@alienplatform/core 3.3.11 → 3.3.13

package/dist/index.js

@@ -85,6 +85,112 @@ const AgentStatusSchema = z$2.object({
 	}
 }).describe("Status of a single agent in the dev server");
 //#endregion
+//#region src/generated/zod/ai-access-test-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+const AiAccessTestSchema = z$2.enum([
+	"verified",
+	"failed",
+	"not-checked"
+]);
+//#endregion
+//#region src/generated/zod/ai-availability-blocker-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+const AiAvailabilityBlockerSchema = z$2.enum([
+	"agreement-required",
+	"entitlement-required",
+	"model-activation-required",
+	"deployment-required",
+	"quota-configuration-required",
+	"region-unavailable",
+	"access-denied",
+	"observation-failed"
+]);
+//#endregion
+//#region src/generated/zod/ai-availability-source-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms.
+*/
+const AiAvailabilitySourceSchema = z$2.enum([
+	"aws-bedrock",
+	"gcp-vertex",
+	"azure-foundry",
+	"anthropic"
+]).describe("Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms.");
+//#endregion
+//#region src/generated/zod/ai-model-availability-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+const AiModelAvailabilitySchema = z$2.enum([
+	"available",
+	"blocked",
+	"unknown"
+]);
+//#endregion
+//#region src/generated/zod/client-api-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description A public API accepted from an application client.
+*/
+const ClientApiSchema = z$2.enum([
+	"open-ai-chat-completions",
+	"open-ai-responses",
+	"anthropic-messages"
+]).describe("A public API accepted from an application client.");
+//#endregion
+//#region src/generated/zod/ai-model-availability-observation-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+const AiModelAvailabilityObservationSchema = z$2.object({
+	get "accessTest"() {
+		return AiAccessTestSchema;
+	},
+	get "availability"() {
+		return AiModelAvailabilitySchema;
+	},
+	get "blockers"() {
+		return z$2.array(AiAvailabilityBlockerSchema);
+	},
+	get "clientApis"() {
+		return z$2.array(ClientApiSchema.describe("A public API accepted from an application client."));
+	},
+	"errorCode": z$2.string().nullish(),
+	"publicModelId": z$2.string(),
+	"testedAt": z$2.iso.datetime().nullish()
+});
+//#endregion
+//#region src/generated/zod/ai-availability-observation-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+const AiAvailabilityObservationSchema = z$2.object({
+	"catalogRevision": z$2.string(),
+	"location": z$2.string().nullish(),
+	get "models"() {
+		return z$2.array(AiModelAvailabilityObservationSchema);
+	},
+	get "source"() {
+		return AiAvailabilitySourceSchema.describe("Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms.");
+	}
+});
+//#endregion
 //#region src/generated/zod/heartbeat-collection-issue-reason-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -181,6 +287,9 @@ const AiHeartbeatStatusSchema = z$2.object({
 * Do not edit manually.
 */
 const AwsBedrockAiHeartbeatDataSchema = z$2.object({
+	get "availability"() {
+		return AiAvailabilityObservationSchema;
+	},
 	"region": z$2.string(),
 	get "status"() {
 		return AiHeartbeatStatusSchema;
@@ -194,6 +303,9 @@ const AwsBedrockAiHeartbeatDataSchema = z$2.object({
 */
 const AzureFoundryAiHeartbeatDataSchema = z$2.object({
 	"accountName": z$2.string(),
+	get "availability"() {
+		return AiAvailabilityObservationSchema;
+	},
 	"endpoint": z$2.string().nullish(),
 	"location": z$2.string().nullish(),
 	"resourceGroup": z$2.string().nullish(),
@@ -208,6 +320,9 @@ const AzureFoundryAiHeartbeatDataSchema = z$2.object({
 * Do not edit manually.
 */
 const ExternalAiHeartbeatDataSchema = z$2.object({
+	get "availability"() {
+		return z$2.union([AiAvailabilityObservationSchema, z$2.null()]).optional();
+	},
 	"provider": z$2.string().describe("The BYO-key provider serving this binding (e.g. \"openai\"). Used on the Local\nplatform, where the app brings its own provider key instead of an ambient cloud."),
 	get "status"() {
 		return AiHeartbeatStatusSchema;
@@ -220,6 +335,9 @@ const ExternalAiHeartbeatDataSchema = z$2.object({
 * Do not edit manually.
 */
 const GcpVertexAiHeartbeatDataSchema = z$2.object({
+	get "availability"() {
+		return AiAvailabilityObservationSchema;
+	},
 	"location": z$2.string(),
 	"project": z$2.string(),
 	get "status"() {
@@ -1410,6 +1528,38 @@ const AwsIamRoleServiceAccountHeartbeatDataSchema = z$2.object({
 	},
 	"tagCount": z$2.int().min(0)
 });
+z$2.object({ "keyArn": z$2.string().describe("Immutable KMS key ARN. Alias ARNs are not accepted.") }).describe("AWS KMS key created by the customer-installed setup stack.");
+//#endregion
+//#region src/generated/zod/key-heartbeat-status-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+const KeyHeartbeatStatusSchema = z$2.object({
+	get "health"() {
+		return ObservedHealthSchema;
+	},
+	get "lifecycle"() {
+		return ProviderLifecycleStateSchema;
+	},
+	"message": z$2.string().nullish()
+});
+//#endregion
+//#region src/generated/zod/aws-kms-key-heartbeat-data-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+const AwsKmsKeyHeartbeatDataSchema = z$2.object({
+	"enabled": z$2.boolean(),
+	"keyArn": z$2.string(),
+	"keySpec": z$2.string(),
+	"keyState": z$2.string(),
+	"keyUsage": z$2.string(),
+	get "status"() {
+		return KeyHeartbeatStatusSchema;
+	}
+});
 //#endregion
 //#region src/generated/zod/aws-kv-import-data-schema.ts
 /**
@@ -2243,6 +2393,12 @@ z$2.object({
 	"serverResourceId": z$2.string().describe("Full ARM resource id of the Flexible Server (the deletable handle)."),
 	"version": z$2.string().describe("Engine version the server reports.")
 }).describe("Azure Postgres (Flexible Server + Private Endpoint) registration data: the handles by\nwhich a setup-created Flexible Server (with its Private Endpoint, private DNS zone, and\nthe Key Vault secret holding the master password) is registered as a Frozen Postgres\nresource. Setup owns the server, Alien refreshes and heartbeats it. The raw password is\nnever carried, only the Key Vault secret URI.");
+z$2.object({
+	"keyId": z$2.string().describe("Full versioned Key Vault key ID used for new wrapping operations."),
+	"keyName": z$2.string().describe("Key name within the vault."),
+	"lineageVersionId": z$2.string().describe("Version ID that identifies the original key lineage."),
+	"vaultResourceId": z$2.string().describe("ARM resource ID of the dedicated Key Vault.")
+}).describe("Azure Key Vault key created by the customer-installed setup stack.");
 //#endregion
 //#region src/generated/zod/azure-key-vault-heartbeat-data-schema.ts
 /**
@@ -2271,6 +2427,22 @@ const AzureKeyVaultHeartbeatDataSchema = z$2.object({
 	"vaultUri": z$2.string().nullish()
 });
 //#endregion
+//#region src/generated/zod/azure-key-vault-key-heartbeat-data-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+const AzureKeyVaultKeyHeartbeatDataSchema = z$2.object({
+	"enabled": z$2.boolean().nullish(),
+	"keyId": z$2.string(),
+	"keyOperations": z$2.array(z$2.string()),
+	"keyType": z$2.string(),
+	"recoveryLevel": z$2.string().nullish(),
+	get "status"() {
+		return KeyHeartbeatStatusSchema;
+	}
+});
+//#endregion
 //#region src/generated/zod/azure-kv-import-data-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -4563,7 +4735,7 @@ z$2.object({
 * Do not edit manually.
 */
 /**
-* @description Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change.\n\nAlien activates the provisioned receipt rule set as part of setup. Because\nSES permits only one active receipt rule set per AWS account and region, an\nAWS stack may contain only one email resource with inbound delivery, and\ninstalling it makes its rule set the account\'s active rule set. SES email\nreceiving is available only in a subset of AWS regions; deploying `inbound`\nto an unsupported region fails during setup.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.
+* @description Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change.\n\nAlien activates the provisioned receipt rule set as part of setup. Because\nSES permits only one active receipt rule set per AWS account and region, an\nAWS stack may contain only one email resource with inbound delivery. The\nresource requires exclusive ownership of SES receiving in its account and\nregion: setup refuses to replace an active rule set it does not own. Choose\nan unused region when the account already receives email through SES. SES email\nreceiving is available only in a subset of AWS regions; deploying `inbound`\nto an unsupported region fails during setup.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.
 */
 const EmailSchema = z$2.object({
 	"domains": z$2.optional(z$2.array(z$2.string()).describe("Seed mail domains provisioned at deploy time (one SES identity each).\nUseful for day-0 bootstrap and products with a static domain set.\nMay be empty (the default): products that create and verify domains\ndynamically should manage identities at runtime through the\n`email/manage-identities` grant instead of listing them here.")),
@@ -4574,7 +4746,7 @@ const EmailSchema = z$2.object({
 	get "inbound"() {
 		return z$2.union([EmailInboundSchema, z$2.null()]).optional();
 	}
-}).describe("Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change.\n\nAlien activates the provisioned receipt rule set as part of setup. Because\nSES permits only one active receipt rule set per AWS account and region, an\nAWS stack may contain only one email resource with inbound delivery, and\ninstalling it makes its rule set the account's active rule set. SES email\nreceiving is available only in a subset of AWS regions; deploying `inbound`\nto an unsupported region fails during setup.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.");
+}).describe("Email infrastructure for sending and receiving mail on customer-owned\ndomains. On AWS this is backed by SES: a shared configuration set, optional\ninbound/event wiring, and one email identity (Easy DKIM) per seed domain.\n\n# Infrastructure vs runtime data\n\nThis resource owns the email *infrastructure* and the capability to use it,\nnot the domain lifecycle. Deployment manages the configuration set, the\nevent topology, the inbound receipt topology, and any seed identities\nlisted in `domains`. Email identities created at runtime through the\n`email/manage-identities` grant are application data: they are not tracked\nby the deployment, are not removed when the stack is deleted, and their\nlifecycle — including deletion — belongs to the application.\n\nThe operator (or the application, for runtime-created identities) owns DNS:\nthe per-domain DKIM CNAME records surfaced in [`EmailOutputs`] must be\ncreated before SES verifies a domain and allows sending from it.\n\n# Inbound mail (AWS)\n\nWhen `inbound` is set, a SES receipt rule set is provisioned that writes\nraw incoming mail into the linked Storage bucket. The receipt rule is a\ncatch-all (no recipient filter), so mail for identities verified at runtime\nlands in the bucket without any infrastructure change.\n\nAlien activates the provisioned receipt rule set as part of setup. Because\nSES permits only one active receipt rule set per AWS account and region, an\nAWS stack may contain only one email resource with inbound delivery. The\nresource requires exclusive ownership of SES receiving in its account and\nregion: setup refuses to replace an active rule set it does not own. Choose\nan unused region when the account already receives email through SES. SES email\nreceiving is available only in a subset of AWS regions; deploying `inbound`\nto an unsupported region fails during setup.\n\n# Update semantics\n\n`domains` is append-friendly: adding a domain provisions a new identity,\nremoving a domain deletes its identity (and its DKIM verification state).\nThe list may be empty. `inbound` and `events` may be added, removed, or\nrepointed; removing them tears down the corresponding receipt rule set /\nevent destination wiring.");
 //#endregion
 //#region src/generated/zod/response-handling-schema.ts
 /**
@@ -4725,6 +4897,22 @@ const GcpBuildImportDataSchema = z$2.object({
 	"triggerName": z$2.string().describe("Cloud Build trigger name.")
 }).describe("GCP Build ImportData — Cloud Build trigger + worker pool reference.");
 //#endregion
+//#region src/generated/zod/gcp-cloud-kms-key-heartbeat-data-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+const GcpCloudKmsKeyHeartbeatDataSchema = z$2.object({
+	"algorithm": z$2.string().nullish(),
+	"cryptoKeyName": z$2.string(),
+	"primaryState": z$2.string().nullish(),
+	"primaryVersion": z$2.string().nullish(),
+	"purpose": z$2.string(),
+	get "status"() {
+		return KeyHeartbeatStatusSchema;
+	}
+});
+//#endregion
 //#region src/generated/zod/gcp-cloud-run-worker-heartbeat-data-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -4834,6 +5022,10 @@ const GcpFirestoreKvHeartbeatDataSchema = z$2.object({
 	"updateTime": z$2.string().nullish(),
 	"versionRetentionPeriod": z$2.string().nullish()
 });
+z$2.object({
+	"cryptoKeyName": z$2.string().describe("Full CryptoKey resource name, without a CryptoKeyVersion."),
+	"primaryVersion": z$2.string().describe("Full primary CryptoKeyVersion resource name used for new wrapping operations.")
+}).describe("GCP Cloud KMS key created by the customer-installed setup stack.");
 //#endregion
 //#region src/generated/zod/gcp-kv-import-data-schema.ts
 /**
@@ -5233,6 +5425,73 @@ const ImportedResourceSchema = z$2.object({
 	}
 }).describe("One resolved resource import payload.");
 //#endregion
+//#region src/generated/zod/key-fingerprint-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description Stable identity of a provider key family.\n\nProvider-native version rotation does not change this value. Replacing the\nprovider key does.
+*/
+const KeyFingerprintSchema = z$2.union([
+	z$2.object({
+		"key_arn": z$2.string(),
+		"provider": z$2.enum(["aws"])
+	}),
+	z$2.object({
+		"crypto_key_name": z$2.string(),
+		"provider": z$2.enum(["gcp"])
+	}),
+	z$2.object({
+		"key_name": z$2.string(),
+		"lineage_version_id": z$2.string(),
+		"provider": z$2.enum(["azure"]),
+		"vault_resource_id": z$2.string()
+	})
+]).describe("Stable identity of a provider key family.\n\nProvider-native version rotation does not change this value. Replacing the\nprovider key does.");
+//#endregion
+//#region src/generated/zod/key-heartbeat-data-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+const KeyHeartbeatDataSchema = z$2.union([
+	z$2.object({
+		get "data"() {
+			return AwsKmsKeyHeartbeatDataSchema;
+		},
+		"provider": z$2.enum(["aws-kms"])
+	}),
+	z$2.object({
+		get "data"() {
+			return GcpCloudKmsKeyHeartbeatDataSchema;
+		},
+		"provider": z$2.enum(["gcp-cloud-kms"])
+	}),
+	z$2.object({
+		get "data"() {
+			return AzureKeyVaultKeyHeartbeatDataSchema;
+		},
+		"provider": z$2.enum(["azure-key-vault"])
+	})
+]);
+z$2.object({
+	get "fingerprint"() {
+		return KeyFingerprintSchema.describe("Stable identity of a provider key family.\n\nProvider-native version rotation does not change this value. Replacing the\nprovider key does.");
+	},
+	"wrappingKeyId": z$2.string().describe("Exact provider key version used for new wrapping operations.")
+}).describe("Outputs generated by a successfully provisioned Key.");
+//#endregion
+//#region src/generated/zod/key-schema.ts
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+* @description A customer-managed encryption key.
+*/
+const KeySchema = z$2.object({ "id": z$2.string().describe("Identifier for the key resource.") }).describe("A customer-managed encryption key.");
+//#endregion
 //#region src/generated/zod/kubernetes-certificate-mode-schema.ts
 /**
 * Generated by Kubb (https://kubb.dev/).
@@ -5242,7 +5501,7 @@ const ImportedResourceSchema = z$2.object({
 * @description Certificate publication or reference mode for Kubernetes public endpoints.
 */
 const KubernetesCertificateModeSchema = z$2.union([
-	z$2.lazy(() => KubernetesTlsSecretRefSchema).and(z$2.object({ "mode": z$2.enum(["tlsSecretRef"]) })),
+	z$2.lazy(() => KubernetesTlsSecretRefSchema).and(z$2.object({ "mode": z$2.enum(["tlsSecretRef"]) })).describe("Namespace-scoped Kubernetes TLS Secret reference."),
 	z$2.object({
 		"mode": z$2.enum(["managedAcmImport"]),
 		"region": z$2.string().describe("ACM region. Defaults to the deployment region when omitted.").nullish(),
@@ -5483,7 +5742,7 @@ const KubernetesIngressRouteProfileSchema = z$2.object({
 /**
 * @description Kubernetes route API selected for public endpoints.
 */
-const KubernetesRouteProfileSchema = z$2.union([z$2.lazy(() => KubernetesIngressRouteProfileSchema).and(z$2.object({ "routeApi": z$2.enum(["ingress"]) })), z$2.lazy(() => KubernetesGatewayRouteProfileSchema).and(z$2.object({ "routeApi": z$2.enum(["gateway"]) }))]).describe("Kubernetes route API selected for public endpoints.");
+const KubernetesRouteProfileSchema = z$2.union([z$2.lazy(() => KubernetesIngressRouteProfileSchema).and(z$2.object({ "routeApi": z$2.enum(["ingress"]) })).describe("Shared Ingress route profile values."), z$2.lazy(() => KubernetesGatewayRouteProfileSchema).and(z$2.object({ "routeApi": z$2.enum(["gateway"]) })).describe("Shared Gateway API route profile values.")]).describe("Kubernetes route API selected for public endpoints.");
 //#endregion
 //#region src/generated/zod/kubernetes-exposure-settings-schema.ts
 /**
@@ -5807,9 +6066,9 @@ const LocalWorkerHeartbeatDataSchema = z$2.object({
 * @description Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it\'s derived from the Manager\'s ServiceAccount.
 */
 const ManagementConfigSchema = z$2.union([
-	z$2.lazy(() => AwsManagementConfigSchema).and(z$2.object({ "platform": z$2.enum(["aws"]) })),
-	z$2.lazy(() => GcpManagementConfigSchema).and(z$2.object({ "platform": z$2.enum(["gcp"]) })),
-	z$2.lazy(() => AzureManagementConfigSchema).and(z$2.object({ "platform": z$2.enum(["azure"]) })),
+	z$2.lazy(() => AwsManagementConfigSchema).and(z$2.object({ "platform": z$2.enum(["aws"]) })).describe("AWS management configuration extracted from stack settings"),
+	z$2.lazy(() => GcpManagementConfigSchema).and(z$2.object({ "platform": z$2.enum(["gcp"]) })).describe("GCP management configuration extracted from stack settings"),
+	z$2.lazy(() => AzureManagementConfigSchema).and(z$2.object({ "platform": z$2.enum(["azure"]) })).describe("Azure management configuration extracted from stack settings"),
 	z$2.object({ "platform": z$2.enum(["kubernetes"]) })
 ]).describe("Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount.");
 //#endregion
@@ -6064,10 +6323,10 @@ const PostgresBackendSchema = z$2.object({ "type": z$2.enum(["auroraServerlessV2
 * Do not edit manually.
 */
 const PostgresHeartbeatDataSchema = z$2.union([
-	z$2.lazy(() => AuroraPostgresHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["aurora"]) })),
-	z$2.lazy(() => GcpCloudSqlPostgresHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["cloudSql"]) })),
-	z$2.lazy(() => AzureFlexibleServerPostgresHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["flexibleServer"]) })),
-	z$2.lazy(() => LocalPostgresHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["local"]) }))
+	z$2.lazy(() => AuroraPostgresHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["aurora"]) })).describe("AWS Aurora Serverless v2 backend."),
+	z$2.lazy(() => GcpCloudSqlPostgresHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["cloudSql"]) })).describe("GCP Cloud SQL backend."),
+	z$2.lazy(() => AzureFlexibleServerPostgresHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["flexibleServer"]) })).describe("Azure Flexible Server backend."),
+	z$2.lazy(() => LocalPostgresHeartbeatDataSchema).and(z$2.object({ "backend": z$2.enum(["local"]) })).describe("Local embedded Postgres backend.")
 ]);
 z$2.object({
 	"database": z$2.string().describe("The default database created for this resource. On cloud backends this is the fixed\nlabel `POSTGRES_DATABASE_NAME` (`alien`); on Local it is the resource id."),
@@ -6437,6 +6696,12 @@ const ResourceHeartbeatDataSchema = z$2.union([
 			return AiHeartbeatDataSchema;
 		},
 		"resourceType": z$2.enum(["ai"])
+	}),
+	z$2.object({
+		get "data"() {
+			return KeyHeartbeatDataSchema;
+		},
+		"resourceType": z$2.enum(["key"])
 	})
 ]);
 //#endregion
@@ -6853,6 +7118,9 @@ const StorageOutputsSchema = z$2.object({ "bucketName": z$2.string().describe("T
 */
 const StorageSchema = z$2.object({
 	"corsAllowedOrigins": z$2.optional(z$2.array(z$2.string()).describe("Browser origins allowed to read objects through signed URLs.\n\nWhen non-empty, providers configure CORS for `GET` and `HEAD` requests.\nAn origin of `*` is appropriate for private buckets whose signed URLs\nare bearer credentials and do not use browser cookies.\nDefault: `[]` (CORS disabled).")),
+	get "encryptionKey"() {
+		return z$2.union([ResourceRefSchema, z$2.null()]).optional();
+	},
 	"id": z$2.string().describe("Name of the the storage bucket.\nFor names with dots, each dot-separated label must be ≤ 63 characters."),
 	get "lifecycleRules"() {
 		return z$2.array(LifecycleRuleSchema.describe("Defines a rule for managing the lifecycle of objects within a storage bucket.")).describe("List of rules for automatic object management (e.g., expiration).\nDefault: `[]` (empty list)").optional();
@@ -6869,7 +7137,7 @@ const StorageSchema = z$2.object({
 /**
 * @description Request to submit a command response (from deployment)
 */
-const SubmitResponseRequestSchema = z$2.lazy(() => CommandResponseSchema).describe("Request to submit a command response (from deployment)");
+const SubmitResponseRequestSchema = z$2.lazy(() => CommandResponseSchema).describe("Command response from deployment").describe("Request to submit a command response (from deployment)");
 //#endregion
 //#region src/generated/zod/upload-complete-request-schema.ts
 /**
@@ -7082,186 +7350,140 @@ var ResourceBuilder = class {
 	}
 };
 //#endregion
-//#region src/storage.ts
+//#region src/ai.ts
 /**
-* Represents an object storage bucket.
+* Represents an AI Gateway resource that provides a unified interface to
+* managed AI inference services across cloud providers.
 */
-var Storage = class extends ResourceBuilder {
-	_config = {
-		publicRead: false,
-		versioning: false,
-		lifecycleRules: [],
-		corsAllowedOrigins: []
-	};
+var AI = class extends ResourceBuilder {
+	_config = {};
 	/**
-	* Creates a new Storage builder.
-	* @param id ID of the storage bucket. For names with dots, each dot-separated label must be ≤ 63 characters.
+	* Creates a new AI builder.
+	* @param id Identifier for the AI resource. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
 	*/
 	constructor(id) {
 		super();
 		this._config.id = id;
 	}
 	/**
-	* Returns a ResourceType representing any storage resource.
-	* Used for creating permission targets that apply to all storage resources.
-	* @returns The "storage" resource type.
+	* Returns a ResourceType representing any AI resource.
+	* Used for creating permission targets that apply to all AI resources.
+	* @returns The "ai" resource type.
 	*/
 	static any() {
-		return "storage";
+		return "ai";
 	}
 	/**
-	* Allows public read access to objects without authentication.
-	* Default: `false`.
-	* @param value Whether to allow public read access.
-	* @returns The Storage builder instance.
+	* Builds and validates the AI configuration.
+	* @returns An immutable Resource representing the configured AI Gateway.
+	* @throws Error if the AI configuration is invalid.
 	*/
-	publicRead(value) {
-		this._config.publicRead = value;
-		return this;
+	build() {
+		const config = AiSchema.parse(this._config);
+		return this.resource({
+			type: "ai",
+			...config
+		});
 	}
+};
+//#endregion
+//#region src/artifact-registry.ts
+/**
+* Represents an artifact registry for storing container images and other build artifacts.
+* This is a high-level wrapper resource that provides a cloud-agnostic interface over
+* AWS ECR, GCP Artifact Registry, and Azure Container Registry.
+*/
+var ArtifactRegistry = class {
+	_config = {};
 	/**
-	* Enables object versioning.
-	* Default: `false`.
-	* @param value Whether to enable versioning.
-	* @returns The Storage builder instance.
+	* Creates a new ArtifactRegistry builder.
+	* @param id Identifier for the artifact registry. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
 	*/
-	versioning(value) {
-		this._config.versioning = value;
-		return this;
+	constructor(id) {
+		this._config.id = id;
 	}
 	/**
-	* Defines lifecycle rules for automatic object management (e.g., expiration).
-	* @param rules An array of lifecycle rules.
-	* @returns The Storage builder instance.
+	* Returns a ResourceType representing any artifact registry resource.
+	* Used for creating permission targets that apply to all artifact registry resources.
+	* @returns The "artifact-registry" resource type.
 	*/
-	lifecycleRules(rules) {
-		this._config.lifecycleRules = rules;
-		return this;
+	static any() {
+		return "artifact-registry";
 	}
 	/**
-	* Allows browser reads from the listed origins through signed URLs.
-	* Providers enable `GET` and `HEAD`; use `*` only when the signed URL itself
-	* is the credential and browser cookies are not involved.
-	* @param origins Allowed browser origins.
-	* @returns The Storage builder instance.
+	* AWS-only: Configure ECR private image replication to additional regions.
+	* Ensures images pushed in the registry's home region are automatically
+	* available in these destination regions (required when Lambda or other
+	* compute runs in a different region).
+	* @param regions - AWS region codes to replicate to (e.g., ["us-east-2", "eu-west-1"])
 	*/
-	corsAllowedOrigins(origins) {
-		this._config.corsAllowedOrigins = origins;
+	replicationRegions(regions) {
+		this._config.replicationRegions = regions;
 		return this;
 	}
 	/**
-	* Builds and validates the storage configuration.
-	* @returns An immutable Resource representing the configured storage bucket.
-	* @throws Error if the storage configuration is invalid.
+	* Builds and validates the artifact registry configuration.
+	* @returns An immutable Resource representing the configured artifact registry.
+	* @throws Error if the artifact registry configuration is invalid.
 	*/
 	build() {
-		const config = StorageSchema.parse(this._config);
-		return this.resource({
-			type: "storage",
-			...config
+		return new Resource({
+			type: "artifact-registry",
+			...ArtifactRegistrySchema.parse(this._config)
 		});
 	}
 };
 //#endregion
-//#region src/worker.ts
+//#region src/build.ts
 /**
-* Represents a serverless worker that executes code in response to triggers or direct invocations.
-* Workers are the primary compute resource in serverless applications, designed to be stateless and ephemeral.
+* Represents a build resource that executes bash scripts to build code.
+* Builds are designed to be stateless and can be triggered on-demand to compile,
+* test, or package application code.
 */
-var Worker = class extends ResourceBuilder {
+var Build = class {
 	_config = {
 		links: [],
-		triggers: [],
-		publicEndpoints: [],
 		environment: {}
 	};
 	/**
-	* Creates a new Worker builder.
-	* @param id Identifier for the worker. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+	* Creates a new Build builder.
+	* @param id Identifier for the build resource. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
 	*/
 	constructor(id) {
-		super();
 		this._config.id = id;
 	}
 	/**
-	* Returns a ResourceType representing any worker resource.
-	* Used for creating permission targets that apply to all worker resources.
-	* @returns The "worker" resource type.
+	* Returns a ResourceType representing any build resource.
+	* Used for creating permission targets that apply to all build resources.
+	* @returns The "build" resource type.
 	*/
 	static any() {
-		return "worker";
-	}
-	/**
-	* Sets the code for the worker, either a pre-built image or source code to be built.
-	* @param code The worker code configuration.
-	* @returns The Worker builder instance.
-	*/
-	code(code) {
-		this._config.code = code;
-		return this;
-	}
-	/**
-	* Sets the memory allocated to the worker in megabytes (MB).
-	* Constraints: 128‑32768 MB (platform-specific limits may apply).
-	* Default: 512 MB.
-	* @param mb The memory in MB.
-	* @returns The Worker builder instance.
-	*/
-	memoryMb(mb) {
-		this._config.memoryMb = mb;
-		return this;
-	}
-	/**
-	* Sets the maximum execution time for the worker in seconds.
-	* Constraints: 1‑3600 seconds (platform-specific limits may apply).
-	* Default: 30 seconds.
-	* @param sec The timeout in seconds.
-	* @returns The Worker builder instance.
-	*/
-	timeoutSeconds(sec) {
-		this._config.timeoutSeconds = sec;
-		return this;
-	}
-	/**
-	* Sets the maximum number of concurrent executions allowed for the worker.
-	* `null` means platform default applies.
-	* @param limit The concurrency limit, or `null` for platform default.
-	* @returns The Worker builder instance.
-	*/
-	concurrencyLimit(limit) {
-		this._config.concurrencyLimit = limit;
-		return this;
+		return "build";
 	}
 	/**
-	* Exposes a named public HTTP endpoint for the worker.
-	*
-	* If no public endpoint is declared, the worker is private and only reachable
-	* through triggers, commands, or provider invocation APIs.
+	* Sets the compute type for the build.
+	* @param type The compute type (small, medium, large, x-large).
+	* @returns The Build builder instance.
 	*/
-	publicEndpoint(name, options = {}) {
-		if (!this._config.publicEndpoints) this._config.publicEndpoints = [];
-		this._config.publicEndpoints.push({
-			name,
-			hostLabel: options.hostLabel,
-			wildcardSubdomains: options.wildcardSubdomains ?? false
-		});
+	computeType(type) {
+		this._config.computeType = type;
 		return this;
 	}
 	/**
-	* Sets key-value pairs as environment variables for the worker.
+	* Sets key-value pairs as environment variables for the build.
 	* @param env A map of environment variable names to their values.
-	* @returns The Worker builder instance.
+	* @returns The Build builder instance.
 	*/
 	environment(env) {
 		this._config.environment = env;
 		return this;
 	}
 	/**
-	* Links another resource (e.g., Storage, KV, Queue) to this worker.
-	* This makes the linked resource accessible to the worker, often by injecting
+	* Links another resource (e.g., Storage, ArtifactRegistry, Role) to this build.
+	* This makes the linked resource accessible to the build, often by injecting
 	* environment variables or granting permissions.
 	* @param resource The resource to link.
-	* @returns The Worker builder instance.
+	* @returns The Build builder instance.
 	*/
 	link(resource) {
 		if (!this._config.links) this._config.links = [];
@@ -7269,441 +7491,630 @@ var Worker = class extends ResourceBuilder {
 		return this;
 	}
 	/**
-	* Assigns a permission profile to this worker.
-	* The profile defines the permissions granted to this worker when interacting
+	* Assigns a permission profile to this build.
+	* The profile defines the permissions granted to this build when interacting
 	* with other cloud resources.
 	* @param permissions The permission profile name.
-	* @returns The Worker builder instance.
+	* @returns The Build builder instance.
 	*/
 	permissions(permissions) {
 		this._config.permissions = permissions;
 		return this;
 	}
 	/**
-	* Configures a readiness probe for the worker.
-	* The probe will be executed after provisioning/update to verify the worker is ready.
-	* Only works with workers that declare a public endpoint.
-	*
-	* @example
-	* ```typescript
-	* const probe: ReadinessProbe = {
-	*   method: "GET",
-	*   path: "/health"
-	* };
-	*
-	* const func = new Worker("my-api")
-	*   .code({ type: "image", image: "my-api:latest" })
-	*   .publicEndpoint("api")
-	*   .readinessProbe(probe)
-	*   .build();
-	* ```
-	*
-	* @param probe The readiness probe configuration.
-	* @returns The Worker builder instance.
-	*/
-	readinessProbe(probe) {
-		this._config.readinessProbe = probe;
-		return this;
-	}
-	/**
-	* Enables or disables the Commands protocol for the worker.
-	* When enabled, the platform pushes commands into the Worker runtime, which executes registered handlers.
-	* Default: false.
-	* @param enabled Whether to enable commands for this worker.
-	* @returns The Worker builder instance.
-	*/
-	commandsEnabled(enabled) {
-		this._config.commandsEnabled = enabled;
-		return this;
-	}
-	/**
-	* Adds a trigger to the worker. Workers can have multiple triggers.
-	* Each trigger will independently invoke the worker when its conditions are met.
-	*
-	* @example
-	* ```typescript
-	* // Queue trigger
-	* const queueTrigger: WorkerTrigger = {
-	*   type: "queue",
-	*   queue: myQueue.ref()
-	* };
-	*
-	* // Schedule trigger
-	* const scheduleTrigg: WorkerTrigger = {
-	*   type: "schedule",
-	*   cron: "0 * * * *"
-	* };
-	*
-	* const func = new Worker("my-func")
-	*   .code({ type: "image", image: "my-image:latest" })
-	*   .trigger(queueTrigger)
-	*   .trigger(scheduleTrigger)
-	*   .build();
-	* ```
-	*
-	* @param trigger The trigger configuration.
-	* @returns The Worker builder instance.
-	*/
-	trigger(trigger) {
-		if (!this._config.triggers) this._config.triggers = [];
-		this._config.triggers.push(trigger);
-		return this;
-	}
-	/**
-	* Builds and validates the worker configuration.
-	* @returns An immutable Resource representing the configured worker.
-	* @throws Error if the worker configuration is invalid (e.g., missing code).
+	* Builds and validates the build configuration.
+	* @returns An immutable Resource representing the configured build.
+	* @throws Error if the build configuration is invalid.
 	*/
 	build() {
-		const config = WorkerSchema.parse(this._config);
-		return this.resource({
-			type: "worker",
-			...config
+		return new Resource({
+			type: "build",
+			...BuildSchema.parse(this._config)
 		});
 	}
 };
 //#endregion
-//#region src/container.ts
+//#region src/error.ts
 /**
-* Represents a long-running container workload.
+* This module provides a structured error handling system similar to Rust's error types,
+* with TypeScript type safety, error chaining, and context preservation.
 *
-* Containers run on compute instances (EC2, GCE, Azure VMs) and are orchestrated
-* by the managed container backend. They're designed for always-on workloads
-* like web services, APIs, databases, and background workers.
+* @example Basic Usage
+* ```typescript
+* import { AlienError, defineError } from '@alienplatform/core'
+* import { z } from 'zod'
+*
+* // Define a type-safe error
+* const DatabaseError = defineError({
+*   code: "DATABASE_CONNECTION_FAILED",
+*   context: z.object({
+*     host: z.string(),
+*     port: z.number(),
+*     reason: z.string(),
+*   }),
+*   message: ({ host, port, reason }) => `Failed to connect to database '${host}:${port}': ${reason}`,
+*   retryable: true,
+*   internal: false,
+*   httpStatusCode: 502,
+* })
+*
+* // Use it
+* throw new AlienError(DatabaseError.create({
+*   host: "localhost",
+*   port: 5432,
+*   reason: "Connection timeout"
+* }))
+* ```
+*
+* @example Error Chaining
+* ```typescript
+* try {
+*   // Some operation that fails
+*   throw new Error("Connection refused")
+* } catch (error) {
+*   throw (await AlienError.from(error)).withContext(
+*     DatabaseError.create({
+*       host: "localhost",
+*       port: 5432,
+*       reason: "Connection refused by server"
+*     })
+*   )
+* }
+* ```
+*
+* @example External API Sanitization
+* ```typescript
+* const internalError = new AlienError(InternalApiError.create({
+*   service: "payment-processor",
+*   details: "Database password expired",
+*   traceId: "trace-12345"
+* }))
+*
+* // Safe for external APIs (sanitizes internal errors)
+* const safeResponse = internalError.toExternal()
+* ```
 */
-var Container = class extends ResourceBuilder {
-	_config = {
-		links: [],
-		ports: [],
-		publicEndpoints: [],
-		environment: {},
-		stateful: false
-	};
-	/**
-	* Creates a new Container builder.
-	* @param id Identifier for the container. Must be DNS-compatible: lowercase alphanumeric with hyphens.
-	*/
-	constructor(id) {
-		super();
-		this._config.id = id;
-	}
-	/**
-	* Returns a ResourceType representing any container resource.
-	* Used for creating permission targets that apply to all container resources.
-	* @returns The "container" resource type.
-	*/
-	static any() {
-		return "container";
-	}
-	/**
-	* Sets the container cluster this container runs on.
-	* @param clusterId The ComputeCluster resource ID.
-	* @returns The Container builder instance.
-	*/
-	cluster(clusterId) {
-		this._config.cluster = clusterId;
-		return this;
+/**
+* Helper function to create type-safe error definitions.
+*
+* This function provides a clean API for defining reusable error types
+* with full TypeScript type safety and Zod validation.
+*
+* @template TContext - Zod schema type for the error context
+* @param metadata - Error metadata including code, schema, and message generator
+* @returns Object with metadata and a create function for error instances
+*
+* @example
+* ```typescript
+* const UserNotFound = defineError({
+*   code: "USER_NOT_FOUND",
+*   context: z.object({
+*     userId: z.string(),
+*     searchMethod: z.string(),
+*   }),
+*   message: ({ userId, searchMethod }) =>
+*     `User '${userId}' not found using method '${searchMethod}'`,
+*   retryable: false,
+*   internal: false,
+*   httpStatusCode: 404,
+* })
+*
+* // Usage
+* const error = UserNotFound.create({
+*   userId: "123",
+*   searchMethod: "database_lookup"
+* })
+* ```
+*/
+function defineError(metadata) {
+	return {
+		metadata,
+		contextSchema: metadata.context,
+		create: (context) => ({
+			metadata,
+			contextSchema: metadata.context,
+			context,
+			toOptions: () => ({
+				code: metadata.code,
+				message: metadata.message(context),
+				retryable: metadata.retryable,
+				internal: metadata.internal,
+				httpStatusCode: metadata.httpStatusCode,
+				context
+			})
+		})
+	};
+}
+/**
+* Main AlienError class that provides structured error handling.
+*
+* This class extends the standard JavaScript Error with additional features:
+* - Type-safe context data
+* - Error chaining and source tracking
+* - Retryability and internal/external visibility flags
+* - HTTP status code mapping
+* - Sanitization for external APIs
+*
+* @template TContext - Zod schema type for the error context
+*
+* @example Basic Construction
+* ```typescript
+* const error = new AlienError(DatabaseError.create({
+*   host: "localhost",
+*   port: 5432,
+*   reason: "Timeout"
+* }))
+* ```
+*
+* @example Converting JavaScript Errors
+* ```typescript
+* try {
+*   JSON.parse("invalid json")
+* } catch (jsError) {
+*   const alienError = AlienError.from(jsError)
+*   console.log(alienError.code) // "GENERIC_ERROR"
+* }
+* ```
+*
+* @example Error Chaining
+* ```typescript
+* const contextualError = AlienError.from(new Error("Network timeout"))
+*   .withContext(DatabaseError.create({
+*     host: "localhost",
+*     port: 5432,
+*     reason: "Connection timeout"
+*   }))
+*
+* // Check error chain
+* console.log(contextualError.hasErrorCode("DATABASE_CONNECTION_FAILED")) // true
+* console.log(contextualError.toString()) // Shows full error chain
+* ```
+*/
+var AlienError = class AlienError extends Error {
+	/** Unique error code identifying the error type */
+	code;
+	/** Whether this error can be safely retried */
+	retryable;
+	/** Whether this error contains sensitive internal information */
+	internal;
+	/** HTTP status code for API responses */
+	httpStatusCode;
+	/** Type-safe context data specific to this error */
+	context;
+	/** Optional human-facing remediation hint */
+	hint;
+	/** Source error that caused this error (for chaining) */
+	source;
+	constructor(input) {
+		let options;
+		if ("metadata" in input && "context" in input) {
+			const { metadata, context: contextData } = input;
+			const message = metadata.message(contextData);
+			options = {
+				code: metadata.code,
+				message,
+				retryable: metadata.retryable,
+				internal: metadata.internal,
+				httpStatusCode: metadata.httpStatusCode,
+				context: contextData
+			};
+		} else options = input;
+		const message = options.message;
+		super(message, { cause: options.source });
+		this.name = "AlienError";
+		this.code = options.code;
+		this.retryable = options.retryable;
+		this.internal = options.internal;
+		this.httpStatusCode = options.httpStatusCode ?? 500;
+		this.context = options.context;
+		this.hint = options.hint;
+		this.source = void 0;
+		if (options.source && typeof options.source === "object") {
+			if ("code" in options.source && "message" in options.source && "retryable" in options.source && "internal" in options.source) this.source = new AlienError(options.source);
+		}
 	}
 	/**
-	* Sets the code for the container, either a pre-built image or source code to be built.
-	* @param code The container code configuration.
-	* @returns The Container builder instance.
+	* Create an AlienError from a type-safe error definition.
+	*
+	* @template TContext - Zod schema type for the error context
+	* @param definition - Error definition with type-safe context
+	* @returns New AlienError instance
 	*/
-	code(code) {
-		this._config.code = code;
-		return this;
+	static fromDefinition(definition) {
+		return new AlienError(definition);
 	}
 	/**
-	* Sets the CPU resources for the container.
-	*
-	* For simplified configuration, use a single number:
-	* - `.cpu(1)` sets both min and desired to 1 vCPU
-	*
-	* For advanced configuration, use ResourceSpec:
-	* - `.cpu({ min: "0.5", desired: "1" })`
+	* Create an AlienError from raw options (for compatibility).
 	*
-	* @param value CPU in vCPUs (number) or ResourceSpec with min/desired.
-	* @returns The Container builder instance.
+	* @param options - Raw error options conforming to AlienErrorOptions schema
+	* @returns New AlienError instance
 	*/
-	cpu(value) {
-		if (typeof value === "number") this._config.cpu = {
-			min: value.toString(),
-			desired: value.toString()
-		};
-		else this._config.cpu = value;
-		return this;
+	static fromOptions(options) {
+		return new AlienError(AlienErrorSchema.parse(options));
 	}
 	/**
-	* Sets the memory resources for the container.
-	*
-	* Format: "<number>Mi" or "<number>Gi"
-	*
-	* Example: "512Mi", "2Gi", "16Gi"
+	* Helper function to get a user-friendly type name for error context.
 	*
-	* @param size Memory size string.
-	* @returns The Container builder instance.
+	* @param error - Any value to get the type name for
+	* @returns User-friendly type name
 	*/
-	memory(size) {
-		this._config.memory = {
-			min: size,
-			desired: size
-		};
-		return this;
+	static getErrorTypeName(error) {
+		if (error === null) return "null";
+		if (error === void 0) return "undefined";
+		if (error?.constructor?.name) return error.constructor.name;
+		const typeofResult = typeof error;
+		return typeofResult === "object" ? "Object" : typeofResult.charAt(0).toUpperCase() + typeofResult.slice(1);
 	}
 	/**
-	* Sets minimum and maximum replica counts with autoscaling configuration.
+	* Convert a JavaScript Error or any object to a generic AlienError.
 	*
-	* @param min Minimum replicas (always running).
-	* @param max Maximum replicas under load.
-	* @returns The Container builder instance.
+	* This is equivalent to Rust's `.into_alien_error()` pattern and provides
+	* a way to convert any JavaScript error into the structured AlienError format.
+	*
+	* @param error - Any JavaScript error or object to convert
+	* @returns AlienError with GENERIC_ERROR code and preserved original error
+	*
+	* @example
+	* ```typescript
+	* try {
+	*   throw new TypeError("Invalid argument")
+	* } catch (error) {
+	*   const alienError = AlienError.from(error)
+	*   console.log(alienError.code) // "GENERIC_ERROR"
+	*   console.log(alienError.context?.originalError) // Serialized TypeError
+	* }
+	* ```
+	*
+	* @example Chaining with context
+	* ```typescript
+	* try {
+	*   JSON.parse("invalid")
+	* } catch (error) {
+	*   throw AlienError.from(error).withContext(
+	*     ValidationError.create({
+	*       input: "invalid",
+	*       expectedFormat: "JSON"
+	*     })
+	*   )
+	* }
+	* ```
+	*
+	* @example AxiosError conversion
+	* ```typescript
+	* try {
+	*   await axios.get('/api/resource')
+	* } catch (error) {
+	*   // If error.response.data contains a valid AlienError structure, it will be parsed
+	*   const alienError = AlienError.from(error)
+	*   console.log(alienError.code) // Could be "REMOTE_RESOURCE_NOT_FOUND" if parsed from response
+	* }
+	* ```
 	*/
-	minReplicas(min) {
-		if (!this._config.autoscaling) this._config.autoscaling = {
-			min,
-			desired: min,
-			max: min * 10
-		};
-		else {
-			this._config.autoscaling.min = min;
-			this._config.autoscaling.desired = min;
-		}
-		return this;
+	static async from(error) {
+		if (error instanceof AlienError) return error;
+		if (error instanceof Response) {
+			let errorBody;
+			try {
+				errorBody = await error.json();
+			} catch {
+				return new AlienError({
+					code: "GENERIC_ERROR",
+					message: `HTTP request failed with status ${error.status}`,
+					retryable: false,
+					internal: true,
+					httpStatusCode: error.status,
+					context: {
+						url: error.url,
+						status: error.status,
+						statusText: error.statusText
+					}
+				});
+			}
+			const parseResult = AlienErrorSchema.safeParse(errorBody);
+			if (parseResult.success) return new AlienError(parseResult.data);
+			return new AlienError({
+				code: "GENERIC_ERROR",
+				message: errorBody?.message || `HTTP request failed with status ${error.status}`,
+				retryable: false,
+				internal: true,
+				httpStatusCode: error.status,
+				context: {
+					url: error.url,
+					status: error.status,
+					statusText: error.statusText,
+					responseBody: errorBody
+				}
+			});
+		}
+		if (error?.response?.data && typeof error.response.data === "object") {
+			const parseResult = AlienErrorSchema.safeParse(error.response.data);
+			if (parseResult.success) return new AlienError(parseResult.data);
+		}
+		const serialized = serializeError(error);
+		const message = serialized?.message || String(error);
+		return new AlienError({
+			code: "GENERIC_ERROR",
+			message,
+			retryable: false,
+			internal: true,
+			httpStatusCode: 500,
+			context: {
+				originalError: serialized,
+				errorType: AlienError.getErrorTypeName(error)
+			}
+		});
 	}
 	/**
-	* Sets the maximum replica count for autoscaling.
-	* @param max Maximum replicas.
-	* @returns The Container builder instance.
+	* Add context to this error, creating a new error that wraps this one.
+	*
+	* This is equivalent to Rust's `.with_context()` pattern and allows
+	* building error chains with increasing levels of context.
+	*
+	* @template TNewContext - Zod schema type for the new context
+	* @param definition - Error definition to wrap this error with
+	* @returns New AlienError with this error as the source
+	*
+	* @example
+	* ```typescript
+	* // Clean fluent API
+	* const authError = (await AlienError.from(new Error("ECONNREFUSED")))
+	*   .withContext(DatabaseError.create({
+	*     host: "localhost",
+	*     port: 5432,
+	*     reason: "Connection refused"
+	*   }))
+	*   .withContext(AuthError.create({
+	*     username: "john",
+	*     reason: "Database unavailable"
+	*   }))
+	*
+	* // Error chain: AuthError -> DatabaseError -> GENERIC_ERROR
+	* console.log(authError.toString())
+	* ```
 	*/
-	maxReplicas(max) {
-		if (!this._config.autoscaling) this._config.autoscaling = {
-			min: 1,
-			desired: 1,
-			max
+	withContext(definition) {
+		const { metadata, context: contextData } = definition;
+		const message = metadata.message(contextData);
+		const sourceOptions = {
+			code: this.code,
+			message: this.message,
+			retryable: this.retryable,
+			internal: this.internal,
+			httpStatusCode: this.httpStatusCode,
+			context: this.context,
+			hint: this.hint,
+			source: this.source?.toOptions()
 		};
-		else this._config.autoscaling.max = max;
-		return this;
-	}
-	/**
-	* Sets a fixed replica count (for stateful containers or stateless without autoscaling).
-	* Cannot be used with minReplicas/maxReplicas.
-	* @param count Fixed number of replicas.
-	* @returns The Container builder instance.
-	*/
-	replicas(count) {
-		this._config.replicas = count;
-		this._config.autoscaling = void 0;
-		return this;
+		return new AlienError({
+			code: metadata.code,
+			message,
+			retryable: metadata.retryable,
+			internal: metadata.internal,
+			httpStatusCode: metadata.httpStatusCode,
+			context: contextData,
+			source: sourceOptions
+		});
 	}
 	/**
-	* Configures autoscaling behavior.
-	* @param config Autoscaling configuration.
-	* @returns The Container builder instance.
+	* Convert this AlienError to the wire format (AlienErrorOptions).
+	*
+	* This method serializes the error into the standard format used
+	* for transmitting errors over the network or storing them.
+	*
+	* @returns AlienErrorOptions object representing this error
 	*/
-	autoScale(config) {
-		this._config.autoscaling = config;
-		return this;
+	toOptions() {
+		return {
+			code: this.code,
+			message: this.message,
+			retryable: this.retryable,
+			internal: this.internal,
+			httpStatusCode: this.httpStatusCode,
+			context: this.context,
+			hint: this.hint,
+			source: this.source?.toOptions()
+		};
 	}
 	/**
-	* Sets whether this container is stateful.
-	* Stateful containers get stable ordinals and support persistent storage.
-	* @param enabled Whether the container is stateful.
-	* @returns The Container builder instance.
+	* Get a sanitized version for external APIs (hides internal errors).
+	*
+	* This method is crucial for security - it prevents sensitive internal
+	* error details from being exposed to external users while preserving
+	* the error chain structure for non-sensitive errors.
+	*
+	* @returns Sanitized AlienErrorOptions safe for external consumption
+	*
+	* @example
+	* ```typescript
+	* const internalError = new AlienError(InternalApiError.create({
+	*   service: "payment-processor",
+	*   details: "Database password expired for user admin",
+	*   traceId: "trace-12345"
+	* }))
+	*
+	* console.log(internalError.toOptions())
+	* // Shows full details including sensitive information
+	*
+	* console.log(internalError.toExternal())
+	* // { code: "GENERIC_ERROR", message: "Internal server error", ... }
+	* ```
 	*/
-	stateful(enabled) {
-		this._config.stateful = enabled;
-		return this;
+	toExternal() {
+		if (this.internal) return {
+			code: "GENERIC_ERROR",
+			message: "Internal server error",
+			retryable: false,
+			internal: false,
+			httpStatusCode: 500
+		};
+		return {
+			code: this.code,
+			message: this.message,
+			retryable: this.retryable,
+			internal: this.internal,
+			httpStatusCode: this.httpStatusCode,
+			context: this.context,
+			hint: this.hint,
+			source: this.source?.toExternal()
+		};
 	}
 	/**
-	* Adds an internal-only port to the container.
-	* Automatically creates DNS records for service discovery.
-	* @param port Port number (e.g., 3000, 8080, 5432).
-	* @returns The Container builder instance.
+	* Check if this error chain contains an error with a specific code.
+	*
+	* This method traverses the entire error chain (this error and all
+	* source errors) to find if any error has the specified code.
+	*
+	* @param code - Error code to search for
+	* @returns True if the code is found anywhere in the error chain
+	*
+	* @example
+	* ```typescript
+	* const chainedError = authError.withContext(dbError.withContext(networkError))
+	*
+	* console.log(chainedError.hasErrorCode("AUTH_FAILED")) // true
+	* console.log(chainedError.hasErrorCode("DATABASE_CONNECTION_FAILED")) // true
+	* console.log(chainedError.hasErrorCode("NETWORK_TIMEOUT")) // true
+	* console.log(chainedError.hasErrorCode("NONEXISTENT_ERROR")) // false
+	* ```
 	*/
-	port(port) {
-		if (!this._config.ports) this._config.ports = [];
-		this._config.ports.push({ port });
-		return this;
+	hasErrorCode(code) {
+		if (this.code === code) return true;
+		return this.source?.hasErrorCode(code) ?? false;
 	}
 	/**
-	* Adds multiple internal-only ports to the container.
-	* @param ports Array of port numbers.
-	* @returns The Container builder instance.
+	* Find the first error in the chain with a specific code.
+	*
+	* This method traverses the error chain and returns the first error
+	* instance that matches the specified code, allowing access to its
+	* specific context and details.
+	*
+	* @param code - Error code to search for
+	* @returns AlienError instance with the specified code, or undefined if not found
+	*
+	* @example
+	* ```typescript
+	* const chainedError = authError.withContext(dbError)
+	*
+	* const dbError = chainedError.findErrorByCode("DATABASE_CONNECTION_FAILED")
+	* if (dbError) {
+	*   console.log("Database error context:", dbError.context)
+	*   console.log("Host:", dbError.context?.host)
+	* }
+	* ```
 	*/
-	ports(ports) {
-		if (!this._config.ports) this._config.ports = [];
-		this._config.ports.push(...ports.map((port) => ({ port })));
-		return this;
+	findErrorByCode(code) {
+		if (this.code === code) return this;
+		return this.source?.findErrorByCode(code);
 	}
 	/**
-	* Exposes a named public endpoint for a container port.
+	* Get a formatted string representation of the error chain.
 	*
-	* Endpoint names are the stable contract for URLs, DNS, and runtime
-	* environment injection.
+	* This method provides a human-readable representation of the entire
+	* error chain, showing how errors are nested and providing context
+	* for debugging and logging.
 	*
-	* @param name Endpoint name, unique within this container.
-	* @param port Port number to expose.
-	* @param options "http"/"tcp" or endpoint options.
-	* @returns The Container builder instance.
-	*/
-	publicEndpoint(name, port, options = "http") {
-		if (!this._config.ports) this._config.ports = [];
-		if (!this._config.publicEndpoints) this._config.publicEndpoints = [];
-		const endpoint = typeof options === "string" ? {
-			protocol: options,
-			hostLabel: void 0,
-			wildcardSubdomains: false
-		} : options;
-		if (!this._config.ports.some((p) => p.port === port)) this._config.ports.push({ port });
-		this._config.publicEndpoints.push({
-			name,
-			port,
-			protocol: endpoint.protocol,
-			hostLabel: endpoint.hostLabel,
-			wildcardSubdomains: endpoint.wildcardSubdomains ?? false
-		});
-		return this;
-	}
-	/**
-	* Sets environment variables for the container.
-	* @param vars Key-value pairs of environment variables.
-	* @returns The Container builder instance.
-	*/
-	environment(vars) {
-		this._config.environment = {
-			...this._config.environment,
-			...vars
-		};
-		return this;
-	}
-	/**
-	* Sets ephemeral storage size.
-	* Data is lost on container restart.
-	* @param size Storage size (e.g., "10Gi", "100Gi", "500Gi").
-	* @returns The Container builder instance.
-	*/
-	ephemeralStorage(size) {
-		this._config.ephemeralStorage = size;
-		return this;
-	}
-	/**
-	* Configures persistent storage and marks the container stateful.
-	* Data survives container restarts.
-	* @param size Storage size (e.g., "100Gi", "500Gi", "1Ti").
-	* @param options Optional mount path.
-	* @returns The Container builder instance.
-	*/
-	persistentStorage(size, options = {}) {
-		const persistentStorage = {
-			size,
-			mountPath: options.mountPath ?? "/data"
-		};
-		this._config.persistentStorage = persistentStorage;
-		this._config.stateful = true;
-		return this;
-	}
-	/**
-	* Requests GPU resources.
-	* @param config GPU configuration with type and count.
-	* @returns The Container builder instance.
-	*/
-	gpu(config) {
-		this._config.gpu = config;
-		return this;
-	}
-	/**
-	* Configures health check for the container.
-	* @param config Health check configuration.
-	* @returns The Container builder instance.
-	*/
-	healthCheck(config) {
-		this._config.healthCheck = config;
-		return this;
-	}
-	/**
-	* Configures readiness probe (alias for healthCheck).
-	* @param config Readiness probe configuration with method and path.
-	* @returns The Container builder instance.
-	*/
-	readinessProbe(config) {
-		this._config.healthCheck = {
-			path: config.path,
-			method: config.method,
-			timeoutSeconds: 1,
-			failureThreshold: 3
-		};
-		return this;
-	}
-	/**
-	* Sets the permission profile for this container.
-	* @param profile Permission profile name from stack permissions configuration.
-	* @returns The Container builder instance.
-	*/
-	permissions(profile) {
-		this._config.permissions = profile;
-		return this;
-	}
-	/**
-	* Assigns the container to a specific compute pool.
-	* @param poolName Compute pool name.
-	* @returns The Container builder instance.
-	*/
-	pool(poolName) {
-		this._config.pool = poolName;
-		return this;
-	}
-	/**
-	* Sets the command to override the image default.
-	* @param command Array of command arguments.
-	* @returns The Container builder instance.
-	*/
-	command(command) {
-		this._config.command = command;
-		return this;
-	}
-	/**
-	* Sets the grace period used when stopping replicas during updates, drains, and deletes.
+	* @returns Formatted string showing the complete error chain
 	*
-	* The value is expressed in seconds. Valid values are 1 through 86400.
-	*/
-	stopGracePeriod(seconds) {
-		this._config.stopGracePeriodSeconds = seconds;
-		return this;
-	}
-	/**
-	* Links this container to another resource (Storage, Queue, KV, etc.).
-	* @param resource The resource to link to.
-	* @returns The Container builder instance.
-	*/
-	link(resource) {
-		if (!this._config.links) this._config.links = [];
-		this._config.links.push(resource.ref());
-		return this;
-	}
-	/**
-	* Enables or disables the Commands protocol for the container.
-	* When enabled, an app-owned receiver can lease this Container's pending commands and execute registered handlers.
-	* Default: false.
-	* @param enabled Whether to enable commands for this container.
-	* @returns The Container builder instance.
-	*/
-	commandsEnabled(enabled) {
-		this._config.commandsEnabled = enabled;
-		return this;
-	}
-	/**
-	* Builds and validates the container configuration.
-	* @returns An immutable Resource representing the configured container.
-	* @throws Error if the container configuration is invalid.
+	* @example
+	* ```typescript
+	* const chainedError = authError.withContext(dbError.withContext(networkError))
+	* console.log(chainedError.toString())
+	* // Output:
+	* // AUTH_FAILED: User authentication failed for 'john'
+	* //   ├─▶ DATABASE_CONNECTION_FAILED: Failed to connect to database 'localhost:5432'
+	* //     ├─▶ GENERIC_ERROR: Connection timeout
+	* ```
 	*/
-	build() {
-		const config = ContainerSchema.parse(this._config);
-		return this.resource({
-			type: "container",
-			...config
-		});
+	toString() {
+		let result = `${this.code}: ${this.message}`;
+		let current = this.source;
+		let indent = "";
+		while (current) {
+			indent += "  ";
+			result += `\n${indent}├─▶ ${current.code}: ${current.message}`;
+			current = current.source;
+		}
+		return result;
 	}
 };
 //#endregion
+//#region src/common-errors.ts
+/**
+* Error thrown when a requested resource cannot be found in the stack state.
+* This matches the Rust alien-core error: RESOURCE_NOT_FOUND
+*/
+const ResourceNotFoundError = defineError({
+	code: "RESOURCE_NOT_FOUND",
+	context: z$1.object({
+		resourceId: z$1.string(),
+		availableResources: z$1.array(z$1.string())
+	}),
+	message: ({ resourceId, availableResources }) => `Resource '${resourceId}' not found in stack state. Available resources: ${JSON.stringify(availableResources)}`,
+	retryable: false,
+	internal: false,
+	httpStatusCode: 404
+});
+/**
+* Error thrown when resource outputs cannot be parsed according to their expected schema.
+* This indicates an internal system error or data corruption.
+*/
+const ResourceOutputsParseError = defineError({
+	code: "RESOURCE_OUTPUTS_PARSE_ERROR",
+	context: z$1.object({
+		resourceName: z$1.string(),
+		resourceType: z$1.string(),
+		validationErrors: z$1.string()
+	}),
+	message: ({ resourceName, resourceType, validationErrors }) => `Failed to parse outputs for resource '${resourceName}' of type '${resourceType}':\n${validationErrors}`,
+	retryable: false,
+	internal: true,
+	httpStatusCode: 500
+});
+/**
+* Error thrown when there's a resource type mismatch during stack operations.
+* This matches the Rust alien-core error: UNEXPECTED_RESOURCE_TYPE
+*/
+const UnexpectedResourceTypeError = defineError({
+	code: "UNEXPECTED_RESOURCE_TYPE",
+	context: z$1.object({
+		resourceId: z$1.string(),
+		expected: z$1.string(),
+		actual: z$1.string()
+	}),
+	message: ({ resourceId, expected, actual }) => `Unexpected resource type for resource '${resourceId}': expected ${expected}, but got ${actual}`,
+	retryable: false,
+	internal: false,
+	httpStatusCode: 400
+});
+/**
+* Error thrown when a binding's projected configuration is invalid.
+*/
+const InvalidBindingConfigError = defineError({
+	code: "INVALID_BINDING_CONFIG",
+	context: z$1.object({
+		message: z$1.string(),
+		suggestion: z$1.string().optional()
+	}),
+	message: ({ message, suggestion }) => suggestion ? `${message}. ${suggestion}` : message,
+	retryable: false,
+	internal: false,
+	httpStatusCode: 400
+});
+/**
+* Error thrown when a binding is not found.
+*/
+const BindingNotFoundError = defineError({
+	code: "BINDING_NOT_FOUND",
+	context: z$1.object({
+		bindingName: z$1.string(),
+		bindingType: z$1.string()
+	}),
+	message: ({ bindingName, bindingType }) => `${bindingType} binding '${bindingName}' not found`,
+	retryable: false,
+	internal: false,
+	httpStatusCode: 404
+});
+//#endregion
 //#region src/compute-cluster.ts
 /**
 * Declares a ComputeCluster — the setup-owned machine boundary for daemons and
@@ -7815,62 +8226,67 @@ function parseQuantityBytes(value) {
 	return Math.round(amount * (suffix === "Ti" ? 1024 ** 4 : suffix === "Gi" ? 1024 ** 3 : suffix === "Mi" ? 1024 ** 2 : suffix === "Ki" ? 1024 : suffix === "T" ? 1e3 ** 4 : suffix === "G" ? 1e3 ** 3 : suffix === "M" ? 1e3 ** 2 : suffix === "k" ? 1e3 : 1));
 }
 //#endregion
-//#region src/daemon.ts
+//#region src/container.ts
 /**
-* Represents a resident process that runs once per eligible machine or node.
+* Represents a long-running container workload.
 *
-* Daemons are intended for long-lived background processes such as endpoint
-* agents and local side services.
+* Containers run on compute instances (EC2, GCE, Azure VMs) and are orchestrated
+* by the managed container backend. They're designed for always-on workloads
+* like web services, APIs, databases, and background workers.
 */
-var Daemon = class extends ResourceBuilder {
+var Container = class extends ResourceBuilder {
 	_config = {
 		links: [],
+		ports: [],
 		publicEndpoints: [],
 		environment: {},
-		cpu: {
-			min: "0.1",
-			desired: "0.1"
-		},
-		memory: {
-			min: "128Mi",
-			desired: "128Mi"
-		}
+		stateful: false
 	};
 	/**
-	* Creates a new Daemon builder.
-	* @param id Identifier for the daemon. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+	* Creates a new Container builder.
+	* @param id Identifier for the container. Must be DNS-compatible: lowercase alphanumeric with hyphens.
 	*/
 	constructor(id) {
 		super();
 		this._config.id = id;
 	}
 	/**
-	* Returns a ResourceType representing any daemon resource.
-	* Used for creating permission targets that apply to all daemon resources.
-	* @returns The "daemon" resource type.
+	* Returns a ResourceType representing any container resource.
+	* Used for creating permission targets that apply to all container resources.
+	* @returns The "container" resource type.
 	*/
 	static any() {
-		return "daemon";
+		return "container";
 	}
 	/**
-	* Sets the code for the daemon, either a pre-built image or source code to be built.
-	* @param code The daemon code configuration.
-	* @returns The Daemon builder instance.
+	* Sets the container cluster this container runs on.
+	* @param clusterId The ComputeCluster resource ID.
+	* @returns The Container builder instance.
 	*/
-	code(code) {
-		this._config.code = code;
+	cluster(clusterId) {
+		this._config.cluster = clusterId;
 		return this;
 	}
 	/**
-	* Sets the ComputeCluster this daemon runs on for AWS/GCP/Azure deployments.
-	* Kubernetes and Local deployments ignore this field.
+	* Sets the code for the container, either a pre-built image or source code to be built.
+	* @param code The container code configuration.
+	* @returns The Container builder instance.
 	*/
-	cluster(clusterId) {
-		this._config.cluster = clusterId;
+	code(code) {
+		this._config.code = code;
 		return this;
 	}
 	/**
-	* Sets CPU resources for each daemon instance.
+	* Sets the CPU resources for the container.
+	*
+	* For simplified configuration, use a single number:
+	* - `.cpu(1)` sets both min and desired to 1 vCPU
+	*
+	* For advanced configuration, use ResourceSpec:
+	* - `.cpu({ min: "0.5", desired: "1" })`
+	*
+	* @param value CPU in vCPUs (number) or ResourceSpec with min/desired.
+	* @returns The Container builder instance.
 	*/
 	cpu(value) {
 		if (typeof value === "number") this._config.cpu = {
@@ -7881,7 +8297,14 @@ var Daemon = class extends ResourceBuilder {
 		return this;
 	}
 	/**
-	* Sets memory resources for each daemon instance.
+	* Sets the memory resources for the container.
+	*
+	* Format: "<number>Mi" or "<number>Gi"
+	*
+	* Example: "512Mi", "2Gi", "16Gi"
+	*
+	* @param size Memory size string.
+	* @returns The Container builder instance.
 	*/
 	memory(size) {
 		this._config.memory = {
@@ -7891,60 +8314,169 @@ var Daemon = class extends ResourceBuilder {
 		return this;
 	}
 	/**
-	* Sets the backend pool/capacity group for daemon placement.
+	* Sets minimum and maximum replica counts with autoscaling configuration.
+	*
+	* @param min Minimum replicas (always running).
+	* @param max Maximum replicas under load.
+	* @returns The Container builder instance.
 	*/
-	pool(pool) {
-		this._config.pool = pool;
+	minReplicas(min) {
+		if (!this._config.autoscaling) this._config.autoscaling = {
+			min,
+			desired: min,
+			max: min * 10
+		};
+		else {
+			this._config.autoscaling.min = min;
+			this._config.autoscaling.desired = min;
+		}
 		return this;
 	}
 	/**
-	* Overrides the image default command.
+	* Sets the maximum replica count for autoscaling.
+	* @param max Maximum replicas.
+	* @returns The Container builder instance.
 	*/
-	command(command) {
-		this._config.command = command;
+	maxReplicas(max) {
+		if (!this._config.autoscaling) this._config.autoscaling = {
+			min: 1,
+			desired: 1,
+			max
+		};
+		else this._config.autoscaling.max = max;
 		return this;
 	}
 	/**
-	* Sets the grace period used when stopping daemon instances during updates, drains, and deletes.
-	*
-	* The value is expressed in seconds. Valid values are 1 through 86400.
+	* Sets a fixed replica count (for stateful containers or stateless without autoscaling).
+	* Cannot be used with minReplicas/maxReplicas.
+	* @param count Fixed number of replicas.
+	* @returns The Container builder instance.
 	*/
-	stopGracePeriod(seconds) {
-		this._config.stopGracePeriodSeconds = seconds;
+	replicas(count) {
+		this._config.replicas = count;
+		this._config.autoscaling = void 0;
 		return this;
 	}
 	/**
-	* Sets backend runtime options for trusted daemon infrastructure.
-	*
-	* Use this only for daemons that intentionally need host-level access, such
-	* as a privileged loader that installs or supervises a native host process.
+	* Configures autoscaling behavior.
+	* @param config Autoscaling configuration.
+	* @returns The Container builder instance.
 	*/
-	runtime(runtime) {
-		this._config.runtime = runtime;
+	autoScale(config) {
+		this._config.autoscaling = config;
 		return this;
 	}
 	/**
-	* Exposes a named public endpoint for a daemon port.
+	* Sets whether this container is stateful.
+	* Stateful containers get stable ordinals and support persistent storage.
+	* @param enabled Whether the container is stateful.
+	* @returns The Container builder instance.
+	*/
+	stateful(enabled) {
+		this._config.stateful = enabled;
+		return this;
+	}
+	/**
+	* Adds an internal-only port to the container.
+	* Automatically creates DNS records for service discovery.
+	* @param port Port number (e.g., 3000, 8080, 5432).
+	* @returns The Container builder instance.
+	*/
+	port(port) {
+		if (!this._config.ports) this._config.ports = [];
+		this._config.ports.push({ port });
+		return this;
+	}
+	/**
+	* Adds multiple internal-only ports to the container.
+	* @param ports Array of port numbers.
+	* @returns The Container builder instance.
+	*/
+	ports(ports) {
+		if (!this._config.ports) this._config.ports = [];
+		this._config.ports.push(...ports.map((port) => ({ port })));
+		return this;
+	}
+	/**
+	* Exposes a named public endpoint for a container port.
+	*
+	* Endpoint names are the stable contract for URLs, DNS, and runtime
+	* environment injection.
+	*
+	* @param name Endpoint name, unique within this container.
+	* @param port Port number to expose.
+	* @param options "http"/"tcp" or endpoint options.
+	* @returns The Container builder instance.
 	*/
 	publicEndpoint(name, port, options = "http") {
+		if (!this._config.ports) this._config.ports = [];
 		if (!this._config.publicEndpoints) this._config.publicEndpoints = [];
 		const endpoint = typeof options === "string" ? {
 			protocol: options,
 			hostLabel: void 0,
 			wildcardSubdomains: false
 		} : options;
-		const publicEndpoint = {
+		if (!this._config.ports.some((p) => p.port === port)) this._config.ports.push({ port });
+		this._config.publicEndpoints.push({
 			name,
 			port,
 			protocol: endpoint.protocol,
 			hostLabel: endpoint.hostLabel,
 			wildcardSubdomains: endpoint.wildcardSubdomains ?? false
+		});
+		return this;
+	}
+	/**
+	* Sets environment variables for the container.
+	* @param vars Key-value pairs of environment variables.
+	* @returns The Container builder instance.
+	*/
+	environment(vars) {
+		this._config.environment = {
+			...this._config.environment,
+			...vars
 		};
-		this._config.publicEndpoints.push(publicEndpoint);
 		return this;
 	}
 	/**
-	* Configures the HTTP health check used by public daemon endpoint load balancers.
+	* Sets ephemeral storage size.
+	* Data is lost on container restart.
+	* @param size Storage size (e.g., "10Gi", "100Gi", "500Gi").
+	* @returns The Container builder instance.
+	*/
+	ephemeralStorage(size) {
+		this._config.ephemeralStorage = size;
+		return this;
+	}
+	/**
+	* Configures persistent storage and marks the container stateful.
+	* Data survives container restarts.
+	* @param size Storage size (e.g., "100Gi", "500Gi", "1Ti").
+	* @param options Optional mount path.
+	* @returns The Container builder instance.
+	*/
+	persistentStorage(size, options = {}) {
+		const persistentStorage = {
+			size,
+			mountPath: options.mountPath ?? "/data"
+		};
+		this._config.persistentStorage = persistentStorage;
+		this._config.stateful = true;
+		return this;
+	}
+	/**
+	* Requests GPU resources.
+	* @param config GPU configuration with type and count.
+	* @returns The Container builder instance.
+	*/
+	gpu(config) {
+		this._config.gpu = config;
+		return this;
+	}
+	/**
+	* Configures health check for the container.
+	* @param config Health check configuration.
+	* @returns The Container builder instance.
 	*/
 	healthCheck(config) {
 		this._config.healthCheck = config;
@@ -7952,6 +8484,8 @@ var Daemon = class extends ResourceBuilder {
 	}
 	/**
 	* Configures readiness probe (alias for healthCheck).
+	* @param config Readiness probe configuration with method and path.
+	* @returns The Container builder instance.
 	*/
 	readinessProbe(config) {
 		this._config.healthCheck = {
@@ -7963,456 +8497,275 @@ var Daemon = class extends ResourceBuilder {
 		return this;
 	}
 	/**
-	* Sets key-value pairs as environment variables for the daemon.
-	* @param env A map of environment variable names to their values.
-	* @returns The Daemon builder instance.
+	* Sets the permission profile for this container.
+	* @param profile Permission profile name from stack permissions configuration.
+	* @returns The Container builder instance.
 	*/
-	environment(env) {
-		this._config.environment = env;
+	permissions(profile) {
+		this._config.permissions = profile;
 		return this;
 	}
 	/**
-	* Links another resource to this daemon.
-	* This makes the linked resource accessible to the daemon, often by injecting
-	* environment variables or granting permissions.
-	* @param resource The resource to link.
-	* @returns The Daemon builder instance.
+	* Assigns the container to a specific compute pool.
+	* @param poolName Compute pool name.
+	* @returns The Container builder instance.
 	*/
-	link(resource) {
-		if (!this._config.links) this._config.links = [];
-		this._config.links.push(resource.ref());
+	pool(poolName) {
+		this._config.pool = poolName;
 		return this;
 	}
 	/**
-	* Assigns a permission profile to this daemon.
-	* The profile defines the permissions granted to this daemon when interacting
-	* with other cloud resources.
-	* @param permissions The permission profile name.
-	* @returns The Daemon builder instance.
+	* Sets the command to override the image default.
+	* @param command Array of command arguments.
+	* @returns The Container builder instance.
 	*/
-	permissions(permissions) {
-		this._config.permissions = permissions;
+	command(command) {
+		this._config.command = command;
 		return this;
 	}
 	/**
-	* Enables or disables the Commands protocol for the daemon.
-	* When enabled, an app-owned receiver can lease this Daemon's pending commands and execute registered handlers.
+	* Sets the grace period used when stopping replicas during updates, drains, and deletes.
+	*
+	* The value is expressed in seconds. Valid values are 1 through 86400.
+	*/
+	stopGracePeriod(seconds) {
+		this._config.stopGracePeriodSeconds = seconds;
+		return this;
+	}
+	/**
+	* Links this container to another resource (Storage, Queue, KV, etc.).
+	* @param resource The resource to link to.
+	* @returns The Container builder instance.
+	*/
+	link(resource) {
+		if (!this._config.links) this._config.links = [];
+		this._config.links.push(resource.ref());
+		return this;
+	}
+	/**
+	* Enables or disables the Commands protocol for the container.
+	* When enabled, an app-owned receiver can lease this Container's pending commands and execute registered handlers.
 	* Default: false.
-	* @param enabled Whether to enable commands for this daemon.
-	* @returns The Daemon builder instance.
+	* @param enabled Whether to enable commands for this container.
+	* @returns The Container builder instance.
 	*/
 	commandsEnabled(enabled) {
 		this._config.commandsEnabled = enabled;
 		return this;
 	}
 	/**
-	* Builds and validates the daemon configuration.
-	* @returns An immutable Resource representing the configured daemon.
-	* @throws Error if the daemon configuration is invalid.
+	* Builds and validates the container configuration.
+	* @returns An immutable Resource representing the configured container.
+	* @throws Error if the container configuration is invalid.
 	*/
 	build() {
-		const config = DaemonSchema.parse(this._config);
+		const config = ContainerSchema.parse(this._config);
 		return this.resource({
-			type: "daemon",
+			type: "container",
 			...config
 		});
 	}
 };
 //#endregion
-//#region src/build.ts
+//#region src/daemon.ts
 /**
-* Represents a build resource that executes bash scripts to build code.
-* Builds are designed to be stateless and can be triggered on-demand to compile,
-* test, or package application code.
+* Represents a resident process that runs once per eligible machine or node.
+*
+* Daemons are intended for long-lived background processes such as endpoint
+* agents and local side services.
 */
-var Build = class {
+var Daemon = class extends ResourceBuilder {
 	_config = {
 		links: [],
-		environment: {}
+		publicEndpoints: [],
+		environment: {},
+		cpu: {
+			min: "0.1",
+			desired: "0.1"
+		},
+		memory: {
+			min: "128Mi",
+			desired: "128Mi"
+		}
 	};
 	/**
-	* Creates a new Build builder.
-	* @param id Identifier for the build resource. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+	* Creates a new Daemon builder.
+	* @param id Identifier for the daemon. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
 	*/
 	constructor(id) {
+		super();
 		this._config.id = id;
 	}
 	/**
-	* Returns a ResourceType representing any build resource.
-	* Used for creating permission targets that apply to all build resources.
-	* @returns The "build" resource type.
+	* Returns a ResourceType representing any daemon resource.
+	* Used for creating permission targets that apply to all daemon resources.
+	* @returns The "daemon" resource type.
 	*/
 	static any() {
-		return "build";
+		return "daemon";
 	}
 	/**
-	* Sets the compute type for the build.
-	* @param type The compute type (small, medium, large, x-large).
-	* @returns The Build builder instance.
+	* Sets the code for the daemon, either a pre-built image or source code to be built.
+	* @param code The daemon code configuration.
+	* @returns The Daemon builder instance.
 	*/
-	computeType(type) {
-		this._config.computeType = type;
+	code(code) {
+		this._config.code = code;
 		return this;
 	}
 	/**
-	* Sets key-value pairs as environment variables for the build.
-	* @param env A map of environment variable names to their values.
-	* @returns The Build builder instance.
+	* Sets the ComputeCluster this daemon runs on for AWS/GCP/Azure deployments.
+	* Kubernetes and Local deployments ignore this field.
 	*/
-	environment(env) {
-		this._config.environment = env;
+	cluster(clusterId) {
+		this._config.cluster = clusterId;
 		return this;
 	}
 	/**
-	* Links another resource (e.g., Storage, ArtifactRegistry, Role) to this build.
-	* This makes the linked resource accessible to the build, often by injecting
-	* environment variables or granting permissions.
-	* @param resource The resource to link.
-	* @returns The Build builder instance.
+	* Sets CPU resources for each daemon instance.
 	*/
-	link(resource) {
-		if (!this._config.links) this._config.links = [];
-		this._config.links.push(resource.ref());
+	cpu(value) {
+		if (typeof value === "number") this._config.cpu = {
+			min: value.toString(),
+			desired: value.toString()
+		};
+		else this._config.cpu = value;
 		return this;
 	}
 	/**
-	* Assigns a permission profile to this build.
-	* The profile defines the permissions granted to this build when interacting
-	* with other cloud resources.
-	* @param permissions The permission profile name.
-	* @returns The Build builder instance.
+	* Sets memory resources for each daemon instance.
 	*/
-	permissions(permissions) {
-		this._config.permissions = permissions;
+	memory(size) {
+		this._config.memory = {
+			min: size,
+			desired: size
+		};
 		return this;
 	}
 	/**
-	* Builds and validates the build configuration.
-	* @returns An immutable Resource representing the configured build.
-	* @throws Error if the build configuration is invalid.
+	* Sets the backend pool/capacity group for daemon placement.
 	*/
-	build() {
-		return new Resource({
-			type: "build",
-			...BuildSchema.parse(this._config)
-		});
+	pool(pool) {
+		this._config.pool = pool;
+		return this;
 	}
-};
-//#endregion
-//#region src/artifact-registry.ts
-/**
-* Represents an artifact registry for storing container images and other build artifacts.
-* This is a high-level wrapper resource that provides a cloud-agnostic interface over
-* AWS ECR, GCP Artifact Registry, and Azure Container Registry.
-*/
-var ArtifactRegistry = class {
-	_config = {};
 	/**
-	* Creates a new ArtifactRegistry builder.
-	* @param id Identifier for the artifact registry. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+	* Overrides the image default command.
 	*/
-	constructor(id) {
-		this._config.id = id;
+	command(command) {
+		this._config.command = command;
+		return this;
 	}
 	/**
-	* Returns a ResourceType representing any artifact registry resource.
-	* Used for creating permission targets that apply to all artifact registry resources.
-	* @returns The "artifact-registry" resource type.
+	* Sets the grace period used when stopping daemon instances during updates, drains, and deletes.
+	*
+	* The value is expressed in seconds. Valid values are 1 through 86400.
 	*/
-	static any() {
-		return "artifact-registry";
+	stopGracePeriod(seconds) {
+		this._config.stopGracePeriodSeconds = seconds;
+		return this;
 	}
 	/**
-	* AWS-only: Configure ECR private image replication to additional regions.
-	* Ensures images pushed in the registry's home region are automatically
-	* available in these destination regions (required when Lambda or other
-	* compute runs in a different region).
-	* @param regions - AWS region codes to replicate to (e.g., ["us-east-2", "eu-west-1"])
+	* Sets backend runtime options for trusted daemon infrastructure.
+	*
+	* Use this only for daemons that intentionally need host-level access, such
+	* as a privileged loader that installs or supervises a native host process.
 	*/
-	replicationRegions(regions) {
-		this._config.replicationRegions = regions;
+	runtime(runtime) {
+		this._config.runtime = runtime;
 		return this;
 	}
 	/**
-	* Builds and validates the artifact registry configuration.
-	* @returns An immutable Resource representing the configured artifact registry.
-	* @throws Error if the artifact registry configuration is invalid.
+	* Exposes a named public endpoint for a daemon port.
 	*/
-	build() {
-		return new Resource({
-			type: "artifact-registry",
-			...ArtifactRegistrySchema.parse(this._config)
-		});
+	publicEndpoint(name, port, options = "http") {
+		if (!this._config.publicEndpoints) this._config.publicEndpoints = [];
+		const endpoint = typeof options === "string" ? {
+			protocol: options,
+			hostLabel: void 0,
+			wildcardSubdomains: false
+		} : options;
+		const publicEndpoint = {
+			name,
+			port,
+			protocol: endpoint.protocol,
+			hostLabel: endpoint.hostLabel,
+			wildcardSubdomains: endpoint.wildcardSubdomains ?? false
+		};
+		this._config.publicEndpoints.push(publicEndpoint);
+		return this;
 	}
-};
-//#endregion
-//#region src/vault.ts
-/**
-* Represents a secure vault for storing secrets.
-* This resource provides a platform-agnostic interface over cloud-native secret management services:
-* - AWS: AWS Secrets Manager with prefixed secret names
-* - GCP: Secret Manager with prefixed secret names
-* - Azure: Key Vault resource
-*
-* The vault acts as a namespace for secrets and controls access permissions for workers and services.
-*/
-var Vault = class extends ResourceBuilder {
-	_config = {};
 	/**
-	* Creates a new Vault builder.
-	* @param id Identifier for the vault. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+	* Configures the HTTP health check used by public daemon endpoint load balancers.
 	*/
-	constructor(id) {
-		super();
-		this._config.id = id;
+	healthCheck(config) {
+		this._config.healthCheck = config;
+		return this;
 	}
 	/**
-	* Returns a ResourceType representing any vault resource.
-	* Used for creating permission targets that apply to all vault resources.
-	* @returns The "vault" resource type.
+	* Configures readiness probe (alias for healthCheck).
 	*/
-	static any() {
-		return "vault";
+	readinessProbe(config) {
+		this._config.healthCheck = {
+			path: config.path,
+			method: config.method,
+			timeoutSeconds: 1,
+			failureThreshold: 3
+		};
+		return this;
 	}
 	/**
-	* Builds and validates the vault configuration.
-	* @returns An immutable Resource representing the configured vault.
-	* @throws Error if the vault configuration is invalid.
+	* Sets key-value pairs as environment variables for the daemon.
+	* @param env A map of environment variable names to their values.
+	* @returns The Daemon builder instance.
 	*/
-	build() {
-		const config = VaultSchema.parse(this._config);
-		return this.resource({
-			type: "vault",
-			...config
-		});
-	}
-};
-//#endregion
-//#region src/kv.ts
-/**
-* Represents a key-value store for data storage.
-* This resource provides a platform-agnostic interface over cloud-native KV services:
-* - AWS: DynamoDB with hash bucketing for load distribution
-* - GCP: Firestore with document-based storage and collection management
-* - Azure: Table Storage with client-side TTL filtering and partition fan-out
-*
-* The KV store supports basic operations: get, put, delete, exists, and scan_prefix.
-* All operations support TTL for automatic expiration and conditional operations.
-*
-* Key Features:
-* - Universal size limits: 512-byte keys, 24 KiB values
-* - TTL support with logical expiry across all platforms
-* - Atomic absent and version preconditions for puts and deletes
-* - Prefix-based scanning with pagination
-* - Platform-specific optimizations while maintaining consistent API
-*
-* Size Constraints:
-* - Keys: ≤ 512 bytes with portable ASCII charset (a-z, A-Z, 0-9, -, _, :, .)
-* - Values: ≤ 24,576 bytes (24 KiB)
-*
-* TTL Behavior:
-* - Expired items appear absent on reads even if physically present
-* - TTL precision varies by platform but logical behavior is consistent
-*
-* Scan Operations:
-* - Returns arbitrary, unordered subsets in backend-natural order
-* - No ordering guarantees across platforms
-* - May return ≤ limit items (not guaranteed to fill)
-* - Clients must de-duplicate keys across pages
-* - No completeness guarantee under concurrent writes
-*/
-var Kv = class extends ResourceBuilder {
-	_config = {};
-	/**
-	* Creates a new KV builder.
-	* @param id Identifier for the KV store. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
-	*/
-	constructor(id) {
-		super();
-		this._config.id = id;
-	}
-	/**
-	* Returns a ResourceType representing any KV resource.
-	* Used for creating permission targets that apply to all KV resources.
-	* @returns The "kv" resource type.
-	*/
-	static any() {
-		return "kv";
-	}
-	/**
-	* Builds and validates the KV configuration.
-	* @returns An immutable Resource representing the configured KV store.
-	* @throws Error if the KV configuration is invalid.
-	*/
-	build() {
-		const config = KvSchema.parse(this._config);
-		return this.resource({
-			type: "kv",
-			...config
-		});
-	}
-};
-//#endregion
-//#region src/postgres.ts
-/**
-* Represents a managed PostgreSQL database. The target platform decides the backend;
-* the database is private and reachable only by same-stack workloads.
-*/
-var Postgres = class extends ResourceBuilder {
-	_config = {
-		version: "17",
-		storage: "20Gi",
-		highAvailability: false
-	};
-	/**
-	* Creates a new Postgres builder.
-	* @param id ID of the database. A database of this name is created on the server.
-	*/
-	constructor(id) {
-		super();
-		this._config.id = id;
-	}
-	/**
-	* Returns a ResourceType representing any postgres resource.
-	* Used for creating permission targets that apply to all postgres resources.
-	* @returns The "postgres" resource type.
-	*/
-	static any() {
-		return "postgres";
-	}
-	/**
-	* Sets the major engine version ("15" | "16" | "17"). Default `"17"`.
-	* The union narrows the generated schema's free-form string for authoring ergonomics;
-	* keep it in sync with the supported majors if the Rust `Postgres` resource adds one.
-	* @param value The major version.
-	* @returns The Postgres builder instance.
-	*/
-	version(value) {
-		this._config.version = value;
-		return this;
-	}
-	/**
-	* Requests vCPUs (e.g. "0.5", "2"). On GCP and Azure, `cpu` and `memory` together pick the
-	* smallest tier that satisfies both. On AWS (Aurora Serverless v2) sizing comes from `memory`, so
-	* `cpu` is ignored.
-	* @param value The requested vCPUs.
-	* @returns The Postgres builder instance.
-	*/
-	cpu(value) {
-		this._config.cpu = value;
-		return this;
+	environment(env) {
+		this._config.environment = env;
+		return this;
 	}
 	/**
-	* Requests memory (e.g. "1Gi", "8Gi"). Drives the size on AWS (the ACU ceiling) and, together
-	* with `cpu`, the tier on GCP and Azure.
-	* @param value The requested memory.
-	* @returns The Postgres builder instance.
+	* Links another resource to this daemon.
+	* This makes the linked resource accessible to the daemon, often by injecting
+	* environment variables or granting permissions.
+	* @param resource The resource to link.
+	* @returns The Daemon builder instance.
 	*/
-	memory(value) {
-		this._config.memory = value;
+	link(resource) {
+		if (!this._config.links) this._config.links = [];
+		this._config.links.push(resource.ref());
 		return this;
 	}
 	/**
-	* Sets allocated storage (e.g. "100Gi"). Default `"20Gi"`. Grow-only.
-	* @param value The storage size.
-	* @returns The Postgres builder instance.
+	* Assigns a permission profile to this daemon.
+	* The profile defines the permissions granted to this daemon when interacting
+	* with other cloud resources.
+	* @param permissions The permission profile name.
+	* @returns The Daemon builder instance.
 	*/
-	storage(value) {
-		this._config.storage = value;
+	permissions(permissions) {
+		this._config.permissions = permissions;
 		return this;
 	}
 	/**
-	* Enables multi-AZ / regional / zone-redundant high availability. Default `false`.
-	* @param value Whether to enable HA.
-	* @returns The Postgres builder instance.
+	* Enables or disables the Commands protocol for the daemon.
+	* When enabled, an app-owned receiver can lease this Daemon's pending commands and execute registered handlers.
+	* Default: false.
+	* @param enabled Whether to enable commands for this daemon.
+	* @returns The Daemon builder instance.
 	*/
-	highAvailability(value = true) {
-		this._config.highAvailability = value;
+	commandsEnabled(enabled) {
+		this._config.commandsEnabled = enabled;
 		return this;
 	}
 	/**
-	* Builds and validates the postgres configuration.
-	* @returns An immutable Resource representing the configured database.
-	* @throws Error if the configuration is invalid.
-	*/
-	build() {
-		const config = PostgresSchema.parse(this._config);
-		return this.resource({
-			type: "postgres",
-			...config
-		});
-	}
-};
-//#endregion
-//#region src/ai.ts
-/**
-* Represents an AI Gateway resource that provides a unified interface to
-* managed AI inference services across cloud providers.
-*/
-var AI = class extends ResourceBuilder {
-	_config = {};
-	/**
-	* Creates a new AI builder.
-	* @param id Identifier for the AI resource. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
-	*/
-	constructor(id) {
-		super();
-		this._config.id = id;
-	}
-	/**
-	* Returns a ResourceType representing any AI resource.
-	* Used for creating permission targets that apply to all AI resources.
-	* @returns The "ai" resource type.
-	*/
-	static any() {
-		return "ai";
-	}
-	/**
-	* Builds and validates the AI configuration.
-	* @returns An immutable Resource representing the configured AI Gateway.
-	* @throws Error if the AI configuration is invalid.
-	*/
-	build() {
-		const config = AiSchema.parse(this._config);
-		return this.resource({
-			type: "ai",
-			...config
-		});
-	}
-};
-//#endregion
-//#region src/queue.ts
-/**
-* Represents a message queue resource with minimal, portable semantics.
-* Queue integrates with platform-native services (AWS SQS, GCP Pub/Sub, Azure Service Bus).
-*/
-var Queue = class extends ResourceBuilder {
-	_config = {};
-	/**
-	* Creates a new Queue builder.
-	* @param id Identifier for the queue. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
-	*/
-	constructor(id) {
-		super();
-		this._config.id = id;
-	}
-	/**
-	* Returns a ResourceType representing any queue resource.
-	* Used for creating permission targets that apply to all queue resources.
-	* @returns The "queue" resource type.
-	*/
-	static any() {
-		return "queue";
-	}
-	/**
-	* Builds and validates the queue configuration.
-	* @returns An immutable Resource representing the configured queue.
-	* @throws Error if the queue configuration is invalid.
+	* Builds and validates the daemon configuration.
+	* @returns An immutable Resource representing the configured daemon.
+	* @throws Error if the daemon configuration is invalid.
 	*/
 	build() {
-		const config = QueueSchema.parse(this._config);
+		const config = DaemonSchema.parse(this._config);
 		return this.resource({
-			type: "queue",
+			type: "daemon",
 			...config
 		});
 	}
@@ -8513,95 +8866,64 @@ var Email = class extends ResourceBuilder {
 	}
 };
 //#endregion
-//#region src/service-account.ts
-/**
-* Represents a non-human identity that can be assumed by compute services.
-*
-* Maps to:
-* - AWS: IAM Role
-* - GCP: Service Account
-* - Azure: User-assigned Managed Identity
-*
-* ServiceAccounts can be used to grant specific permissions to compute resources
-* and can be impersonated by other services for cross-account or cross-service access.
-*
-* @example
-* ```typescript
-* import { ServiceAccount, Worker } from "@alien/core"
-*
-* // Create a service account with stack-level permissions
-* const dataProcessorAccount = new ServiceAccount("data-processor")
-*   .build()
-*
-* // Link it to a function to use its identity
-* const processor = new Worker("processor")
-*   .code({ type: "image", image: "processor:latest" })
-*   .link(dataProcessorAccount)
-*   .build()
-* ```
-*/
-var ServiceAccount = class {
-	_config = { stackPermissionSets: [] };
-	/**
-	* Creates a new ServiceAccount builder.
-	* @param id Identifier for the service account. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
-	*/
-	constructor(id) {
-		this._config.id = id;
-	}
-	/**
-	* Returns a ResourceType representing any service account resource.
-	* Used for creating permission targets that apply to all service account resources.
-	* @returns The "service-account" resource type.
-	*/
-	static any() {
-		return "service-account";
-	}
-	/**
-	* Adds a stack-level permission set to the service account.
-	* Stack-level permissions apply to all resources in the stack.
-	*
-	* Note: Only inline permission set objects are supported. To use built-in permission sets,
-	* you need to resolve them first through the permission set registry or use permission profiles
-	* in your stack configuration.
-	*
-	* @example
-	* ```typescript
-	* import { ServiceAccount, type PermissionSet } from "@alien/core"
-	*
-	* const customPermissionSet: PermissionSet = {
-	*   id: "custom/my-perms",
-	*   description: "Custom permissions",
-	*   platforms: {
-	*     aws: [{ grant: { actions: ["s3:GetObject"] }, binding: { stack: { resources: ["*"] } } }]
-	*   }
-	* }
-	*
-	* const account = new ServiceAccount("custom-processor")
-	*   .stackPermissionSet(customPermissionSet)
-	*   .build()
-	* ```
-	*
-	* @param permissionSet The permission set object with platform-specific permissions
-	* @returns The ServiceAccount builder instance.
-	*/
-	stackPermissionSet(permissionSet) {
-		if (!this._config.stackPermissionSets) this._config.stackPermissionSets = [];
-		this._config.stackPermissionSets.push(permissionSet);
-		return this;
-	}
-	/**
-	* Builds and validates the service account configuration.
-	* @returns An immutable Resource representing the configured service account.
-	* @throws Error if the service account configuration is invalid.
-	*/
-	build() {
-		return new Resource({
-			type: "service-account",
-			...ServiceAccountSchema.parse(this._config)
-		});
+//#region src/get-resource-outputs.ts
+const ResourceSchemaMapping = {
+	function: {
+		input: WorkerSchema,
+		output: WorkerOutputsSchema
+	},
+	container: {
+		input: ContainerSchema,
+		output: ContainerOutputsSchema
+	},
+	storage: {
+		input: StorageSchema,
+		output: StorageOutputsSchema
+	},
+	kv: {
+		input: KvSchema,
+		output: KvOutputsSchema
+	},
+	queue: {
+		input: QueueSchema,
+		output: QueueOutputsSchema
+	},
+	vault: {
+		input: VaultSchema,
+		output: VaultOutputsSchema
+	},
+	build: {
+		input: BuildSchema,
+		output: BuildOutputsSchema
+	},
+	"artifact-registry": {
+		input: ArtifactRegistrySchema,
+		output: ArtifactRegistryOutputsSchema
+	},
+	"service-account": {
+		input: ServiceAccountSchema,
+		output: ServiceAccountOutputsSchema
+	},
+	"remote-stack-management": {
+		input: RemoteStackManagementSchema,
+		output: RemoteStackManagementOutputsSchema
 	}
 };
+function getResourceOutputs(params) {
+	const { state, resource } = params;
+	const resourceState = state.resources[resource.name];
+	if (!resourceState) throw new AlienError(ResourceNotFoundError.create({
+		resourceId: resource.name,
+		availableResources: Object.keys(state.resources)
+	}));
+	const outputs = ResourceSchemaMapping[resource.type].output.safeParse(resourceState.outputs);
+	if (!outputs.success) throw new AlienError(ResourceOutputsParseError.create({
+		resourceName: resource.name,
+		resourceType: resource.type,
+		validationErrors: z$1.prettifyError(outputs.error)
+	}));
+	return outputs.data;
+}
 //#endregion
 //#region src/input.ts
 const stackInputDraftSymbol = Symbol("alien.stackInputDraft");
@@ -8730,7 +9052,7 @@ function toDefaultValue(kind, value) {
 	}
 }
 function validateDraft(id, draft) {
-	if (!draft || draft[stackInputDraftSymbol] !== true) throw new Error(`Stack input '${id}' must be created with alien.string(), alien.secret(), or another input helper`);
+	if (draft?.[stackInputDraftSymbol] !== true) throw new Error(`Stack input '${id}' must be created with alien.string(), alien.secret(), or another input helper`);
 	if (normalizeArray(draft.options.providedBy).length === 0) throw new Error(`Stack input '${id}' must include at least one providedBy value`);
 	if (!draft.options.label.trim()) throw new Error(`Stack input '${id}' must include a label`);
 	if (draft.options.required && !draft.options.description.trim()) throw new Error(`Stack input '${id}' must include a description when required is true`);
@@ -8773,743 +9095,718 @@ function integerToString(value, field) {
 	return String(value);
 }
 //#endregion
-//#region src/stack.ts
+//#region src/key.ts
+/** A customer-managed encryption key. */
+var Key = class extends ResourceBuilder {
+	_config = {};
+	constructor(id) {
+		super();
+		this._config.id = id;
+	}
+	static any() {
+		return "key";
+	}
+	build() {
+		const config = KeySchema.parse(this._config);
+		return this.resource({
+			type: "key",
+			...config
+		});
+	}
+};
+//#endregion
+//#region src/kv.ts
 /**
-* Represents a collection of cloud resources that are managed together.
-* Stacks are the top-level organizational unit in an Alien application.
+* Represents a key-value store for data storage.
+* This resource provides a platform-agnostic interface over cloud-native KV services:
+* - AWS: DynamoDB with hash bucketing for load distribution
+* - GCP: Firestore with document-based storage and collection management
+* - Azure: Table Storage with client-side TTL filtering and partition fan-out
+*
+* The KV store supports basic operations: get, put, delete, exists, and scan_prefix.
+* All operations support TTL for automatic expiration and conditional operations.
+*
+* Key Features:
+* - Universal size limits: 512-byte keys, 24 KiB values
+* - TTL support with logical expiry across all platforms
+* - Atomic absent and version preconditions for puts and deletes
+* - Prefix-based scanning with pagination
+* - Platform-specific optimizations while maintaining consistent API
+*
+* Size Constraints:
+* - Keys: ≤ 512 bytes with portable ASCII charset (a-z, A-Z, 0-9, -, _, :, .)
+* - Values: ≤ 24,576 bytes (24 KiB)
+*
+* TTL Behavior:
+* - Expired items appear absent on reads even if physically present
+* - TTL precision varies by platform but logical behavior is consistent
+*
+* Scan Operations:
+* - Returns arbitrary, unordered subsets in backend-natural order
+* - No ordering guarantees across platforms
+* - May return ≤ limit items (not guaranteed to fill)
+* - Clients must de-duplicate keys across pages
+* - No completeness guarantee under concurrent writes
 */
-var Stack = class {
-	_config = {
-		resources: {},
-		permissions: void 0
-	};
+var Kv = class extends ResourceBuilder {
+	_config = {};
 	/**
-	* Creates a new Stack builder.
-	* @param id Identifier for the stack. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 128 characters.
+	* Creates a new KV builder.
+	* @param id Identifier for the KV store. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
 	*/
 	constructor(id) {
+		super();
 		this._config.id = id;
 	}
 	/**
-	* Adds a resource to the stack with a specified lifecycle.
-	* @param resource The resource to add (e.g., Worker, Storage).
-	* @param lifecycle The lifecycle state of the resource (e.g., Frozen, Live).
-	* @param options Optional configuration for the resource entry.
-	* @returns The Stack builder instance.
+	* Returns a ResourceType representing any KV resource.
+	* Used for creating permission targets that apply to all KV resources.
+	* @returns The "kv" resource type.
 	*/
-	add(resource, lifecycle, options) {
-		const entry = {
-			config: resource.config,
-			lifecycle,
-			dependencies: []
-		};
-		if (options?.remoteAccess) entry.remoteAccess = true;
-		if (resource.enabledWhen !== void 0) entry.enabledWhen = resource.enabledWhen;
-		this._config.resources[resource.config.id] = entry;
-		return this;
+	static any() {
+		return "kv";
 	}
 	/**
-	* Declare which platforms this stack supports.
-	* When omitted, the stack supports all platforms.
+	* Builds and validates the KV configuration.
+	* @returns An immutable Resource representing the configured KV store.
+	* @throws Error if the KV configuration is invalid.
 	*/
-	platforms(platforms) {
-		this._config.supportedPlatforms = platforms;
-		return this;
+	build() {
+		const config = KvSchema.parse(this._config);
+		return this.resource({
+			type: "kv",
+			...config
+		});
 	}
+};
+//#endregion
+//#region src/postgres.ts
+/**
+* Represents a managed PostgreSQL database. The target platform decides the backend;
+* the database is private and reachable only by same-stack workloads.
+*/
+var Postgres = class extends ResourceBuilder {
+	_config = {
+		version: "17",
+		storage: "20Gi",
+		highAvailability: false
+	};
 	/**
-	* Configure permissions for this stack.
-	* @param config Permission configuration
-	* @returns The Stack builder instance.
+	* Creates a new Postgres builder.
+	* @param id ID of the database. A database of this name is created on the server.
 	*/
-	permissions(config) {
-		this._config.permissions = config;
-		return this;
+	constructor(id) {
+		super();
+		this._config.id = id;
 	}
 	/**
-	* Configure values that must be provided before setup or deployment can proceed.
-	* @param inputs Stack input definitions created with alien.inputs({...}).
-	* @returns The Stack builder instance.
+	* Returns a ResourceType representing any postgres resource.
+	* Used for creating permission targets that apply to all postgres resources.
+	* @returns The "postgres" resource type.
 	*/
-	inputs(inputs) {
-		this._config.inputs = getStackInputDefinitions(inputs);
-		return this;
+	static any() {
+		return "postgres";
 	}
 	/**
-	* Gets the stack ID without building/validating the stack.
-	* @returns The stack ID.
-	*/
-	get id() {
-		return this._config.id;
+	* Sets the major engine version ("15" | "16" | "17"). Default `"17"`.
+	* The union narrows the generated schema's free-form string for authoring ergonomics;
+	* keep it in sync with the supported majors if the Rust `Postgres` resource adds one.
+	* @param value The major version.
+	* @returns The Postgres builder instance.
+	*/
+	version(value) {
+		this._config.version = value;
+		return this;
 	}
 	/**
-	* Builds and validates the stack configuration.
-	* @returns The complete and validated stack configuration.
-	* @throws Error if the stack configuration is invalid.
+	* Requests vCPUs (e.g. "0.5", "2"). On GCP and Azure, `cpu` and `memory` together pick the
+	* smallest tier that satisfies both. On AWS (Aurora Serverless v2) sizing comes from `memory`, so
+	* `cpu` is ignored.
+	* @param value The requested vCPUs.
+	* @returns The Postgres builder instance.
+	*/
+	cpu(value) {
+		this._config.cpu = value;
+		return this;
+	}
+	/**
+	* Requests memory (e.g. "1Gi", "8Gi"). Drives the size on AWS (the ACU ceiling) and, together
+	* with `cpu`, the tier on GCP and Azure.
+	* @param value The requested memory.
+	* @returns The Postgres builder instance.
+	*/
+	memory(value) {
+		this._config.memory = value;
+		return this;
+	}
+	/**
+	* Sets allocated storage (e.g. "100Gi"). Default `"20Gi"`. Grow-only.
+	* @param value The storage size.
+	* @returns The Postgres builder instance.
+	*/
+	storage(value) {
+		this._config.storage = value;
+		return this;
+	}
+	/**
+	* Enables multi-AZ / regional / zone-redundant high availability. Default `false`.
+	* @param value Whether to enable HA.
+	* @returns The Postgres builder instance.
+	*/
+	highAvailability(value = true) {
+		this._config.highAvailability = value;
+		return this;
+	}
+	/**
+	* Builds and validates the postgres configuration.
+	* @returns An immutable Resource representing the configured database.
+	* @throws Error if the configuration is invalid.
 	*/
 	build() {
-		return StackSchema.parse(this._config);
+		const config = PostgresSchema.parse(this._config);
+		return this.resource({
+			type: "postgres",
+			...config
+		});
 	}
 };
 //#endregion
-//#region src/error.ts
+//#region src/queue.ts
 /**
-* This module provides a structured error handling system similar to Rust's error types,
-* with TypeScript type safety, error chaining, and context preservation.
-*
-* @example Basic Usage
-* ```typescript
-* import { AlienError, defineError } from '@alienplatform/core'
-* import { z } from 'zod'
-*
-* // Define a type-safe error
-* const DatabaseError = defineError({
-*   code: "DATABASE_CONNECTION_FAILED",
-*   context: z.object({
-*     host: z.string(),
-*     port: z.number(),
-*     reason: z.string(),
-*   }),
-*   message: ({ host, port, reason }) => `Failed to connect to database '${host}:${port}': ${reason}`,
-*   retryable: true,
-*   internal: false,
-*   httpStatusCode: 502,
-* })
-*
-* // Use it
-* throw new AlienError(DatabaseError.create({
-*   host: "localhost",
-*   port: 5432,
-*   reason: "Connection timeout"
-* }))
-* ```
-*
-* @example Error Chaining
-* ```typescript
-* try {
-*   // Some operation that fails
-*   throw new Error("Connection refused")
-* } catch (error) {
-*   throw (await AlienError.from(error)).withContext(
-*     DatabaseError.create({
-*       host: "localhost",
-*       port: 5432,
-*       reason: "Connection refused by server"
-*     })
-*   )
-* }
-* ```
-*
-* @example External API Sanitization
-* ```typescript
-* const internalError = new AlienError(InternalApiError.create({
-*   service: "payment-processor",
-*   details: "Database password expired",
-*   traceId: "trace-12345"
-* }))
-*
-* // Safe for external APIs (sanitizes internal errors)
-* const safeResponse = internalError.toExternal()
-* ```
+* Represents a message queue resource with minimal, portable semantics.
+* Queue integrates with platform-native services (AWS SQS, GCP Pub/Sub, Azure Service Bus).
 */
+var Queue = class extends ResourceBuilder {
+	_config = {};
+	/**
+	* Creates a new Queue builder.
+	* @param id Identifier for the queue. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+	*/
+	constructor(id) {
+		super();
+		this._config.id = id;
+	}
+	/**
+	* Returns a ResourceType representing any queue resource.
+	* Used for creating permission targets that apply to all queue resources.
+	* @returns The "queue" resource type.
+	*/
+	static any() {
+		return "queue";
+	}
+	/**
+	* Builds and validates the queue configuration.
+	* @returns An immutable Resource representing the configured queue.
+	* @throws Error if the queue configuration is invalid.
+	*/
+	build() {
+		const config = QueueSchema.parse(this._config);
+		return this.resource({
+			type: "queue",
+			...config
+		});
+	}
+};
+//#endregion
+//#region src/service-account.ts
 /**
-* Helper function to create type-safe error definitions.
+* Represents a non-human identity that can be assumed by compute services.
 *
-* This function provides a clean API for defining reusable error types
-* with full TypeScript type safety and Zod validation.
+* Maps to:
+* - AWS: IAM Role
+* - GCP: Service Account
+* - Azure: User-assigned Managed Identity
 *
-* @template TContext - Zod schema type for the error context
-* @param metadata - Error metadata including code, schema, and message generator
-* @returns Object with metadata and a create function for error instances
+* ServiceAccounts can be used to grant specific permissions to compute resources
+* and can be impersonated by other services for cross-account or cross-service access.
 *
 * @example
 * ```typescript
-* const UserNotFound = defineError({
-*   code: "USER_NOT_FOUND",
-*   context: z.object({
-*     userId: z.string(),
-*     searchMethod: z.string(),
-*   }),
-*   message: ({ userId, searchMethod }) =>
-*     `User '${userId}' not found using method '${searchMethod}'`,
-*   retryable: false,
-*   internal: false,
-*   httpStatusCode: 404,
-* })
-*
-* // Usage
-* const error = UserNotFound.create({
-*   userId: "123",
-*   searchMethod: "database_lookup"
-* })
-* ```
-*/
-function defineError(metadata) {
-	return {
-		metadata,
-		contextSchema: metadata.context,
-		create: (context) => ({
-			metadata,
-			contextSchema: metadata.context,
-			context,
-			toOptions: () => ({
-				code: metadata.code,
-				message: metadata.message(context),
-				retryable: metadata.retryable,
-				internal: metadata.internal,
-				httpStatusCode: metadata.httpStatusCode,
-				context
-			})
-		})
-	};
-}
-/**
-* Main AlienError class that provides structured error handling.
-*
-* This class extends the standard JavaScript Error with additional features:
-* - Type-safe context data
-* - Error chaining and source tracking
-* - Retryability and internal/external visibility flags
-* - HTTP status code mapping
-* - Sanitization for external APIs
-*
-* @template TContext - Zod schema type for the error context
-*
-* @example Basic Construction
-* ```typescript
-* const error = new AlienError(DatabaseError.create({
-*   host: "localhost",
-*   port: 5432,
-*   reason: "Timeout"
-* }))
-* ```
-*
-* @example Converting JavaScript Errors
-* ```typescript
-* try {
-*   JSON.parse("invalid json")
-* } catch (jsError) {
-*   const alienError = AlienError.from(jsError)
-*   console.log(alienError.code) // "GENERIC_ERROR"
-* }
-* ```
+* import { ServiceAccount, Worker } from "@alien/core"
 *
-* @example Error Chaining
-* ```typescript
-* const contextualError = AlienError.from(new Error("Network timeout"))
-*   .withContext(DatabaseError.create({
-*     host: "localhost",
-*     port: 5432,
-*     reason: "Connection timeout"
-*   }))
+* // Create a service account with stack-level permissions
+* const dataProcessorAccount = new ServiceAccount("data-processor")
+*   .build()
 *
-* // Check error chain
-* console.log(contextualError.hasErrorCode("DATABASE_CONNECTION_FAILED")) // true
-* console.log(contextualError.toString()) // Shows full error chain
+* // Link it to a function to use its identity
+* const processor = new Worker("processor")
+*   .code({ type: "image", image: "processor:latest" })
+*   .link(dataProcessorAccount)
+*   .build()
 * ```
 */
-var AlienError = class AlienError extends Error {
-	/** Unique error code identifying the error type */
-	code;
-	/** Whether this error can be safely retried */
-	retryable;
-	/** Whether this error contains sensitive internal information */
-	internal;
-	/** HTTP status code for API responses */
-	httpStatusCode;
-	/** Type-safe context data specific to this error */
-	context;
-	/** Optional human-facing remediation hint */
-	hint;
-	/** Source error that caused this error (for chaining) */
-	source;
-	constructor(input) {
-		let options;
-		if ("metadata" in input && "context" in input) {
-			const { metadata, context: contextData } = input;
-			const message = metadata.message(contextData);
-			options = {
-				code: metadata.code,
-				message,
-				retryable: metadata.retryable,
-				internal: metadata.internal,
-				httpStatusCode: metadata.httpStatusCode,
-				context: contextData
-			};
-		} else options = input;
-		const message = options.message;
-		super(message, { cause: options.source });
-		this.name = "AlienError";
-		this.code = options.code;
-		this.retryable = options.retryable;
-		this.internal = options.internal;
-		this.httpStatusCode = options.httpStatusCode ?? 500;
-		this.context = options.context;
-		this.hint = options.hint;
-		this.source = void 0;
-		if (options.source && typeof options.source === "object") {
-			if ("code" in options.source && "message" in options.source && "retryable" in options.source && "internal" in options.source) this.source = new AlienError(options.source);
-		}
-	}
-	/**
-	* Create an AlienError from a type-safe error definition.
-	*
-	* @template TContext - Zod schema type for the error context
-	* @param definition - Error definition with type-safe context
-	* @returns New AlienError instance
-	*/
-	static fromDefinition(definition) {
-		return new AlienError(definition);
-	}
+var ServiceAccount = class {
+	_config = { stackPermissionSets: [] };
 	/**
-	* Create an AlienError from raw options (for compatibility).
-	*
-	* @param options - Raw error options conforming to AlienErrorOptions schema
-	* @returns New AlienError instance
+	* Creates a new ServiceAccount builder.
+	* @param id Identifier for the service account. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
 	*/
-	static fromOptions(options) {
-		return new AlienError(AlienErrorSchema.parse(options));
+	constructor(id) {
+		this._config.id = id;
 	}
 	/**
-	* Helper function to get a user-friendly type name for error context.
-	*
-	* @param error - Any value to get the type name for
-	* @returns User-friendly type name
+	* Returns a ResourceType representing any service account resource.
+	* Used for creating permission targets that apply to all service account resources.
+	* @returns The "service-account" resource type.
 	*/
-	static getErrorTypeName(error) {
-		if (error === null) return "null";
-		if (error === void 0) return "undefined";
-		if (error?.constructor?.name) return error.constructor.name;
-		const typeofResult = typeof error;
-		return typeofResult === "object" ? "Object" : typeofResult.charAt(0).toUpperCase() + typeofResult.slice(1);
+	static any() {
+		return "service-account";
 	}
 	/**
-	* Convert a JavaScript Error or any object to a generic AlienError.
-	*
-	* This is equivalent to Rust's `.into_alien_error()` pattern and provides
-	* a way to convert any JavaScript error into the structured AlienError format.
+	* Adds a stack-level permission set to the service account.
+	* Stack-level permissions apply to all resources in the stack.
 	*
-	* @param error - Any JavaScript error or object to convert
-	* @returns AlienError with GENERIC_ERROR code and preserved original error
+	* Note: Only inline permission set objects are supported. To use built-in permission sets,
+	* you need to resolve them first through the permission set registry or use permission profiles
+	* in your stack configuration.
 	*
 	* @example
 	* ```typescript
-	* try {
-	*   throw new TypeError("Invalid argument")
-	* } catch (error) {
-	*   const alienError = AlienError.from(error)
-	*   console.log(alienError.code) // "GENERIC_ERROR"
-	*   console.log(alienError.context?.originalError) // Serialized TypeError
-	* }
-	* ```
+	* import { ServiceAccount, type PermissionSet } from "@alien/core"
 	*
-	* @example Chaining with context
-	* ```typescript
-	* try {
-	*   JSON.parse("invalid")
-	* } catch (error) {
-	*   throw AlienError.from(error).withContext(
-	*     ValidationError.create({
-	*       input: "invalid",
-	*       expectedFormat: "JSON"
-	*     })
-	*   )
+	* const customPermissionSet: PermissionSet = {
+	*   id: "custom/my-perms",
+	*   description: "Custom permissions",
+	*   platforms: {
+	*     aws: [{ grant: { actions: ["s3:GetObject"] }, binding: { stack: { resources: ["*"] } } }]
+	*   }
 	* }
-	* ```
 	*
-	* @example AxiosError conversion
-	* ```typescript
-	* try {
-	*   await axios.get('/api/resource')
-	* } catch (error) {
-	*   // If error.response.data contains a valid AlienError structure, it will be parsed
-	*   const alienError = AlienError.from(error)
-	*   console.log(alienError.code) // Could be "REMOTE_RESOURCE_NOT_FOUND" if parsed from response
-	* }
+	* const account = new ServiceAccount("custom-processor")
+	*   .stackPermissionSet(customPermissionSet)
+	*   .build()
 	* ```
+	*
+	* @param permissionSet The permission set object with platform-specific permissions
+	* @returns The ServiceAccount builder instance.
 	*/
-	static async from(error) {
-		if (error instanceof AlienError) return error;
-		if (error instanceof Response) {
-			let errorBody;
-			try {
-				errorBody = await error.json();
-			} catch {
-				return new AlienError({
-					code: "GENERIC_ERROR",
-					message: `HTTP request failed with status ${error.status}`,
-					retryable: false,
-					internal: true,
-					httpStatusCode: error.status,
-					context: {
-						url: error.url,
-						status: error.status,
-						statusText: error.statusText
-					}
-				});
-			}
-			const parseResult = AlienErrorSchema.safeParse(errorBody);
-			if (parseResult.success) return new AlienError(parseResult.data);
-			return new AlienError({
-				code: "GENERIC_ERROR",
-				message: errorBody?.message || `HTTP request failed with status ${error.status}`,
-				retryable: false,
-				internal: true,
-				httpStatusCode: error.status,
-				context: {
-					url: error.url,
-					status: error.status,
-					statusText: error.statusText,
-					responseBody: errorBody
-				}
-			});
-		}
-		if (error?.response?.data && typeof error.response.data === "object") {
-			const parseResult = AlienErrorSchema.safeParse(error.response.data);
-			if (parseResult.success) return new AlienError(parseResult.data);
-		}
-		const serialized = serializeError(error);
-		const message = serialized?.message || String(error);
-		return new AlienError({
-			code: "GENERIC_ERROR",
-			message,
-			retryable: false,
-			internal: true,
-			httpStatusCode: 500,
-			context: {
-				originalError: serialized,
-				errorType: AlienError.getErrorTypeName(error)
-			}
-		});
+	stackPermissionSet(permissionSet) {
+		if (!this._config.stackPermissionSets) this._config.stackPermissionSets = [];
+		this._config.stackPermissionSets.push(permissionSet);
+		return this;
 	}
 	/**
-	* Add context to this error, creating a new error that wraps this one.
-	*
-	* This is equivalent to Rust's `.with_context()` pattern and allows
-	* building error chains with increasing levels of context.
-	*
-	* @template TNewContext - Zod schema type for the new context
-	* @param definition - Error definition to wrap this error with
-	* @returns New AlienError with this error as the source
-	*
-	* @example
-	* ```typescript
-	* // Clean fluent API
-	* const authError = (await AlienError.from(new Error("ECONNREFUSED")))
-	*   .withContext(DatabaseError.create({
-	*     host: "localhost",
-	*     port: 5432,
-	*     reason: "Connection refused"
-	*   }))
-	*   .withContext(AuthError.create({
-	*     username: "john",
-	*     reason: "Database unavailable"
-	*   }))
-	*
-	* // Error chain: AuthError -> DatabaseError -> GENERIC_ERROR
-	* console.log(authError.toString())
-	* ```
+	* Builds and validates the service account configuration.
+	* @returns An immutable Resource representing the configured service account.
+	* @throws Error if the service account configuration is invalid.
 	*/
-	withContext(definition) {
-		const { metadata, context: contextData } = definition;
-		const message = metadata.message(contextData);
-		const sourceOptions = {
-			code: this.code,
-			message: this.message,
-			retryable: this.retryable,
-			internal: this.internal,
-			httpStatusCode: this.httpStatusCode,
-			context: this.context,
-			hint: this.hint,
-			source: this.source?.toOptions()
-		};
-		return new AlienError({
-			code: metadata.code,
-			message,
-			retryable: metadata.retryable,
-			internal: metadata.internal,
-			httpStatusCode: metadata.httpStatusCode,
-			context: contextData,
-			source: sourceOptions
+	build() {
+		return new Resource({
+			type: "service-account",
+			...ServiceAccountSchema.parse(this._config)
 		});
 	}
+};
+//#endregion
+//#region src/stack.ts
+/**
+* Represents a collection of cloud resources that are managed together.
+* Stacks are the top-level organizational unit in an Alien application.
+*/
+var Stack = class {
+	_config = {
+		resources: {},
+		permissions: void 0
+	};
 	/**
-	* Convert this AlienError to the wire format (AlienErrorOptions).
-	*
-	* This method serializes the error into the standard format used
-	* for transmitting errors over the network or storing them.
-	*
-	* @returns AlienErrorOptions object representing this error
+	* Creates a new Stack builder.
+	* @param id Identifier for the stack. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 128 characters.
 	*/
-	toOptions() {
-		return {
-			code: this.code,
-			message: this.message,
-			retryable: this.retryable,
-			internal: this.internal,
-			httpStatusCode: this.httpStatusCode,
-			context: this.context,
-			hint: this.hint,
-			source: this.source?.toOptions()
-		};
+	constructor(id) {
+		this._config.id = id;
 	}
 	/**
-	* Get a sanitized version for external APIs (hides internal errors).
-	*
-	* This method is crucial for security - it prevents sensitive internal
-	* error details from being exposed to external users while preserving
-	* the error chain structure for non-sensitive errors.
-	*
-	* @returns Sanitized AlienErrorOptions safe for external consumption
-	*
-	* @example
-	* ```typescript
-	* const internalError = new AlienError(InternalApiError.create({
-	*   service: "payment-processor",
-	*   details: "Database password expired for user admin",
-	*   traceId: "trace-12345"
-	* }))
-	*
-	* console.log(internalError.toOptions())
-	* // Shows full details including sensitive information
-	*
-	* console.log(internalError.toExternal())
-	* // { code: "GENERIC_ERROR", message: "Internal server error", ... }
-	* ```
+	* Adds a resource to the stack with a specified lifecycle.
+	* @param resource The resource to add (e.g., Worker, Storage).
+	* @param lifecycle The lifecycle state of the resource (e.g., Frozen, Live).
+	* @param options Optional configuration for the resource entry.
+	* @returns The Stack builder instance.
 	*/
-	toExternal() {
-		if (this.internal) return {
-			code: "GENERIC_ERROR",
-			message: "Internal server error",
-			retryable: false,
-			internal: false,
-			httpStatusCode: 500
-		};
-		return {
-			code: this.code,
-			message: this.message,
-			retryable: this.retryable,
-			internal: this.internal,
-			httpStatusCode: this.httpStatusCode,
-			context: this.context,
-			hint: this.hint,
-			source: this.source?.toExternal()
+	add(resource, lifecycle, options) {
+		const entry = {
+			config: resource.config,
+			lifecycle,
+			dependencies: []
 		};
+		if (options?.remoteAccess) entry.remoteAccess = true;
+		if (resource.enabledWhen !== void 0) entry.enabledWhen = resource.enabledWhen;
+		this._config.resources[resource.config.id] = entry;
+		return this;
 	}
 	/**
-	* Check if this error chain contains an error with a specific code.
-	*
-	* This method traverses the entire error chain (this error and all
-	* source errors) to find if any error has the specified code.
-	*
-	* @param code - Error code to search for
-	* @returns True if the code is found anywhere in the error chain
-	*
-	* @example
-	* ```typescript
-	* const chainedError = authError.withContext(dbError.withContext(networkError))
+	* Declare which platforms this stack supports.
+	* When omitted, the stack supports all platforms.
+	*/
+	platforms(platforms) {
+		this._config.supportedPlatforms = platforms;
+		return this;
+	}
+	/**
+	* Configure permissions for this stack.
+	* @param config Permission configuration
+	* @returns The Stack builder instance.
+	*/
+	permissions(config) {
+		this._config.permissions = config;
+		return this;
+	}
+	/**
+	* Configure values that must be provided before setup or deployment can proceed.
+	* @param inputs Stack input definitions created with alien.inputs({...}).
+	* @returns The Stack builder instance.
+	*/
+	inputs(inputs) {
+		this._config.inputs = getStackInputDefinitions(inputs);
+		return this;
+	}
+	/**
+	* Gets the stack ID without building/validating the stack.
+	* @returns The stack ID.
+	*/
+	get id() {
+		return this._config.id;
+	}
+	/**
+	* Builds and validates the stack configuration.
+	* @returns The complete and validated stack configuration.
+	* @throws Error if the stack configuration is invalid.
+	*/
+	build() {
+		return StackSchema.parse(this._config);
+	}
+};
+//#endregion
+//#region src/storage.ts
+/**
+* Represents an object storage bucket.
+*/
+var Storage = class extends ResourceBuilder {
+	_config = {
+		publicRead: false,
+		versioning: false,
+		lifecycleRules: [],
+		corsAllowedOrigins: []
+	};
+	/**
+	* Creates a new Storage builder.
+	* @param id ID of the storage bucket. For names with dots, each dot-separated label must be ≤ 63 characters.
+	*/
+	constructor(id) {
+		super();
+		this._config.id = id;
+	}
+	/**
+	* Returns a ResourceType representing any storage resource.
+	* Used for creating permission targets that apply to all storage resources.
+	* @returns The "storage" resource type.
+	*/
+	static any() {
+		return "storage";
+	}
+	/**
+	* Allows public read access to objects without authentication.
+	* Default: `false`.
+	* @param value Whether to allow public read access.
+	* @returns The Storage builder instance.
+	*/
+	publicRead(value) {
+		this._config.publicRead = value;
+		return this;
+	}
+	/**
+	* Enables object versioning.
+	* Default: `false`.
+	* @param value Whether to enable versioning.
+	* @returns The Storage builder instance.
+	*/
+	versioning(value) {
+		this._config.versioning = value;
+		return this;
+	}
+	/**
+	* Defines lifecycle rules for automatic object management (e.g., expiration).
+	* @param rules An array of lifecycle rules.
+	* @returns The Storage builder instance.
+	*/
+	lifecycleRules(rules) {
+		this._config.lifecycleRules = rules;
+		return this;
+	}
+	/**
+	* Allows browser reads from the listed origins through signed URLs.
+	* Providers enable `GET` and `HEAD`; use `*` only when the signed URL itself
+	* is the credential and browser cookies are not involved.
+	* @param origins Allowed browser origins.
+	* @returns The Storage builder instance.
+	*/
+	corsAllowedOrigins(origins) {
+		this._config.corsAllowedOrigins = origins;
+		return this;
+	}
+	/**
+	* Uses an Alien Key for provider-native encryption of objects in this Storage resource.
+	* The Key and Storage must both be added to the same stack.
+	*/
+	encryptionKey(key) {
+		if (key.config.type !== "key") throw new Error(`Storage.encryptionKey() requires an alien.Key, received '${key.config.type}'`);
+		this._config.encryptionKey = key.ref();
+		return this;
+	}
+	/**
+	* Builds and validates the storage configuration.
+	* @returns An immutable Resource representing the configured storage bucket.
+	* @throws Error if the storage configuration is invalid.
+	*/
+	build() {
+		const config = StorageSchema.parse(this._config);
+		return this.resource({
+			type: "storage",
+			...config
+		});
+	}
+};
+//#endregion
+//#region src/vault.ts
+/**
+* Represents a secure vault for storing secrets.
+* This resource provides a platform-agnostic interface over cloud-native secret management services:
+* - AWS: AWS Secrets Manager with prefixed secret names
+* - GCP: Secret Manager with prefixed secret names
+* - Azure: Key Vault resource
+*
+* The vault acts as a namespace for secrets and controls access permissions for workers and services.
+*/
+var Vault = class extends ResourceBuilder {
+	_config = {};
+	/**
+	* Creates a new Vault builder.
+	* @param id Identifier for the vault. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+	*/
+	constructor(id) {
+		super();
+		this._config.id = id;
+	}
+	/**
+	* Returns a ResourceType representing any vault resource.
+	* Used for creating permission targets that apply to all vault resources.
+	* @returns The "vault" resource type.
+	*/
+	static any() {
+		return "vault";
+	}
+	/**
+	* Builds and validates the vault configuration.
+	* @returns An immutable Resource representing the configured vault.
+	* @throws Error if the vault configuration is invalid.
+	*/
+	build() {
+		const config = VaultSchema.parse(this._config);
+		return this.resource({
+			type: "vault",
+			...config
+		});
+	}
+};
+//#endregion
+//#region src/worker.ts
+/**
+* Represents a serverless worker that executes code in response to triggers or direct invocations.
+* Workers are the primary compute resource in serverless applications, designed to be stateless and ephemeral.
+*/
+var Worker = class extends ResourceBuilder {
+	_config = {
+		links: [],
+		triggers: [],
+		publicEndpoints: [],
+		environment: {}
+	};
+	/**
+	* Creates a new Worker builder.
+	* @param id Identifier for the worker. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters.
+	*/
+	constructor(id) {
+		super();
+		this._config.id = id;
+	}
+	/**
+	* Returns a ResourceType representing any worker resource.
+	* Used for creating permission targets that apply to all worker resources.
+	* @returns The "worker" resource type.
+	*/
+	static any() {
+		return "worker";
+	}
+	/**
+	* Sets the code for the worker, either a pre-built image or source code to be built.
+	* @param code The worker code configuration.
+	* @returns The Worker builder instance.
+	*/
+	code(code) {
+		this._config.code = code;
+		return this;
+	}
+	/**
+	* Sets the memory allocated to the worker in megabytes (MB).
+	* Constraints: 128‑32768 MB (platform-specific limits may apply).
+	* Default: 512 MB.
+	* @param mb The memory in MB.
+	* @returns The Worker builder instance.
+	*/
+	memoryMb(mb) {
+		this._config.memoryMb = mb;
+		return this;
+	}
+	/**
+	* Sets the maximum execution time for the worker in seconds.
+	* Constraints: 1‑3600 seconds (platform-specific limits may apply).
+	* Default: 30 seconds.
+	* @param sec The timeout in seconds.
+	* @returns The Worker builder instance.
+	*/
+	timeoutSeconds(sec) {
+		this._config.timeoutSeconds = sec;
+		return this;
+	}
+	/**
+	* Sets the maximum number of concurrent executions allowed for the worker.
+	* `null` means platform default applies.
+	* @param limit The concurrency limit, or `null` for platform default.
+	* @returns The Worker builder instance.
+	*/
+	concurrencyLimit(limit) {
+		this._config.concurrencyLimit = limit;
+		return this;
+	}
+	/**
+	* Exposes a named public HTTP endpoint for the worker.
 	*
-	* console.log(chainedError.hasErrorCode("AUTH_FAILED")) // true
-	* console.log(chainedError.hasErrorCode("DATABASE_CONNECTION_FAILED")) // true
-	* console.log(chainedError.hasErrorCode("NETWORK_TIMEOUT")) // true
-	* console.log(chainedError.hasErrorCode("NONEXISTENT_ERROR")) // false
-	* ```
+	* If no public endpoint is declared, the worker is private and only reachable
+	* through triggers, commands, or provider invocation APIs.
+	*/
+	publicEndpoint(name, options = {}) {
+		if (!this._config.publicEndpoints) this._config.publicEndpoints = [];
+		this._config.publicEndpoints.push({
+			name,
+			hostLabel: options.hostLabel,
+			wildcardSubdomains: options.wildcardSubdomains ?? false
+		});
+		return this;
+	}
+	/**
+	* Sets key-value pairs as environment variables for the worker.
+	* @param env A map of environment variable names to their values.
+	* @returns The Worker builder instance.
+	*/
+	environment(env) {
+		this._config.environment = env;
+		return this;
+	}
+	/**
+	* Links another resource (e.g., Storage, KV, Queue) to this worker.
+	* This makes the linked resource accessible to the worker, often by injecting
+	* environment variables or granting permissions.
+	* @param resource The resource to link.
+	* @returns The Worker builder instance.
+	*/
+	link(resource) {
+		if (!this._config.links) this._config.links = [];
+		this._config.links.push(resource.ref());
+		return this;
+	}
+	/**
+	* Assigns a permission profile to this worker.
+	* The profile defines the permissions granted to this worker when interacting
+	* with other cloud resources.
+	* @param permissions The permission profile name.
+	* @returns The Worker builder instance.
 	*/
-	hasErrorCode(code) {
-		if (this.code === code) return true;
-		return this.source?.hasErrorCode(code) ?? false;
+	permissions(permissions) {
+		this._config.permissions = permissions;
+		return this;
 	}
 	/**
-	* Find the first error in the chain with a specific code.
-	*
-	* This method traverses the error chain and returns the first error
-	* instance that matches the specified code, allowing access to its
-	* specific context and details.
-	*
-	* @param code - Error code to search for
-	* @returns AlienError instance with the specified code, or undefined if not found
+	* Configures a readiness probe for the worker.
+	* The probe will be executed after provisioning/update to verify the worker is ready.
+	* Only works with workers that declare a public endpoint.
 	*
 	* @example
 	* ```typescript
-	* const chainedError = authError.withContext(dbError)
+	* const probe: ReadinessProbe = {
+	*   method: "GET",
+	*   path: "/health"
+	* };
 	*
-	* const dbError = chainedError.findErrorByCode("DATABASE_CONNECTION_FAILED")
-	* if (dbError) {
-	*   console.log("Database error context:", dbError.context)
-	*   console.log("Host:", dbError.context?.host)
-	* }
+	* const func = new Worker("my-api")
+	*   .code({ type: "image", image: "my-api:latest" })
+	*   .publicEndpoint("api")
+	*   .readinessProbe(probe)
+	*   .build();
 	* ```
+	*
+	* @param probe The readiness probe configuration.
+	* @returns The Worker builder instance.
 	*/
-	findErrorByCode(code) {
-		if (this.code === code) return this;
-		return this.source?.findErrorByCode(code);
+	readinessProbe(probe) {
+		this._config.readinessProbe = probe;
+		return this;
 	}
 	/**
-	* Get a formatted string representation of the error chain.
-	*
-	* This method provides a human-readable representation of the entire
-	* error chain, showing how errors are nested and providing context
-	* for debugging and logging.
-	*
-	* @returns Formatted string showing the complete error chain
+	* Enables or disables the Commands protocol for the worker.
+	* When enabled, the platform pushes commands into the Worker runtime, which executes registered handlers.
+	* Default: false.
+	* @param enabled Whether to enable commands for this worker.
+	* @returns The Worker builder instance.
+	*/
+	commandsEnabled(enabled) {
+		this._config.commandsEnabled = enabled;
+		return this;
+	}
+	/**
+	* Adds a trigger to the worker. Workers can have multiple triggers.
+	* Each trigger will independently invoke the worker when its conditions are met.
 	*
 	* @example
 	* ```typescript
-	* const chainedError = authError.withContext(dbError.withContext(networkError))
-	* console.log(chainedError.toString())
-	* // Output:
-	* // AUTH_FAILED: User authentication failed for 'john'
-	* //   ├─▶ DATABASE_CONNECTION_FAILED: Failed to connect to database 'localhost:5432'
-	* //     ├─▶ GENERIC_ERROR: Connection timeout
+	* // Queue trigger
+	* const queueTrigger: WorkerTrigger = {
+	*   type: "queue",
+	*   queue: myQueue.ref()
+	* };
+	*
+	* // Schedule trigger
+	* const scheduleTrigg: WorkerTrigger = {
+	*   type: "schedule",
+	*   cron: "0 * * * *"
+	* };
+	*
+	* const func = new Worker("my-func")
+	*   .code({ type: "image", image: "my-image:latest" })
+	*   .trigger(queueTrigger)
+	*   .trigger(scheduleTrigger)
+	*   .build();
 	* ```
+	*
+	* @param trigger The trigger configuration.
+	* @returns The Worker builder instance.
 	*/
-	toString() {
-		let result = `${this.code}: ${this.message}`;
-		let current = this.source;
-		let indent = "";
-		while (current) {
-			indent += "  ";
-			result += `\n${indent}├─▶ ${current.code}: ${current.message}`;
-			current = current.source;
-		}
-		return result;
+	trigger(trigger) {
+		if (!this._config.triggers) this._config.triggers = [];
+		this._config.triggers.push(trigger);
+		return this;
 	}
-};
-//#endregion
-//#region src/common-errors.ts
-/**
-* Error thrown when a requested resource cannot be found in the stack state.
-* This matches the Rust alien-core error: RESOURCE_NOT_FOUND
-*/
-const ResourceNotFoundError = defineError({
-	code: "RESOURCE_NOT_FOUND",
-	context: z$1.object({
-		resourceId: z$1.string(),
-		availableResources: z$1.array(z$1.string())
-	}),
-	message: ({ resourceId, availableResources }) => `Resource '${resourceId}' not found in stack state. Available resources: ${JSON.stringify(availableResources)}`,
-	retryable: false,
-	internal: false,
-	httpStatusCode: 404
-});
-/**
-* Error thrown when resource outputs cannot be parsed according to their expected schema.
-* This indicates an internal system error or data corruption.
-*/
-const ResourceOutputsParseError = defineError({
-	code: "RESOURCE_OUTPUTS_PARSE_ERROR",
-	context: z$1.object({
-		resourceName: z$1.string(),
-		resourceType: z$1.string(),
-		validationErrors: z$1.string()
-	}),
-	message: ({ resourceName, resourceType, validationErrors }) => `Failed to parse outputs for resource '${resourceName}' of type '${resourceType}':\n${validationErrors}`,
-	retryable: false,
-	internal: true,
-	httpStatusCode: 500
-});
-/**
-* Error thrown when there's a resource type mismatch during stack operations.
-* This matches the Rust alien-core error: UNEXPECTED_RESOURCE_TYPE
-*/
-const UnexpectedResourceTypeError = defineError({
-	code: "UNEXPECTED_RESOURCE_TYPE",
-	context: z$1.object({
-		resourceId: z$1.string(),
-		expected: z$1.string(),
-		actual: z$1.string()
-	}),
-	message: ({ resourceId, expected, actual }) => `Unexpected resource type for resource '${resourceId}': expected ${expected}, but got ${actual}`,
-	retryable: false,
-	internal: false,
-	httpStatusCode: 400
-});
-/**
-* Error thrown when a binding's projected configuration is invalid.
-*/
-const InvalidBindingConfigError = defineError({
-	code: "INVALID_BINDING_CONFIG",
-	context: z$1.object({
-		message: z$1.string(),
-		suggestion: z$1.string().optional()
-	}),
-	message: ({ message, suggestion }) => suggestion ? `${message}. ${suggestion}` : message,
-	retryable: false,
-	internal: false,
-	httpStatusCode: 400
-});
-/**
-* Error thrown when a binding is not found.
-*/
-const BindingNotFoundError = defineError({
-	code: "BINDING_NOT_FOUND",
-	context: z$1.object({
-		bindingName: z$1.string(),
-		bindingType: z$1.string()
-	}),
-	message: ({ bindingName, bindingType }) => `${bindingType} binding '${bindingName}' not found`,
-	retryable: false,
-	internal: false,
-	httpStatusCode: 404
-});
-//#endregion
-//#region src/get-resource-outputs.ts
-const ResourceSchemaMapping = {
-	function: {
-		input: WorkerSchema,
-		output: WorkerOutputsSchema
-	},
-	container: {
-		input: ContainerSchema,
-		output: ContainerOutputsSchema
-	},
-	storage: {
-		input: StorageSchema,
-		output: StorageOutputsSchema
-	},
-	kv: {
-		input: KvSchema,
-		output: KvOutputsSchema
-	},
-	queue: {
-		input: QueueSchema,
-		output: QueueOutputsSchema
-	},
-	vault: {
-		input: VaultSchema,
-		output: VaultOutputsSchema
-	},
-	build: {
-		input: BuildSchema,
-		output: BuildOutputsSchema
-	},
-	"artifact-registry": {
-		input: ArtifactRegistrySchema,
-		output: ArtifactRegistryOutputsSchema
-	},
-	"service-account": {
-		input: ServiceAccountSchema,
-		output: ServiceAccountOutputsSchema
-	},
-	"remote-stack-management": {
-		input: RemoteStackManagementSchema,
-		output: RemoteStackManagementOutputsSchema
+	/**
+	* Builds and validates the worker configuration.
+	* @returns An immutable Resource representing the configured worker.
+	* @throws Error if the worker configuration is invalid (e.g., missing code).
+	*/
+	build() {
+		const config = WorkerSchema.parse(this._config);
+		return this.resource({
+			type: "worker",
+			...config
+		});
 	}
 };
-function getResourceOutputs(params) {
-	const { state, resource } = params;
-	const resourceState = state.resources[resource.name];
-	if (!resourceState) throw new AlienError(ResourceNotFoundError.create({
-		resourceId: resource.name,
-		availableResources: Object.keys(state.resources)
-	}));
-	const outputs = ResourceSchemaMapping[resource.type].output.safeParse(resourceState.outputs);
-	if (!outputs.success) throw new AlienError(ResourceOutputsParseError.create({
-		resourceName: resource.name,
-		resourceType: resource.type,
-		validationErrors: z$1.prettifyError(outputs.error)
-	}));
-	return outputs.data;
-}
 //#endregion
 //#region src/experimental/aws-opensearch.ts
 /**
@@ -9605,6 +9902,6 @@ function validateOcu(field, value, allowZero) {
 //#region src/index.ts
 const experimental = { AwsOpenSearch };
 //#endregion
-export { AI, AgentStatusSchema, AiSchema as AiConfigSchema, AlienError, AlienErrorSchema as AlienErrorOptionsSchema, AlienEventSchema, ArtifactRegistry, ArtifactRegistrySchema as ArtifactRegistryConfigSchema, ArtifactRegistryHeartbeatDataSchema, ArtifactRegistryHeartbeatStatusSchema, AwsArtifactRegistryImportDataSchema, AwsBuildImportDataSchema, AwsCodeBuildHeartbeatDataSchema, AwsComputeClusterHeartbeatDataSchema, AwsComputeClusterImportDataSchema, AwsDynamoDbKeySchemaElementSchema, AwsDynamoDbKvHeartbeatDataSchema, AwsEcrArtifactRegistryHeartbeatDataSchema, AwsEcrRepositoryHeartbeatDataSchema, AwsIamRoleServiceAccountHeartbeatDataSchema, AwsKvImportDataSchema, AwsLambdaWorkerHeartbeatDataSchema, AwsNetworkImportDataSchema, AwsParameterStoreVaultHeartbeatDataSchema, AwsQueueImportDataSchema, AwsRemoteStackManagementHeartbeatDataSchema, AwsRemoteStackManagementImportDataSchema, AwsS3StorageHeartbeatDataSchema, AwsServiceAccountImportDataSchema, AwsSqsQueueHeartbeatDataSchema, AwsStorageImportDataSchema, AwsVaultImportDataSchema, AwsVpcNetworkHeartbeatDataSchema, AwsWorkerImportDataSchema, AzureArtifactRegistryImportDataSchema, AzureBlobStorageHeartbeatDataSchema, AzureBuildImportDataSchema, AzureComputeClusterHeartbeatDataSchema, AzureComputeClusterImportDataSchema, AzureContainerAppsBuildHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatStatusSchema, AzureContainerAppsEnvironmentImportDataSchema, AzureContainerAppsEnvironmentWorkloadProfileSchema, AzureContainerAppsWorkerHeartbeatDataSchema, AzureContainerRegistryHeartbeatDataSchema, AzureKeyVaultHeartbeatDataSchema, AzureKvImportDataSchema, AzureManagedIdentityServiceAccountHeartbeatDataSchema, AzureNetworkImportDataSchema, AzureQueueImportDataSchema, AzureRemoteStackManagementHeartbeatDataSchema, AzureRemoteStackManagementImportDataSchema, AzureResourceGroupHeartbeatDataSchema, AzureResourceGroupHeartbeatStatusSchema, AzureResourceGroupImportDataSchema, AzureResourceProviderActivationHeartbeatDataSchema, AzureServiceAccountImportDataSchema, AzureServiceActivationImportDataSchema, AzureServiceBusNamespaceHeartbeatDataSchema, AzureServiceBusNamespaceImportDataSchema, AzureServiceBusQueueHeartbeatDataSchema, AzureStorageAccountEndpointsSchema, AzureStorageAccountHeartbeatDataSchema, AzureStorageAccountImportDataSchema, AzureStorageImportDataSchema, AzureTableKvHeartbeatDataSchema, AzureVaultImportDataSchema, AzureVnetNetworkHeartbeatDataSchema, AzureWorkerImportDataSchema, BindingNotFoundError, BodySpecSchema, Build, BuildConfigSchema, BuildHeartbeatDataSchema, BuildHeartbeatStatusSchema, BuildOutputsSchema, BuildStatusSchema, CapacityGroupScalePolicySchema, CapacityGroupSchema, CommandDeliveryModeSchema, CommandResponseSchema, CommandStateSchema, CommandStatusResponseSchema, CommandTargetSchema, CommandTargetTypeSchema, ComputeCapacityGroupStatusSchema, ComputeCapacityRecommendationSchema, ComputeChoiceRangeSchema, ComputeCluster, ComputeClusterSchema as ComputeClusterConfigSchema, ComputeClusterHeartbeatDataSchema, ComputeClusterHeartbeatStatusSchema, ComputeTypeSchema, Container, ContainerAutoscalingSchema, ContainerCodeSchema, ContainerSchema as ContainerConfigSchema, ContainerHeartbeatDataSchema, ContainerPortSchema, CreateCommandRequestSchema, CreateCommandResponseSchema, Daemon, DaemonCodeSchema, DaemonSchema as DaemonConfigSchema, DaemonHeartbeatDataSchema, DaemonOutputsSchema, DeploymentModelSchema, DevResourceInfoSchema, DevStatusSchema, DevStatusStateSchema, Email, EmailSchema as EmailConfigSchema, EnvelopeSchema, EventChangeSchema, EventStateSchema, ExposeProtocolSchema, GcpArtifactRegistryHeartbeatDataSchema, GcpArtifactRegistryImportDataSchema, GcpBuildImportDataSchema, GcpCloudBuildHeartbeatDataSchema, GcpCloudRunWorkerHeartbeatDataSchema, GcpCloudStorageHeartbeatDataSchema, GcpComputeClusterHeartbeatDataSchema, GcpComputeClusterImportDataSchema, GcpFirestoreKvHeartbeatDataSchema, GcpKvImportDataSchema, GcpNetworkImportDataSchema, GcpPubSubQueueHeartbeatDataSchema, GcpQueueImportDataSchema, GcpRemoteStackManagementHeartbeatDataSchema, GcpRemoteStackManagementImportDataSchema, GcpSecretManagerVaultHeartbeatDataSchema, GcpServiceAccountHeartbeatDataSchema, GcpServiceAccountImportDataSchema, GcpServiceActivationImportDataSchema, GcpServiceUsageActivationHeartbeatDataSchema, GcpStorageImportDataSchema, GcpVaultImportDataSchema, GcpVpcNetworkHeartbeatDataSchema, GcpWorkerImportDataSchema, HeartbeatBackendSchema, HeartbeatIssueSeveritySchema, HeartbeatsModeSchema, HorizonContainerHeartbeatDataSchema, HttpMethodSchema, InvalidBindingConfigError, KubernetesBuildHeartbeatDataSchema, KubernetesClusterNodeStatusSchema, KubernetesContainerHeartbeatDataSchema, KubernetesDaemonHeartbeatDataSchema, KubernetesEventInvolvedObjectSchema, KubernetesEventSnapshotSchema, KubernetesEventSourceSchema, KubernetesNodeConditionStatusSchema, KubernetesNodeResourcesSchema, KubernetesNodeUsageSchema, KubernetesPodRuntimeUnitStatusSchema, KubernetesSecretVaultHeartbeatDataSchema, KubernetesWorkerHeartbeatDataSchema, Kv, KvSchema as KvConfigSchema, KvHeartbeatDataSchema, KvHeartbeatStatusSchema, LeaseInfoSchema, LeaseRequestSchema, LeaseResponseSchema, LocalArtifactRegistryHeartbeatDataSchema, LocalComputeClusterHeartbeatDataSchema, LocalContainerHeartbeatDataSchema, LocalDaemonHeartbeatDataSchema, LocalKvHeartbeatDataSchema, LocalQueueHeartbeatDataSchema, LocalRuntimeEventSnapshotSchema, LocalRuntimeEventSubjectSchema, LocalRuntimeUnitKindSchema, LocalRuntimeUnitStatusSchema, LocalServiceAccountHeartbeatDataSchema, LocalStorageHeartbeatDataSchema, LocalVaultHeartbeatDataSchema, LocalWorkerHeartbeatDataSchema, MachineProfileSchema, ManagedRuntimeEventInvolvedObjectSchema, ManagedRuntimeEventSnapshotSchema, ManagedRuntimeEventSourceSchema, ManagedRuntimeUnitStatusSchema, MessagePayloadSchema, MetricSampleSchema, NetworkHeartbeatDataSchema, NetworkHeartbeatStatusSchema, ObservedCountsSchema, ObservedHealthSchema, ObservedInventoryBatchSchema, ObservedResourceSampleSchema, PermissionSetSchema, PlatformSchema, Postgres, PostgresSchema as PostgresConfigSchema, PresignedRequestBackendSchema, PresignedRequestSchema, ProviderFleetStatusSchema, ProviderLifecycleStateSchema, PublicEndpointSchema, Queue, QueueSchema as QueueConfigSchema, QueueHeartbeatDataSchema, QueueHeartbeatStatusSchema, QueueMessageSchema, ReadinessProbeSchema, ReleaseRequestSchema, RemoteStackManagementHeartbeatDataSchema, RemoteStackManagementHeartbeatStatusSchema, Resource, ResourceHeartbeatDataSchema, ResourceHeartbeatSchema, ResourceLifecycleSchema, ResourceNotFoundError, ResourceOutputsParseError, ResourceRefSchema, ResourceSchemaMapping, ResourceStatusSchema, ResourceTypeSchema, ResponseHandlingSchema, ScheduledEventSchema, ServiceAccount, ServiceAccountSchema as ServiceAccountConfigSchema, ServiceAccountHeartbeatDataSchema, ServiceAccountHeartbeatStatusSchema, ServiceAccountOutputsSchema, ServiceActivationHeartbeatDataSchema, ServiceActivationHeartbeatStatusSchema, Stack, StackInputDefaultValueSchema, StackInputDefinitionSchema, StackInputEnvironmentMappingSchema, StackInputEnvironmentVariableTypeSchema, StackInputKindSchema, StackInputProviderSchema, StackInputValidationSchema, StackResourceStateSchema, StackSchema, StackSettingsSchema, StackStateSchema, StackStatusSchema, Storage, StorageSchema as StorageConfigSchema, StorageEventSchema, StorageEventTypeSchema, StorageEventsSchema, StorageHeartbeatDataSchema, StorageHeartbeatStatusSchema, StorageUploadSchema, SubmitResponseRequestSchema, TelemetryModeSchema, TraceContextSchema, UnexpectedResourceTypeError, UpdatesModeSchema, UploadCompleteRequestSchema, UploadCompleteResponseSchema, Vault, VaultSchema as VaultConfigSchema, VaultHeartbeatDataSchema, VaultHeartbeatStatusSchema, Worker, WorkerSchema as WorkerConfigSchema, WorkerHeartbeatDataSchema, WorkerOutputsSchema, WorkerPublicEndpointSchema, WorkerTriggerSchema, WorkloadHeartbeatStatusSchema, WorkloadReplicaStatusSchema, defineBooleanInput as boolean, defineError, defineEnumInput as enum, experimental, getResourceOutputs, getStackInputDefinitions, inputs, defineIntegerInput as integer, defineNumberInput as number, defineSecretInput as secret, defineStringInput as string, defineStringListInput as stringList };
+export { AI, AgentStatusSchema, AiSchema as AiConfigSchema, AlienError, AlienErrorSchema as AlienErrorOptionsSchema, AlienEventSchema, ArtifactRegistry, ArtifactRegistrySchema as ArtifactRegistryConfigSchema, ArtifactRegistryHeartbeatDataSchema, ArtifactRegistryHeartbeatStatusSchema, AwsArtifactRegistryImportDataSchema, AwsBuildImportDataSchema, AwsCodeBuildHeartbeatDataSchema, AwsComputeClusterHeartbeatDataSchema, AwsComputeClusterImportDataSchema, AwsDynamoDbKeySchemaElementSchema, AwsDynamoDbKvHeartbeatDataSchema, AwsEcrArtifactRegistryHeartbeatDataSchema, AwsEcrRepositoryHeartbeatDataSchema, AwsIamRoleServiceAccountHeartbeatDataSchema, AwsKvImportDataSchema, AwsLambdaWorkerHeartbeatDataSchema, AwsNetworkImportDataSchema, AwsParameterStoreVaultHeartbeatDataSchema, AwsQueueImportDataSchema, AwsRemoteStackManagementHeartbeatDataSchema, AwsRemoteStackManagementImportDataSchema, AwsS3StorageHeartbeatDataSchema, AwsServiceAccountImportDataSchema, AwsSqsQueueHeartbeatDataSchema, AwsStorageImportDataSchema, AwsVaultImportDataSchema, AwsVpcNetworkHeartbeatDataSchema, AwsWorkerImportDataSchema, AzureArtifactRegistryImportDataSchema, AzureBlobStorageHeartbeatDataSchema, AzureBuildImportDataSchema, AzureComputeClusterHeartbeatDataSchema, AzureComputeClusterImportDataSchema, AzureContainerAppsBuildHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatDataSchema, AzureContainerAppsEnvironmentHeartbeatStatusSchema, AzureContainerAppsEnvironmentImportDataSchema, AzureContainerAppsEnvironmentWorkloadProfileSchema, AzureContainerAppsWorkerHeartbeatDataSchema, AzureContainerRegistryHeartbeatDataSchema, AzureKeyVaultHeartbeatDataSchema, AzureKvImportDataSchema, AzureManagedIdentityServiceAccountHeartbeatDataSchema, AzureNetworkImportDataSchema, AzureQueueImportDataSchema, AzureRemoteStackManagementHeartbeatDataSchema, AzureRemoteStackManagementImportDataSchema, AzureResourceGroupHeartbeatDataSchema, AzureResourceGroupHeartbeatStatusSchema, AzureResourceGroupImportDataSchema, AzureResourceProviderActivationHeartbeatDataSchema, AzureServiceAccountImportDataSchema, AzureServiceActivationImportDataSchema, AzureServiceBusNamespaceHeartbeatDataSchema, AzureServiceBusNamespaceImportDataSchema, AzureServiceBusQueueHeartbeatDataSchema, AzureStorageAccountEndpointsSchema, AzureStorageAccountHeartbeatDataSchema, AzureStorageAccountImportDataSchema, AzureStorageImportDataSchema, AzureTableKvHeartbeatDataSchema, AzureVaultImportDataSchema, AzureVnetNetworkHeartbeatDataSchema, AzureWorkerImportDataSchema, BindingNotFoundError, BodySpecSchema, Build, BuildConfigSchema, BuildHeartbeatDataSchema, BuildHeartbeatStatusSchema, BuildOutputsSchema, BuildStatusSchema, CapacityGroupScalePolicySchema, CapacityGroupSchema, CommandDeliveryModeSchema, CommandResponseSchema, CommandStateSchema, CommandStatusResponseSchema, CommandTargetSchema, CommandTargetTypeSchema, ComputeCapacityGroupStatusSchema, ComputeCapacityRecommendationSchema, ComputeChoiceRangeSchema, ComputeCluster, ComputeClusterSchema as ComputeClusterConfigSchema, ComputeClusterHeartbeatDataSchema, ComputeClusterHeartbeatStatusSchema, ComputeTypeSchema, Container, ContainerAutoscalingSchema, ContainerCodeSchema, ContainerSchema as ContainerConfigSchema, ContainerHeartbeatDataSchema, ContainerPortSchema, CreateCommandRequestSchema, CreateCommandResponseSchema, Daemon, DaemonCodeSchema, DaemonSchema as DaemonConfigSchema, DaemonHeartbeatDataSchema, DaemonOutputsSchema, DeploymentModelSchema, DevResourceInfoSchema, DevStatusSchema, DevStatusStateSchema, Email, EmailSchema as EmailConfigSchema, EnvelopeSchema, EventChangeSchema, EventStateSchema, ExposeProtocolSchema, GcpArtifactRegistryHeartbeatDataSchema, GcpArtifactRegistryImportDataSchema, GcpBuildImportDataSchema, GcpCloudBuildHeartbeatDataSchema, GcpCloudRunWorkerHeartbeatDataSchema, GcpCloudStorageHeartbeatDataSchema, GcpComputeClusterHeartbeatDataSchema, GcpComputeClusterImportDataSchema, GcpFirestoreKvHeartbeatDataSchema, GcpKvImportDataSchema, GcpNetworkImportDataSchema, GcpPubSubQueueHeartbeatDataSchema, GcpQueueImportDataSchema, GcpRemoteStackManagementHeartbeatDataSchema, GcpRemoteStackManagementImportDataSchema, GcpSecretManagerVaultHeartbeatDataSchema, GcpServiceAccountHeartbeatDataSchema, GcpServiceAccountImportDataSchema, GcpServiceActivationImportDataSchema, GcpServiceUsageActivationHeartbeatDataSchema, GcpStorageImportDataSchema, GcpVaultImportDataSchema, GcpVpcNetworkHeartbeatDataSchema, GcpWorkerImportDataSchema, HeartbeatBackendSchema, HeartbeatIssueSeveritySchema, HeartbeatsModeSchema, HorizonContainerHeartbeatDataSchema, HttpMethodSchema, InvalidBindingConfigError, Key, KeySchema as KeyConfigSchema, KubernetesBuildHeartbeatDataSchema, KubernetesClusterNodeStatusSchema, KubernetesContainerHeartbeatDataSchema, KubernetesDaemonHeartbeatDataSchema, KubernetesEventInvolvedObjectSchema, KubernetesEventSnapshotSchema, KubernetesEventSourceSchema, KubernetesNodeConditionStatusSchema, KubernetesNodeResourcesSchema, KubernetesNodeUsageSchema, KubernetesPodRuntimeUnitStatusSchema, KubernetesSecretVaultHeartbeatDataSchema, KubernetesWorkerHeartbeatDataSchema, Kv, KvSchema as KvConfigSchema, KvHeartbeatDataSchema, KvHeartbeatStatusSchema, LeaseInfoSchema, LeaseRequestSchema, LeaseResponseSchema, LocalArtifactRegistryHeartbeatDataSchema, LocalComputeClusterHeartbeatDataSchema, LocalContainerHeartbeatDataSchema, LocalDaemonHeartbeatDataSchema, LocalKvHeartbeatDataSchema, LocalQueueHeartbeatDataSchema, LocalRuntimeEventSnapshotSchema, LocalRuntimeEventSubjectSchema, LocalRuntimeUnitKindSchema, LocalRuntimeUnitStatusSchema, LocalServiceAccountHeartbeatDataSchema, LocalStorageHeartbeatDataSchema, LocalVaultHeartbeatDataSchema, LocalWorkerHeartbeatDataSchema, MachineProfileSchema, ManagedRuntimeEventInvolvedObjectSchema, ManagedRuntimeEventSnapshotSchema, ManagedRuntimeEventSourceSchema, ManagedRuntimeUnitStatusSchema, MessagePayloadSchema, MetricSampleSchema, NetworkHeartbeatDataSchema, NetworkHeartbeatStatusSchema, ObservedCountsSchema, ObservedHealthSchema, ObservedInventoryBatchSchema, ObservedResourceSampleSchema, PermissionSetSchema, PlatformSchema, Postgres, PostgresSchema as PostgresConfigSchema, PresignedRequestBackendSchema, PresignedRequestSchema, ProviderFleetStatusSchema, ProviderLifecycleStateSchema, PublicEndpointSchema, Queue, QueueSchema as QueueConfigSchema, QueueHeartbeatDataSchema, QueueHeartbeatStatusSchema, QueueMessageSchema, ReadinessProbeSchema, ReleaseRequestSchema, RemoteStackManagementHeartbeatDataSchema, RemoteStackManagementHeartbeatStatusSchema, Resource, ResourceHeartbeatDataSchema, ResourceHeartbeatSchema, ResourceLifecycleSchema, ResourceNotFoundError, ResourceOutputsParseError, ResourceRefSchema, ResourceSchemaMapping, ResourceStatusSchema, ResourceTypeSchema, ResponseHandlingSchema, ScheduledEventSchema, ServiceAccount, ServiceAccountSchema as ServiceAccountConfigSchema, ServiceAccountHeartbeatDataSchema, ServiceAccountHeartbeatStatusSchema, ServiceAccountOutputsSchema, ServiceActivationHeartbeatDataSchema, ServiceActivationHeartbeatStatusSchema, Stack, StackInputDefaultValueSchema, StackInputDefinitionSchema, StackInputEnvironmentMappingSchema, StackInputEnvironmentVariableTypeSchema, StackInputKindSchema, StackInputProviderSchema, StackInputValidationSchema, StackResourceStateSchema, StackSchema, StackSettingsSchema, StackStateSchema, StackStatusSchema, Storage, StorageSchema as StorageConfigSchema, StorageEventSchema, StorageEventTypeSchema, StorageEventsSchema, StorageHeartbeatDataSchema, StorageHeartbeatStatusSchema, StorageUploadSchema, SubmitResponseRequestSchema, TelemetryModeSchema, TraceContextSchema, UnexpectedResourceTypeError, UpdatesModeSchema, UploadCompleteRequestSchema, UploadCompleteResponseSchema, Vault, VaultSchema as VaultConfigSchema, VaultHeartbeatDataSchema, VaultHeartbeatStatusSchema, Worker, WorkerSchema as WorkerConfigSchema, WorkerHeartbeatDataSchema, WorkerOutputsSchema, WorkerPublicEndpointSchema, WorkerTriggerSchema, WorkloadHeartbeatStatusSchema, WorkloadReplicaStatusSchema, defineBooleanInput as boolean, defineError, defineEnumInput as enum, experimental, getResourceOutputs, getStackInputDefinitions, inputs, defineIntegerInput as integer, defineNumberInput as number, defineSecretInput as secret, defineStringInput as string, defineStringListInput as stringList };
 
 //# sourceMappingURL=index.js.map