@microagi/alchemy-gcp 0.11.6 → 0.11.7

package/lib/Iam/WorkloadIdentityPoolProvider.js

@@ -0,0 +1,222 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import * as iam from "@distilled.cloud/gcp/unstable/iam-v1";
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Effect from "effect/Effect";
+import { descriptionHasAlchemyMarker, gcpAlchemyDescription, stripAlchemyMarker, } from "../Tags.js";
+import { makeAwaitOperation } from "./Operations.js";
+import { poolResourceName } from "./WorkloadIdentityPool.js";
+export const WorkloadIdentityPoolProvider = Resource("GCP.WorkloadIdentityPoolProvider");
+export const providerResourceName = (project, poolId, providerId) => `${poolResourceName(project, poolId)}/providers/${providerId}`;
+/**
+ * Compare two claim mappings by CONTENT, not serialisation.
+ *
+ * `JSON.stringify` preserves key insertion order, and the order GCP returns
+ * these keys in need not match the order they were sent in. A raw stringify
+ * comparison therefore reports drift for two identical mappings and fires a
+ * patch LRO on every single deploy.
+ */
+const sameMapping = (a, b) => {
+    const entries = (r) => Object.entries(r ?? {}).sort(([x], [y]) => (x < y ? -1 : x > y ? 1 : 0));
+    return JSON.stringify(entries(a)) === JSON.stringify(entries(b));
+};
+/**
+ * Compare audience allow-lists as SETS.
+ *
+ * `allowedAudiences` is an allow-list: membership is what matters, order is
+ * not meaningful, and GCP is free to return it in any order. Comparing it
+ * positionally would make a reordering look like drift forever.
+ */
+const sameAudiences = (a, b) => {
+    const sorted = (v) => [...(v ?? [])].sort();
+    return JSON.stringify(sorted(a)) === JSON.stringify(sorted(b));
+};
+/**
+ * Treat absent and empty-string as the same value.
+ *
+ * The patch below uses a FIXED `updateMask` while the request body omits
+ * unset optional fields — which is deliberate: under a field mask, an omitted
+ * field means "clear it", so dropping `displayName` from the props really
+ * should clear it on GCP. The hazard is only in the comparison afterwards. If
+ * GCP echoes a cleared field back as `""` rather than omitting it, a raw
+ * `!==` against `undefined` would report drift on every single deploy and
+ * churn a long-running patch operation forever.
+ */
+const sameText = (a, b) => (a ?? "") === (b ?? "");
+export const WorkloadIdentityPoolProviderProvider = () => Provider.effect(WorkloadIdentityPoolProvider, Effect.gen(function* () {
+    const getProvider = yield* iam.getProjectsLocationsWorkloadIdentityPoolsProviders;
+    const createProvider = yield* iam.createProjectsLocationsWorkloadIdentityPoolsProviders;
+    const patchProvider = yield* iam.patchProjectsLocationsWorkloadIdentityPoolsProviders;
+    const deleteProvider = yield* iam.deleteProjectsLocationsWorkloadIdentityPoolsProviders;
+    const undeleteProvider = yield* iam.undeleteProjectsLocationsWorkloadIdentityPoolsProviders;
+    const getOperations = yield* iam.getProjectsLocationsWorkloadIdentityPoolsProvidersOperations;
+    const awaitOperation = makeAwaitOperation(getOperations, "Workload Identity provider");
+    const observeProvider = (project, poolId, providerId) => getProvider({
+        name: providerResourceName(project, poolId, providerId),
+    }).pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)), Effect.catchTag("Forbidden", () => Effect.succeed(undefined)));
+    const toAttrs = (project, poolId, providerId, provider) => {
+        const name = provider.name ?? providerResourceName(project, poolId, providerId);
+        return {
+            name,
+            project,
+            poolId,
+            providerId,
+            issuerUri: provider.oidc?.issuerUri,
+            allowedAudiences: provider.oidc?.allowedAudiences,
+            attributeMapping: provider.attributeMapping,
+            attributeCondition: provider.attributeCondition,
+            displayName: provider.displayName,
+            description: stripAlchemyMarker(provider.description),
+            state: provider.state,
+            disabled: provider.disabled,
+            audience: `//iam.googleapis.com/${name}`,
+        };
+    };
+    return {
+        stables: ["name", "project", "poolId", "providerId", "audience"],
+        diff: Effect.fn(function* ({ olds = {}, news, output }) {
+            if (!isResolved(news))
+                return undefined;
+            const oldProps = olds;
+            // Prefer live attributes over persisted props, and fall back to the
+            // DESIRED value when neither is known — see the equivalent comment
+            // in WorkloadIdentityPool.ts. Defaulting to `undefined` would make
+            // an adoption replace a live, correct provider.
+            //
+            // All three fields are part of the resource name; the API cannot
+            // move a provider between pools or rename it.
+            const currentProject = output?.project || oldProps.project || news.project;
+            const currentPoolId = output?.poolId || oldProps.poolId || news.poolId;
+            const currentProviderId = output?.providerId || oldProps.providerId || news.providerId;
+            if (currentProject !== news.project ||
+                currentPoolId !== news.poolId ||
+                currentProviderId !== news.providerId) {
+                return { action: "replace" };
+            }
+        }),
+        read: Effect.fn(function* ({ id, olds, output }) {
+            const project = output?.project || olds?.project;
+            const poolId = output?.poolId || olds?.poolId;
+            const providerId = output?.providerId || olds?.providerId;
+            if (!project || !poolId || !providerId)
+                return undefined;
+            const provider = yield* observeProvider(project, poolId, providerId);
+            if (!provider)
+                return undefined;
+            const attrs = toAttrs(project, poolId, providerId, provider);
+            return (yield* descriptionHasAlchemyMarker(id, provider.description))
+                ? attrs
+                : Unowned(attrs);
+        }),
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+            const { project, poolId, providerId } = news;
+            if (!news.attributeMapping["google.subject"]) {
+                // Caught here rather than at the API, which rejects it with a
+                // message that does not name the missing key.
+                return yield* new ConfigError({
+                    message: `Workload Identity provider ${providerId} must map 'google.subject' in attributeMapping.`,
+                });
+            }
+            const description = yield* gcpAlchemyDescription(id, news.description);
+            // Scalars are TOTAL over the updateMask below — always present,
+            // explicit empty/default when unset — so clearing is stated in code
+            // rather than implied by field-mask semantics.
+            //
+            // `attributeCondition` and `oidc.jwksJson` are the exception and
+            // stay conditional: both are validated formats (a CEL expression
+            // and a JWKS document), and sending "" risks a parse rejection
+            // where omission is unambiguous. They are still cleared correctly
+            // when unset — `oidc` is masked as a whole message, so the body's
+            // `oidc` replaces it outright.
+            const body = {
+                displayName: news.displayName ?? "",
+                description,
+                disabled: news.disabled ?? false,
+                attributeMapping: news.attributeMapping,
+                ...(news.attributeCondition
+                    ? { attributeCondition: news.attributeCondition }
+                    : {}),
+                oidc: {
+                    issuerUri: news.oidc.issuerUri,
+                    allowedAudiences: news.oidc.allowedAudiences ?? [],
+                    ...(news.oidc.jwksJson ? { jwksJson: news.oidc.jwksJson } : {}),
+                },
+            };
+            let provider = yield* observeProvider(project, poolId, providerId);
+            // Same soft-delete reasoning as the pool: the ID is held until the
+            // purge, so undelete rather than strand the deploy.
+            if (provider?.state === "DELETED") {
+                yield* session.note(`Undeleting soft-deleted Workload Identity provider ${providerId}…`);
+                const op = yield* undeleteProvider({
+                    name: providerResourceName(project, poolId, providerId),
+                    body: {},
+                });
+                if (op.name)
+                    yield* awaitOperation(op.name, session);
+                provider = yield* observeProvider(project, poolId, providerId);
+            }
+            if (!provider) {
+                const op = yield* createProvider({
+                    parent: poolResourceName(project, poolId),
+                    workloadIdentityPoolProviderId: providerId,
+                    body,
+                });
+                if (op.name)
+                    yield* awaitOperation(op.name, session);
+                provider = yield* observeProvider(project, poolId, providerId);
+                if (!provider) {
+                    return yield* new ConfigError({
+                        message: `Workload Identity provider ${providerId} in pool ${poolId} was not readable after create.`,
+                    });
+                }
+            }
+            else {
+                const needsPatch = !sameText(provider.displayName, news.displayName) ||
+                    !sameText(provider.description, description) ||
+                    (provider.disabled ?? false) !== (news.disabled ?? false) ||
+                    !sameText(provider.attributeCondition, news.attributeCondition) ||
+                    !sameMapping(provider.attributeMapping, news.attributeMapping) ||
+                    !sameText(provider.oidc?.issuerUri, news.oidc.issuerUri) ||
+                    !sameAudiences(provider.oidc?.allowedAudiences, news.oidc.allowedAudiences) ||
+                    !sameText(provider.oidc?.jwksJson, news.oidc.jwksJson);
+                if (needsPatch) {
+                    const op = yield* patchProvider({
+                        name: providerResourceName(project, poolId, providerId),
+                        updateMask: "displayName,description,disabled,attributeMapping,attributeCondition,oidc",
+                        body,
+                    });
+                    if (op.name)
+                        yield* awaitOperation(op.name, session);
+                    provider =
+                        (yield* observeProvider(project, poolId, providerId)) ??
+                            provider;
+                }
+            }
+            yield* session.note(providerResourceName(project, poolId, providerId));
+            return toAttrs(project, poolId, providerId, provider);
+        }),
+        delete: Effect.fn(function* ({ olds, output, session }) {
+            // Props fallback for the same reason as the pool: incomplete
+            // attributes must not turn destroy into a silent no-op that leaks a
+            // soft-deleted-name-holding resource.
+            // `||` not `??`: an empty string is never a valid identity here,
+            // and a persisted `""` must fall through to the next source rather
+            // than be taken as real. With `??` a corrupt/partial state entry
+            // would short-circuit the fallback and turn destroy into a silent
+            // no-op (or make diff replace a live resource).
+            const project = output?.project || olds?.project;
+            const poolId = output?.poolId || olds?.poolId;
+            const providerId = output?.providerId || olds?.providerId;
+            if (!project || !poolId || !providerId)
+                return;
+            const op = yield* deleteProvider({
+                name: providerResourceName(project, poolId, providerId),
+            }).pipe(Effect.catchTag("NotFound", () => Effect.succeed({ name: undefined })));
+            if (op.name)
+                yield* awaitOperation(op.name, session);
+        }),
+    };
+}));
+//# sourceMappingURL=WorkloadIdentityPoolProvider.js.map

package/lib/Iam/WorkloadIdentityPoolProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkloadIdentityPoolProvider.js","sourceRoot":"","sources":["../../src/Iam/WorkloadIdentityPoolProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,GAAG,MAAM,sCAAsC,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAkI7D,MAAM,CAAC,MAAM,4BAA4B,GACvC,QAAQ,CAA+B,kCAAkC,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAe,EACf,MAAc,EACd,UAAkB,EAClB,EAAE,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,cAAc,UAAU,EAAE,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,WAAW,GAAG,CAClB,CAAqC,EACrC,CAAqC,EACrC,EAAE;IACF,MAAM,OAAO,GAAG,CAAC,CAAqC,EAAE,EAAE,CACxD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,CACpB,CAAgC,EAChC,CAAgC,EAChC,EAAE;IACF,MAAM,MAAM,GAAG,CAAC,CAAgC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3E,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,QAAQ,GAAG,CAAC,CAAqB,EAAE,CAAqB,EAAE,EAAE,CAChE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAE1B,MAAM,CAAC,MAAM,oCAAoC,GAAG,GAAG,EAAE,CACvD,QAAQ,CAAC,MAAM,CACb,4BAA4B,EAC5B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,WAAW,GACf,KAAK,CAAC,CAAC,GAAG,CAAC,kDAAkD,CAAC;IAChE,MAAM,cAAc,GAClB,KAAK,CAAC,CAAC,GAAG,CAAC,qDAAqD,CAAC;IACnE,MAAM,aAAa,GACjB,KAAK,CAAC,CAAC,GAAG,CAAC,oDAAoD,CAAC;IAClE,MAAM,cAAc,GAClB,KAAK,CAAC,CAAC,GAAG,CAAC,qDAAqD,CAAC;IACnE,MAAM,gBAAgB,GACpB,KAAK,CAAC,CAAC,GAAG,CAAC,uDAAuD,CAAC;IACrE,MAAM,aAAa,GACjB,KAAK,CAAC,CAAC,GAAG,CAAC,4DAA4D,CAAC;IAC1E,MAAM,cAAc,GAAG,kBAAkB,CACvC,aAAa,EACb,4BAA4B,CAC7B,CAAC;IAEF,MAAM,eAAe,GAAG,CACtB,OAAe,EACf,MAAc,EACd,UAAkB,EAClB,EAAE,CACF,WAAW,CAAC;QACV,IAAI,EAAE,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC;KACxD,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CACZ,SAAyD,CAC1D,CACF,EACD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CACZ,SAAyD,CAC1D,CACF,CACF,CAAC;IAEJ,MAAM,OAAO,GAAG,CACd,OAAe,EACf,MAAc,EACd,UAAkB,EAClB,QAA0C,EACF,EAAE;QAC1C,MAAM,IAAI,GACR,QAAQ,CAAC,IAAI,IAAI,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACrE,OAAO;YACL,IAAI;YACJ,OAAO;YACP,MAAM;YACN,UAAU;YACV,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS;YACnC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB;YACjD,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,WAAW,EAAE,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC;YACrD,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,wBAAwB,IAAI,EAAE;SACzC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC;QAChE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAkD,CAAC;YACpE,oEAAoE;YACpE,mEAAmE;YACnE,mEAAmE;YACnE,gDAAgD;YAChD,EAAE;YACF,iEAAiE;YACjE,8CAA8C;YAC9C,MAAM,cAAc,GAAG,MAAM,EAAE,OAAO,IAAI,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;YAC3E,MAAM,aAAa,GAAG,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;YACvE,MAAM,iBAAiB,GACrB,MAAM,EAAE,UAAU,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC;YAC/D,IACE,cAAc,KAAK,IAAI,CAAC,OAAO;gBAC/B,aAAa,KAAK,IAAI,CAAC,MAAM;gBAC7B,iBAAiB,KAAK,IAAI,CAAC,UAAU,EACrC,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;YAC9C,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,IAAI,EAAE,UAAU,CAAC;YAC1D,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YACrE,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,CAAC,2BAA2B,CAAC,EAAE,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACnE,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YACnD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC7C,8DAA8D;gBAC9D,8CAA8C;gBAC9C,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC;oBAC5B,OAAO,EAAE,8BAA8B,UAAU,iDAAiD;iBACnG,CAAC,CAAC;YACL,CAAC;YACD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAC9C,EAAE,EACF,IAAI,CAAC,WAAW,CACjB,CAAC;YACF,gEAAgE;YAChE,oEAAoE;YACpE,+CAA+C;YAC/C,EAAE;YACF,iEAAiE;YACjE,iEAAiE;YACjE,+DAA+D;YAC/D,kEAAkE;YAClE,kEAAkE;YAClE,+BAA+B;YAC/B,MAAM,IAAI,GAAqC;gBAC7C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;gBACnC,WAAW;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;gBAChC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,GAAG,CAAC,IAAI,CAAC,kBAAkB;oBACzB,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE;oBACjD,CAAC,CAAC,EAAE,CAAC;gBACP,IAAI,EAAE;oBACJ,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;oBAC9B,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE;oBAClD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChE;aACF,CAAC;YAEF,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YAEnE,mEAAmE;YACnE,oDAAoD;YACpD,IAAI,QAAQ,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;gBAClC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CACjB,sDAAsD,UAAU,GAAG,CACpE,CAAC;gBACF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;oBACjC,IAAI,EAAE,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC;oBACvD,IAAI,EAAE,EAAE;iBACT,CAAC,CAAC;gBACH,IAAI,EAAE,CAAC,IAAI;oBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACrD,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YACjE,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;oBAC/B,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;oBACzC,8BAA8B,EAAE,UAAU;oBAC1C,IAAI;iBACL,CAAC,CAAC;gBACH,IAAI,EAAE,CAAC,IAAI;oBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACrD,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;gBAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC;wBAC5B,OAAO,EAAE,8BAA8B,UAAU,YAAY,MAAM,iCAAiC;qBACrG,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,GACd,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC;oBACjD,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;oBAC5C,CAAC,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;oBACzD,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,CAAC;oBAC/D,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC;oBAC9D,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;oBACxD,CAAC,aAAa,CACZ,QAAQ,CAAC,IAAI,EAAE,gBAAgB,EAC/B,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAC3B;oBACD,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzD,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;wBAC9B,IAAI,EAAE,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC;wBACvD,UAAU,EACR,2EAA2E;wBAC7E,IAAI;qBACL,CAAC,CAAC;oBACH,IAAI,EAAE,CAAC,IAAI;wBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBACrD,QAAQ;wBACN,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;4BACrD,QAAQ,CAAC;gBACb,CAAC;YACH,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CACjB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAClD,CAAC;YACF,OAAO,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACxD,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YACpD,6DAA6D;YAC7D,oEAAoE;YACpE,sCAAsC;YACtC,iEAAiE;YACjE,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,gDAAgD;YAChD,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;YAC9C,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,IAAI,EAAE,UAAU,CAAC;YAC1D,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU;gBAAE,OAAO;YAC/C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;gBAC/B,IAAI,EAAE,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC;aACxD,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAmB,CAAC,CACrD,CACF,CAAC;YACF,IAAI,EAAE,CAAC,IAAI;gBAAE,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACvD,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/Iam/index.d.ts

@@ -3,4 +3,8 @@ export type { ServiceAccountProps } from "./ServiceAccount.ts";
 export * from "./ServiceAccountIamMember.ts";
 export { ServiceAccountKey, ServiceAccountKeyProvider, } from "./ServiceAccountKey.ts";
 export type { ServiceAccountKeyProps } from "./ServiceAccountKey.ts";
+export { WorkloadIdentityPool, WorkloadIdentityPoolResourceProvider, } from "./WorkloadIdentityPool.ts";
+export type { WorkloadIdentityPoolProps } from "./WorkloadIdentityPool.ts";
+export { WorkloadIdentityPoolProvider, WorkloadIdentityPoolProviderProvider, } from "./WorkloadIdentityPoolProvider.ts";
+export type { WorkloadIdentityPoolProviderProps } from "./WorkloadIdentityPoolProvider.ts";
 //# sourceMappingURL=index.d.ts.map

package/lib/Iam/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,cAAc,8BAA8B,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/Iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,cAAc,8BAA8B,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,iCAAiC,EAAE,MAAM,mCAAmC,CAAC"}

package/lib/Iam/index.js

@@ -1,4 +1,6 @@
 export { ServiceAccount, ServiceAccountProvider } from "./ServiceAccount.js";
 export * from "./ServiceAccountIamMember.js";
 export { ServiceAccountKey, ServiceAccountKeyProvider, } from "./ServiceAccountKey.js";
+export { WorkloadIdentityPool, WorkloadIdentityPoolResourceProvider, } from "./WorkloadIdentityPool.js";
+export { WorkloadIdentityPoolProvider, WorkloadIdentityPoolProviderProvider, } from "./WorkloadIdentityPoolProvider.js";
 //# sourceMappingURL=index.js.map

package/lib/Iam/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,cAAc,8BAA8B,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/Iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,cAAc,8BAA8B,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,mCAAmC,CAAC"}

package/lib/Providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AA2EtC,qBAAa,SAAU,SAAQ,cAA+C;CAAG;AAEjF,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,gaA2EnB,CAAC"}
+{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AAmFtC,qBAAa,SAAU,SAAQ,cAA+C;CAAG;AAEjF,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,gaA+EnB,CAAC"}

package/lib/Providers.js

@@ -18,6 +18,8 @@ import { Cluster, ClusterProvider } from "./Container/Cluster.js";
 import { NodePool, NodePoolProvider } from "./Container/NodePool.js";
 import { ServiceAccount, ServiceAccountProvider, } from "./Iam/ServiceAccount.js";
 import { ServiceAccountKey, ServiceAccountKeyProvider, } from "./Iam/ServiceAccountKey.js";
+import { WorkloadIdentityPool, WorkloadIdentityPoolResourceProvider, } from "./Iam/WorkloadIdentityPool.js";
+import { WorkloadIdentityPoolProvider, WorkloadIdentityPoolProviderProvider, } from "./Iam/WorkloadIdentityPoolProvider.js";
 import { HelmRelease, HelmReleaseProvider, } from "./Kubernetes/Helm.js";
 import { KubernetesManifest, KubernetesManifestProvider, } from "./Kubernetes/KubernetesManifest.js";
 import { KubernetesSecret, KubernetesSecretProvider, } from "./Kubernetes/Secret.js";
@@ -75,10 +77,12 @@ export const providers = () => Layer.effect(Providers, Provider.collection([
     ArtifactRegistryRepositoryIamMember,
     ServiceAccount,
     ServiceAccountKey,
+    WorkloadIdentityPool,
+    WorkloadIdentityPoolProvider,
     KubernetesSecret,
     KubernetesManifest,
     HelmRelease,
-])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), ClusterProvider(), NodePoolProvider(), ApiEnableProvider(), NetworkProvider(), ProjectDefaultNetworkTierProvider(), SubnetworkProvider(), FirewallProvider(), AddressProvider(), ForwardingRuleProvider(), GlobalAddressProvider(), SharedVpcHostProvider(), SharedVpcServiceProjectProvider(), PsaConnectionProvider(), ManagedLustreInstanceProvider(), StorageBucketProvider(), StorageBucketIamMemberProvider(), ServiceProvider(), JobProvider(), SqlInstanceProvider(), SqlDatabaseProvider(), SqlUserProvider(), ArtifactRegistryRepositoryProvider(), ArtifactRegistryRepositoryIamMemberProvider(), ServiceAccountProvider(), ServiceAccountKeyProvider(), KubernetesSecretProvider(), KubernetesManifestProvider(), HelmReleaseProvider())), Layer.provideMerge(fromAuthProvider()), Layer.provideMerge(GCPAuth), 
+])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), ClusterProvider(), NodePoolProvider(), ApiEnableProvider(), NetworkProvider(), ProjectDefaultNetworkTierProvider(), SubnetworkProvider(), FirewallProvider(), AddressProvider(), ForwardingRuleProvider(), GlobalAddressProvider(), SharedVpcHostProvider(), SharedVpcServiceProjectProvider(), PsaConnectionProvider(), ManagedLustreInstanceProvider(), StorageBucketProvider(), StorageBucketIamMemberProvider(), ServiceProvider(), JobProvider(), SqlInstanceProvider(), SqlDatabaseProvider(), SqlUserProvider(), ArtifactRegistryRepositoryProvider(), ArtifactRegistryRepositoryIamMemberProvider(), ServiceAccountProvider(), ServiceAccountKeyProvider(), WorkloadIdentityPoolResourceProvider(), WorkloadIdentityPoolProviderProvider(), KubernetesSecretProvider(), KubernetesManifestProvider(), HelmReleaseProvider())), Layer.provideMerge(fromAuthProvider()), Layer.provideMerge(GCPAuth), 
 // Auth/config failures (missing ADC, malformed profile) become
 // unrecoverable defects rather than typed errors — mirrors
 // `AWS/Providers.ts` and `Cloudflare/Providers.ts`. Resource lifecycle

package/lib/Providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"Providers.js","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,mCAAmC,EACnC,2CAA2C,GAC5C,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EACL,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,WAAW,EACX,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE9D,MAAM,OAAO,SAAU,SAAQ,QAAQ,CAAC,kBAAkB,EAAa,CAAC,KAAK,CAAC;CAAG;AAIjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAC5B,KAAK,CAAC,MAAM,CACV,SAAS,EACT,QAAQ,CAAC,UAAU,CAAC;IAClB,OAAO;IACP,OAAO;IACP,QAAQ;IACR,SAAS;IACT,OAAO;IACP,yBAAyB;IACzB,UAAU;IACV,QAAQ;IACR,OAAO;IACP,cAAc;IACd,aAAa;IACb,aAAa;IACb,uBAAuB;IACvB,aAAa;IACb,qBAAqB;IACrB,aAAa;IACb,sBAAsB;IACtB,OAAO;IACP,GAAG;IACH,WAAW;IACX,WAAW;IACX,OAAO;IACP,0BAA0B;IAC1B,mCAAmC;IACnC,cAAc;IACd,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;IAClB,WAAW;CACZ,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,QAAQ,CACZ,eAAe,EAAE,EACjB,eAAe,EAAE,EACjB,gBAAgB,EAAE,EAClB,iBAAiB,EAAE,EACnB,eAAe,EAAE,EACjB,iCAAiC,EAAE,EACnC,kBAAkB,EAAE,EACpB,gBAAgB,EAAE,EAClB,eAAe,EAAE,EACjB,sBAAsB,EAAE,EACxB,qBAAqB,EAAE,EACvB,qBAAqB,EAAE,EACvB,+BAA+B,EAAE,EACjC,qBAAqB,EAAE,EACvB,6BAA6B,EAAE,EAC/B,qBAAqB,EAAE,EACvB,8BAA8B,EAAE,EAChC,eAAe,EAAE,EACjB,WAAW,EAAE,EACb,mBAAmB,EAAE,EACrB,mBAAmB,EAAE,EACrB,eAAe,EAAE,EACjB,kCAAkC,EAAE,EACpC,2CAA2C,EAAE,EAC7C,sBAAsB,EAAE,EACxB,yBAAyB,EAAE,EAC3B,wBAAwB,EAAE,EAC1B,0BAA0B,EAAE,EAC5B,mBAAmB,EAAE,CACtB,CACF,EACD,KAAK,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,EACtC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;AAC3B,+DAA+D;AAC/D,2DAA2D;AAC3D,uEAAuE;AACvE,0DAA0D;AAC1D,KAAK,CAAC,KAAK,CACZ,CAAC"}
+{"version":3,"file":"Providers.js","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,mCAAmC,EACnC,2CAA2C,GAC5C,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EACL,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,WAAW,EACX,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE9D,MAAM,OAAO,SAAU,SAAQ,QAAQ,CAAC,kBAAkB,EAAa,CAAC,KAAK,CAAC;CAAG;AAIjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAC5B,KAAK,CAAC,MAAM,CACV,SAAS,EACT,QAAQ,CAAC,UAAU,CAAC;IAClB,OAAO;IACP,OAAO;IACP,QAAQ;IACR,SAAS;IACT,OAAO;IACP,yBAAyB;IACzB,UAAU;IACV,QAAQ;IACR,OAAO;IACP,cAAc;IACd,aAAa;IACb,aAAa;IACb,uBAAuB;IACvB,aAAa;IACb,qBAAqB;IACrB,aAAa;IACb,sBAAsB;IACtB,OAAO;IACP,GAAG;IACH,WAAW;IACX,WAAW;IACX,OAAO;IACP,0BAA0B;IAC1B,mCAAmC;IACnC,cAAc;IACd,iBAAiB;IACjB,oBAAoB;IACpB,4BAA4B;IAC5B,gBAAgB;IAChB,kBAAkB;IAClB,WAAW;CACZ,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,QAAQ,CACZ,eAAe,EAAE,EACjB,eAAe,EAAE,EACjB,gBAAgB,EAAE,EAClB,iBAAiB,EAAE,EACnB,eAAe,EAAE,EACjB,iCAAiC,EAAE,EACnC,kBAAkB,EAAE,EACpB,gBAAgB,EAAE,EAClB,eAAe,EAAE,EACjB,sBAAsB,EAAE,EACxB,qBAAqB,EAAE,EACvB,qBAAqB,EAAE,EACvB,+BAA+B,EAAE,EACjC,qBAAqB,EAAE,EACvB,6BAA6B,EAAE,EAC/B,qBAAqB,EAAE,EACvB,8BAA8B,EAAE,EAChC,eAAe,EAAE,EACjB,WAAW,EAAE,EACb,mBAAmB,EAAE,EACrB,mBAAmB,EAAE,EACrB,eAAe,EAAE,EACjB,kCAAkC,EAAE,EACpC,2CAA2C,EAAE,EAC7C,sBAAsB,EAAE,EACxB,yBAAyB,EAAE,EAC3B,oCAAoC,EAAE,EACtC,oCAAoC,EAAE,EACtC,wBAAwB,EAAE,EAC1B,0BAA0B,EAAE,EAC5B,mBAAmB,EAAE,CACtB,CACF,EACD,KAAK,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,EACtC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;AAC3B,+DAA+D;AAC/D,2DAA2D;AAC3D,uEAAuE;AACvE,0DAA0D;AAC1D,KAAK,CAAC,KAAK,CACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microagi/alchemy-gcp",
-  "version": "0.11.6",
+  "version": "0.11.7",
   "description": "GCP provider for Alchemy v2 (Effect-based IaC). Resources for Project, ServiceAccount, Cluster, NodePool, Compute, ManagedLustre, ServiceUsage, ServiceNetworking, Cloud Run (Service + Job + IAM), Cloud SQL (Instance + Database + User with IAM database authn), Artifact Registry (Docker repositories, standard + remote pull-through caches), Kubernetes (typed Secret + generic SSA Manifest + Helm release), with ADC-backed credentials and target-side IAM bindings.",
   "keywords": [
     "alchemy",
@@ -59,11 +59,11 @@
     "effect": ">=4.0.0-beta.100 || >=4.0.0"
   },
   "devDependencies": {
-    "@distilled.cloud/gcp": "0.30.2",
-    "@distilled.cloud/kubernetes": "0.30.2",
+    "@distilled.cloud/gcp": "workspace:*",
+    "@distilled.cloud/kubernetes": "workspace:*",
     "@types/bun": "latest",
     "@types/node": "latest",
-    "alchemy": "2.0.0-beta.65",
+    "alchemy": "workspace:*",
     "effect": ">=4.0.0-beta.100 || >=4.0.0",
     "typescript": "^7.0.2"
   },

package/src/Iam/Operations.ts

@@ -0,0 +1,81 @@
+import { ConfigError } from "@distilled.cloud/gcp";
+import type * as iam from "@distilled.cloud/gcp/unstable/iam-v1";
+import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+/**
+ * Resolved callable signature of an `iam-v1` operations getter.
+ *
+ * Workload Identity pools and providers each have their own operations
+ * collection (`…WorkloadIdentityPoolsOperations`,
+ * `…WorkloadIdentityPoolsProvidersOperations`) rather than one shared
+ * endpoint, so this is generic over the getter and each resource passes its
+ * own — the same factory shape `ArtifactRegistry/Operations.ts` uses.
+ */
+type GetOperations = Effect.Success<
+  typeof iam.getProjectsLocationsWorkloadIdentityPoolsOperations
+>;
+
+/**
+ * Build the IAM long-running-operation polling helper.
+ *
+ * `iam-v1` operations use the standard `google.longrunning.Operation` shape —
+ * doneness is `.done === true` and failure is a populated `.error` (NOT
+ * Container's `.status === "DONE"`, and NOT Sqladmin's tri-state `.status`).
+ * Verified against the `Operation` interface in
+ * `vendor/distilled/packages/gcp/src/unstable-services/iam-v1.ts`.
+ *
+ * Operation names returned by pool/provider create and delete are already
+ * fully qualified (`projects/{p}/locations/global/workloadIdentityPools/{id}/operations/{op}`),
+ * so callers pass them straight through — no qualify dance.
+ *
+ * Schedule: exponential 1s → 1.5× growth, capped per-poll at 10s via
+ * `Schedule.min`, then a hard count cap of 60 retries via `Schedule.max`
+ * → ~10 min wall ceiling. Pool and provider CRUD normally settles in
+ * seconds; the ceiling exists so a stuck operation surfaces as an error
+ * rather than hanging a deploy indefinitely.
+ *
+ * The helper is a factory — the caller resolves the operations getter once at
+ * provider construction and passes the resulting callable here, so we never
+ * re-resolve services on each await.
+ */
+export const makeAwaitOperation = (
+  getOperations: GetOperations,
+  label: string,
+) =>
+  Effect.fn(function* (
+    operationName: string,
+    session: ScopedPlanStatusSession,
+  ) {
+    const op = yield* getOperations({ name: operationName }).pipe(
+      Effect.flatMap((current) =>
+        current.done === true
+          ? Effect.succeed(current)
+          : Effect.fail({ _tag: "OperationPending" as const }),
+      ),
+      Effect.retry({
+        while: (e: { _tag?: string }) => e?._tag === "OperationPending",
+        schedule: Schedule.max([
+          Schedule.min([
+            Schedule.exponential(Duration.seconds(1), 1.5),
+            Schedule.spaced(Duration.seconds(10)),
+          ]),
+          Schedule.recurs(60),
+        ]).pipe(
+          Schedule.tap(() =>
+            session.note(`Waiting for ${label} operation ${operationName}…`),
+          ),
+        ),
+      }),
+    );
+    if (op.error) {
+      return yield* new ConfigError({
+        message: `${label} operation ${operationName} failed: ${
+          op.error.message ?? JSON.stringify(op.error)
+        }`,
+      });
+    }
+    return op;
+  });