@microagi/alchemy-gcp 0.11.6 → 0.11.7

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `@microagi/alchemy-gcp`. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this package
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.11.7 — 2026-08-02
+
+### Added
+
+- **`GCP.WorkloadIdentityPool`** and **`GCP.WorkloadIdentityPoolProvider`** —
+  keyless federation into GCP from an external OIDC issuer, so a workload
+  outside GCP (an EKS/AKS pod, a CI job) can impersonate a service account
+  with no service-account key anywhere in the system. The provider exposes an
+  `audience` attribute (`//iam.googleapis.com/{name}`) for use in a credential
+  configuration. Both resources undelete rather than fail when they find a
+  soft-deleted predecessor, since GCP holds a deleted pool's ID for ~30 days
+  and would otherwise block a re-deploy under the same name.
+
 ## 0.11.6 — 2026-07-28
 
 ### Changed

package/lib/Iam/Operations.d.ts

@@ -0,0 +1,42 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import type * as iam from "@distilled.cloud/gcp/unstable/iam-v1";
+import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
+import * as Effect from "effect/Effect";
+/**
+ * Resolved callable signature of an `iam-v1` operations getter.
+ *
+ * Workload Identity pools and providers each have their own operations
+ * collection (`…WorkloadIdentityPoolsOperations`,
+ * `…WorkloadIdentityPoolsProvidersOperations`) rather than one shared
+ * endpoint, so this is generic over the getter and each resource passes its
+ * own — the same factory shape `ArtifactRegistry/Operations.ts` uses.
+ */
+type GetOperations = Effect.Success<typeof iam.getProjectsLocationsWorkloadIdentityPoolsOperations>;
+/**
+ * Build the IAM long-running-operation polling helper.
+ *
+ * `iam-v1` operations use the standard `google.longrunning.Operation` shape —
+ * doneness is `.done === true` and failure is a populated `.error` (NOT
+ * Container's `.status === "DONE"`, and NOT Sqladmin's tri-state `.status`).
+ * Verified against the `Operation` interface in
+ * `vendor/distilled/packages/gcp/src/unstable-services/iam-v1.ts`.
+ *
+ * Operation names returned by pool/provider create and delete are already
+ * fully qualified (`projects/{p}/locations/global/workloadIdentityPools/{id}/operations/{op}`),
+ * so callers pass them straight through — no qualify dance.
+ *
+ * Schedule: exponential 1s → 1.5× growth, capped per-poll at 10s via
+ * `Schedule.min`, then a hard count cap of 60 retries via `Schedule.max`
+ * → ~10 min wall ceiling. Pool and provider CRUD normally settles in
+ * seconds; the ceiling exists so a stuck operation surfaces as an error
+ * rather than hanging a deploy indefinitely.
+ *
+ * The helper is a factory — the caller resolves the operations getter once at
+ * provider construction and passes the resulting callable here, so we never
+ * re-resolve services on each await.
+ */
+export declare const makeAwaitOperation: (getOperations: GetOperations, label: string) => (operationName: string, session: ScopedPlanStatusSession) => Effect.Effect<iam.Operation, ConfigError | {
+    _tag: "OperationPending";
+} | iam.GetProjectsLocationsWorkloadIdentityPoolsOperationsError, never>;
+export {};
+//# sourceMappingURL=Operations.d.ts.map

package/lib/Iam/Operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Operations.d.ts","sourceRoot":"","sources":["../../src/Iam/Operations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,KAAK,GAAG,MAAM,sCAAsC,CAAC;AACjE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE/D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC;;;;;;;;GAQG;AACH,KAAK,aAAa,GAAG,MAAM,CAAC,OAAO,CACjC,OAAO,GAAG,CAAC,mDAAmD,CAC/D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,kBAAkB,kBACd,aAAa,SACrB,MAAM;UAUiB,kBAAkB;wEAyB9C,CAAC"}

package/lib/Iam/Operations.js

@@ -0,0 +1,48 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+/**
+ * Build the IAM long-running-operation polling helper.
+ *
+ * `iam-v1` operations use the standard `google.longrunning.Operation` shape —
+ * doneness is `.done === true` and failure is a populated `.error` (NOT
+ * Container's `.status === "DONE"`, and NOT Sqladmin's tri-state `.status`).
+ * Verified against the `Operation` interface in
+ * `vendor/distilled/packages/gcp/src/unstable-services/iam-v1.ts`.
+ *
+ * Operation names returned by pool/provider create and delete are already
+ * fully qualified (`projects/{p}/locations/global/workloadIdentityPools/{id}/operations/{op}`),
+ * so callers pass them straight through — no qualify dance.
+ *
+ * Schedule: exponential 1s → 1.5× growth, capped per-poll at 10s via
+ * `Schedule.min`, then a hard count cap of 60 retries via `Schedule.max`
+ * → ~10 min wall ceiling. Pool and provider CRUD normally settles in
+ * seconds; the ceiling exists so a stuck operation surfaces as an error
+ * rather than hanging a deploy indefinitely.
+ *
+ * The helper is a factory — the caller resolves the operations getter once at
+ * provider construction and passes the resulting callable here, so we never
+ * re-resolve services on each await.
+ */
+export const makeAwaitOperation = (getOperations, label) => Effect.fn(function* (operationName, session) {
+    const op = yield* getOperations({ name: operationName }).pipe(Effect.flatMap((current) => current.done === true
+        ? Effect.succeed(current)
+        : Effect.fail({ _tag: "OperationPending" })), Effect.retry({
+        while: (e) => e?._tag === "OperationPending",
+        schedule: Schedule.max([
+            Schedule.min([
+                Schedule.exponential(Duration.seconds(1), 1.5),
+                Schedule.spaced(Duration.seconds(10)),
+            ]),
+            Schedule.recurs(60),
+        ]).pipe(Schedule.tap(() => session.note(`Waiting for ${label} operation ${operationName}…`))),
+    }));
+    if (op.error) {
+        return yield* new ConfigError({
+            message: `${label} operation ${operationName} failed: ${op.error.message ?? JSON.stringify(op.error)}`,
+        });
+    }
+    return op;
+});
+//# sourceMappingURL=Operations.js.map

package/lib/Iam/Operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Operations.js","sourceRoot":"","sources":["../../src/Iam/Operations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAe5C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,aAA4B,EAC5B,KAAa,EACb,EAAE,CACF,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACjB,aAAqB,EACrB,OAAgC;IAEhC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,IAAI,CAC3D,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACzB,OAAO,CAAC,IAAI,KAAK,IAAI;QACnB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAA2B,EAAE,CAAC,CACvD,EACD,MAAM,CAAC,KAAK,CAAC;QACX,KAAK,EAAE,CAAC,CAAoB,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,kBAAkB;QAC/D,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC;YACrB,QAAQ,CAAC,GAAG,CAAC;gBACX,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC9C,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;aACtC,CAAC;YACF,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;SACpB,CAAC,CAAC,IAAI,CACL,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAChB,OAAO,CAAC,IAAI,CAAC,eAAe,KAAK,cAAc,aAAa,GAAG,CAAC,CACjE,CACF;KACF,CAAC,CACH,CAAC;IACF,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC;YAC5B,OAAO,EAAE,GAAG,KAAK,cAAc,aAAa,YAC1C,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAC7C,EAAE;SACH,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC,CAAC"}

package/lib/Iam/WorkloadIdentityPool.d.ts

@@ -0,0 +1,100 @@
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import type * as GCP from "../Providers.ts";
+/**
+ * A Workload Identity **pool** — the trust boundary that lets identities from
+ * outside GCP (another cloud's OIDC issuer, a Kubernetes cluster, a CI system)
+ * impersonate a {@link import("./ServiceAccount.ts").ServiceAccount} without
+ * anyone ever creating a service-account key.
+ *
+ * A pool on its own trusts nothing; it is a namespace. The trust is declared
+ * by a {@link import("./WorkloadIdentityPoolProvider.ts").WorkloadIdentityPoolProvider}
+ * inside it, and the grant by an `iam.workloadIdentityUser` binding on the
+ * target GSA.
+ *
+ * ### Project number, not project ID
+ *
+ * The `principalSet://` member strings that reference this pool require the
+ * project **number**, not its ID:
+ *
+ * ```
+ * principalSet://iam.googleapis.com/projects/123456789/locations/global/workloadIdentityPools/POOL/*
+ * ```
+ *
+ * A member string built with the project ID is accepted by `setIamPolicy`
+ * and then silently never matches, which is a genuinely unpleasant thing to
+ * debug. Prefer passing the project number as `project` so `name` comes back
+ * in the form the bindings need.
+ *
+ * ### Deletion is soft
+ *
+ * `delete` puts the pool in state `DELETED` with an `expireTime` roughly 30
+ * days out; it is purged only after that. **The pool ID cannot be reused
+ * until it is purged.** Because of that, `reconcile` treats an existing
+ * soft-deleted pool as recoverable and undeletes it rather than failing —
+ * otherwise a destroy followed by a re-deploy inside the same month would be
+ * unrecoverable without renaming the pool.
+ *
+ * All mutating operations are long-running; the provider polls them to
+ * completion via {@link makeAwaitOperation}.
+ *
+ * @section Creating a WorkloadIdentityPool
+ * @example Trust an EKS cluster's OIDC issuer
+ * ```typescript
+ * const pool = yield* GCP.WorkloadIdentityPool("EksPool", {
+ *   project: "123456789",           // project NUMBER
+ *   poolId: "eks-us-east-1",
+ *   displayName: "EKS us-east-1",
+ *   description: "Federates research-eks-us-east-1 service accounts.",
+ * });
+ * ```
+ */
+export type WorkloadIdentityPoolProps = {
+    /**
+     * Project that owns the pool. Accepts the project ID or number; prefer the
+     * **number**, because `principalSet://` members require it (see above).
+     */
+    project: string;
+    /**
+     * Pool ID, 4–32 characters of `[a-z0-9-]`. Immutable — changing it
+     * replaces the pool. The `gcp-` prefix is reserved by Google.
+     */
+    poolId: string;
+    /** Display name, max 32 characters. */
+    displayName?: string;
+    /** Description, max 256 characters. */
+    description?: string;
+    /**
+     * Disable the pool. A disabled pool exchanges no tokens; existing tokens
+     * stop granting access and start working again if it is re-enabled.
+     */
+    disabled?: boolean;
+};
+export type WorkloadIdentityPoolAttributes = {
+    /** Full resource name, `projects/{p}/locations/global/workloadIdentityPools/{id}`. */
+    name: string;
+    project: string;
+    poolId: string;
+    displayName: string | undefined;
+    /** Description with the alchemy ownership marker stripped. */
+    description: string | undefined;
+    state: string | undefined;
+    disabled: boolean | undefined;
+};
+export interface WorkloadIdentityPool extends Resource<"GCP.WorkloadIdentityPool", WorkloadIdentityPoolProps, WorkloadIdentityPoolAttributes, never, GCP.Providers> {
+}
+export declare const WorkloadIdentityPool: import("alchemy").ResourceClass<WorkloadIdentityPool>;
+/** `projects/{project}/locations/global` — the only supported location. */
+export declare const poolParent: (project: string) => string;
+export declare const poolResourceName: (project: string, poolId: string) => string;
+/**
+ * Alchemy provider factory for {@link WorkloadIdentityPool}.
+ *
+ * Deliberately NOT named `WorkloadIdentityPoolProvider`, which the repo's
+ * `X` + `XProvider` convention would suggest: GCP already uses that exact
+ * term for a different, user-facing resource — the OIDC provider inside a
+ * pool ({@link import("./WorkloadIdentityPoolProvider.ts").WorkloadIdentityPoolProvider}).
+ * The resource keeps GCP's name; this internal factory takes the awkward one.
+ */
+export declare const WorkloadIdentityPoolResourceProvider: () => import("effect/Layer").Layer<Provider.Provider<WorkloadIdentityPool>, never, import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient | import("alchemy").Stack | import("alchemy").Stage>;
+//# sourceMappingURL=WorkloadIdentityPool.d.ts.map

package/lib/Iam/WorkloadIdentityPool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkloadIdentityPool.d.ts","sourceRoot":"","sources":["../../src/Iam/WorkloadIdentityPool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAO7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAG5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IAC3C,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,8DAA8D;IAC9D,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/B,CAAC;AAEF,MAAM,WAAW,oBACf,SAAQ,QAAQ,CACd,0BAA0B,EAC1B,yBAAyB,EACzB,8BAA8B,EAC9B,KAAK,EACL,GAAG,CAAC,SAAS,CACd;CAAG;AAEN,eAAO,MAAM,oBAAoB,uDAEhC,CAAC;AAcF,2EAA2E;AAC3E,eAAO,MAAM,UAAU,YAAa,MAAM,WACF,CAAC;AAEzC,eAAO,MAAM,gBAAgB,YAAa,MAAM,UAAU,MAAM,WACN,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC,2OA0K9C,CAAC"}

package/lib/Iam/WorkloadIdentityPool.js

@@ -0,0 +1,175 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as iam from "@distilled.cloud/gcp/unstable/iam-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import { descriptionHasAlchemyMarker, gcpAlchemyDescription, stripAlchemyMarker, } from "../Tags.js";
+import { makeAwaitOperation } from "./Operations.js";
+export const WorkloadIdentityPool = Resource("GCP.WorkloadIdentityPool");
+/**
+ * Treat absent and empty-string as the same value.
+ *
+ * The patch below uses a FIXED `updateMask` while the body omits unset
+ * optional fields — deliberately, since under a field mask an omitted field
+ * means "clear it". The hazard is the comparison: if GCP echoes a cleared
+ * field back as `""` rather than omitting it, a raw `!==` against `undefined`
+ * would report drift on every deploy and churn a patch LRO forever.
+ */
+const sameText = (a, b) => (a ?? "") === (b ?? "");
+/** `projects/{project}/locations/global` — the only supported location. */
+export const poolParent = (project) => `projects/${project}/locations/global`;
+export const poolResourceName = (project, poolId) => `${poolParent(project)}/workloadIdentityPools/${poolId}`;
+/**
+ * Alchemy provider factory for {@link WorkloadIdentityPool}.
+ *
+ * Deliberately NOT named `WorkloadIdentityPoolProvider`, which the repo's
+ * `X` + `XProvider` convention would suggest: GCP already uses that exact
+ * term for a different, user-facing resource — the OIDC provider inside a
+ * pool ({@link import("./WorkloadIdentityPoolProvider.ts").WorkloadIdentityPoolProvider}).
+ * The resource keeps GCP's name; this internal factory takes the awkward one.
+ */
+export const WorkloadIdentityPoolResourceProvider = () => Provider.effect(WorkloadIdentityPool, Effect.gen(function* () {
+    const getPool = yield* iam.getProjectsLocationsWorkloadIdentityPools;
+    const createPool = yield* iam.createProjectsLocationsWorkloadIdentityPools;
+    const patchPool = yield* iam.patchProjectsLocationsWorkloadIdentityPools;
+    const deletePool = yield* iam.deleteProjectsLocationsWorkloadIdentityPools;
+    const undeletePool = yield* iam.undeleteProjectsLocationsWorkloadIdentityPools;
+    const getOperations = yield* iam.getProjectsLocationsWorkloadIdentityPoolsOperations;
+    const awaitOperation = makeAwaitOperation(getOperations, "Workload Identity pool");
+    // Absent and invisible collapse to the same thing, matching the
+    // ServiceAccount observer: a 403 on a resource we are about to create
+    // is indistinguishable from a 404 without extra permissions we may not
+    // have.
+    const observePool = (project, poolId) => getPool({ name: poolResourceName(project, poolId) }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+    const toAttrs = (project, poolId, pool) => ({
+        name: pool.name ?? poolResourceName(project, poolId),
+        project,
+        poolId,
+        displayName: pool.displayName,
+        description: stripAlchemyMarker(pool.description),
+        state: pool.state,
+        disabled: pool.disabled,
+    });
+    return {
+        stables: ["name", "project", "poolId"],
+        diff: Effect.fn(function* ({ olds = {}, news, output }) {
+            if (!isResolved(news))
+                return undefined;
+            const oldProps = olds;
+            // Prefer live attributes over persisted props, and fall back to the
+            // DESIRED value when neither is known — mirroring Project.ts.
+            //
+            // Defaulting to `undefined` instead would make an adoption (output
+            // present, olds absent) compare `undefined !== news.project` and
+            // return `replace`, deleting and recreating a live pool that was
+            // already correct. Both fields are part of the resource name, so a
+            // genuine change here really is a replacement; the point is only to
+            // avoid inventing one.
+            const currentProject = output?.project || oldProps.project || news.project;
+            const currentPoolId = output?.poolId || oldProps.poolId || news.poolId;
+            if (currentProject !== news.project || currentPoolId !== news.poolId) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            const project = output?.project || olds?.project;
+            const poolId = output?.poolId || olds?.poolId;
+            if (!project || !poolId)
+                return undefined;
+            const pool = yield* observePool(project, poolId);
+            if (!pool)
+                return undefined;
+            const attrs = toAttrs(project, poolId, pool);
+            return (yield* descriptionHasAlchemyMarker(id, pool.description))
+                ? attrs
+                : Unowned(attrs);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+            const { project, poolId } = news;
+            const description = yield* gcpAlchemyDescription(id, news.description);
+            // Body is TOTAL over the patch's updateMask below: every masked
+            // field is always present, with an explicit empty/default value
+            // when the prop is unset. Behaviourally identical to omitting them
+            // (a masked-but-absent field is cleared), but it states the intent
+            // in code rather than relying on that field-mask subtlety, so
+            // "clear displayName" cannot be misread as "leave it alone".
+            const body = {
+                displayName: news.displayName ?? "",
+                description,
+                disabled: news.disabled ?? false,
+            };
+            let pool = yield* observePool(project, poolId);
+            // A soft-deleted pool holds its ID for ~30 days. Undelete rather
+            // than fail: otherwise destroy-then-redeploy is stuck until the
+            // purge, with no way out but renaming the pool.
+            if (pool?.state === "DELETED") {
+                yield* session.note(`Undeleting soft-deleted Workload Identity pool ${poolId}…`);
+                const op = yield* undeletePool({
+                    name: poolResourceName(project, poolId),
+                    body: {},
+                });
+                if (op.name)
+                    yield* awaitOperation(op.name, session);
+                pool = yield* observePool(project, poolId);
+            }
+            if (!pool) {
+                const op = yield* createPool({
+                    parent: poolParent(project),
+                    workloadIdentityPoolId: poolId,
+                    body,
+                });
+                if (op.name)
+                    yield* awaitOperation(op.name, session);
+                pool = yield* observePool(project, poolId);
+                if (!pool) {
+                    return yield* new ConfigError({
+                        message: `Workload Identity pool ${poolId} in project ${project} was not readable after create.`,
+                    });
+                }
+            }
+            else {
+                // Only the mutable fields, and only when they actually differ —
+                // an unconditional patch would churn an LRO on every deploy.
+                const needsPatch = !sameText(pool.displayName, news.displayName) ||
+                    !sameText(pool.description, description) ||
+                    (pool.disabled ?? false) !== (news.disabled ?? false);
+                if (needsPatch) {
+                    const op = yield* patchPool({
+                        name: poolResourceName(project, poolId),
+                        updateMask: "displayName,description,disabled",
+                        body,
+                    });
+                    if (op.name)
+                        yield* awaitOperation(op.name, session);
+                    pool = (yield* observePool(project, poolId)) ?? pool;
+                }
+            }
+            yield* session.note(poolResourceName(project, poolId));
+            return toAttrs(project, poolId, pool);
+        }),
+        delete: Effect.fn(function* ({ olds, output, session }) {
+            // Fall back to props when attributes are incomplete. A create whose
+            // LRO succeeded but whose follow-up read failed leaves state with
+            // props and no usable attributes; a no-op destroy would then LEAK
+            // the pool — and because deletion is soft, the leaked pool holds
+            // its ID for ~30 days, blocking a re-deploy under the same name.
+            // `||` not `??`: an empty string is never a valid identity here,
+            // and a persisted `""` must fall through to the next source rather
+            // than be taken as real. With `??` a corrupt/partial state entry
+            // would short-circuit the fallback and turn destroy into a silent
+            // no-op (or make diff replace a live resource).
+            const project = output?.project || olds?.project;
+            const poolId = output?.poolId || olds?.poolId;
+            if (!project || !poolId)
+                return;
+            const op = yield* deletePool({
+                name: poolResourceName(project, poolId),
+            }).pipe(Effect.catchTag("NotFound", () => Effect.succeed({ name: undefined })));
+            if (op.name)
+                yield* awaitOperation(op.name, session);
+        }),
+    };
+}));
+//# sourceMappingURL=WorkloadIdentityPool.js.map

package/lib/Iam/WorkloadIdentityPool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkloadIdentityPool.js","sourceRoot":"","sources":["../../src/Iam/WorkloadIdentityPool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,GAAG,MAAM,sCAAsC,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AA6FrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAC1C,0BAA0B,CAC3B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,QAAQ,GAAG,CAAC,CAAqB,EAAE,CAAqB,EAAE,EAAE,CAChE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAE1B,2EAA2E;AAC3E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,EAAE,CAC5C,YAAY,OAAO,mBAAmB,CAAC;AAEzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAE,MAAc,EAAE,EAAE,CAClE,GAAG,UAAU,CAAC,OAAO,CAAC,0BAA0B,MAAM,EAAE,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,GAAG,EAAE,CACvD,QAAQ,CAAC,MAAM,CACb,oBAAoB,EACpB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,yCAAyC,CAAC;IACrE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,4CAA4C,CAAC;IAC3E,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,2CAA2C,CAAC;IACzE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,4CAA4C,CAAC;IAC3E,MAAM,YAAY,GAChB,KAAK,CAAC,CAAC,GAAG,CAAC,8CAA8C,CAAC;IAC5D,MAAM,aAAa,GACjB,KAAK,CAAC,CAAC,GAAG,CAAC,mDAAmD,CAAC;IACjE,MAAM,cAAc,GAAG,kBAAkB,CACvC,aAAa,EACb,wBAAwB,CACzB,CAAC;IAEF,gEAAgE;IAChE,sEAAsE;IACtE,uEAAuE;IACvE,QAAQ;IACR,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,MAAc,EAAE,EAAE,CACtD,OAAO,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CACvD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,SAAiD,CAAC,CAClE,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CAAC,SAAiD,CAAC,CAClE,CACF,CAAC;IAEJ,MAAM,OAAO,GAAG,CACd,OAAe,EACf,MAAc,EACd,IAA8B,EACE,EAAE,CAAC,CAAC;QACpC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;QACpD,OAAO;QACP,MAAM;QACN,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC;QACjD,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;QACtC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,QAAQ,GAAG,IAA0C,CAAC;YAC5D,oEAAoE;YACpE,8DAA8D;YAC9D,EAAE;YACF,mEAAmE;YACnE,iEAAiE;YACjE,iEAAiE;YACjE,mEAAmE;YACnE,oEAAoE;YACpE,uBAAuB;YACvB,MAAM,cAAc,GAAG,MAAM,EAAE,OAAO,IAAI,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;YAC3E,MAAM,aAAa,GAAG,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;YACvE,IAAI,cAAc,KAAK,IAAI,CAAC,OAAO,IAAI,aAAa,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBACrE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;YAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,CAAC,2BAA2B,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC/D,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YACnD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;YACjC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAC9C,EAAE,EACF,IAAI,CAAC,WAAW,CACjB,CAAC;YACF,gEAAgE;YAChE,gEAAgE;YAChE,mEAAmE;YACnE,mEAAmE;YACnE,8DAA8D;YAC9D,6DAA6D;YAC7D,MAAM,IAAI,GAA6B;gBACrC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;gBACnC,WAAW;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;aACjC,CAAC;YAEF,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAE/C,iEAAiE;YACjE,gEAAgE;YAChE,gDAAgD;YAChD,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC9B,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CACjB,kDAAkD,MAAM,GAAG,CAC5D,CAAC;gBACF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;oBAC7B,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;oBACvC,IAAI,EAAE,EAAE;iBACT,CAAC,CAAC;gBACH,IAAI,EAAE,CAAC,IAAI;oBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACrD,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7C,CAAC;YAED,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;oBAC3B,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC;oBAC3B,sBAAsB,EAAE,MAAM;oBAC9B,IAAI;iBACL,CAAC,CAAC;gBACH,IAAI,EAAE,CAAC,IAAI;oBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACrD,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC;wBAC5B,OAAO,EAAE,0BAA0B,MAAM,eAAe,OAAO,iCAAiC;qBACjG,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,gEAAgE;gBAChE,6DAA6D;gBAC7D,MAAM,UAAU,GACd,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC;oBAC7C,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC;oBACxC,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC;gBACxD,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;wBAC1B,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;wBACvC,UAAU,EAAE,kCAAkC;wBAC9C,IAAI;qBACL,CAAC,CAAC;oBACH,IAAI,EAAE,CAAC,IAAI;wBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBACrD,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC;gBACvD,CAAC;YACH,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YACvD,OAAO,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YACpD,oEAAoE;YACpE,kEAAkE;YAClE,kEAAkE;YAClE,iEAAiE;YACjE,iEAAiE;YACjE,iEAAiE;YACjE,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,gDAAgD;YAChD,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;YAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;gBAAE,OAAO;YAChC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;gBAC3B,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;aACxC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAmB,CAAC,CACrD,CACF,CAAC;YACF,IAAI,EAAE,CAAC,IAAI;gBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACvD,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Iam/WorkloadIdentityPoolProvider.d.ts

@@ -0,0 +1,124 @@
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import type * as GCP from "../Providers.ts";
+/**
+ * An OIDC **provider** inside a
+ * {@link import("./WorkloadIdentityPool.ts").WorkloadIdentityPool} — the
+ * thing that actually declares "I trust tokens issued by this URL".
+ *
+ * The canonical use is keyless federation from another cloud: point
+ * `oidc.issuerUri` at an EKS/AKS/GKE cluster's OIDC issuer, and pods holding
+ * a projected ServiceAccount token can impersonate a GSA with no key material
+ * anywhere in the system.
+ *
+ * ### `attributeMapping` is required and `google.subject` is mandatory
+ *
+ * The mapping turns claims on the incoming token into Google attributes. At
+ * minimum `google.subject` must be mapped; it is what `principal://` members
+ * match on. For a Kubernetes issuer the subject claim is
+ * `system:serviceaccount:{namespace}:{name}`, so:
+ *
+ * ```typescript
+ * attributeMapping: { "google.subject": "assertion.sub" }
+ * ```
+ *
+ * ### Set `allowedAudiences`, or the default is surprising
+ *
+ * When `oidc.allowedAudiences` is empty, GCP accepts only the *default*
+ * audience — the full provider resource name prefixed with
+ * `https://iam.googleapis.com/`. A Kubernetes projected token minted for
+ * audience `sts.googleapis.com` (or anything else) is then rejected with a
+ * generic audience error. Set this explicitly to whatever audience the
+ * token is actually minted for.
+ *
+ * ### Constrain trust with `attributeCondition`
+ *
+ * An issuer-only trust accepts **every** identity that issuer can mint — on
+ * a Kubernetes cluster, that is every ServiceAccount in every namespace. Pair
+ * the provider with an `attributeCondition` (and a narrow `principal://`
+ * member on the GSA binding) so a token from an unrelated namespace cannot
+ * impersonate anything.
+ *
+ * @section Creating a WorkloadIdentityPoolProvider
+ * @example Trust one Kubernetes ServiceAccount on an EKS cluster
+ * ```typescript
+ * const provider = yield* GCP.WorkloadIdentityPoolProvider("EksOidc", {
+ *   project: "123456789",
+ *   poolId: pool.poolId,
+ *   providerId: "eks-oidc",
+ *   oidc: {
+ *     issuerUri: "https://oidc.eks.us-east-1.amazonaws.com/id/ABC123",
+ *     allowedAudiences: ["sts.googleapis.com"],
+ *   },
+ *   attributeMapping: { "google.subject": "assertion.sub" },
+ *   attributeCondition:
+ *     "assertion.sub == 'system:serviceaccount:admin:eks-auth-reconciler'",
+ * });
+ * ```
+ */
+export type WorkloadIdentityPoolProviderProps = {
+    /** Project that owns the pool. Prefer the project **number**. */
+    project: string;
+    /** ID of the enclosing pool. */
+    poolId: string;
+    /**
+     * Provider ID, 4–32 characters of `[a-z0-9-]`. Immutable — changing it
+     * replaces the provider. The `gcp-` prefix is reserved by Google.
+     */
+    providerId: string;
+    /** The OIDC issuer this provider trusts. */
+    oidc: {
+        /** Issuer URL. Must be HTTPS and serve an OIDC discovery document. */
+        issuerUri: string;
+        /**
+         * Acceptable `aud` values. Leave unset only if the token is minted for
+         * the provider's default audience — see the note above.
+         */
+        allowedAudiences?: string[];
+        /**
+         * Inline JWKS, for issuers whose keys are not publicly reachable. When
+         * unset, GCP fetches `jwks_uri` from the issuer's discovery document,
+         * which requires the issuer to be reachable from Google's network.
+         */
+        jwksJson?: string;
+    };
+    /**
+     * Claim-to-attribute mapping. Must include `google.subject`.
+     */
+    attributeMapping: Record<string, string>;
+    /** CEL expression further restricting which credentials are accepted. */
+    attributeCondition?: string;
+    /** Display name, max 32 characters. */
+    displayName?: string;
+    /** Description, max 256 characters. */
+    description?: string;
+    /** Disable the provider without deleting it. */
+    disabled?: boolean;
+};
+export type WorkloadIdentityPoolProviderAttributes = {
+    /** Full resource name, `…/workloadIdentityPools/{pool}/providers/{id}`. */
+    name: string;
+    project: string;
+    poolId: string;
+    providerId: string;
+    issuerUri: string | undefined;
+    allowedAudiences: readonly string[] | undefined;
+    attributeMapping: Record<string, string> | undefined;
+    attributeCondition: string | undefined;
+    displayName: string | undefined;
+    description: string | undefined;
+    state: string | undefined;
+    disabled: boolean | undefined;
+    /**
+     * The audience string to put in a credential configuration, i.e.
+     * `//iam.googleapis.com/{name}`. Provided because assembling it by hand is
+     * easy to get subtly wrong (the leading `//`, and no scheme).
+     */
+    audience: string;
+};
+export interface WorkloadIdentityPoolProvider extends Resource<"GCP.WorkloadIdentityPoolProvider", WorkloadIdentityPoolProviderProps, WorkloadIdentityPoolProviderAttributes, never, GCP.Providers> {
+}
+export declare const WorkloadIdentityPoolProvider: import("alchemy").ResourceClass<WorkloadIdentityPoolProvider>;
+export declare const providerResourceName: (project: string, poolId: string, providerId: string) => string;
+export declare const WorkloadIdentityPoolProviderProvider: () => import("effect/Layer").Layer<Provider.Provider<WorkloadIdentityPoolProvider>, never, import("@distilled.cloud/gcp").Credentials | import("effect/unstable/http/HttpClient").HttpClient | import("alchemy").Stack | import("alchemy").Stage>;
+//# sourceMappingURL=WorkloadIdentityPoolProvider.d.ts.map

package/lib/Iam/WorkloadIdentityPoolProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkloadIdentityPoolProvider.d.ts","sourceRoot":"","sources":["../../src/Iam/WorkloadIdentityPoolProvider.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAO7C,OAAO,KAAK,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAI5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC9C,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,IAAI,EAAE;QACJ,sEAAsE;QACtE,SAAS,EAAE,MAAM,CAAC;QAClB;;;WAGG;QACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC5B;;;;WAIG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,yEAAyE;IACzE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,sCAAsC,GAAG;IACnD,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAG9B,gBAAgB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAChD,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACrD,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,WAAW,4BACf,SAAQ,QAAQ,CACd,kCAAkC,EAClC,iCAAiC,EACjC,sCAAsC,EACtC,KAAK,EACL,GAAG,CAAC,SAAS,CACd;CAAG;AAEN,eAAO,MAAM,4BAA4B,+DACmC,CAAC;AAE7E,eAAO,MAAM,oBAAoB,YACtB,MAAM,UACP,MAAM,cACF,MAAM,WAC+C,CAAC;AAgDpE,eAAO,MAAM,oCAAoC,mPAiO9C,CAAC"}