@microagi/alchemy-gcp 0.11.7 → 0.11.8

package/lib/Tags.js

@@ -24,6 +24,10 @@ const sanitizeLabelValue = (raw) => {
     const replaced = lowered.replace(/[^a-z0-9_-]/g, "-");
     return replaced.slice(0, 63);
 };
+/** Normalize an SDK string map by omitting absent values at the boundary. */
+export const normalizeStringMap = (value) => value === undefined
+    ? undefined
+    : Object.fromEntries(Object.entries(value).filter((entry) => entry[1] !== undefined));
 /**
  * Compute the alchemy-internal label set for a Resource. Merge the
  * result with user-provided labels (user wins on key collision is
@@ -43,7 +47,11 @@ export const gcpInternalLabels = Effect.fnUntraced(function* (id) {
  * values matching this stack/stage/id. Used in `read` to decide
  * adoption ownership.
  */
-export const hasAlchemyLabels = Effect.fnUntraced(function* (id, labels) {
+export const hasAlchemyLabels = Effect.fnUntraced(function* (id, 
+// Distilled's generated Kubernetes/GCP map types have index signatures that
+// include `undefined` (`{ [k: string]: string | undefined }`), so accept the
+// wider shape — the equality checks below are unaffected.
+labels) {
     if (!labels)
         return false;
     const expected = yield* gcpInternalLabels(id);

package/lib/Tags.js.map

@@ -1 +1 @@
-{"version":3,"file":"Tags.js","sourceRoot":"","sources":["../src/Tags.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC;;;;;;;;;;;;;;GAcG;AAEH,MAAM,aAAa,GAAG,aAAa,CAAC;AACpC,MAAM,eAAe,GAAG,eAAe,CAAC;AACxC,MAAM,YAAY,GAAG,YAAY,CAAC;AAElC,MAAM,kBAAkB,GAAG,CAAC,GAAW,EAAU,EAAE;IACjD,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAU;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAC3B,OAAO;QACL,CAAC,aAAa,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC;QAC/C,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC;QAC5C,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC,EAAE,CAAC;KACN,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EACzD,EAAU,EACV,MAA0C;IAE1C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC9C,OAAO,CACL,MAAM,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,aAAa,CAAC;QACjD,MAAM,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,eAAe,CAAC;QACrD,MAAM,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,YAAY,CAAC,CAChD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,OAAO,EACL,aAAa,IAAI,iBAAiB,EAClC,eAAe,IAAI,mBAAmB,EACtC,YAAY,IAAI,gBAAgB,GACjC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAU,EAAE,CAClD,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAE9D,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,EAAU,EAAU,EAAE,CAC3E,gBAAgB,mBAAmB,CAAC,GAAG,CAAC,UAAU,mBAAmB,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,EAAE,CAAC,GAAG,CAAC;AAEhH;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAC9D,EAAU,EACV,eAAwB;IAExB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAC3B,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACnE,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EACpE,EAAU,EACV,WAA+B;IAE/B,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1D,OAAO,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,WAA+B,EAAsB,EAAE;IACxF,IAAI,CAAC,WAAW;QAAE,OAAO,WAAW,CAAC;IACrC,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;AACvE,CAAC,CAAC"}
+{"version":3,"file":"Tags.js","sourceRoot":"","sources":["../src/Tags.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC;;;;;;;;;;;;;;GAcG;AAEH,MAAM,aAAa,GAAG,aAAa,CAAC;AACpC,MAAM,eAAe,GAAG,eAAe,CAAC;AACxC,MAAM,YAAY,GAAG,YAAY,CAAC;AAElC,MAAM,kBAAkB,GAAG,CAAC,GAAW,EAAU,EAAE;IACjD,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,KAAqD,EACjB,EAAE,CACtC,KAAK,KAAK,SAAS;IACjB,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAC1B,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAC7D,CACF,CAAC;AAER;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAU;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAC3B,OAAO;QACL,CAAC,aAAa,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC;QAC/C,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC;QAC5C,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC,EAAE,CAAC;KACN,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EACzD,EAAU;AACV,4EAA4E;AAC5E,6EAA6E;AAC7E,0DAA0D;AAC1D,MAAsD;IAEtD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC9C,OAAO,CACL,MAAM,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,aAAa,CAAC;QACjD,MAAM,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,eAAe,CAAC;QACrD,MAAM,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,YAAY,CAAC,CAChD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,OAAO,EACL,aAAa,IAAI,iBAAiB,EAClC,eAAe,IAAI,mBAAmB,EACtC,YAAY,IAAI,gBAAgB,GACjC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAU,EAAE,CAClD,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAE9D,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,EAAU,EAAU,EAAE,CAC3E,gBAAgB,mBAAmB,CAAC,GAAG,CAAC,UAAU,mBAAmB,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,EAAE,CAAC,GAAG,CAAC;AAEhH;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAC9D,EAAU,EACV,eAAwB;IAExB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAC3B,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACnE,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EACpE,EAAU,EACV,WAA+B;IAE/B,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1D,OAAO,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,WAA+B,EAAsB,EAAE;IACxF,IAAI,CAAC,WAAW;QAAE,OAAO,WAAW,CAAC;IACrC,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;AACvE,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microagi/alchemy-gcp",
-  "version": "0.11.7",
+  "version": "0.11.8",
   "description": "GCP provider for Alchemy v2 (Effect-based IaC). Resources for Project, ServiceAccount, Cluster, NodePool, Compute, ManagedLustre, ServiceUsage, ServiceNetworking, Cloud Run (Service + Job + IAM), Cloud SQL (Instance + Database + User with IAM database authn), Artifact Registry (Docker repositories, standard + remote pull-through caches), Kubernetes (typed Secret + generic SSA Manifest + Helm release), with ADC-backed credentials and target-side IAM bindings.",
   "keywords": [
     "alchemy",
@@ -53,18 +53,18 @@
     "google-auth-library": "^10.4.0"
   },
   "peerDependencies": {
-    "@distilled.cloud/gcp": ">=0.30.2",
-    "@distilled.cloud/kubernetes": ">=0.30.2",
-    "alchemy": ">=2.0.0-beta.65",
-    "effect": ">=4.0.0-beta.100 || >=4.0.0"
+    "@distilled.cloud/gcp": ">=1.0.0-rc.4",
+    "@distilled.cloud/kubernetes": ">=1.0.0-rc.4",
+    "alchemy": ">=2.0.0-beta.72",
+    "effect": ">=4.0.0-beta.105 || >=4.0.0"
   },
   "devDependencies": {
-    "@distilled.cloud/gcp": "workspace:*",
-    "@distilled.cloud/kubernetes": "workspace:*",
+    "@distilled.cloud/gcp": "1.0.0-rc.4",
+    "@distilled.cloud/kubernetes": "1.0.0-rc.4",
     "@types/bun": "latest",
     "@types/node": "latest",
-    "alchemy": "workspace:*",
-    "effect": ">=4.0.0-beta.100 || >=4.0.0",
+    "alchemy": "2.0.0-beta.72",
+    "effect": ">=4.0.0-beta.105 || >=4.0.0",
     "typescript": "^7.0.2"
   },
   "publishConfig": {

package/src/ArtifactRegistry/Operations.ts

@@ -1,5 +1,5 @@
 import { ConfigError } from "@distilled.cloud/gcp";
-import * as ar from "@distilled.cloud/gcp/artifactregistry-v1";
+import * as ar from "@distilled.cloud/gcp/artifactregistry_v1";
 import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";

package/src/ArtifactRegistry/Repository.ts

@@ -1,4 +1,4 @@
-import * as ar from "@distilled.cloud/gcp/artifactregistry-v1";
+import * as ar from "@distilled.cloud/gcp/artifactregistry_v1";
 import { Resource } from "alchemy";
 import { Unowned } from "alchemy/AdoptPolicy";
 import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
@@ -10,7 +10,7 @@ import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
 import type * as GCP from "../Providers.ts";
-import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.ts";
+import { gcpInternalLabels, hasAlchemyLabels, normalizeStringMap } from "../Tags.ts";
 import { makeAwaitOperation } from "./Operations.ts";
 import type { ArtifactRegistryFormat, ArtifactRegistryMode } from "./Types.ts";
 import {
@@ -399,7 +399,7 @@ const toAttributes = (
   sizeBytes: r.sizeBytes,
   satisfiesPzs: r.satisfiesPzs,
   satisfiesPzi: r.satisfiesPzi,
-  labels: { ...(r.labels ?? {}) },
+  labels: normalizeStringMap(r.labels) ?? {},
   createTime: r.createTime ?? "",
   updateTime: r.updateTime ?? "",
 });
@@ -441,7 +441,7 @@ export const ArtifactRegistryRepositoryProvider = () =>
         }
 
         const labelDiff = diffTags(
-          { ...(args.observed.labels ?? {}) },
+          normalizeStringMap(args.observed.labels) ?? {},
           args.desiredLabels,
         );
         if (labelDiff.removed.length > 0 || labelDiff.upsert.length > 0) {
@@ -623,7 +623,7 @@ export const ArtifactRegistryRepositoryProvider = () =>
           const observed = yield* observe(project, location, name);
           if (!observed) return undefined;
           const attrs = toAttributes(observed, { project, location, name });
-          return (yield* hasAlchemyLabels(id, observed.labels))
+          return (yield* hasAlchemyLabels(id, normalizeStringMap(observed.labels)))
             ? attrs
             : Unowned(attrs);
         }),

package/src/ArtifactRegistry/RepositoryIamMember.ts

@@ -1,5 +1,5 @@
 import { ConfigError } from "@distilled.cloud/gcp";
-import * as ar from "@distilled.cloud/gcp/artifactregistry-v1";
+import * as ar from "@distilled.cloud/gcp/artifactregistry_v1";
 import { Resource } from "alchemy";
 import { isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";

package/src/CloudResourceManager/Project.ts

@@ -1,6 +1,6 @@
 import { ConfigError } from "@distilled.cloud/gcp";
-import * as billing from "@distilled.cloud/gcp/cloudbilling-v1";
-import * as crm from "@distilled.cloud/gcp/cloudresourcemanager-v3";
+import * as billing from "@distilled.cloud/gcp/cloudbilling_v1";
+import * as crm from "@distilled.cloud/gcp/cloudresourcemanager_v3";
 import { Resource } from "alchemy";
 import { Unowned } from "alchemy/AdoptPolicy";
 import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
@@ -11,7 +11,7 @@ import { diffTags } from "alchemy/Tags";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
-import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.ts";
+import { gcpInternalLabels, hasAlchemyLabels, normalizeStringMap } from "../Tags.ts";
 import type * as GCP from "../Providers.ts";
 
 /**
@@ -205,7 +205,7 @@ const toAttributes = (
   state: p.state ?? "ACTIVE",
   parent: p.parent ?? "",
   createTime: p.createTime,
-  labels: { ...(p.labels ?? {}) },
+  labels: normalizeStringMap(p.labels) ?? {},
   // GCP returns `billingAccountName` as a plain string but its format
   // is always `billingAccounts/{id}` — narrow at the boundary.
   billingAccount: (billingInfo?.billingAccountName || undefined) as
@@ -387,7 +387,7 @@ export const ProjectProvider = () =>
         desired: { displayName: string | undefined; labels: Record<string, string> },
         session: ScopedPlanStatusSession,
       ) {
-        const observedLabels = { ...(observed.labels ?? {}) };
+        const observedLabels = normalizeStringMap(observed.labels) ?? {};
         const updateMaskFields: string[] = [];
         if (desired.displayName !== observed.displayName) {
           updateMaskFields.push("display_name");
@@ -601,7 +601,7 @@ export const ProjectProvider = () =>
           // created outside this stack/stage/id. The engine surfaces
           // `Unowned(attrs)` to the user as "exists but is not ours" —
           // adoption requires `--adopt` (or `adopt(true)`).
-          return (yield* hasAlchemyLabels(id, observed.labels))
+          return (yield* hasAlchemyLabels(id, normalizeStringMap(observed.labels)))
             ? attrs
             : Unowned(attrs);
         }),

package/src/Compute/Address.ts

@@ -1,4 +1,4 @@
-import * as compute from "@distilled.cloud/gcp/compute-v1";
+import * as compute from "@distilled.cloud/gcp/compute_v1";
 import { Resource } from "alchemy";
 import { Unowned } from "alchemy/AdoptPolicy";
 import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
@@ -6,7 +6,7 @@ import { deepEqual, isResolved, somePropsAreDifferent } from "alchemy/Diff";
 import { createPhysicalName } from "alchemy/PhysicalName";
 import * as Provider from "alchemy/Provider";
 import * as Effect from "effect/Effect";
-import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.ts";
+import { gcpInternalLabels, hasAlchemyLabels, normalizeStringMap } from "../Tags.ts";
 import type * as GCP from "../Providers.ts";
 import { makeAwaitRegionOperation } from "./Operations.ts";
 
@@ -125,7 +125,7 @@ const toAddressAttributes = (
   purpose: a.purpose,
   subnetwork: a.subnetwork,
   status: a.status,
-  labels: { ...(a.labels ?? {}) },
+  labels: normalizeStringMap(a.labels) ?? {},
 });
 
 export const AddressProvider = () =>
@@ -283,7 +283,7 @@ export const AddressProvider = () =>
           const observed = yield* observe(project, region, name);
           if (!observed) return undefined;
           const attrs = toAddressAttributes(observed, { project, region });
-          return (yield* hasAlchemyLabels(id, observed.labels))
+          return (yield* hasAlchemyLabels(id, normalizeStringMap(observed.labels)))
             ? attrs
             : Unowned(attrs);
         }),

package/src/Compute/Firewall.ts

@@ -1,4 +1,4 @@
-import * as compute from "@distilled.cloud/gcp/compute-v1";
+import * as compute from "@distilled.cloud/gcp/compute_v1";
 import { Resource } from "alchemy";
 import { Unowned } from "alchemy/AdoptPolicy";
 import { deepEqual, isResolved, somePropsAreDifferent } from "alchemy/Diff";

package/src/Compute/ForwardingRule.ts

@@ -1,4 +1,4 @@
-import * as compute from "@distilled.cloud/gcp/compute-v1";
+import * as compute from "@distilled.cloud/gcp/compute_v1";
 import { Resource } from "alchemy";
 import { Unowned } from "alchemy/AdoptPolicy";
 import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
@@ -6,7 +6,7 @@ import { deepEqual, isResolved, somePropsAreDifferent } from "alchemy/Diff";
 import { createPhysicalName } from "alchemy/PhysicalName";
 import * as Provider from "alchemy/Provider";
 import * as Effect from "effect/Effect";
-import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.ts";
+import { gcpInternalLabels, hasAlchemyLabels, normalizeStringMap } from "../Tags.ts";
 import type * as GCP from "../Providers.ts";
 import { makeAwaitRegionOperation } from "./Operations.ts";
 
@@ -135,7 +135,7 @@ const toForwardingRuleAttributes = (
   allowPscGlobalAccess: f.allowPscGlobalAccess ?? false,
   pscConnectionId: f.pscConnectionId,
   pscConnectionStatus: f.pscConnectionStatus,
-  labels: { ...(f.labels ?? {}) },
+  labels: normalizeStringMap(f.labels) ?? {},
 });
 
 export const ForwardingRuleProvider = () =>
@@ -296,7 +296,7 @@ export const ForwardingRuleProvider = () =>
             project,
             region,
           });
-          return (yield* hasAlchemyLabels(id, observed.labels))
+          return (yield* hasAlchemyLabels(id, normalizeStringMap(observed.labels)))
             ? attrs
             : Unowned(attrs);
         }),

package/src/Compute/GlobalAddress.ts

@@ -1,4 +1,4 @@
-import * as compute from "@distilled.cloud/gcp/compute-v1";
+import * as compute from "@distilled.cloud/gcp/compute_v1";
 import { Resource } from "alchemy";
 import { Unowned } from "alchemy/AdoptPolicy";
 import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
@@ -6,7 +6,7 @@ import { deepEqual, isResolved, somePropsAreDifferent } from "alchemy/Diff";
 import { createPhysicalName } from "alchemy/PhysicalName";
 import * as Provider from "alchemy/Provider";
 import * as Effect from "effect/Effect";
-import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.ts";
+import { gcpInternalLabels, hasAlchemyLabels, normalizeStringMap } from "../Tags.ts";
 import type * as GCP from "../Providers.ts";
 import { makeAwaitGlobalOperation } from "./Operations.ts";
 
@@ -133,7 +133,7 @@ const toGlobalAddressAttributes = (
   purpose: a.purpose,
   network: a.network,
   status: a.status,
-  labels: { ...(a.labels ?? {}) },
+  labels: normalizeStringMap(a.labels) ?? {},
 });
 
 export const GlobalAddressProvider = () =>
@@ -278,7 +278,7 @@ export const GlobalAddressProvider = () =>
           const observed = yield* observe(project, name);
           if (!observed) return undefined;
           const attrs = toGlobalAddressAttributes(observed, { project });
-          return (yield* hasAlchemyLabels(id, observed.labels))
+          return (yield* hasAlchemyLabels(id, normalizeStringMap(observed.labels)))
             ? attrs
             : Unowned(attrs);
         }),

package/src/Compute/Network.ts

@@ -1,4 +1,4 @@
-import * as compute from "@distilled.cloud/gcp/compute-v1";
+import * as compute from "@distilled.cloud/gcp/compute_v1";
 import { Resource } from "alchemy";
 import { Unowned } from "alchemy/AdoptPolicy";
 import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";

package/src/Compute/Operations.ts

@@ -1,5 +1,5 @@
 import { ConfigError } from "@distilled.cloud/gcp";
-import * as compute from "@distilled.cloud/gcp/compute-v1";
+import * as compute from "@distilled.cloud/gcp/compute_v1";
 import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";

package/src/Compute/ProjectDefaultNetworkTier.ts

@@ -1,4 +1,4 @@
-import * as compute from "@distilled.cloud/gcp/compute-v1";
+import * as compute from "@distilled.cloud/gcp/compute_v1";
 import { Resource } from "alchemy";
 import { isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";

package/src/Compute/SharedVpcHost.ts

@@ -1,4 +1,4 @@
-import * as compute from "@distilled.cloud/gcp/compute-v1";
+import * as compute from "@distilled.cloud/gcp/compute_v1";
 import { Resource } from "alchemy";
 import { isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";

package/src/Compute/SharedVpcServiceProject.ts

@@ -1,4 +1,4 @@
-import * as compute from "@distilled.cloud/gcp/compute-v1";
+import * as compute from "@distilled.cloud/gcp/compute_v1";
 import { Resource } from "alchemy";
 import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
 import { isResolved } from "alchemy/Diff";

package/src/Compute/Subnetwork.ts

@@ -1,4 +1,4 @@
-import * as compute from "@distilled.cloud/gcp/compute-v1";
+import * as compute from "@distilled.cloud/gcp/compute_v1";
 import { Resource } from "alchemy";
 import { Unowned } from "alchemy/AdoptPolicy";
 import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
@@ -291,7 +291,7 @@ export const SubnetworkProvider = () =>
         );
         const desiredRanges = sortedSecondaryRanges(args.news.secondaryIpRanges);
         if (!deepEqual(obsRanges, desiredRanges)) {
-          body.secondaryIpRanges = desiredRanges as ReadonlyArray<compute.SubnetworkSecondaryRange>;
+          body.secondaryIpRanges = [...desiredRanges];
         }
         if (
           args.news.privateIpGoogleAccess !== undefined &&

package/src/Container/Cluster.ts

@@ -1,4 +1,4 @@
-import * as cont from "@distilled.cloud/gcp/container-v1";
+import * as cont from "@distilled.cloud/gcp/container_v1";
 import { Resource } from "alchemy";
 import { Unowned } from "alchemy/AdoptPolicy";
 import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
@@ -8,7 +8,7 @@ import * as Provider from "alchemy/Provider";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
-import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.ts";
+import { gcpInternalLabels, hasAlchemyLabels, normalizeStringMap } from "../Tags.ts";
 import type * as GCP from "../Providers.ts";
 import { type NodePoolProps, toNodeConfigCreateBody } from "./NodePool.ts";
 import { makeAwaitOperation, qualifyOperationName } from "./Operations.ts";
@@ -297,7 +297,7 @@ const toInitialNodePoolBody = (
 ): cont.NodePool => ({
   name: spec.name,
   initialNodeCount: spec.initialNodeCount,
-  ...(spec.nodeLocations ? { locations: spec.nodeLocations } : {}),
+  ...(spec.nodeLocations ? { locations: [...spec.nodeLocations] } : {}),
   config: toNodeConfigCreateBody(spec.config, {
     ...(spec.config.resourceLabels ?? {}),
     ...clusterInternalLabels,
@@ -320,9 +320,25 @@ const toClusterAttributes = (
   currentMasterVersion: c.currentMasterVersion,
   status: c.status,
   releaseChannel: c.releaseChannel,
-  resourceLabels: { ...(c.resourceLabels ?? {}) },
+  resourceLabels: normalizeStringMap(c.resourceLabels) ?? {},
 });
 
+/** Ignore server bookkeeping when diffing; carry its concurrency token on writes. */
+export const clusterMaintenancePolicyUpdate = (
+  observed: cont.MaintenancePolicy | undefined,
+  desired: ClusterProps["maintenancePolicy"],
+): cont.MaintenancePolicy | undefined => {
+  if (!desired) return undefined;
+  const { resourceVersion, ...current } = observed ?? {};
+  // Daily window duration is computed by GKE and cannot be configured.
+  if (current.window?.dailyMaintenanceWindow) {
+    const { duration: _, ...daily } = current.window.dailyMaintenanceWindow;
+    current.window = { ...current.window, dailyMaintenanceWindow: daily };
+  }
+  if (deepEqual(current, desired)) return undefined;
+  return { ...desired, ...(resourceVersion ? { resourceVersion } : {}) };
+};
+
 export const ClusterProvider = () =>
   Provider.effect(
     Cluster,
@@ -389,15 +405,21 @@ export const ClusterProvider = () =>
 
       const syncClusterMaintenance = Effect.fn(function* (args: {
         fqName: string;
-        observed: cont.Cluster;
         news: ClusterProps;
         session: ScopedPlanStatusSession;
       }) {
         if (!args.news.maintenancePolicy) return;
-        if (deepEqual(args.observed.maintenancePolicy, args.news.maintenancePolicy)) return;
+        // Earlier sync steps can update the cluster. Read immediately before
+        // setting the policy to obtain its current optimistic-concurrency token.
+        const current = yield* getClusters({ name: args.fqName });
+        const maintenancePolicy = clusterMaintenancePolicyUpdate(
+          current.maintenancePolicy,
+          args.news.maintenancePolicy,
+        );
+        if (!maintenancePolicy) return;
         const op = yield* setMaintenance({
           name: args.fqName,
-          body: { maintenancePolicy: args.news.maintenancePolicy },
+          body: { maintenancePolicy },
         });
         if (op.name) yield* awaitOperation(qualifyOp(args.fqName, op.name), args.session);
       });
@@ -412,7 +434,7 @@ export const ClusterProvider = () =>
         if (deepEqual(args.observed.locations ?? [], args.news.nodeLocations)) return;
         const op = yield* setLocations({
           name: args.fqName,
-          body: { locations: args.news.nodeLocations },
+          body: { locations: [...args.news.nodeLocations] },
         });
         if (op.name) yield* awaitOperation(qualifyOp(args.fqName, op.name), args.session);
       });
@@ -587,7 +609,7 @@ export const ClusterProvider = () =>
                   ...(news.initialClusterVersion
                     ? { initialClusterVersion: news.initialClusterVersion }
                     : {}),
-                  ...(news.nodeLocations ? { locations: news.nodeLocations } : {}),
+                  ...(news.nodeLocations ? { locations: [...news.nodeLocations] } : {}),
                   resourceLabels: desiredLabels,
                   nodePools: [initialPoolBody],
                 },
@@ -628,7 +650,7 @@ export const ClusterProvider = () =>
             session,
           });
           yield* syncClusterAddons({ fqName, observed, news, session });
-          yield* syncClusterMaintenance({ fqName, observed, news, session });
+          yield* syncClusterMaintenance({ fqName, news, session });
           yield* syncClusterLocations({ fqName, observed, news, session });
           yield* syncClusterNetworkPolicy({ fqName, observed, news, session });
           yield* syncClusterLogging({ fqName, observed, news, session });
@@ -667,7 +689,10 @@ export const ClusterProvider = () =>
           );
           if (!observed) return undefined;
           const attrs = toClusterAttributes(observed, { project, location });
-          return (yield* hasAlchemyLabels(id, observed.resourceLabels))
+          return (yield* hasAlchemyLabels(
+            id,
+            normalizeStringMap(observed.resourceLabels),
+          ))
             ? attrs
             : Unowned(attrs);
         }),

package/src/Container/NodePool.ts

@@ -1,4 +1,4 @@
-import * as cont from "@distilled.cloud/gcp/container-v1";
+import * as cont from "@distilled.cloud/gcp/container_v1";
 import { Resource } from "alchemy";
 import { Unowned } from "alchemy/AdoptPolicy";
 import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
@@ -6,7 +6,7 @@ import { deepEqual, isResolved, somePropsAreDifferent } from "alchemy/Diff";
 import { createPhysicalName } from "alchemy/PhysicalName";
 import * as Provider from "alchemy/Provider";
 import * as Effect from "effect/Effect";
-import { gcpInternalLabels, hasAlchemyLabels } from "../Tags.ts";
+import { gcpInternalLabels, hasAlchemyLabels, normalizeStringMap } from "../Tags.ts";
 import type * as GCP from "../Providers.ts";
 import { makeAwaitOperation, qualifyOperationName } from "./Operations.ts";
 
@@ -262,7 +262,7 @@ export const nodePoolSizeNeedsSync = (
  */
 const toAcceleratorConfig = (
   accelerators: NodePoolProps["config"]["accelerators"] | undefined,
-): ReadonlyArray<cont.AcceleratorConfig> | undefined =>
+): cont.AcceleratorConfig[] | undefined =>
   accelerators?.map((a) => ({
     acceleratorType: a.type,
     acceleratorCount: String(a.count),
@@ -293,19 +293,30 @@ export const toNodeConfigCreateBody = (
     ...(config.imageType ? { imageType: config.imageType } : {}),
     ...(accelerators ? { accelerators } : {}),
     ...(config.serviceAccount ? { serviceAccount: config.serviceAccount } : {}),
-    ...(config.oauthScopes ? { oauthScopes: config.oauthScopes } : {}),
-    ...(config.taints ? { taints: config.taints } : {}),
+    ...(config.oauthScopes ? { oauthScopes: [...config.oauthScopes] } : {}),
+    ...(config.taints ? { taints: [...config.taints] } : {}),
     ...(config.labels ? { labels: config.labels } : {}),
     resourceLabels: desiredResourceLabels,
     ...(config.metadata ? { metadata: config.metadata } : {}),
-    ...(config.tags ? { tags: config.tags } : {}),
+    ...(config.tags ? { tags: [...config.tags] } : {}),
     ...(config.minCpuPlatform ? { minCpuPlatform: config.minCpuPlatform } : {}),
     ...(config.bootDiskKmsKey ? { bootDiskKmsKey: config.bootDiskKmsKey } : {}),
     ...(config.sandboxConfig ? { sandboxConfig: config.sandboxConfig } : {}),
     ...(config.preemptible !== undefined ? { preemptible: config.preemptible } : {}),
     ...(config.spot !== undefined ? { spot: config.spot } : {}),
     ...(config.reservationAffinity
-      ? { reservationAffinity: config.reservationAffinity }
+      ? {
+          reservationAffinity: {
+            consumeReservationType:
+              config.reservationAffinity.consumeReservationType,
+            ...(config.reservationAffinity.key
+              ? { key: config.reservationAffinity.key }
+              : {}),
+            ...(config.reservationAffinity.values
+              ? { values: [...config.reservationAffinity.values] }
+              : {}),
+          },
+        }
       : {}),
     ...(config.shieldedInstanceConfig
       ? { shieldedInstanceConfig: config.shieldedInstanceConfig }
@@ -371,13 +382,13 @@ const toNodePoolUpdateBody = (
   }
 
   if (nc.tags && !deepEqual(oc.tags ?? [], nc.tags)) {
-    body.tags = { tags: nc.tags };
+    body.tags = { tags: [...nc.tags] };
   }
   if (nc.labels && !deepEqual(oc.labels ?? {}, nc.labels)) {
     body.labels = { labels: nc.labels };
   }
   if (nc.taints && !deepEqual(oc.taints ?? [], nc.taints)) {
-    body.taints = { taints: nc.taints };
+    body.taints = { taints: [...nc.taints] };
   }
   // GKE injects its own `goog-*` resource labels (accelerator type,
   // provisioning model, …) after create. Treat them as server-managed:
@@ -529,7 +540,7 @@ export const NodePoolProvider = () =>
         ) {
           const op = yield* updateNodePools({
             name: args.fqName,
-            body: { locations: args.news.nodeLocations },
+            body: { locations: [...args.news.nodeLocations] },
           });
           if (op.name) yield* awaitOperation(qualifyOp(args.fqName, op.name), args.session);
         }
@@ -627,7 +638,7 @@ export const NodePoolProvider = () =>
                 nodePool: {
                   name: desiredName,
                   initialNodeCount: createNodeCount,
-                  ...(news.nodeLocations ? { locations: news.nodeLocations } : {}),
+                  ...(news.nodeLocations ? { locations: [...news.nodeLocations] } : {}),
                   config,
                   ...(news.autoscaling ? { autoscaling: news.autoscaling } : {}),
                   ...(news.management ? { management: news.management } : {}),
@@ -707,7 +718,10 @@ export const NodePoolProvider = () =>
             );
             for (const candidate of page?.nodePools ?? []) {
               if (
-                yield* hasAlchemyLabels(id, candidate.config?.resourceLabels)
+                yield* hasAlchemyLabels(
+                  id,
+                  normalizeStringMap(candidate.config?.resourceLabels),
+                )
               ) {
                 observed = candidate;
                 break;
@@ -720,7 +734,10 @@ export const NodePoolProvider = () =>
             location,
             clusterName,
           });
-          return (yield* hasAlchemyLabels(id, observed.config?.resourceLabels))
+          return (yield* hasAlchemyLabels(
+            id,
+            normalizeStringMap(observed.config?.resourceLabels),
+          ))
             ? attrs
             : Unowned(attrs);
         }),

package/src/Container/Operations.ts

@@ -1,5 +1,5 @@
 import { ConfigError } from "@distilled.cloud/gcp";
-import * as cont from "@distilled.cloud/gcp/container-v1";
+import * as cont from "@distilled.cloud/gcp/container_v1";
 import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";

package/src/Iam/Operations.ts

@@ -1,5 +1,5 @@
 import { ConfigError } from "@distilled.cloud/gcp";
-import type * as iam from "@distilled.cloud/gcp/unstable/iam-v1";
+import type * as iam from "@distilled.cloud/gcp/unstable/iam_v1";
 import type { ScopedPlanStatusSession } from "alchemy/Cli/Cli";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";

package/src/Iam/ServiceAccount.ts

@@ -1,5 +1,5 @@
 import { ConfigError } from "@distilled.cloud/gcp";
-import * as iam from "@distilled.cloud/gcp/unstable/iam-v1";
+import * as iam from "@distilled.cloud/gcp/unstable/iam_v1";
 import { Resource } from "alchemy";
 import { Unowned } from "alchemy/AdoptPolicy";
 import { isResolved } from "alchemy/Diff";

package/src/Iam/ServiceAccountKey.ts

@@ -1,5 +1,5 @@
 import { ConfigError } from "@distilled.cloud/gcp";
-import * as iam from "@distilled.cloud/gcp/unstable/iam-v1";
+import * as iam from "@distilled.cloud/gcp/unstable/iam_v1";
 import { Resource } from "alchemy";
 import { isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";

package/src/Iam/WorkloadIdentityPool.ts

@@ -1,5 +1,5 @@
 import { ConfigError } from "@distilled.cloud/gcp";
-import * as iam from "@distilled.cloud/gcp/unstable/iam-v1";
+import * as iam from "@distilled.cloud/gcp/unstable/iam_v1";
 import { Resource } from "alchemy";
 import { Unowned } from "alchemy/AdoptPolicy";
 import { isResolved } from "alchemy/Diff";

package/src/Iam/WorkloadIdentityPoolProvider.ts

@@ -1,5 +1,5 @@
 import { ConfigError } from "@distilled.cloud/gcp";
-import * as iam from "@distilled.cloud/gcp/unstable/iam-v1";
+import * as iam from "@distilled.cloud/gcp/unstable/iam_v1";
 import { Resource } from "alchemy";
 import { Unowned } from "alchemy/AdoptPolicy";
 import { isResolved } from "alchemy/Diff";
@@ -8,6 +8,7 @@ import * as Effect from "effect/Effect";
 import {
   descriptionHasAlchemyMarker,
   gcpAlchemyDescription,
+  normalizeStringMap,
   stripAlchemyMarker,
 } from "../Tags.ts";
 import type * as GCP from "../Providers.ts";
@@ -253,7 +254,7 @@ export const WorkloadIdentityPoolProviderProvider = () =>
           providerId,
           issuerUri: provider.oidc?.issuerUri,
           allowedAudiences: provider.oidc?.allowedAudiences,
-          attributeMapping: provider.attributeMapping,
+          attributeMapping: normalizeStringMap(provider.attributeMapping),
           attributeCondition: provider.attributeCondition,
           displayName: provider.displayName,
           description: stripAlchemyMarker(provider.description),
@@ -372,7 +373,10 @@ export const WorkloadIdentityPoolProviderProvider = () =>
               !sameText(provider.description, description) ||
               (provider.disabled ?? false) !== (news.disabled ?? false) ||
               !sameText(provider.attributeCondition, news.attributeCondition) ||
-              !sameMapping(provider.attributeMapping, news.attributeMapping) ||
+              !sameMapping(
+                normalizeStringMap(provider.attributeMapping),
+                news.attributeMapping,
+              ) ||
               !sameText(provider.oidc?.issuerUri, news.oidc.issuerUri) ||
               !sameAudiences(
                 provider.oidc?.allowedAudiences,