@alienplatform/core 3.3.10 → 3.3.12

package/dist/index.js

@@ -4563,7 +4563,7 @@ z$2.object({
 * Do not edit manually.
 */
 /**
-* @description Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change.\n\nAlien activates the provisioned receipt rule set as part of setup. Because\nSES permits only one active receipt rule set per AWS account and region, an\nAWS stack may contain only one email resource with inbound delivery, and\ninstalling it makes its rule set the account\'s active rule set. SES email\nreceiving is available only in a subset of AWS regions; deploying `inbound`\nto an unsupported region fails during setup.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.
+* @description Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change.\n\nAlien activates the provisioned receipt rule set as part of setup. Because\nSES permits only one active receipt rule set per AWS account and region, an\nAWS stack may contain only one email resource with inbound delivery. The\nresource requires exclusive ownership of SES receiving in its account and\nregion: setup refuses to replace an active rule set it does not own. Choose\nan unused region when the account already receives email through SES. SES email\nreceiving is available only in a subset of AWS regions; deploying `inbound`\nto an unsupported region fails during setup.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.
 */
 const EmailSchema = z$2.object({
 	"domains": z$2.optional(z$2.array(z$2.string()).describe("Seed mail domains provisioned at deploy time (one SES identity each).\nUseful for day-0 bootstrap and products with a static domain set.\nMay be empty (the default): products that create and verify domains\ndynamically should manage identities at runtime through the\n`email/manage-identities` grant instead of listing them here.")),
@@ -4574,7 +4574,7 @@ const EmailSchema = z$2.object({
 	get "inbound"() {
 		return z$2.union([EmailInboundSchema, z$2.null()]).optional();
 	}
-}).describe("Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change.\n\nAlien activates the provisioned receipt rule set as part of setup. Because\nSES permits only one active receipt rule set per AWS account and region, an\nAWS stack may contain only one email resource with inbound delivery, and\ninstalling it makes its rule set the account's active rule set. SES email\nreceiving is available only in a subset of AWS regions; deploying `inbound`\nto an unsupported region fails during setup.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.");
+}).describe("Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change.\n\nAlien activates the provisioned receipt rule set as part of setup. Because\nSES permits only one active receipt rule set per AWS account and region, an\nAWS stack may contain only one email resource with inbound delivery. The\nresource requires exclusive ownership of SES receiving in its account and\nregion: setup refuses to replace an active rule set it does not own. Choose\nan unused region when the account already receives email through SES. SES email\nreceiving is available only in a subset of AWS regions; deploying `inbound`\nto an unsupported region fails during setup.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.");
 //#endregion
 //#region src/generated/zod/response-handling-schema.ts
 /**
@@ -5242,7 +5242,7 @@ const ImportedResourceSchema = z$2.object({
 * @description Certificate publication or reference mode for Kubernetes public endpoints.
 */
 const KubernetesCertificateModeSchema = z$2.union([
-	z$2.lazy(() => KubernetesTlsSecretRefSchema).and(z$2.object({ "mode": z$2.enum(["tlsSecretRef"]) })),
+	z$2.lazy(() => KubernetesTlsSecretRefSchema).and(z$2.object({ "mode": z$2.enum(["tlsSecretRef"]) })).describe("Namespace-scoped Kubernetes TLS Secret reference."),
 	z$2.object({
 		"mode": z$2.enum(["managedAcmImport"]),
 		"region": z$2.string().describe("ACM region. Defaults to the deployment region when omitted.").nullish(),
@@ -5483,7 +5483,7 @@ const KubernetesIngressRouteProfileSchema = z$2.object({
 /**
 * @description Kubernetes route API selected for public endpoints.
 */
-const KubernetesRouteProfileSchema = z$2.union([z$2.lazy(() => KubernetesIngressRouteProfileSchema).and(z$2.object({ "routeApi": z$2.enum(["ingress"]) })), z$2.lazy(() => KubernetesGatewayRouteProfileSchema).and(z$2.object({ "routeApi": z$2.enum(["gateway"]) }))]).describe("Kubernetes route API selected for public endpoints.");
+const KubernetesRouteProfileSchema = z$2.union([z$2.lazy(() => KubernetesIngressRouteProfileSchema).and(z$2.object({ "routeApi": z$2.enum(["ingress"]) })).describe("Shared Ingress route profile values."), z$2.lazy(() => KubernetesGatewayRouteProfileSchema).and(z$2.object({ "routeApi": z$2.enum(["gateway"]) })).describe("Shared Gateway API route profile values.")]).describe("Kubernetes route API selected for public endpoints.");
 //#endregion
 //#region src/generated/zod/kubernetes-exposure-settings-schema.ts
 /**
@@ -5807,9 +5807,9 @@ const LocalWorkerHeartbeatDataSchema = z$2.object({
 * @description Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it\'s derived from the Manager\'s ServiceAccount.
 */
 const ManagementConfigSchema = z$2.union([
-	z$2.lazy(() => AwsManagementConfigSchema).and(z$2.object({ "platform": z$2.enum(["aws"]) })),
-	z$2.lazy(() => GcpManagementConfigSchema).and(z$2.object({ "platform": z$2.enum(["gcp"]) })),
-	z$2.lazy(() => AzureManagementConfigSchema).and(z$2.object({ "platform": z$2.enum(["azure"]) })),
+	z$2.lazy(() => AwsManagementConfigSchema).and(z$2.object({ "platform": z$2.enum(["aws"]) })).describe("AWS management configuration extracted from stack settings"),
+	z$2.lazy(() => GcpManagementConfigSchema).and(z$2.object({ "platform": z$2.enum(["gcp"]) })).describe("GCP management configuration extracted from stack settings"),
+	z$2.lazy(() => AzureManagementConfigSchema).and(z$2.object({ "platform": z$2.enum(["azure"]) })).describe("Azure management configuration extracted from stack settings"),
 	z$2.object({ "platform": z$2.enum(["kubernetes"]) })
 ]).describe("Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount.");
 //#endregion
@@ -6064,10 +6064,10 @@ const PostgresBackendSchema = z$2.object({ "type": z$2.enum(["auroraServerlessV2
 * Do not edit manually.
 */
 const PostgresHeartbeatDataSchema = z$2.union([
-	z$2.lazy(() => AuroraPostgresHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["aurora"]) })),
-	z$2.lazy(() => GcpCloudSqlPostgresHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["cloudSql"]) })),
-	z$2.lazy(() => AzureFlexibleServerPostgresHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["flexibleServer"]) })),
-	z$2.lazy(() => LocalPostgresHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["local"]) }))
+	z$2.lazy(() => AuroraPostgresHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["aurora"]) })).describe("AWS Aurora Serverless v2 backend."),
+	z$2.lazy(() => GcpCloudSqlPostgresHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["cloudSql"]) })).describe("GCP Cloud SQL backend."),
+	z$2.lazy(() => AzureFlexibleServerPostgresHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["flexibleServer"]) })).describe("Azure Flexible Server backend."),
+	z$2.lazy(() => LocalPostgresHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["local"]) })).describe("Local embedded Postgres backend.")
 ]);
 z$2.object({
 	"database": z$2.string().describe("The default database created for this resource. On cloud backends this is the fixed\nlabel `POSTGRES_DATABASE_NAME` (`alien`); on Local it is the resource id."),
@@ -6869,7 +6869,7 @@ const StorageSchema = z$2.object({
 /**
 * @description Request to submit a command response (from deployment)
 */
-const SubmitResponseRequestSchema = z$2.lazy(() => CommandResponseSchema).describe("Request to submit a command response (from deployment)");
+const SubmitResponseRequestSchema = z$2.lazy(() => CommandResponseSchema).describe("Command response from deployment").describe("Request to submit a command response (from deployment)");
 //#endregion
 //#region src/generated/zod/upload-complete-request-schema.ts
 /**
@@ -7082,186 +7082,140 @@ var ResourceBuilder = class {
 	}
 };
 //#endregion
-//#region src/storage.ts
+//#region src/ai.ts
 /**
-* Represents an object storage bucket.
+* Represents an AI Gateway resource that provides a unified interface to
+* managed AI inference services across cloud providers.
 */
-var Storage = class extends ResourceBuilder {
-	_config = {
-		publicRead: false,
-		versioning: false,
-		lifecycleRules: [],
-		corsAllowedOrigins: []
-	};
+var AI = class extends ResourceBuilder {
+	_config = {};
 	/**
-	* Creates a new Storage builder.
-	* @param id ID of the storage bucket. For names with dots, each dot-separated label must be ≤ 63 characters.
+	* Creates a new AI builder.
+	* @param id Identifier for the AI resource. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
 	*/
 	constructor(id) {
 		super();
 		this._config.id = id;
 	}
 	/**
-	* Returns a ResourceType representing any storage resource.
-	* Used for creating permission targets that apply to all storage resources.
-	* @returns The "storage" resource type.
+	* Returns a ResourceType representing any AI resource.
+	* Used for creating permission targets that apply to all AI resources.
+	* @returns The "ai" resource type.
 	*/
 	static any() {
-		return "storage";
+		return "ai";
 	}
 	/**
-	* Allows public read access to objects without authentication.
-	* Default: `false`.
-	* @param value Whether to allow public read access.
-	* @returns The Storage builder instance.
+	* Builds and validates the AI configuration.
+	* @returns An immutable Resource representing the configured AI Gateway.
+	* @throws Error if the AI configuration is invalid.
 	*/
-	publicRead(value) {
-		this._config.publicRead = value;
-		return this;
+	build() {
+		const config = AiSchema.parse(this._config);
+		return this.resource({
+			type: "ai",
+			...config
+		});
 	}
+};
+//#endregion
+//#region src/artifact-registry.ts
+/**
+* Represents an artifact registry for storing container images and other build artifacts.
+* This is a high-level wrapper resource that provides a cloud-agnostic interface over
+* AWS ECR, GCP Artifact Registry, and Azure Container Registry.
+*/
+var ArtifactRegistry = class {
+	_config = {};
 	/**
-	* Enables object versioning.
-	* Default: `false`.
-	* @param value Whether to enable versioning.
-	* @returns The Storage builder instance.
+	* Creates a new ArtifactRegistry builder.
+	* @param id Identifier for the artifact registry. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
 	*/
-	versioning(value) {
-		this._config.versioning = value;
-		return this;
+	constructor(id) {
+		this._config.id = id;
 	}
 	/**
-	* Defines lifecycle rules for automatic object management (e.g., expiration).
-	* @param rules An array of lifecycle rules.
-	* @returns The Storage builder instance.
+	* Returns a ResourceType representing any artifact registry resource.
+	* Used for creating permission targets that apply to all artifact registry resources.
+	* @returns The "artifact-registry" resource type.
 	*/
-	lifecycleRules(rules) {
-		this._config.lifecycleRules = rules;
-		return this;
+	static any() {
+		return "artifact-registry";
 	}
 	/**
-	* Allows browser reads from the listed origins through signed URLs.
-	* Providers enable `GET` and `HEAD`; use `*` only when the signed URL itself
-	* is the credential and browser cookies are not involved.
-	* @param origins Allowed browser origins.
-	* @returns The Storage builder instance.
+	* AWS-only: Configure ECR private image replication to additional regions.
+	* Ensures images pushed in the registry's home region are automatically
+	* available in these destination regions (required when Lambda or other
+	* compute runs in a different region).
+	* @param regions - AWS region codes to replicate to (e.g., ["us-east-2", "eu-west-1"])
 	*/
-	corsAllowedOrigins(origins) {
-		this._config.corsAllowedOrigins = origins;
+	replicationRegions(regions) {
+		this._config.replicationRegions = regions;
 		return this;
 	}
 	/**
-	* Builds and validates the storage configuration.
-	* @returns An immutable Resource representing the configured storage bucket.
-	* @throws Error if the storage configuration is invalid.
+	* Builds and validates the artifact registry configuration.
+	* @returns An immutable Resource representing the configured artifact registry.
+	* @throws Error if the artifact registry configuration is invalid.
 	*/
 	build() {
-		const config = StorageSchema.parse(this._config);
-		return this.resource({
-			type: "storage",
-			...config
+		return new Resource({
+			type: "artifact-registry",
+			...ArtifactRegistrySchema.parse(this._config)
 		});
 	}
 };
 //#endregion
-//#region src/worker.ts
+//#region src/build.ts
 /**
-* Represents a serverless worker that executes code in response to triggers or direct invocations.
-* Workers are the primary compute resource in serverless applications, designed to be stateless and ephemeral.
+* Represents a build resource that executes bash scripts to build code.
+* Builds are designed to be stateless and can be triggered on-demand to compile,
+* test, or package application code.
 */
-var Worker = class extends ResourceBuilder {
+var Build = class {
 	_config = {
 		links: [],
-		triggers: [],
-		publicEndpoints: [],
 		environment: {}
 	};
 	/**
-	* Creates a new Worker builder.
-	* @param id Identifier for the worker. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+	* Creates a new Build builder.
+	* @param id Identifier for the build resource. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
 	*/
 	constructor(id) {
-		super();
 		this._config.id = id;
 	}
 	/**
-	* Returns a ResourceType representing any worker resource.
-	* Used for creating permission targets that apply to all worker resources.
-	* @returns The "worker" resource type.
+	* Returns a ResourceType representing any build resource.
+	* Used for creating permission targets that apply to all build resources.
+	* @returns The "build" resource type.
 	*/
 	static any() {
-		return "worker";
-	}
-	/**
-	* Sets the code for the worker, either a pre-built image or source code to be built.
-	* @param code The worker code configuration.
-	* @returns The Worker builder instance.
-	*/
-	code(code) {
-		this._config.code = code;
-		return this;
-	}
-	/**
-	* Sets the memory allocated to the worker in megabytes (MB).
-	* Constraints: 128‑32768 MB (platform-specific limits may apply).
-	* Default: 512 MB.
-	* @param mb The memory in MB.
-	* @returns The Worker builder instance.
-	*/
-	memoryMb(mb) {
-		this._config.memoryMb = mb;
-		return this;
-	}
-	/**
-	* Sets the maximum execution time for the worker in seconds.
-	* Constraints: 1‑3600 seconds (platform-specific limits may apply).
-	* Default: 30 seconds.
-	* @param sec The timeout in seconds.
-	* @returns The Worker builder instance.
-	*/
-	timeoutSeconds(sec) {
-		this._config.timeoutSeconds = sec;
-		return this;
-	}
-	/**
-	* Sets the maximum number of concurrent executions allowed for the worker.
-	* `null` means platform default applies.
-	* @param limit The concurrency limit, or `null` for platform default.
-	* @returns The Worker builder instance.
-	*/
-	concurrencyLimit(limit) {
-		this._config.concurrencyLimit = limit;
-		return this;
+		return "build";
 	}
 	/**
-	* Exposes a named public HTTP endpoint for the worker.
-	*
-	* If no public endpoint is declared, the worker is private and only reachable
-	* through triggers, commands, or provider invocation APIs.
+	* Sets the compute type for the build.
+	* @param type The compute type (small, medium, large, x-large).
+	* @returns The Build builder instance.
 	*/
-	publicEndpoint(name, options = {}) {
-		if (!this._config.publicEndpoints) this._config.publicEndpoints = [];
-		this._config.publicEndpoints.push({
-			name,
-			hostLabel: options.hostLabel,
-			wildcardSubdomains: options.wildcardSubdomains ?? false
-		});
+	computeType(type) {
+		this._config.computeType = type;
 		return this;
 	}
 	/**
-	* Sets key-value pairs as environment variables for the worker.
+	* Sets key-value pairs as environment variables for the build.
 	* @param env A map of environment variable names to their values.
-	* @returns The Worker builder instance.
+	* @returns The Build builder instance.
 	*/
 	environment(env) {
 		this._config.environment = env;
 		return this;
 	}
 	/**
-	* Links another resource (e.g., Storage, KV, Queue) to this worker.
-	* This makes the linked resource accessible to the worker, often by injecting
+	* Links another resource (e.g., Storage, ArtifactRegistry, Role) to this build.
+	* This makes the linked resource accessible to the build, often by injecting
 	* environment variables or granting permissions.
 	* @param resource The resource to link.
-	* @returns The Worker builder instance.
+	* @returns The Build builder instance.
 	*/
 	link(resource) {
 		if (!this._config.links) this._config.links = [];
@@ -7269,99 +7223,740 @@ var Worker = class extends ResourceBuilder {
 		return this;
 	}
 	/**
-	* Assigns a permission profile to this worker.
-	* The profile defines the permissions granted to this worker when interacting
+	* Assigns a permission profile to this build.
+	* The profile defines the permissions granted to this build when interacting
 	* with other cloud resources.
 	* @param permissions The permission profile name.
-	* @returns The Worker builder instance.
+	* @returns The Build builder instance.
 	*/
 	permissions(permissions) {
 		this._config.permissions = permissions;
 		return this;
 	}
 	/**
-	* Configures a readiness probe for the worker.
-	* The probe will be executed after provisioning/update to verify the worker is ready.
-	* Only works with workers that declare a public endpoint.
-	*
-	* @example
-	* ```typescript
-	* const probe: ReadinessProbe = {
-	*   method: "GET",
-	*   path: "/health"
-	* };
-	*
-	* const func = new Worker("my-api")
-	*   .code({ type: "image", image: "my-api:latest" })
-	*   .publicEndpoint("api")
-	*   .readinessProbe(probe)
-	*   .build();
-	* ```
-	*
-	* @param probe The readiness probe configuration.
-	* @returns The Worker builder instance.
-	*/
-	readinessProbe(probe) {
-		this._config.readinessProbe = probe;
-		return this;
-	}
-	/**
-	* Enables or disables the Commands protocol for the worker.
-	* When enabled, the platform pushes commands into the Worker runtime, which executes registered handlers.
-	* Default: false.
-	* @param enabled Whether to enable commands for this worker.
-	* @returns The Worker builder instance.
+	* Builds and validates the build configuration.
+	* @returns An immutable Resource representing the configured build.
+	* @throws Error if the build configuration is invalid.
 	*/
-	commandsEnabled(enabled) {
-		this._config.commandsEnabled = enabled;
-		return this;
+	build() {
+		return new Resource({
+			type: "build",
+			...BuildSchema.parse(this._config)
+		});
 	}
-	/**
-	* Adds a trigger to the worker. Workers can have multiple triggers.
-	* Each trigger will independently invoke the worker when its conditions are met.
-	*
-	* @example
-	* ```typescript
-	* // Queue trigger
-	* const queueTrigger: WorkerTrigger = {
-	*   type: "queue",
-	*   queue: myQueue.ref()
-	* };
-	*
-	* // Schedule trigger
-	* const scheduleTrigg: WorkerTrigger = {
-	*   type: "schedule",
-	*   cron: "0 * * * *"
-	* };
+};
+//#endregion
+//#region src/error.ts
+/**
+* This module provides a structured error handling system similar to Rust's error types,
+* with TypeScript type safety, error chaining, and context preservation.
+*
+* @example Basic Usage
+* ```typescript
+* import { AlienError, defineError } from '@alienplatform/core'
+* import { z } from 'zod'
+*
+* // Define a type-safe error
+* const DatabaseError = defineError({
+*   code: "DATABASE_CONNECTION_FAILED",
+*   context: z.object({
+*     host: z.string(),
+*     port: z.number(),
+*     reason: z.string(),
+*   }),
+*   message: ({ host, port, reason }) => `Failed to connect to database '${host}:${port}': ${reason}`,
+*   retryable: true,
+*   internal: false,
+*   httpStatusCode: 502,
+* })
+*
+* // Use it
+* throw new AlienError(DatabaseError.create({
+*   host: "localhost",
+*   port: 5432,
+*   reason: "Connection timeout"
+* }))
+* ```
+*
+* @example Error Chaining
+* ```typescript
+* try {
+*   // Some operation that fails
+*   throw new Error("Connection refused")
+* } catch (error) {
+*   throw (await AlienError.from(error)).withContext(
+*     DatabaseError.create({
+*       host: "localhost",
+*       port: 5432,
+*       reason: "Connection refused by server"
+*     })
+*   )
+* }
+* ```
+*
+* @example External API Sanitization
+* ```typescript
+* const internalError = new AlienError(InternalApiError.create({
+*   service: "payment-processor",
+*   details: "Database password expired",
+*   traceId: "trace-12345"
+* }))
+*
+* // Safe for external APIs (sanitizes internal errors)
+* const safeResponse = internalError.toExternal()
+* ```
+*/
+/**
+* Helper function to create type-safe error definitions.
+*
+* This function provides a clean API for defining reusable error types
+* with full TypeScript type safety and Zod validation.
+*
+* @template TContext - Zod schema type for the error context
+* @param metadata - Error metadata including code, schema, and message generator
+* @returns Object with metadata and a create function for error instances
+*
+* @example
+* ```typescript
+* const UserNotFound = defineError({
+*   code: "USER_NOT_FOUND",
+*   context: z.object({
+*     userId: z.string(),
+*     searchMethod: z.string(),
+*   }),
+*   message: ({ userId, searchMethod }) =>
+*     `User '${userId}' not found using method '${searchMethod}'`,
+*   retryable: false,
+*   internal: false,
+*   httpStatusCode: 404,
+* })
+*
+* // Usage
+* const error = UserNotFound.create({
+*   userId: "123",
+*   searchMethod: "database_lookup"
+* })
+* ```
+*/
+function defineError(metadata) {
+	return {
+		metadata,
+		contextSchema: metadata.context,
+		create: (context) => ({
+			metadata,
+			contextSchema: metadata.context,
+			context,
+			toOptions: () => ({
+				code: metadata.code,
+				message: metadata.message(context),
+				retryable: metadata.retryable,
+				internal: metadata.internal,
+				httpStatusCode: metadata.httpStatusCode,
+				context
+			})
+		})
+	};
+}
+/**
+* Main AlienError class that provides structured error handling.
+*
+* This class extends the standard JavaScript Error with additional features:
+* - Type-safe context data
+* - Error chaining and source tracking
+* - Retryability and internal/external visibility flags
+* - HTTP status code mapping
+* - Sanitization for external APIs
+*
+* @template TContext - Zod schema type for the error context
+*
+* @example Basic Construction
+* ```typescript
+* const error = new AlienError(DatabaseError.create({
+*   host: "localhost",
+*   port: 5432,
+*   reason: "Timeout"
+* }))
+* ```
+*
+* @example Converting JavaScript Errors
+* ```typescript
+* try {
+*   JSON.parse("invalid json")
+* } catch (jsError) {
+*   const alienError = AlienError.from(jsError)
+*   console.log(alienError.code) // "GENERIC_ERROR"
+* }
+* ```
+*
+* @example Error Chaining
+* ```typescript
+* const contextualError = AlienError.from(new Error("Network timeout"))
+*   .withContext(DatabaseError.create({
+*     host: "localhost",
+*     port: 5432,
+*     reason: "Connection timeout"
+*   }))
+*
+* // Check error chain
+* console.log(contextualError.hasErrorCode("DATABASE_CONNECTION_FAILED")) // true
+* console.log(contextualError.toString()) // Shows full error chain
+* ```
+*/
+var AlienError = class AlienError extends Error {
+	/** Unique error code identifying the error type */
+	code;
+	/** Whether this error can be safely retried */
+	retryable;
+	/** Whether this error contains sensitive internal information */
+	internal;
+	/** HTTP status code for API responses */
+	httpStatusCode;
+	/** Type-safe context data specific to this error */
+	context;
+	/** Optional human-facing remediation hint */
+	hint;
+	/** Source error that caused this error (for chaining) */
+	source;
+	constructor(input) {
+		let options;
+		if ("metadata" in input && "context" in input) {
+			const { metadata, context: contextData } = input;
+			const message = metadata.message(contextData);
+			options = {
+				code: metadata.code,
+				message,
+				retryable: metadata.retryable,
+				internal: metadata.internal,
+				httpStatusCode: metadata.httpStatusCode,
+				context: contextData
+			};
+		} else options = input;
+		const message = options.message;
+		super(message, { cause: options.source });
+		this.name = "AlienError";
+		this.code = options.code;
+		this.retryable = options.retryable;
+		this.internal = options.internal;
+		this.httpStatusCode = options.httpStatusCode ?? 500;
+		this.context = options.context;
+		this.hint = options.hint;
+		this.source = void 0;
+		if (options.source && typeof options.source === "object") {
+			if ("code" in options.source && "message" in options.source && "retryable" in options.source && "internal" in options.source) this.source = new AlienError(options.source);
+		}
+	}
+	/**
+	* Create an AlienError from a type-safe error definition.
+	*
+	* @template TContext - Zod schema type for the error context
+	* @param definition - Error definition with type-safe context
+	* @returns New AlienError instance
+	*/
+	static fromDefinition(definition) {
+		return new AlienError(definition);
+	}
+	/**
+	* Create an AlienError from raw options (for compatibility).
+	*
+	* @param options - Raw error options conforming to AlienErrorOptions schema
+	* @returns New AlienError instance
+	*/
+	static fromOptions(options) {
+		return new AlienError(AlienErrorSchema.parse(options));
+	}
+	/**
+	* Helper function to get a user-friendly type name for error context.
+	*
+	* @param error - Any value to get the type name for
+	* @returns User-friendly type name
+	*/
+	static getErrorTypeName(error) {
+		if (error === null) return "null";
+		if (error === void 0) return "undefined";
+		if (error?.constructor?.name) return error.constructor.name;
+		const typeofResult = typeof error;
+		return typeofResult === "object" ? "Object" : typeofResult.charAt(0).toUpperCase() + typeofResult.slice(1);
+	}
+	/**
+	* Convert a JavaScript Error or any object to a generic AlienError.
+	*
+	* This is equivalent to Rust's `.into_alien_error()` pattern and provides
+	* a way to convert any JavaScript error into the structured AlienError format.
+	*
+	* @param error - Any JavaScript error or object to convert
+	* @returns AlienError with GENERIC_ERROR code and preserved original error
+	*
+	* @example
+	* ```typescript
+	* try {
+	*   throw new TypeError("Invalid argument")
+	* } catch (error) {
+	*   const alienError = AlienError.from(error)
+	*   console.log(alienError.code) // "GENERIC_ERROR"
+	*   console.log(alienError.context?.originalError) // Serialized TypeError
+	* }
+	* ```
+	*
+	* @example Chaining with context
+	* ```typescript
+	* try {
+	*   JSON.parse("invalid")
+	* } catch (error) {
+	*   throw AlienError.from(error).withContext(
+	*     ValidationError.create({
+	*       input: "invalid",
+	*       expectedFormat: "JSON"
+	*     })
+	*   )
+	* }
+	* ```
+	*
+	* @example AxiosError conversion
+	* ```typescript
+	* try {
+	*   await axios.get('/api/resource')
+	* } catch (error) {
+	*   // If error.response.data contains a valid AlienError structure, it will be parsed
+	*   const alienError = AlienError.from(error)
+	*   console.log(alienError.code) // Could be "REMOTE_RESOURCE_NOT_FOUND" if parsed from response
+	* }
+	* ```
+	*/
+	static async from(error) {
+		if (error instanceof AlienError) return error;
+		if (error instanceof Response) {
+			let errorBody;
+			try {
+				errorBody = await error.json();
+			} catch {
+				return new AlienError({
+					code: "GENERIC_ERROR",
+					message: `HTTP request failed with status ${error.status}`,
+					retryable: false,
+					internal: true,
+					httpStatusCode: error.status,
+					context: {
+						url: error.url,
+						status: error.status,
+						statusText: error.statusText
+					}
+				});
+			}
+			const parseResult = AlienErrorSchema.safeParse(errorBody);
+			if (parseResult.success) return new AlienError(parseResult.data);
+			return new AlienError({
+				code: "GENERIC_ERROR",
+				message: errorBody?.message || `HTTP request failed with status ${error.status}`,
+				retryable: false,
+				internal: true,
+				httpStatusCode: error.status,
+				context: {
+					url: error.url,
+					status: error.status,
+					statusText: error.statusText,
+					responseBody: errorBody
+				}
+			});
+		}
+		if (error?.response?.data && typeof error.response.data === "object") {
+			const parseResult = AlienErrorSchema.safeParse(error.response.data);
+			if (parseResult.success) return new AlienError(parseResult.data);
+		}
+		const serialized = serializeError(error);
+		const message = serialized?.message || String(error);
+		return new AlienError({
+			code: "GENERIC_ERROR",
+			message,
+			retryable: false,
+			internal: true,
+			httpStatusCode: 500,
+			context: {
+				originalError: serialized,
+				errorType: AlienError.getErrorTypeName(error)
+			}
+		});
+	}
+	/**
+	* Add context to this error, creating a new error that wraps this one.
 	*
-	* const func = new Worker("my-func")
-	*   .code({ type: "image", image: "my-image:latest" })
-	*   .trigger(queueTrigger)
-	*   .trigger(scheduleTrigger)
-	*   .build();
+	* This is equivalent to Rust's `.with_context()` pattern and allows
+	* building error chains with increasing levels of context.
+	*
+	* @template TNewContext - Zod schema type for the new context
+	* @param definition - Error definition to wrap this error with
+	* @returns New AlienError with this error as the source
+	*
+	* @example
+	* ```typescript
+	* // Clean fluent API
+	* const authError = (await AlienError.from(new Error("ECONNREFUSED")))
+	*   .withContext(DatabaseError.create({
+	*     host: "localhost",
+	*     port: 5432,
+	*     reason: "Connection refused"
+	*   }))
+	*   .withContext(AuthError.create({
+	*     username: "john",
+	*     reason: "Database unavailable"
+	*   }))
+	*
+	* // Error chain: AuthError -> DatabaseError -> GENERIC_ERROR
+	* console.log(authError.toString())
 	* ```
+	*/
+	withContext(definition) {
+		const { metadata, context: contextData } = definition;
+		const message = metadata.message(contextData);
+		const sourceOptions = {
+			code: this.code,
+			message: this.message,
+			retryable: this.retryable,
+			internal: this.internal,
+			httpStatusCode: this.httpStatusCode,
+			context: this.context,
+			hint: this.hint,
+			source: this.source?.toOptions()
+		};
+		return new AlienError({
+			code: metadata.code,
+			message,
+			retryable: metadata.retryable,
+			internal: metadata.internal,
+			httpStatusCode: metadata.httpStatusCode,
+			context: contextData,
+			source: sourceOptions
+		});
+	}
+	/**
+	* Convert this AlienError to the wire format (AlienErrorOptions).
 	*
-	* @param trigger The trigger configuration.
-	* @returns The Worker builder instance.
+	* This method serializes the error into the standard format used
+	* for transmitting errors over the network or storing them.
+	*
+	* @returns AlienErrorOptions object representing this error
+	*/
+	toOptions() {
+		return {
+			code: this.code,
+			message: this.message,
+			retryable: this.retryable,
+			internal: this.internal,
+			httpStatusCode: this.httpStatusCode,
+			context: this.context,
+			hint: this.hint,
+			source: this.source?.toOptions()
+		};
+	}
+	/**
+	* Get a sanitized version for external APIs (hides internal errors).
+	*
+	* This method is crucial for security - it prevents sensitive internal
+	* error details from being exposed to external users while preserving
+	* the error chain structure for non-sensitive errors.
+	*
+	* @returns Sanitized AlienErrorOptions safe for external consumption
+	*
+	* @example
+	* ```typescript
+	* const internalError = new AlienError(InternalApiError.create({
+	*   service: "payment-processor",
+	*   details: "Database password expired for user admin",
+	*   traceId: "trace-12345"
+	* }))
+	*
+	* console.log(internalError.toOptions())
+	* // Shows full details including sensitive information
+	*
+	* console.log(internalError.toExternal())
+	* // { code: "GENERIC_ERROR", message: "Internal server error", ... }
+	* ```
+	*/
+	toExternal() {
+		if (this.internal) return {
+			code: "GENERIC_ERROR",
+			message: "Internal server error",
+			retryable: false,
+			internal: false,
+			httpStatusCode: 500
+		};
+		return {
+			code: this.code,
+			message: this.message,
+			retryable: this.retryable,
+			internal: this.internal,
+			httpStatusCode: this.httpStatusCode,
+			context: this.context,
+			hint: this.hint,
+			source: this.source?.toExternal()
+		};
+	}
+	/**
+	* Check if this error chain contains an error with a specific code.
+	*
+	* This method traverses the entire error chain (this error and all
+	* source errors) to find if any error has the specified code.
+	*
+	* @param code - Error code to search for
+	* @returns True if the code is found anywhere in the error chain
+	*
+	* @example
+	* ```typescript
+	* const chainedError = authError.withContext(dbError.withContext(networkError))
+	*
+	* console.log(chainedError.hasErrorCode("AUTH_FAILED")) // true
+	* console.log(chainedError.hasErrorCode("DATABASE_CONNECTION_FAILED")) // true
+	* console.log(chainedError.hasErrorCode("NETWORK_TIMEOUT")) // true
+	* console.log(chainedError.hasErrorCode("NONEXISTENT_ERROR")) // false
+	* ```
+	*/
+	hasErrorCode(code) {
+		if (this.code === code) return true;
+		return this.source?.hasErrorCode(code) ?? false;
+	}
+	/**
+	* Find the first error in the chain with a specific code.
+	*
+	* This method traverses the error chain and returns the first error
+	* instance that matches the specified code, allowing access to its
+	* specific context and details.
+	*
+	* @param code - Error code to search for
+	* @returns AlienError instance with the specified code, or undefined if not found
+	*
+	* @example
+	* ```typescript
+	* const chainedError = authError.withContext(dbError)
+	*
+	* const dbError = chainedError.findErrorByCode("DATABASE_CONNECTION_FAILED")
+	* if (dbError) {
+	*   console.log("Database error context:", dbError.context)
+	*   console.log("Host:", dbError.context?.host)
+	* }
+	* ```
+	*/
+	findErrorByCode(code) {
+		if (this.code === code) return this;
+		return this.source?.findErrorByCode(code);
+	}
+	/**
+	* Get a formatted string representation of the error chain.
+	*
+	* This method provides a human-readable representation of the entire
+	* error chain, showing how errors are nested and providing context
+	* for debugging and logging.
+	*
+	* @returns Formatted string showing the complete error chain
+	*
+	* @example
+	* ```typescript
+	* const chainedError = authError.withContext(dbError.withContext(networkError))
+	* console.log(chainedError.toString())
+	* // Output:
+	* // AUTH_FAILED: User authentication failed for 'john'
+	* //   ├─▶ DATABASE_CONNECTION_FAILED: Failed to connect to database 'localhost:5432'
+	* //     ├─▶ GENERIC_ERROR: Connection timeout
+	* ```
+	*/
+	toString() {
+		let result = `${this.code}: ${this.message}`;
+		let current = this.source;
+		let indent = "";
+		while (current) {
+			indent += "  ";
+			result += `\n${indent}├─▶ ${current.code}: ${current.message}`;
+			current = current.source;
+		}
+		return result;
+	}
+};
+//#endregion
+//#region src/common-errors.ts
+/**
+* Error thrown when a requested resource cannot be found in the stack state.
+* This matches the Rust alien-core error: RESOURCE_NOT_FOUND
+*/
+const ResourceNotFoundError = defineError({
+	code: "RESOURCE_NOT_FOUND",
+	context: z$1.object({
+		resourceId: z$1.string(),
+		availableResources: z$1.array(z$1.string())
+	}),
+	message: ({ resourceId, availableResources }) => `Resource '${resourceId}' not found in stack state. Available resources: ${JSON.stringify(availableResources)}`,
+	retryable: false,
+	internal: false,
+	httpStatusCode: 404
+});
+/**
+* Error thrown when resource outputs cannot be parsed according to their expected schema.
+* This indicates an internal system error or data corruption.
+*/
+const ResourceOutputsParseError = defineError({
+	code: "RESOURCE_OUTPUTS_PARSE_ERROR",
+	context: z$1.object({
+		resourceName: z$1.string(),
+		resourceType: z$1.string(),
+		validationErrors: z$1.string()
+	}),
+	message: ({ resourceName, resourceType, validationErrors }) => `Failed to parse outputs for resource '${resourceName}' of type '${resourceType}':\n${validationErrors}`,
+	retryable: false,
+	internal: true,
+	httpStatusCode: 500
+});
+/**
+* Error thrown when there's a resource type mismatch during stack operations.
+* This matches the Rust alien-core error: UNEXPECTED_RESOURCE_TYPE
+*/
+const UnexpectedResourceTypeError = defineError({
+	code: "UNEXPECTED_RESOURCE_TYPE",
+	context: z$1.object({
+		resourceId: z$1.string(),
+		expected: z$1.string(),
+		actual: z$1.string()
+	}),
+	message: ({ resourceId, expected, actual }) => `Unexpected resource type for resource '${resourceId}': expected ${expected}, but got ${actual}`,
+	retryable: false,
+	internal: false,
+	httpStatusCode: 400
+});
+/**
+* Error thrown when a binding's projected configuration is invalid.
+*/
+const InvalidBindingConfigError = defineError({
+	code: "INVALID_BINDING_CONFIG",
+	context: z$1.object({
+		message: z$1.string(),
+		suggestion: z$1.string().optional()
+	}),
+	message: ({ message, suggestion }) => suggestion ? `${message}. ${suggestion}` : message,
+	retryable: false,
+	internal: false,
+	httpStatusCode: 400
+});
+/**
+* Error thrown when a binding is not found.
+*/
+const BindingNotFoundError = defineError({
+	code: "BINDING_NOT_FOUND",
+	context: z$1.object({
+		bindingName: z$1.string(),
+		bindingType: z$1.string()
+	}),
+	message: ({ bindingName, bindingType }) => `${bindingType} binding '${bindingName}' not found`,
+	retryable: false,
+	internal: false,
+	httpStatusCode: 404
+});
+//#endregion
+//#region src/compute-cluster.ts
+/**
+* Declares a ComputeCluster — the setup-owned machine boundary for daemons and
+* containers. Each capacity group inside the cluster becomes a separate
+* Auto Scaling Group (AWS), Managed Instance Group (GCP), or VM Scale Set
+* (Azure). Daemons reference a cluster via `daemon.cluster(...)` and (when
+* the cluster has more than one capacity group) a specific group via
+* `daemon.pool(...)`.
+*
+* Application source declares portable pool requirements. Provider machine
+* names are selected later through deployment settings.
+*/
+var ComputeCluster = class {
+	_config = { capacityGroups: [] };
+	constructor(id) {
+		this._config.id = id;
+	}
+	/**
+	* Returns the resource type for permission targets that apply to all
+	* compute-cluster resources.
 	*/
-	trigger(trigger) {
-		if (!this._config.triggers) this._config.triggers = [];
-		this._config.triggers.push(trigger);
+	static any() {
+		return "compute-cluster";
+	}
+	pool(groupId, config) {
+		const { minSize, maxSize } = selectedScaleBounds(config.scale);
+		this._config.capacityGroups.push({
+			groupId,
+			profile: machineProfileFromRequirements(config.requirements),
+			minSize,
+			maxSize,
+			scalePolicy: scalePolicyFromInput(config.scale),
+			nestedVirtualization: config.requirements.nestedVirtualization
+		});
 		return this;
 	}
 	/**
-	* Builds and validates the worker configuration.
-	* @returns An immutable Resource representing the configured worker.
-	* @throws Error if the worker configuration is invalid (e.g., missing code).
+	* Sets the container CIDR block used for inter-container networking inside
+	* the cluster. Each machine gets a /24 subnet carved from this range.
+	* Defaults to 10.244.0.0/16 if not specified.
+	*/
+	containerCidr(cidr) {
+		this._config.containerCidr = cidr;
+		return this;
+	}
+	/**
+	* Builds and validates the cluster configuration.
 	*/
 	build() {
-		const config = WorkerSchema.parse(this._config);
-		return this.resource({
-			type: "worker",
-			...config
+		return new Resource({
+			type: "compute-cluster",
+			...ComputeClusterSchema.parse(this._config)
 		});
 	}
 };
+function selectedScaleBounds(scale) {
+	if (scale.type === "fixed") {
+		const machines = defaultChoice(scale.machines);
+		return {
+			minSize: machines,
+			maxSize: machines
+		};
+	}
+	return {
+		minSize: defaultChoice(scale.min),
+		maxSize: defaultChoice(scale.max)
+	};
+}
+function scalePolicyFromInput(scale) {
+	if (scale.type === "fixed") return {
+		type: "fixed",
+		machines: choiceRange(scale.machines)
+	};
+	return {
+		type: "autoscale",
+		min: choiceRange(scale.min),
+		max: choiceRange(scale.max)
+	};
+}
+function choiceRange(choice) {
+	if (typeof choice === "number") return {
+		min: choice,
+		max: choice,
+		default: choice
+	};
+	return choice;
+}
+function defaultChoice(choice) {
+	if (typeof choice === "number") return choice;
+	return choice.default;
+}
+function machineProfileFromRequirements(requirements) {
+	return {
+		cpu: typeof requirements.cpu === "number" ? `${requirements.cpu}` : requirements.cpu,
+		memoryBytes: parseQuantityBytes(requirements.memory),
+		ephemeralStorageBytes: parseQuantityBytes(requirements.ephemeralStorage ?? "20Gi"),
+		architecture: requirements.architecture,
+		gpu: requirements.accelerators?.[0] ? {
+			type: requirements.accelerators[0].type,
+			count: requirements.accelerators[0].count
+		} : void 0
+	};
+}
+function parseQuantityBytes(value) {
+	const match = value.match(/^([0-9]+(?:\.[0-9]+)?)(Ki|Mi|Gi|Ti|k|M|G|T)?$/);
+	if (!match) throw new Error(`Invalid memory/storage quantity: ${value}`);
+	const amount = Number(match[1]);
+	const suffix = match[2];
+	return Math.round(amount * (suffix === "Ti" ? 1024 ** 4 : suffix === "Gi" ? 1024 ** 3 : suffix === "Mi" ? 1024 ** 2 : suffix === "Ki" ? 1024 : suffix === "T" ? 1e3 ** 4 : suffix === "G" ? 1e3 ** 3 : suffix === "M" ? 1e3 ** 2 : suffix === "k" ? 1e3 : 1));
+}
 //#endregion
 //#region src/container.ts
 /**
@@ -7695,125 +8290,14 @@ var Container = class extends ResourceBuilder {
 	* @returns An immutable Resource representing the configured container.
 	* @throws Error if the container configuration is invalid.
 	*/
-	build() {
-		const config = ContainerSchema.parse(this._config);
-		return this.resource({
-			type: "container",
-			...config
-		});
-	}
-};
-//#endregion
-//#region src/compute-cluster.ts
-/**
-* Declares a ComputeCluster — the setup-owned machine boundary for daemons and
-* containers. Each capacity group inside the cluster becomes a separate
-* Auto Scaling Group (AWS), Managed Instance Group (GCP), or VM Scale Set
-* (Azure). Daemons reference a cluster via `daemon.cluster(...)` and (when
-* the cluster has more than one capacity group) a specific group via
-* `daemon.pool(...)`.
-*
-* Application source declares portable pool requirements. Provider machine
-* names are selected later through deployment settings.
-*/
-var ComputeCluster = class {
-	_config = { capacityGroups: [] };
-	constructor(id) {
-		this._config.id = id;
-	}
-	/**
-	* Returns the resource type for permission targets that apply to all
-	* compute-cluster resources.
-	*/
-	static any() {
-		return "compute-cluster";
-	}
-	pool(groupId, config) {
-		const { minSize, maxSize } = selectedScaleBounds(config.scale);
-		this._config.capacityGroups.push({
-			groupId,
-			profile: machineProfileFromRequirements(config.requirements),
-			minSize,
-			maxSize,
-			scalePolicy: scalePolicyFromInput(config.scale),
-			nestedVirtualization: config.requirements.nestedVirtualization
-		});
-		return this;
-	}
-	/**
-	* Sets the container CIDR block used for inter-container networking inside
-	* the cluster. Each machine gets a /24 subnet carved from this range.
-	* Defaults to 10.244.0.0/16 if not specified.
-	*/
-	containerCidr(cidr) {
-		this._config.containerCidr = cidr;
-		return this;
-	}
-	/**
-	* Builds and validates the cluster configuration.
-	*/
-	build() {
-		return new Resource({
-			type: "compute-cluster",
-			...ComputeClusterSchema.parse(this._config)
+	build() {
+		const config = ContainerSchema.parse(this._config);
+		return this.resource({
+			type: "container",
+			...config
 		});
 	}
 };
-function selectedScaleBounds(scale) {
-	if (scale.type === "fixed") {
-		const machines = defaultChoice(scale.machines);
-		return {
-			minSize: machines,
-			maxSize: machines
-		};
-	}
-	return {
-		minSize: defaultChoice(scale.min),
-		maxSize: defaultChoice(scale.max)
-	};
-}
-function scalePolicyFromInput(scale) {
-	if (scale.type === "fixed") return {
-		type: "fixed",
-		machines: choiceRange(scale.machines)
-	};
-	return {
-		type: "autoscale",
-		min: choiceRange(scale.min),
-		max: choiceRange(scale.max)
-	};
-}
-function choiceRange(choice) {
-	if (typeof choice === "number") return {
-		min: choice,
-		max: choice,
-		default: choice
-	};
-	return choice;
-}
-function defaultChoice(choice) {
-	if (typeof choice === "number") return choice;
-	return choice.default;
-}
-function machineProfileFromRequirements(requirements) {
-	return {
-		cpu: typeof requirements.cpu === "number" ? `${requirements.cpu}` : requirements.cpu,
-		memoryBytes: parseQuantityBytes(requirements.memory),
-		ephemeralStorageBytes: parseQuantityBytes(requirements.ephemeralStorage ?? "20Gi"),
-		architecture: requirements.architecture,
-		gpu: requirements.accelerators?.[0] ? {
-			type: requirements.accelerators[0].type,
-			count: requirements.accelerators[0].count
-		} : void 0
-	};
-}
-function parseQuantityBytes(value) {
-	const match = value.match(/^([0-9]+(?:\.[0-9]+)?)(Ki|Mi|Gi|Ti|k|M|G|T)?$/);
-	if (!match) throw new Error(`Invalid memory/storage quantity: ${value}`);
-	const amount = Number(match[1]);
-	const suffix = match[2];
-	return Math.round(amount * (suffix === "Ti" ? 1024 ** 4 : suffix === "Gi" ? 1024 ** 3 : suffix === "Mi" ? 1024 ** 2 : suffix === "Ki" ? 1024 : suffix === "T" ? 1e3 ** 4 : suffix === "G" ? 1e3 ** 3 : suffix === "M" ? 1e3 ** 2 : suffix === "k" ? 1e3 : 1));
-}
 //#endregion
 //#region src/daemon.ts
 /**
@@ -8019,174 +8503,329 @@ var Daemon = class extends ResourceBuilder {
 	}
 };
 //#endregion
-//#region src/build.ts
+//#region src/email.ts
 /**
-* Represents a build resource that executes bash scripts to build code.
-* Builds are designed to be stateless and can be triggered on-demand to compile,
-* test, or package application code.
+* Email infrastructure for sending and receiving mail on customer-owned
+* domains (AWS SES). Provisions a shared configuration set, optional inbound
+* and event wiring, and one email identity (Easy DKIM) per seed domain.
+*
+* The resource owns the email infrastructure, not the domain lifecycle. Seed
+* domains are optional: products that create and verify domains dynamically
+* should manage identities at runtime through the `email/manage-identities`
+* grant instead of listing them here. Runtime-created identities are
+* application data — they are not tracked by the deployment and survive stack
+* deletion.
+*
+* After deployment, create the per-domain DKIM CNAME records from the
+* resource outputs — SES verifies each domain once the records exist in DNS.
+*
+* When inbound mail is configured, the receipt rule is a catch-all (no
+* recipient filter), so mail for runtime-verified identities lands in the
+* bucket without redeployment. Setup activates the provisioned receipt rule
+* set automatically. SES permits one active receipt rule set per account and
+* region, so an AWS stack may contain only one Email with inbound delivery,
+* and installing it makes its rule set the account's active rule set.
 */
-var Build = class {
-	_config = {
-		links: [],
-		environment: {}
-	};
+var Email = class extends ResourceBuilder {
+	_config = { domains: [] };
 	/**
-	* Creates a new Build builder.
-	* @param id Identifier for the build resource. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+	* Creates a new Email builder.
+	* @param id Identifier for the email resource. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
 	*/
 	constructor(id) {
+		super();
 		this._config.id = id;
 	}
 	/**
-	* Returns a ResourceType representing any build resource.
-	* Used for creating permission targets that apply to all build resources.
-	* @returns The "build" resource type.
+	* Returns a ResourceType representing any email resource.
+	* Used for creating permission targets that apply to all email resources.
+	* @returns The "email" resource type.
 	*/
 	static any() {
-		return "build";
+		return "email";
 	}
 	/**
-	* Sets the compute type for the build.
-	* @param type The compute type (small, medium, large, x-large).
-	* @returns The Build builder instance.
+	* Sets the seed mail domains provisioned at deploy time (one SES identity
+	* each). Optional — omit for products that manage domains at runtime.
+	* @param domains The mail domains (e.g. `["mail.example.com"]`).
+	* @returns The Email builder instance.
 	*/
-	computeType(type) {
-		this._config.computeType = type;
+	domains(domains) {
+		this._config.domains = domains;
 		return this;
 	}
 	/**
-	* Sets key-value pairs as environment variables for the build.
-	* @param env A map of environment variable names to their values.
-	* @returns The Build builder instance.
+	* Adds a single seed mail domain.
+	* @param domain The mail domain (e.g. `"mail.example.com"`).
+	* @returns The Email builder instance.
 	*/
-	environment(env) {
-		this._config.environment = env;
+	domain(domain) {
+		this._config.domains = [...this._config.domains ?? [], domain];
 		return this;
 	}
 	/**
-	* Links another resource (e.g., Storage, ArtifactRegistry, Role) to this build.
-	* This makes the linked resource accessible to the build, often by injecting
-	* environment variables or granting permissions.
-	* @param resource The resource to link.
-	* @returns The Build builder instance.
+	* Configures inbound mail: raw incoming mail for the configured domains is
+	* written to the linked Storage bucket. Note the post-deploy activation
+	* step described in the class documentation.
+	* @param storage The Storage resource that receives raw incoming mail.
+	* @returns The Email builder instance.
 	*/
-	link(resource) {
-		if (!this._config.links) this._config.links = [];
-		this._config.links.push(resource.ref());
+	inbound(storage) {
+		this._config.inbound = { storage: storage.ref() };
 		return this;
 	}
 	/**
-	* Assigns a permission profile to this build.
-	* The profile defines the permissions granted to this build when interacting
-	* with other cloud resources.
-	* @param permissions The permission profile name.
-	* @returns The Build builder instance.
+	* Configures sending events: send / delivery / bounce / complaint /
+	* delivery-delay / reject events are delivered to the linked Queue.
+	* @param queue The Queue resource that receives sending events.
+	* @returns The Email builder instance.
 	*/
-	permissions(permissions) {
-		this._config.permissions = permissions;
+	events(queue) {
+		this._config.events = { queue: queue.ref() };
 		return this;
 	}
 	/**
-	* Builds and validates the build configuration.
-	* @returns An immutable Resource representing the configured build.
-	* @throws Error if the build configuration is invalid.
+	* Builds and validates the email configuration.
+	* @returns An immutable Resource representing the configured email infrastructure.
+	* @throws Error if the email configuration is invalid.
 	*/
 	build() {
-		return new Resource({
-			type: "build",
-			...BuildSchema.parse(this._config)
+		const config = EmailSchema.parse(this._config);
+		return this.resource({
+			type: "email",
+			...config
 		});
 	}
 };
 //#endregion
-//#region src/artifact-registry.ts
-/**
-* Represents an artifact registry for storing container images and other build artifacts.
-* This is a high-level wrapper resource that provides a cloud-agnostic interface over
-* AWS ECR, GCP Artifact Registry, and Azure Container Registry.
-*/
-var ArtifactRegistry = class {
-	_config = {};
-	/**
-	* Creates a new ArtifactRegistry builder.
-	* @param id Identifier for the artifact registry. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
-	*/
-	constructor(id) {
-		this._config.id = id;
-	}
-	/**
-	* Returns a ResourceType representing any artifact registry resource.
-	* Used for creating permission targets that apply to all artifact registry resources.
-	* @returns The "artifact-registry" resource type.
-	*/
-	static any() {
-		return "artifact-registry";
-	}
-	/**
-	* AWS-only: Configure ECR private image replication to additional regions.
-	* Ensures images pushed in the registry's home region are automatically
-	* available in these destination regions (required when Lambda or other
-	* compute runs in a different region).
-	* @param regions - AWS region codes to replicate to (e.g., ["us-east-2", "eu-west-1"])
-	*/
-	replicationRegions(regions) {
-		this._config.replicationRegions = regions;
-		return this;
-	}
-	/**
-	* Builds and validates the artifact registry configuration.
-	* @returns An immutable Resource representing the configured artifact registry.
-	* @throws Error if the artifact registry configuration is invalid.
-	*/
-	build() {
-		return new Resource({
-			type: "artifact-registry",
-			...ArtifactRegistrySchema.parse(this._config)
-		});
+//#region src/get-resource-outputs.ts
+const ResourceSchemaMapping = {
+	function: {
+		input: WorkerSchema,
+		output: WorkerOutputsSchema
+	},
+	container: {
+		input: ContainerSchema,
+		output: ContainerOutputsSchema
+	},
+	storage: {
+		input: StorageSchema,
+		output: StorageOutputsSchema
+	},
+	kv: {
+		input: KvSchema,
+		output: KvOutputsSchema
+	},
+	queue: {
+		input: QueueSchema,
+		output: QueueOutputsSchema
+	},
+	vault: {
+		input: VaultSchema,
+		output: VaultOutputsSchema
+	},
+	build: {
+		input: BuildSchema,
+		output: BuildOutputsSchema
+	},
+	"artifact-registry": {
+		input: ArtifactRegistrySchema,
+		output: ArtifactRegistryOutputsSchema
+	},
+	"service-account": {
+		input: ServiceAccountSchema,
+		output: ServiceAccountOutputsSchema
+	},
+	"remote-stack-management": {
+		input: RemoteStackManagementSchema,
+		output: RemoteStackManagementOutputsSchema
 	}
 };
+function getResourceOutputs(params) {
+	const { state, resource } = params;
+	const resourceState = state.resources[resource.name];
+	if (!resourceState) throw new AlienError(ResourceNotFoundError.create({
+		resourceId: resource.name,
+		availableResources: Object.keys(state.resources)
+	}));
+	const outputs = ResourceSchemaMapping[resource.type].output.safeParse(resourceState.outputs);
+	if (!outputs.success) throw new AlienError(ResourceOutputsParseError.create({
+		resourceName: resource.name,
+		resourceType: resource.type,
+		validationErrors: z$1.prettifyError(outputs.error)
+	}));
+	return outputs.data;
+}
 //#endregion
-//#region src/vault.ts
-/**
-* Represents a secure vault for storing secrets.
-* This resource provides a platform-agnostic interface over cloud-native secret management services:
-* - AWS: AWS Secrets Manager with prefixed secret names
-* - GCP: Secret Manager with prefixed secret names
-* - Azure: Key Vault resource
-*
-* The vault acts as a namespace for secrets and controls access permissions for workers and services.
-*/
-var Vault = class extends ResourceBuilder {
-	_config = {};
-	/**
-	* Creates a new Vault builder.
-	* @param id Identifier for the vault. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
-	*/
-	constructor(id) {
-		super();
-		this._config.id = id;
+//#region src/input.ts
+const stackInputDraftSymbol = Symbol("alien.stackInputDraft");
+const stackInputDefinitionsSymbol = Symbol("alien.stackInputDefinitions");
+function inputs(drafts) {
+	const result = {};
+	const definitions = [];
+	for (const [id, draft] of Object.entries(drafts)) {
+		validateInputId(id);
+		validateDraft(id, draft);
+		result[id] = {
+			id,
+			kind: draft.kind
+		};
+		definitions.push({
+			id,
+			kind: draft.kind,
+			providedBy: normalizeArray(draft.options.providedBy),
+			required: draft.options.required,
+			label: draft.options.label,
+			description: draft.options.description,
+			placeholder: draft.options.placeholder,
+			default: toDefaultValue(draft.kind, draft.options.default),
+			platforms: draft.options.platforms ? [...draft.options.platforms] : void 0,
+			validation: Object.keys(draft.validation).length > 0 ? draft.validation : void 0,
+			env: normalizeEnv(draft.options.env)
+		});
 	}
-	/**
-	* Returns a ResourceType representing any vault resource.
-	* Used for creating permission targets that apply to all vault resources.
-	* @returns The "vault" resource type.
-	*/
-	static any() {
-		return "vault";
+	Object.defineProperty(result, stackInputDefinitionsSymbol, {
+		value: Object.freeze(definitions),
+		enumerable: false
+	});
+	return result;
+}
+function getStackInputDefinitions(value) {
+	if (Array.isArray(value)) return [...value];
+	return [...value[stackInputDefinitionsSymbol]];
+}
+function defineInput(kind, options, validation = {}) {
+	return {
+		[stackInputDraftSymbol]: true,
+		kind,
+		options,
+		validation
+	};
+}
+function defineStringInput(options) {
+	return defineInput("string", options, {
+		minLength: options.minLength,
+		maxLength: options.maxLength,
+		pattern: options.pattern,
+		format: options.format
+	});
+}
+function defineSecretInput(options) {
+	return defineInput("secret", options, {
+		minLength: options.minLength,
+		maxLength: options.maxLength,
+		pattern: options.pattern,
+		format: options.format
+	});
+}
+function defineNumberInput(options) {
+	return defineInput("number", options, {
+		min: numberToString(options.min),
+		max: numberToString(options.max)
+	});
+}
+function defineIntegerInput(options) {
+	return defineInput("integer", options, {
+		min: integerToString(options.min, "min"),
+		max: integerToString(options.max, "max")
+	});
+}
+function defineBooleanInput(options) {
+	return defineInput("boolean", options);
+}
+function defineEnumInput(values, options) {
+	return defineInput("enum", options, { values: [...values] });
+}
+function defineStringListInput(options) {
+	return defineInput("stringList", options, {
+		minItems: options.minItems,
+		maxItems: options.maxItems
+	});
+}
+function normalizeArray(value) {
+	return Array.isArray(value) ? [...value] : [value];
+}
+function normalizeEnv(value) {
+	if (!value) return [];
+	return normalizeArray(value).map((mapping) => {
+		if (typeof mapping === "string") return { name: mapping };
+		return {
+			name: mapping.name,
+			targetResources: mapping.targetResources ? [...mapping.targetResources] : void 0,
+			type: mapping.type
+		};
+	});
+}
+function toDefaultValue(kind, value) {
+	if (value === void 0) return;
+	switch (kind) {
+		case "string":
+		case "enum": return {
+			type: "string",
+			value: String(value)
+		};
+		case "number": return {
+			type: "number",
+			value: numberToString(value) ?? ""
+		};
+		case "integer": return {
+			type: "number",
+			value: integerToString(value, "default") ?? ""
+		};
+		case "boolean": return {
+			type: "boolean",
+			value: Boolean(value)
+		};
+		case "stringList": return {
+			type: "stringList",
+			value: [...value]
+		};
+		case "secret": throw new Error("Secret stack inputs cannot declare a default value");
 	}
-	/**
-	* Builds and validates the vault configuration.
-	* @returns An immutable Resource representing the configured vault.
-	* @throws Error if the vault configuration is invalid.
-	*/
-	build() {
-		const config = VaultSchema.parse(this._config);
-		return this.resource({
-			type: "vault",
-			...config
-		});
+}
+function validateDraft(id, draft) {
+	if (draft?.[stackInputDraftSymbol] !== true) throw new Error(`Stack input '${id}' must be created with alien.string(), alien.secret(), or another input helper`);
+	if (normalizeArray(draft.options.providedBy).length === 0) throw new Error(`Stack input '${id}' must include at least one providedBy value`);
+	if (!draft.options.label.trim()) throw new Error(`Stack input '${id}' must include a label`);
+	if (draft.options.required && !draft.options.description.trim()) throw new Error(`Stack input '${id}' must include a description when required is true`);
+	validateValidation(id, draft.kind, draft.validation);
+	for (const mapping of normalizeEnv(draft.options.env)) {
+		validateEnvName(id, mapping.name);
+		if (mapping.targetResources?.length === 0) throw new Error(`Stack input '${id}' env mapping '${mapping.name}' cannot use an empty targetResources list`);
 	}
-};
+}
+function validateInputId(id) {
+	if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(id)) throw new Error(`Stack input '${id}' id must start with a letter or underscore and contain only letters, digits, and underscores`);
+	if (!/[a-z]/.test(id)) throw new Error(`Stack input '${id}' id must not be all-caps env-var style`);
+}
+function validateEnvName(id, name) {
+	if (!/^[A-Z_][A-Z0-9_]*$/.test(name)) throw new Error(`Stack input '${id}' env name '${name}' must use uppercase letters, digits, and underscores`);
+}
+function validateValidation(id, kind, validation) {
+	const minLength = validation.minLength ?? void 0;
+	const maxLength = validation.maxLength ?? void 0;
+	const minItems = validation.minItems ?? void 0;
+	const maxItems = validation.maxItems ?? void 0;
+	if (minLength !== void 0 && maxLength !== void 0 && minLength > maxLength) throw new Error(`Stack input '${id}' minLength must be less than or equal to maxLength`);
+	if (minItems !== void 0 && maxItems !== void 0 && minItems > maxItems) throw new Error(`Stack input '${id}' minItems must be less than or equal to maxItems`);
+	if (kind === "enum" && (!validation.values || validation.values.length === 0)) throw new Error(`Stack input '${id}' enum values must not be empty`);
+	if (validation.pattern) validatePortablePattern(id, validation.pattern);
+}
+function validatePortablePattern(id, pattern) {
+	if (pattern.length === 0) throw new Error(`Stack input '${id}' pattern must not be empty`);
+	if (pattern.startsWith("/") && pattern.endsWith("/") && pattern.length > 1) throw new Error(`Stack input '${id}' pattern must not use regex delimiters`);
+	if (/\\[1-9pPk]/.test(pattern) || /\(\?/.test(pattern) || /\[[^\]]*\[/.test(pattern)) throw new Error(`Stack input '${id}' pattern is not portable across TypeScript, CloudFormation, and Terraform`);
+}
+function numberToString(value) {
+	if (value === void 0) return;
+	if (!Number.isFinite(value)) throw new Error("Stack input number constraints must be finite");
+	return String(value);
+}
+function integerToString(value, field) {
+	if (value === void 0) return;
+	if (!Number.isInteger(value)) throw new Error(`Stack input integer ${field} must be an integer`);
+	return String(value);
+}
 //#endregion
 //#region src/kv.ts
 /**
@@ -8329,53 +8968,16 @@ var Postgres = class extends ResourceBuilder {
 	highAvailability(value = true) {
 		this._config.highAvailability = value;
 		return this;
-	}
-	/**
-	* Builds and validates the postgres configuration.
-	* @returns An immutable Resource representing the configured database.
-	* @throws Error if the configuration is invalid.
-	*/
-	build() {
-		const config = PostgresSchema.parse(this._config);
-		return this.resource({
-			type: "postgres",
-			...config
-		});
-	}
-};
-//#endregion
-//#region src/ai.ts
-/**
-* Represents an AI Gateway resource that provides a unified interface to
-* managed AI inference services across cloud providers.
-*/
-var AI = class extends ResourceBuilder {
-	_config = {};
-	/**
-	* Creates a new AI builder.
-	* @param id Identifier for the AI resource. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
-	*/
-	constructor(id) {
-		super();
-		this._config.id = id;
-	}
-	/**
-	* Returns a ResourceType representing any AI resource.
-	* Used for creating permission targets that apply to all AI resources.
-	* @returns The "ai" resource type.
-	*/
-	static any() {
-		return "ai";
-	}
-	/**
-	* Builds and validates the AI configuration.
-	* @returns An immutable Resource representing the configured AI Gateway.
-	* @throws Error if the AI configuration is invalid.
+	}
+	/**
+	* Builds and validates the postgres configuration.
+	* @returns An immutable Resource representing the configured database.
+	* @throws Error if the configuration is invalid.
 	*/
 	build() {
-		const config = AiSchema.parse(this._config);
+		const config = PostgresSchema.parse(this._config);
 		return this.resource({
-			type: "ai",
+			type: "postgres",
 			...config
 		});
 	}
@@ -8418,101 +9020,6 @@ var Queue = class extends ResourceBuilder {
 	}
 };
 //#endregion
-//#region src/email.ts
-/**
-* Email infrastructure for sending and receiving mail on customer-owned
-* domains (AWS SES). Provisions a shared configuration set, optional inbound
-* and event wiring, and one email identity (Easy DKIM) per seed domain.
-*
-* The resource owns the email infrastructure, not the domain lifecycle. Seed
-* domains are optional: products that create and verify domains dynamically
-* should manage identities at runtime through the `email/manage-identities`
-* grant instead of listing them here. Runtime-created identities are
-* application data — they are not tracked by the deployment and survive stack
-* deletion.
-*
-* After deployment, create the per-domain DKIM CNAME records from the
-* resource outputs — SES verifies each domain once the records exist in DNS.
-*
-* When inbound mail is configured, the receipt rule is a catch-all (no
-* recipient filter), so mail for runtime-verified identities lands in the
-* bucket without redeployment. Setup activates the provisioned receipt rule
-* set automatically. SES permits one active receipt rule set per account and
-* region, so an AWS stack may contain only one Email with inbound delivery,
-* and installing it makes its rule set the account's active rule set.
-*/
-var Email = class extends ResourceBuilder {
-	_config = { domains: [] };
-	/**
-	* Creates a new Email builder.
-	* @param id Identifier for the email resource. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
-	*/
-	constructor(id) {
-		super();
-		this._config.id = id;
-	}
-	/**
-	* Returns a ResourceType representing any email resource.
-	* Used for creating permission targets that apply to all email resources.
-	* @returns The "email" resource type.
-	*/
-	static any() {
-		return "email";
-	}
-	/**
-	* Sets the seed mail domains provisioned at deploy time (one SES identity
-	* each). Optional — omit for products that manage domains at runtime.
-	* @param domains The mail domains (e.g. `["mail.example.com"]`).
-	* @returns The Email builder instance.
-	*/
-	domains(domains) {
-		this._config.domains = domains;
-		return this;
-	}
-	/**
-	* Adds a single seed mail domain.
-	* @param domain The mail domain (e.g. `"mail.example.com"`).
-	* @returns The Email builder instance.
-	*/
-	domain(domain) {
-		this._config.domains = [...this._config.domains ?? [], domain];
-		return this;
-	}
-	/**
-	* Configures inbound mail: raw incoming mail for the configured domains is
-	* written to the linked Storage bucket. Note the post-deploy activation
-	* step described in the class documentation.
-	* @param storage The Storage resource that receives raw incoming mail.
-	* @returns The Email builder instance.
-	*/
-	inbound(storage) {
-		this._config.inbound = { storage: storage.ref() };
-		return this;
-	}
-	/**
-	* Configures sending events: send / delivery / bounce / complaint /
-	* delivery-delay / reject events are delivered to the linked Queue.
-	* @param queue The Queue resource that receives sending events.
-	* @returns The Email builder instance.
-	*/
-	events(queue) {
-		this._config.events = { queue: queue.ref() };
-		return this;
-	}
-	/**
-	* Builds and validates the email configuration.
-	* @returns An immutable Resource representing the configured email infrastructure.
-	* @throws Error if the email configuration is invalid.
-	*/
-	build() {
-		const config = EmailSchema.parse(this._config);
-		return this.resource({
-			type: "email",
-			...config
-		});
-	}
-};
-//#endregion
 //#region src/service-account.ts
 /**
 * Represents a non-human identity that can be assumed by compute services.
@@ -8575,203 +9082,33 @@ var ServiceAccount = class {
 	*   platforms: {
 	*     aws: [{ grant: { actions: ["s3:GetObject"] }, binding: { stack: { resources: ["*"] } } }]
 	*   }
-	* }
-	*
-	* const account = new ServiceAccount("custom-processor")
-	*   .stackPermissionSet(customPermissionSet)
-	*   .build()
-	* ```
-	*
-	* @param permissionSet The permission set object with platform-specific permissions
-	* @returns The ServiceAccount builder instance.
-	*/
-	stackPermissionSet(permissionSet) {
-		if (!this._config.stackPermissionSets) this._config.stackPermissionSets = [];
-		this._config.stackPermissionSets.push(permissionSet);
-		return this;
-	}
-	/**
-	* Builds and validates the service account configuration.
-	* @returns An immutable Resource representing the configured service account.
-	* @throws Error if the service account configuration is invalid.
-	*/
-	build() {
-		return new Resource({
-			type: "service-account",
-			...ServiceAccountSchema.parse(this._config)
-		});
-	}
-};
-//#endregion
-//#region src/input.ts
-const stackInputDraftSymbol = Symbol("alien.stackInputDraft");
-const stackInputDefinitionsSymbol = Symbol("alien.stackInputDefinitions");
-function inputs(drafts) {
-	const result = {};
-	const definitions = [];
-	for (const [id, draft] of Object.entries(drafts)) {
-		validateInputId(id);
-		validateDraft(id, draft);
-		result[id] = {
-			id,
-			kind: draft.kind
-		};
-		definitions.push({
-			id,
-			kind: draft.kind,
-			providedBy: normalizeArray(draft.options.providedBy),
-			required: draft.options.required,
-			label: draft.options.label,
-			description: draft.options.description,
-			placeholder: draft.options.placeholder,
-			default: toDefaultValue(draft.kind, draft.options.default),
-			platforms: draft.options.platforms ? [...draft.options.platforms] : void 0,
-			validation: Object.keys(draft.validation).length > 0 ? draft.validation : void 0,
-			env: normalizeEnv(draft.options.env)
-		});
-	}
-	Object.defineProperty(result, stackInputDefinitionsSymbol, {
-		value: Object.freeze(definitions),
-		enumerable: false
-	});
-	return result;
-}
-function getStackInputDefinitions(value) {
-	if (Array.isArray(value)) return [...value];
-	return [...value[stackInputDefinitionsSymbol]];
-}
-function defineInput(kind, options, validation = {}) {
-	return {
-		[stackInputDraftSymbol]: true,
-		kind,
-		options,
-		validation
-	};
-}
-function defineStringInput(options) {
-	return defineInput("string", options, {
-		minLength: options.minLength,
-		maxLength: options.maxLength,
-		pattern: options.pattern,
-		format: options.format
-	});
-}
-function defineSecretInput(options) {
-	return defineInput("secret", options, {
-		minLength: options.minLength,
-		maxLength: options.maxLength,
-		pattern: options.pattern,
-		format: options.format
-	});
-}
-function defineNumberInput(options) {
-	return defineInput("number", options, {
-		min: numberToString(options.min),
-		max: numberToString(options.max)
-	});
-}
-function defineIntegerInput(options) {
-	return defineInput("integer", options, {
-		min: integerToString(options.min, "min"),
-		max: integerToString(options.max, "max")
-	});
-}
-function defineBooleanInput(options) {
-	return defineInput("boolean", options);
-}
-function defineEnumInput(values, options) {
-	return defineInput("enum", options, { values: [...values] });
-}
-function defineStringListInput(options) {
-	return defineInput("stringList", options, {
-		minItems: options.minItems,
-		maxItems: options.maxItems
-	});
-}
-function normalizeArray(value) {
-	return Array.isArray(value) ? [...value] : [value];
-}
-function normalizeEnv(value) {
-	if (!value) return [];
-	return normalizeArray(value).map((mapping) => {
-		if (typeof mapping === "string") return { name: mapping };
-		return {
-			name: mapping.name,
-			targetResources: mapping.targetResources ? [...mapping.targetResources] : void 0,
-			type: mapping.type
-		};
-	});
-}
-function toDefaultValue(kind, value) {
-	if (value === void 0) return;
-	switch (kind) {
-		case "string":
-		case "enum": return {
-			type: "string",
-			value: String(value)
-		};
-		case "number": return {
-			type: "number",
-			value: numberToString(value) ?? ""
-		};
-		case "integer": return {
-			type: "number",
-			value: integerToString(value, "default") ?? ""
-		};
-		case "boolean": return {
-			type: "boolean",
-			value: Boolean(value)
-		};
-		case "stringList": return {
-			type: "stringList",
-			value: [...value]
-		};
-		case "secret": throw new Error("Secret stack inputs cannot declare a default value");
+	* }
+	*
+	* const account = new ServiceAccount("custom-processor")
+	*   .stackPermissionSet(customPermissionSet)
+	*   .build()
+	* ```
+	*
+	* @param permissionSet The permission set object with platform-specific permissions
+	* @returns The ServiceAccount builder instance.
+	*/
+	stackPermissionSet(permissionSet) {
+		if (!this._config.stackPermissionSets) this._config.stackPermissionSets = [];
+		this._config.stackPermissionSets.push(permissionSet);
+		return this;
 	}
-}
-function validateDraft(id, draft) {
-	if (!draft || draft[stackInputDraftSymbol] !== true) throw new Error(`Stack input '${id}' must be created with alien.string(), alien.secret(), or another input helper`);
-	if (normalizeArray(draft.options.providedBy).length === 0) throw new Error(`Stack input '${id}' must include at least one providedBy value`);
-	if (!draft.options.label.trim()) throw new Error(`Stack input '${id}' must include a label`);
-	if (draft.options.required && !draft.options.description.trim()) throw new Error(`Stack input '${id}' must include a description when required is true`);
-	validateValidation(id, draft.kind, draft.validation);
-	for (const mapping of normalizeEnv(draft.options.env)) {
-		validateEnvName(id, mapping.name);
-		if (mapping.targetResources?.length === 0) throw new Error(`Stack input '${id}' env mapping '${mapping.name}' cannot use an empty targetResources list`);
+	/**
+	* Builds and validates the service account configuration.
+	* @returns An immutable Resource representing the configured service account.
+	* @throws Error if the service account configuration is invalid.
+	*/
+	build() {
+		return new Resource({
+			type: "service-account",
+			...ServiceAccountSchema.parse(this._config)
+		});
 	}
-}
-function validateInputId(id) {
-	if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(id)) throw new Error(`Stack input '${id}' id must start with a letter or underscore and contain only letters, digits, and underscores`);
-	if (!/[a-z]/.test(id)) throw new Error(`Stack input '${id}' id must not be all-caps env-var style`);
-}
-function validateEnvName(id, name) {
-	if (!/^[A-Z_][A-Z0-9_]*$/.test(name)) throw new Error(`Stack input '${id}' env name '${name}' must use uppercase letters, digits, and underscores`);
-}
-function validateValidation(id, kind, validation) {
-	const minLength = validation.minLength ?? void 0;
-	const maxLength = validation.maxLength ?? void 0;
-	const minItems = validation.minItems ?? void 0;
-	const maxItems = validation.maxItems ?? void 0;
-	if (minLength !== void 0 && maxLength !== void 0 && minLength > maxLength) throw new Error(`Stack input '${id}' minLength must be less than or equal to maxLength`);
-	if (minItems !== void 0 && maxItems !== void 0 && minItems > maxItems) throw new Error(`Stack input '${id}' minItems must be less than or equal to maxItems`);
-	if (kind === "enum" && (!validation.values || validation.values.length === 0)) throw new Error(`Stack input '${id}' enum values must not be empty`);
-	if (validation.pattern) validatePortablePattern(id, validation.pattern);
-}
-function validatePortablePattern(id, pattern) {
-	if (pattern.length === 0) throw new Error(`Stack input '${id}' pattern must not be empty`);
-	if (pattern.startsWith("/") && pattern.endsWith("/") && pattern.length > 1) throw new Error(`Stack input '${id}' pattern must not use regex delimiters`);
-	if (/\\[1-9pPk]/.test(pattern) || /\(\?/.test(pattern) || /\[[^\]]*\[/.test(pattern)) throw new Error(`Stack input '${id}' pattern is not portable across TypeScript, CloudFormation, and Terraform`);
-}
-function numberToString(value) {
-	if (value === void 0) return;
-	if (!Number.isFinite(value)) throw new Error("Stack input number constraints must be finite");
-	return String(value);
-}
-function integerToString(value, field) {
-	if (value === void 0) return;
-	if (!Number.isInteger(value)) throw new Error(`Stack input integer ${field} must be an integer`);
-	return String(value);
-}
+};
 //#endregion
 //#region src/stack.ts
 /**
@@ -8817,699 +9154,362 @@ var Stack = class {
 		return this;
 	}
 	/**
-	* Configure permissions for this stack.
-	* @param config Permission configuration
-	* @returns The Stack builder instance.
-	*/
-	permissions(config) {
-		this._config.permissions = config;
-		return this;
-	}
-	/**
-	* Configure values that must be provided before setup or deployment can proceed.
-	* @param inputs Stack input definitions created with alien.inputs({...}).
-	* @returns The Stack builder instance.
-	*/
-	inputs(inputs) {
-		this._config.inputs = getStackInputDefinitions(inputs);
-		return this;
-	}
-	/**
-	* Gets the stack ID without building/validating the stack.
-	* @returns The stack ID.
-	*/
-	get id() {
-		return this._config.id;
-	}
-	/**
-	* Builds and validates the stack configuration.
-	* @returns The complete and validated stack configuration.
-	* @throws Error if the stack configuration is invalid.
-	*/
-	build() {
-		return StackSchema.parse(this._config);
-	}
-};
-//#endregion
-//#region src/error.ts
-/**
-* This module provides a structured error handling system similar to Rust's error types,
-* with TypeScript type safety, error chaining, and context preservation.
-*
-* @example Basic Usage
-* ```typescript
-* import { AlienError, defineError } from '@alienplatform/core'
-* import { z } from 'zod'
-*
-* // Define a type-safe error
-* const DatabaseError = defineError({
-*   code: "DATABASE_CONNECTION_FAILED",
-*   context: z.object({
-*     host: z.string(),
-*     port: z.number(),
-*     reason: z.string(),
-*   }),
-*   message: ({ host, port, reason }) => `Failed to connect to database '${host}:${port}': ${reason}`,
-*   retryable: true,
-*   internal: false,
-*   httpStatusCode: 502,
-* })
-*
-* // Use it
-* throw new AlienError(DatabaseError.create({
-*   host: "localhost",
-*   port: 5432,
-*   reason: "Connection timeout"
-* }))
-* ```
-*
-* @example Error Chaining
-* ```typescript
-* try {
-*   // Some operation that fails
-*   throw new Error("Connection refused")
-* } catch (error) {
-*   throw (await AlienError.from(error)).withContext(
-*     DatabaseError.create({
-*       host: "localhost",
-*       port: 5432,
-*       reason: "Connection refused by server"
-*     })
-*   )
-* }
-* ```
-*
-* @example External API Sanitization
-* ```typescript
-* const internalError = new AlienError(InternalApiError.create({
-*   service: "payment-processor",
-*   details: "Database password expired",
-*   traceId: "trace-12345"
-* }))
-*
-* // Safe for external APIs (sanitizes internal errors)
-* const safeResponse = internalError.toExternal()
-* ```
-*/
-/**
-* Helper function to create type-safe error definitions.
-*
-* This function provides a clean API for defining reusable error types
-* with full TypeScript type safety and Zod validation.
-*
-* @template TContext - Zod schema type for the error context
-* @param metadata - Error metadata including code, schema, and message generator
-* @returns Object with metadata and a create function for error instances
-*
-* @example
-* ```typescript
-* const UserNotFound = defineError({
-*   code: "USER_NOT_FOUND",
-*   context: z.object({
-*     userId: z.string(),
-*     searchMethod: z.string(),
-*   }),
-*   message: ({ userId, searchMethod }) =>
-*     `User '${userId}' not found using method '${searchMethod}'`,
-*   retryable: false,
-*   internal: false,
-*   httpStatusCode: 404,
-* })
-*
-* // Usage
-* const error = UserNotFound.create({
-*   userId: "123",
-*   searchMethod: "database_lookup"
-* })
-* ```
-*/
-function defineError(metadata) {
-	return {
-		metadata,
-		contextSchema: metadata.context,
-		create: (context) => ({
-			metadata,
-			contextSchema: metadata.context,
-			context,
-			toOptions: () => ({
-				code: metadata.code,
-				message: metadata.message(context),
-				retryable: metadata.retryable,
-				internal: metadata.internal,
-				httpStatusCode: metadata.httpStatusCode,
-				context
-			})
-		})
-	};
-}
-/**
-* Main AlienError class that provides structured error handling.
-*
-* This class extends the standard JavaScript Error with additional features:
-* - Type-safe context data
-* - Error chaining and source tracking
-* - Retryability and internal/external visibility flags
-* - HTTP status code mapping
-* - Sanitization for external APIs
-*
-* @template TContext - Zod schema type for the error context
-*
-* @example Basic Construction
-* ```typescript
-* const error = new AlienError(DatabaseError.create({
-*   host: "localhost",
-*   port: 5432,
-*   reason: "Timeout"
-* }))
-* ```
-*
-* @example Converting JavaScript Errors
-* ```typescript
-* try {
-*   JSON.parse("invalid json")
-* } catch (jsError) {
-*   const alienError = AlienError.from(jsError)
-*   console.log(alienError.code) // "GENERIC_ERROR"
-* }
-* ```
-*
-* @example Error Chaining
-* ```typescript
-* const contextualError = AlienError.from(new Error("Network timeout"))
-*   .withContext(DatabaseError.create({
-*     host: "localhost",
-*     port: 5432,
-*     reason: "Connection timeout"
-*   }))
-*
-* // Check error chain
-* console.log(contextualError.hasErrorCode("DATABASE_CONNECTION_FAILED")) // true
-* console.log(contextualError.toString()) // Shows full error chain
-* ```
+	* Configure permissions for this stack.
+	* @param config Permission configuration
+	* @returns The Stack builder instance.
+	*/
+	permissions(config) {
+		this._config.permissions = config;
+		return this;
+	}
+	/**
+	* Configure values that must be provided before setup or deployment can proceed.
+	* @param inputs Stack input definitions created with alien.inputs({...}).
+	* @returns The Stack builder instance.
+	*/
+	inputs(inputs) {
+		this._config.inputs = getStackInputDefinitions(inputs);
+		return this;
+	}
+	/**
+	* Gets the stack ID without building/validating the stack.
+	* @returns The stack ID.
+	*/
+	get id() {
+		return this._config.id;
+	}
+	/**
+	* Builds and validates the stack configuration.
+	* @returns The complete and validated stack configuration.
+	* @throws Error if the stack configuration is invalid.
+	*/
+	build() {
+		return StackSchema.parse(this._config);
+	}
+};
+//#endregion
+//#region src/storage.ts
+/**
+* Represents an object storage bucket.
 */
-var AlienError = class AlienError extends Error {
-	/** Unique error code identifying the error type */
-	code;
-	/** Whether this error can be safely retried */
-	retryable;
-	/** Whether this error contains sensitive internal information */
-	internal;
-	/** HTTP status code for API responses */
-	httpStatusCode;
-	/** Type-safe context data specific to this error */
-	context;
-	/** Optional human-facing remediation hint */
-	hint;
-	/** Source error that caused this error (for chaining) */
-	source;
-	constructor(input) {
-		let options;
-		if ("metadata" in input && "context" in input) {
-			const { metadata, context: contextData } = input;
-			const message = metadata.message(contextData);
-			options = {
-				code: metadata.code,
-				message,
-				retryable: metadata.retryable,
-				internal: metadata.internal,
-				httpStatusCode: metadata.httpStatusCode,
-				context: contextData
-			};
-		} else options = input;
-		const message = options.message;
-		super(message, { cause: options.source });
-		this.name = "AlienError";
-		this.code = options.code;
-		this.retryable = options.retryable;
-		this.internal = options.internal;
-		this.httpStatusCode = options.httpStatusCode ?? 500;
-		this.context = options.context;
-		this.hint = options.hint;
-		this.source = void 0;
-		if (options.source && typeof options.source === "object") {
-			if ("code" in options.source && "message" in options.source && "retryable" in options.source && "internal" in options.source) this.source = new AlienError(options.source);
-		}
+var Storage = class extends ResourceBuilder {
+	_config = {
+		publicRead: false,
+		versioning: false,
+		lifecycleRules: [],
+		corsAllowedOrigins: []
+	};
+	/**
+	* Creates a new Storage builder.
+	* @param id ID of the storage bucket. For names with dots, each dot-separated label must be ≤ 63 characters.
+	*/
+	constructor(id) {
+		super();
+		this._config.id = id;
 	}
 	/**
-	* Create an AlienError from a type-safe error definition.
-	*
-	* @template TContext - Zod schema type for the error context
-	* @param definition - Error definition with type-safe context
-	* @returns New AlienError instance
+	* Returns a ResourceType representing any storage resource.
+	* Used for creating permission targets that apply to all storage resources.
+	* @returns The "storage" resource type.
 	*/
-	static fromDefinition(definition) {
-		return new AlienError(definition);
+	static any() {
+		return "storage";
 	}
 	/**
-	* Create an AlienError from raw options (for compatibility).
-	*
-	* @param options - Raw error options conforming to AlienErrorOptions schema
-	* @returns New AlienError instance
+	* Allows public read access to objects without authentication.
+	* Default: `false`.
+	* @param value Whether to allow public read access.
+	* @returns The Storage builder instance.
 	*/
-	static fromOptions(options) {
-		return new AlienError(AlienErrorSchema.parse(options));
+	publicRead(value) {
+		this._config.publicRead = value;
+		return this;
 	}
 	/**
-	* Helper function to get a user-friendly type name for error context.
-	*
-	* @param error - Any value to get the type name for
-	* @returns User-friendly type name
+	* Enables object versioning.
+	* Default: `false`.
+	* @param value Whether to enable versioning.
+	* @returns The Storage builder instance.
 	*/
-	static getErrorTypeName(error) {
-		if (error === null) return "null";
-		if (error === void 0) return "undefined";
-		if (error?.constructor?.name) return error.constructor.name;
-		const typeofResult = typeof error;
-		return typeofResult === "object" ? "Object" : typeofResult.charAt(0).toUpperCase() + typeofResult.slice(1);
+	versioning(value) {
+		this._config.versioning = value;
+		return this;
 	}
 	/**
-	* Convert a JavaScript Error or any object to a generic AlienError.
-	*
-	* This is equivalent to Rust's `.into_alien_error()` pattern and provides
-	* a way to convert any JavaScript error into the structured AlienError format.
-	*
-	* @param error - Any JavaScript error or object to convert
-	* @returns AlienError with GENERIC_ERROR code and preserved original error
-	*
-	* @example
-	* ```typescript
-	* try {
-	*   throw new TypeError("Invalid argument")
-	* } catch (error) {
-	*   const alienError = AlienError.from(error)
-	*   console.log(alienError.code) // "GENERIC_ERROR"
-	*   console.log(alienError.context?.originalError) // Serialized TypeError
-	* }
-	* ```
-	*
-	* @example Chaining with context
-	* ```typescript
-	* try {
-	*   JSON.parse("invalid")
-	* } catch (error) {
-	*   throw AlienError.from(error).withContext(
-	*     ValidationError.create({
-	*       input: "invalid",
-	*       expectedFormat: "JSON"
-	*     })
-	*   )
-	* }
-	* ```
-	*
-	* @example AxiosError conversion
-	* ```typescript
-	* try {
-	*   await axios.get('/api/resource')
-	* } catch (error) {
-	*   // If error.response.data contains a valid AlienError structure, it will be parsed
-	*   const alienError = AlienError.from(error)
-	*   console.log(alienError.code) // Could be "REMOTE_RESOURCE_NOT_FOUND" if parsed from response
-	* }
-	* ```
+	* Defines lifecycle rules for automatic object management (e.g., expiration).
+	* @param rules An array of lifecycle rules.
+	* @returns The Storage builder instance.
 	*/
-	static async from(error) {
-		if (error instanceof AlienError) return error;
-		if (error instanceof Response) {
-			let errorBody;
-			try {
-				errorBody = await error.json();
-			} catch {
-				return new AlienError({
-					code: "GENERIC_ERROR",
-					message: `HTTP request failed with status ${error.status}`,
-					retryable: false,
-					internal: true,
-					httpStatusCode: error.status,
-					context: {
-						url: error.url,
-						status: error.status,
-						statusText: error.statusText
-					}
-				});
-			}
-			const parseResult = AlienErrorSchema.safeParse(errorBody);
-			if (parseResult.success) return new AlienError(parseResult.data);
-			return new AlienError({
-				code: "GENERIC_ERROR",
-				message: errorBody?.message || `HTTP request failed with status ${error.status}`,
-				retryable: false,
-				internal: true,
-				httpStatusCode: error.status,
-				context: {
-					url: error.url,
-					status: error.status,
-					statusText: error.statusText,
-					responseBody: errorBody
-				}
-			});
-		}
-		if (error?.response?.data && typeof error.response.data === "object") {
-			const parseResult = AlienErrorSchema.safeParse(error.response.data);
-			if (parseResult.success) return new AlienError(parseResult.data);
-		}
-		const serialized = serializeError(error);
-		const message = serialized?.message || String(error);
-		return new AlienError({
-			code: "GENERIC_ERROR",
-			message,
-			retryable: false,
-			internal: true,
-			httpStatusCode: 500,
-			context: {
-				originalError: serialized,
-				errorType: AlienError.getErrorTypeName(error)
-			}
+	lifecycleRules(rules) {
+		this._config.lifecycleRules = rules;
+		return this;
+	}
+	/**
+	* Allows browser reads from the listed origins through signed URLs.
+	* Providers enable `GET` and `HEAD`; use `*` only when the signed URL itself
+	* is the credential and browser cookies are not involved.
+	* @param origins Allowed browser origins.
+	* @returns The Storage builder instance.
+	*/
+	corsAllowedOrigins(origins) {
+		this._config.corsAllowedOrigins = origins;
+		return this;
+	}
+	/**
+	* Builds and validates the storage configuration.
+	* @returns An immutable Resource representing the configured storage bucket.
+	* @throws Error if the storage configuration is invalid.
+	*/
+	build() {
+		const config = StorageSchema.parse(this._config);
+		return this.resource({
+			type: "storage",
+			...config
 		});
 	}
+};
+//#endregion
+//#region src/vault.ts
+/**
+* Represents a secure vault for storing secrets.
+* This resource provides a platform-agnostic interface over cloud-native secret management services:
+* - AWS: AWS Secrets Manager with prefixed secret names
+* - GCP: Secret Manager with prefixed secret names
+* - Azure: Key Vault resource
+*
+* The vault acts as a namespace for secrets and controls access permissions for workers and services.
+*/
+var Vault = class extends ResourceBuilder {
+	_config = {};
 	/**
-	* Add context to this error, creating a new error that wraps this one.
-	*
-	* This is equivalent to Rust's `.with_context()` pattern and allows
-	* building error chains with increasing levels of context.
-	*
-	* @template TNewContext - Zod schema type for the new context
-	* @param definition - Error definition to wrap this error with
-	* @returns New AlienError with this error as the source
-	*
-	* @example
-	* ```typescript
-	* // Clean fluent API
-	* const authError = (await AlienError.from(new Error("ECONNREFUSED")))
-	*   .withContext(DatabaseError.create({
-	*     host: "localhost",
-	*     port: 5432,
-	*     reason: "Connection refused"
-	*   }))
-	*   .withContext(AuthError.create({
-	*     username: "john",
-	*     reason: "Database unavailable"
-	*   }))
-	*
-	* // Error chain: AuthError -> DatabaseError -> GENERIC_ERROR
-	* console.log(authError.toString())
-	* ```
+	* Creates a new Vault builder.
+	* @param id Identifier for the vault. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
 	*/
-	withContext(definition) {
-		const { metadata, context: contextData } = definition;
-		const message = metadata.message(contextData);
-		const sourceOptions = {
-			code: this.code,
-			message: this.message,
-			retryable: this.retryable,
-			internal: this.internal,
-			httpStatusCode: this.httpStatusCode,
-			context: this.context,
-			hint: this.hint,
-			source: this.source?.toOptions()
-		};
-		return new AlienError({
-			code: metadata.code,
-			message,
-			retryable: metadata.retryable,
-			internal: metadata.internal,
-			httpStatusCode: metadata.httpStatusCode,
-			context: contextData,
-			source: sourceOptions
+	constructor(id) {
+		super();
+		this._config.id = id;
+	}
+	/**
+	* Returns a ResourceType representing any vault resource.
+	* Used for creating permission targets that apply to all vault resources.
+	* @returns The "vault" resource type.
+	*/
+	static any() {
+		return "vault";
+	}
+	/**
+	* Builds and validates the vault configuration.
+	* @returns An immutable Resource representing the configured vault.
+	* @throws Error if the vault configuration is invalid.
+	*/
+	build() {
+		const config = VaultSchema.parse(this._config);
+		return this.resource({
+			type: "vault",
+			...config
 		});
 	}
+};
+//#endregion
+//#region src/worker.ts
+/**
+* Represents a serverless worker that executes code in response to triggers or direct invocations.
+* Workers are the primary compute resource in serverless applications, designed to be stateless and ephemeral.
+*/
+var Worker = class extends ResourceBuilder {
+	_config = {
+		links: [],
+		triggers: [],
+		publicEndpoints: [],
+		environment: {}
+	};
 	/**
-	* Convert this AlienError to the wire format (AlienErrorOptions).
-	*
-	* This method serializes the error into the standard format used
-	* for transmitting errors over the network or storing them.
-	*
-	* @returns AlienErrorOptions object representing this error
+	* Creates a new Worker builder.
+	* @param id Identifier for the worker. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
 	*/
-	toOptions() {
-		return {
-			code: this.code,
-			message: this.message,
-			retryable: this.retryable,
-			internal: this.internal,
-			httpStatusCode: this.httpStatusCode,
-			context: this.context,
-			hint: this.hint,
-			source: this.source?.toOptions()
-		};
+	constructor(id) {
+		super();
+		this._config.id = id;
 	}
 	/**
-	* Get a sanitized version for external APIs (hides internal errors).
-	*
-	* This method is crucial for security - it prevents sensitive internal
-	* error details from being exposed to external users while preserving
-	* the error chain structure for non-sensitive errors.
-	*
-	* @returns Sanitized AlienErrorOptions safe for external consumption
-	*
-	* @example
-	* ```typescript
-	* const internalError = new AlienError(InternalApiError.create({
-	*   service: "payment-processor",
-	*   details: "Database password expired for user admin",
-	*   traceId: "trace-12345"
-	* }))
-	*
-	* console.log(internalError.toOptions())
-	* // Shows full details including sensitive information
-	*
-	* console.log(internalError.toExternal())
-	* // { code: "GENERIC_ERROR", message: "Internal server error", ... }
-	* ```
+	* Returns a ResourceType representing any worker resource.
+	* Used for creating permission targets that apply to all worker resources.
+	* @returns The "worker" resource type.
 	*/
-	toExternal() {
-		if (this.internal) return {
-			code: "GENERIC_ERROR",
-			message: "Internal server error",
-			retryable: false,
-			internal: false,
-			httpStatusCode: 500
-		};
-		return {
-			code: this.code,
-			message: this.message,
-			retryable: this.retryable,
-			internal: this.internal,
-			httpStatusCode: this.httpStatusCode,
-			context: this.context,
-			hint: this.hint,
-			source: this.source?.toExternal()
-		};
+	static any() {
+		return "worker";
 	}
 	/**
-	* Check if this error chain contains an error with a specific code.
-	*
-	* This method traverses the entire error chain (this error and all
-	* source errors) to find if any error has the specified code.
-	*
-	* @param code - Error code to search for
-	* @returns True if the code is found anywhere in the error chain
-	*
-	* @example
-	* ```typescript
-	* const chainedError = authError.withContext(dbError.withContext(networkError))
+	* Sets the code for the worker, either a pre-built image or source code to be built.
+	* @param code The worker code configuration.
+	* @returns The Worker builder instance.
+	*/
+	code(code) {
+		this._config.code = code;
+		return this;
+	}
+	/**
+	* Sets the memory allocated to the worker in megabytes (MB).
+	* Constraints: 128‑32768 MB (platform-specific limits may apply).
+	* Default: 512 MB.
+	* @param mb The memory in MB.
+	* @returns The Worker builder instance.
+	*/
+	memoryMb(mb) {
+		this._config.memoryMb = mb;
+		return this;
+	}
+	/**
+	* Sets the maximum execution time for the worker in seconds.
+	* Constraints: 1‑3600 seconds (platform-specific limits may apply).
+	* Default: 30 seconds.
+	* @param sec The timeout in seconds.
+	* @returns The Worker builder instance.
+	*/
+	timeoutSeconds(sec) {
+		this._config.timeoutSeconds = sec;
+		return this;
+	}
+	/**
+	* Sets the maximum number of concurrent executions allowed for the worker.
+	* `null` means platform default applies.
+	* @param limit The concurrency limit, or `null` for platform default.
+	* @returns The Worker builder instance.
+	*/
+	concurrencyLimit(limit) {
+		this._config.concurrencyLimit = limit;
+		return this;
+	}
+	/**
+	* Exposes a named public HTTP endpoint for the worker.
 	*
-	* console.log(chainedError.hasErrorCode("AUTH_FAILED")) // true
-	* console.log(chainedError.hasErrorCode("DATABASE_CONNECTION_FAILED")) // true
-	* console.log(chainedError.hasErrorCode("NETWORK_TIMEOUT")) // true
-	* console.log(chainedError.hasErrorCode("NONEXISTENT_ERROR")) // false
-	* ```
+	* If no public endpoint is declared, the worker is private and only reachable
+	* through triggers, commands, or provider invocation APIs.
+	*/
+	publicEndpoint(name, options = {}) {
+		if (!this._config.publicEndpoints) this._config.publicEndpoints = [];
+		this._config.publicEndpoints.push({
+			name,
+			hostLabel: options.hostLabel,
+			wildcardSubdomains: options.wildcardSubdomains ?? false
+		});
+		return this;
+	}
+	/**
+	* Sets key-value pairs as environment variables for the worker.
+	* @param env A map of environment variable names to their values.
+	* @returns The Worker builder instance.
+	*/
+	environment(env) {
+		this._config.environment = env;
+		return this;
+	}
+	/**
+	* Links another resource (e.g., Storage, KV, Queue) to this worker.
+	* This makes the linked resource accessible to the worker, often by injecting
+	* environment variables or granting permissions.
+	* @param resource The resource to link.
+	* @returns The Worker builder instance.
+	*/
+	link(resource) {
+		if (!this._config.links) this._config.links = [];
+		this._config.links.push(resource.ref());
+		return this;
+	}
+	/**
+	* Assigns a permission profile to this worker.
+	* The profile defines the permissions granted to this worker when interacting
+	* with other cloud resources.
+	* @param permissions The permission profile name.
+	* @returns The Worker builder instance.
 	*/
-	hasErrorCode(code) {
-		if (this.code === code) return true;
-		return this.source?.hasErrorCode(code) ?? false;
+	permissions(permissions) {
+		this._config.permissions = permissions;
+		return this;
 	}
 	/**
-	* Find the first error in the chain with a specific code.
-	*
-	* This method traverses the error chain and returns the first error
-	* instance that matches the specified code, allowing access to its
-	* specific context and details.
-	*
-	* @param code - Error code to search for
-	* @returns AlienError instance with the specified code, or undefined if not found
+	* Configures a readiness probe for the worker.
+	* The probe will be executed after provisioning/update to verify the worker is ready.
+	* Only works with workers that declare a public endpoint.
 	*
 	* @example
 	* ```typescript
-	* const chainedError = authError.withContext(dbError)
+	* const probe: ReadinessProbe = {
+	*   method: "GET",
+	*   path: "/health"
+	* };
 	*
-	* const dbError = chainedError.findErrorByCode("DATABASE_CONNECTION_FAILED")
-	* if (dbError) {
-	*   console.log("Database error context:", dbError.context)
-	*   console.log("Host:", dbError.context?.host)
-	* }
+	* const func = new Worker("my-api")
+	*   .code({ type: "image", image: "my-api:latest" })
+	*   .publicEndpoint("api")
+	*   .readinessProbe(probe)
+	*   .build();
 	* ```
+	*
+	* @param probe The readiness probe configuration.
+	* @returns The Worker builder instance.
 	*/
-	findErrorByCode(code) {
-		if (this.code === code) return this;
-		return this.source?.findErrorByCode(code);
+	readinessProbe(probe) {
+		this._config.readinessProbe = probe;
+		return this;
 	}
 	/**
-	* Get a formatted string representation of the error chain.
-	*
-	* This method provides a human-readable representation of the entire
-	* error chain, showing how errors are nested and providing context
-	* for debugging and logging.
-	*
-	* @returns Formatted string showing the complete error chain
+	* Enables or disables the Commands protocol for the worker.
+	* When enabled, the platform pushes commands into the Worker runtime, which executes registered handlers.
+	* Default: false.
+	* @param enabled Whether to enable commands for this worker.
+	* @returns The Worker builder instance.
+	*/
+	commandsEnabled(enabled) {
+		this._config.commandsEnabled = enabled;
+		return this;
+	}
+	/**
+	* Adds a trigger to the worker. Workers can have multiple triggers.
+	* Each trigger will independently invoke the worker when its conditions are met.
 	*
 	* @example
 	* ```typescript
-	* const chainedError = authError.withContext(dbError.withContext(networkError))
-	* console.log(chainedError.toString())
-	* // Output:
-	* // AUTH_FAILED: User authentication failed for 'john'
-	* //   ├─▶ DATABASE_CONNECTION_FAILED: Failed to connect to database 'localhost:5432'
-	* //     ├─▶ GENERIC_ERROR: Connection timeout
+	* // Queue trigger
+	* const queueTrigger: WorkerTrigger = {
+	*   type: "queue",
+	*   queue: myQueue.ref()
+	* };
+	*
+	* // Schedule trigger
+	* const scheduleTrigg: WorkerTrigger = {
+	*   type: "schedule",
+	*   cron: "0 * * * *"
+	* };
+	*
+	* const func = new Worker("my-func")
+	*   .code({ type: "image", image: "my-image:latest" })
+	*   .trigger(queueTrigger)
+	*   .trigger(scheduleTrigger)
+	*   .build();
 	* ```
+	*
+	* @param trigger The trigger configuration.
+	* @returns The Worker builder instance.
 	*/
-	toString() {
-		let result = `${this.code}: ${this.message}`;
-		let current = this.source;
-		let indent = "";
-		while (current) {
-			indent += "  ";
-			result += `\n${indent}├─▶ ${current.code}: ${current.message}`;
-			current = current.source;
-		}
-		return result;
+	trigger(trigger) {
+		if (!this._config.triggers) this._config.triggers = [];
+		this._config.triggers.push(trigger);
+		return this;
 	}
-};
-//#endregion
-//#region src/common-errors.ts
-/**
-* Error thrown when a requested resource cannot be found in the stack state.
-* This matches the Rust alien-core error: RESOURCE_NOT_FOUND
-*/
-const ResourceNotFoundError = defineError({
-	code: "RESOURCE_NOT_FOUND",
-	context: z$1.object({
-		resourceId: z$1.string(),
-		availableResources: z$1.array(z$1.string())
-	}),
-	message: ({ resourceId, availableResources }) => `Resource '${resourceId}' not found in stack state. Available resources: ${JSON.stringify(availableResources)}`,
-	retryable: false,
-	internal: false,
-	httpStatusCode: 404
-});
-/**
-* Error thrown when resource outputs cannot be parsed according to their expected schema.
-* This indicates an internal system error or data corruption.
-*/
-const ResourceOutputsParseError = defineError({
-	code: "RESOURCE_OUTPUTS_PARSE_ERROR",
-	context: z$1.object({
-		resourceName: z$1.string(),
-		resourceType: z$1.string(),
-		validationErrors: z$1.string()
-	}),
-	message: ({ resourceName, resourceType, validationErrors }) => `Failed to parse outputs for resource '${resourceName}' of type '${resourceType}':\n${validationErrors}`,
-	retryable: false,
-	internal: true,
-	httpStatusCode: 500
-});
-/**
-* Error thrown when there's a resource type mismatch during stack operations.
-* This matches the Rust alien-core error: UNEXPECTED_RESOURCE_TYPE
-*/
-const UnexpectedResourceTypeError = defineError({
-	code: "UNEXPECTED_RESOURCE_TYPE",
-	context: z$1.object({
-		resourceId: z$1.string(),
-		expected: z$1.string(),
-		actual: z$1.string()
-	}),
-	message: ({ resourceId, expected, actual }) => `Unexpected resource type for resource '${resourceId}': expected ${expected}, but got ${actual}`,
-	retryable: false,
-	internal: false,
-	httpStatusCode: 400
-});
-/**
-* Error thrown when a binding's projected configuration is invalid.
-*/
-const InvalidBindingConfigError = defineError({
-	code: "INVALID_BINDING_CONFIG",
-	context: z$1.object({
-		message: z$1.string(),
-		suggestion: z$1.string().optional()
-	}),
-	message: ({ message, suggestion }) => suggestion ? `${message}. ${suggestion}` : message,
-	retryable: false,
-	internal: false,
-	httpStatusCode: 400
-});
-/**
-* Error thrown when a binding is not found.
-*/
-const BindingNotFoundError = defineError({
-	code: "BINDING_NOT_FOUND",
-	context: z$1.object({
-		bindingName: z$1.string(),
-		bindingType: z$1.string()
-	}),
-	message: ({ bindingName, bindingType }) => `${bindingType} binding '${bindingName}' not found`,
-	retryable: false,
-	internal: false,
-	httpStatusCode: 404
-});
-//#endregion
-//#region src/get-resource-outputs.ts
-const ResourceSchemaMapping = {
-	function: {
-		input: WorkerSchema,
-		output: WorkerOutputsSchema
-	},
-	container: {
-		input: ContainerSchema,
-		output: ContainerOutputsSchema
-	},
-	storage: {
-		input: StorageSchema,
-		output: StorageOutputsSchema
-	},
-	kv: {
-		input: KvSchema,
-		output: KvOutputsSchema
-	},
-	queue: {
-		input: QueueSchema,
-		output: QueueOutputsSchema
-	},
-	vault: {
-		input: VaultSchema,
-		output: VaultOutputsSchema
-	},
-	build: {
-		input: BuildSchema,
-		output: BuildOutputsSchema
-	},
-	"artifact-registry": {
-		input: ArtifactRegistrySchema,
-		output: ArtifactRegistryOutputsSchema
-	},
-	"service-account": {
-		input: ServiceAccountSchema,
-		output: ServiceAccountOutputsSchema
-	},
-	"remote-stack-management": {
-		input: RemoteStackManagementSchema,
-		output: RemoteStackManagementOutputsSchema
+	/**
+	* Builds and validates the worker configuration.
+	* @returns An immutable Resource representing the configured worker.
+	* @throws Error if the worker configuration is invalid (e.g., missing code).
+	*/
+	build() {
+		const config = WorkerSchema.parse(this._config);
+		return this.resource({
+			type: "worker",
+			...config
+		});
 	}
 };
-function getResourceOutputs(params) {
-	const { state, resource } = params;
-	const resourceState = state.resources[resource.name];
-	if (!resourceState) throw new AlienError(ResourceNotFoundError.create({
-		resourceId: resource.name,
-		availableResources: Object.keys(state.resources)
-	}));
-	const outputs = ResourceSchemaMapping[resource.type].output.safeParse(resourceState.outputs);
-	if (!outputs.success) throw new AlienError(ResourceOutputsParseError.create({
-		resourceName: resource.name,
-		resourceType: resource.type,
-		validationErrors: z$1.prettifyError(outputs.error)
-	}));
-	return outputs.data;
-}
 //#endregion
 //#region src/experimental/aws-opensearch.ts
 /**