@microagi/alchemy-gcp 0.11.5 → 0.11.7

package/lib/Iam/WorkloadIdentityPool.js

@@ -0,0 +1,175 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as iam from "@distilled.cloud/gcp/unstable/iam-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import { descriptionHasAlchemyMarker, gcpAlchemyDescription, stripAlchemyMarker, } from "../Tags.js";
+import { makeAwaitOperation } from "./Operations.js";
+export const WorkloadIdentityPool = Resource("GCP.WorkloadIdentityPool");
+/**
+ * Treat absent and empty-string as the same value.
+ *
+ * The patch below uses a FIXED `updateMask` while the body omits unset
+ * optional fields — deliberately, since under a field mask an omitted field
+ * means "clear it". The hazard is the comparison: if GCP echoes a cleared
+ * field back as `""` rather than omitting it, a raw `!==` against `undefined`
+ * would report drift on every deploy and churn a patch LRO forever.
+ */
+const sameText = (a, b) => (a ?? "") === (b ?? "");
+/** `projects/{project}/locations/global` — the only supported location. */
+export const poolParent = (project) => `projects/${project}/locations/global`;
+export const poolResourceName = (project, poolId) => `${poolParent(project)}/workloadIdentityPools/${poolId}`;
+/**
+ * Alchemy provider factory for {@link WorkloadIdentityPool}.
+ *
+ * Deliberately NOT named `WorkloadIdentityPoolProvider`, which the repo's
+ * `X` + `XProvider` convention would suggest: GCP already uses that exact
+ * term for a different, user-facing resource — the OIDC provider inside a
+ * pool ({@link import("./WorkloadIdentityPoolProvider.ts").WorkloadIdentityPoolProvider}).
+ * The resource keeps GCP's name; this internal factory takes the awkward one.
+ */
+export const WorkloadIdentityPoolResourceProvider = () => Provider.effect(WorkloadIdentityPool, Effect.gen(function* () {
+    const getPool = yield* iam.getProjectsLocationsWorkloadIdentityPools;
+    const createPool = yield* iam.createProjectsLocationsWorkloadIdentityPools;
+    const patchPool = yield* iam.patchProjectsLocationsWorkloadIdentityPools;
+    const deletePool = yield* iam.deleteProjectsLocationsWorkloadIdentityPools;
+    const undeletePool = yield* iam.undeleteProjectsLocationsWorkloadIdentityPools;
+    const getOperations = yield* iam.getProjectsLocationsWorkloadIdentityPoolsOperations;
+    const awaitOperation = makeAwaitOperation(getOperations, "Workload Identity pool");
+    // Absent and invisible collapse to the same thing, matching the
+    // ServiceAccount observer: a 403 on a resource we are about to create
+    // is indistinguishable from a 404 without extra permissions we may not
+    // have.
+    const observePool = (project, poolId) => getPool({ name: poolResourceName(project, poolId) }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+    const toAttrs = (project, poolId, pool) => ({
+        name: pool.name ?? poolResourceName(project, poolId),
+        project,
+        poolId,
+        displayName: pool.displayName,
+        description: stripAlchemyMarker(pool.description),
+        state: pool.state,
+        disabled: pool.disabled,
+    });
+    return {
+        stables: ["name", "project", "poolId"],
+        diff: Effect.fn(function* ({ olds = {}, news, output }) {
+            if (!isResolved(news))
+                return undefined;
+            const oldProps = olds;
+            // Prefer live attributes over persisted props, and fall back to the
+            // DESIRED value when neither is known — mirroring Project.ts.
+            //
+            // Defaulting to `undefined` instead would make an adoption (output
+            // present, olds absent) compare `undefined !== news.project` and
+            // return `replace`, deleting and recreating a live pool that was
+            // already correct. Both fields are part of the resource name, so a
+            // genuine change here really is a replacement; the point is only to
+            // avoid inventing one.
+            const currentProject = output?.project || oldProps.project || news.project;
+            const currentPoolId = output?.poolId || oldProps.poolId || news.poolId;
+            if (currentProject !== news.project || currentPoolId !== news.poolId) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            const project = output?.project || olds?.project;
+            const poolId = output?.poolId || olds?.poolId;
+            if (!project || !poolId)
+                return undefined;
+            const pool = yield* observePool(project, poolId);
+            if (!pool)
+                return undefined;
+            const attrs = toAttrs(project, poolId, pool);
+            return (yield* descriptionHasAlchemyMarker(id, pool.description))
+                ? attrs
+                : Unowned(attrs);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+            const { project, poolId } = news;
+            const description = yield* gcpAlchemyDescription(id, news.description);
+            // Body is TOTAL over the patch's updateMask below: every masked
+            // field is always present, with an explicit empty/default value
+            // when the prop is unset. Behaviourally identical to omitting them
+            // (a masked-but-absent field is cleared), but it states the intent
+            // in code rather than relying on that field-mask subtlety, so
+            // "clear displayName" cannot be misread as "leave it alone".
+            const body = {
+                displayName: news.displayName ?? "",
+                description,
+                disabled: news.disabled ?? false,
+            };
+            let pool = yield* observePool(project, poolId);
+            // A soft-deleted pool holds its ID for ~30 days. Undelete rather
+            // than fail: otherwise destroy-then-redeploy is stuck until the
+            // purge, with no way out but renaming the pool.
+            if (pool?.state === "DELETED") {
+                yield* session.note(`Undeleting soft-deleted Workload Identity pool ${poolId}…`);
+                const op = yield* undeletePool({
+                    name: poolResourceName(project, poolId),
+                    body: {},
+                });
+                if (op.name)
+                    yield* awaitOperation(op.name, session);
+                pool = yield* observePool(project, poolId);
+            }
+            if (!pool) {
+                const op = yield* createPool({
+                    parent: poolParent(project),
+                    workloadIdentityPoolId: poolId,
+                    body,
+                });
+                if (op.name)
+                    yield* awaitOperation(op.name, session);
+                pool = yield* observePool(project, poolId);
+                if (!pool) {
+                    return yield* new ConfigError({
+                        message: `Workload Identity pool ${poolId} in project ${project} was not readable after create.`,
+                    });
+                }
+            }
+            else {
+                // Only the mutable fields, and only when they actually differ —
+                // an unconditional patch would churn an LRO on every deploy.
+                const needsPatch = !sameText(pool.displayName, news.displayName) ||
+                    !sameText(pool.description, description) ||
+                    (pool.disabled ?? false) !== (news.disabled ?? false);
+                if (needsPatch) {
+                    const op = yield* patchPool({
+                        name: poolResourceName(project, poolId),
+                        updateMask: "displayName,description,disabled",
+                        body,
+                    });
+                    if (op.name)
+                        yield* awaitOperation(op.name, session);
+                    pool = (yield* observePool(project, poolId)) ?? pool;
+                }
+            }
+            yield* session.note(poolResourceName(project, poolId));
+            return toAttrs(project, poolId, pool);
+        }),
+        delete: Effect.fn(function* ({ olds, output, session }) {
+            // Fall back to props when attributes are incomplete. A create whose
+            // LRO succeeded but whose follow-up read failed leaves state with
+            // props and no usable attributes; a no-op destroy would then LEAK
+            // the pool — and because deletion is soft, the leaked pool holds
+            // its ID for ~30 days, blocking a re-deploy under the same name.
+            // `||` not `??`: an empty string is never a valid identity here,
+            // and a persisted `""` must fall through to the next source rather
+            // than be taken as real. With `??` a corrupt/partial state entry
+            // would short-circuit the fallback and turn destroy into a silent
+            // no-op (or make diff replace a live resource).
+            const project = output?.project || olds?.project;
+            const poolId = output?.poolId || olds?.poolId;
+            if (!project || !poolId)
+                return;
+            const op = yield* deletePool({
+                name: poolResourceName(project, poolId),
+            }).pipe(Effect.catchTag("NotFound", () => Effect.succeed({ name: undefined })));
+            if (op.name)
+                yield* awaitOperation(op.name, session);
+        }),
+    };
+}));
+//# sourceMappingURL=WorkloadIdentityPool.js.map

package/lib/Iam/WorkloadIdentityPool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkloadIdentityPool.js","sourceRoot":"","sources":["../../src/Iam/WorkloadIdentityPool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,GAAG,MAAM,sCAAsC,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AA6FrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAC1C,0BAA0B,CAC3B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,QAAQ,GAAG,CAAC,CAAqB,EAAE,CAAqB,EAAE,EAAE,CAChE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAE1B,2EAA2E;AAC3E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,EAAE,CAC5C,YAAY,OAAO,mBAAmB,CAAC;AAEzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAE,MAAc,EAAE,EAAE,CAClE,GAAG,UAAU,CAAC,OAAO,CAAC,0BAA0B,MAAM,EAAE,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,GAAG,EAAE,CACvD,QAAQ,CAAC,MAAM,CACb,oBAAoB,EACpB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,yCAAyC,CAAC;IACrE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,4CAA4C,CAAC;IAC3E,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,2CAA2C,CAAC;IACzE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,4CAA4C,CAAC;IAC3E,MAAM,YAAY,GAChB,KAAK,CAAC,CAAC,GAAG,CAAC,8CAA8C,CAAC;IAC5D,MAAM,aAAa,GACjB,KAAK,CAAC,CAAC,GAAG,CAAC,mDAAmD,CAAC;IACjE,MAAM,cAAc,GAAG,kBAAkB,CACvC,aAAa,EACb,wBAAwB,CACzB,CAAC;IAEF,gEAAgE;IAChE,sEAAsE;IACtE,uEAAuE;IACvE,QAAQ;IACR,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,MAAc,EAAE,EAAE,CACtD,OAAO,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CACvD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAiD,CAAC,CAClE,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAAiD,CAAC,CAClE,CACF,CAAC;IAEJ,MAAM,OAAO,GAAG,CACd,OAAe,EACf,MAAc,EACd,IAA8B,EACE,EAAE,CAAC,CAAC;QACpC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;QACpD,OAAO;QACP,MAAM;QACN,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC;QACjD,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;QACtC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,QAAQ,GAAG,IAA0C,CAAC;YAC5D,oEAAoE;YACpE,8DAA8D;YAC9D,EAAE;YACF,mEAAmE;YACnE,iEAAiE;YACjE,iEAAiE;YACjE,mEAAmE;YACnE,oEAAoE;YACpE,uBAAuB;YACvB,MAAM,cAAc,GAAG,MAAM,EAAE,OAAO,IAAI,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;YAC3E,MAAM,aAAa,GAAG,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;YACvE,IAAI,cAAc,KAAK,IAAI,CAAC,OAAO,IAAI,aAAa,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBACrE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;YAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,CAAC,2BAA2B,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC/D,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YACnD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;YACjC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAC9C,EAAE,EACF,IAAI,CAAC,WAAW,CACjB,CAAC;YACF,gEAAgE;YAChE,gEAAgE;YAChE,mEAAmE;YACnE,mEAAmE;YACnE,8DAA8D;YAC9D,6DAA6D;YAC7D,MAAM,IAAI,GAA6B;gBACrC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;gBACnC,WAAW;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;aACjC,CAAC;YAEF,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAE/C,iEAAiE;YACjE,gEAAgE;YAChE,gDAAgD;YAChD,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC9B,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CACjB,kDAAkD,MAAM,GAAG,CAC5D,CAAC;gBACF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;oBAC7B,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;oBACvC,IAAI,EAAE,EAAE;iBACT,CAAC,CAAC;gBACH,IAAI,EAAE,CAAC,IAAI;oBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACrD,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7C,CAAC;YAED,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;oBAC3B,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC;oBAC3B,sBAAsB,EAAE,MAAM;oBAC9B,IAAI;iBACL,CAAC,CAAC;gBACH,IAAI,EAAE,CAAC,IAAI;oBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACrD,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC;wBAC5B,OAAO,EAAE,0BAA0B,MAAM,eAAe,OAAO,iCAAiC;qBACjG,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,gEAAgE;gBAChE,6DAA6D;gBAC7D,MAAM,UAAU,GACd,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC;oBAC7C,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC;oBACxC,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC;gBACxD,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;wBAC1B,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;wBACvC,UAAU,EAAE,kCAAkC;wBAC9C,IAAI;qBACL,CAAC,CAAC;oBACH,IAAI,EAAE,CAAC,IAAI;wBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBACrD,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC;gBACvD,CAAC;YACH,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YACvD,OAAO,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YACpD,oEAAoE;YACpE,kEAAkE;YAClE,kEAAkE;YAClE,iEAAiE;YACjE,iEAAiE;YACjE,iEAAiE;YACjE,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,gDAAgD;YAChD,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;YAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;gBAAE,OAAO;YAChC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;gBAC3B,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;aACxC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAmB,CAAC,CACrD,CACF,CAAC;YACF,IAAI,EAAE,CAAC,IAAI;gBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACvD,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Iam/WorkloadIdentityPoolProvider.d.ts

@@ -0,0 +1,124 @@
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import type * as GCP from "../Providers.ts";
+/**
+ * An OIDC **provider** inside a
+ * {@link import("./WorkloadIdentityPool.ts").WorkloadIdentityPool} — the
+ * thing that actually declares "I trust tokens issued by this URL".
+ *
+ * The canonical use is keyless federation from another cloud: point
+ * `oidc.issuerUri` at an EKS/AKS/GKE cluster's OIDC issuer, and pods holding
+ * a projected ServiceAccount token can impersonate a GSA with no key material
+ * anywhere in the system.
+ *
+ * ### `attributeMapping` is required and `google.subject` is mandatory
+ *
+ * The mapping turns claims on the incoming token into Google attributes. At
+ * minimum `google.subject` must be mapped; it is what `principal://` members
+ * match on. For a Kubernetes issuer the subject claim is
+ * `system:serviceaccount:{namespace}:{name}`, so:
+ *
+ * ```typescript
+ * attributeMapping: { "google.subject": "assertion.sub" }
+ * ```
+ *
+ * ### Set `allowedAudiences`, or the default is surprising
+ *
+ * When `oidc.allowedAudiences` is empty, GCP accepts only the *default*
+ * audience — the full provider resource name prefixed with
+ * `https://iam.googleapis.com/`. A Kubernetes projected token minted for
+ * audience `sts.googleapis.com` (or anything else) is then rejected with a
+ * generic audience error. Set this explicitly to whatever audience the
+ * token is actually minted for.
+ *
+ * ### Constrain trust with `attributeCondition`
+ *
+ * An issuer-only trust accepts **every** identity that issuer can mint — on
+ * a Kubernetes cluster, that is every ServiceAccount in every namespace. Pair
+ * the provider with an `attributeCondition` (and a narrow `principal://`
+ * member on the GSA binding) so a token from an unrelated namespace cannot
+ * impersonate anything.
+ *
+ * @section Creating a WorkloadIdentityPoolProvider
+ * @example Trust one Kubernetes ServiceAccount on an EKS cluster
+ * ```typescript
+ * const provider = yield* GCP.WorkloadIdentityPoolProvider("EksOidc", {
+ *   project: "123456789",
+ *   poolId: pool.poolId,
+ *   providerId: "eks-oidc",
+ *   oidc: {
+ *     issuerUri: "https://oidc.eks.us-east-1.amazonaws.com/id/ABC123",
+ *     allowedAudiences: ["sts.googleapis.com"],
+ *   },
+ *   attributeMapping: { "google.subject": "assertion.sub" },
+ *   attributeCondition:
+ *     "assertion.sub == 'system:serviceaccount:admin:eks-auth-reconciler'",
+ * });
+ * ```
+ */
+export type WorkloadIdentityPoolProviderProps = {
+    /** Project that owns the pool. Prefer the project **number**. */
+    project: string;
+    /** ID of the enclosing pool. */
+    poolId: string;
+    /**
+     * Provider ID, 4–32 characters of `[a-z0-9-]`. Immutable — changing it
+     * replaces the provider. The `gcp-` prefix is reserved by Google.
+     */
+    providerId: string;
+    /** The OIDC issuer this provider trusts. */
+    oidc: {
+        /** Issuer URL. Must be HTTPS and serve an OIDC discovery document. */
+        issuerUri: string;
+        /**
+         * Acceptable `aud` values. Leave unset only if the token is minted for
+         * the provider's default audience — see the note above.
+         */
+        allowedAudiences?: string[];
+        /**
+         * Inline JWKS, for issuers whose keys are not publicly reachable. When
+         * unset, GCP fetches `jwks_uri` from the issuer's discovery document,
+         * which requires the issuer to be reachable from Google's network.
+         */
+        jwksJson?: string;
+    };
+    /**
+     * Claim-to-attribute mapping. Must include `google.subject`.
+     */
+    attributeMapping: Record<string, string>;
+    /** CEL expression further restricting which credentials are accepted. */
+    attributeCondition?: string;
+    /** Display name, max 32 characters. */
+    displayName?: string;
+    /** Description, max 256 characters. */
+    description?: string;
+    /** Disable the provider without deleting it. */
+    disabled?: boolean;
+};
+export type WorkloadIdentityPoolProviderAttributes = {
+    /** Full resource name, `…/workloadIdentityPools/{pool}/providers/{id}`. */
+    name: string;
+    project: string;
+    poolId: string;
+    providerId: string;
+    issuerUri: string | undefined;
+    allowedAudiences: readonly string[] | undefined;
+    attributeMapping: Record<string, string> | undefined;
+    attributeCondition: string | undefined;
+    displayName: string | undefined;
+    description: string | undefined;
+    state: string | undefined;
+    disabled: boolean | undefined;
+    /**
+     * The audience string to put in a credential configuration, i.e.
+     * `//iam.googleapis.com/{name}`. Provided because assembling it by hand is
+     * easy to get subtly wrong (the leading `//`, and no scheme).
+     */
+    audience: string;
+};
+export interface WorkloadIdentityPoolProvider extends Resource<"GCP.WorkloadIdentityPoolProvider", WorkloadIdentityPoolProviderProps, WorkloadIdentityPoolProviderAttributes, never, GCP.Providers> {
+}
+export declare const WorkloadIdentityPoolProvider: import("alchemy").ResourceClass<WorkloadIdentityPoolProvider>;
+export declare const providerResourceName: (project: string, poolId: string, providerId: string) => string;
+export declare const WorkloadIdentityPoolProviderProvider: () => import("effect/Layer").Layer<Provider.Provider<WorkloadIdentityPoolProvider>, never, import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient | import("alchemy").Stack | import("alchemy").Stage>;
+//# sourceMappingURL=WorkloadIdentityPoolProvider.d.ts.map

package/lib/Iam/WorkloadIdentityPoolProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkloadIdentityPoolProvider.d.ts","sourceRoot":"","sources":["../../src/Iam/WorkloadIdentityPoolProvider.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAO7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAI5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC9C,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,IAAI,EAAE;QACJ,sEAAsE;QACtE,SAAS,EAAE,MAAM,CAAC;QAClB;;;WAGG;QACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC5B;;;;WAIG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,yEAAyE;IACzE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG;IACnD,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAG9B,gBAAgB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAChD,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACrD,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,WAAW,4BACf,SAAQ,QAAQ,CACd,kCAAkC,EAClC,iCAAiC,EACjC,sCAAsC,EACtC,KAAK,EACL,GAAG,CAAC,SAAS,CACd;CAAG;AAEN,eAAO,MAAM,4BAA4B,+DACmC,CAAC;AAE7E,eAAO,MAAM,oBAAoB,YACtB,MAAM,UACP,MAAM,cACF,MAAM,WAC+C,CAAC;AAgDpE,eAAO,MAAM,oCAAoC,mPAiO9C,CAAC"}

package/lib/Iam/WorkloadIdentityPoolProvider.js

@@ -0,0 +1,222 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as iam from "@distilled.cloud/gcp/unstable/iam-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import { descriptionHasAlchemyMarker, gcpAlchemyDescription, stripAlchemyMarker, } from "../Tags.js";
+import { makeAwaitOperation } from "./Operations.js";
+import { poolResourceName } from "./WorkloadIdentityPool.js";
+export const WorkloadIdentityPoolProvider = Resource("GCP.WorkloadIdentityPoolProvider");
+export const providerResourceName = (project, poolId, providerId) => `${poolResourceName(project, poolId)}/providers/${providerId}`;
+/**
+ * Compare two claim mappings by CONTENT, not serialisation.
+ *
+ * `JSON.stringify` preserves key insertion order, and the order GCP returns
+ * these keys in need not match the order they were sent in. A raw stringify
+ * comparison therefore reports drift for two identical mappings and fires a
+ * patch LRO on every single deploy.
+ */
+const sameMapping = (a, b) => {
+    const entries = (r) => Object.entries(r ?? {}).sort(([x], [y]) => (x < y ? -1 : x > y ? 1 : 0));
+    return JSON.stringify(entries(a)) === JSON.stringify(entries(b));
+};
+/**
+ * Compare audience allow-lists as SETS.
+ *
+ * `allowedAudiences` is an allow-list: membership is what matters, order is
+ * not meaningful, and GCP is free to return it in any order. Comparing it
+ * positionally would make a reordering look like drift forever.
+ */
+const sameAudiences = (a, b) => {
+    const sorted = (v) => [...(v ?? [])].sort();
+    return JSON.stringify(sorted(a)) === JSON.stringify(sorted(b));
+};
+/**
+ * Treat absent and empty-string as the same value.
+ *
+ * The patch below uses a FIXED `updateMask` while the request body omits
+ * unset optional fields — which is deliberate: under a field mask, an omitted
+ * field means "clear it", so dropping `displayName` from the props really
+ * should clear it on GCP. The hazard is only in the comparison afterwards. If
+ * GCP echoes a cleared field back as `""` rather than omitting it, a raw
+ * `!==` against `undefined` would report drift on every single deploy and
+ * churn a long-running patch operation forever.
+ */
+const sameText = (a, b) => (a ?? "") === (b ?? "");
+export const WorkloadIdentityPoolProviderProvider = () => Provider.effect(WorkloadIdentityPoolProvider, Effect.gen(function* () {
+    const getProvider = yield* iam.getProjectsLocationsWorkloadIdentityPoolsProviders;
+    const createProvider = yield* iam.createProjectsLocationsWorkloadIdentityPoolsProviders;
+    const patchProvider = yield* iam.patchProjectsLocationsWorkloadIdentityPoolsProviders;
+    const deleteProvider = yield* iam.deleteProjectsLocationsWorkloadIdentityPoolsProviders;
+    const undeleteProvider = yield* iam.undeleteProjectsLocationsWorkloadIdentityPoolsProviders;
+    const getOperations = yield* iam.getProjectsLocationsWorkloadIdentityPoolsProvidersOperations;
+    const awaitOperation = makeAwaitOperation(getOperations, "Workload Identity provider");
+    const observeProvider = (project, poolId, providerId) => getProvider({
+        name: providerResourceName(project, poolId, providerId),
+    }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+    const toAttrs = (project, poolId, providerId, provider) => {
+        const name = provider.name ?? providerResourceName(project, poolId, providerId);
+        return {
+            name,
+            project,
+            poolId,
+            providerId,
+            issuerUri: provider.oidc?.issuerUri,
+            allowedAudiences: provider.oidc?.allowedAudiences,
+            attributeMapping: provider.attributeMapping,
+            attributeCondition: provider.attributeCondition,
+            displayName: provider.displayName,
+            description: stripAlchemyMarker(provider.description),
+            state: provider.state,
+            disabled: provider.disabled,
+            audience: `//iam.googleapis.com/${name}`,
+        };
+    };
+    return {
+        stables: ["name", "project", "poolId", "providerId", "audience"],
+        diff: Effect.fn(function* ({ olds = {}, news, output }) {
+            if (!isResolved(news))
+                return undefined;
+            const oldProps = olds;
+            // Prefer live attributes over persisted props, and fall back to the
+            // DESIRED value when neither is known — see the equivalent comment
+            // in WorkloadIdentityPool.ts. Defaulting to `undefined` would make
+            // an adoption replace a live, correct provider.
+            //
+            // All three fields are part of the resource name; the API cannot
+            // move a provider between pools or rename it.
+            const currentProject = output?.project || oldProps.project || news.project;
+            const currentPoolId = output?.poolId || oldProps.poolId || news.poolId;
+            const currentProviderId = output?.providerId || oldProps.providerId || news.providerId;
+            if (currentProject !== news.project ||
+                currentPoolId !== news.poolId ||
+                currentProviderId !== news.providerId) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            const project = output?.project || olds?.project;
+            const poolId = output?.poolId || olds?.poolId;
+            const providerId = output?.providerId || olds?.providerId;
+            if (!project || !poolId || !providerId)
+                return undefined;
+            const provider = yield* observeProvider(project, poolId, providerId);
+            if (!provider)
+                return undefined;
+            const attrs = toAttrs(project, poolId, providerId, provider);
+            return (yield* descriptionHasAlchemyMarker(id, provider.description))
+                ? attrs
+                : Unowned(attrs);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+            const { project, poolId, providerId } = news;
+            if (!news.attributeMapping["google.subject"]) {
+                // Caught here rather than at the API, which rejects it with a
+                // message that does not name the missing key.
+                return yield* new ConfigError({
+                    message: `Workload Identity provider ${providerId} must map 'google.subject' in attributeMapping.`,
+                });
+            }
+            const description = yield* gcpAlchemyDescription(id, news.description);
+            // Scalars are TOTAL over the updateMask below — always present,
+            // explicit empty/default when unset — so clearing is stated in code
+            // rather than implied by field-mask semantics.
+            //
+            // `attributeCondition` and `oidc.jwksJson` are the exception and
+            // stay conditional: both are validated formats (a CEL expression
+            // and a JWKS document), and sending "" risks a parse rejection
+            // where omission is unambiguous. They are still cleared correctly
+            // when unset — `oidc` is masked as a whole message, so the body's
+            // `oidc` replaces it outright.
+            const body = {
+                displayName: news.displayName ?? "",
+                description,
+                disabled: news.disabled ?? false,
+                attributeMapping: news.attributeMapping,
+                ...(news.attributeCondition
+                    ? { attributeCondition: news.attributeCondition }
+                    : {}),
+                oidc: {
+                    issuerUri: news.oidc.issuerUri,
+                    allowedAudiences: news.oidc.allowedAudiences ?? [],
+                    ...(news.oidc.jwksJson ? { jwksJson: news.oidc.jwksJson } : {}),
+                },
+            };
+            let provider = yield* observeProvider(project, poolId, providerId);
+            // Same soft-delete reasoning as the pool: the ID is held until the
+            // purge, so undelete rather than strand the deploy.
+            if (provider?.state === "DELETED") {
+                yield* session.note(`Undeleting soft-deleted Workload Identity provider ${providerId}…`);
+                const op = yield* undeleteProvider({
+                    name: providerResourceName(project, poolId, providerId),
+                    body: {},
+                });
+                if (op.name)
+                    yield* awaitOperation(op.name, session);
+                provider = yield* observeProvider(project, poolId, providerId);
+            }
+            if (!provider) {
+                const op = yield* createProvider({
+                    parent: poolResourceName(project, poolId),
+                    workloadIdentityPoolProviderId: providerId,
+                    body,
+                });
+                if (op.name)
+                    yield* awaitOperation(op.name, session);
+                provider = yield* observeProvider(project, poolId, providerId);
+                if (!provider) {
+                    return yield* new ConfigError({
+                        message: `Workload Identity provider ${providerId} in pool ${poolId} was not readable after create.`,
+                    });
+                }
+            }
+            else {
+                const needsPatch = !sameText(provider.displayName, news.displayName) ||
+                    !sameText(provider.description, description) ||
+                    (provider.disabled ?? false) !== (news.disabled ?? false) ||
+                    !sameText(provider.attributeCondition, news.attributeCondition) ||
+                    !sameMapping(provider.attributeMapping, news.attributeMapping) ||
+                    !sameText(provider.oidc?.issuerUri, news.oidc.issuerUri) ||
+                    !sameAudiences(provider.oidc?.allowedAudiences, news.oidc.allowedAudiences) ||
+                    !sameText(provider.oidc?.jwksJson, news.oidc.jwksJson);
+                if (needsPatch) {
+                    const op = yield* patchProvider({
+                        name: providerResourceName(project, poolId, providerId),
+                        updateMask: "displayName,description,disabled,attributeMapping,attributeCondition,oidc",
+                        body,
+                    });
+                    if (op.name)
+                        yield* awaitOperation(op.name, session);
+                    provider =
+                        (yield* observeProvider(project, poolId, providerId)) ??
+                            provider;
+                }
+            }
+            yield* session.note(providerResourceName(project, poolId, providerId));
+            return toAttrs(project, poolId, providerId, provider);
+        }),
+        delete: Effect.fn(function* ({ olds, output, session }) {
+            // Props fallback for the same reason as the pool: incomplete
+            // attributes must not turn destroy into a silent no-op that leaks a
+            // soft-deleted-name-holding resource.
+            // `||` not `??`: an empty string is never a valid identity here,
+            // and a persisted `""` must fall through to the next source rather
+            // than be taken as real. With `??` a corrupt/partial state entry
+            // would short-circuit the fallback and turn destroy into a silent
+            // no-op (or make diff replace a live resource).
+            const project = output?.project || olds?.project;
+            const poolId = output?.poolId || olds?.poolId;
+            const providerId = output?.providerId || olds?.providerId;
+            if (!project || !poolId || !providerId)
+                return;
+            const op = yield* deleteProvider({
+                name: providerResourceName(project, poolId, providerId),
+            }).pipe(Effect.catchTag("NotFound", () => Effect.succeed({ name: undefined })));
+            if (op.name)
+                yield* awaitOperation(op.name, session);
+        }),
+    };
+}));
+//# sourceMappingURL=WorkloadIdentityPoolProvider.js.map

package/lib/Iam/WorkloadIdentityPoolProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkloadIdentityPoolProvider.js","sourceRoot":"","sources":["../../src/Iam/WorkloadIdentityPoolProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,GAAG,MAAM,sCAAsC,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAkI7D,MAAM,CAAC,MAAM,4BAA4B,GACvC,QAAQ,CAA+B,kCAAkC,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAe,EACf,MAAc,EACd,UAAkB,EAClB,EAAE,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,cAAc,UAAU,EAAE,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,WAAW,GAAG,CAClB,CAAqC,EACrC,CAAqC,EACrC,EAAE;IACF,MAAM,OAAO,GAAG,CAAC,CAAqC,EAAE,EAAE,CACxD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,CACpB,CAAgC,EAChC,CAAgC,EAChC,EAAE;IACF,MAAM,MAAM,GAAG,CAAC,CAAgC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3E,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,QAAQ,GAAG,CAAC,CAAqB,EAAE,CAAqB,EAAE,EAAE,CAChE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAE1B,MAAM,CAAC,MAAM,oCAAoC,GAAG,GAAG,EAAE,CACvD,QAAQ,CAAC,MAAM,CACb,4BAA4B,EAC5B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,WAAW,GACf,KAAK,CAAC,CAAC,GAAG,CAAC,kDAAkD,CAAC;IAChE,MAAM,cAAc,GAClB,KAAK,CAAC,CAAC,GAAG,CAAC,qDAAqD,CAAC;IACnE,MAAM,aAAa,GACjB,KAAK,CAAC,CAAC,GAAG,CAAC,oDAAoD,CAAC;IAClE,MAAM,cAAc,GAClB,KAAK,CAAC,CAAC,GAAG,CAAC,qDAAqD,CAAC;IACnE,MAAM,gBAAgB,GACpB,KAAK,CAAC,CAAC,GAAG,CAAC,uDAAuD,CAAC;IACrE,MAAM,aAAa,GACjB,KAAK,CAAC,CAAC,GAAG,CAAC,4DAA4D,CAAC;IAC1E,MAAM,cAAc,GAAG,kBAAkB,CACvC,aAAa,EACb,4BAA4B,CAC7B,CAAC;IAEF,MAAM,eAAe,GAAG,CACtB,OAAe,EACf,MAAc,EACd,UAAkB,EAClB,EAAE,CACF,WAAW,CAAC;QACV,IAAI,EAAE,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC;KACxD,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CACZ,SAAyD,CAC1D,CACF,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CACZ,SAAyD,CAC1D,CACF,CACF,CAAC;IAEJ,MAAM,OAAO,GAAG,CACd,OAAe,EACf,MAAc,EACd,UAAkB,EAClB,QAA0C,EACF,EAAE;QAC1C,MAAM,IAAI,GACR,QAAQ,CAAC,IAAI,IAAI,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACrE,OAAO;YACL,IAAI;YACJ,OAAO;YACP,MAAM;YACN,UAAU;YACV,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS;YACnC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB;YACjD,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,WAAW,EAAE,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC;YACrD,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,wBAAwB,IAAI,EAAE;SACzC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC;QAChE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAkD,CAAC;YACpE,oEAAoE;YACpE,mEAAmE;YACnE,mEAAmE;YACnE,gDAAgD;YAChD,EAAE;YACF,iEAAiE;YACjE,8CAA8C;YAC9C,MAAM,cAAc,GAAG,MAAM,EAAE,OAAO,IAAI,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;YAC3E,MAAM,aAAa,GAAG,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;YACvE,MAAM,iBAAiB,GACrB,MAAM,EAAE,UAAU,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC;YAC/D,IACE,cAAc,KAAK,IAAI,CAAC,OAAO;gBAC/B,aAAa,KAAK,IAAI,CAAC,MAAM;gBAC7B,iBAAiB,KAAK,IAAI,CAAC,UAAU,EACrC,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;YAC9C,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,IAAI,EAAE,UAAU,CAAC;YAC1D,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YACrE,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACnE,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YACnD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC7C,8DAA8D;gBAC9D,8CAA8C;gBAC9C,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC;oBAC5B,OAAO,EAAE,8BAA8B,UAAU,iDAAiD;iBACnG,CAAC,CAAC;YACL,CAAC;YACD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAC9C,EAAE,EACF,IAAI,CAAC,WAAW,CACjB,CAAC;YACF,gEAAgE;YAChE,oEAAoE;YACpE,+CAA+C;YAC/C,EAAE;YACF,iEAAiE;YACjE,iEAAiE;YACjE,+DAA+D;YAC/D,kEAAkE;YAClE,kEAAkE;YAClE,+BAA+B;YAC/B,MAAM,IAAI,GAAqC;gBAC7C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;gBACnC,WAAW;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;gBAChC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,GAAG,CAAC,IAAI,CAAC,kBAAkB;oBACzB,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE;oBACjD,CAAC,CAAC,EAAE,CAAC;gBACP,IAAI,EAAE;oBACJ,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;oBAC9B,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE;oBAClD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChE;aACF,CAAC;YAEF,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YAEnE,mEAAmE;YACnE,oDAAoD;YACpD,IAAI,QAAQ,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;gBAClC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CACjB,sDAAsD,UAAU,GAAG,CACpE,CAAC;gBACF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;oBACjC,IAAI,EAAE,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC;oBACvD,IAAI,EAAE,EAAE;iBACT,CAAC,CAAC;gBACH,IAAI,EAAE,CAAC,IAAI;oBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACrD,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YACjE,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;oBAC/B,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;oBACzC,8BAA8B,EAAE,UAAU;oBAC1C,IAAI;iBACL,CAAC,CAAC;gBACH,IAAI,EAAE,CAAC,IAAI;oBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACrD,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;gBAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC;wBAC5B,OAAO,EAAE,8BAA8B,UAAU,YAAY,MAAM,iCAAiC;qBACrG,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,GACd,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC;oBACjD,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;oBAC5C,CAAC,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;oBACzD,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,CAAC;oBAC/D,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC;oBAC9D,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;oBACxD,CAAC,aAAa,CACZ,QAAQ,CAAC,IAAI,EAAE,gBAAgB,EAC/B,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAC3B;oBACD,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzD,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;wBAC9B,IAAI,EAAE,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC;wBACvD,UAAU,EACR,2EAA2E;wBAC7E,IAAI;qBACL,CAAC,CAAC;oBACH,IAAI,EAAE,CAAC,IAAI;wBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBACrD,QAAQ;wBACN,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;4BACrD,QAAQ,CAAC;gBACb,CAAC;YACH,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CACjB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAClD,CAAC;YACF,OAAO,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACxD,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YACpD,6DAA6D;YAC7D,oEAAoE;YACpE,sCAAsC;YACtC,iEAAiE;YACjE,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,gDAAgD;YAChD,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;YAC9C,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,IAAI,EAAE,UAAU,CAAC;YAC1D,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU;gBAAE,OAAO;YAC/C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;gBAC/B,IAAI,EAAE,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC;aACxD,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAmB,CAAC,CACrD,CACF,CAAC;YACF,IAAI,EAAE,CAAC,IAAI;gBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACvD,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Iam/index.d.ts

@@ -3,4 +3,8 @@ export type { ServiceAccountProps } from "./ServiceAccount.ts";
 export * from "./ServiceAccountIamMember.ts";
 export { ServiceAccountKey, ServiceAccountKeyProvider, } from "./ServiceAccountKey.ts";
 export type { ServiceAccountKeyProps } from "./ServiceAccountKey.ts";
+export { WorkloadIdentityPool, WorkloadIdentityPoolResourceProvider, } from "./WorkloadIdentityPool.ts";
+export type { WorkloadIdentityPoolProps } from "./WorkloadIdentityPool.ts";
+export { WorkloadIdentityPoolProvider, WorkloadIdentityPoolProviderProvider, } from "./WorkloadIdentityPoolProvider.ts";
+export type { WorkloadIdentityPoolProviderProps } from "./WorkloadIdentityPoolProvider.ts";
 //# sourceMappingURL=index.d.ts.map

package/lib/Iam/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,cAAc,8BAA8B,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,cAAc,8BAA8B,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,iCAAiC,EAAE,MAAM,mCAAmC,CAAC"}

package/lib/Iam/index.js

@@ -1,4 +1,6 @@
 export { ServiceAccount, ServiceAccountProvider } from "./ServiceAccount.js";
 export * from "./ServiceAccountIamMember.js";
 export { ServiceAccountKey, ServiceAccountKeyProvider, } from "./ServiceAccountKey.js";
+export { WorkloadIdentityPool, WorkloadIdentityPoolResourceProvider, } from "./WorkloadIdentityPool.js";
+export { WorkloadIdentityPoolProvider, WorkloadIdentityPoolProviderProvider, } from "./WorkloadIdentityPoolProvider.js";
 //# sourceMappingURL=index.js.map

package/lib/Iam/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,cAAc,8BAA8B,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,cAAc,8BAA8B,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,mCAAmC,CAAC"}

package/lib/Kubernetes/Helm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Helm.d.ts","sourceRoot":"","sources":["../../src/Kubernetes/Helm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAIpC,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAG5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,yEAAyE;IACzE,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,QAAQ,CAChC,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,GAAG,CAAC,SAAS,CACd,CAAC;AACF,eAAO,MAAM,WAAW,8CAEvB,CAAC;;;;AAEF,0CAA0C;AAC1C,qBAAa,SAAU,SAAQ,eAA8B;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;CAAG;AAsDL,eAAO,MAAM,mBAAmB,4PAiV7B,CAAC"}
+{"version":3,"file":"Helm.d.ts","sourceRoot":"","sources":["../../src/Kubernetes/Helm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAIpC,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAG5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,yEAAyE;IACzE,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,QAAQ,CAChC,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,GAAG,CAAC,SAAS,CACd,CAAC;AACF,eAAO,MAAM,WAAW,8CAEvB,CAAC;;;;AAEF,0CAA0C;AAC1C,qBAAa,SAAU,SAAQ,eAA8B;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;CAAG;AAsDL,eAAO,MAAM,mBAAmB,4PAmV7B,CAAC"}

package/lib/Kubernetes/Helm.js

@@ -137,6 +137,8 @@ export const HelmReleaseProvider = () => Provider.effect(HelmRelease, Effect.gen
         // Identity (name/namespace/chart) and endpoint are unchanged by an
         // in-place upgrade. revision increments on every upgrade — it is NOT
         // stable (an update must persist the new revision).
+        nuke: { skip: true },
+        list: () => Effect.succeed([]),
         stables: ["name", "namespace", "chart", "endpoint"],
         diff: Effect.fn(function* ({ news, olds = {} }) {
             if (!isResolved(news))