variable names to their values.
-   * @returns The Worker builder instance.
+   * @returns The Build builder instance.
    */
   environment(env: Record<string, string>): this;
   /**
-   * Links another resource (e.g., Storage, KV, Queue) to this worker.
-   * This makes the linked resource accessible to the worker, often by injecting
+   * Links another resource (e.g., Storage, ArtifactRegistry, Role) to this build.
+   * This makes the linked resource accessible to the build, often by injecting
    * environment variables or granting permissions.
    * @param resource The resource to link.
-   * @returns The Worker builder instance.
+   * @returns The Build builder instance.
    */
   link(resource: Resource): this;
   /**
-   * Assigns a permission profile to this worker.
-   * The profile defines the permissions granted to this worker when interacting
+   * Assigns a permission profile to this build.
+   * The profile defines the permissions granted to this build when interacting
    * with other cloud resources.
    * @param permissions The permission profile name.
-   * @returns The Worker builder instance.
+   * @returns The Build builder instance.
    */
   permissions(permissions: string): this;
   /**
-   * Configures a readiness probe for the worker.
-   * The probe will be executed after provisioning/update to verify the worker is ready.
-   * Only works with workers that declare a public endpoint.
-   *
-   * @example
-   * ```typescript
-   * const probe: ReadinessProbe = {
-   *   method: "GET",
-   *   path: "/health"
-   * };
-   *
-   * const func = new Worker("my-api")
-   *   .code({ type: "image", image: "my-api:latest" })
-   *   .publicEndpoint("api")
-   *   .readinessProbe(probe)
-   *   .build();
-   * ```
-   *
-   * @param probe The readiness probe configuration.
-   * @returns The Worker builder instance.
-   */
-  readinessProbe(probe: ReadinessProbe): this;
-  /**
-   * Enables or disables the Commands protocol for the worker.
-   * When enabled, the platform pushes commands into the Worker runtime, which executes registered handlers.
-   * Default: false.
-   * @param enabled Whether to enable commands for this worker.
-   * @returns The Worker builder instance.
-   */
-  commandsEnabled(enabled: boolean): this;
-  /**
-   * Adds a trigger to the worker. Workers can have multiple triggers.
-   * Each trigger will independently invoke the worker when its conditions are met.
-   *
-   * @example
-   * ```typescript
-   * // Queue trigger
-   * const queueTrigger: WorkerTrigger = {
-   *   type: "queue",
-   *   queue: myQueue.ref()
-   * };
-   *
-   * // Schedule trigger
-   * const scheduleTrigg: WorkerTrigger = {
-   *   type: "schedule",
-   *   cron: "0 * * * *"
-   * };
-   *
-   * const func = new Worker("my-func")
-   *   .code({ type: "image", image: "my-image:latest" })
-   *   .trigger(queueTrigger)
-   *   .trigger(scheduleTrigger)
-   *   .build();
-   * ```
-   *
-   * @param trigger The trigger configuration.
-   * @returns The Worker builder instance.
-   */
-  trigger(trigger: WorkerTrigger): this;
-  /**
-   * Builds and validates the worker configuration.
-   * @returns An immutable Resource representing the configured worker.
-   * @throws Error if the worker configuration is invalid (e.g., missing code).
+   * Builds and validates the build configuration.
+   * @returns An immutable Resource representing the configured build.
+   * @throws Error if the build configuration is invalid.
    */
   build(): Resource;
 }
 //#endregion
-//#region src/container.d.ts
-type PublicEndpointOptions = "http" | "tcp" | {
-  protocol: "http" | "tcp";
-  hostLabel?: string;
-  wildcardSubdomains?: boolean;
-};
-interface PersistentStorageOptions {
-  /**
-   * Mount path inside the container.
-   *
-   * Defaults to `/data`.
-   */
-  mountPath?: string;
-}
+//#region src/error.d.ts
 /**
- * Represents a long-running container workload.
+ * Base interface that all error type definitions must implement.
  *
- * Containers run on compute instances (EC2, GCE, Azure VMs) and are orchestrated
- * by the managed container backend. They're designed for always-on workloads
- * like web services, APIs, databases, and background workers.
+ * This provides the structure for creating type-safe error definitions
+ * with Zod validation and contextual information.
+ *
+ * @template TContext - Zod schema type for the error context
  */
-declare class Container extends ResourceBuilder {
-  private _config;
-  /**
-   * Creates a new Container builder.
-   * @param id Identifier for the container. Must be DNS-compatible: lowercase alphanumeric with hyphens.
-   */
-  constructor(id: string);
+interface AlienErrorMetadata<TContext extends z.ZodTypeAny> {
+  /** Unique error code (e.g., "DATABASE_CONNECTION_FAILED") */
+  code: string;
+  /** Zod schema for type-safe context validation */
+  context: TContext;
+  /** Whether this error can be retried */
+  retryable: boolean;
+  /** Whether this error contains sensitive information */
+  internal: boolean;
+  /** HTTP status code for API responses */
+  httpStatusCode?: number;
+  /** Worker to generate human-readable error message from context */
+  message: (context: z.infer<TContext>) => string;
+}
+/**
+ * Helper function to create type-safe error definitions.
+ *
+ * This function provides a clean API for defining reusable error types
+ * with full TypeScript type safety and Zod validation.
+ *
+ * @template TContext - Zod schema type for the error context
+ * @param metadata - Error metadata including code, schema, and message generator
+ * @returns Object with metadata and a create function for error instances
+ *
+ * @example
+ * ```typescript
+ * const UserNotFound = defineError({
+ *   code: "USER_NOT_FOUND",
+ *   context: z.object({
+ *     userId: z.string(),
+ *     searchMethod: z.string(),
+ *   }),
+ *   message: ({ userId, searchMethod }) =>
+ *     `User '${userId}' not found using method '${searchMethod}'`,
+ *   retryable: false,
+ *   internal: false,
+ *   httpStatusCode: 404,
+ * })
+ *
+ * // Usage
+ * const error = UserNotFound.create({
+ *   userId: "123",
+ *   searchMethod: "database_lookup"
+ * })
+ * ```
+ */
+declare function defineError<TContext extends z.ZodTypeAny>(metadata: AlienErrorMetadata<TContext>): {
+  metadata: AlienErrorMetadata<TContext>;
+  contextSchema: TContext;
+  create: (context: z.infer<TContext>) => AlienErrorDefinition<TContext>;
+};
+/**
+ * Represents a specific error instance with its context.
+ *
+ * This is created by calling `.create()` on an error definition
+ * and contains the actual context data for a specific error occurrence.
+ *
+ * @template TContext - Zod schema type for the error context
+ */
+interface AlienErrorDefinition<TContext extends z.ZodTypeAny> {
+  metadata: AlienErrorMetadata<TContext>;
+  contextSchema: TContext;
+  context: z.infer<TContext>;
   /**
-   * Returns a ResourceType representing any container resource.
-   * Used for creating permission targets that apply to all container resources.
-   * @returns The "container" resource type.
+   * Convert this error definition directly to AlienErrorOptions.
+   *
+   * This allows you to get the wire format representation
+   * without creating an AlienError instance first.
+   *
+   * @returns AlienErrorOptions object representing this error
    */
-  static any(): ResourceType;
+  toOptions(): AlienError$1;
+}
+/**
+ * Main AlienError class that provides structured error handling.
+ *
+ * This class extends the standard JavaScript Error with additional features:
+ * - Type-safe context data
+ * - Error chaining and source tracking
+ * - Retryability and internal/external visibility flags
+ * - HTTP status code mapping
+ * - Sanitization for external APIs
+ *
+ * @template TContext - Zod schema type for the error context
+ *
+ * @example Basic Construction
+ * ```typescript
+ * const error = new AlienError(DatabaseError.create({
+ *   host: "localhost",
+ *   port: 5432,
+ *   reason: "Timeout"
+ * }))
+ * ```
+ *
+ * @example Converting JavaScript Errors
+ * ```typescript
+ * try {
+ *   JSON.parse("invalid json")
+ * } catch (jsError) {
+ *   const alienError = AlienError.from(jsError)
+ *   console.log(alienError.code) // "GENERIC_ERROR"
+ * }
+ * ```
+ *
+ * @example Error Chaining
+ * ```typescript
+ * const contextualError = AlienError.from(new Error("Network timeout"))
+ *   .withContext(DatabaseError.create({
+ *     host: "localhost",
+ *     port: 5432,
+ *     reason: "Connection timeout"
+ *   }))
+ *
+ * // Check error chain
+ * console.log(contextualError.hasErrorCode("DATABASE_CONNECTION_FAILED")) // true
+ * console.log(contextualError.toString()) // Shows full error chain
+ * ```
+ */
+declare class AlienError<TContext extends z.ZodTypeAny = z.ZodAny> extends Error {
+  /** Unique error code identifying the error type */
+  readonly code: string;
+  /** Whether this error can be safely retried */
+  readonly retryable: boolean;
+  /** Whether this error contains sensitive internal information */
+  readonly internal: boolean;
+  /** HTTP status code for API responses */
+  readonly httpStatusCode: number;
+  /** Type-safe context data specific to this error */
+  readonly context?: z.infer<TContext>;
+  /** Optional human-facing remediation hint */
+  readonly hint?: string | null;
+  /** Source error that caused this error (for chaining) */
+  readonly source?: AlienError<any>;
+  constructor(input: AlienErrorDefinition<TContext> | (AlienError$1 & {
+    context?: any;
+  }));
   /**
-   * Sets the container cluster this container runs on.
-   * @param clusterId The ComputeCluster resource ID.
-   * @returns The Container builder instance.
+   * Create an AlienError from a type-safe error definition.
+   *
+   * @template TContext - Zod schema type for the error context
+   * @param definition - Error definition with type-safe context
+   * @returns New AlienError instance
    */
-  cluster(clusterId: string): this;
+  static fromDefinition<TContext extends z.ZodTypeAny>(definition: AlienErrorDefinition<TContext>): AlienError<TContext>;
   /**
-   * Sets the code for the container, either a pre-built image or source code to be built.
-   * @param code The container code configuration.
-   * @returns The Container builder instance.
+   * Create an AlienError from raw options (for compatibility).
+   *
+   * @param options - Raw error options conforming to AlienErrorOptions schema
+   * @returns New AlienError instance
    */
-  code(code: ContainerCode): this;
+  static fromOptions(options: AlienError$1): AlienError;
   /**
-   * Sets the CPU resources for the container.
+   * Helper function to get a user-friendly type name for error context.
    *
-   * For simplified configuration, use a single number:
-   * - `.cpu(1)` sets both min and desired to 1 vCPU
+   * @param error - Any value to get the type name for
+   * @returns User-friendly type name
+   */
+  private static getErrorTypeName;
+  /**
+   * Convert a JavaScript Error or any object to a generic AlienError.
    *
-   * For advanced configuration, use ResourceSpec:
-   * - `.cpu({ min: "0.5", desired: "1" })`
+   * This is equivalent to Rust's `.into_alien_error()` pattern and provides
+   * a way to convert any JavaScript error into the structured AlienError format.
    *
-   * @param value CPU in vCPUs (number) or ResourceSpec with min/desired.
-   * @returns The Container builder instance.
+   * @param error - Any JavaScript error or object to convert
+   * @returns AlienError with GENERIC_ERROR code and preserved original error
+   *
+   * @example
+   * ```typescript
+   * try {
+   *   throw new TypeError("Invalid argument")
+   * } catch (error) {
+   *   const alienError = AlienError.from(error)
+   *   console.log(alienError.code) // "GENERIC_ERROR"
+   *   console.log(alienError.context?.originalError) // Serialized TypeError
+   * }
+   * ```
+   *
+   * @example Chaining with context
+   * ```typescript
+   * try {
+   *   JSON.parse("invalid")
+   * } catch (error) {
+   *   throw AlienError.from(error).withContext(
+   *     ValidationError.create({
+   *       input: "invalid",
+   *       expectedFormat: "JSON"
+   *     })
+   *   )
+   * }
+   * ```
+   *
+   * @example AxiosError conversion
+   * ```typescript
+   * try {
+   *   await axios.get('/api/resource')
+   * } catch (error) {
+   *   // If error.response.data contains a valid AlienError structure, it will be parsed
+   *   const alienError = AlienError.from(error)
+   *   console.log(alienError.code) // Could be "REMOTE_RESOURCE_NOT_FOUND" if parsed from response
+   * }
+   * ```
    */
-  cpu(value: number | ResourceSpec): this;
+  static from(error: any): Promise<AlienError>;
   /**
-   * Sets the memory resources for the container.
+   * Add context to this error, creating a new error that wraps this one.
    *
-   * Format: "<number>Mi" or "<number>Gi"
+   * This is equivalent to Rust's `.with_context()` pattern and allows
+   * building error chains with increasing levels of context.
    *
-   * Example: "512Mi", "2Gi", "16Gi"
+   * @template TNewContext - Zod schema type for the new context
+   * @param definition - Error definition to wrap this error with
+   * @returns New AlienError with this error as the source
    *
-   * @param size Memory size string.
-   * @returns The Container builder instance.
+   * @example
+   * ```typescript
+   * // Clean fluent API
+   * const authError = (await AlienError.from(new Error("ECONNREFUSED")))
+   *   .withContext(DatabaseError.create({
+   *     host: "localhost",
+   *     port: 5432,
+   *     reason: "Connection refused"
+   *   }))
+   *   .withContext(AuthError.create({
+   *     username: "john",
+   *     reason: "Database unavailable"
+   *   }))
+   *
+   * // Error chain: AuthError -> DatabaseError -> GENERIC_ERROR
+   * console.log(authError.toString())
+   * ```
    */
-  memory(size: string): this;
+  withContext<TNewContext extends z.ZodTypeAny>(definition: AlienErrorDefinition<TNewContext>): AlienError<TNewContext>;
   /**
-   * Sets minimum and maximum replica counts with autoscaling configuration.
+   * Convert this AlienError to the wire format (AlienErrorOptions).
    *
-   * @param min Minimum replicas (always running).
-   * @param max Maximum replicas under load.
-   * @returns The Container builder instance.
+   * This method serializes the error into the standard format used
+   * for transmitting errors over the network or storing them.
+   *
+   * @returns AlienErrorOptions object representing this error
    */
-  minReplicas(min: number): this;
+  toOptions(): AlienError$1;
   /**
-   * Sets the maximum replica count for autoscaling.
-   * @param max Maximum replicas.
-   * @returns The Container builder instance.
-   */
-  maxReplicas(max: number): this;
-  /**
-   * Sets a fixed replica count (for stateful containers or stateless without autoscaling).
-   * Cannot be used with minReplicas/maxReplicas.
-   * @param count Fixed number of replicas.
-   * @returns The Container builder instance.
-   */
-  replicas(count: number): this;
-  /**
-   * Configures autoscaling behavior.
-   * @param config Autoscaling configuration.
-   * @returns The Container builder instance.
-   */
-  autoScale(config: ContainerAutoscaling): this;
-  /**
-   * Sets whether this container is stateful.
-   * Stateful containers get stable ordinals and support persistent storage.
-   * @param enabled Whether the container is stateful.
-   * @returns The Container builder instance.
-   */
-  stateful(enabled: boolean): this;
-  /**
-   * Adds an internal-only port to the container.
-   * Automatically creates DNS records for service discovery.
-   * @param port Port number (e.g., 3000, 8080, 5432).
-   * @returns The Container builder instance.
-   */
-  port(port: number): this;
-  /**
-   * Adds multiple internal-only ports to the container.
-   * @param ports Array of port numbers.
-   * @returns The Container builder instance.
-   */
-  ports(ports: number[]): this;
-  /**
-   * Exposes a named public endpoint for a container port.
+   * Get a sanitized version for external APIs (hides internal errors).
    *
-   * Endpoint names are the stable contract for URLs, DNS, and runtime
-   * environment injection.
+   * This method is crucial for security - it prevents sensitive internal
+   * error details from being exposed to external users while preserving
+   * the error chain structure for non-sensitive errors.
    *
-   * @param name Endpoint name, unique within this container.
-   * @param port Port number to expose.
-   * @param options "http"/"tcp" or endpoint options.
-   * @returns The Container builder instance.
-   */
-  publicEndpoint(name: string, port: number, options?: PublicEndpointOptions): this;
-  /**
-   * Sets environment variables for the container.
-   * @param vars Key-value pairs of environment variables.
-   * @returns The Container builder instance.
-   */
-  environment(vars: Record<string, string>): this;
-  /**
-   * Sets ephemeral storage size.
-   * Data is lost on container restart.
-   * @param size Storage size (e.g., "10Gi", "100Gi", "500Gi").
-   * @returns The Container builder instance.
-   */
-  ephemeralStorage(size: string): this;
-  /**
-   * Configures persistent storage and marks the container stateful.
-   * Data survives container restarts.
-   * @param size Storage size (e.g., "100Gi", "500Gi", "1Ti").
-   * @param options Optional mount path.
-   * @returns The Container builder instance.
-   */
-  persistentStorage(size: string, options?: PersistentStorageOptions): this;
-  /**
-   * Requests GPU resources.
-   * @param config GPU configuration with type and count.
-   * @returns The Container builder instance.
-   */
-  gpu(config: ContainerGpuSpec): this;
-  /**
-   * Configures health check for the container.
-   * @param config Health check configuration.
-   * @returns The Container builder instance.
-   */
-  healthCheck(config: HealthCheck): this;
-  /**
-   * Configures readiness probe (alias for healthCheck).
-   * @param config Readiness probe configuration with method and path.
-   * @returns The Container builder instance.
-   */
-  readinessProbe(config: {
-    method: string;
-    path: string;
-  }): this;
-  /**
-   * Sets the permission profile for this container.
-   * @param profile Permission profile name from stack permissions configuration.
-   * @returns The Container builder instance.
-   */
-  permissions(profile: string): this;
-  /**
-   * Assigns the container to a specific compute pool.
-   * @param poolName Compute pool name.
-   * @returns The Container builder instance.
-   */
-  pool(poolName: string): this;
-  /**
-   * Sets the command to override the image default.
-   * @param command Array of command arguments.
-   * @returns The Container builder instance.
-   */
-  command(command: string[]): this;
-  /**
-   * Sets the grace period used when stopping replicas during updates, drains, and deletes.
+   * @returns Sanitized AlienErrorOptions safe for external consumption
    *
-   * The value is expressed in seconds. Valid values are 1 through 86400.
+   * @example
+   * ```typescript
+   * const internalError = new AlienError(InternalApiError.create({
+   *   service: "payment-processor",
+   *   details: "Database password expired for user admin",
+   *   traceId: "trace-12345"
+   * }))
+   *
+   * console.log(internalError.toOptions())
+   * // Shows full details including sensitive information
+   *
+   * console.log(internalError.toExternal())
+   * // { code: "GENERIC_ERROR", message: "Internal server error", ... }
+   * ```
    */
-  stopGracePeriod(seconds: number): this;
+  toExternal(): AlienError$1;
   /**
-   * Links this container to another resource (Storage, Queue, KV, etc.).
-   * @param resource The resource to link to.
-   * @returns The Container builder instance.
+   * Check if this error chain contains an error with a specific code.
+   *
+   * This method traverses the entire error chain (this error and all
+   * source errors) to find if any error has the specified code.
+   *
+   * @param code - Error code to search for
+   * @returns True if the code is found anywhere in the error chain
+   *
+   * @example
+   * ```typescript
+   * const chainedError = authError.withContext(dbError.withContext(networkError))
+   *
+   * console.log(chainedError.hasErrorCode("AUTH_FAILED")) // true
+   * console.log(chainedError.hasErrorCode("DATABASE_CONNECTION_FAILED")) // true
+   * console.log(chainedError.hasErrorCode("NETWORK_TIMEOUT")) // true
+   * console.log(chainedError.hasErrorCode("NONEXISTENT_ERROR")) // false
+   * ```
    */
-  link(resource: Resource): this;
+  hasErrorCode(code: string): boolean;
   /**
-   * Enables or disables the Commands protocol for the container.
-   * When enabled, an app-owned receiver can lease this Container's pending commands and execute registered handlers.
-   * Default: false.
-   * @param enabled Whether to enable commands for this container.
-   * @returns The Container builder instance.
+   * Find the first error in the chain with a specific code.
+   *
+   * This method traverses the error chain and returns the first error
+   * instance that matches the specified code, allowing access to its
+   * specific context and details.
+   *
+   * @param code - Error code to search for
+   * @returns AlienError instance with the specified code, or undefined if not found
+   *
+   * @example
+   * ```typescript
+   * const chainedError = authError.withContext(dbError)
+   *
+   * const dbError = chainedError.findErrorByCode("DATABASE_CONNECTION_FAILED")
+   * if (dbError) {
+   *   console.log("Database error context:", dbError.context)
+   *   console.log("Host:", dbError.context?.host)
+   * }
+   * ```
    */
-  commandsEnabled(enabled: boolean): this;
+  findErrorByCode(code: string): AlienError | undefined;
   /**
-   * Builds and validates the container configuration.
-   * @returns An immutable Resource representing the configured container.
-   * @throws Error if the container configuration is invalid.
+   * Get a formatted string representation of the error chain.
+   *
+   * This method provides a human-readable representation of the entire
+   * error chain, showing how errors are nested and providing context
+   * for debugging and logging.
+   *
+   * @returns Formatted string showing the complete error chain
+   *
+   * @example
+   * ```typescript
+   * const chainedError = authError.withContext(dbError.withContext(networkError))
+   * console.log(chainedError.toString())
+   * // Output:
+   * // AUTH_FAILED: User authentication failed for 'john'
+   * //   ├─▶ DATABASE_CONNECTION_FAILED: Failed to connect to database 'localhost:5432'
+   * //     ├─▶ GENERIC_ERROR: Connection timeout
+   * ```
    */
-  build(): Resource;
+  toString(): string;
 }
+type ExtractContext<T> = T extends AlienErrorDefinition<infer TContext> ? z.infer<TContext> : never;
 //#endregion
-//#region src/compute-cluster.d.ts
+//#region src/common-errors.d.ts
 /**
- * Hardware requirements for a compute pool.
+ * Error thrown when a requested resource cannot be found in the stack state.
+ * This matches the Rust alien-core error: RESOURCE_NOT_FOUND
  */
-type ComputePoolRequirements = {
-  cpu: number | string;
-  memory: string;
-  ephemeralStorage?: string;
-  architecture?: "arm64" | "x86_64";
-  nestedVirtualization?: boolean;
-  accelerators?: Array<{
-    type: string;
-    count: number;
-  }>;
-};
-type ComputeChoiceRange = number | {
-  min: number;
-  max: number;
-  default: number;
-};
-type ComputePoolScale = {
-  type: "fixed";
-  machines: ComputeChoiceRange;
-} | {
-  type: "autoscale";
-  min: ComputeChoiceRange;
-  max: ComputeChoiceRange;
-};
-type ComputePoolInput = {
-  requirements: ComputePoolRequirements;
-  scale: ComputePoolScale;
+declare const ResourceNotFoundError: {
+  metadata: AlienErrorMetadata<z$1.ZodObject<{
+    resourceId: z$1.ZodString;
+    availableResources: z$1.ZodArray<z$1.ZodString>;
+  }, z$1.core.$strip>>;
+  contextSchema: z$1.ZodObject<{
+    resourceId: z$1.ZodString;
+    availableResources: z$1.ZodArray<z$1.ZodString>;
+  }, z$1.core.$strip>;
+  create: (context: {
+    resourceId: string;
+    availableResources: string[];
+  }) => AlienErrorDefinition<z$1.ZodObject<{
+    resourceId: z$1.ZodString;
+    availableResources: z$1.ZodArray<z$1.ZodString>;
+  }, z$1.core.$strip>>;
 };
 /**
- * Declares a ComputeCluster — the setup-owned machine boundary for daemons and
- * containers. Each capacity group inside the cluster becomes a separate
- * Auto Scaling Group (AWS), Managed Instance Group (GCP), or VM Scale Set
- * (Azure). Daemons reference a cluster via `daemon.cluster(...)` and (when
- * the cluster has more than one capacity group) a specific group via
- * `daemon.pool(...)`.
- *
+ * Error thrown when resource outputs cannot be parsed according to their expected schema.
+ * This indicates an internal system error or data corruption.
+ */
+declare const ResourceOutputsParseError: {
+  metadata: AlienErrorMetadata<z$1.ZodObject<{
+    resourceName: z$1.ZodString;
+    resourceType: z$1.ZodString;
+    validationErrors: z$1.ZodString;
+  }, z$1.core.$strip>>;
+  contextSchema: z$1.ZodObject<{
+    resourceName: z$1.ZodString;
+    resourceType: z$1.ZodString;
+    validationErrors: z$1.ZodString;
+  }, z$1.core.$strip>;
+  create: (context: {
+    resourceName: string;
+    resourceType: string;
+    validationErrors: string;
+  }) => AlienErrorDefinition<z$1.ZodObject<{
+    resourceName: z$1.ZodString;
+    resourceType: z$1.ZodString;
+    validationErrors: z$1.ZodString;
+  }, z$1.core.$strip>>;
+};
+/**
+ * Error thrown when there's a resource type mismatch during stack operations.
+ * This matches the Rust alien-core error: UNEXPECTED_RESOURCE_TYPE
+ */
+declare const UnexpectedResourceTypeError: {
+  metadata: AlienErrorMetadata<z$1.ZodObject<{
+    resourceId: z$1.ZodString;
+    expected: z$1.ZodString;
+    actual: z$1.ZodString;
+  }, z$1.core.$strip>>;
+  contextSchema: z$1.ZodObject<{
+    resourceId: z$1.ZodString;
+    expected: z$1.ZodString;
+    actual: z$1.ZodString;
+  }, z$1.core.$strip>;
+  create: (context: {
+    resourceId: string;
+    expected: string;
+    actual: string;
+  }) => AlienErrorDefinition<z$1.ZodObject<{
+    resourceId: z$1.ZodString;
+    expected: z$1.ZodString;
+    actual: z$1.ZodString;
+  }, z$1.core.$strip>>;
+};
+/**
+ * Error thrown when a binding's projected configuration is invalid.
+ */
+declare const InvalidBindingConfigError: {
+  metadata: AlienErrorMetadata<z$1.ZodObject<{
+    message: z$1.ZodString;
+    suggestion: z$1.ZodOptional<z$1.ZodString>;
+  }, z$1.core.$strip>>;
+  contextSchema: z$1.ZodObject<{
+    message: z$1.ZodString;
+    suggestion: z$1.ZodOptional<z$1.ZodString>;
+  }, z$1.core.$strip>;
+  create: (context: {
+    message: string;
+    suggestion?: string | undefined;
+  }) => AlienErrorDefinition<z$1.ZodObject<{
+    message: z$1.ZodString;
+    suggestion: z$1.ZodOptional<z$1.ZodString>;
+  }, z$1.core.$strip>>;
+};
+/**
+ * Error thrown when a binding is not found.
+ */
+declare const BindingNotFoundError: {
+  metadata: AlienErrorMetadata<z$1.ZodObject<{
+    bindingName: z$1.ZodString;
+    bindingType: z$1.ZodString;
+  }, z$1.core.$strip>>;
+  contextSchema: z$1.ZodObject<{
+    bindingName: z$1.ZodString;
+    bindingType: z$1.ZodString;
+  }, z$1.core.$strip>;
+  create: (context: {
+    bindingName: string;
+    bindingType: string;
+  }) => AlienErrorDefinition<z$1.ZodObject<{
+    bindingName: z$1.ZodString;
+    bindingType: z$1.ZodString;
+  }, z$1.core.$strip>>;
+};
+//#endregion
+//#region src/compute-cluster.d.ts
+/**
+ * Hardware requirements for a compute pool.
+ */
+type ComputePoolRequirements = {
+  cpu: number | string;
+  memory: string;
+  ephemeralStorage?: string;
+  architecture?: "arm64" | "x86_64";
+  nestedVirtualization?: boolean;
+  accelerators?: Array<{
+    type: string;
+    count: number;
+  }>;
+};
+type ComputeChoiceRange = number | {
+  min: number;
+  max: number;
+  default: number;
+};
+type ComputePoolScale = {
+  type: "fixed";
+  machines: ComputeChoiceRange;
+} | {
+  type: "autoscale";
+  min: ComputeChoiceRange;
+  max: ComputeChoiceRange;
+};
+type ComputePoolInput = {
+  requirements: ComputePoolRequirements;
+  scale: ComputePoolScale;
+};
+/**
+ * Declares a ComputeCluster — the setup-owned machine boundary for daemons and
+ * containers. Each capacity group inside the cluster becomes a separate
+ * Auto Scaling Group (AWS), Managed Instance Group (GCP), or VM Scale Set
+ * (Azure). Daemons reference a cluster via `daemon.cluster(...)` and (when
+ * the cluster has more than one capacity group) a specific group via
+ * `daemon.pool(...)`.
+ *
  * Application source declares portable pool requirements. Provider machine
  * names are selected later through deployment settings.
  */
@@ -26452,620 +26604,472 @@ declare class ComputeCluster {
   build(): Resource;
 }
 //#endregion
-//#region src/daemon.d.ts
-type DaemonPublicEndpointOptions = ExposeProtocol | {
-  protocol: ExposeProtocol;
+//#region src/container.d.ts
+type PublicEndpointOptions = "http" | "tcp" | {
+  protocol: "http" | "tcp";
   hostLabel?: string;
   wildcardSubdomains?: boolean;
 };
+interface PersistentStorageOptions {
+  /**
+   * Mount path inside the container.
+   *
+   * Defaults to `/data`.
+   */
+  mountPath?: string;
+}
 /**
- * Represents a resident process that runs once per eligible machine or node.
+ * Represents a long-running container workload.
  *
- * Daemons are intended for long-lived background processes such as endpoint
- * agents and local side services.
+ * Containers run on compute instances (EC2, GCE, Azure VMs) and are orchestrated
+ * by the managed container backend. They're designed for always-on workloads
+ * like web services, APIs, databases, and background workers.
  */
-declare class Daemon extends ResourceBuilder {
+declare class Container extends ResourceBuilder {
   private _config;
   /**
-   * Creates a new Daemon builder.
-   * @param id Identifier for the daemon. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+   * Creates a new Container builder.
+   * @param id Identifier for the container. Must be DNS-compatible: lowercase alphanumeric with hyphens.
    */
   constructor(id: string);
   /**
-   * Returns a ResourceType representing any daemon resource.
-   * Used for creating permission targets that apply to all daemon resources.
-   * @returns The "daemon" resource type.
+   * Returns a ResourceType representing any container resource.
+   * Used for creating permission targets that apply to all container resources.
+   * @returns The "container" resource type.
    */
   static any(): ResourceType;
   /**
-   * Sets the code for the daemon, either a pre-built image or source code to be built.
-   * @param code The daemon code configuration.
-   * @returns The Daemon builder instance.
+   * Sets the container cluster this container runs on.
+   * @param clusterId The ComputeCluster resource ID.
+   * @returns The Container builder instance.
    */
-  code(code: DaemonCode): this;
+  cluster(clusterId: string): this;
   /**
-   * Sets the ComputeCluster this daemon runs on for AWS/GCP/Azure deployments.
-   * Kubernetes and Local deployments ignore this field.
+   * Sets the code for the container, either a pre-built image or source code to be built.
+   * @param code The container code configuration.
+   * @returns The Container builder instance.
    */
-  cluster(clusterId: string): this;
+  code(code: ContainerCode): this;
   /**
-   * Sets CPU resources for each daemon instance.
+   * Sets the CPU resources for the container.
+   *
+   * For simplified configuration, use a single number:
+   * - `.cpu(1)` sets both min and desired to 1 vCPU
+   *
+   * For advanced configuration, use ResourceSpec:
+   * - `.cpu({ min: "0.5", desired: "1" })`
+   *
+   * @param value CPU in vCPUs (number) or ResourceSpec with min/desired.
+   * @returns The Container builder instance.
    */
   cpu(value: number | ResourceSpec): this;
   /**
-   * Sets memory resources for each daemon instance.
+   * Sets the memory resources for the container.
+   *
+   * Format: "<number>Mi" or "<number>Gi"
+   *
+   * Example: "512Mi", "2Gi", "16Gi"
+   *
+   * @param size Memory size string.
+   * @returns The Container builder instance.
    */
   memory(size: string): this;
   /**
-   * Sets the backend pool/capacity group for daemon placement.
+   * Sets minimum and maximum replica counts with autoscaling configuration.
+   *
+   * @param min Minimum replicas (always running).
+   * @param max Maximum replicas under load.
+   * @returns The Container builder instance.
    */
-  pool(pool: string): this;
+  minReplicas(min: number): this;
   /**
-   * Overrides the image default command.
+   * Sets the maximum replica count for autoscaling.
+   * @param max Maximum replicas.
+   * @returns The Container builder instance.
    */
-  command(command: string[]): this;
+  maxReplicas(max: number): this;
   /**
-   * Sets the grace period used when stopping daemon instances during updates, drains, and deletes.
-   *
-   * The value is expressed in seconds. Valid values are 1 through 86400.
+   * Sets a fixed replica count (for stateful containers or stateless without autoscaling).
+   * Cannot be used with minReplicas/maxReplicas.
+   * @param count Fixed number of replicas.
+   * @returns The Container builder instance.
    */
-  stopGracePeriod(seconds: number): this;
+  replicas(count: number): this;
   /**
-   * Sets backend runtime options for trusted daemon infrastructure.
-   *
-   * Use this only for daemons that intentionally need host-level access, such
-   * as a privileged loader that installs or supervises a native host process.
+   * Configures autoscaling behavior.
+   * @param config Autoscaling configuration.
+   * @returns The Container builder instance.
    */
-  runtime(runtime: DaemonRuntime): this;
+  autoScale(config: ContainerAutoscaling): this;
   /**
-   * Exposes a named public endpoint for a daemon port.
+   * Sets whether this container is stateful.
+   * Stateful containers get stable ordinals and support persistent storage.
+   * @param enabled Whether the container is stateful.
+   * @returns The Container builder instance.
    */
-  publicEndpoint(name: string, port: number, options?: DaemonPublicEndpointOptions): this;
+  stateful(enabled: boolean): this;
   /**
-   * Configures the HTTP health check used by public daemon endpoint load balancers.
+   * Adds an internal-only port to the container.
+   * Automatically creates DNS records for service discovery.
+   * @param port Port number (e.g., 3000, 8080, 5432).
+   * @returns The Container builder instance.
    */
-  healthCheck(config: HealthCheck): this;
+  port(port: number): this;
   /**
-   * Configures readiness probe (alias for healthCheck).
+   * Adds multiple internal-only ports to the container.
+   * @param ports Array of port numbers.
+   * @returns The Container builder instance.
    */
-  readinessProbe(config: {
-    method: string;
-    path: string;
-  }): this;
+  ports(ports: number[]): this;
   /**
-   * Sets key-value pairs as environment variables for the daemon.
-   * @param env A map of environment variable names to their values.
-   * @returns The Daemon builder instance.
+   * Exposes a named public endpoint for a container port.
+   *
+   * Endpoint names are the stable contract for URLs, DNS, and runtime
+   * environment injection.
+   *
+   * @param name Endpoint name, unique within this container.
+   * @param port Port number to expose.
+   * @param options "http"/"tcp" or endpoint options.
+   * @returns The Container builder instance.
    */
-  environment(env: Record<string, string>): this;
+  publicEndpoint(name: string, port: number, options?: PublicEndpointOptions): this;
   /**
-   * Links another resource to this daemon.
-   * This makes the linked resource accessible to the daemon, often by injecting
-   * environment variables or granting permissions.
-   * @param resource The resource to link.
-   * @returns The Daemon builder instance.
+   * Sets environment variables for the container.
+   * @param vars Key-value pairs of environment variables.
+   * @returns The Container builder instance.
    */
-  link(resource: Resource): this;
+  environment(vars: Record<string, string>): this;
   /**
-   * Assigns a permission profile to this daemon.
-   * The profile defines the permissions granted to this daemon when interacting
-   * with other cloud resources.
-   * @param permissions The permission profile name.
-   * @returns The Daemon builder instance.
+   * Sets ephemeral storage size.
+   * Data is lost on container restart.
+   * @param size Storage size (e.g., "10Gi", "100Gi", "500Gi").
+   * @returns The Container builder instance.
    */
-  permissions(permissions: string): this;
+  ephemeralStorage(size: string): this;
   /**
-   * Enables or disables the Commands protocol for the daemon.
-   * When enabled, an app-owned receiver can lease this Daemon's pending commands and execute registered handlers.
+   * Configures persistent storage and marks the container stateful.
+   * Data survives container restarts.
+   * @param size Storage size (e.g., "100Gi", "500Gi", "1Ti").
+   * @param options Optional mount path.
+   * @returns The Container builder instance.
+   */
+  persistentStorage(size: string, options?: PersistentStorageOptions): this;
+  /**
+   * Requests GPU resources.
+   * @param config GPU configuration with type and count.
+   * @returns The Container builder instance.
+   */
+  gpu(config: ContainerGpuSpec): this;
+  /**
+   * Configures health check for the container.
+   * @param config Health check configuration.
+   * @returns The Container builder instance.
+   */
+  healthCheck(config: HealthCheck): this;
+  /**
+   * Configures readiness probe (alias for healthCheck).
+   * @param config Readiness probe configuration with method and path.
+   * @returns The Container builder instance.
+   */
+  readinessProbe(config: {
+    method: string;
+    path: string;
+  }): this;
+  /**
+   * Sets the permission profile for this container.
+   * @param profile Permission profile name from stack permissions configuration.
+   * @returns The Container builder instance.
+   */
+  permissions(profile: string): this;
+  /**
+   * Assigns the container to a specific compute pool.
+   * @param poolName Compute pool name.
+   * @returns The Container builder instance.
+   */
+  pool(poolName: string): this;
+  /**
+   * Sets the command to override the image default.
+   * @param command Array of command arguments.
+   * @returns The Container builder instance.
+   */
+  command(command: string[]): this;
+  /**
+   * Sets the grace period used when stopping replicas during updates, drains, and deletes.
+   *
+   * The value is expressed in seconds. Valid values are 1 through 86400.
+   */
+  stopGracePeriod(seconds: number): this;
+  /**
+   * Links this container to another resource (Storage, Queue, KV, etc.).
+   * @param resource The resource to link to.
+   * @returns The Container builder instance.
+   */
+  link(resource: Resource): this;
+  /**
+   * Enables or disables the Commands protocol for the container.
+   * When enabled, an app-owned receiver can lease this Container's pending commands and execute registered handlers.
    * Default: false.
-   * @param enabled Whether to enable commands for this daemon.
-   * @returns The Daemon builder instance.
+   * @param enabled Whether to enable commands for this container.
+   * @returns The Container builder instance.
    */
   commandsEnabled(enabled: boolean): this;
   /**
-   * Builds and validates the daemon configuration.
-   * @returns An immutable Resource representing the configured daemon.
-   * @throws Error if the daemon configuration is invalid.
+   * Builds and validates the container configuration.
+   * @returns An immutable Resource representing the configured container.
+   * @throws Error if the container configuration is invalid.
    */
   build(): Resource;
 }
 //#endregion
-//#region src/build.d.ts
+//#region src/daemon.d.ts
+type DaemonPublicEndpointOptions = ExposeProtocol | {
+  protocol: ExposeProtocol;
+  hostLabel?: string;
+  wildcardSubdomains?: boolean;
+};
 /**
- * Represents a build resource that executes bash scripts to build code.
- * Builds are designed to be stateless and can be triggered on-demand to compile,
- * test, or package application code.
+ * Represents a resident process that runs once per eligible machine or node.
+ *
+ * Daemons are intended for long-lived background processes such as endpoint
+ * agents and local side services.
  */
-declare class Build {
+declare class Daemon extends ResourceBuilder {
   private _config;
   /**
-   * Creates a new Build builder.
-   * @param id Identifier for the build resource. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+   * Creates a new Daemon builder.
+   * @param id Identifier for the daemon. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
    */
   constructor(id: string);
   /**
-   * Returns a ResourceType representing any build resource.
-   * Used for creating permission targets that apply to all build resources.
-   * @returns The "build" resource type.
+   * Returns a ResourceType representing any daemon resource.
+   * Used for creating permission targets that apply to all daemon resources.
+   * @returns The "daemon" resource type.
    */
   static any(): ResourceType;
   /**
-   * Sets the compute type for the build.
-   * @param type The compute type (small, medium, large, x-large).
-   * @returns The Build builder instance.
+   * Sets the code for the daemon, either a pre-built image or source code to be built.
+   * @param code The daemon code configuration.
+   * @returns The Daemon builder instance.
    */
-  computeType(type: ComputeType): this;
+  code(code: DaemonCode): this;
   /**
-   * Sets key-value pairs as environment variables for the build.
+   * Sets the ComputeCluster this daemon runs on for AWS/GCP/Azure deployments.
+   * Kubernetes and Local deployments ignore this field.
+   */
+  cluster(clusterId: string): this;
+  /**
+   * Sets CPU resources for each daemon instance.
+   */
+  cpu(value: number | ResourceSpec): this;
+  /**
+   * Sets memory resources for each daemon instance.
+   */
+  memory(size: string): this;
+  /**
+   * Sets the backend pool/capacity group for daemon placement.
+   */
+  pool(pool: string): this;
+  /**
+   * Overrides the image default command.
+   */
+  command(command: string[]): this;
+  /**
+   * Sets the grace period used when stopping daemon instances during updates, drains, and deletes.
+   *
+   * The value is expressed in seconds. Valid values are 1 through 86400.
+   */
+  stopGracePeriod(seconds: number): this;
+  /**
+   * Sets backend runtime options for trusted daemon infrastructure.
+   *
+   * Use this only for daemons that intentionally need host-level access, such
+   * as a privileged loader that installs or supervises a native host process.
+   */
+  runtime(runtime: DaemonRuntime): this;
+  /**
+   * Exposes a named public endpoint for a daemon port.
+   */
+  publicEndpoint(name: string, port: number, options?: DaemonPublicEndpointOptions): this;
+  /**
+   * Configures the HTTP health check used by public daemon endpoint load balancers.
+   */
+  healthCheck(config: HealthCheck): this;
+  /**
+   * Configures readiness probe (alias for healthCheck).
+   */
+  readinessProbe(config: {
+    method: string;
+    path: string;
+  }): this;
+  /**
+   * Sets key-value pairs as environment variables for the daemon.
    * @param env A map of environment variable names to their values.
-   * @returns The Build builder instance.
+   * @returns The Daemon builder instance.
    */
   environment(env: Record<string, string>): this;
   /**
-   * Links another resource (e.g., Storage, ArtifactRegistry, Role) to this build.
-   * This makes the linked resource accessible to the build, often by injecting
+   * Links another resource to this daemon.
+   * This makes the linked resource accessible to the daemon, often by injecting
    * environment variables or granting permissions.
    * @param resource The resource to link.
-   * @returns The Build builder instance.
+   * @returns The Daemon builder instance.
    */
   link(resource: Resource): this;
   /**
-   * Assigns a permission profile to this build.
-   * The profile defines the permissions granted to this build when interacting
+   * Assigns a permission profile to this daemon.
+   * The profile defines the permissions granted to this daemon when interacting
    * with other cloud resources.
    * @param permissions The permission profile name.
-   * @returns The Build builder instance.
+   * @returns The Daemon builder instance.
    */
   permissions(permissions: string): this;
   /**
-   * Builds and validates the build configuration.
-   * @returns An immutable Resource representing the configured build.
-   * @throws Error if the build configuration is invalid.
+   * Enables or disables the Commands protocol for the daemon.
+   * When enabled, an app-owned receiver can lease this Daemon's pending commands and execute registered handlers.
+   * Default: false.
+   * @param enabled Whether to enable commands for this daemon.
+   * @returns The Daemon builder instance.
+   */
+  commandsEnabled(enabled: boolean): this;
+  /**
+   * Builds and validates the daemon configuration.
+   * @returns An immutable Resource representing the configured daemon.
+   * @throws Error if the daemon configuration is invalid.
    */
   build(): Resource;
 }
 //#endregion
-//#region src/artifact-registry.d.ts
+//#region src/email.d.ts
 /**
- * Represents an artifact registry for storing container images and other build artifacts.
- * This is a high-level wrapper resource that provides a cloud-agnostic interface over
- * AWS ECR, GCP Artifact Registry, and Azure Container Registry.
+ * Email infrastructure for sending and receiving mail on customer-owned
+ * domains (AWS SES). Provisions a shared configuration set, optional inbound
+ * and event wiring, and one email identity (Easy DKIM) per seed domain.
+ *
+ * The resource owns the email infrastructure, not the domain lifecycle. Seed
+ * domains are optional: products that create and verify domains dynamically
+ * should manage identities at runtime through the `email/manage-identities`
+ * grant instead of listing them here. Runtime-created identities are
+ * application data — they are not tracked by the deployment and survive stack
+ * deletion.
+ *
+ * After deployment, create the per-domain DKIM CNAME records from the
+ * resource outputs — SES verifies each domain once the records exist in DNS.
+ *
+ * When inbound mail is configured, the receipt rule is a catch-all (no
+ * recipient filter), so mail for runtime-verified identities lands in the
+ * bucket without redeployment. Setup activates the provisioned receipt rule
+ * set automatically. SES permits one active receipt rule set per account and
+ * region, so an AWS stack may contain only one Email with inbound delivery,
+ * and installing it makes its rule set the account's active rule set.
  */
-declare class ArtifactRegistry {
+declare class Email extends ResourceBuilder {
   private _config;
   /**
-   * Creates a new ArtifactRegistry builder.
-   * @param id Identifier for the artifact registry. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+   * Creates a new Email builder.
+   * @param id Identifier for the email resource. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
    */
   constructor(id: string);
   /**
-   * Returns a ResourceType representing any artifact registry resource.
-   * Used for creating permission targets that apply to all artifact registry resources.
-   * @returns The "artifact-registry" resource type.
+   * Returns a ResourceType representing any email resource.
+   * Used for creating permission targets that apply to all email resources.
+   * @returns The "email" resource type.
    */
   static any(): ResourceType;
   /**
-   * AWS-only: Configure ECR private image replication to additional regions.
-   * Ensures images pushed in the registry's home region are automatically
-   * available in these destination regions (required when Lambda or other
-   * compute runs in a different region).
-   * @param regions - AWS region codes to replicate to (e.g., ["us-east-2", "eu-west-1"])
+   * Sets the seed mail domains provisioned at deploy time (one SES identity
+   * each). Optional — omit for products that manage domains at runtime.
+   * @param domains The mail domains (e.g. `["mail.example.com"]`).
+   * @returns The Email builder instance.
    */
-  replicationRegions(regions: string[]): this;
+  domains(domains: string[]): this;
   /**
-   * Builds and validates the artifact registry configuration.
-   * @returns An immutable Resource representing the configured artifact registry.
-   * @throws Error if the artifact registry configuration is invalid.
+   * Adds a single seed mail domain.
+   * @param domain The mail domain (e.g. `"mail.example.com"`).
+   * @returns The Email builder instance.
    */
-  build(): Resource;
-}
-//#endregion
-//#region src/vault.d.ts
-/**
- * Represents a secure vault for storing secrets.
- * This resource provides a platform-agnostic interface over cloud-native secret management services:
- * - AWS: AWS Secrets Manager with prefixed secret names
- * - GCP: Secret Manager with prefixed secret names
- * - Azure: Key Vault resource
- *
- * The vault acts as a namespace for secrets and controls access permissions for workers and services.
- */
-declare class Vault extends ResourceBuilder {
-  private _config;
+  domain(domain: string): this;
   /**
-   * Creates a new Vault builder.
-   * @param id Identifier for the vault. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+   * Configures inbound mail: raw incoming mail for the configured domains is
+   * written to the linked Storage bucket. Note the post-deploy activation
+   * step described in the class documentation.
+   * @param storage The Storage resource that receives raw incoming mail.
+   * @returns The Email builder instance.
    */
-  constructor(id: string);
+  inbound(storage: Resource): this;
   /**
-   * Returns a ResourceType representing any vault resource.
-   * Used for creating permission targets that apply to all vault resources.
-   * @returns The "vault" resource type.
+   * Configures sending events: send / delivery / bounce / complaint /
+   * delivery-delay / reject events are delivered to the linked Queue.
+   * @param queue The Queue resource that receives sending events.
+   * @returns The Email builder instance.
    */
-  static any(): ResourceType;
+  events(queue: Resource): this;
   /**
-   * Builds and validates the vault configuration.
-   * @returns An immutable Resource representing the configured vault.
-   * @throws Error if the vault configuration is invalid.
+   * Builds and validates the email configuration.
+   * @returns An immutable Resource representing the configured email infrastructure.
+   * @throws Error if the email configuration is invalid.
    */
   build(): Resource;
 }
 //#endregion
-//#region src/kv.d.ts
+//#region src/stack.d.ts
 /**
- * Represents a key-value store for data storage.
- * This resource provides a platform-agnostic interface over cloud-native KV services:
- * - AWS: DynamoDB with hash bucketing for load distribution
- * - GCP: Firestore with document-based storage and collection management
- * - Azure: Table Storage with client-side TTL filtering and partition fan-out
- *
- * The KV store supports basic operations: get, put, delete, exists, and scan_prefix.
- * All operations support TTL for automatic expiration and conditional operations.
- *
- * Key Features:
- * - Universal size limits: 512-byte keys, 24 KiB values
- * - TTL support with logical expiry across all platforms
- * - Atomic absent and version preconditions for puts and deletes
- * - Prefix-based scanning with pagination
- * - Platform-specific optimizations while maintaining consistent API
- *
- * Size Constraints:
- * - Keys: ≤ 512 bytes with portable ASCII charset (a-z, A-Z, 0-9, -, _, :, .)
- * - Values: ≤ 24,576 bytes (24 KiB)
- *
- * TTL Behavior:
- * - Expired items appear absent on reads even if physically present
- * - TTL precision varies by platform but logical behavior is consistent
- *
- * Scan Operations:
- * - Returns arbitrary, unordered subsets in backend-natural order
- * - No ordering guarantees across platforms
- * - May return ≤ limit items (not guaranteed to fill)
- * - Clients must de-duplicate keys across pages
- * - No completeness guarantee under concurrent writes
+ * Options for adding a resource to a stack.
  */
-declare class Kv extends ResourceBuilder {
-  private _config;
-  /**
-   * Creates a new KV builder.
-   * @param id Identifier for the KV store. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
-   */
-  constructor(id: string);
-  /**
-   * Returns a ResourceType representing any KV resource.
-   * Used for creating permission targets that apply to all KV resources.
-   * @returns The "kv" resource type.
-   */
-  static any(): ResourceType;
+interface AddResourceOptions {
   /**
-   * Builds and validates the KV configuration.
-   * @returns An immutable Resource representing the configured KV store.
-   * @throws Error if the KV configuration is invalid.
+   * Enable remote bindings for this resource (BYOB use case).
+   * When true, binding params are synced to StackState for external access.
+   * Default: false (prevents sensitive data in synced state).
    */
-  build(): Resource;
+  remoteAccess?: boolean;
 }
-//#endregion
-//#region src/postgres.d.ts
 /**
- * Represents a managed PostgreSQL database. The target platform decides the backend;
- * the database is private and reachable only by same-stack workloads.
+ * Represents a collection of cloud resources that are managed together.
+ * Stacks are the top-level organizational unit in an Alien application.
  */
-declare class Postgres extends ResourceBuilder {
+declare class Stack {
   private _config;
   /**
-   * Creates a new Postgres builder.
-   * @param id ID of the database. A database of this name is created on the server.
+   * Creates a new Stack builder.
+   * @param id Identifier for the stack. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 128 characters.
    */
   constructor(id: string);
   /**
-   * Returns a ResourceType representing any postgres resource.
-   * Used for creating permission targets that apply to all postgres resources.
-   * @returns The "postgres" resource type.
-   */
-  static any(): ResourceType;
-  /**
-   * Sets the major engine version ("15" | "16" | "17"). Default `"17"`.
-   * The union narrows the generated schema's free-form string for authoring ergonomics;
-   * keep it in sync with the supported majors if the Rust `Postgres` resource adds one.
-   * @param value The major version.
-   * @returns The Postgres builder instance.
-   */
-  version(value: "15" | "16" | "17"): this;
-  /**
-   * Requests vCPUs (e.g. "0.5", "2"). On GCP and Azure, `cpu` and `memory` together pick the
-   * smallest tier that satisfies both. On AWS (Aurora Serverless v2) sizing comes from `memory`, so
-   * `cpu` is ignored.
-   * @param value The requested vCPUs.
-   * @returns The Postgres builder instance.
-   */
-  cpu(value: string): this;
-  /**
-   * Requests memory (e.g. "1Gi", "8Gi"). Drives the size on AWS (the ACU ceiling) and, together
-   * with `cpu`, the tier on GCP and Azure.
-   * @param value The requested memory.
-   * @returns The Postgres builder instance.
-   */
-  memory(value: string): this;
-  /**
-   * Sets allocated storage (e.g. "100Gi"). Default `"20Gi"`. Grow-only.
-   * @param value The storage size.
-   * @returns The Postgres builder instance.
-   */
-  storage(value: string): this;
-  /**
-   * Enables multi-AZ / regional / zone-redundant high availability. Default `false`.
-   * @param value Whether to enable HA.
-   * @returns The Postgres builder instance.
-   */
-  highAvailability(value?: boolean): this;
-  /**
-   * Builds and validates the postgres configuration.
-   * @returns An immutable Resource representing the configured database.
-   * @throws Error if the configuration is invalid.
-   */
-  build(): Resource;
-}
-//#endregion
-//#region src/ai.d.ts
-/**
- * Represents an AI Gateway resource that provides a unified interface to
- * managed AI inference services across cloud providers.
- */
-declare class AI extends ResourceBuilder {
-  private _config;
-  /**
-   * Creates a new AI builder.
-   * @param id Identifier for the AI resource. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+   * Adds a resource to the stack with a specified lifecycle.
+   * @param resource The resource to add (e.g., Worker, Storage).
+   * @param lifecycle The lifecycle state of the resource (e.g., Frozen, Live).
+   * @param options Optional configuration for the resource entry.
+   * @returns The Stack builder instance.
    */
-  constructor(id: string);
+  add(resource: Resource, lifecycle: ResourceLifecycle, options?: AddResourceOptions): this;
   /**
-   * Returns a ResourceType representing any AI resource.
-   * Used for creating permission targets that apply to all AI resources.
-   * @returns The "ai" resource type.
+   * Declare which platforms this stack supports.
+   * When omitted, the stack supports all platforms.
    */
-  static any(): ResourceType;
+  platforms(platforms: Platform[]): this;
   /**
-   * Builds and validates the AI configuration.
-   * @returns An immutable Resource representing the configured AI Gateway.
-   * @throws Error if the AI configuration is invalid.
+   * Configure permissions for this stack.
+   * @param config Permission configuration
+   * @returns The Stack builder instance.
    */
-  build(): Resource;
-}
-//#endregion
-//#region src/queue.d.ts
-/**
- * Represents a message queue resource with minimal, portable semantics.
- * Queue integrates with platform-native services (AWS SQS, GCP Pub/Sub, Azure Service Bus).
- */
-declare class Queue extends ResourceBuilder {
-  private _config;
+  permissions(config: PermissionsConfig): this;
   /**
-   * Creates a new Queue builder.
-   * @param id Identifier for the queue. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+   * Configure values that must be provided before setup or deployment can proceed.
+   * @param inputs Stack input definitions created with alien.inputs({...}).
+   * @returns The Stack builder instance.
    */
-  constructor(id: string);
+  inputs(inputs: StackInputCollection | readonly StackInputDefinition[]): this;
   /**
-   * Returns a ResourceType representing any queue resource.
-   * Used for creating permission targets that apply to all queue resources.
-   * @returns The "queue" resource type.
+   * Gets the stack ID without building/validating the stack.
+   * @returns The stack ID.
    */
-  static any(): ResourceType;
+  get id(): string;
   /**
-   * Builds and validates the queue configuration.
-   * @returns An immutable Resource representing the configured queue.
-   * @throws Error if the queue configuration is invalid.
+   * Builds and validates the stack configuration.
+   * @returns The complete and validated stack configuration.
+   * @throws Error if the stack configuration is invalid.
    */
-  build(): Resource;
-}
-//#endregion
-//#region src/email.d.ts
-/**
- * Email infrastructure for sending and receiving mail on customer-owned
- * domains (AWS SES). Provisions a shared configuration set, optional inbound
- * and event wiring, and one email identity (Easy DKIM) per seed domain.
- *
- * The resource owns the email infrastructure, not the domain lifecycle. Seed
- * domains are optional: products that create and verify domains dynamically
- * should manage identities at runtime through the `email/manage-identities`
- * grant instead of listing them here. Runtime-created identities are
- * application data — they are not tracked by the deployment and survive stack
- * deletion.
- *
- * After deployment, create the per-domain DKIM CNAME records from the
- * resource outputs — SES verifies each domain once the records exist in DNS.
- *
- * When inbound mail is configured, the receipt rule is a catch-all (no
- * recipient filter), so mail for runtime-verified identities lands in the
- * bucket without redeployment. Setup activates the provisioned receipt rule
- * set automatically. SES permits one active receipt rule set per account and
- * region, so an AWS stack may contain only one Email with inbound delivery,
- * and installing it makes its rule set the account's active rule set.
- */
-declare class Email extends ResourceBuilder {
-  private _config;
-  /**
-   * Creates a new Email builder.
-   * @param id Identifier for the email resource. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
-   */
-  constructor(id: string);
-  /**
-   * Returns a ResourceType representing any email resource.
-   * Used for creating permission targets that apply to all email resources.
-   * @returns The "email" resource type.
-   */
-  static any(): ResourceType;
-  /**
-   * Sets the seed mail domains provisioned at deploy time (one SES identity
-   * each). Optional — omit for products that manage domains at runtime.
-   * @param domains The mail domains (e.g. `["mail.example.com"]`).
-   * @returns The Email builder instance.
-   */
-  domains(domains: string[]): this;
-  /**
-   * Adds a single seed mail domain.
-   * @param domain The mail domain (e.g. `"mail.example.com"`).
-   * @returns The Email builder instance.
-   */
-  domain(domain: string): this;
-  /**
-   * Configures inbound mail: raw incoming mail for the configured domains is
-   * written to the linked Storage bucket. Note the post-deploy activation
-   * step described in the class documentation.
-   * @param storage The Storage resource that receives raw incoming mail.
-   * @returns The Email builder instance.
-   */
-  inbound(storage: Resource): this;
-  /**
-   * Configures sending events: send / delivery / bounce / complaint /
-   * delivery-delay / reject events are delivered to the linked Queue.
-   * @param queue The Queue resource that receives sending events.
-   * @returns The Email builder instance.
-   */
-  events(queue: Resource): this;
-  /**
-   * Builds and validates the email configuration.
-   * @returns An immutable Resource representing the configured email infrastructure.
-   * @throws Error if the email configuration is invalid.
-   */
-  build(): Resource;
-}
-//#endregion
-//#region src/service-account.d.ts
-/**
- * Represents a non-human identity that can be assumed by compute services.
- *
- * Maps to:
- * - AWS: IAM Role
- * - GCP: Service Account
- * - Azure: User-assigned Managed Identity
- *
- * ServiceAccounts can be used to grant specific permissions to compute resources
- * and can be impersonated by other services for cross-account or cross-service access.
- *
- * @example
- * ```typescript
- * import { ServiceAccount, Worker } from "@alien/core"
- *
- * // Create a service account with stack-level permissions
- * const dataProcessorAccount = new ServiceAccount("data-processor")
- *   .build()
- *
- * // Link it to a function to use its identity
- * const processor = new Worker("processor")
- *   .code({ type: "image", image: "processor:latest" })
- *   .link(dataProcessorAccount)
- *   .build()
- * ```
- */
-declare class ServiceAccount {
-  private _config;
-  /**
-   * Creates a new ServiceAccount builder.
-   * @param id Identifier for the service account. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
-   */
-  constructor(id: string);
-  /**
-   * Returns a ResourceType representing any service account resource.
-   * Used for creating permission targets that apply to all service account resources.
-   * @returns The "service-account" resource type.
-   */
-  static any(): ResourceType;
-  /**
-   * Adds a stack-level permission set to the service account.
-   * Stack-level permissions apply to all resources in the stack.
-   *
-   * Note: Only inline permission set objects are supported. To use built-in permission sets,
-   * you need to resolve them first through the permission set registry or use permission profiles
-   * in your stack configuration.
-   *
-   * @example
-   * ```typescript
-   * import { ServiceAccount, type PermissionSet } from "@alien/core"
-   *
-   * const customPermissionSet: PermissionSet = {
-   *   id: "custom/my-perms",
-   *   description: "Custom permissions",
-   *   platforms: {
-   *     aws: [{ grant: { actions: ["s3:GetObject"] }, binding: { stack: { resources: ["*"] } } }]
-   *   }
-   * }
-   *
-   * const account = new ServiceAccount("custom-processor")
-   *   .stackPermissionSet(customPermissionSet)
-   *   .build()
-   * ```
-   *
-   * @param permissionSet The permission set object with platform-specific permissions
-   * @returns The ServiceAccount builder instance.
-   */
-  stackPermissionSet(permissionSet: PermissionSet): this;
-  /**
-   * Builds and validates the service account configuration.
-   * @returns An immutable Resource representing the configured service account.
-   * @throws Error if the service account configuration is invalid.
-   */
-  build(): Resource;
-}
-//#endregion
-//#region src/stack.d.ts
-/**
- * Options for adding a resource to a stack.
- */
-interface AddResourceOptions {
-  /**
-   * Enable remote bindings for this resource (BYOB use case).
-   * When true, binding params are synced to StackState for external access.
-   * Default: false (prevents sensitive data in synced state).
-   */
-  remoteAccess?: boolean;
-}
-/**
- * Represents a collection of cloud resources that are managed together.
- * Stacks are the top-level organizational unit in an Alien application.
- */
-declare class Stack {
-  private _config;
-  /**
-   * Creates a new Stack builder.
-   * @param id Identifier for the stack. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 128 characters.
-   */
-  constructor(id: string);
-  /**
-   * Adds a resource to the stack with a specified lifecycle.
-   * @param resource The resource to add (e.g., Worker, Storage).
-   * @param lifecycle The lifecycle state of the resource (e.g., Frozen, Live).
-   * @param options Optional configuration for the resource entry.
-   * @returns The Stack builder instance.
-   */
-  add(resource: Resource, lifecycle: ResourceLifecycle, options?: AddResourceOptions): this;
-  /**
-   * Declare which platforms this stack supports.
-   * When omitted, the stack supports all platforms.
-   */
-  platforms(platforms: Platform[]): this;
-  /**
-   * Configure permissions for this stack.
-   * @param config Permission configuration
-   * @returns The Stack builder instance.
-   */
-  permissions(config: PermissionsConfig): this;
-  /**
-   * Configure values that must be provided before setup or deployment can proceed.
-   * @param inputs Stack input definitions created with alien.inputs({...}).
-   * @returns The Stack builder instance.
-   */
-  inputs(inputs: StackInputCollection | readonly StackInputDefinition[]): this;
-  /**
-   * Gets the stack ID without building/validating the stack.
-   * @returns The stack ID.
-   */
-  get id(): string;
-  /**
-   * Builds and validates the stack configuration.
-   * @returns The complete and validated stack configuration.
-   * @throws Error if the stack configuration is invalid.
-   */
-  build(): Stack$1;
+  build(): Stack$1;
 }
 //#endregion
 //#region src/get-resource-outputs.d.ts
@@ -27477,459 +27481,455 @@ declare function getResourceOutputs<K extends keyof typeof ResourceSchemaMapping
   };
 }): z$1.infer<(typeof ResourceSchemaMapping)[K]["output"]>;
 //#endregion
-//#region src/error.d.ts
+//#region src/kv.d.ts
 /**
- * Base interface that all error type definitions must implement.
+ * Represents a key-value store for data storage.
+ * This resource provides a platform-agnostic interface over cloud-native KV services:
+ * - AWS: DynamoDB with hash bucketing for load distribution
+ * - GCP: Firestore with document-based storage and collection management
+ * - Azure: Table Storage with client-side TTL filtering and partition fan-out
  *
- * This provides the structure for creating type-safe error definitions
- * with Zod validation and contextual information.
+ * The KV store supports basic operations: get, put, delete, exists, and scan_prefix.
+ * All operations support TTL for automatic expiration and conditional operations.
  *
- * @template TContext - Zod schema type for the error context
+ * Key Features:
+ * - Universal size limits: 512-byte keys, 24 KiB values
+ * - TTL support with logical expiry across all platforms
+ * - Atomic absent and version preconditions for puts and deletes
+ * - Prefix-based scanning with pagination
+ * - Platform-specific optimizations while maintaining consistent API
+ *
+ * Size Constraints:
+ * - Keys: ≤ 512 bytes with portable ASCII charset (a-z, A-Z, 0-9, -, _, :, .)
+ * - Values: ≤ 24,576 bytes (24 KiB)
+ *
+ * TTL Behavior:
+ * - Expired items appear absent on reads even if physically present
+ * - TTL precision varies by platform but logical behavior is consistent
+ *
+ * Scan Operations:
+ * - Returns arbitrary, unordered subsets in backend-natural order
+ * - No ordering guarantees across platforms
+ * - May return ≤ limit items (not guaranteed to fill)
+ * - Clients must de-duplicate keys across pages
+ * - No completeness guarantee under concurrent writes
  */
-interface AlienErrorMetadata<TContext extends z.ZodTypeAny> {
-  /** Unique error code (e.g., "DATABASE_CONNECTION_FAILED") */
-  code: string;
-  /** Zod schema for type-safe context validation */
-  context: TContext;
-  /** Whether this error can be retried */
-  retryable: boolean;
-  /** Whether this error contains sensitive information */
-  internal: boolean;
-  /** HTTP status code for API responses */
-  httpStatusCode?: number;
-  /** Worker to generate human-readable error message from context */
-  message: (context: z.infer<TContext>) => string;
+declare class Kv extends ResourceBuilder {
+  private _config;
+  /**
+   * Creates a new KV builder.
+   * @param id Identifier for the KV store. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+   */
+  constructor(id: string);
+  /**
+   * Returns a ResourceType representing any KV resource.
+   * Used for creating permission targets that apply to all KV resources.
+   * @returns The "kv" resource type.
+   */
+  static any(): ResourceType;
+  /**
+   * Builds and validates the KV configuration.
+   * @returns An immutable Resource representing the configured KV store.
+   * @throws Error if the KV configuration is invalid.
+   */
+  build(): Resource;
 }
+//#endregion
+//#region src/postgres.d.ts
 /**
- * Helper function to create type-safe error definitions.
+ * Represents a managed PostgreSQL database. The target platform decides the backend;
+ * the database is private and reachable only by same-stack workloads.
+ */
+declare class Postgres extends ResourceBuilder {
+  private _config;
+  /**
+   * Creates a new Postgres builder.
+   * @param id ID of the database. A database of this name is created on the server.
+   */
+  constructor(id: string);
+  /**
+   * Returns a ResourceType representing any postgres resource.
+   * Used for creating permission targets that apply to all postgres resources.
+   * @returns The "postgres" resource type.
+   */
+  static any(): ResourceType;
+  /**
+   * Sets the major engine version ("15" | "16" | "17"). Default `"17"`.
+   * The union narrows the generated schema's free-form string for authoring ergonomics;
+   * keep it in sync with the supported majors if the Rust `Postgres` resource adds one.
+   * @param value The major version.
+   * @returns The Postgres builder instance.
+   */
+  version(value: "15" | "16" | "17"): this;
+  /**
+   * Requests vCPUs (e.g. "0.5", "2"). On GCP and Azure, `cpu` and `memory` together pick the
+   * smallest tier that satisfies both. On AWS (Aurora Serverless v2) sizing comes from `memory`, so
+   * `cpu` is ignored.
+   * @param value The requested vCPUs.
+   * @returns The Postgres builder instance.
+   */
+  cpu(value: string): this;
+  /**
+   * Requests memory (e.g. "1Gi", "8Gi"). Drives the size on AWS (the ACU ceiling) and, together
+   * with `cpu`, the tier on GCP and Azure.
+   * @param value The requested memory.
+   * @returns The Postgres builder instance.
+   */
+  memory(value: string): this;
+  /**
+   * Sets allocated storage (e.g. "100Gi"). Default `"20Gi"`. Grow-only.
+   * @param value The storage size.
+   * @returns The Postgres builder instance.
+   */
+  storage(value: string): this;
+  /**
+   * Enables multi-AZ / regional / zone-redundant high availability. Default `false`.
+   * @param value Whether to enable HA.
+   * @returns The Postgres builder instance.
+   */
+  highAvailability(value?: boolean): this;
+  /**
+   * Builds and validates the postgres configuration.
+   * @returns An immutable Resource representing the configured database.
+   * @throws Error if the configuration is invalid.
+   */
+  build(): Resource;
+}
+//#endregion
+//#region src/queue.d.ts
+/**
+ * Represents a message queue resource with minimal, portable semantics.
+ * Queue integrates with platform-native services (AWS SQS, GCP Pub/Sub, Azure Service Bus).
+ */
+declare class Queue extends ResourceBuilder {
+  private _config;
+  /**
+   * Creates a new Queue builder.
+   * @param id Identifier for the queue. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+   */
+  constructor(id: string);
+  /**
+   * Returns a ResourceType representing any queue resource.
+   * Used for creating permission targets that apply to all queue resources.
+   * @returns The "queue" resource type.
+   */
+  static any(): ResourceType;
+  /**
+   * Builds and validates the queue configuration.
+   * @returns An immutable Resource representing the configured queue.
+   * @throws Error if the queue configuration is invalid.
+   */
+  build(): Resource;
+}
+//#endregion
+//#region src/service-account.d.ts
+/**
+ * Represents a non-human identity that can be assumed by compute services.
  *
- * This function provides a clean API for defining reusable error types
- * with full TypeScript type safety and Zod validation.
+ * Maps to:
+ * - AWS: IAM Role
+ * - GCP: Service Account
+ * - Azure: User-assigned Managed Identity
  *
- * @template TContext - Zod schema type for the error context
- * @param metadata - Error metadata including code, schema, and message generator
- * @returns Object with metadata and a create function for error instances
+ * ServiceAccounts can be used to grant specific permissions to compute resources
+ * and can be impersonated by other services for cross-account or cross-service access.
  *
  * @example
  * ```typescript
- * const UserNotFound = defineError({
- *   code: "USER_NOT_FOUND",
- *   context: z.object({
- *     userId: z.string(),
- *     searchMethod: z.string(),
- *   }),
- *   message: ({ userId, searchMethod }) =>
- *     `User '${userId}' not found using method '${searchMethod}'`,
- *   retryable: false,
- *   internal: false,
- *   httpStatusCode: 404,
- * })
+ * import { ServiceAccount, Worker } from "@alien/core"
  *
- * // Usage
- * const error = UserNotFound.create({
- *   userId: "123",
- *   searchMethod: "database_lookup"
- * })
+ * // Create a service account with stack-level permissions
+ * const dataProcessorAccount = new ServiceAccount("data-processor")
+ *   .build()
+ *
+ * // Link it to a function to use its identity
+ * const processor = new Worker("processor")
+ *   .code({ type: "image", image: "processor:latest" })
+ *   .link(dataProcessorAccount)
+ *   .build()
  * ```
  */
-declare function defineError<TContext extends z.ZodTypeAny>(metadata: AlienErrorMetadata<TContext>): {
-  metadata: AlienErrorMetadata<TContext>;
-  contextSchema: TContext;
-  create: (context: z.infer<TContext>) => AlienErrorDefinition<TContext>;
-};
+declare class ServiceAccount {
+  private _config;
+  /**
+   * Creates a new ServiceAccount builder.
+   * @param id Identifier for the service account. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+   */
+  constructor(id: string);
+  /**
+   * Returns a ResourceType representing any service account resource.
+   * Used for creating permission targets that apply to all service account resources.
+   * @returns The "service-account" resource type.
+   */
+  static any(): ResourceType;
+  /**
+   * Adds a stack-level permission set to the service account.
+   * Stack-level permissions apply to all resources in the stack.
+   *
+   * Note: Only inline permission set objects are supported. To use built-in permission sets,
+   * you need to resolve them first through the permission set registry or use permission profiles
+   * in your stack configuration.
+   *
+   * @example
+   * ```typescript
+   * import { ServiceAccount, type PermissionSet } from "@alien/core"
+   *
+   * const customPermissionSet: PermissionSet = {
+   *   id: "custom/my-perms",
+   *   description: "Custom permissions",
+   *   platforms: {
+   *     aws: [{ grant: { actions: ["s3:GetObject"] }, binding: { stack: { resources: ["*"] } } }]
+   *   }
+   * }
+   *
+   * const account = new ServiceAccount("custom-processor")
+   *   .stackPermissionSet(customPermissionSet)
+   *   .build()
+   * ```
+   *
+   * @param permissionSet The permission set object with platform-specific permissions
+   * @returns The ServiceAccount builder instance.
+   */
+  stackPermissionSet(permissionSet: PermissionSet): this;
+  /**
+   * Builds and validates the service account configuration.
+   * @returns An immutable Resource representing the configured service account.
+   * @throws Error if the service account configuration is invalid.
+   */
+  build(): Resource;
+}
+//#endregion
+//#region src/storage.d.ts
+/**
+ * Represents an object storage bucket.
+ */
+declare class Storage extends ResourceBuilder {
+  private _config;
+  /**
+   * Creates a new Storage builder.
+   * @param id ID of the storage bucket. For names with dots, each dot-separated label must be ≤ 63 characters.
+   */
+  constructor(id: string);
+  /**
+   * Returns a ResourceType representing any storage resource.
+   * Used for creating permission targets that apply to all storage resources.
+   * @returns The "storage" resource type.
+   */
+  static any(): ResourceType;
+  /**
+   * Allows public read access to objects without authentication.
+   * Default: `false`.
+   * @param value Whether to allow public read access.
+   * @returns The Storage builder instance.
+   */
+  publicRead(value: boolean): this;
+  /**
+   * Enables object versioning.
+   * Default: `false`.
+   * @param value Whether to enable versioning.
+   * @returns The Storage builder instance.
+   */
+  versioning(value: boolean): this;
+  /**
+   * Defines lifecycle rules for automatic object management (e.g., expiration).
+   * @param rules An array of lifecycle rules.
+   * @returns The Storage builder instance.
+   */
+  lifecycleRules(rules: LifecycleRule[]): this;
+  /**
+   * Allows browser reads from the listed origins through signed URLs.
+   * Providers enable `GET` and `HEAD`; use `*` only when the signed URL itself
+   * is the credential and browser cookies are not involved.
+   * @param origins Allowed browser origins.
+   * @returns The Storage builder instance.
+   */
+  corsAllowedOrigins(origins: string[]): this;
+  /**
+   * Builds and validates the storage configuration.
+   * @returns An immutable Resource representing the configured storage bucket.
+   * @throws Error if the storage configuration is invalid.
+   */
+  build(): Resource;
+}
+//#endregion
+//#region src/vault.d.ts
 /**
- * Represents a specific error instance with its context.
- *
- * This is created by calling `.create()` on an error definition
- * and contains the actual context data for a specific error occurrence.
+ * Represents a secure vault for storing secrets.
+ * This resource provides a platform-agnostic interface over cloud-native secret management services:
+ * - AWS: AWS Secrets Manager with prefixed secret names
+ * - GCP: Secret Manager with prefixed secret names
+ * - Azure: Key Vault resource
  *
- * @template TContext - Zod schema type for the error context
+ * The vault acts as a namespace for secrets and controls access permissions for workers and services.
  */
-interface AlienErrorDefinition<TContext extends z.ZodTypeAny> {
-  metadata: AlienErrorMetadata<TContext>;
-  contextSchema: TContext;
-  context: z.infer<TContext>;
+declare class Vault extends ResourceBuilder {
+  private _config;
   /**
-   * Convert this error definition directly to AlienErrorOptions.
-   *
-   * This allows you to get the wire format representation
-   * without creating an AlienError instance first.
-   *
-   * @returns AlienErrorOptions object representing this error
+   * Creates a new Vault builder.
+   * @param id Identifier for the vault. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
    */
-  toOptions(): AlienError$1;
+  constructor(id: string);
+  /**
+   * Returns a ResourceType representing any vault resource.
+   * Used for creating permission targets that apply to all vault resources.
+   * @returns The "vault" resource type.
+   */
+  static any(): ResourceType;
+  /**
+   * Builds and validates the vault configuration.
+   * @returns An immutable Resource representing the configured vault.
+   * @throws Error if the vault configuration is invalid.
+   */
+  build(): Resource;
+}
+//#endregion
+//#region src/worker.d.ts
+interface WorkerPublicEndpointOptions {
+  hostLabel?: string;
+  wildcardSubdomains?: boolean;
 }
 /**
- * Main AlienError class that provides structured error handling.
- *
- * This class extends the standard JavaScript Error with additional features:
- * - Type-safe context data
- * - Error chaining and source tracking
- * - Retryability and internal/external visibility flags
- * - HTTP status code mapping
- * - Sanitization for external APIs
- *
- * @template TContext - Zod schema type for the error context
- *
- * @example Basic Construction
- * ```typescript
- * const error = new AlienError(DatabaseError.create({
- *   host: "localhost",
- *   port: 5432,
- *   reason: "Timeout"
- * }))
- * ```
- *
- * @example Converting JavaScript Errors
- * ```typescript
- * try {
- *   JSON.parse("invalid json")
- * } catch (jsError) {
- *   const alienError = AlienError.from(jsError)
- *   console.log(alienError.code) // "GENERIC_ERROR"
- * }
- * ```
- *
- * @example Error Chaining
- * ```typescript
- * const contextualError = AlienError.from(new Error("Network timeout"))
- *   .withContext(DatabaseError.create({
- *     host: "localhost",
- *     port: 5432,
- *     reason: "Connection timeout"
- *   }))
- *
- * // Check error chain
- * console.log(contextualError.hasErrorCode("DATABASE_CONNECTION_FAILED")) // true
- * console.log(contextualError.toString()) // Shows full error chain
- * ```
+ * Represents a serverless worker that executes code in response to triggers or direct invocations.
+ * Workers are the primary compute resource in serverless applications, designed to be stateless and ephemeral.
  */
-declare class AlienError<TContext extends z.ZodTypeAny = z.ZodAny> extends Error {
-  /** Unique error code identifying the error type */
-  readonly code: string;
-  /** Whether this error can be safely retried */
-  readonly retryable: boolean;
-  /** Whether this error contains sensitive internal information */
-  readonly internal: boolean;
-  /** HTTP status code for API responses */
-  readonly httpStatusCode: number;
-  /** Type-safe context data specific to this error */
-  readonly context?: z.infer<TContext>;
-  /** Optional human-facing remediation hint */
-  readonly hint?: string | null;
-  /** Source error that caused this error (for chaining) */
-  readonly source?: AlienError<any>;
-  constructor(input: AlienErrorDefinition<TContext> | (AlienError$1 & {
-    context?: any;
-  }));
+declare class Worker extends ResourceBuilder {
+  private _config;
   /**
-   * Create an AlienError from a type-safe error definition.
-   *
-   * @template TContext - Zod schema type for the error context
-   * @param definition - Error definition with type-safe context
-   * @returns New AlienError instance
+   * Creates a new Worker builder.
+   * @param id Identifier for the worker. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
    */
-  static fromDefinition<TContext extends z.ZodTypeAny>(definition: AlienErrorDefinition<TContext>): AlienError<TContext>;
+  constructor(id: string);
   /**
-   * Create an AlienError from raw options (for compatibility).
-   *
-   * @param options - Raw error options conforming to AlienErrorOptions schema
-   * @returns New AlienError instance
+   * Returns a ResourceType representing any worker resource.
+   * Used for creating permission targets that apply to all worker resources.
+   * @returns The "worker" resource type.
    */
-  static fromOptions(options: AlienError$1): AlienError;
+  static any(): ResourceType;
   /**
-   * Helper function to get a user-friendly type name for error context.
-   *
-   * @param error - Any value to get the type name for
-   * @returns User-friendly type name
+   * Sets the code for the worker, either a pre-built image or source code to be built.
+   * @param code The worker code configuration.
+   * @returns The Worker builder instance.
    */
-  private static getErrorTypeName;
+  code(code: WorkerCode): this;
   /**
-   * Convert a JavaScript Error or any object to a generic AlienError.
-   *
-   * This is equivalent to Rust's `.into_alien_error()` pattern and provides
-   * a way to convert any JavaScript error into the structured AlienError format.
-   *
-   * @param error - Any JavaScript error or object to convert
-   * @returns AlienError with GENERIC_ERROR code and preserved original error
-   *
-   * @example
-   * ```typescript
-   * try {
-   *   throw new TypeError("Invalid argument")
-   * } catch (error) {
-   *   const alienError = AlienError.from(error)
-   *   console.log(alienError.code) // "GENERIC_ERROR"
-   *   console.log(alienError.context?.originalError) // Serialized TypeError
-   * }
-   * ```
-   *
-   * @example Chaining with context
-   * ```typescript
-   * try {
-   *   JSON.parse("invalid")
-   * } catch (error) {
-   *   throw AlienError.from(error).withContext(
-   *     ValidationError.create({
-   *       input: "invalid",
-   *       expectedFormat: "JSON"
-   *     })
-   *   )
-   * }
-   * ```
-   *
-   * @example AxiosError conversion
-   * ```typescript
-   * try {
-   *   await axios.get('/api/resource')
-   * } catch (error) {
-   *   // If error.response.data contains a valid AlienError structure, it will be parsed
-   *   const alienError = AlienError.from(error)
-   *   console.log(alienError.code) // Could be "REMOTE_RESOURCE_NOT_FOUND" if parsed from response
-   * }
-   * ```
+   * Sets the memory allocated to the worker in megabytes (MB).
+   * Constraints: 128‑32768 MB (platform-specific limits may apply).
+   * Default: 512 MB.
+   * @param mb The memory in MB.
+   * @returns The Worker builder instance.
    */
-  static from(error: any): Promise<AlienError>;
+  memoryMb(mb: number): this;
   /**
-   * Add context to this error, creating a new error that wraps this one.
-   *
-   * This is equivalent to Rust's `.with_context()` pattern and allows
-   * building error chains with increasing levels of context.
-   *
-   * @template TNewContext - Zod schema type for the new context
-   * @param definition - Error definition to wrap this error with
-   * @returns New AlienError with this error as the source
-   *
-   * @example
-   * ```typescript
-   * // Clean fluent API
-   * const authError = (await AlienError.from(new Error("ECONNREFUSED")))
-   *   .withContext(DatabaseError.create({
-   *     host: "localhost",
-   *     port: 5432,
-   *     reason: "Connection refused"
-   *   }))
-   *   .withContext(AuthError.create({
-   *     username: "john",
-   *     reason: "Database unavailable"
-   *   }))
+   * Sets the maximum execution time for the worker in seconds.
+   * Constraints: 1‑3600 seconds (platform-specific limits may apply).
+   * Default: 30 seconds.
+   * @param sec The timeout in seconds.
+   * @returns The Worker builder instance.
+   */
+  timeoutSeconds(sec: number): this;
+  /**
+   * Sets the maximum number of concurrent executions allowed for the worker.
+   * `null` means platform default applies.
+   * @param limit The concurrency limit, or `null` for platform default.
+   * @returns The Worker builder instance.
+   */
+  concurrencyLimit(limit: number | undefined): this;
+  /**
+   * Exposes a named public HTTP endpoint for the worker.
    *
-   * // Error chain: AuthError -> DatabaseError -> GENERIC_ERROR
-   * console.log(authError.toString())
-   * ```
+   * If no public endpoint is declared, the worker is private and only reachable
+   * through triggers, commands, or provider invocation APIs.
+   */
+  publicEndpoint(name: string, options?: WorkerPublicEndpointOptions): this;
+  /**
+   * Sets key-value pairs as environment variables for the worker.
+   * @param env A map of environment variable names to their values.
+   * @returns The Worker builder instance.
    */
-  withContext<TNewContext extends z.ZodTypeAny>(definition: AlienErrorDefinition<TNewContext>): AlienError<TNewContext>;
+  environment(env: Record<string, string>): this;
   /**
-   * Convert this AlienError to the wire format (AlienErrorOptions).
-   *
-   * This method serializes the error into the standard format used
-   * for transmitting errors over the network or storing them.
-   *
-   * @returns AlienErrorOptions object representing this error
+   * Links another resource (e.g., Storage, KV, Queue) to this worker.
+   * This makes the linked resource accessible to the worker, often by injecting
+   * environment variables or granting permissions.
+   * @param resource The resource to link.
+   * @returns The Worker builder instance.
    */
-  toOptions(): AlienError$1;
+  link(resource: Resource): this;
   /**
-   * Get a sanitized version for external APIs (hides internal errors).
-   *
-   * This method is crucial for security - it prevents sensitive internal
-   * error details from being exposed to external users while preserving
-   * the error chain structure for non-sensitive errors.
-   *
-   * @returns Sanitized AlienErrorOptions safe for external consumption
-   *
-   * @example
-   * ```typescript
-   * const internalError = new AlienError(InternalApiError.create({
-   *   service: "payment-processor",
-   *   details: "Database password expired for user admin",
-   *   traceId: "trace-12345"
-   * }))
-   *
-   * console.log(internalError.toOptions())
-   * // Shows full details including sensitive information
-   *
-   * console.log(internalError.toExternal())
-   * // { code: "GENERIC_ERROR", message: "Internal server error", ... }
-   * ```
+   * Assigns a permission profile to this worker.
+   * The profile defines the permissions granted to this worker when interacting
+   * with other cloud resources.
+   * @param permissions The permission profile name.
+   * @returns The Worker builder instance.
    */
-  toExternal(): AlienError$1;
+  permissions(permissions: string): this;
   /**
-   * Check if this error chain contains an error with a specific code.
-   *
-   * This method traverses the entire error chain (this error and all
-   * source errors) to find if any error has the specified code.
-   *
-   * @param code - Error code to search for
-   * @returns True if the code is found anywhere in the error chain
+   * Configures a readiness probe for the worker.
+   * The probe will be executed after provisioning/update to verify the worker is ready.
+   * Only works with workers that declare a public endpoint.
    *
    * @example
    * ```typescript
-   * const chainedError = authError.withContext(dbError.withContext(networkError))
+   * const probe: ReadinessProbe = {
+   *   method: "GET",
+   *   path: "/health"
+   * };
    *
-   * console.log(chainedError.hasErrorCode("AUTH_FAILED")) // true
-   * console.log(chainedError.hasErrorCode("DATABASE_CONNECTION_FAILED")) // true
-   * console.log(chainedError.hasErrorCode("NETWORK_TIMEOUT")) // true
-   * console.log(chainedError.hasErrorCode("NONEXISTENT_ERROR")) // false
+   * const func = new Worker("my-api")
+   *   .code({ type: "image", image: "my-api:latest" })
+   *   .publicEndpoint("api")
+   *   .readinessProbe(probe)
+   *   .build();
    * ```
+   *
+   * @param probe The readiness probe configuration.
+   * @returns The Worker builder instance.
    */
-  hasErrorCode(code: string): boolean;
+  readinessProbe(probe: ReadinessProbe): this;
   /**
-   * Find the first error in the chain with a specific code.
-   *
-   * This method traverses the error chain and returns the first error
-   * instance that matches the specified code, allowing access to its
-   * specific context and details.
-   *
-   * @param code - Error code to search for
-   * @returns AlienError instance with the specified code, or undefined if not found
+   * Enables or disables the Commands protocol for the worker.
+   * When enabled, the platform pushes commands into the Worker runtime, which executes registered handlers.
+   * Default: false.
+   * @param enabled Whether to enable commands for this worker.
+   * @returns The Worker builder instance.
+   */
+  commandsEnabled(enabled: boolean): this;
+  /**
+   * Adds a trigger to the worker. Workers can have multiple triggers.
+   * Each trigger will independently invoke the worker when its conditions are met.
    *
    * @example
    * ```typescript
-   * const chainedError = authError.withContext(dbError)
+   * // Queue trigger
+   * const queueTrigger: WorkerTrigger = {
+   *   type: "queue",
+   *   queue: myQueue.ref()
+   * };
    *
-   * const dbError = chainedError.findErrorByCode("DATABASE_CONNECTION_FAILED")
-   * if (dbError) {
-   *   console.log("Database error context:", dbError.context)
-   *   console.log("Host:", dbError.context?.host)
-   * }
+   * // Schedule trigger
+   * const scheduleTrigg: WorkerTrigger = {
+   *   type: "schedule",
+   *   cron: "0 * * * *"
+   * };
+   *
+   * const func = new Worker("my-func")
+   *   .code({ type: "image", image: "my-image:latest" })
+   *   .trigger(queueTrigger)
+   *   .trigger(scheduleTrigger)
+   *   .build();
    * ```
+   *
+   * @param trigger The trigger configuration.
+   * @returns The Worker builder instance.
    */
-  findErrorByCode(code: string): AlienError | undefined;
+  trigger(trigger: WorkerTrigger): this;
   /**
-   * Get a formatted string representation of the error chain.
-   *
-   * This method provides a human-readable representation of the entire
-   * error chain, showing how errors are nested and providing context
-   * for debugging and logging.
-   *
-   * @returns Formatted string showing the complete error chain
-   *
-   * @example
-   * ```typescript
-   * const chainedError = authError.withContext(dbError.withContext(networkError))
-   * console.log(chainedError.toString())
-   * // Output:
-   * // AUTH_FAILED: User authentication failed for 'john'
-   * //   ├─▶ DATABASE_CONNECTION_FAILED: Failed to connect to database 'localhost:5432'
-   * //     ├─▶ GENERIC_ERROR: Connection timeout
-   * ```
+   * Builds and validates the worker configuration.
+   * @returns An immutable Resource representing the configured worker.
+   * @throws Error if the worker configuration is invalid (e.g., missing code).
    */
-  toString(): string;
+  build(): Resource;
 }
-type ExtractContext<T> = T extends AlienErrorDefinition<infer TContext> ? z.infer<TContext> : never;
-//#endregion
-//#region src/common-errors.d.ts
-/**
- * Error thrown when a requested resource cannot be found in the stack state.
- * This matches the Rust alien-core error: RESOURCE_NOT_FOUND
- */
-declare const ResourceNotFoundError: {
-  metadata: AlienErrorMetadata<z$1.ZodObject<{
-    resourceId: z$1.ZodString;
-    availableResources: z$1.ZodArray<z$1.ZodString>;
-  }, z$1.core.$strip>>;
-  contextSchema: z$1.ZodObject<{
-    resourceId: z$1.ZodString;
-    availableResources: z$1.ZodArray<z$1.ZodString>;
-  }, z$1.core.$strip>;
-  create: (context: {
-    resourceId: string;
-    availableResources: string[];
-  }) => AlienErrorDefinition<z$1.ZodObject<{
-    resourceId: z$1.ZodString;
-    availableResources: z$1.ZodArray<z$1.ZodString>;
-  }, z$1.core.$strip>>;
-};
-/**
- * Error thrown when resource outputs cannot be parsed according to their expected schema.
- * This indicates an internal system error or data corruption.
- */
-declare const ResourceOutputsParseError: {
-  metadata: AlienErrorMetadata<z$1.ZodObject<{
-    resourceName: z$1.ZodString;
-    resourceType: z$1.ZodString;
-    validationErrors: z$1.ZodString;
-  }, z$1.core.$strip>>;
-  contextSchema: z$1.ZodObject<{
-    resourceName: z$1.ZodString;
-    resourceType: z$1.ZodString;
-    validationErrors: z$1.ZodString;
-  }, z$1.core.$strip>;
-  create: (context: {
-    resourceName: string;
-    resourceType: string;
-    validationErrors: string;
-  }) => AlienErrorDefinition<z$1.ZodObject<{
-    resourceName: z$1.ZodString;
-    resourceType: z$1.ZodString;
-    validationErrors: z$1.ZodString;
-  }, z$1.core.$strip>>;
-};
-/**
- * Error thrown when there's a resource type mismatch during stack operations.
- * This matches the Rust alien-core error: UNEXPECTED_RESOURCE_TYPE
- */
-declare const UnexpectedResourceTypeError: {
-  metadata: AlienErrorMetadata<z$1.ZodObject<{
-    resourceId: z$1.ZodString;
-    expected: z$1.ZodString;
-    actual: z$1.ZodString;
-  }, z$1.core.$strip>>;
-  contextSchema: z$1.ZodObject<{
-    resourceId: z$1.ZodString;
-    expected: z$1.ZodString;
-    actual: z$1.ZodString;
-  }, z$1.core.$strip>;
-  create: (context: {
-    resourceId: string;
-    expected: string;
-    actual: string;
-  }) => AlienErrorDefinition<z$1.ZodObject<{
-    resourceId: z$1.ZodString;
-    expected: z$1.ZodString;
-    actual: z$1.ZodString;
-  }, z$1.core.$strip>>;
-};
-/**
- * Error thrown when a binding's projected configuration is invalid.
- */
-declare const InvalidBindingConfigError: {
-  metadata: AlienErrorMetadata<z$1.ZodObject<{
-    message: z$1.ZodString;
-    suggestion: z$1.ZodOptional<z$1.ZodString>;
-  }, z$1.core.$strip>>;
-  contextSchema: z$1.ZodObject<{
-    message: z$1.ZodString;
-    suggestion: z$1.ZodOptional<z$1.ZodString>;
-  }, z$1.core.$strip>;
-  create: (context: {
-    message: string;
-    suggestion?: string | undefined;
-  }) => AlienErrorDefinition<z$1.ZodObject<{
-    message: z$1.ZodString;
-    suggestion: z$1.ZodOptional<z$1.ZodString>;
-  }, z$1.core.$strip>>;
-};
-/**
- * Error thrown when a binding is not found.
- */
-declare const BindingNotFoundError: {
-  metadata: AlienErrorMetadata<z$1.ZodObject<{
-    bindingName: z$1.ZodString;
-    bindingType: z$1.ZodString;
-  }, z$1.core.$strip>>;
-  contextSchema: z$1.ZodObject<{
-    bindingName: z$1.ZodString;
-    bindingType: z$1.ZodString;
-  }, z$1.core.$strip>;
-  create: (context: {
-    bindingName: string;
-    bindingType: string;
-  }) => AlienErrorDefinition<z$1.ZodObject<{
-    bindingName: z$1.ZodString;
-    bindingType: z$1.ZodString;
-  }, z$1.core.$strip>>;
-};
 //#endregion
 //#region src/experimental/aws-opensearch.d.ts
 /**