@microagi/alchemy-gcp 0.2.1 → 0.3.0

package/CHANGELOG.md

@@ -0,0 +1,65 @@
+# Changelog
+
+All notable changes to `@microagi/alchemy-gcp`. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this package
+adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## 0.3.0 — 2026-05-11
+
+Cloud Run v2 — production polish on the Service + Job + IAM surface.
+
+### Added
+
+- **`GCP.Service`** — Cloud Run v2 HTTP service. Traffic routing,
+  ingress controls (`INGRESS_TRAFFIC_ALL` / `INTERNAL_ONLY` /
+  `INTERNAL_LOAD_BALANCER`), launch-stage gating, server-side
+  template diffing, label-gated adoption, and full LRO polling.
+- **`GCP.Job`** — Cloud Run v2 batch workload. Declarative
+  definition of the Job (template, parallelism, task count, retries,
+  GPU node selectors); execution is imperative via
+  `runProjectsLocationsJobs` (documented in the resource JSDoc).
+- **`GCP.serviceIamMember`** / **`GCP.jobIamMember`** — target-side
+  IAM binding helpers. Provider unions all bindings per target and
+  writes a single `setIamPolicy` per reconcile, preserving foreign
+  roles and members. Etag round-trip absorbs CI/human contention.
+- **Clean type re-exports** from the top level — `GCP.RevisionTemplate`,
+  `GCP.ExecutionTemplate`, `GCP.TaskTemplate`, `GCP.Container`,
+  `GCP.TrafficTarget`, `GCP.VpcAccess`, `GCP.NodeSelector`, etc. —
+  so consumers no longer need to import from `@distilled.cloud/gcp`
+  directly.
+- **Plan-time validation** for Cloud Run resources — name regex
+  (`<50 chars`, RFC 1123 label subset), reserved label/annotation
+  namespaces (`run.googleapis.com/`, `cloud.googleapis.com/`,
+  `serving.knative.dev/`, `autoscaling.knative.dev/`), and
+  template-must-have-containers. Fails fast with a typed
+  `ConfigError` before any state mutation.
+- **`BadRequest` passthroughs** on Cloud Run create + patch — wrap
+  the underlying GCP message with a remediation hint for billing
+  not enabled, image-not-in-approved-registry, and reserved-namespace
+  failures.
+
+### Changed
+
+- **Optimistic concurrency** on Cloud Run Service + Job — patch and
+  delete now pass the observed `etag` so concurrent edits (e.g. via
+  `gcloud run services update`) surface as `Conflict` instead of
+  silently overwriting.
+- README rewritten with categorised resource sections and Cloud Run
+  examples.
+
+### Notes
+
+`apps/cluster` and other downstream stacks bumping past `0.2.x` should
+swap `invokerIamDisabled: true` (sledgehammer) for the declarative
+`serviceIamMember(svc, "Public", { role: "roles/run.invoker", member: "allUsers" })`
+binding where possible — IAM history is auditable; the flag is not.
+
+## 0.2.x
+
+Pre-0.3 history is in `git log` — see commits up to and including
+`c6bcb9d Add Cloud Run v2 Service resource`. Highlights:
+
+- 0.2.0 — initial Cloud Run Service support (no IAM, no Job).
+- 0.1.x — Project, ApiEnable, Cluster, NodePool, Network, Subnetwork,
+  PsaConnection, GlobalAddress, SharedVpcHost, SharedVpcServiceProject,
+  ManagedLustreInstance.

package/README.md

@@ -79,27 +79,79 @@ bun alchemy destroy ./alchemy.run.ts
 
 `Alchemy.localState()` writes Alchemy's resource state to `.alchemy/` next to the stack file. `Alchemy.inMemoryState()` is fine for tests but loses state between runs. For team use, swap in `httpStateStore()`.
 
-Long-running operations (`createProjects`, `patchProjects`, GKE cluster ops) are polled internally; reconcilers follow the [Alchemy reconciler doctrine](https://v2.alchemy.run/concepts/resource-lifecycle) (single observe → ensure → sync → return flow that converges from any starting state, including adoption).
+Long-running operations (`createProjects`, `patchProjects`, GKE cluster ops, Cloud Run service deploys) are polled internally; reconcilers follow the [Alchemy reconciler doctrine](https://v2.alchemy.run/concepts/resource-lifecycle) (single observe → ensure → sync → return flow that converges from any starting state, including adoption).
 
 ## Resources
 
+### Foundation
 - **`GCP.Project`** — projects under an org or folder, with optional billing-account attach.
 - **`GCP.ApiEnable`** — project-level GCP service enablement.
+
+### Compute
 - **`GCP.Cluster`** — Standard GKE cluster.
 - **`GCP.NodePool`** — node pool attached to a cluster, including accelerator (GPU) configurations.
+
+### Networking
 - **`GCP.Network`** — VPC network.
 - **`GCP.Subnetwork`** — VPC subnetwork.
 - **`GCP.PsaConnection`** — Private Service Access peering for Google managed services.
 - **`GCP.GlobalAddress`** — global IP address (typically used to reserve a PSA range).
 - **`GCP.SharedVpcHost`** / **`GCP.SharedVpcServiceProject`** — Shared VPC enable/attach.
-- **`GCP.ParallelstoreInstance`** — Parallelstore filesystem instance.
+
+### Serverless (Cloud Run v2)
+- **`GCP.Service`** — Cloud Run HTTP service with traffic routing, ingress controls, and IAM.
+- **`GCP.Job`** — Cloud Run batch workload (declarative definition; trigger execution imperatively via `runProjectsLocationsJobs`).
+- **`GCP.serviceIamMember`** / **`GCP.jobIamMember`** — bind `(role, member)` IAM grants on Cloud Run resources. Provider unions all bindings and writes one `setIamPolicy` per target, preserving foreign roles.
+
+### Storage
+- **`GCP.ManagedLustreInstance`** — Managed Lustre filesystem instance.
 
 Each resource's full prop/attribute set is documented as JSDoc on the source.
 
+### Cloud Run example
+
+```ts
+const api = yield* GCP.Service("HelloApi", {
+  project: project.projectId,
+  location: "europe-west4",
+  template: {
+    containers: [{ image: "gcr.io/cloudrun/hello" }],
+  },
+});
+
+// Declarative public access — preferred over `invokerIamDisabled: true`,
+// which bypasses IAM entirely and leaves no audit trail.
+yield* GCP.serviceIamMember(api, "PublicInvoker", {
+  role: "roles/run.invoker",
+  member: "allUsers",
+});
+
+// Batch workload — definition only; execution is imperative.
+const batch = yield* GCP.Job("ProcessBatch", {
+  project: project.projectId,
+  location: "europe-west4",
+  template: {
+    taskCount: 1,
+    template: {
+      maxRetries: 3,
+      containers: [{ image: "europe-west4-docker.pkg.dev/proj/repo/worker:v1" }],
+    },
+  },
+});
+```
+
+Clean type aliases are re-exported from the top level so consumers don't need to import from `@distilled.cloud/gcp` directly: `GCP.RevisionTemplate`, `GCP.Container`, `GCP.TrafficTarget`, `GCP.VpcAccess`, `GCP.NodeSelector`, etc.
+
 ## Adoption
 
 `read` is gated on the alchemy internal labels `alchemy_app` / `alchemy_stage` / `alchemy_id`. Existing GCP resources lacking those labels are returned `Unowned` — the engine refuses to take them over without explicit `--adopt` (or `adopt(true)` on the resource call).
 
+For resources that don't carry labels (Network, Subnetwork), the same `(app, stage, id)` triple is encoded as a sentinel inside `description` and matched on `read`.
+
+## Optimistic concurrency
+
+Resources with server-side fingerprints (Cloud Run Service/Job, Subnetwork) pass the observed `etag`/`fingerprint` through patch and delete calls. A concurrent edit between observe and patch surfaces as `Conflict` rather than silently overwriting.
+
 ## License
 
 Apache-2.0.

package/lib/Providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AAwBtC,qBAAa,SAAU,SAAQ,cAA+C;CAAG;AAEjF,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,uQAuCnB,CAAC"}
+{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AA0BtC,qBAAa,SAAU,SAAQ,cAA+C;CAAG;AAEjF,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,uQA2CnB,CAAC"}

package/lib/Providers.js

@@ -11,6 +11,8 @@ import { Subnetwork, SubnetworkProvider } from "./Compute/Subnetwork.js";
 import { Cluster, ClusterProvider } from "./Container/Cluster.js";
 import { NodePool, NodePoolProvider } from "./Container/NodePool.js";
 import { ManagedLustreInstance, ManagedLustreInstanceProvider, } from "./ManagedLustre/Instance.js";
+import { Job, JobProvider } from "./Run/Job.js";
+import { Service, ServiceProvider } from "./Run/Service.js";
 import { PsaConnection, PsaConnectionProvider, } from "./ServiceNetworking/PsaConnection.js";
 import { ApiEnable, ApiEnableProvider } from "./ServiceUsage/ApiEnable.js";
 export class Providers extends Provider.ProviderCollection()("GCP") {
@@ -42,7 +44,9 @@ export const providers = () => Layer.effect(Providers, Provider.collection([
     SharedVpcServiceProject,
     PsaConnection,
     ManagedLustreInstance,
-])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), ClusterProvider(), NodePoolProvider(), ApiEnableProvider(), NetworkProvider(), SubnetworkProvider(), GlobalAddressProvider(), SharedVpcHostProvider(), SharedVpcServiceProjectProvider(), PsaConnectionProvider(), ManagedLustreInstanceProvider())), Layer.provideMerge(fromAuthProvider()), Layer.provideMerge(GCPAuth), 
+    Service,
+    Job,
+])).pipe(Layer.provide(Layer.mergeAll(ProjectProvider(), ClusterProvider(), NodePoolProvider(), ApiEnableProvider(), NetworkProvider(), SubnetworkProvider(), GlobalAddressProvider(), SharedVpcHostProvider(), SharedVpcServiceProjectProvider(), PsaConnectionProvider(), ManagedLustreInstanceProvider(), ServiceProvider(), JobProvider())), Layer.provideMerge(fromAuthProvider()), Layer.provideMerge(GCPAuth), 
 // Auth/config failures (missing ADC, malformed profile) become
 // unrecoverable defects rather than typed errors — mirrors
 // `AWS/Providers.ts` and `Cloudflare/Providers.ts`. Resource lifecycle

package/lib/Providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"Providers.js","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,MAAM,OAAO,SAAU,SAAQ,QAAQ,CAAC,kBAAkB,EAAa,CAAC,KAAK,CAAC;CAAG;AAIjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAC5B,KAAK,CAAC,MAAM,CACV,SAAS,EACT,QAAQ,CAAC,UAAU,CAAC;IAClB,OAAO;IACP,OAAO;IACP,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,aAAa;IACb,aAAa;IACb,uBAAuB;IACvB,aAAa;IACb,qBAAqB;CACtB,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,QAAQ,CACZ,eAAe,EAAE,EACjB,eAAe,EAAE,EACjB,gBAAgB,EAAE,EAClB,iBAAiB,EAAE,EACnB,eAAe,EAAE,EACjB,kBAAkB,EAAE,EACpB,qBAAqB,EAAE,EACvB,qBAAqB,EAAE,EACvB,+BAA+B,EAAE,EACjC,qBAAqB,EAAE,EACvB,6BAA6B,EAAE,CAChC,CACF,EACD,KAAK,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,EACtC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;AAC3B,+DAA+D;AAC/D,2DAA2D;AAC3D,uEAAuE;AACvE,0DAA0D;AAC1D,KAAK,CAAC,KAAK,CACZ,CAAC"}
+{"version":3,"file":"Providers.js","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EACL,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,aAAa,EACb,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,MAAM,OAAO,SAAU,SAAQ,QAAQ,CAAC,kBAAkB,EAAa,CAAC,KAAK,CAAC;CAAG;AAIjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAC5B,KAAK,CAAC,MAAM,CACV,SAAS,EACT,QAAQ,CAAC,UAAU,CAAC;IAClB,OAAO;IACP,OAAO;IACP,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,aAAa;IACb,aAAa;IACb,uBAAuB;IACvB,aAAa;IACb,qBAAqB;IACrB,OAAO;IACP,GAAG;CACJ,CAAC,CACH,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CACX,KAAK,CAAC,QAAQ,CACZ,eAAe,EAAE,EACjB,eAAe,EAAE,EACjB,gBAAgB,EAAE,EAClB,iBAAiB,EAAE,EACnB,eAAe,EAAE,EACjB,kBAAkB,EAAE,EACpB,qBAAqB,EAAE,EACvB,qBAAqB,EAAE,EACvB,+BAA+B,EAAE,EACjC,qBAAqB,EAAE,EACvB,6BAA6B,EAAE,EAC/B,eAAe,EAAE,EACjB,WAAW,EAAE,CACd,CACF,EACD,KAAK,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,EACtC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;AAC3B,+DAA+D;AAC/D,2DAA2D;AAC3D,uEAAuE;AACvE,0DAA0D;AAC1D,KAAK,CAAC,KAAK,CACZ,CAAC"}

package/lib/Run/IamMember.d.ts

@@ -0,0 +1,70 @@
+import * as Effect from "effect/Effect";
+import type { Job } from "./Job.ts";
+import type { Service } from "./Service.ts";
+/**
+ * Bind a single `(role, member)` IAM grant onto a Cloud Run
+ * {@link Service}.
+ *
+ * Target-side binding — see
+ * {@link import("../Compute/SubnetworkIamMember.ts").subnetworkIamMember}
+ * for the pattern, the SID-collision pitfall, and why `key` exists.
+ * Service's `reconcile` merges all bindings into a single
+ * `setIamPolicy` call against the service, preserving foreign roles
+ * and members on the policy. To remove a binding, drop the call and
+ * re-deploy — the provider is additive within the bindings we
+ * declared, but does NOT prune.
+ *
+ * The most common usage:
+ *
+ * - **Public invoker:** `{ role: "roles/run.invoker", member: "allUsers" }`
+ *   makes the service publicly reachable. Prefer this over
+ *   `invokerIamDisabled: true` on the {@link Service} props — declarative
+ *   IAM is auditable in `setIamPolicy` history; `invokerIamDisabled`
+ *   is a flag with no audit trail.
+ * - **Service-to-service:** a downstream service's runtime SA bound
+ *   to `roles/run.invoker` on the upstream service.
+ *
+ * @example Public Cloud Run service
+ * ```typescript
+ * const api = yield* GCP.Service("PublicApi", { ... });
+ * yield* GCP.serviceIamMember(api, "PublicInvoker", {
+ *   role: "roles/run.invoker",
+ *   member: "allUsers",
+ * });
+ * ```
+ *
+ * @example Service-to-service auth
+ * ```typescript
+ * const upstream = yield* GCP.Service("Upstream", { ... });
+ * yield* GCP.serviceIamMember(upstream, "DownstreamCaller", {
+ *   role: "roles/run.invoker",
+ *   member: `serviceAccount:${downstreamSa.email}`,
+ * });
+ * ```
+ */
+export declare const serviceIamMember: (service: Service, key: string, args: {
+    role: string;
+    member: string;
+}) => Effect.Effect<void>;
+/**
+ * Bind a single `(role, member)` IAM grant onto a Cloud Run {@link Job}.
+ *
+ * Same target-side pattern as {@link serviceIamMember}. The most
+ * common Job binding is `roles/run.invoker` on the service account
+ * that triggers the job (Cloud Scheduler, Eventarc, Workflows, or a
+ * developer's user identity).
+ *
+ * @example Letting a Cloud Scheduler SA trigger the job
+ * ```typescript
+ * const nightly = yield* GCP.Job("Nightly", { ... });
+ * yield* GCP.jobIamMember(nightly, "SchedulerInvoker", {
+ *   role: "roles/run.invoker",
+ *   member: `serviceAccount:${schedulerSa.email}`,
+ * });
+ * ```
+ */
+export declare const jobIamMember: (job: Job, key: string, args: {
+    role: string;
+    member: string;
+}) => Effect.Effect<void>;
+//# sourceMappingURL=IamMember.d.ts.map

package/lib/Run/IamMember.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IamMember.d.ts","sourceRoot":"","sources":["../../src/Run/IamMember.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,gBAAgB,GAC3B,SAAS,OAAO,EAChB,KAAK,MAAM,EACX,MAAM;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KACrC,MAAM,CAAC,MAAM,CAAC,IAAI,CAGiB,CAAC;AAEvC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,GACvB,KAAK,GAAG,EACR,KAAK,MAAM,EACX,MAAM;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KACrC,MAAM,CAAC,MAAM,CAAC,IAAI,CAGiB,CAAC"}

package/lib/Run/IamMember.js

@@ -0,0 +1,65 @@
+/**
+ * Bind a single `(role, member)` IAM grant onto a Cloud Run
+ * {@link Service}.
+ *
+ * Target-side binding — see
+ * {@link import("../Compute/SubnetworkIamMember.ts").subnetworkIamMember}
+ * for the pattern, the SID-collision pitfall, and why `key` exists.
+ * Service's `reconcile` merges all bindings into a single
+ * `setIamPolicy` call against the service, preserving foreign roles
+ * and members on the policy. To remove a binding, drop the call and
+ * re-deploy — the provider is additive within the bindings we
+ * declared, but does NOT prune.
+ *
+ * The most common usage:
+ *
+ * - **Public invoker:** `{ role: "roles/run.invoker", member: "allUsers" }`
+ *   makes the service publicly reachable. Prefer this over
+ *   `invokerIamDisabled: true` on the {@link Service} props — declarative
+ *   IAM is auditable in `setIamPolicy` history; `invokerIamDisabled`
+ *   is a flag with no audit trail.
+ * - **Service-to-service:** a downstream service's runtime SA bound
+ *   to `roles/run.invoker` on the upstream service.
+ *
+ * @example Public Cloud Run service
+ * ```typescript
+ * const api = yield* GCP.Service("PublicApi", { ... });
+ * yield* GCP.serviceIamMember(api, "PublicInvoker", {
+ *   role: "roles/run.invoker",
+ *   member: "allUsers",
+ * });
+ * ```
+ *
+ * @example Service-to-service auth
+ * ```typescript
+ * const upstream = yield* GCP.Service("Upstream", { ... });
+ * yield* GCP.serviceIamMember(upstream, "DownstreamCaller", {
+ *   role: "roles/run.invoker",
+ *   member: `serviceAccount:${downstreamSa.email}`,
+ * });
+ * ```
+ */
+export const serviceIamMember = (service, key, args) => service.bind `IamMember(${service}, ${key})`({
+    iamBindings: [{ role: args.role, members: [args.member] }],
+});
+/**
+ * Bind a single `(role, member)` IAM grant onto a Cloud Run {@link Job}.
+ *
+ * Same target-side pattern as {@link serviceIamMember}. The most
+ * common Job binding is `roles/run.invoker` on the service account
+ * that triggers the job (Cloud Scheduler, Eventarc, Workflows, or a
+ * developer's user identity).
+ *
+ * @example Letting a Cloud Scheduler SA trigger the job
+ * ```typescript
+ * const nightly = yield* GCP.Job("Nightly", { ... });
+ * yield* GCP.jobIamMember(nightly, "SchedulerInvoker", {
+ *   role: "roles/run.invoker",
+ *   member: `serviceAccount:${schedulerSa.email}`,
+ * });
+ * ```
+ */
+export const jobIamMember = (job, key, args) => job.bind `IamMember(${job}, ${key})`({
+    iamBindings: [{ role: args.role, members: [args.member] }],
+});
+//# sourceMappingURL=IamMember.js.map

package/lib/Run/IamMember.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IamMember.js","sourceRoot":"","sources":["../../src/Run/IamMember.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,OAAgB,EAChB,GAAW,EACX,IAAsC,EACjB,EAAE,CACvB,OAAO,CAAC,IAAI,CAAA,aAAa,OAAO,KAAK,GAAG,GAAG,CAAC;IAC1C,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;CAC3D,CAAmC,CAAC;AAEvC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,GAAQ,EACR,GAAW,EACX,IAAsC,EACjB,EAAE,CACvB,GAAG,CAAC,IAAI,CAAA,aAAa,GAAG,KAAK,GAAG,GAAG,CAAC;IAClC,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;CAC3D,CAAmC,CAAC"}

package/lib/Run/IamSync.d.ts

@@ -0,0 +1,80 @@
+import type * as run from "@distilled.cloud/gcp/run-v2";
+import type { ResourceBinding } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+/**
+ * Common shape of Cloud Run's `getIamPolicy` / `setIamPolicy` request
+ * inputs — Service and Job declare nominally distinct request types,
+ * but both reduce to `{ resource, body? }` plus the version query for
+ * get. We model the operation surface generically so {@link makeSyncIam}
+ * can serve both targets without duplication.
+ *
+ * @internal
+ */
+type GetIamPolicyOp = (input: {
+    resource: string;
+    "options.requestedPolicyVersion"?: number;
+}) => Effect.Effect<run.GoogleIamV1Policy, unknown, never>;
+type SetIamPolicyOp = (input: {
+    resource: string;
+    body?: run.GoogleIamV1SetIamPolicyRequest;
+}) => Effect.Effect<run.GoogleIamV1Policy, unknown, never>;
+/**
+ * Single `(role, members)` entry on a Cloud Run target's IAM policy.
+ * Identical shape between Service and Job — both Cloud Run resources
+ * speak the same `iam.v1.Policy`, so the binding contract is shared.
+ *
+ * @example
+ * ```typescript
+ * yield* GCP.serviceIamMember(svc, "PublicInvoker", {
+ *   role: "roles/run.invoker",
+ *   member: "allUsers",
+ * });
+ * ```
+ */
+export type RunIamBinding = {
+    /** IAM role, e.g. `"roles/run.invoker"`. */
+    role: string;
+    /** Principals, e.g. `["allUsers"]` or `["serviceAccount:foo@bar.iam.gserviceaccount.com"]`. */
+    members: ReadonlyArray<string>;
+};
+/**
+ * Binding contract for a Cloud Run target — services and jobs both
+ * accept a list of `iamBindings` records via the alchemy `.bind`
+ * mechanism. The reconciler reads `bindings` from its arguments and
+ * routes them through {@link makeSyncIam}.
+ */
+export type RunIamBindingContract = {
+    iamBindings: ReadonlyArray<RunIamBinding>;
+};
+/**
+ * Build a reusable `syncIam` step parametrised by the resolved
+ * `getIamPolicy` / `setIamPolicy` callables. Cloud Run's Service and
+ * Job IAM endpoints have identical request/response shapes (both
+ * `resource: "projects/{p}/locations/{l}/{kind}/{n}"`), so the same
+ * helper works for both — the caller just hands in the right pair of
+ * callables.
+ *
+ * Semantics, mirroring `Compute/Subnetwork.ts`:
+ *
+ * - **Union bindings per role across all `.bind` callers.** Multiple
+ *   capabilities granting the same role get their members merged into
+ *   a single binding.
+ * - **Preserve foreign roles and members verbatim.** We never displace
+ *   bindings we didn't author. The provider is additive — to remove a
+ *   binding, drop the `.bind` call and re-deploy (a future revision
+ *   could narrow this; for now it matches the existing idiom).
+ * - **Etag round-trip.** `getIamPolicy` returns an etag; we pass it
+ *   through `setIamPolicy` so a concurrent edit racing us surfaces as
+ *   `Conflict`. We retry exponentially up to ~1.5 min — enough to
+ *   absorb normal CI/human contention without masking real failures.
+ */
+export declare const makeSyncIam: (api: {
+    getIamPolicy: GetIamPolicyOp;
+    setIamPolicy: SetIamPolicyOp;
+}) => (args: {
+    /** Fully-qualified resource name: `projects/{p}/locations/{l}/{kind}/{n}`. */
+    resource: string;
+    bindings: ReadonlyArray<ResourceBinding<RunIamBindingContract>>;
+}) => Effect.Effect<void, unknown, never>;
+export {};
+//# sourceMappingURL=IamSync.d.ts.map

package/lib/Run/IamSync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IamSync.d.ts","sourceRoot":"","sources":["../../src/Run/IamSync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,GAAG,MAAM,6BAA6B,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC;;;;;;;;GAQG;AACH,KAAK,cAAc,GAAG,CAAC,KAAK,EAAE;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC,CAAC,EAAE,MAAM,CAAC;CAC3C,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAE3D,KAAK,cAAc,GAAG,CAAC,KAAK,EAAE;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,GAAG,CAAC,8BAA8B,CAAC;CAC3C,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAE3D;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CAC3C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,WAAW,GACrB,KAAK;IAAE,YAAY,EAAE,cAAc,CAAC;IAAC,YAAY,EAAE,cAAc,CAAA;CAAE,MACnE,MAAM;IACL,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,aAAa,CAAC,eAAe,CAAC,qBAAqB,CAAC,CAAC,CAAC;CACjE,wCAkDE,CAAC"}

package/lib/Run/IamSync.js

@@ -0,0 +1,73 @@
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+/**
+ * Build a reusable `syncIam` step parametrised by the resolved
+ * `getIamPolicy` / `setIamPolicy` callables. Cloud Run's Service and
+ * Job IAM endpoints have identical request/response shapes (both
+ * `resource: "projects/{p}/locations/{l}/{kind}/{n}"`), so the same
+ * helper works for both — the caller just hands in the right pair of
+ * callables.
+ *
+ * Semantics, mirroring `Compute/Subnetwork.ts`:
+ *
+ * - **Union bindings per role across all `.bind` callers.** Multiple
+ *   capabilities granting the same role get their members merged into
+ *   a single binding.
+ * - **Preserve foreign roles and members verbatim.** We never displace
+ *   bindings we didn't author. The provider is additive — to remove a
+ *   binding, drop the `.bind` call and re-deploy (a future revision
+ *   could narrow this; for now it matches the existing idiom).
+ * - **Etag round-trip.** `getIamPolicy` returns an etag; we pass it
+ *   through `setIamPolicy` so a concurrent edit racing us surfaces as
+ *   `Conflict`. We retry exponentially up to ~1.5 min — enough to
+ *   absorb normal CI/human contention without masking real failures.
+ */
+export const makeSyncIam = (api) => (args) => Effect.gen(function* () {
+    const desiredByRole = new Map();
+    for (const b of args.bindings) {
+        for (const ib of b.data.iamBindings) {
+            const set = desiredByRole.get(ib.role) ?? new Set();
+            for (const m of ib.members)
+                set.add(m);
+            desiredByRole.set(ib.role, set);
+        }
+    }
+    if (desiredByRole.size === 0)
+        return;
+    const current = yield* api.getIamPolicy({
+        resource: args.resource,
+        "options.requestedPolicyVersion": 3,
+    });
+    const bindings = (current.bindings ?? []).map((b) => ({
+        ...b,
+        members: [...(b.members ?? [])],
+    }));
+    let mutated = false;
+    for (const [role, members] of desiredByRole) {
+        let existing = bindings.find((b) => b.role === role && !b.condition);
+        if (!existing) {
+            existing = { role, members: [] };
+            bindings.push(existing);
+        }
+        const merged = new Set([...(existing.members ?? []), ...members]);
+        if (merged.size !== (existing.members?.length ?? 0))
+            mutated = true;
+        existing.members = [...merged];
+    }
+    if (!mutated)
+        return;
+    yield* api.setIamPolicy({
+        resource: args.resource,
+        body: {
+            policy: {
+                ...current,
+                bindings,
+                version: 3,
+            },
+        },
+    });
+}).pipe(Effect.retry({
+    schedule: Schedule.exponential(Duration.seconds(2)).pipe(Schedule.both(Schedule.recurs(8))),
+}));
+//# sourceMappingURL=IamSync.js.map

package/lib/Run/IamSync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IamSync.js","sourceRoot":"","sources":["../../src/Run/IamSync.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAmD5C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,WAAW,GACtB,CAAC,GAAmE,EAAE,EAAE,CACxE,CAAC,IAIA,EAAE,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACvC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAErC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,gCAAgC,EAAE,CAAC;KACpC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,GAAG,CAAC;QACJ,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;KAChC,CAAC,CAAC,CAAC;IACJ,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,aAAa,EAAE,CAAC;QAC5C,IAAI,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC;QACpE,QAAQ,CAAC,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO;IAErB,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,GAAG,OAAO;gBACV,QAAQ;gBACR,OAAO,EAAE,CAAC;aACX;SACF;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,KAAK,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACtD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAClC;CACF,CAAC,CACH,CAAC"}

package/lib/Run/Job.d.ts

@@ -0,0 +1,167 @@
+import * as run from "@distilled.cloud/gcp/run-v2";
+import { Resource } from "alchemy";
+import * as Provider from "alchemy/Provider";
+import type * as GCP from "../Providers.ts";
+import { type RunIamBindingContract } from "./IamSync.ts";
+/**
+ * A Cloud Run v2 Job — a managed batch workload. A Job holds an
+ * `ExecutionTemplate` (parallelism + a `TaskTemplate` containing
+ * containers); invoking the Job via `runProjectsLocationsJobs` creates
+ * an immutable Execution that runs the configured number of tasks to
+ * completion.
+ *
+ * **Declarative vs imperative.** This resource models the Job
+ * *definition* — its template, parallelism, task count, IAM. The act
+ * of *running* the Job is event-shaped (does not fit the
+ * converge-to-desired-state model) and is left to user-side code:
+ *
+ * ```typescript
+ * import * as run from "@distilled.cloud/gcp/run-v2";
+ * const job = yield* GCP.Job("Nightly", { ... });
+ * const runJob = yield* run.runProjectsLocationsJobs;
+ * yield* runJob({
+ *   name: `projects/${job.project}/locations/${job.location}/jobs/${job.name}`,
+ * });
+ * // returns an LRO; poll if you want to wait for completion
+ * ```
+ *
+ * **Lifecycle.** observe → ensure (create, retrying the API-enable
+ * race) → sync (patch full body if anything changed; Job's patch has
+ * no `updateMask` — server diffs the body itself) → sync IAM bindings
+ * → return.
+ *
+ * **Replace triggers.** Only identity fields (project, location, name)
+ * force replacement. Everything else is in-place via `patch`. New
+ * Executions are created independently by `runProjectsLocationsJobs`.
+ *
+ * **Optimistic concurrency.** Delete passes through the observed
+ * `etag`; patch passes etag in the body so concurrent edits surface
+ * as `Conflict` instead of silently overwriting.
+ *
+ * **Adoption.** Label-gated, same as {@link import("./Service.ts").Service}.
+ *
+ * **IAM.** Use {@link import("./IamMember.ts").jobIamMember} to bind
+ * `(role, member)` grants — typically `roles/run.invoker` on the
+ * service account that triggers the job.
+ *
+ * @section Creating a Cloud Run Job
+ * @example Single-shot batch job
+ * ```typescript
+ * const job = yield* GCP.Job("ProcessBatch", {
+ *   project: project.projectId,
+ *   location: "europe-west4",
+ *   template: {
+ *     taskCount: 1,
+ *     template: {
+ *       maxRetries: 3,
+ *       containers: [{
+ *         image: "europe-west4-docker.pkg.dev/proj/repo/worker:latest",
+ *       }],
+ *     },
+ *   },
+ * });
+ * ```
+ *
+ * @example Parallel job with custom service account and GPU
+ * ```typescript
+ * const train = yield* GCP.Job("Train", {
+ *   project: project.projectId,
+ *   location: "europe-west4",
+ *   launchStage: "BETA",
+ *   template: {
+ *     taskCount: 8,
+ *     parallelism: 8,
+ *     template: {
+ *       serviceAccount: sa.email,
+ *       maxRetries: 0,
+ *       timeout: "21600s",
+ *       containers: [{
+ *         image: "europe-west4-docker.pkg.dev/proj/repo/train:v2",
+ *         resources: { limits: { cpu: "4", memory: "16Gi", "nvidia.com/gpu": "1" } },
+ *       }],
+ *       nodeSelector: { accelerator: "nvidia-l4" },
+ *     },
+ *   },
+ * });
+ * ```
+ */
+export type JobProps = {
+    /** GCP project ID hosting the Job. Immutable — replace if changed. */
+    project: string;
+    /** Cloud Run region. Immutable — replace if changed. */
+    location: string;
+    /**
+     * Job name. Defaults to `createPhysicalName({ id, lowercase: true,
+     * maxLength: 49 })`. Lowercase letters/digits/hyphens; must begin
+     * with a letter and not end with a hyphen; **fewer than 50 characters**.
+     * Immutable — replace if changed.
+     */
+    name?: string;
+    /** User-visible description. Mutable via `patch`. */
+    description?: string;
+    /**
+     * Resource labels. Alchemy internal labels are merged on top
+     * automatically. Cloud Run rejects reserved namespaces (same as
+     * Service). Mutable via `patch`.
+     */
+    labels?: Record<string, string>;
+    /** Free-form annotations. Mutable via `patch`. */
+    annotations?: Record<string, string>;
+    /**
+     * Launch stage — `BETA` (or higher) required for preview features
+     * (GPU node selectors, Direct VPC). Mutable via `patch`.
+     */
+    launchStage?: "ALPHA" | "BETA" | "GA" | "EARLY_ACCESS" | "PRELAUNCH" | "DEPRECATED";
+    /** Binary Authorization policy. Mutable via `patch`. */
+    binaryAuthorization?: run.GoogleCloudRunV2BinaryAuthorization;
+    /**
+     * Token-suffix used to compose Execution names when the Job is
+     * started via the GCP UI or `gcloud run jobs execute`. Required to
+     * keep distinct from Job name + 63 chars. Mutable.
+     */
+    startExecutionToken?: string;
+    /** Same as `startExecutionToken` but used on run completion. Mutable. */
+    runExecutionToken?: string;
+    /**
+     * The Execution template — describes parallelism, task count, and
+     * the inner `TaskTemplate` (containers, volumes, retry policy).
+     * **Required at create.** Mutable via `patch`.
+     */
+    template: run.GoogleCloudRunV2ExecutionTemplate;
+};
+export type JobAttributes = {
+    /** Job name (bare). */
+    name: string;
+    /** Server-assigned UID. */
+    uid: string;
+    /** Fully-qualified resource name. */
+    resourceName: string;
+    /** GCP project ID. */
+    project: string;
+    /** Region. */
+    location: string;
+    /** Monotonically increasing generation, bumped on every patch. */
+    generation: string | undefined;
+    /** Generation reflected in the latest reconciled state. */
+    observedGeneration: string | undefined;
+    /** Overall readiness condition. */
+    terminalCondition: run.GoogleCloudRunV2Condition | undefined;
+    /** Number of Executions created for this Job. */
+    executionCount: number | undefined;
+    /** Reference to the most recently created Execution, if any. */
+    latestCreatedExecution: run.GoogleCloudRunV2ExecutionReference | undefined;
+    /** True while Cloud Run is reconciling toward the desired state. */
+    reconciling: boolean | undefined;
+    /** Optimistic-concurrency etag. */
+    etag: string | undefined;
+    /** Labels currently set, including internals. */
+    labels: Record<string, string>;
+    /** Creation time. */
+    createTime: string | undefined;
+    /** Last-modified time. */
+    updateTime: string | undefined;
+};
+export type Job = Resource<"GCP.Job", JobProps, JobAttributes, RunIamBindingContract, GCP.Providers>;
+export declare const Job: import("alchemy").ResourceClass<Job>;
+export declare const JobProvider: () => import("effect/Layer").Layer<Provider.Provider<Job>, never, import("effect/unstable/http/HttpClient").HttpClient | import("alchemy").Stage | import("alchemy").Stack | import("@distilled.cloud/gcp").Credentials>;
+//# sourceMappingURL=Job.d.ts.map